Inactive firewall error

[Inactive] firewall error

my mcafee firewall keeps on turning itself of. i am running the windows firewall until;l problem resolved. as requested to follow are the 2 logs from dds

 

dds log 1

DDS (Ver_10-03-17.01) - NTFSx86
Run by keith at 22:27:31.79 on 27/09/2010
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_21
Microsoft Windows XP Home Edition 5.1.2600.3.1252.44.1033.18.958.394 [GMT 1:00]

AV: McAfee VirusScan *On-access scanning enabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *disabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
C:\WINDOWS\system32\mfevtps.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Documents and Settings\keith\Local Settings\Temporary Internet Files\Content.IE5\X6SBOI12\dds[1].scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://uk.yahoo.com/?p=us
uWindow Title = Windows Internet Explorer provided by Yahoo!
uDefault_Page_URL = hxxp://www.yahoo.com/?fr=fp-yie8
uSearch Bar = hxxp://www.crawler.com/search/dispatcher.aspx?tp=aus&qkw=%s&tbid=60076
mSearch Bar = hxxp://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/sb/*http://uk.docs.yahoo.com/info/bt_side.html
uInternet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
TB: {472734EA-242A-422B-ADF8-83D1E48CC825} - No File
TB: {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - No File
TB: Zynga Toolbar: {7b13ec3e-999a-4b70-b9cb-2617b8323822} - c:\program files\zynga\tbZyng.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [TomTomHOME.exe] "c:\program files\tomtom home 2\TomTomHOMERunner.exe "
mRun: [WinPatrol] c:\program files\billp studios\winpatrol\winpatrol.exe
mRun: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
mRun: [NWEReboot]
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe "
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [mcui_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey
mPolicies-system: EnableLUA = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office12\EXCEL.EXE/3000
IE: {53F6FCCD-9E22-4d71-86EA-6E43136192AB}
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - c:\program files\yahoo!\messenger\YahooMessenger.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\mi1933~1\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mi1933~1\office12\REFIEBAR.DLL
DPF: ChatSpace Full Java Client 3.1.0.248 - hxxp://chat-c2.orange.co.uk/Java/cfs31248.cab
DPF: JT's Blocks - hxxp://origin.games.yahoo.net/games/clients/y/blt1_x.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: Video Poker - hxxp://origin.games.yahoo.net/games/clients/y/vpt0_x.cab
DPF: Yahoo! Cribbage - hxxp://origin.games.yahoo.net/games/clients/y/it1_x.cab
DPF: Yahoo! Dominoes - hxxp://origin.games.yahoo.net/games/clients/y/dot9_x.cab
DPF: Yahoo! Gin - hxxp://origin.games.yahoo.net/games/clients/y/nt1_x.cab
DPF: Yahoo! Hearts - hxxp://origin.games.yahoo.net/games/clients/y/ht1_x.cab
DPF: Yahoo! Poker - hxxp://origin.games.yahoo.net/games/clients/y/pt3_x.cab
DPF: Yahoo! Pyramids - hxxp://origin.games.yahoo.net/games/clients/y/pyt1_x.cab
DPF: Yahoo! Spades - hxxp://origin.games.yahoo.net/games/clients/y/st3_x.cab
DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {27527D31-447B-11D5-A46E-0001023B4289} - hxxp://gamingzone.ubisoft.com/dev/packages/GSManager.cab
DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll
DPF: {41ACD49D-1974-791A-0981-AA9872721044} - hxxp://download.gamedesire.com/g_bin/eng/boards_2_0_0_35.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1229625584546
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1208516062093
DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} - hxxp://cid-a103cdc24413a1d5.spaces.live.com/PhotoUpload/MsnPUpld.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll
mASetup: {A509B1FF-37FF-4bFF-8CFF-4F3A747040FF} - c:\windows\system32\rundll32.exe c:\windows\system32\advpack.dll,launchinfsectionex c:\program files\internet explorer\clrtour.inf,DefaultInstall.ResetTour,,12

============= SERVICES / DRIVERS ===============

R0 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2010-9-16 386712]
R1 mfetdi2k;McAfee Inc. mfetdi2k;c:\windows\system32\drivers\mfetdi2k.sys [2010-9-16 84072]
R2 McNaiAnn;McAfee VirusScan Announcer; "c:\program files\common files\mcafee\mcsvchost\McSvHost.exe" /McCoreSvc [2010-9-16 271480]
R2 McProxy;McAfee Proxy Service; "c:\program files\common files\mcafee\mcsvchost\McSvHost.exe" /McCoreSvc [2010-9-16 271480]
R2 McShield;McShield;c:\program files\common files\mcafee\systemcore\mcshield.exe [2010-9-16 171168]
R2 mfefire;McAfee Firewall Core Service;c:\program files\common files\mcafee\systemcore\mfefire.exe [2010-9-16 188136]
R2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [2010-9-16 141792]
R2 TomTomHOMEService;TomTomHOMEService;c:\program files\tomtom home 2\TomTomHOMEService.exe [2010-8-24 92008]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2010-9-6 38224]
R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2010-9-16 152992]
R3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2010-9-16 52104]
R3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [2010-9-16 312904]
R3 mfendiskmp;mfendiskmp;c:\windows\system32\drivers\mfendisk.sys [2010-9-16 88544]
S3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [2010-9-16 55840]
S3 FlashUSB;FlashUSB;c:\windows\system32\drivers\FlashUsb.sys [2009-12-5 16896]
S3 mfendisk;McAfee Core NDIS Intermediate Filter;c:\windows\system32\drivers\mfendisk.sys [2010-9-16 88544]
S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [2010-9-16 84264]
S4 0173021285597552mcinstcleanup;McAfee Application Installer Cleanup (0173021285597552);c:\docume~1\keith\locals~1\temp\017302~1.exe c:\progra~1\common~1\mcafee\instal~1\cleanup.ini -cleanup -nolog -service --> c:\docume~1\keith\locals~1\temp\017302~1.exe c:\progra~1\common~1\mcafee\instal~1\cleanup.ini -cleanup -nolog -service [?]
S4 EraserSvc10910;Symantec Eraser Service; "c:\program files\common files\symantec shared\ccsvchst.exe" /h cccommon --> c:\program files\common files\symantec shared\ccSvcHst.exe [?]
S4 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-5-15 136176]
S4 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\mcafee\siteadvisor\McSACore.exe [2010-5-8 203280]
S4 McMPFSvc;McAfee Personal Firewall; "c:\program files\common files\mcafee\mcsvchost\McSvHost.exe" /McCoreSvc [2010-9-16 271480]
S4 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2008-8-22 24652]

=============== Created Last 30 ================

2010-09-27 12:59:39 0 d-----w- c:\docume~1\keith\applic~1\NCH Software
2010-09-27 12:33:33 0 d-----w- c:\windows\system32\XPSViewer
2010-09-25 21:36:54 0 d-----w- c:\program files\Zynga
2010-09-21 15:33:28 0 d-----w- c:\docume~1\keith\applic~1\Windows Desktop Search
2010-09-16 19:45:40 9344 ----a-w- c:\windows\system32\drivers\mfeclnk.sys
2010-09-16 19:45:11 141792 ----a-w- c:\windows\system32\mfevtps.exe
2010-09-16 19:45:07 95600 ----a-w- c:\windows\system32\drivers\mfeapfk.sys
2010-09-16 19:45:07 88544 ----a-w- c:\windows\system32\drivers\mfendisk.sys
2010-09-16 19:45:07 84264 ----a-w- c:\windows\system32\drivers\mferkdet.sys
2010-09-16 19:45:07 84072 ----a-w- c:\windows\system32\drivers\mfetdi2k.sys
2010-09-16 19:45:07 55840 ----a-w- c:\windows\system32\drivers\cfwids.sys
2010-09-16 19:45:07 52104 ----a-w- c:\windows\system32\drivers\mfebopk.sys
2010-09-16 19:45:07 386712 ----a-w- c:\windows\system32\drivers\mfehidk.sys
2010-09-16 19:45:07 312904 ----a-w- c:\windows\system32\drivers\mfefirek.sys
2010-09-16 19:45:07 152992 ----a-w- c:\windows\system32\drivers\mfeavfk.sys
2010-09-16 15:48:53 0 dc-h--w- c:\windows\ie8
2010-09-06 16:20:18 0 d-----w- c:\docume~1\keith\applic~1\Malwarebytes
2010-09-06 16:19:44 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-09-06 16:19:42 0 d-----w- c:\docume~1\alluse~1.win\applic~1\Malwarebytes
2010-09-06 16:19:38 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-09-06 16:19:37 0 d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-09-04 19:12:33 690068 ----a-w- c:\windows\system32\drivers\Cat.DB
2010-09-04 18:41:47 0 d-----w- c:\docume~1\alluse~1.win\applic~1\PC Tools
2010-09-04 18:35:03 0 d-----w- c:\program files\WindowsClear
2010-09-04 17:21:10 0 d-----w- c:\program files\common files\xing shared
2010-09-03 20:10:35 0 d-----w- c:\windows\system32\Adobe
2010-09-03 19:54:25 73728 ----a-w- c:\windows\system32\javacpl.cpl
2010-08-31 17:18:22 0 d-----w- c:\docume~1\keith\applic~1\BBCiPlayerDesktop.61DB7A798358575D6A969CCD73DDBBD723A6DA9D.1
2010-08-31 17:07:46 0 d-----w- c:\program files\BBC iPlayer Desktop

==================== Find3M ====================

2010-09-04 17:19:54 348160 ----a-w- c:\windows\system32\msvcr71.dll
2010-09-04 14:19:11 361600 ----a-w- c:\windows\system32\drivers\tcpip.sys
2010-09-03 19:53:05 423656 ----a-w- c:\windows\system32\deployJava1.dll
2010-08-17 13:17:06 58880 ----a-w- c:\windows\system32\spoolsv.exe
2010-07-22 15:49:15 590848 ----a-w- c:\windows\system32\rpcrt4.dll
2010-07-22 05:57:20 5120 ------w- c:\windows\system32\xpsp4res.dll
2010-06-30 12:31:35 149504 ----a-w- c:\windows\system32\schannel.dll
2008-10-01 15:03:41 774144 -c--a-w- c:\program files\RngInterstitial.dll
2008-09-23 15:50:07 8192 --sha-w- c:\program files\common files\Thumbs.db
2008-09-23 15:49:45 5632 -csha-w- c:\program files\Thumbs.db
2010-06-01 10:40:45 16384 --sha-w- c:\windows\temp\temporary internet files\content.ie5\index.dat

============= FINISH: 22:29:35.18 ===============

 

dds attach log

DDS (Ver_10-03-17.01)

Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume2
Install Date: 18/04/2008 09:08:52
System Uptime: 27/09/2010 22:19:38 (0 hours ago)

Motherboard: Dell Inc | |
Processor: AMD Athlon(tm) 64 X2 Dual Core Processor 3600+ | Socket M2 | 1903/1000mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 171 GiB total, 150.603 GiB free.
D: is FIXED (NTFS) - 58 GiB total, 39.41 GiB free.
E: is CDROM ()

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP825: 20/07/2010 21:43:54 - System Checkpoint
RP826: 23/07/2010 22:16:23 - System Checkpoint
RP827: 24/07/2010 22:42:34 - System Checkpoint
RP828: 26/07/2010 18:28:48 - System Checkpoint
RP829: 27/07/2010 22:31:38 - System Checkpoint
RP830: 29/07/2010 11:28:57 - System Checkpoint
RP831: 30/07/2010 13:19:07 - System Checkpoint
RP832: 31/07/2010 22:25:01 - System Checkpoint
RP833: 02/08/2010 12:21:46 - System Checkpoint
RP834: 03/08/2010 22:37:05 - System Checkpoint
RP835: 05/08/2010 19:55:04 - System Checkpoint
RP836: 07/08/2010 21:28:53 - System Checkpoint
RP837: 10/08/2010 22:25:09 - System Checkpoint
RP838: 10/08/2010 23:46:21 - Installed Java(TM) 6 Update 20
RP839: 11/08/2010 13:25:21 - Installed Java(TM) 6 Update 21
RP840: 12/08/2010 15:43:55 - System Checkpoint
RP841: 13/08/2010 17:57:59 - System Checkpoint
RP842: 14/08/2010 18:40:48 - System Checkpoint
RP843: 15/08/2010 19:17:00 - System Checkpoint
RP844: 16/08/2010 19:49:56 - System Checkpoint
RP845: 17/08/2010 20:29:17 - System Checkpoint
RP846: 19/08/2010 16:04:32 - System Checkpoint
RP847: 20/08/2010 19:13:37 - System Checkpoint
RP848: 21/08/2010 19:45:31 - System Checkpoint
RP849: 23/08/2010 12:33:26 - System Checkpoint
RP850: 25/08/2010 09:19:53 - System Checkpoint
RP851: 26/08/2010 13:58:06 - System Checkpoint
RP852: 27/08/2010 14:22:19 - System Checkpoint
RP853: 28/08/2010 17:04:57 - System Checkpoint
RP854: 30/08/2010 17:52:17 - System Checkpoint
RP855: 31/08/2010 20:07:30 - System Checkpoint
RP856: 01/09/2010 20:40:53 - System Checkpoint
RP857: 02/09/2010 21:39:12 - System Checkpoint
RP858: 03/09/2010 19:38:34 - Installed Java(TM) 6 Update 20
RP859: 03/09/2010 19:45:48 - Installed QuickTime
RP860: 03/09/2010 19:53:53 - Installed Java(TM) 6 Update 20
RP861: 03/09/2010 20:15:11 - Removed Java(TM) 6 Update 20
RP862: 03/09/2010 20:16:59 - Installed Java(TM) 6 Update 20
RP863: 03/09/2010 20:21:13 - Removed Java(TM) 6 Update 20
RP864: 03/09/2010 20:23:05 - Removed Java(TM) 6 Update 20
RP865: 03/09/2010 20:24:46 - Removed Java(TM) 6 Update 4
RP866: 03/09/2010 20:26:31 - Removed Java(TM) 6 Update 5
RP867: 03/09/2010 20:27:48 - Removed Java(TM) 6 Update 7
RP868: 03/09/2010 20:52:38 - Installed Java(TM) 6 Update 21
RP869: 03/09/2010 21:24:17 - Installed Microsoft Fix it 50202
RP870: 04/09/2010 00:47:37 - Removed Adobe Reader 8.2.4
RP871: 04/09/2010 15:23:52 - Removed Microsoft Silverlight
RP872: 04/09/2010 15:53:16 - Software Distribution Service 3.0
RP873: 04/09/2010 16:11:22 - Software Distribution Service 3.0
RP874: 04/09/2010 16:56:57 - Software Distribution Service 3.0
RP875: 04/09/2010 17:27:01 - Software Distribution Service 3.0
RP876: 04/09/2010 17:33:59 - Removed Microsoft Silverlight
RP877: 04/09/2010 18:55:23 - Software Distribution Service 3.0
RP878: 04/09/2010 19:03:41 - Installed Adobe Reader 9.3.4.
RP879: 04/09/2010 19:21:08 - Removed QuickTime
RP880: 04/09/2010 21:09:48 - Software Distribution Service 3.0
RP881: 04/09/2010 21:46:47 - Spyware Terminator - restore point
RP882: 05/09/2010 22:00:09 - System Checkpoint
RP883: 07/09/2010 18:47:36 - System Checkpoint
RP884: 07/09/2010 23:12:54 - Spyware Terminator - restore point
RP885: 09/09/2010 15:30:02 - System Checkpoint
RP886: 10/09/2010 18:05:05 - System Checkpoint
RP887: 11/09/2010 18:11:43 - System Checkpoint
RP888: 14/09/2010 17:15:52 - Installed DirectX
RP889: 15/09/2010 21:22:16 - System Checkpoint
RP890: 16/09/2010 16:26:43 - Software Distribution Service 3.0
RP891: 16/09/2010 16:51:07 - Installed Windows Internet Explorer 8.
RP892: 16/09/2010 16:53:20 - Software Distribution Service 3.0
RP893: 17/09/2010 17:11:50 - Software Distribution Service 3.0
RP894: 17/09/2010 22:39:27 - Software Distribution Service 3.0
RP895: 19/09/2010 17:09:08 - System Checkpoint
RP896: 20/09/2010 17:50:26 - System Checkpoint
RP897: 21/09/2010 16:30:22 - Installed Windows XP KB915800-v4.
RP898: 21/09/2010 16:31:15 - Installed Windows XP Windows Search 4.0.
RP899: 22/09/2010 16:59:57 - Software Distribution Service 3.0
RP900: 23/09/2010 17:02:52 - System Checkpoint
RP901: 24/09/2010 18:29:23 - System Checkpoint
RP902: 24/09/2010 20:49:17 - Removed Microsoft Silverlight
RP903: 24/09/2010 20:52:42 - Removed Microsoft SQL Server 2005 Compact Edition [ENU]
RP904: 25/09/2010 21:05:27 - System Checkpoint
RP905: 27/09/2010 12:38:16 - Installed Microsoft Download Manager
RP906: 27/09/2010 12:51:00 - Removed Microsoft Download Manager
RP907: 27/09/2010 13:40:08 - Installed Microsoft Phone Data Manager (beta)
RP908: 27/09/2010 13:49:30 - Removed Microsoft Phone Data Manager (beta)

==== Installed Programs ======================

505 Game Collection
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Reader 9.3.4
Adobe Shockwave Player 11.5
ALZip
Apple Application Support
Apple Software Update
Athlon 64 Processor Driver
µTorrent
AVI Codec Pack
BBC iPlayer Desktop
BBC iPlayer Download Manager
Broadcom 440x 10/100 Integrated Controller
BT NetProtect Plus
BTHomeHub
Dell Resource CD
FaxTools
FreeUndelete
Google Earth Plug-in
Google Update Helper
High Definition Audio Driver Package - KB835221
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows XP (KB915800-v4)
Hotfix for Windows XP (KB915865)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB954708)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB979306)
Hotfix for Windows XP (KB981793)
Infineon USB driver 1.0.0.6
Java Auto Updater
Java(TM) 6 Update 21
LG Internet Kit
LG PC Suite II
LG USB Modem driver
Logitech Legacy USB Camera Driver Package
Logitech QuickCam
Logitech QuickCam Driver Package
Logitech Updater
Malwarebytes' Anti-Malware
Microsoft .NET Framework 2.0
Microsoft .NET Framework 3.0
Microsoft Application Error Reporting
Microsoft Calculator Plus
Microsoft Choice Guard
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office Live Add-in 1.5
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook Connector
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Software Update for Web Folders (English) 12
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
MSVCRT
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 6.0 Parser (KB925673)
neroxml
NVIDIA Drivers
PhotoPad Image Editor
Quicken 2007
RealPlayer
RealUpgrade 1.0
Recuva
Security Update for 2007 Microsoft Office System (KB2277947)
Security Update for 2007 Microsoft Office System (KB2288621)
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB976321)
Security Update for 2007 Microsoft Office System (KB982312)
Security Update for 2007 Microsoft Office System (KB982331)
Security Update for Microsoft Office Access 2007 (KB979440)
Security Update for Microsoft Office Excel 2007 (KB982308)
Security Update for Microsoft Office InfoPath 2007 (KB979441)
Security Update for Microsoft Office Outlook 2007 (KB2288953)
Security Update for Microsoft Office PowerPoint 2007 (KB982158)
Security Update for Microsoft Office Publisher 2007 (KB982124)
Security Update for Microsoft Office system 2007 (972581)
Security Update for Microsoft Office system 2007 (KB974234)
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
Security Update for Microsoft Office Word 2007 (KB2251419)
Security Update for Windows Internet Explorer 7 (KB2183461)
Security Update for Windows Internet Explorer 7 (KB938127-v2)
Security Update for Windows Internet Explorer 7 (KB972260)
Security Update for Windows Internet Explorer 7 (KB974455)
Security Update for Windows Internet Explorer 7 (KB976325)
Security Update for Windows Internet Explorer 7 (KB978207)
Security Update for Windows Internet Explorer 8 (KB2183461)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB975558)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player 10 (KB936782)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Search 4 - KB963093
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2121546)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2286198)
Security Update for Windows XP (KB2347290)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB938464-v2)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950759)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953838)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956390)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972260)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977165)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981322)
Security Update for Windows XP (KB981349)
Security Update for Windows XP (KB981852)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982665)
Security Update for Windows XP (KB982802)
Segoe UI
SigmaTel Audio
Skypeâ„¢ 4.2
Switch Sound File Converter
TomTom HOME 2.7.6.2056
TomTom HOME Visual Studio Merge Modules
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft Office OneNote 2007 (KB980729)
Update for Microsoft Windows (KB971513)
Update for Outlook 2007 Junk Email Filter (kb2291599)
Update for Windows Internet Explorer 7 (KB976749)
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows Internet Explorer 8 (KB982664)
Update for Windows XP (KB2141007)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB955839)
Update for Windows XP (KB961503)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
USB Flash Port Driver
Viewpoint Manager (Remove Only)
Viewpoint Media Player
WebFldrs XP
Windows Communication Foundation
Windows Driver Package - Infineon Technologies (FlashUSB) USB (04/16/2009 1.0.0.6)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Imaging Component
Windows Internet Explorer 7
Windows Internet Explorer 8
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live ID Sign-in Assistant
Windows Live Messenger
Windows Live Sync
Windows Live Upload Tool
Windows Presentation Foundation
Windows Search 4.0
Windows Workflow Foundation
Windows XP Service Pack 3
WinPatrol
WinPatrol 2007 Restore/Remove First
Yahoo! Install Manager
Yahoo! Messenger
Yahoo! Search Protection
Yahoo! Software Update
Zynga Toolbar

==== Event Viewer Messages From Past Week ========

24/09/2010 20:49:42, error: Service Control Manager [7023] - The Application Management service terminated with the following error: The specified module could not be found.
24/09/2010 18:24:14, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service McAfee SiteAdvisor Service with arguments " " in order to run the server: {5A90F5EE-16B8-4C2A-81B3-FD5329BA477C}
24/09/2010 15:18:36, error: Service Control Manager [7001] - The Wireless Zero Configuration service depends on the NDIS Usermode I/O Protocol service which failed to start because of the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
24/09/2010 15:18:36, error: Service Control Manager [7000] - The Automatic LiveUpdate Scheduler service failed to start due to the following error: The system cannot find the path specified.
23/09/2010 16:34:24, error: Service Control Manager [7023] - The KService service terminated with the following error: Unspecified error

==== End Of File ===========================

 

malware log

step one has been completed, as i have maleware here is last nights log

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4555

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

27/09/2010 23:57:04
mbam-log-2010-09-27 (23-57-04).txt

Scan type: Full scan (C:\|D:\|)
Objects scanned: 298166
Time elapsed: 1 hour(s), 30 minute(s), 50 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

 

re admin p2p

i understand the concerns of admin regarding p2p software, i always run scans on the downloads before opening but will remove p2p if u think its wise

 

blue stop

whilst running gmer my computer stopped with the blue screen

caused by kgwdqaow.sys page fault in non paged area

stop 0x00000050 (0xb8e29b30, 0x00000001. 0xb8b49fa6. 0x00000000)

kgwdqaow.sys address b8b49fa6 base at b8b3e000 datestamp 4b274f8d

when re starting i got an error message from gmer

WARNING!!! gmer found system modification caused by rootkit activity

the following was listed in red

module\systemroot\system 32\drivers\uacd sys(hidden)

library d\windows\sysyem32\dll.dll\hidden)cd:\windows\system3\msi.exec.exe(1660)

service d/windows\system32\drivers\uac mdivrtng.sys(hidden)

file d/windows\system32\drivers\uac mdivrtng.sys

 

sorry but no matter what i do the scan crashes my computer and i am afraid i do not know how to enter safe mode or the admin account so am procedding to the mbr check

 

mbr check

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows XP Home Edition
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x0000001c

Kernel Drivers (total 115):
0x804D7000 \WINDOWS\system32\ntkrnlpa.exe
0x806E4000 \WINDOWS\system32\hal.dll
0xF7987000 \WINDOWS\system32\KDCOM.DLL
0xF7897000 \WINDOWS\system32\BOOTVID.dll
0xF7358000 ACPI.sys
0xF7989000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
0xF7347000 pci.sys
0xF7487000 isapnp.sys
0xF7A4F000 pciide.sys
0xF7707000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
0xF7497000 MountMgr.sys
0xF7328000 ftdisk.sys
0xF770F000 PartMgr.sys
0xF74A7000 VolSnap.sys
0xF7310000 atapi.sys
0xF7717000 cercsr6.sys
0xF72F8000 \WINDOWS\System32\Drivers\SCSIPORT.SYS
0xF74B7000 disk.sys
0xF74C7000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xF72D8000 fltmgr.sys
0xF72C6000 sr.sys
0xF7269000 mfehidk.sys
0xF74D7000 PxHelp20.sys
0xF7252000 KSecDD.sys
0xF723F000 WudfPf.sys
0xF71B2000 Ntfs.sys
0xF7185000 NDIS.sys
0xF716B000 Mup.sys
0xF7617000 \SystemRoot\system32\DRIVERS\AmdK8.sys
0xF6AE2000 \SystemRoot\system32\DRIVERS\nv4_mini.sys
0xF6ACE000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xF77AF000 \SystemRoot\system32\DRIVERS\usbohci.sys
0xF6AAA000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xF77B7000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xF7627000 \SystemRoot\system32\DRIVERS\imapi.sys
0xF7637000 \SystemRoot\system32\DRIVERS\cdrom.sys
0xF7647000 \SystemRoot\system32\DRIVERS\redbook.sys
0xF6A87000 \SystemRoot\system32\DRIVERS\ks.sys
0xF7657000 \SystemRoot\system32\DRIVERS\bcm4sbxp.sys
0xF6A5F000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0xF7B21000 \SystemRoot\system32\DRIVERS\audstub.sys
0xF6A4B000 \SystemRoot\system32\DRIVERS\mfendisk.sys
0xF76B7000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xF7937000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xF6A34000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xF76C7000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xF76D7000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xF77C7000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xF6A23000 \SystemRoot\system32\DRIVERS\psched.sys
0xF76E7000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xF69FF000 \SystemRoot\system32\drivers\mfeavfk.sys
0xF698C000 \SystemRoot\system32\drivers\mfefirek.sys
0xF77CF000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xF77D7000 \SystemRoot\system32\DRIVERS\raspti.sys
0xF76F7000 \SystemRoot\system32\DRIVERS\termdd.sys
0xF77DF000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xF77E7000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xF79B5000 \SystemRoot\system32\DRIVERS\swenum.sys
0xF68BF000 \SystemRoot\system32\DRIVERS\update.sys
0xF7973000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xF6793000 \SystemRoot\system32\drivers\sthda.sys
0xF676F000 \SystemRoot\system32\drivers\portcls.sys
0xF7517000 \SystemRoot\system32\drivers\drmk.sys
0xF7527000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xF7537000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xF79CF000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xF79D7000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xF7ABA000 \SystemRoot\System32\Drivers\Null.SYS
0xF79D9000 \SystemRoot\System32\Drivers\Beep.SYS
0xF780F000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0xF7817000 \SystemRoot\System32\drivers\vga.sys
0xF79DB000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xF79DD000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xF781F000 \SystemRoot\System32\Drivers\Msfs.SYS
0xF7827000 \SystemRoot\System32\Drivers\Npfs.SYS
0xF7923000 \SystemRoot\system32\DRIVERS\rasacd.sys
0xF3FE3000 \SystemRoot\system32\DRIVERS\ipsec.sys
0xF3F8A000 \SystemRoot\system32\DRIVERS\tcpip.sys
0xF3F77000 \SystemRoot\system32\drivers\mfetdi2k.sys
0xF3F51000 \SystemRoot\system32\DRIVERS\ipnat.sys
0xF3F29000 \SystemRoot\system32\DRIVERS\netbt.sys
0xF7927000 \SystemRoot\System32\drivers\ws2ifsl.sys
0xF3F07000 \SystemRoot\System32\drivers\afd.sys
0xF7557000 \SystemRoot\system32\DRIVERS\netbios.sys
0xF3EDC000 \SystemRoot\system32\DRIVERS\rdbss.sys
0xF3E6C000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xF7577000 \SystemRoot\System32\Drivers\Fips.SYS
0xF782F000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0xF69EF000 \SystemRoot\system32\DRIVERS\hidusb.sys
0xF7587000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0xF7597000 \SystemRoot\system32\drivers\LVUSBSta.sys
0xF3BFA000 \SystemRoot\system32\DRIVERS\LV302V32.SYS
0xF79E5000 \SystemRoot\system32\DRIVERS\lv302af.sys
0xF75A7000 \SystemRoot\system32\drivers\usbaudio.sys
0xF3B62000 \SystemRoot\system32\DRIVERS\lvrs.sys
0xF69EB000 \SystemRoot\system32\DRIVERS\mouhid.sys
0xF75B7000 \SystemRoot\system32\DRIVERS\wanarp.sys
0xF69D7000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0xF75E7000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xF460B000 \SystemRoot\System32\drivers\Dxapi.sys
0xF7867000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0xF7BB4000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF012000 \SystemRoot\System32\nv4_disp.dll
0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
0xBA4B3000 \SystemRoot\system32\DRIVERS\mrxdav.sys
0xBA344000 \SystemRoot\system32\DRIVERS\srv.sys
0xF7777000 \SystemRoot\system32\DRIVERS\LVPr2Mon.sys
0xB9D44000 \SystemRoot\system32\drivers\wdmaud.sys
0xB9E81000 \SystemRoot\system32\drivers\sysaudio.sys
0xB939A000 \SystemRoot\system32\drivers\mfeapfk.sys
0xB9CA4000 \SystemRoot\system32\drivers\mfebopk.sys
0xB88EF000 \SystemRoot\system32\drivers\kmixer.sys
0x7C900000 \WINDOWS\system32\ntdll.dll

Processes (total 43):
0 System Idle Process
4 System
916 C:\WINDOWS\system32\smss.exe
972 csrss.exe
996 C:\WINDOWS\system32\winlogon.exe
1040 C:\WINDOWS\system32\services.exe
1052 C:\WINDOWS\system32\lsass.exe
1224 C:\WINDOWS\system32\svchost.exe
1316 svchost.exe
1440 C:\WINDOWS\system32\svchost.exe
1480 C:\WINDOWS\system32\svchost.exe
1636 svchost.exe
1792 C:\WINDOWS\system32\spoolsv.exe
1924 svchost.exe
1976 svchost.exe
2028 C:\Program Files\Java\jre6\bin\jqs.exe
232 C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
284 C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
420 C:\WINDOWS\system32\mfevtps.exe
544 C:\WINDOWS\system32\nvsvc32.exe
692 C:\WINDOWS\system32\svchost.exe
968 C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
1280 wdfmgr.exe
1368 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
1868 C:\WINDOWS\system32\searchindexer.exe
556 C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
760 C:\WINDOWS\system32\wuauclt.exe
772 C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
840 C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
2380 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
2600 alg.exe
2820 C:\WINDOWS\explorer.exe
3488 C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe
3504 C:\WINDOWS\system32\rundll32.exe
3536 C:\Program Files\Common Files\Java\Java Update\jusched.exe
3576 C:\Program Files\McAfee.com\Agent\mcagent.exe
3588 C:\WINDOWS\system32\ctfmon.exe
2236 C:\Program Files\Internet Explorer\iexplore.exe
2700 C:\Program Files\Internet Explorer\iexplore.exe
3272 C:\Program Files\Internet Explorer\iexplore.exe
3452 C:\WINDOWS\system32\searchprotocolhost.exe
708 searchfilterhost.exe
3096 C:\Documents and Settings\keith.HOME-13887EE678.000\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`02738a00 (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x0000002a`df126200 (NTFS)

PhysicalDrive0 Model Number: ST3250820AS, Rev: 3.ADG

Size Device Name MBR Status
--------------------------------------------
232 GB \\.\PhysicalDrive0 Windows XP MBR code detected
SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A


Done!

 

combo fix log

ComboFix 10-09-30.03 - keith 01/10/2010 14:47:00.1.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.44.1033.18.958.364 [GMT 1:00]
Running from: c:\documents and settings\keith.HOME-13887EE678.000\Desktop\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\smp.bat
C:\Thumbs.db
c:\windows\system32\_000006_.tmp.dll
c:\windows\system32\ban_list.txt
c:\windows\system32\drivers\_VOIDd.sys
c:\windows\system32\drivers\srosa2.sys
c:\windows\system32\Thumbs.db
c:\windows\TEMP\logishrd\LVPrcInj01.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_SROSA


((((((((((((((((((((((((( Files Created from 2010-09-01 to 2010-10-01 )))))))))))))))))))))))))))))))
.

2010-09-30 20:40 . 2010-09-30 20:40 932368 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\profiles-1-6.dll
2010-09-30 20:40 . 2010-09-30 20:40 678416 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\content_interpreter-1-1.dll
2010-09-30 20:40 . 2010-09-30 20:40 604688 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\gsg-3-9.dll
2010-09-30 20:40 . 2010-09-30 20:40 1096208 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\filtration-4-6.dll
2010-09-30 20:40 . 2010-09-30 20:40 522768 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\database-1-5.dll
2010-09-30 20:01 . 2010-10-01 14:00 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Kaspersky Lab
2010-09-30 20:01 . 2010-09-30 20:01 -------- d-----w- c:\program files\Kaspersky Lab
2010-09-30 19:57 . 2010-09-30 19:57 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Kaspersky Lab Setup Files
2010-09-29 23:49 . 2010-09-29 23:49 -------- d-----w- c:\documents and settings\keith.HOME-13887EE678.000\Application Data\NCH Swift Sound
2010-09-29 23:44 . 2010-09-29 23:44 -------- d-----w- c:\documents and settings\keith.HOME-13887EE678.000\Application Data\EstSoft
2010-09-29 15:41 . 2010-09-29 15:41 -------- d-----w- c:\documents and settings\keith.HOME-13887EE678.000\Application Data\Windows Search
2010-09-29 10:35 . 2010-09-29 10:35 -------- d-----w- c:\documents and settings\keith.HOME-13887EE678.000\Application Data\Intuit
2010-09-29 00:04 . 2010-09-29 00:04 -------- d-sh--w- c:\documents and settings\keith.HOME-13887EE678.000\IECompatCache
2010-09-28 21:21 . 2010-09-28 21:21 -------- d-----w- c:\documents and settings\keith.HOME-13887EE678.000\Application Data\Malwarebytes
2010-09-28 20:42 . 2010-09-28 20:42 74648 ----a-w- c:\documents and settings\keith.HOME-13887EE678.000\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-09-28 20:35 . 2010-09-28 20:35 -------- d-----w- c:\windows\system32\wbem\Repository
2010-09-28 20:09 . 2010-09-28 20:09 503808 ----a-w- c:\documents and settings\keith.HOME-13887EE678.000\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-3dbfcc14-n\msvcp71.dll
2010-09-28 20:09 . 2010-09-28 20:09 499712 ----a-w- c:\documents and settings\keith.HOME-13887EE678.000\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-3dbfcc14-n\jmc.dll
2010-09-28 20:09 . 2010-09-28 20:09 348160 ----a-w- c:\documents and settings\keith.HOME-13887EE678.000\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-3dbfcc14-n\msvcr71.dll
2010-09-28 20:09 . 2010-09-28 20:09 61440 ----a-w- c:\documents and settings\keith.HOME-13887EE678.000\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-5c3346f4-n\decora-sse.dll
2010-09-28 20:09 . 2010-09-28 20:09 12800 ----a-w- c:\documents and settings\keith.HOME-13887EE678.000\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-5c3346f4-n\decora-d3d.dll
2010-09-28 19:30 . 2010-09-28 19:30 -------- d-sh--w- c:\documents and settings\keith.HOME-13887EE678.000\PrivacIE
2010-09-28 19:29 . 2010-09-28 22:46 -------- d-----w- c:\documents and settings\keith.HOME-13887EE678.000\Local Settings\Application Data\Adobe
2010-09-28 19:18 . 2010-09-30 20:41 -------- d-----r- c:\documents and settings\keith.HOME-13887EE678.000
2010-09-27 12:33 . 2010-09-28 14:07 -------- d-----w- c:\windows\system32\XPSViewer
2010-09-27 12:32 . 2010-09-27 12:32 -------- d-----w- c:\program files\Reference Assemblies
2010-09-25 21:36 . 2010-09-25 21:36 -------- d-----w- c:\program files\Zynga
2010-09-21 15:36 . 2010-09-23 17:51 -------- d-----w- c:\documents and settings\LocalService.NT AUTHORITY.000\Local Settings\Application Data\Adobe
2010-09-16 19:45 . 2010-09-04 13:09 141792 ----a-w- c:\windows\system32\mfevtps.exe
2010-09-16 15:48 . 2010-09-16 15:52 -------- dc-h--w- c:\windows\ie8
2010-09-15 19:05 . 2010-09-15 19:05 -------- d-----w- c:\documents and settings\michaela\Local Settings\Application Data\Conduit
2010-09-15 19:05 . 2010-09-15 19:05 -------- d-----w- c:\documents and settings\michaela\Local Settings\Application Data\Zynga
2010-09-06 20:53 . 2010-09-06 20:53 -------- d-----w- c:\documents and settings\Guest\Application Data\Spyware Terminator
2010-09-06 16:19 . 2010-04-29 14:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-09-06 16:19 . 2010-09-06 16:19 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Malwarebytes
2010-09-06 16:19 . 2010-04-29 14:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-09-06 16:19 . 2010-09-06 16:19 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-09-05 16:36 . 2010-09-05 16:37 -------- d-----w- c:\documents and settings\michaela\Application Data\Spyware Terminator
2010-09-05 14:57 . 2010-09-05 14:57 -------- d-----w- c:\documents and settings\nadine.HOME-13887EE678\Application Data\Spyware Terminator
2010-09-04 18:41 . 2010-09-04 19:05 80770088 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\PC Tools\DownloadManager\Spyware Doctor with AntiVirus8.0\sdasetup_dl.exe
2010-09-04 18:41 . 2010-09-04 20:01 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\PC Tools
2010-09-04 18:35 . 2010-09-29 23:44 -------- d-----w- c:\program files\WindowsClear
2010-09-04 17:22 . 2010-09-04 17:22 49152 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext\Components\nprpffbrowserrecordext.dll
2010-09-04 17:22 . 2010-09-04 17:22 45056 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimwmp.dll
2010-09-04 17:22 . 2010-09-04 17:22 45056 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimswf.dll
2010-09-04 17:22 . 2010-09-04 17:22 45056 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimrp.dll
2010-09-04 17:22 . 2010-09-04 17:22 45056 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimqt.dll
2010-09-04 17:22 . 2010-09-04 17:22 308808 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Real\RealPlayer\BrowserRecordPlugin\Common\rpmainbrowserrecordplugin.dll
2010-09-04 17:22 . 2010-09-04 17:22 14848 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
2010-09-04 17:22 . 2010-09-04 17:22 40960 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Real\RealPlayer\BrowserRecordPlugin\Chrome\Hook\rpchromebrowserrecordhelper.dll
2010-09-04 17:22 . 2010-09-04 17:22 341600 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
2010-09-04 17:21 . 2010-09-04 17:21 -------- d-----w- c:\program files\Common Files\xing shared
2010-09-04 17:19 . 2010-09-04 17:21 -------- d-----w- c:\program files\real
2010-09-03 20:10 . 2010-09-03 20:11 -------- d-----w- c:\windows\system32\Adobe
2010-09-03 19:52 . 2010-09-03 19:52 -------- d-----w- c:\program files\Java
2010-09-03 18:44 . 2010-09-03 18:44 -------- d-----w- c:\program files\Common Files\Apple
2010-09-03 18:44 . 2010-09-03 18:44 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Apple

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-29 23:47 . 2009-08-08 17:00 -------- d---a-w- c:\documents and settings\All Users.WINDOWS\Application Data\TEMP
2010-09-28 19:19 . 2010-09-28 19:19 -------- d-----w- c:\documents and settings\keith.HOME-13887EE678.000\Application Data\WinPatrol
2010-09-28 17:21 . 2010-04-05 18:27 74648 ----a-w- c:\documents and settings\sue\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-09-27 12:56 . 2007-12-21 20:43 -------- d-----w- c:\program files\NCH Software
2010-09-27 12:37 . 2008-01-12 18:10 -------- d-----w- c:\program files\MSBuild
2010-09-26 11:52 . 2010-01-31 10:49 -------- d-----w- c:\program files\uTorrent
2010-09-25 16:30 . 2008-05-07 21:49 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\NCH Software
2010-09-22 16:00 . 2009-09-27 14:55 -------- d-----w- c:\program files\Windows Desktop Search
2010-09-16 15:41 . 2009-06-17 13:16 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Microsoft Help
2010-09-14 20:14 . 2007-09-12 18:40 -------- d-----w- c:\program files\Windows Live
2010-09-06 16:50 . 2008-05-18 22:53 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Kontiki
2010-09-04 20:04 . 2009-09-01 17:01 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\NOS
2010-09-04 19:42 . 2010-09-04 19:12 690068 ----a-w- c:\windows\system32\drivers\Cat.DB
2010-09-04 18:21 . 2007-08-26 15:47 -------- d-----w- c:\program files\QuickTime
2010-09-04 18:05 . 2008-02-09 12:52 -------- d-----w- c:\program files\Common Files\Adobe
2010-09-04 17:22 . 2007-04-23 16:02 -------- d-----w- c:\program files\Common Files\Real
2010-09-04 17:19 . 2008-04-18 09:02 348160 ----a-w- c:\windows\system32\msvcr71.dll
2010-09-04 15:57 . 2009-10-08 18:10 -------- d-----w- c:\program files\Microsoft
2010-09-04 14:19 . 2004-08-04 10:00 361600 ----a-w- c:\windows\system32\drivers\tcpip.sys
2010-09-04 14:18 . 2010-08-02 10:44 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-09-03 19:54 . 2007-04-19 07:54 -------- d-----w- c:\program files\Common Files\Java
2010-09-03 19:53 . 2010-08-10 22:47 423656 ----a-w- c:\windows\system32\deployJava1.dll
2010-08-31 17:07 . 2010-08-31 17:07 -------- d-----w- c:\documents and settings\sue\Application Data\BBCiPlayerDesktop.61DB7A798358575D6A969CCD73DDBBD723A6DA9D.1
2010-08-31 17:07 . 2010-08-31 17:07 -------- d-----w- c:\program files\BBC iPlayer Desktop
2010-08-31 17:07 . 2010-08-31 17:07 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-08-31 17:06 . 2010-09-28 19:19 53632 ----a-w- c:\documents and settings\keith.HOME-13887EE678.000\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-08-31 17:06 . 2010-08-31 17:07 53632 ----a-w- c:\documents and settings\sue\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-08-31 17:06 . 2010-08-31 17:07 53632 ----a-w- c:\documents and settings\Default User.WINDOWS\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-08-22 14:31 . 2010-08-22 14:31 503808 ----a-w- c:\documents and settings\nadine.HOME-13887EE678\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-191717c7-n\msvcp71.dll
2010-08-22 14:31 . 2010-08-22 14:31 499712 ----a-w- c:\documents and settings\nadine.HOME-13887EE678\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-191717c7-n\jmc.dll
2010-08-22 14:31 . 2010-08-22 14:31 348160 ----a-w- c:\documents and settings\nadine.HOME-13887EE678\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-191717c7-n\msvcr71.dll
2010-08-22 14:31 . 2010-08-22 14:31 61440 ----a-w- c:\documents and settings\nadine.HOME-13887EE678\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-2283ac0a-n\decora-sse.dll
2010-08-22 14:31 . 2010-08-22 14:31 12800 ----a-w- c:\documents and settings\nadine.HOME-13887EE678\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-2283ac0a-n\decora-d3d.dll
2010-08-17 16:31 . 2010-08-17 16:31 503808 ----a-w- c:\documents and settings\michaela\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-167cfe6b-n\msvcp71.dll
2010-08-17 16:31 . 2010-08-17 16:31 499712 ----a-w- c:\documents and settings\michaela\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-167cfe6b-n\jmc.dll
2010-08-17 16:31 . 2010-08-17 16:31 348160 ----a-w- c:\documents and settings\michaela\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-167cfe6b-n\msvcr71.dll
2010-08-17 16:31 . 2010-08-17 16:31 61440 ----a-w- c:\documents and settings\michaela\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-312130aa-n\decora-sse.dll
2010-08-17 16:31 . 2010-08-17 16:31 12800 ----a-w- c:\documents and settings\michaela\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-312130aa-n\decora-d3d.dll
2010-08-17 13:17 . 2004-08-04 10:00 58880 ----a-w- c:\windows\system32\spoolsv.exe
2010-08-15 09:18 . 2010-08-15 09:18 503808 ----a-w- c:\documents and settings\sue\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-28004f32-n\msvcp71.dll
2010-08-15 09:18 . 2010-08-15 09:18 499712 ----a-w- c:\documents and settings\sue\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-28004f32-n\jmc.dll
2010-08-15 09:18 . 2010-08-15 09:18 348160 ----a-w- c:\documents and settings\sue\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-28004f32-n\msvcr71.dll
2010-08-15 09:18 . 2010-08-15 09:18 61440 ----a-w- c:\documents and settings\sue\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-57372c2b-n\decora-sse.dll
2010-08-15 09:18 . 2010-08-15 09:18 12800 ----a-w- c:\documents and settings\sue\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-57372c2b-n\decora-d3d.dll
2010-08-13 22:12 . 2010-07-14 14:21 -------- d-----w- c:\program files\TomTom HOME 2
2010-07-22 15:49 . 2004-08-04 10:00 590848 ----a-w- c:\windows\system32\rpcrt4.dll
2010-07-22 05:57 . 2010-07-22 05:57 5120 ------w- c:\windows\system32\xpsp4res.dll
2010-07-08 16:43 . 2010-07-08 16:43 27630760 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\yahoo!\YUpdater\msgup1000_1270_us_u1.exe
2008-10-01 15:03 . 2008-10-01 15:03 774144 -c--a-w- c:\program files\RngInterstitial.dll
2008-09-23 15:50 . 2008-09-23 15:49 8192 --sha-w- c:\program files\Common Files\Thumbs.db
2008-09-23 15:49 . 2008-09-23 15:49 5632 -csha-w- c:\program files\Thumbs.db
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinPatrol "= "c:\program files\BillP Studios\WinPatrol\winpatrol.exe" [2007-03-26 271936]
"BluetoothAuthenticationAgent "= "bthprops.cpl" [2008-04-14 110592]
"NvCplDaemon "= "c:\windows\system32\NvCpl.dll" [2008-05-02 13529088]
"SunJavaUpdateSched "= "c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"TkBellExe "= "c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-09-04 202256]
"AVP "= "c:\program files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe" [2010-09-30 340520]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5} "= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=" "

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=" "

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring "=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring "=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring "=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall "= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"c:\\Program Files\\Kontiki\\KService.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe "=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE "=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE "=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE "=
"c:\\Program Files\\uTorrent\\uTorrent.exe "=
"c:\\Program Files\\Skype\\Phone\\Skype.exe "=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe "=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP "= 3389:TCPxpsp2res.dll,-22009

R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [14/10/2009 21:18 36880]
R2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [24/08/2010 10:38 92008]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [14/09/2009 14:42 32272]
R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\drivers\klmouflt.sys [02/10/2009 19:39 19472]
S3 FlashUSB;FlashUSB;c:\windows\system32\drivers\FlashUsb.sys [05/12/2009 14:04 16896]
S4 EraserSvc10910;Symantec Eraser Service; "c:\program files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon --> c:\program files\Common Files\Symantec Shared\ccSvcHst.exe [?]
S4 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [15/05/2010 17:13 136176]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]
2009-03-08 03:32 128512 ----a-w- c:\windows\system32\advpack.dll
.
Contents of the 'Scheduled Tasks' folder
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
mSearch Bar = hxxp://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/sb/*http://uk.docs.yahoo.com/info/bt_side.html
uInternet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch
IE: Add to Anti-Banner - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2010\ie_banner_deny.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000
DPF: ChatSpace Full Java Client 3.1.0.248 - hxxp://chat-c2.orange.co.uk/Java/cfs31248.cab
DPF: JT's Blocks - hxxp://origin.games.yahoo.net/games/clients/y/blt1_x.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: Video Poker - hxxp://origin.games.yahoo.net/games/clients/y/vpt0_x.cab
DPF: Yahoo! Cribbage - hxxp://origin.games.yahoo.net/games/clients/y/it1_x.cab
DPF: Yahoo! Dominoes - hxxp://origin.games.yahoo.net/games/clients/y/dot9_x.cab
DPF: Yahoo! Gin - hxxp://origin.games.yahoo.net/games/clients/y/nt1_x.cab
DPF: Yahoo! Hearts - hxxp://origin.games.yahoo.net/games/clients/y/ht1_x.cab
DPF: Yahoo! Poker - hxxp://origin.games.yahoo.net/games/clients/y/pt3_x.cab
DPF: Yahoo! Pyramids - hxxp://origin.games.yahoo.net/games/clients/y/pyt1_x.cab
DPF: Yahoo! Spades - hxxp://origin.games.yahoo.net/games/clients/y/st3_x.cab
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-NWEReboot - (no file)
SafeBoot-klmdb.sys



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-10-01 15:00
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: >>UNKNOWN [0x804D7000]<< >>UNKNOWN [0xF74C7000]<< >>UNKNOWN [0xF74B7000]<< >>UNKNOWN [0xF7358000]<< >>UNKNOWN [0x806E4000]<< >>UNKNOWN [0xF7310000]<< >>UNKNOWN [0xF7A4F000]<< >>UNKNOWN [0xF7707000]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> 0xf74cbf28
\Driver\ACPI -> 0xf735ecb8
\Driver\atapi -> 0xf7316852
IoDeviceObjectType -> DeleteProcedure -> 0x805836a8
ParseProcedure -> 0x805827e8
\Device\Harddisk0\DR0 -> DeleteProcedure -> 0x805836a8
ParseProcedure -> 0x805827e8
NDIS: Broadcom 440x 10/100 Integrated Controller -> SendCompleteHandler -> 0xf71f7bb0
PacketIndicateHandler -> 0xf7204a21
SendHandler -> 0xf71e287b
user & kernel MBR OK

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@= "FlashBroker "
"LocalizedString "= "@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe,-101 "

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled "=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@= "c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe "

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@= "IFlashBroker4 "

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@= "{00020424-0000-0000-C000-000000000046} "

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
"Version "= "1.0 "
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(2584)
c:\windows\system32\WININET.dll
c:\program files\BillP Studios\WinPatrol\PATROLPRO.DLL
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\wdfmgr.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\windows\system32\SearchIndexer.exe
c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\rundll32.exe
.
**************************************************************************
.
Completion time: 2010-10-01 15:22:20 - machine was rebooted
ComboFix-quarantined-files.txt 2010-10-01 14:22

Pre-Run: 161,538,023,424 bytes free
Post-Run: 161,383,505,920 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT= "Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug= "do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS= "Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect /usepmtimer

- - End Of File - - 18830328573CA481091EE099C58E5D3F

 

resolved

appologies i forgot about that part however kaspersky seems to have resolved the issue

 

it appears so, i did not mean to go against anything u guys say as this is an excellant site appologies again broni