Solved Has anyone come across "powerInstall"

[Resolved] Has anyone come across "powerInstall "

Has anyone heard of powerInstall?

This morning when I turned on my computer I nticed that a programme, 'power toys for windows XP' was missing from my start menu.
There had been two programmes in that file, tweakUI and a wallpaper changer (one of the power toys from microsoft).

I use 'win patrol' a programme which runs like msconfig and when I checked it, it was showing 'powerInstall' in the start menu but with the icon for winpatrol beside it. When I right clicked on it it just showed the command line for winpatrol.

I checked the winpatrol file and there was no mention of 'powerInstall', nor was there any trace of it when I did a full search of the computer. I also checked msconfig, but there was no mention of 'powerInstall'.

I shut down and re-started the computer and when I checked again with 'win patrol the 'powerInstall' was still there but this time the icon beside it had changed to that of 'LClock'', another programme which changes the appearance of the clock in the lower right hand task bar.
I deleted the 'LClock' programme and restarted the computer 'powerInstall' was still there but with no icon beside it. I again checked msconfig but there was no mention of 'powerInstall'. It just appeared in the 'winpatrol' list of programmes in start up.

I googled 'powerinstall' and there is such a programme which is described as a Key updater. But I have never downloaded that programme and as I have said earlier there is no trace of it anywhere on my computer.

I finally deleted 'powerInstall' from the 'winpatrol' list of startup programmes and when I restarted the computer it was gone. But I got a 'winpatrol' popup telling me that a programme c/windows/pchealth/helpctr/binaries/msconfig wanted to add itself to the startup. I don't know why msconfig would be asking to be put into the start up list.

I don't know if there is any connection between all these things happening or whether they are directly related to this phantom 'powerInstall'.
Apart fro what I have told you, I'm not noticing any other malfunction with the computer. I have run 'windows defender', AVG and MBAM and they are not showing any problems.

I'm sorry if all this is a bit long winded (and possibly confusing) but I would be grateful if someone would take the time to consider whether the 'powerInstall' is something nasty which has crept in under the radar.
Thank you
Attached below are the contents of 2 DDS files:
DDS:

DDS (Ver_09-12-01.01) - NTFSx86
Run by User 1 at 10:55:03.01 on 09/12/2009
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Home Edition 5.1.2600.3.1252.44.1033.18.2047.1616 [GMT 0:00]

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\Program Files\3 Mobile Broadband\3Connect\AutoUpdateSrv.exe
C:\PROGRAM FILES\AVG\AVG9\AVGTRAY.EXE
C:\WINDOWS\system32\sol.exe
C:\Documents and Settings\User 1\Start Menu\Programs\Utilities\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://uk.my.yahoo.com/
uURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} -
uURLSearchHooks: H - No File
mURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} -
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} -
BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} -
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} -
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} -
TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} -
mRun: [WinPatrol] c:\program files\billp studios\winpatrol\winpatrol.exe
dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll
DPF: {40F576AD-8680-4F9E-9490-99D069CD665F} - hxxp://srtest-cdn.systemrequirementslab.com.s3.amazonaws.com/bin/sysreqlabdetect.cab
DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase8942.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} - hxxp://utilities.pcpitstop.com/da2/PCPitStop2.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll
Notify: avgrsstarter - avgrsstx.dll
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\wifd1f~1\MpShHook.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\user1~1\applic~1\mozilla\firefox\profiles\aom3fm04.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.timesonline.co.uk/tol/news/
FF - component: c:\program files\avg\avg9\firefox\components\avgssff.dll
FF - component: c:\program files\avg\avg9\toolbar\firefox\avg@igeared\components\IGeared_tavgp_xputils2.dll
FF - component: c:\program files\avg\avg9\toolbar\firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll
FF - component: c:\program files\avg\avg9\toolbar\firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll
FF - component: c:\program files\avg\avg9\toolbar\firefox\avg@igeared\components\xpavgtbapi.dll
FF - component: c:\program files\real\realplayer\browserrecord\firefox\ext\components\nprpffbrowserrecordext.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - truec:\program files\mozilla firefox\greprefs\security-prefs.js - pref( "security.ssl3.rsa_seed_sha ", true);

============= SERVICES / DRIVERS ===============

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-11-17 333192]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-11-17 28424]
R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-11-17 360584]
R2 avg9wd;AVG Free WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2009-11-13 285392]
S2 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592]
S3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [2009-9-7 7680]

=============== Created Last 30 ================

2009-12-08 09:24:41 187072 ----a-w- c:\windows\walltoyUninst.exe
2009-12-08 09:24:41 0 d-----w- c:\program files\WallpaperToy
2009-12-08 02:04:31 4177974 ---ha-w- c:\windows\system32\toyhide.bmp
2009-12-05 16:46:53 0 d-----w- c:\program files\Microsoft Office Outlook Connector
2009-12-05 16:46:38 0 d-----w- c:\program files\MSECache
2009-12-04 07:36:29 0 d-----w- c:\program files\Red Storm Entertainment
2009-12-04 07:10:23 0 d-----w- c:\program files\NovaLogic
2009-12-04 07:09:45 306688 ----a-w- c:\windows\IsUninst.exe
2009-12-04 07:09:36 0 d-----w- c:\documents and settings\user 1\WINDOWS
2009-12-04 06:55:59 0 d-----w- c:\program files\Call of Duty
2009-12-04 06:55:15 745 ----a-w- c:\windows\CoD.INI
2009-12-04 06:52:13 0 d-----w- c:\program files\IObit
2009-12-04 03:52:34 0 d-----w- c:\program files\common files\Scanner
2009-12-02 04:24:17 0 d-----w- C:\icons
2009-12-01 23:46:37 266360 ----a-w- c:\windows\system32\TweakUI.exe
2009-12-01 23:46:37 160217 ----a-w- c:\windows\system32\PowerToysLicense.rtf
2009-11-25 21:03:05 0 d--h--w- c:\windows\$hf_mig$
2009-11-21 03:25:24 0 d-----w- c:\program files\Dictionary
2009-11-19 20:22:07 3245 ----a-w- c:\windows\system32\wbem\Outlook_01ca6955f70ed904.mof
2009-11-18 11:33:55 195456 ------w- c:\windows\system32\MpSigStub.exe
2009-11-18 01:10:09 0 d-----w- c:\program files\Steam
2009-11-18 01:09:54 515416 ----a-w- c:\windows\system32\XAudio2_5.dll
2009-11-18 01:09:53 5501792 ----a-w- c:\windows\system32\d3dcsx_42.dll
2009-11-18 01:09:53 238936 ----a-w- c:\windows\system32\xactengine3_5.dll
2009-11-18 01:09:53 1974616 ----a-w- c:\windows\system32\D3DCompiler_42.dll
2009-11-18 01:09:52 453456 ----a-w- c:\windows\system32\d3dx10_42.dll
2009-11-18 01:09:52 235344 ----a-w- c:\windows\system32\d3dx11_42.dll
2009-11-18 01:09:51 1892184 ----a-w- c:\windows\system32\D3DX9_42.dll
2009-11-17 23:19:44 0 d-----w- c:\program files\XML Marker
2009-11-17 22:47:43 0 d-----w- c:\program files\LucasArts
2009-11-17 22:19:58 0 d-----w- c:\program files\Gotham Games
2009-11-17 22:01:42 12464 ----a-w- c:\windows\system32\avgrsstx.dll
2009-11-17 22:01:41 360584 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2009-11-17 22:01:38 333192 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-11-17 22:01:35 0 d-----w- c:\windows\system32\drivers\Avg
2009-11-17 22:01:34 0 d-----w- c:\docume~1\alluse~1\applic~1\AVG Security Toolbar
2009-11-17 21:23:18 0 d-----w- c:\program files\backgw32
2009-11-17 21:22:02 0 d-----w- c:\program files\Rekenwonder Software
2009-11-17 21:04:39 0 d-----w- c:\program files\Eidos
2009-11-17 19:41:18 0 d-----w- c:\program files\Destineer
2009-11-17 18:58:48 0 d-----w- c:\program files\Illusion Softworks
2009-11-17 16:18:56 0 d-----w- c:\docume~1\alluse~1\applic~1\NVIDIA Corporation
2009-11-17 16:18:48 0 d-----w- c:\program files\NVIDIA Corporation
2009-11-17 01:56:11 0 d-----w- c:\docume~1\alluse~1\applic~1\PCPitstop
2009-11-17 01:47:19 0 d-----w- c:\docume~1\user1~1\applic~1\Blitware
2009-11-17 01:05:49 0 d-----w- c:\program files\common files\xing shared
2009-11-17 01:05:33 0 d-----w- c:\program files\common files\Real
2009-11-17 01:00:35 65536 ----a-w- c:\documents and settings\user 1\040000040210DE404A1682.bios
2009-11-17 00:35:07 319 ----a-w- c:\windows\game.ini
2009-11-17 00:21:02 0 d-----w- c:\program files\Activision
2009-11-17 00:16:16 0 d-sh--w- c:\windows\ftpcache
2009-11-16 23:03:50 0 d-----w- c:\windows\Logs
2009-11-16 21:42:44 0 d-----w- c:\program files\common files\Wise Installation Wizard
2009-11-16 21:28:09 98304 ----a-w- c:\windows\system32\CmdLineExt.dll
2009-11-16 21:19:55 0 d-----w- c:\windows\system32\ageia
2009-11-16 20:52:24 0 d-----w- c:\program files\CCleaner
2009-11-16 20:38:41 32592 ----a-w- c:\windows\system32\msonpmon.dll
2009-11-16 20:35:27 0 d-----w- c:\windows\SHELLNEW
2009-11-16 20:18:38 0 d-----w- C:\Downloads
2009-11-16 19:56:53 0 d-----w- c:\docume~1\user1~1\applic~1\WinPatrol
2009-11-16 19:56:03 0 d-----w- c:\windows\pss
2009-11-16 19:50:01 0 d-----w- c:\program files\Lavalys
2009-11-16 19:49:34 0 d-----w- c:\docume~1\user1~1\applic~1\Malwarebytes
2009-11-16 19:49:33 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-11-16 19:49:31 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-11-16 19:49:30 0 d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-11-16 19:49:30 0 d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-11-16 19:49:01 0 d-----w- c:\program files\Trend Micro
2009-11-16 19:48:25 0 d-----w- c:\docume~1\user1~1\applic~1\DeskSoft
2009-11-16 19:48:06 0 d-----w- c:\program files\SpeedFan
2009-11-16 19:48:04 45 ----a-w- c:\windows\system32\initdebug.nfo
2009-11-16 19:47:50 0 d-----w- c:\program files\BillP Studios
2009-11-16 19:47:43 0 d-----w- c:\windows\Downloaded Installations
2009-11-16 19:47:30 0 d-----w- c:\program files\Unlocker
2009-11-16 19:47:02 0 d-----w- c:\program files\SIW
2009-11-16 19:09:11 1414440 ----a-w- c:\windows\system32\ShellManager310E2D762.dll
2009-11-16 19:08:55 0 ----a-w- c:\windows\Irremote.ini
2009-11-16 19:07:04 0 d-----w- c:\program files\VS Revo Group
2009-11-16 19:03:45 0 d-----w- c:\docume~1\user1~1\applic~1\Windows Search
2009-11-16 19:03:04 0 d-----w- c:\docume~1\user1~1\applic~1\Birdstep Technology
2009-11-16 19:02:58 0 d-----w- c:\docume~1\alluse~1\applic~1\Birdstep Technology
2009-11-16 19:01:30 0 d-----w- c:\program files\ZTE_MF627_LEGACY_DRIVER_1.2059.0.4
2009-11-16 19:01:28 10240 ------w- c:\windows\system32\drivers\mdvrmng.sys
2009-11-16 19:01:21 0 d-----w- c:\program files\3 Mobile Broadband
2009-11-16 19:00:32 60032 -c--a-w- c:\windows\system32\dllcache\usbaudio.sys
2009-11-16 19:00:32 60032 ----a-w- c:\windows\system32\drivers\USBAUDIO.sys
2009-11-13 16:28:39 0 d-----w- c:\program files\SystemRequirementsLab
2009-11-13 16:15:34 21504 -c--a-w- c:\windows\system32\dllcache\hidserv.dll
2009-11-13 16:15:34 21504 ----a-w- c:\windows\system32\hidserv.dll
2009-11-13 16:15:30 14592 -c--a-w- c:\windows\system32\dllcache\kbdhid.sys
2009-11-13 16:15:30 14592 ----a-w- c:\windows\system32\drivers\kbdhid.sys
2009-11-13 16:15:21 32128 -c--a-w- c:\windows\system32\dllcache\usbccgp.sys
2009-11-13 16:15:21 32128 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2009-11-13 16:06:26 0 d-----w- c:\program files\MSXML 4.0
2009-11-13 15:38:24 12160 -c--a-w- c:\windows\system32\dllcache\mouhid.sys
2009-11-13 15:38:24 12160 ----a-w- c:\windows\system32\drivers\mouhid.sys
2009-11-13 15:38:22 10368 -c--a-w- c:\windows\system32\dllcache\hidusb.sys
2009-11-13 15:38:22 10368 ----a-w- c:\windows\system32\drivers\hidusb.sys
2009-11-13 15:26:18 23127 ----a-w- c:\windows\system32\nvdisp.nvu
2009-11-13 15:26:18 0 d-----w- c:\windows\nview
2009-11-13 15:26:17 490088 ----a-w- c:\windows\system32\nvudisp.exe
2009-11-13 15:25:46 490088 ----a-w- c:\windows\system32\NVUNINST.EXE
2009-11-13 14:47:22 1024 ----a-w- c:\documents and settings\user 1\.rnd
2009-11-13 14:45:38 0 d-----w- c:\docume~1\alluse~1\applic~1\Nero
2009-11-13 14:36:34 0 d-----w- c:\program files\InterVideo
2009-11-13 14:26:30 1683456 ----a-w- c:\windows\fish.scr
2009-11-13 14:21:01 73728 ----a-w- c:\windows\system32\javacpl.cpl
2009-11-13 14:21:01 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-11-13 14:20:08 178176 ----a-w- c:\windows\system32\unrar.dll
2009-11-13 14:15:58 0 d--h--w- C:\$AVG
2009-11-13 14:15:39 0 d-----w- c:\program files\AVG
2009-11-13 14:15:39 0 d-----w- c:\docume~1\alluse~1\applic~1\avg9
2009-11-13 14:11:10 26368 -c--a-w- c:\windows\system32\dllcache\usbstor.sys
2009-11-13 13:51:22 0 d-sh--w- c:\documents and settings\user 1\IECompatCache
2009-11-13 13:50:59 0 d-sh--w- c:\documents and settings\user 1\PrivacIE
2009-11-13 13:50:16 0 d-sh--w- c:\documents and settings\user 1\IETldCache
2009-11-13 13:39:40 92160 -c----w- c:\windows\system32\dllcache\iecompat.dll
2009-11-13 13:39:31 0 d-----w- c:\windows\ie8updates
2009-11-13 13:39:26 594432 -c----w- c:\windows\system32\dllcache\msfeeds.dll
2009-11-13 13:39:26 55296 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll
2009-11-13 13:39:26 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2009-11-13 13:39:26 1985536 -c----w- c:\windows\system32\dllcache\iertutil.dll
2009-11-13 13:39:26 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2009-11-13 13:39:26 11069440 -c----w- c:\windows\system32\dllcache\ieframe.dll
2009-11-13 13:38:33 0 dc-h--w- c:\windows\ie8
2009-11-13 13:28:32 0 d-----w- c:\windows\system32\XPSViewer
2009-11-13 13:28:10 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-11-13 13:28:10 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-11-13 13:28:10 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll
2009-11-13 13:28:10 575488 ------w- c:\windows\system32\xpsshhdr.dll
2009-11-13 13:28:10 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll
2009-11-13 13:28:10 1676288 ------w- c:\windows\system32\xpssvcs.dll
2009-11-13 13:28:10 117760 ------w- c:\windows\system32\prntvpt.dll
2009-11-13 13:28:10 0 d-----w- C:\c61244615619fab463d37b437239b9
2009-11-13 13:24:48 0 d-----w- c:\windows\system32\GroupPolicy
2009-11-13 13:24:48 0 d-----w- c:\program files\Windows Desktop Search
2009-11-13 13:24:16 0 d-----w- c:\program files\Windows Media Connect 2
2009-11-13 13:23:42 0 d-----w- c:\windows\system32\LogFiles
2009-11-13 13:22:50 0 d-----w- c:\windows\system32\URTTemp
2009-11-13 13:18:53 2145280 -c----w- c:\windows\system32\dllcache\ntkrnlmp.exe
2009-11-13 13:18:52 2189184 -c----w- c:\windows\system32\dllcache\ntoskrnl.exe
2009-11-13 13:18:52 2023936 -c----w- c:\windows\system32\dllcache\ntkrpamp.exe
2009-11-13 13:18:46 2560 ------w- c:\windows\system32\xpsp4res.dll
2009-11-13 13:18:22 455296 -c----w- c:\windows\system32\dllcache\mrxsmb.sys
2009-11-13 13:17:40 272128 -c----w- c:\windows\system32\dllcache\bthport.sys
2009-11-13 13:17:40 272128 ------w- c:\windows\system32\drivers\bthport.sys
2009-11-13 13:14:55 26144 ----a-w- c:\windows\system32\spupdsvc.exe
2009-11-13 13:14:55 0 d-----w- c:\windows\system32\PreInstall
2009-11-13 13:14:10 0 d-sh--w- c:\documents and settings\user 1\UserData
2009-11-13 13:12:10 13646 ----a-w- c:\windows\system32\wpa.bak
2009-11-13 13:10:40 0 d-----w- c:\windows\system32\SoftwareDistribution
2009-11-13 13:09:41 940794 ----a-w- c:\windows\system32\LoopyMusic.wav
2009-11-13 13:09:41 146650 ----a-w- c:\windows\system32\BuzzingBee.wav
2009-11-13 13:08:13 0 d-----w- c:\program files\Realtek
2009-11-13 13:07:23 5672960 ----a-r- c:\windows\system32\igfxress.dll
2009-11-13 13:05:51 0 d-----w- c:\windows\system32\ReinstallBackups
2009-11-13 13:05:49 53248 ----a-r- c:\windows\system32\CSVer.dll
2009-11-13 13:05:23 0 d-----w- C:\Intel
2009-11-13 12:53:41 0 d-sh--w- c:\documents and settings\all users\DRM
2009-11-13 12:53:29 0 d--h--w- c:\program files\WindowsUpdate
2009-11-13 12:52:59 0 d-----w- c:\program files\common files\MSSoap
2009-11-13 12:51:46 0 d-----w- c:\program files\Online Services
2009-11-13 12:51:41 0 d-----w- c:\program files\Messenger
2009-11-13 12:51:38 0 d-----w- c:\program files\MSN Gaming Zone
2009-11-13 12:51:09 0 d-----w- c:\program files\Windows NT
2009-11-13 12:46:12 0 d-----w- c:\program files\common files\ODBC
2009-11-13 12:46:10 0 d-----w- c:\program files\common files\SpeechEngines
2009-11-13 12:45:51 0 d-----r- c:\documents and settings\all users\Documents

==================== Find3M ====================

2009-11-17 01:05:36 499712 ----a-w- c:\windows\system32\msvcp71.dll
2009-11-17 01:05:36 348160 ----a-w- c:\windows\system32\msvcr71.dll
2009-11-13 12:52:19 21640 ----a-w- c:\windows\system32\emptyregdb.dat
2009-10-08 14:57:02 611328 ----a-w- c:\windows\system32\uiautomationcore.dll
2009-10-08 14:57:00 220160 ----a-w- c:\windows\system32\oleacc.dll
2009-10-08 14:56:56 20480 ----a-w- c:\windows\system32\oleaccrc.dll
2009-09-27 18:20:04 2173544 ----a-w- c:\windows\system32\nvcplui.exe
2009-09-27 18:20:00 81920 ----a-w- c:\windows\system32\nvwddi.dll
2009-09-27 18:19:52 3166208 ----a-w- c:\windows\system32\nvwss.dll
2009-09-27 18:19:50 4026368 ----a-w- c:\windows\system32\nvvitvs.dll
2009-09-27 18:19:48 3547136 ----a-w- c:\windows\system32\nvgames.dll
2009-09-27 18:19:48 188416 ----a-w- c:\windows\system32\nvmccss.dll
2009-09-27 18:19:48 1286144 ----a-w- c:\windows\system32\nvmobls.dll
2009-09-27 18:19:46 86016 ----a-w- c:\windows\system32\nvmctray.dll
2009-09-27 18:19:46 4935680 ----a-w- c:\windows\system32\nvdisps.dll
2009-09-27 18:19:46 172100 ----a-w- c:\windows\system32\nvsvc32.exe
2009-09-27 18:19:46 143360 ----a-w- c:\windows\system32\nvcolor.exe
2009-09-27 18:19:46 13918208 ----a-w- c:\windows\system32\nvcpl.dll
2009-09-27 18:19:40 229376 ----a-w- c:\windows\system32\nvmccs.dll
2009-09-27 16:12:22 888832 ----a-w- c:\windows\system32\nvapi.dll
2009-09-27 16:12:22 5900416 ----a-w- c:\windows\system32\nv4_disp.dll
2009-09-27 16:12:22 2194024 ----a-w- c:\windows\system32\nvcuvid.dll
2009-09-27 16:12:22 2007040 ----a-w- c:\windows\system32\nvcuda.dll
2009-09-27 16:12:22 1714792 ----a-w- c:\windows\system32\nvcuvenc.dll
2009-09-27 16:12:22 170600 ----a-w- c:\windows\system32\nvcodins.dll
2009-09-27 16:12:22 170600 ----a-w- c:\windows\system32\nvcod.dll
2009-09-27 16:12:22 1604482 ----a-w- c:\windows\system32\nvdata.bin
2009-09-27 16:12:22 10756096 ----a-w- c:\windows\system32\nvoglnt.dll
2009-09-25 05:37:09 81920 ------w- c:\windows\system32\ieencode.dll
2009-09-11 14:18:39 136192 ----a-w- c:\windows\system32\msv1_0.dll
2004-02-20 15:22:58 7031 ----a-w- c:\program files\DevMode.lua

============= FINISH: 10:55:09.96 ===============
DDS.Attach

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-12-01.01)

Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume1
Install Date: 13/11/2009 12:55:33
System Uptime: 12/09/2009 09:37:27 (2113 hours ago)

Motherboard: ASRock | | G31M-GS.
Processor: Intel Pentium III Xeon processor | CPUSocket | 2593/200mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 233 GiB total, 154.458 GiB free.
D: is CDROM (UDF)
E: is CDROM (CDFS)
F: is Removable
G: is Removable
H: is Removable
I: is Removable
J: is Removable
K: is FIXED (NTFS) - 37 GiB total, 29.411 GiB free.

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP1: 13/11/2009 13:03:13 - System Checkpoint
RP2: 13/11/2009 13:08:13 - Installed Realtek High Definition Audio Driver
RP3: 13/11/2009 13:08:41 - Installed REALTEK GbE & FE Ethernet PCI-E NIC Driver
RP4: 13/11/2009 13:14:43 - Software Distribution Service 3.0
RP5: 13/11/2009 13:22:45 - Software Distribution Service 3.0
RP6: 13/11/2009 13:57:17 - Software Distribution Service 3.0
RP7: 13/11/2009 14:11:30 - Software Distribution Service 3.0
RP8: 13/11/2009 14:44:55 - Installed DirectX
RP9: 13/11/2009 14:45:33 - Installed Nero 8 Essentials
RP10: 13/11/2009 16:06:23 - Software Distribution Service 3.0
RP11: 13/11/2009 17:04:33 - Cleaned registry with Windows Live OneCare safety scanner
RP12: 14/11/2009 08:10:54 - Avg8 Update
RP13: 14/11/2009 08:11:31 - Avg8 Update
RP14: 15/11/2009 09:08:59 - System Checkpoint
RP15: 16/11/2009 19:01:21 - Installed 3Connect
RP16: 16/11/2009 19:07:30 - Revo Uninstaller's restore point - Nero 8 Essentials
RP17: 16/11/2009 19:08:21 - Revo Uninstaller's restore point - Nero 8 Essentials
RP18: 16/11/2009 19:08:43 - Removed Nero 8 Essentials
RP19: 16/11/2009 19:11:41 - Revo Uninstaller's restore point - OpenOffice.org 3.1
RP20: 16/11/2009 19:12:38 - Removed OpenOffice.org 3.1
RP21: 16/11/2009 19:47:49 - Installed WinPatrol
RP22: 16/11/2009 19:50:30 - Installed Windows Defender
RP23: 16/11/2009 20:34:55 - Installed Microsoft Office Enterprise 2007
RP24: 16/11/2009 20:38:40 - Printer Driver Send To Microsoft OneNote Driver Installed
RP25: 16/11/2009 20:40:39 - Configured Microsoft Office Enterprise 2007
RP26: 16/11/2009 20:56:41 - Revo Uninstaller's restore point - Windows Messenger Remover 1.0
RP27: 16/11/2009 21:16:05 - Installed Ghost Recon Advanced Warfighter
RP28: 16/11/2009 21:35:17 - Installed Tom Clancy's Ghost Recon Advanced Warfighter® 2
RP29: 16/11/2009 21:43:10 - Installed AGEIA PhysX v7.05.17
RP30: 16/11/2009 21:57:24 - Installed Far Cry
RP31: 16/11/2009 22:13:34 - Installed Far Cry (Patch 1.31)
RP32: 16/11/2009 22:13:50 - Installed Far Cry (Patch 1.3)
RP33: 16/11/2009 22:14:41 - Installed Far Cry (Patch 1.31)
RP34: 16/11/2009 22:52:57 - Revo Uninstaller's restore point - Far Cry
RP35: 16/11/2009 22:53:02 - Configured Far Cry
RP36: 16/11/2009 22:56:10 - Installed Far Cry 2
RP37: 16/11/2009 23:03:53 - Installed DirectX
RP38: 17/11/2009 00:16:47 - Installed Call of Duty(R) 4 - Modern Warfare(TM)
RP39: 17/11/2009 01:50:09 - Revo Uninstaller's restore point - Driver Robot 1.1.0.14
RP40: 17/11/2009 01:59:49 - Revo Uninstaller's restore point - PC Pitstop Driver Alert2 2.0.0.0
RP41: 17/11/2009 18:02:12 - Installed Call of Duty(R) - World at War(TM)
RP42: 17/11/2009 18:41:52 - Revo Uninstaller's restore point - Windows Search 4.0
RP43: 17/11/2009 19:10:16 - Installed Hidden & Dangerous 2
RP44: 17/11/2009 19:58:08 - Installed AVG Free 8.5
RP45: 17/11/2009 20:05:07 - Avg8 Update
RP46: 17/11/2009 20:12:44 - Avg8 Update
RP47: 17/11/2009 21:04:39 - Installed Conflict Global Storm
RP48: 17/11/2009 21:37:14 - Revo Uninstaller's restore point - AVG 8.5
RP49: 17/11/2009 21:37:53 - Removed AVG Free 8.5
RP50: 17/11/2009 21:38:39 - Installed AVG Free 8.5
RP51: 17/11/2009 22:01:29 - Configured AVG Free 9.0
RP52: 17/11/2009 22:19:58 - Installed Desert Storm
RP53: 17/11/2009 22:26:14 - Installed Conflict Desert Storm II
RP54: 17/11/2009 22:46:21 - Installed Secret Weapons Over Normandy
RP55: 17/11/2009 22:47:45 - Installed Secret Weapons Over Normandy
RP56: 17/11/2009 23:54:34 - Installed DirectX
RP57: 17/11/2009 23:59:33 - Revo Uninstaller's restore point - ArmA 2 Uninstall
RP58: 18/11/2009 00:01:10 - Installed Silent Hunter III
RP59: 18/11/2009 00:11:17 - Installed Far Cry
RP60: 18/11/2009 01:09:01 - Installed DirectX
RP61: 18/11/2009 01:10:09 - Installed Steam
RP62: 18/11/2009 11:33:52 - Software Distribution Service 3.0
RP63: 18/11/2009 12:24:54 - Revo Uninstaller's restore point - EarthView
RP64: 18/11/2009 20:17:21 - Revo Uninstaller's restore point - ASRock IES
RP65: 19/11/2009 16:29:10 - 19/11/09 Everything Installed
RP66: 19/11/2009 20:20:11 - Configured Microsoft Office Enterprise 2007
RP67: 20/11/2009 02:00:01 - Revo Uninstaller's restore point - Windows Defender
RP68: 20/11/2009 02:00:14 - Removed Windows Defender
RP69: 20/11/2009 02:03:01 - Revo Uninstaller's restore point - PunkBuster Services
RP70: 20/11/2009 23:01:08 - Revo Uninstaller's restore point - Concise Oxford English Dictionary (Eleventh Edition)
RP71: 21/11/2009 03:24:31 - Revo Uninstaller's restore point - Concise Oxford English Dictionary (Eleventh Edition)
RP72: 22/11/2009 15:31:02 - System Checkpoint
RP73: 23/11/2009 04:06:40 - Avg8 Update
RP74: 23/11/2009 04:06:52 - Avg8 Update
RP75: 23/11/2009 04:24:50 - Configured Microsoft Office Enterprise 2007
RP76: 23/11/2009 07:13:31 - Revo Uninstaller's restore point - K-Lite Codec Pack 5.1.0 (Standard)
RP77: 24/11/2009 14:15:26 - System Checkpoint
RP78: 25/11/2009 17:07:59 - System Checkpoint
RP79: 25/11/2009 18:38:42 - Revo Uninstaller's restore point - Free_TV_Bar Toolbar
RP80: 25/11/2009 21:02:53 - Software Distribution Service 3.0
RP81: 26/11/2009 19:38:53 - Configured Far Cry (Patch 1.3)
RP82: 26/11/2009 19:39:07 - Configured Far Cry (Patch 1.31)
RP83: 26/11/2009 19:39:30 - Configured Far Cry (Patch 1.31)
RP84: 26/11/2009 19:40:11 - Configured Far Cry (Patch 1.3)
RP85: 26/11/2009 19:40:45 - Installed Far Cry (Patch 1.31)
RP86: 26/11/2009 19:43:00 - Installed Far Cry (Patch 1.3)
RP87: 26/11/2009 19:45:18 - Revo Uninstaller's restore point - Far Cry
RP88: 26/11/2009 19:45:27 - Configured Far Cry
RP89: 26/11/2009 19:48:02 - Installed Far Cry
RP90: 26/11/2009 20:08:47 - Installed Far Cry (Patch 1.3)
RP91: 26/11/2009 20:10:09 - Installed Far Cry (Patch 1.31)
RP92: 27/11/2009 21:12:51 - System Checkpoint
RP93: 29/11/2009 09:48:22 - System Checkpoint
RP94: 29/11/2009 14:38:10 - Installed Windows Defender
RP95: 29/11/2009 14:39:42 - Software Distribution Service 3.0
RP96: 30/11/2009 22:27:25 - System Checkpoint
RP97: 01/12/2009 07:33:22 - Revo Uninstaller's restore point - 1st Clock 5.0 (30-day trial)
RP98: 01/12/2009 07:49:41 - Revo Uninstaller's restore point - 1st Clock 5.0 (30-day trial)
RP99: 01/12/2009 08:26:46 - Revo Uninstaller's restore point - 1st Clock 5.0 (30-day trial)
RP100: 02/12/2009 10:36:21 - System Checkpoint
RP101: 03/12/2009 11:35:41 - System Checkpoint
RP102: 04/12/2009 01:41:52 - Revo Uninstaller's restore point - RegistryFix v8.0
RP103: 04/12/2009 01:43:37 - Revo Uninstaller's restore point - RegistryFix v8.0
RP104: 04/12/2009 01:46:12 - Revo Uninstaller's restore point - RegistryFix v8.0
RP105: 04/12/2009 04:17:51 - Revo Uninstaller's restore point - Yahoo! Toolbar
RP106: 04/12/2009 04:20:06 - Revo Uninstaller's restore point - Yahoo! Software Update
RP107: 04/12/2009 04:20:35 - Revo Uninstaller's restore point - Yahoo! Mail Advisor
RP108: 04/12/2009 04:21:01 - Revo Uninstaller's restore point - Yahoo! Install Manager
RP109: 04/12/2009 04:21:22 - Revo Uninstaller's restore point - Yahoo! Internet Mail
RP110: 04/12/2009 07:36:29 - Installed Ghost Recon
RP111: 04/12/2009 07:40:05 - Installed Ghost Recon
RP112: 05/12/2009 16:46:51 - Installed Microsoft Office Outlook Connector
RP113: 06/12/2009 17:01:15 - System Checkpoint
RP114: 07/12/2009 12:57:43 - Software Distribution Service 3.0
RP115: 08/12/2009 01:38:15 - Software Distribution Service 3.0
RP116: 08/12/2009 02:32:29 - Revo Uninstaller's restore point - CA Yahoo! Anti-Spy (remove only)
RP117: 08/12/2009 03:05:36 - Revo Uninstaller's restore point - Wallpaper Changer for Windows XP
RP118: 08/12/2009 09:53:43 - Revo Uninstaller's restore point - LClock

==== Installed Programs ======================

3Connect
7-Zip 4.65
Acrobat.com
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 9.2
AVG Free 9.0
Bravo 2-5
Call of Duty
Call of Duty(R) - World at War(TM)
Call of Duty(R) 4 - Modern Warfare(TM)
Call of Duty: Modern Warfare 2
Call of Duty: Modern Warfare 2 - Multiplayer
CCleaner
Concise Oxford English Dictionary (Eleventh Edition)
Conflict Desert Storm II
Conflict Global Storm
Delta Force - Black Hawk Down
Delta Force Black Hawk Down Team Sabre
Desert Storm
EAX4 Unified Redist
EVEREST Home Edition v2.20
Far Cry
Far Cry (Patch 1.3)
Far Cry (Patch 1.31)
Far Cry 2
Far Cry K-9 Vision 1.1
First to Fight
Frostbite Full version 1.2
Game Booster
Ghost Recon
Ghost Recon Advanced Warfighter
GRAW Patch 1.35
Hidden & Dangerous 2
Hidden & Dangerous 2 Sabre Squadron
HijackThis 2.0.2
Hitman's Arsenal
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows XP (KB954550-v5)
Intel(R) Graphics Media Accelerator Driver
InterVideo WinDVD
Java(TM) 6 Update 16
Malwarebytes' Anti-Malware
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB953297)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook Connector
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Software Update for Web Folders (English) 12
Microsoft Visual C++ 2005 Redistributable
Mozilla Firefox (3.5.5)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
neroxml
NVIDIA Drivers
NVIDIA PhysX
RealPlayer
REALTEK GbE & FE Ethernet PCI-E NIC Driver
Realtek High Definition Audio Driver
Revo Uninstaller 1.83
Secret Weapons Over Normandy
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB974455)
Security Update for Windows XP (KB923789)
Silent Hunter III
SIW version 2009.10.22
SpeedFan (remove only)
Steam
System Requirements Lab
The 22nd SAS Equipment Modification v1.0
Tom Clancy's Ghost Recon Advanced Warfighter® 2
Tweak UI
Unlocker 1.8.7
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows Internet Explorer 8 (KB975364)
Update for Windows Internet Explorer 8 (KB976749)
Wallpaper Changer for Windows XP
WebFldrs XP
Windows Defender
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 8
Windows Live OneCare safety scanner
Windows Media Format 11 runtime
Windows Media Player 11
WinPatrol
WinPatrol 2007 Restore/Remove First
ZTE_MF627_USB_MODEM_1.2059.0.4

==== Event Viewer Messages From Past Week ========

07/12/2009 17:49:54, error: sr [1] - The System Restore filter encountered the unexpected error '0xC0000001' while processing the file '' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume.
04/12/2009 04:18:04, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service YahooAUService with arguments " " in order to run the server: {90AFF435-B544-4F94-A0C2-CC020EACA4E3}

==== End Of File ===========================

 

Thanks Broni

Firstly, thanks for all your trouble. I've copied below the files you requested. I've been running windows defender, avg (free) amd malawares malabytes. With the downloads you have recommended do I really need them all.
Perhaps you would let me have your recommendations.
Here are the logs:-

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 12/10/2009 at 02:48 PM

Application Version : 4.31.1000

Core Rules Database Version : 4354
Trace Rules Database Version: 2201

Scan type : Complete Scan
Total Scan Time : 00:17:16

Memory items scanned : 223
Memory threats detected : 0
Registry items scanned : 4951
Registry threats detected : 0
File items scanned : 13876
File threats detected : 3

Trojan.Unclassified/Packed-Win
C:\PROGRAM FILES\UBISOFT\FAR CRY 2\FC2_V102_TRN.EXE
C:\DOCUMENTS AND SETTINGS\USER 1\DESKTOP\GAMES\FC2T.LNK
C:\SYSTEM VOLUME INFORMATION\_RESTORE{A6551856-A8D4-4B4D-9AFA-951D286486A1}\RP109\A0009383.LNK

Malwarebytes' Anti-Malware 1.42
Database version: 3337
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

10/12/2009 15:50:22
mbam-log-2009-12-10 (15-50-22).txt

Scan type: Full Scan (C:\|)
Objects scanned: 177308
Time elapsed: 34 minute(s), 12 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

GMER 1.0.15.15273 - http://www.gmer.net
Rootkit scan 2009-12-10 17:23:55
Windows 5.1.2600 Service Pack 3
Running: s1uk4x83.exe; Driver: C:\DOCUME~1\USER1~1\LOCALS~1\Temp\kxtdapow.sys


---- System - GMER 1.0.15 ----

SSDT \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys (SASKUTIL.SYS/SUPERAdBlocker.com and SUPERAntiSpyware.com) ZwTerminateProcess [0xB3EF10B0]

---- Kernel code sections - GMER 1.0.15 ----

.text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xB7991360, 0x3E57A5, 0xE8000020]

---- Devices - GMER 1.0.15 ----

AttachedDevice \Driver\Tcpip \Device\Ip mdvrmng.sys
AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Tcp mdvrmng.sys
AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Udp mdvrmng.sys
AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\RawIp mdvrmng.sys

---- EOF - GMER 1.0.15 ----

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:24:44, on 10/12/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\PROGRAM FILES\AVG\AVG9\AVGTRAY.EXE
C:\Program Files\3 Mobile Broadband\3Connect\AutoUpdateSrv.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.my.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)
R3 - URLSearchHook: (no name) - {a0729639-d831-46c9-811b-9b0aa79fb45a} - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - (no file)
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - (no file)
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {40F576AD-8680-4F9E-9490-99D069CD665F} (System Requirements Lab Class) - http://srtest-cdn.systemrequirementslab.com.s3.amazonaws.com/bin/sysreqlabdetect.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase8942.cab
O16 - DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} (PCPitstop Exam) - http://utilities.pcpitstop.com/da2/PCPitStop2.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

--
End of file - 4384 bytes


Thanks Broni

 

Latest generated HJT Log

Thanks Broni,
I dread to think how many beers I owe by now!

I've followed your instructions and below is the latest HJT log.
One really odd thing I'd like to draw your attention to is the SAS log I initially sent to you shows 3 file threats detected. I know the 1st 2 and I guess the 3rd relate to a game trainer I downloaded for the game Far Cry 2. After the scan I didnt take any action but they were quarantined and disappeared from their respective folders. Just as a test I downloaded and re-installed those files and re-scanned the computer with SAS, Defender and malaware malabytes and no threats were detected.

Secondly, when I gave SAS it's first run it generated a log file, but it hasn't done so subsequently.

Finally, why is it that SAS will show a threat which is missed by Defender and why does AVG warn against almost all trainer downloads and the other programmes do not.

Anyway, once again, thanks for all your help and here are the contants of the latest HJT.

Cheers,
Peter

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:42:08, on 11/12/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\PROGRAM FILES\AVG\AVG9\AVGTRAY.EXE
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\3 Mobile Broadband\3Connect\AutoUpdateSrv.exe
C:\Program Files\3 Mobile Broadband\3Connect\WilogApp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bbc.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {40F576AD-8680-4F9E-9490-99D069CD665F} (System Requirements Lab Class) - http://srtest-cdn.systemrequirementslab.com.s3.amazonaws.com/bin/sysreqlabdetect.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase8942.cab
O16 - DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} (PCPitstop Exam) - http://utilities.pcpitstop.com/da2/PCPitStop2.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1546FDED-AA4B-4712-A94C-BEA75CF99E18}: NameServer = 217.171.135.1 217.171.132.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{1546FDED-AA4B-4712-A94C-BEA75CF99E18}: NameServer = 217.171.135.1 217.171.132.1
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

--
End of file - 3983 bytes

 

Thanks Broni....What beer?

 

The computer is fine, but I was lying about the beer. What can I say....perfidious albion!
Anyway thanks Broni I'll mark this thread as solved (but thirsty).