Active iexplore.exe

[Active] iexplore.exe

I've been looking around for hours now, and can't seem to find any one solution, but my machine has fallen victim to having iexplore open all the time using alot of memory and when a legit internet explorer is opened, two process come up. Here are my logs:


DDS (Ver_09-10-26.01) - NTFSx86
Run by Chris at 12:46:48.23 on Sat 11/14/2009
Internet Explorer: 7.0.5730.11 BrowserJavaVersion: 1.6.0_11
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1023.492 [GMT -5:00]

AV: Eset NOD32 antivirus system 2.51 *On-access scanning enabled* (Outdated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

============== Running Processes ===============

C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\WebWatcherV5\atisvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Documents and Settings\All Users\Application Data\Seekdns\seekdns121.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\WebWatcherV5\atisvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\CTHELPER.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\ACDSYS~1\DEVDET~1\DEVDET~1.EXE
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\NETGEAR\WPNT121\WPNT121.exe
C:\Program Files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe
C:\Program Files\Seekdns\seekdns.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\WebWatcherV5\atisvc.exe
svchost.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Chris\Desktop\dds.scr

============== Pseudo HJT Report ===============

uInternet Settings,ProxyOverride = *.local
uURLSearchHooks: AIM Toolbar Search Class: {03402f96-3dc7-4285-bc50-9e81fefafe43} - c:\program files\aim toolbar\aimtb.dll
mURLSearchHooks: AIM Toolbar Search Class: {03402f96-3dc7-4285-bc50-9e81fefafe43} - c:\program files\aim toolbar\aimtb.dll
mWinlogon: Shell=Explorer.exe rundll32.exe nhni.goo mgxaig
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: GigagetIEHelper Class: {111caa23-6f4f-42ac-8555-b48c1d87bbab} - c:\windows\system32\gigagetbho_v10.dll
BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\DLASHX_W.DLL
BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: AIM Toolbar Loader: {b0cda128-b425-4eef-a174-61a11ac5dbf8} - c:\program files\aim toolbar\aimtb.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: AIM Toolbar: {61539ecd-cc67-4437-a03c-9aaccbd14326} - c:\program files\aim toolbar\aimtb.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [Aim6] "c:\program files\aim6\aim6.exe" /d locale=en-US ee://aol/imApp
uRun: [MsnMsgr] "c:\program files\msn messenger\MsnMsgr.Exe" /background
uRun: [H/PC Connection Agent] "c:\program files\microsoft activesync\wcescomm.exe "
uRun: [Steam] "c:\program files\steam\steam.exe" -silent
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
mRun: [CTHelper] CTHELPER.EXE
mRun: [CTxfiHlp] CTXFIHLP.EXE
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe "
mRun: [PWRISOVM.EXE] c:\program files\poweriso\PWRISOVM.EXE
mRun: [Camera Detector] c:\progra~1\acdsys~1\devdet~1\DEVDET~1.EXE -autorun
mRun: [DAEMON Tools] "c:\program files\daemon tools\daemon.exe" -lang 1033
mRun: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
mRun: [XboxStat] "c:\program files\microsoft xbox 360 accessories\XboxStat.exe" silentrun
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe "
mRun: [DLA] c:\windows\system32\dla\DLACTRLW.EXE
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\bin\AppleSyncNotifier.exe
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe "
mRun: [MSConfig] c:\windows\pchealth\helpctr\binaries\MSConfig.exe /auto
StartupFolder: c:\docume~1\chris\startm~1\programs\startup\pictur~1.lnk - c:\program files\sony\sony picture utility\pmbcore\SPUVolumeWatcher.exe
StartupFolder: c:\docume~1\chris\startm~1\programs\startup\xfire.lnk - c:\program files\xfire\xfire.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\netgea~1.lnk - c:\program files\netgear\wpnt121\WPNT121.exe
IE: &AIM Toolbar Search - c:\documents and settings\all users\application data\aim toolbar\ietoolbar\resources\en-us\local\search.html
IE: &Download All by Gigaget - c:\program files\giganology\gigaget\getallurl.htm
IE: &Download by Gigaget - c:\program files\giganology\gigaget\geturl.htm
IE: &Search
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {0b83c99c-1efa-4259-858f-bcb33e007a5b} - {61539ecd-cc67-4437-a03c-9aaccbd14326} - c:\program files\aim toolbar\aimtb.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/3/9/8/398422c0-8d3e-40e1-a617-af65a72a0465/LegitCheckControl.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1170886903470
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1170887013642
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Notify: AtiExtEvent - Ati2evxx.dll
AppInit_DLLs: dkjlmo.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\chris\applic~1\mozilla\firefox\profiles\m8mi9s2r.default\
FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=&query=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=&query=
FF - component: c:\program files\mozilla firefox\components\1357468.dll
FF - component: c:\program files\mozilla firefox\components\GigagetComponent.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npclntax_HotbarSA.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdnu.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npmozax.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npunagi2.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\unity\webplayer\loader\npUnity3D32.dll
FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}

============= SERVICES / DRIVERS ===============

R2 atisvc;atisvc;c:\program files\webwatcherv5\atisvc.exe [2009-11-13 454263]
R2 Seekdns Service;Seekdns Service;c:\documents and settings\all users\application data\seekdns\seekdns121.exe [2009-11-5 58720]
R2 srenum;srenum;c:\windows\system32\drivers\srenum.sys [2009-11-7 36480]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2007-2-15 24652]
R3 Airgo3U;NETGEAR RangeMax(TM) 240 Wireless USB 2.0 Adapter WPNT121;c:\windows\system32\drivers\TMIMO31U.sys [2006-3-6 722432]
R3 ndisrd;WinpkFilter Service;c:\windows\system32\drivers\ndisrd.sys [2009-11-7 20480]

=============== Created Last 30 ================

2009-11-14 17:41:56 0 d-----w- C:\SDFix
2009-11-14 17:36:11 0 d-----w- C:\HJT
2009-11-14 17:20:29 244 ---ha-w- C:\sqmnoopt16.sqm
2009-11-14 17:20:29 232 ---ha-w- C:\sqmdata16.sqm
2009-11-14 17:07:03 0 d-----w- c:\program files\Trend Micro
2009-11-14 12:14:42 0 d-----w- c:\docume~1\chris\applic~1\AVG8
2009-11-14 11:48:30 232 ---ha-w- C:\sqmdata15.sqm
2009-11-14 11:48:29 244 ---ha-w- C:\sqmnoopt15.sqm
2009-11-13 15:14:25 244 ---ha-w- C:\sqmnoopt14.sqm
2009-11-13 15:14:25 232 ---ha-w- C:\sqmdata14.sqm
2009-11-13 15:06:57 13696 ----a-w- c:\windows\system32\drivers\wpsnuio.sys
2009-11-13 15:06:57 0 d-----w- c:\program files\Skyhook Wireless
2009-11-13 15:06:52 44544 ----a-w- c:\windows\system32\msxml4a.dll
2009-11-13 15:06:52 402 ----a-w- c:\windows\system32\msxml4.inf
2009-11-13 15:06:37 0 d-----w- c:\program files\WebWatcherV5
2009-11-13 11:27:10 244 ---ha-w- C:\sqmnoopt13.sqm
2009-11-13 11:27:10 232 ---ha-w- C:\sqmdata13.sqm
2009-11-12 21:33:18 244 ---ha-w- C:\sqmnoopt12.sqm
2009-11-12 21:33:18 232 ---ha-w- C:\sqmdata12.sqm
2009-11-12 17:12:52 244 ---ha-w- C:\sqmnoopt11.sqm
2009-11-12 17:12:52 232 ---ha-w- C:\sqmdata11.sqm
2009-11-12 03:51:16 0 d-----w- c:\docume~1\alluse~1\applic~1\Sony Corporation
2009-11-11 09:26:55 0 d-----w- c:\program files\MixMeister BPM Analyzer
2009-11-10 01:25:50 56228 ---ha-w- c:\windows\system32\mlfcache.dat
2009-11-07 12:57:48 232 ---ha-w- C:\sqmdata10.sqm
2009-11-07 12:57:47 244 ---ha-w- C:\sqmnoopt10.sqm
2009-11-07 12:55:39 36480 ----a-w- c:\windows\system32\drivers\srenum.sys
2009-11-07 12:54:40 20480 ----a-w- c:\windows\system32\drivers\ndisrd.sys
2009-11-07 12:54:28 27648 ----a-w- c:\windows\system32\nhni.goo
2009-11-06 02:14:42 41872 ----a-w- c:\windows\system32\xfcodec.dll
2009-11-06 01:17:41 232 ---ha-w- C:\sqmdata09.sqm
2009-11-06 01:17:40 244 ---ha-w- C:\sqmnoopt09.sqm
2009-11-03 15:43:10 0 d-----w- c:\program files\iPod
2009-10-30 20:19:33 0 d-----w- c:\program files\ASIO4ALL v2
2009-10-30 20:19:15 225280 ----a-w- c:\windows\system32\rewire.dll
2009-10-30 20:18:40 1554944 ----a-w- c:\windows\system32\vorbis.acm
2009-10-30 20:18:16 0 d-----w- c:\program files\VstPlugins
2009-10-30 20:18:10 0 d-----w- c:\program files\Outsim
2009-10-30 20:14:05 0 d-----w- c:\program files\Image-Line
2009-10-28 21:37:07 232 ---ha-w- C:\sqmdata08.sqm
2009-10-28 21:37:06 244 ---ha-w- C:\sqmnoopt08.sqm
2009-10-28 04:11:01 244 ---ha-w- C:\sqmnoopt07.sqm
2009-10-28 04:11:01 232 ---ha-w- C:\sqmdata07.sqm
2009-10-26 03:20:48 0 d-----w- c:\program files\common files\DivX Shared
2009-10-22 20:35:30 244 ---ha-w- C:\sqmnoopt06.sqm
2009-10-22 20:35:30 232 ---ha-w- C:\sqmdata06.sqm
2009-10-22 14:05:03 0 d-----w- c:\docume~1\chris\applic~1\Hotbar
2009-10-20 18:41:39 244 ---ha-w- C:\sqmnoopt05.sqm
2009-10-20 18:41:39 232 ---ha-w- C:\sqmdata05.sqm
2009-10-19 21:49:31 0 d-----w- c:\docume~1\alluse~1\applic~1\Seekdns
2009-10-19 21:49:30 0 d-----w- c:\program files\Seekdns
2009-10-19 21:49:10 0 d-----w- c:\docume~1\alluse~1\applic~1\HotbarSA
2009-10-17 18:50:47 244 ---ha-w- C:\sqmnoopt04.sqm
2009-10-17 18:50:47 232 ---ha-w- C:\sqmdata04.sqm
2009-10-17 00:47:07 244 ---ha-w- C:\sqmnoopt03.sqm
2009-10-17 00:47:07 232 ---ha-w- C:\sqmdata03.sqm

==================== Find3M ====================

2009-08-28 23:42:52 2065696 ----a-w- c:\windows\system32\usbaaplrc.dll
2009-08-25 22:30:55 196608 ----a-w- C:\{EE7253A7-0D2C-4563-9F48-A64343459199}.dll
2009-08-25 22:30:55 196608 ----a-w- C:\{DB819BC5-6B6A-4ED2-ABC1-C8BED08FFF08}.dll
2009-08-25 22:30:55 196608 ----a-w- C:\{B17AEC53-5C76-4AAA-A069-CFBC3BBD5186}.dll
2009-08-25 22:30:55 196608 ----a-w- C:\{A9DBD395-0E85-4F25-9ABC-52DC55AB1B38}.dll
2009-08-25 22:30:55 196608 ----a-w- C:\{7FF30AB7-EF5A-4CC6-B367-5BF36028929E}.dll
2009-08-25 22:30:55 196608 ----a-w- C:\{044CB556-4BAE-4FCF-B9AC-B1EC155BE9AA}.dll
2009-08-25 22:30:39 192512 ----a-w- C:\{4D7CA135-CF94-49BF-B149-2A2F4516ED5C}.dll
2009-08-25 22:30:35 118784 ----a-w- C:\{1CBD4EC1-4187-4AAC-B8D5-CAFAB0504257}.dll
2009-08-25 22:30:31 86016 ----a-w- C:\{C2F84D37-734F-416E-BA9A-A842A3E46C07}.dll
2009-08-25 22:30:29 77824 ----a-w- C:\{77F6F136-522D-4967-9613-1CD5D961D873}.dll
2009-04-19 02:56:09 2713 --sh--w- c:\windows\system32\dakekeja.exe
2009-04-04 02:50:09 2713 --sh--w- c:\windows\system32\foyomiwe.exe
2009-02-24 16:34:05 129024 --sha-w- c:\windows\system32\fuzayubi.dll
2009-04-05 14:51:53 2713 --sh--w- c:\windows\system32\gikoluyi.exe
2009-05-18 14:38:00 2713 --sh--w- c:\windows\system32\hawinigi.exe
2009-05-20 02:39:05 2713 --sh--w- c:\windows\system32\hohazami.exe
2009-05-19 08:38:34 2713 --sh--w- c:\windows\system32\kahitepi.exe
2009-05-21 14:40:16 2713 --sh--w- c:\windows\system32\nuwijoti.exe
2009-05-23 20:42:06 2713 --sh--w- c:\windows\system32\papesezi.exe
2009-05-13 08:25:29 2713 --sh--w- c:\windows\system32\rahebono.exe
2009-05-20 20:39:40 2713 --sh--w- c:\windows\system32\refajako.exe
2009-05-24 14:42:44 2713 --sh--w- c:\windows\system32\rukigiwi.exe
2009-05-22 08:40:51 2713 --sh--w- c:\windows\system32\susejewe.exe
2009-05-26 02:43:57 2713 --sh--w- c:\windows\system32\tomesitu.exe
2009-05-25 08:43:20 2713 --sh--w- c:\windows\system32\vukikudi.exe
2009-05-23 02:41:28 2713 --sh--w- c:\windows\system32\wararezu.exe
2009-04-04 20:51:02 2713 --sh--w- c:\windows\system32\yayihoge.exe

============= FINISH: 12:47:04.20 ===============



UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-10-26.01)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 2/7/2007 10:20:04 AM
System Uptime: 11/14/2009 12:19:11 PM (0 hours ago)

Motherboard: MICRO-STAR INC. | | MS-6580
Processor: Intel(R) Pentium(R) 4 CPU 2.66GHz | FC-478 | 2672/133mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 56 GiB total, 6.035 GiB free.
D: is CDROM ()
E: is CDROM ()
F: is FIXED (NTFS) - 233 GiB total, 119.525 GiB free.
H: is CDROM (CDFS)

==== Disabled Device Manager Items =============

Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: Wireless-G PCI Adapter
Device ID: PCI\VEN_14E4&DEV_4320&SUBSYS_00131737&REV_02\4&1A671D0C&0&00F0
Manufacturer: Linksys, A Division of Cisco Systems, Inc.
Name: Wireless-G PCI Adapter
PNP Device ID: PCI\VEN_14E4&DEV_4320&SUBSYS_00131737&REV_02\4&1A671D0C&0&00F0
Service: BCM43XX

==== System Restore Points ===================

RP960: 8/14/2009 8:42:59 PM - System Checkpoint
RP961: 8/15/2009 9:42:58 PM - System Checkpoint
RP962: 8/16/2009 10:43:00 PM - System Checkpoint
RP963: 8/17/2009 11:42:59 PM - System Checkpoint
RP964: 8/19/2009 12:43:00 AM - System Checkpoint
RP965: 8/26/2009 7:05:25 PM - System Checkpoint
RP966: 9/1/2009 2:27:44 AM - System Checkpoint
RP967: 9/2/2009 3:22:16 AM - System Checkpoint
RP968: 9/3/2009 4:22:16 AM - System Checkpoint
RP969: 9/4/2009 5:22:16 AM - System Checkpoint
RP970: 9/5/2009 6:22:16 AM - System Checkpoint
RP971: 9/6/2009 7:22:16 AM - System Checkpoint
RP972: 9/7/2009 8:22:16 AM - System Checkpoint
RP973: 9/8/2009 9:22:18 AM - System Checkpoint
RP974: 9/9/2009 10:22:17 AM - System Checkpoint
RP975: 9/10/2009 11:22:17 AM - System Checkpoint
RP976: 9/11/2009 12:22:17 PM - System Checkpoint
RP977: 9/12/2009 1:22:16 PM - System Checkpoint
RP978: 9/13/2009 2:22:16 PM - System Checkpoint
RP979: 9/14/2009 3:22:17 PM - System Checkpoint
RP980: 9/15/2009 4:22:16 PM - System Checkpoint
RP981: 9/16/2009 5:22:17 PM - System Checkpoint
RP982: 9/17/2009 6:22:17 PM - System Checkpoint
RP983: 9/18/2009 7:22:17 PM - System Checkpoint
RP984: 9/19/2009 8:22:17 PM - System Checkpoint
RP985: 9/20/2009 9:22:17 PM - System Checkpoint
RP986: 9/21/2009 10:22:17 PM - System Checkpoint
RP987: 9/22/2009 11:22:18 PM - System Checkpoint
RP988: 9/24/2009 12:22:17 AM - System Checkpoint
RP989: 9/25/2009 1:22:16 AM - System Checkpoint
RP990: 9/26/2009 2:22:21 AM - System Checkpoint
RP991: 9/27/2009 3:22:17 AM - System Checkpoint
RP992: 10/1/2009 6:29:26 PM - System Checkpoint
RP993: 10/2/2009 9:21:45 PM - System Checkpoint
RP994: 10/3/2009 10:10:11 PM - System Checkpoint
RP995: 10/6/2009 5:24:00 PM - Installed iTunes
RP996: 10/7/2009 5:31:23 PM - System Checkpoint
RP997: 10/8/2009 6:31:26 PM - System Checkpoint
RP998: 10/9/2009 7:31:27 PM - System Checkpoint
RP999: 10/9/2009 10:38:39 PM - Unsigned driver install
RP1000: 10/13/2009 8:23:31 PM - System Checkpoint
RP1001: 10/17/2009 12:07:35 PM - System Checkpoint
RP1002: 10/20/2009 11:57:47 AM - System Checkpoint
RP1003: 10/22/2009 10:37:58 AM - System Checkpoint
RP1004: 10/28/2009 12:39:42 PM - System Checkpoint
RP1005: 11/11/2009 10:44:38 PM - Removed Sony Picture Utility
RP1006: 11/11/2009 10:45:04 PM - Removed VideoConversion
RP1007: 11/11/2009 10:45:29 PM - Removed Shared
RP1008: 11/11/2009 10:47:02 PM - Removed PMBCore
RP1009: 11/11/2009 10:49:24 PM - Removed VideoUtility
RP1010: 11/11/2009 10:52:14 PM - Installed Sony Picture Utility
RP1011: 11/11/2009 10:52:45 PM - Installed PMBCore
RP1012: 11/11/2009 10:53:56 PM - Installed VideoUtility
RP1013: 11/11/2009 10:55:17 PM - Installed DirectX

==== Installed Programs ======================

ACDSee for PENTAX
Adobe Anchor Service CS3
Adobe Asset Services CS3
Adobe Bridge CS3
Adobe Bridge Start Meeting
Adobe Camera Raw 4.0
Adobe CMaps
Adobe Color - Photoshop Specific
Adobe Color Common Settings
Adobe Color EU Extra Settings
Adobe Color JA Extra Settings
Adobe Color NA Recommended Settings
Adobe Default Language CS3
Adobe Device Central CS3
Adobe ExtendScript Toolkit 2
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Fonts All
Adobe Help Viewer CS3
Adobe Linguistics CS3
Adobe PDF Library Files
Adobe Photoshop CS3
Adobe Reader 8.1.2
Adobe Setup
Adobe Shockwave Player
Adobe Stock Photos CS3
Adobe Type Support
Adobe Update Manager CS3
Adobe Version Cue CS3 Client
Adobe WinSoft Linguistics Plugin
Adobe XMP Panels CS3
AIM Toolbar
Apple Application Support
Apple Mobile Device Support
Apple Software Update
ASIO4ALL
ATI Display Driver
Audiosurf Beta
AviSynth 2.5
Azureus
Boilsoft Video Joiner 4.92
Bonjour
Compatibility Pack for the 2007 Office system
Creative Audio Console
DivX Web Player
Download Updater (AOL LLC)
DVD Decrypter (Remove Only)
Express Burn
FL Studio 9
Gigaget
GreedyTorrent v1.01 beta build 170
Half-Life
Half-Life 2: Jaykin' Bacon Source
Hardcore
HijackThis 2.0.2
Hotbar
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB896344)
Hotfix for Windows XP (KB909394)
Hotfix for Windows XP (KB914440)
Hotfix for Windows XP (KB915865)
Hotfix for Windows XP (KB926239)
Hotfix for Windows XP (KB928388)
Hotfix for Windows XP (KB929120)
Hotfix for Windows XP (KB952287)
IL Download Manager
Intel(R) PRO Ethernet Adapter and Software
InterActual Player
iTunes
J2SE Runtime Environment 5.0 Update 11
Java(TM) 6 Update 11
Last.fm 1.5.2.38918
Malwarebytes' Anti-Malware
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0 Service Pack 1
Microsoft .NET Framework 3.0
Microsoft Base Smart Card Cryptographic Service Provider Package
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft Kernel-Mode Driver Framework Feature Pack 1.1
Microsoft National Language Support Downlevel APIs
Microsoft Office Professional Edition 2003
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Xbox 360 Accessories 1.1
mIRC
MixMeister BPM Analyzer 1.0
MobileMe Control Panel
Mozilla Firefox (3.0.15)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 6 Service Pack 2 (KB954459)
NCH Toolbox Uninstall
NETGEAR RangeMax(TM) 240 Wireless USB 2.0 Adapter WPNT121
PDF Settings
PeerGuardian 2.0
PoiZone
Primo
QuickTime
Real Lives 2007
Safari
Sawer
Security Update for Windows Internet Explorer 7 (KB928090)
Security Update for Windows Internet Explorer 7 (KB929969)
Security Update for Windows Internet Explorer 7 (KB931768)
Security Update for Windows Internet Explorer 7 (KB933566)
Security Update for Windows Internet Explorer 7 (KB937143)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 8 (KB917734)
Security Update for Windows Media Player 9 (KB917734)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899589)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB921503)
Security Update for Windows XP (KB921883)
Security Update for Windows XP (KB922616)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB923694)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925454)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB933729)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
Security Update for Windows XP (KB936021)
Security Update for Windows XP (KB937894)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB938829)
Security Update for Windows XP (KB941202)
Security Update for Windows XP (KB941568)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB941644)
Security Update for Windows XP (KB941693)
Security Update for Windows XP (KB943055)
Security Update for Windows XP (KB943460)
Security Update for Windows XP (KB943485)
Security Update for Windows XP (KB944653)
Security Update for Windows XP (KB945553)
Security Update for Windows XP (KB946026)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB948590)
Security Update for Windows XP (KB948881)
Security Update for Windows XP (KB950749)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB960715)
Seekdns 1.0 build 121
Sid Meier's Civilization 4
SoftV92 Data Fax Modem
Sonic UDF Reader
Sony Picture Utility
Sony USB Driver
Steam
System Requirements Lab
Team Fortress Classic
The Ship
The Ship Tutorial
The Simsâ„¢ 2 Double Deluxe
Toxic Biohazard
Unity Web Player
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB904942)
Update for Windows XP (KB908531)
Update for Windows XP (KB910437)
Update for Windows XP (KB911280)
Update for Windows XP (KB916595)
Update for Windows XP (KB920342)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB925720)
Update for Windows XP (KB925876)
Update for Windows XP (KB927891)
Update for Windows XP (KB929338)
Update for Windows XP (KB930916)
Update for Windows XP (KB931836)
Update for Windows XP (KB932823-v3)
Update for Windows XP (KB933360)
Update for Windows XP (KB936357)
Update for Windows XP (KB938828)
Update for Windows XP (KB942763)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB955839)
VC80CRTRedist - 8.0.50727.762
VideoLAN VLC media player 0.8.6h
Videora iPod classic Converter 3.07
Viewpoint Media Player
WebFldrs XP
WebWatcher V5 Demo
Windows Communication Foundation
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Imaging Component
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Media Format 11 runtime
Windows Media Format SDK Hotfix - KB891122
Windows Media Player 11
Windows Presentation Foundation
Windows Workflow Foundation
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891781
Windows XP Service Pack 2
WinRAR archiver
Xfire (remove only)
XML Paper Specification Shared Components Pack 1.0
Xvid 1.1.3 final uninstall

==== Event Viewer Messages From Past Week ========

11/7/2009 8:57:29 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: SCDEmu
11/14/2009 12:13:29 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments " " in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
11/14/2009 12:13:20 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD Fips intelppm IPSec MRxSmb NetBIOS NetBT RasAcd Rdbss SCDEmu Tcpip
11/14/2009 12:13:20 PM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD Networking Support Environment service which failed to start because of the following error: A device attached to the system is not functioning.
11/14/2009 12:13:20 PM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.
11/14/2009 12:13:20 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
11/14/2009 12:13:20 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.
11/14/2009 12:13:20 PM, error: Service Control Manager [7001] - The Bonjour Service service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
11/14/2009 12:13:20 PM, error: Service Control Manager [7001] - The Apple Mobile Device service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
11/14/2009 12:13:18 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments " " in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
11/13/2009 10:10:04 AM, error: Service Control Manager [7034] - The Ati HotKey Poller service terminated unexpectedly. It has done this 1 time(s).
11/11/2009 10:28:49 PM, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service wuauserv with arguments " " in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
11/10/2009 8:02:23 PM, error: MRxSmb [8003] - The master browser has received a server announcement from the computer JOYGREENWAY-PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{504FBA7B-5943. The master browser is stopping or an election is being forced.

==== End Of File ===========================

 

Combofix deleted quite a bit but it did not solve it yet,

The combofix log:
ComboFix 09-11-18.01 - Chris 11/17/2009 13:59.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1023.480 [GMT -5:00]
Running from: c:\documents and settings\Chris\Desktop\ComboFix.exe
AV: Eset NOD32 antivirus system 2.51 *On-access scanning enabled* (Outdated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Start Menu\Programs\Hotbar
c:\documents and settings\All Users\Start Menu\Programs\Hotbar\About Hotbar.lnk
c:\documents and settings\All Users\Start Menu\Programs\Hotbar\Hotbar Customer Support Center.lnk
c:\documents and settings\All Users\Start Menu\Programs\Hotbar\Hotbar Games!.lnk
c:\documents and settings\All Users\Start Menu\Programs\Hotbar\Hotbar Uninstall Instructions.lnk
c:\documents and settings\All Users\Start Menu\Programs\Hotbar\Hotbar Videos!.lnk
c:\documents and settings\All Users\Start Menu\Programs\Hotbar\Reset Cursor.lnk
c:\documents and settings\All Users\Start Menu\Programs\Hotbar\Weather.lnk
c:\documents and settings\Ann\Application Data\Hotbar
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\dynamic\1.sdf
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\dynamic\domains.txt
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\dynamic\ustat\38cd.dat
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\ads.cdf
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\btntrans.idx
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\btntrans1.dat
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\business_promo.htm
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\buttondir.txt
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\components.cdf
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\cursors.res
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\d_icons_buttons_1000.res
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\d_icons_buttons_2000.res
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\d_icons_buttons_3000.res
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\d_icons_buttons_bar.res
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\d_icons_buttons_bbar1.res
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\d_icons_buttons_logos.res
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\d_icons_buttons_other.res
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\d_icons_weather.res
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\default.cdf
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_511745-514279.mnu
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_bidz.mnu
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_bidz1.mnu
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_bidz10.mnu
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_bidz11.mnu
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_bidz12.mnu
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_bidz13.mnu
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_bidz14.mnu
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_bidz15.mnu
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_bidz16.mnu
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_bidz17.mnu
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_bidz18.mnu
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_bidz19.mnu
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_bidz2.mnu
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_bidz20.mnu
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_bidz3.mnu
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_bidz4.mnu
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_bidz5.mnu
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_bidz6.mnu
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_bidz7.mnu
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_bidz8.mnu
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_bidz9.mnu
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_categorize.mnu
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_comparison.mnu
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_em_PROFL_CA_flow_b_IEB.mnu
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_explorer-Mails.mnu
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_explorer-people.mnu
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_favorites.mnu
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_Games.mnu
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_Hide.mnu
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_hotbarcom.mnu
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_Hotmail.mnu
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_hsskin.mnu
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_jemster.mnu
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_jemsterie.mnu
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_jemsteruk.mnu
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_jobsearch.mnu
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_Mails.mnu
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_new.mnu
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_premium.mnu
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_reun.mnu
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_ringtones.mnu
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_SearchBoxTrapper.mnu
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_searchfor.mnu
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_searchgo.mnu
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_weather.mnu
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_yellowpages.mnu
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\editblbuttons.res
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\email-def-511724-548964.mnu
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\email-def-511724-9595.mnu
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\email-t1-bg.res
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\gamesmenu.cdf
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\gamesMenu.mnu
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\hb_ie_menu.res
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\hotbar-premium-hotbar-premium.mnu
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\hotbar-premium.cdf
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\hotbar_promo.htm
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\icons2.res
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\ie_games_icon.res
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\ie_video.res
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\keywords.idx
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\keywords1.dat
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\layout.cdf
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\linkpathlegal.txt
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\more.res
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\new_games.mnu
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\progress.res
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\s_icons_buttons.res
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\sales_buttons.res
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\sdfmodifier.xml
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\t2_bg.res
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\theweb.mnu
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\top7.cdf
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\Top7_theweb.mnu
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\tsd_bg.res
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\2\weathericon.res
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\ads.xip
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\BtnTrans.xip
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\BtnTrans1.xip
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\business_promo.xip
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\buttondir.xip
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\cursors.xip
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\d_icons_buttons_1000.xip
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\d_icons_buttons_2000.xip
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\d_icons_buttons_3000.xip
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\d_icons_buttons_bar.xip
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\d_icons_buttons_bbar1.xip
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\d_icons_buttons_logos.xip
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\d_icons_buttons_other.xip
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\d_icons_weather.xip
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\default.xip
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\editblbuttons.xip
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\email-t1-bg.xip
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\gamesmenu.xip
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\hb_ie_menu.xip
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\hotbar-premium.xip
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\hotbar_promo.xip
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\icons2.xip
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\ie_games_icon.xip
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\ie_video.xip
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\keywords.xip
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\keywords1.xip
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\layout.xip
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\linkpathlegal.xip
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\more.xip
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\progress.xip
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\s_icons_buttons.xip
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\sales_buttons.xip
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\samplegroups2.txt
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\samplegroups2.xip
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\sdfmodifier.xip
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\t2_bg.xip
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\top7.xip
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\tsd_bg.xip
c:\documents and settings\Ann\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\weathericon.xip
c:\documents and settings\Ann\Application Data\Hotbar\Weather\history
c:\documents and settings\Ann\Application Data\Hotbar\Weather\Weather_XML\Default
c:\documents and settings\Ann\Application Data\Hotbar\Weather\Weather_XML\Genera1
c:\documents and settings\Ann\Application Data\Hotbar\Weather\Weather_XML\General
c:\documents and settings\Ann\Application Data\Hotbar\Weather\WeatherDPA\Links
c:\documents and settings\Ann\Application Data\Hotbar\Weather\WeatherDPA\radar-big.jpg
c:\documents and settings\Ann\Application Data\Hotbar\Weather\WeatherDPA\radar-small
c:\documents and settings\Ann\Application Data\Hotbar\Weather\WeatherDPA\satellite-big.jpg
c:\documents and settings\Ann\Application Data\Hotbar\Weather\WeatherDPA\satellite-small
c:\documents and settings\Ann\Application Data\Hotbar\Weather\WeatherDPA\Weather_XML\Display
c:\documents and settings\Ann\Application Data\Hotbar\Weather\WeatherDPA\Weather_XML\Loading
c:\documents and settings\Ann\Application Data\Hotbar\Weather\WeatherDPA\Weather_XML\screen2
c:\documents and settings\Ann\Application Data\Hotbar\Weather\WeatherDPA\WeatherPreferences
c:\documents and settings\Ann\Application Data\Hotbar\Weather\WeatherStartup.xml
c:\documents and settings\Ann\Application Data\WeatherDPA
c:\documents and settings\Ann\My Documents\ZbThumbnail.info
c:\documents and settings\Chris\Application Data\Hotbar
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\dynamic\1.sdf
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\dynamic\domains.txt
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\dynamic\TooltipXML\585086
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\dynamic\TooltipXML\748176
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\dynamic\ustat\38d1.dat
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\ads.cdf
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\btntrans.idx
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\btntrans1.dat
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\business_promo.htm
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\buttondir.txt
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\components.cdf
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\cursors.res
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\d_icons_buttons_1000.res
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\d_icons_buttons_2000.res
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\d_icons_buttons_3000.res
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\d_icons_buttons_bar.res
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\d_icons_buttons_bbar1.res
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\d_icons_buttons_logos.res
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\d_icons_buttons_other.res
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\d_icons_weather.res
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\default.cdf
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_511745-514279.mnu
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_bidz.mnu
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_bidz1.mnu
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_bidz10.mnu
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_bidz11.mnu
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_bidz12.mnu
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_bidz13.mnu
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_bidz14.mnu
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_bidz15.mnu
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_bidz16.mnu
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_bidz17.mnu
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_bidz18.mnu
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_bidz19.mnu
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_bidz2.mnu
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_bidz20.mnu
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_bidz3.mnu
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_bidz4.mnu
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_bidz5.mnu
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_bidz6.mnu
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_bidz7.mnu
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_bidz8.mnu
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_bidz9.mnu
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_categorize.mnu
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_comparison.mnu
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_em_PROFL_CA_flow_b_IEB.mnu
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_explorer-Mails.mnu
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_explorer-people.mnu
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_favorites.mnu
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_Games.mnu
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_Hide.mnu
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_hotbarcom.mnu
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_Hotmail.mnu
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_hsskin.mnu
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_jemster.mnu
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_jemsterie.mnu
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_jemsteruk.mnu
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_jobsearch.mnu
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_Mails.mnu
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_new.mnu
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_premium.mnu
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_reun.mnu
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_ringtones.mnu
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_SearchBoxTrapper.mnu
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_searchfor.mnu
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_searchgo.mnu
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_weather.mnu
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\Default_yellowpages.mnu
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\editblbuttons.res
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\email-def-511724-548964.mnu
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\email-def-511724-9595.mnu
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\email-t1-bg.res
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\gamesmenu.cdf
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\gamesMenu.mnu
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\hb_ie_menu.res
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\hotbar-premium-hotbar-premium.mnu
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\hotbar-premium.cdf
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\hotbar_promo.htm
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\icons2.res
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\ie_games_icon.res
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\ie_video.res
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\keywords.idx
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\keywords1.dat
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\layout.cdf
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\linkpathlegal.txt
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\more.res
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\new_games.mnu
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\progress.res
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\s_icons_buttons.res
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\sales_buttons.res
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\sdfmodifier.xml
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\t2_bg.res
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\theweb.mnu
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\top7.cdf
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\Top7_theweb.mnu
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\tsd_bg.res
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\2\weathericon.res
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\ads.xip
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\BtnTrans.xip
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\BtnTrans1.xip
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\business_promo.xip
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\buttondir.xip
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\cursors.xip
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\d_icons_buttons_1000.xip
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\d_icons_buttons_2000.xip
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\d_icons_buttons_3000.xip
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\d_icons_buttons_bar.xip
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\d_icons_buttons_bbar1.xip
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\d_icons_buttons_logos.xip
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\d_icons_buttons_other.xip
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\d_icons_weather.xip
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\default.xip
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\editblbuttons.xip
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\email-t1-bg.xip
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\gamesmenu.xip
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\hb_ie_menu.xip
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\hotbar-premium.xip
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\hotbar_promo.xip
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\icons2.xip
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\ie_games_icon.xip
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\ie_video.xip
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\keywords.xip
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\keywords1.xip
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\layout.xip
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\linkpathlegal.xip
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\more.xip
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\progress.xip
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\s_icons_buttons.xip
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\sales_buttons.xip
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\samplegroups2.txt
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\samplegroups2.xip
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\sdfmodifier.xip
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\t2_bg.xip
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\top7.xip
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\tsd_bg.xip
c:\documents and settings\Chris\Application Data\Hotbar\v3.5\Hotbar\static\DownLoad\weathericon.xip
c:\program files\WebWatcherV5\ATIDLL.dll
c:\program files\WebWatcherV5\AWTKernel32.dll
c:\windows\system32\dakekeja.exe
c:\windows\system32\drivers\ndisrd.sys
c:\windows\system32\foyomiwe.exe
c:\windows\system32\fuzayubi.dll
c:\windows\system32\gikoluyi.exe
c:\windows\system32\hawinigi.exe
c:\windows\system32\hohazami.exe
c:\windows\system32\kahitepi.exe
c:\windows\system32\nuwijoti.exe
c:\windows\system32\papesezi.exe
c:\windows\system32\rahebono.exe
c:\windows\system32\refajako.exe
c:\windows\system32\rukigiwi.exe
c:\windows\system32\susejewe.exe
c:\windows\system32\tomesitu.exe
c:\windows\system32\vukikudi.exe
c:\windows\system32\wararezu.exe
c:\windows\system32\yayihoge.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_ndisrd


((((((((((((((((((((((((( Files Created from 2009-10-17 to 2009-11-17 )))))))))))))))))))))))))))))))
.

2009-11-15 21:38 . 2009-11-15 21:38 -------- d-sh--w- c:\documents and settings\Chris\IETldCache
2009-11-15 21:05 . 2009-11-15 21:05 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2009-11-15 19:45 . 2009-11-15 19:45 -------- d-----w- c:\windows\system32\KB905474
2009-11-15 19:45 . 2009-03-11 03:26 1403264 ----a-w- c:\windows\system32\KB905474\wganotifypackageinner.exe
2009-11-15 19:45 . 2009-03-11 03:18 453512 ----a-w- c:\windows\system32\KB905474\wgasetup.exe
2009-11-15 19:39 . 2009-10-02 04:44 92160 -c----w- c:\windows\system32\dllcache\iecompat.dll
2009-11-15 19:39 . 2009-11-15 19:39 -------- d-----w- c:\windows\ie8updates
2009-11-15 19:38 . 2009-08-29 08:08 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2009-11-15 19:38 . 2009-08-29 08:08 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2009-11-15 19:36 . 2009-11-15 19:38 -------- dc-h--w- c:\windows\ie8
2009-11-14 17:41 . 2008-11-06 07:03 -------- d-----w- C:\SDFix
2009-11-14 17:36 . 2009-11-14 17:36 -------- d-----w- C:\HJT
2009-11-14 17:07 . 2009-11-14 17:07 -------- d-----w- c:\program files\Trend Micro
2009-11-14 12:30 . 2009-06-09 15:06 1871872 -c----w- c:\windows\system32\dllcache\mstscax.dll
2009-11-14 12:29 . 2009-03-06 14:44 283648 -c----w- c:\windows\system32\dllcache\pdh.dll
2009-11-14 12:29 . 2005-07-26 04:39 60416 -c----w- c:\windows\system32\dllcache\colbact.dll
2009-11-14 12:29 . 2009-02-09 10:20 399360 -c----w- c:\windows\system32\dllcache\rpcss.dll
2009-11-14 12:29 . 2009-02-09 10:20 473088 -c----w- c:\windows\system32\dllcache\fastprox.dll
2009-11-14 12:29 . 2009-02-09 10:20 453120 -c----w- c:\windows\system32\dllcache\wmiprvsd.dll
2009-11-14 12:29 . 2009-02-06 17:14 110592 -c----w- c:\windows\system32\dllcache\services.exe
2009-11-14 12:29 . 2009-02-06 16:39 227840 -c----w- c:\windows\system32\dllcache\wmiprvse.exe
2009-11-14 12:29 . 2009-02-09 10:20 714752 -c----w- c:\windows\system32\dllcache\ntdll.dll
2009-11-14 12:29 . 2009-02-09 10:20 616960 -c----w- c:\windows\system32\dllcache\advapi32.dll
2009-11-14 12:28 . 2009-06-21 22:04 153088 -c----w- c:\windows\system32\dllcache\triedit.dll
2009-11-14 12:14 . 2009-11-14 12:14 -------- d-----w- c:\documents and settings\Chris\Application Data\AVG8
2009-11-14 12:00 . 2008-04-21 10:02 215552 -c----w- c:\windows\system32\dllcache\wordpad.exe
2009-11-14 11:52 . 2009-11-14 11:52 4045528 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-11-13 15:06 . 2009-11-13 15:06 13696 ----a-w- c:\windows\system32\drivers\wpsnuio.sys
2009-11-13 15:06 . 2009-11-13 15:06 -------- d-----w- c:\program files\Skyhook Wireless
2009-11-13 15:06 . 2009-11-13 15:06 -------- d-----w- c:\documents and settings\William Greenway\Local Settings\Application Data\Skyhook Wireless
2009-11-13 15:06 . 2008-03-14 18:14 44544 ----a-w- c:\windows\system32\msxml4a.dll
2009-11-13 15:06 . 2009-11-17 19:10 -------- d-----w- c:\program files\WebWatcherV5
2009-11-13 15:02 . 2009-11-13 15:02 1961720 ----a-w- c:\documents and settings\William Greenway\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe
2009-11-13 14:29 . 2009-11-13 14:29 -------- d-----w- c:\documents and settings\William Greenway\Local Settings\Application Data\AIM Toolbar
2009-11-12 03:51 . 2009-11-12 03:51 -------- d-----w- c:\documents and settings\All Users\Application Data\Sony Corporation
2009-11-11 09:26 . 2009-11-11 09:26 -------- d-----w- c:\program files\MixMeister BPM Analyzer
2009-11-10 01:25 . 2009-11-10 01:25 56228 ---ha-w- c:\windows\system32\mlfcache.dat
2009-11-07 12:55 . 2009-11-07 12:55 36480 ----a-w- c:\windows\system32\drivers\srenum.sys
2009-11-06 02:14 . 2009-11-06 02:14 41872 ----a-w- c:\windows\system32\xfcodec.dll
2009-11-05 07:23 . 2009-11-04 13:38 58720 ----a-w- c:\documents and settings\All Users\Application Data\Seekdns\seekdns121.exe
2009-11-03 15:43 . 2009-11-03 15:43 -------- d-----w- c:\program files\iPod
2009-11-03 15:35 . 2009-11-03 15:35 79144 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe
2009-10-30 20:19 . 2009-10-30 20:19 -------- d-----w- c:\program files\ASIO4ALL v2
2009-10-30 20:19 . 2006-06-20 08:56 225280 ----a-w- c:\windows\system32\rewire.dll
2009-10-30 20:18 . 2009-10-30 20:19 -------- d-----w- c:\program files\VstPlugins
2009-10-30 20:18 . 2009-10-30 20:18 -------- d-----w- c:\program files\Outsim
2009-10-30 20:14 . 2009-10-30 20:18 -------- d-----w- c:\program files\Image-Line
2009-10-26 03:20 . 2009-10-26 03:20 -------- d-----w- c:\program files\Common Files\DivX Shared
2009-10-19 21:49 . 2009-11-06 01:15 -------- d-----w- c:\documents and settings\All Users\Application Data\Seekdns
2009-10-19 21:49 . 2009-11-06 01:15 -------- d-----w- c:\program files\Seekdns
2009-10-19 21:49 . 2009-10-28 05:03 -------- d-----w- c:\documents and settings\All Users\Application Data\HotbarSA

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-17 19:16 . 2007-05-07 02:39 -------- d-----w- c:\program files\Steam
2009-11-17 18:48 . 2007-02-09 21:54 69728 ----a-w- c:\documents and settings\Chris\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-11-15 21:41 . 2006-08-21 01:51 -------- d-----w- c:\documents and settings\Chris\Application Data\Xfire
2009-11-14 11:54 . 2009-07-20 22:32 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-11-14 11:47 . 2007-02-10 23:28 -------- d-s---w- c:\program files\Xfire
2009-11-14 10:31 . 2007-02-10 23:51 -------- d-----w- c:\documents and settings\Chris\Application Data\Azureus
2009-11-12 16:19 . 2007-02-08 15:47 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-11-12 03:52 . 2008-11-20 03:11 -------- d-----w- c:\program files\Sony
2009-11-03 15:44 . 2008-06-08 22:45 -------- d-----w- c:\program files\iTunes
2009-11-03 15:43 . 2007-12-27 01:58 -------- d-----w- c:\program files\Common Files\Apple
2009-11-03 15:33 . 2009-01-16 12:13 -------- d-----w- c:\program files\Safari
2009-10-26 03:21 . 2007-05-07 01:46 -------- d-----w- c:\program files\DivX
2009-10-09 19:05 . 2006-01-01 19:21 -------- d-----w- c:\documents and settings\Chris\Application Data\Apple Computer
2009-10-09 14:58 . 2009-10-09 14:58 -------- d-----w- c:\documents and settings\All Users\Application Data\acccore
2009-10-06 22:16 . 2006-04-04 21:32 -------- d-----w- c:\documents and settings\Ann\Application Data\Apple Computer
2009-10-06 22:14 . 2007-12-27 01:58 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
2009-10-06 21:26 . 2009-10-06 21:25 -------- d-----w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2009-10-06 21:23 . 2009-10-06 21:22 -------- d-----w- c:\program files\QuickTime
2009-10-06 21:21 . 2005-01-13 03:46 -------- d-----w- c:\documents and settings\All Users\Application Data\AOL
2009-10-06 21:21 . 2007-02-10 00:39 -------- d-----w- c:\program files\Common Files\AOL
2009-09-11 14:33 . 2002-08-29 19:00 133632 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-10 19:54 . 2009-07-20 22:32 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-10 19:53 . 2009-07-20 22:32 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-09-04 20:45 . 2002-08-29 19:00 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-08-29 08:08 . 2006-06-23 16:33 916480 ----a-w- c:\windows\system32\wininet.dll
2009-08-28 23:42 . 2009-10-06 21:19 2065696 ----a-w- c:\windows\system32\usbaaplrc.dll
2009-08-28 23:42 . 2007-12-27 01:59 40448 ----a-w- c:\windows\system32\drivers\usbaapl.sys
2009-08-26 08:16 . 2002-08-29 19:00 247326 ----a-w- c:\windows\system32\strmdll.dll
2009-08-25 22:30 . 2009-09-11 21:38 196608 ----a-w- C:\{EE7253A7-0D2C-4563-9F48-A64343459199}.dll
2009-08-25 22:30 . 2009-09-11 21:38 196608 ----a-w- C:\{DB819BC5-6B6A-4ED2-ABC1-C8BED08FFF08}.dll
2009-08-25 22:30 . 2009-09-11 21:38 196608 ----a-w- C:\{B17AEC53-5C76-4AAA-A069-CFBC3BBD5186}.dll
2009-08-25 22:30 . 2009-09-11 21:38 196608 ----a-w- C:\{A9DBD395-0E85-4F25-9ABC-52DC55AB1B38}.dll
2009-08-25 22:30 . 2009-09-11 21:38 196608 ----a-w- C:\{7FF30AB7-EF5A-4CC6-B367-5BF36028929E}.dll
2009-08-25 22:30 . 2009-09-11 21:38 196608 ----a-w- C:\{044CB556-4BAE-4FCF-B9AC-B1EC155BE9AA}.dll
2009-08-25 22:30 . 2009-09-11 21:38 192512 ----a-w- C:\{4D7CA135-CF94-49BF-B149-2A2F4516ED5C}.dll
2009-08-25 22:30 . 2009-09-11 21:38 118784 ----a-w- C:\{1CBD4EC1-4187-4AAC-B8D5-CAFAB0504257}.dll
2009-08-25 22:30 . 2009-09-11 21:38 86016 ----a-w- C:\{C2F84D37-734F-416E-BA9A-A842A3E46C07}.dll
2009-08-25 22:30 . 2009-09-11 21:38 77824 ----a-w- C:\{77F6F136-522D-4967-9613-1CD5D961D873}.dll
2009-11-13 15:06 . 2009-11-13 15:06 2164909 ----a-w- c:\program files\mozilla firefox\components\1357468.dll
2006-01-02 21:01 . 2007-06-12 20:44 53248 ----a-w- c:\program files\mozilla firefox\components\GigagetComponent.dll
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr "= "c:\program files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]
"Steam "= "c:\program files\steam\steam.exe" [2009-10-28 1217808]
"WMPNSCFG "= "c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-19 204288]
"ctfmon.exe "= "c:\windows\system32\ctfmon.exe" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UserFaultCheck "= "c:\windows\system32\dumprep 0 -u" [X]
"SunJavaUpdateSched "= "c:\program files\Java\jre6\bin\jusched.exe" [2009-02-08 136600]
"DAEMON Tools "= "c:\program files\DAEMON Tools\daemon.exe" [2005-12-10 133016]
"XboxStat "= "c:\program files\Microsoft Xbox 360 Accessories\XboxStat.exe" [2007-09-26 734264]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]
"DLA "= "c:\windows\System32\DLA\DLACTRLW.EXE" [2006-06-13 127036]
"QuickTime Task "= "c:\program files\QuickTime\QTTask.exe" [2009-09-05 417792]
"AppleSyncNotifier "= "c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-08-13 177440]
"iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2009-10-29 141600]
"CTHelper "= "CTHELPER.EXE" - c:\windows\CTHELPER.EXE [2006-08-11 17920]
"CTxfiHlp "= "CTXFIHLP.EXE" - c:\windows\system32\CTXFIHLP.EXE [2006-08-11 18944]

c:\documents and settings\Chris\Start Menu\Programs\Startup\
Picture Motion Browser Media Check Tool.lnk - c:\program files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe [2009-11-11 385024]
Xfire.lnk - c:\program files\Xfire\xfire.exe [2009-11-5 3152272]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
NETGEAR WPNT121 Smart Wizard.lnk - c:\program files\NETGEAR\WPNT121\WPNT121.exe [2006-6-30 1769472]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall "= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe "=
"c:\\Program Files\\Xfire\\xfire.exe "=
"c:\\Program Files\\Azureus\\Azureus.exe "=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe "=
"c:\\Program Files\\MSN Messenger\\livecall.exe "=
"c:\\Program Files\\LimeWire\\LimeWire.exe "=
"c:\\Documents and Settings\\Ann\\Desktop\\MySpaceMp3Gopher.exe "=
"c:\\Program Files\\Steam\\Steam.exe "=
"c:\\Program Files\\mIRC\\mirc.exe "=
"c:\\Program Files\\GreedyTorrent\\GTor.exe "=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe "=
"c:\\Program Files\\Steam\\steamapps\\skvermillion13\\half-life\\hl.exe "=
"c:\\Program Files\\Steam\\steamapps\\munch5\\the ship\\ship.exe "=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe "=
"c:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Civilization4.exe "=
"c:\\Program Files\\iTunes\\iTunes.exe "=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP "= 3389:TCPxpsp2res.dll,-22009
"9420:TCP "= 9420:TCP:Akamai NetSession Interface
"5000:UDP "= 5000:UDP:Akamai NetSession Interface

R2 atisvc;atisvc;c:\program files\WebWatcherV5\atisvc.exe [11/13/2009 10:06 AM 454263]
R2 Seekdns Service;Seekdns Service;c:\documents and settings\All Users\Application Data\Seekdns\seekdns121.exe [11/5/2009 2:23 AM 58720]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2/15/2007 7:22 PM 24652]
R3 Airgo3U;NETGEAR RangeMax(TM) 240 Wireless USB 2.0 Adapter WPNT121;c:\windows\system32\drivers\TMIMO31U.sys [3/6/2006 7:49 PM 722432]
S2 srenum;srenum;c:\windows\system32\drivers\srenum.sys [11/7/2009 7:55 AM 36480]

--- Other Services/Drivers In Memory ---

*Deregistered* - mbr
.
Contents of the 'Scheduled Tasks' folder

2009-11-11 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 17:34]

2009-11-17 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-11-15 03:18]
.
.
------- Supplementary Scan -------
.
uInternet Settings,ProxyOverride = *.local
IE: &AIM Toolbar Search - c:\documents and settings\All Users\Application Data\AIM Toolbar\ieToolbar\resources\en-US\local\search.html
IE: &Download All by Gigaget - c:\program files\Giganology\Gigaget\getallurl.htm
IE: &Download by Gigaget - c:\program files\Giganology\Gigaget\geturl.htm
IE: &Search
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Chris\Application Data\Mozilla\Firefox\Profiles\m8mi9s2r.default\
FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=&query=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=&query=
FF - component: c:\program files\Mozilla Firefox\components\1357468.dll
FF - component: c:\program files\Mozilla Firefox\components\GigagetComponent.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npclntax_HotbarSA.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\Unity\WebPlayer\loader\npUnity3D32.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-Aim6 - c:\program files\AIM6\aim6.exe
HKCU-Run-H/PC Connection Agent - c:\program files\Microsoft ActiveSync\wcescomm.exe
HKLM-Run-PWRISOVM.EXE - c:\program files\PowerISO\PWRISOVM.EXE
AddRemove-Audiosurf_is1 - c:\program files\Audiosurf\unins000.exe
AddRemove-gigaget_is1 - c:\program files\Giganology\Gigaget\unins000.exe
AddRemove-SystemRequirementsLab - c:\program files\SystemRequirementsLab\Uninstall.exe
AddRemove-Videora iPod classic Converter - c:\program files\Red Kawa\Video Converter 3\uninstaller.exe
AddRemove-{36C41D70-56F5-4E2B-81DA-6BEB7502D7A1} - c:\program files\InstallShield Installation Information\{36C41D70-56F5-4E2B-81DA-6BEB7502D7A1}\setup.exe
AddRemove-{B2C4A8C4-AA20-425D-9FEE-C78039238C81} - c:\program files\InstallShield Installation Information\{B2C4A8C4-AA20-425D-9FEE-C78039238C81}\setup.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-17 14:16
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe >>UNKNOWN [0x8738A940]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> 0x8738a940
\Driver\ACPI -> ACPI.sys @ 0xf763bcb8
\Driver\atapi -> atapi.sys @ 0xf75d22f0
IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805a0084
ParseProcedure -> ntoskrnl.exe @ 0x8056f07e
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805a0084
ParseProcedure -> ntoskrnl.exe @ 0x8056f07e
NDIS: -> SendCompleteHandler -> 0x0
PacketIndicateHandler -> 0x0
SendHandler -> 0x0
Warning: possible MBR rootkit infection !
user & kernel MBR OK

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(476)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(1592)
c:\windows\system32\WININET.dll
c:\program files\WebWatcherV5\mcie.dll
c:\program files\WebWatcherV5\mca.dll
c:\program files\WebWatcherV5\mcapp.dll
c:\program files\WebWatcherV5\mcgc.dll
c:\program files\Seekdns\seekdns.dll
c:\program files\WebWatcherV5\mcsc.dll
c:\program files\WebWatcherV5\mcy.dll
c:\program files\WebWatcherV5\mcmsg.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\System32\Ati2evxx.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Windows Media Player\WMPNetwk.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Internet Explorer\IEXPLORE.EXE
c:\windows\system32\wscntfy.exe
c:\program files\Seekdns\seekdns.exe
c:\progra~1\ACDSYS~1\DEVDET~1\DEVDET~1.EXE
c:\program files\iPod\bin\iPodService.exe
c:\program files\Viewpoint\Viewpoint Manager\ViewMgr.exe
.
**************************************************************************
.
Completion time: 2009-11-17 14:26 - machine was rebooted
ComboFix-quarantined-files.txt 2009-11-17 19:26

Pre-Run: 6,011,310,080 bytes free
Post-Run: 9,949,278,208 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT= "Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS= "Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

- - End Of File - - E1014E76E8D33ABC57435A093C004FBE

 

Hijack this log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:45:47 PM, on 11/17/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\WebWatcherV5\atisvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\WebWatcherV5\atisvc.exe
C:\Documents and Settings\All Users\Application Data\Seekdns\seekdns121.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\WebWatcherV5\atisvc.exe
C:\Program Files\Seekdns\seekdns.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\PROGRA~1\ACDSYS~1\DEVDET~1\DEVDET~1.EXE
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\NETGEAR\WPNT121\WPNT121.exe
C:\Program Files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/?v=msgrv75
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: AIM Toolbar Search Class - {03402f96-3dc7-4285-bc50-9e81fefafe43} - C:\Program Files\AIM Toolbar\aimtb.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: GigagetIEHelper - {111CAA23-6F4F-42AC-8555-B48C1D87BBAB} - C:\WINDOWS\system32\gigagetbho_v10.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: AIM Toolbar Loader - {b0cda128-b425-4eef-a174-61a11ac5dbf8} - C:\Program Files\AIM Toolbar\aimtb.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: AIM Toolbar - {61539ecd-cc67-4437-a03c-9aaccbd14326} - C:\Program Files\AIM Toolbar\aimtb.dll
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe "
O4 - HKLM\..\Run: [Camera Detector] C:\PROGRA~1\ACDSYS~1\DEVDET~1\DEVDET~1.EXE -autorun
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [XboxStat] "C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe" silentrun
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe "
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - S-1-5-18 Startup: Picture Motion Browser Media Check Tool.lnk = C:\Program Files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe (User 'SYSTEM')
O4 - S-1-5-18 Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: Picture Motion Browser Media Check Tool.lnk = C:\Program Files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe (User 'Default user')
O4 - .DEFAULT Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe (User 'Default user')
O4 - Startup: Picture Motion Browser Media Check Tool.lnk = C:\Program Files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe
O4 - Global Startup: NETGEAR WPNT121 Smart Wizard.lnk = C:\Program Files\NETGEAR\WPNT121\WPNT121.exe
O8 - Extra context menu item: &AIM Toolbar Search - C:\Documents and Settings\All Users\Application Data\AIM Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: &Download All by Gigaget - C:\Program Files\Giganology\Gigaget\getallurl.htm
O8 - Extra context menu item: &Download by Gigaget - C:\Program Files\Giganology\Gigaget\geturl.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: AIM Toolbar - {0b83c99c-1efa-4259-858f-bcb33e007a5b} - C:\Program Files\AIM Toolbar\aimtb.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1170886903470
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1170887013642
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: atisvc - Unknown owner - C:\Program Files\WebWatcherV5\atisvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Seekdns Service - Unknown owner - C:\Documents and Settings\All Users\Application Data\Seekdns\seekdns121.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

--
End of file - 8656 bytes

 

When I dragged the script thing into combo fix it had to update itself and restart so I'm not sure if that would make it not run the script?
ComboFix 09-11-18.04 - Chris 11/17/2009 19:19.2.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1023.531 [GMT -5:00]
Running from: c:\documents and settings\Chris\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Chris\Desktop\CFScript.txt
AV: Eset NOD32 antivirus system 2.51 *On-access scanning enabled* (Outdated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

FILE ::
"C:\{044CB556-4BAE-4FCF-B9AC-B1EC155BE9AA}.dll "
"C:\{1CBD4EC1-4187-4AAC-B8D5-CAFAB0504257}.dll "
"C:\{4D7CA135-CF94-49BF-B149-2A2F4516ED5C}.dll "
"C:\{77F6F136-522D-4967-9613-1CD5D961D873}.dll "
"C:\{7FF30AB7-EF5A-4CC6-B367-5BF36028929E}.dll "
"C:\{A9DBD395-0E85-4F25-9ABC-52DC55AB1B38}.dll "
"C:\{B17AEC53-5C76-4AAA-A069-CFBC3BBD5186}.dll "
"C:\{C2F84D37-734F-416E-BA9A-A842A3E46C07}.dll "
"C:\{DB819BC5-6B6A-4ED2-ABC1-C8BED08FFF08}.dll "
"C:\{EE7253A7-0D2C-4563-9F48-A64343459199}.dll "
"c:\program files\mozilla firefox\components\1357468.dll "
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\{044CB556-4BAE-4FCF-B9AC-B1EC155BE9AA}.dll
C:\{1CBD4EC1-4187-4AAC-B8D5-CAFAB0504257}.dll
C:\{4D7CA135-CF94-49BF-B149-2A2F4516ED5C}.dll
C:\{77F6F136-522D-4967-9613-1CD5D961D873}.dll
C:\{7FF30AB7-EF5A-4CC6-B367-5BF36028929E}.dll
C:\{A9DBD395-0E85-4F25-9ABC-52DC55AB1B38}.dll
C:\{B17AEC53-5C76-4AAA-A069-CFBC3BBD5186}.dll
C:\{C2F84D37-734F-416E-BA9A-A842A3E46C07}.dll
C:\{DB819BC5-6B6A-4ED2-ABC1-C8BED08FFF08}.dll
C:\{EE7253A7-0D2C-4563-9F48-A64343459199}.dll
c:\program files\mozilla firefox\components\1357468.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_Ndisrd


((((((((((((((((((((((((( Files Created from 2009-10-18 to 2009-11-18 )))))))))))))))))))))))))))))))
.

2009-11-15 21:38 . 2009-11-15 21:38 -------- d-sh--w- c:\documents and settings\Chris\IETldCache
2009-11-15 21:05 . 2009-11-15 21:05 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2009-11-15 19:45 . 2009-11-15 19:45 -------- d-----w- c:\windows\system32\KB905474
2009-11-15 19:45 . 2009-03-11 03:26 1403264 ----a-w- c:\windows\system32\KB905474\wganotifypackageinner.exe
2009-11-15 19:45 . 2009-03-11 03:18 453512 ----a-w- c:\windows\system32\KB905474\wgasetup.exe
2009-11-15 19:39 . 2009-10-02 04:44 92160 -c----w- c:\windows\system32\dllcache\iecompat.dll
2009-11-15 19:39 . 2009-11-15 19:39 -------- d-----w- c:\windows\ie8updates
2009-11-15 19:38 . 2009-08-29 08:08 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2009-11-15 19:38 . 2009-08-29 08:08 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2009-11-15 19:36 . 2009-11-15 19:38 -------- dc-h--w- c:\windows\ie8
2009-11-14 17:41 . 2008-11-06 07:03 -------- d-----w- C:\SDFix
2009-11-14 17:36 . 2009-11-17 19:45 -------- d-----w- C:\HJT
2009-11-14 17:07 . 2009-11-14 17:07 -------- d-----w- c:\program files\Trend Micro
2009-11-14 12:30 . 2009-06-09 15:06 1871872 -c----w- c:\windows\system32\dllcache\mstscax.dll
2009-11-14 12:29 . 2009-03-06 14:44 283648 -c----w- c:\windows\system32\dllcache\pdh.dll
2009-11-14 12:29 . 2005-07-26 04:39 60416 -c----w- c:\windows\system32\dllcache\colbact.dll
2009-11-14 12:29 . 2009-02-09 10:20 399360 -c----w- c:\windows\system32\dllcache\rpcss.dll
2009-11-14 12:29 . 2009-02-09 10:20 473088 -c----w- c:\windows\system32\dllcache\fastprox.dll
2009-11-14 12:29 . 2009-02-09 10:20 453120 -c----w- c:\windows\system32\dllcache\wmiprvsd.dll
2009-11-14 12:29 . 2009-02-06 17:14 110592 -c----w- c:\windows\system32\dllcache\services.exe
2009-11-14 12:29 . 2009-02-06 16:39 227840 -c----w- c:\windows\system32\dllcache\wmiprvse.exe
2009-11-14 12:29 . 2009-02-09 10:20 714752 -c----w- c:\windows\system32\dllcache\ntdll.dll
2009-11-14 12:29 . 2009-02-09 10:20 616960 -c----w- c:\windows\system32\dllcache\advapi32.dll
2009-11-14 12:28 . 2009-06-21 22:04 153088 -c----w- c:\windows\system32\dllcache\triedit.dll
2009-11-14 12:00 . 2008-04-21 10:02 215552 -c----w- c:\windows\system32\dllcache\wordpad.exe
2009-11-14 11:52 . 2009-11-14 11:52 4045528 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-11-13 15:06 . 2009-11-13 15:06 13696 ----a-w- c:\windows\system32\drivers\wpsnuio.sys
2009-11-13 15:06 . 2009-11-13 15:06 -------- d-----w- c:\program files\Skyhook Wireless
2009-11-13 15:06 . 2009-11-13 15:06 -------- d-----w- c:\documents and settings\William Greenway\Local Settings\Application Data\Skyhook Wireless
2009-11-13 15:06 . 2008-03-14 18:14 44544 ----a-w- c:\windows\system32\msxml4a.dll
2009-11-13 15:06 . 2009-11-17 19:10 -------- d-----w- c:\program files\WebWatcherV5
2009-11-13 15:02 . 2009-11-13 15:02 1961720 ----a-w- c:\documents and settings\William Greenway\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe
2009-11-13 14:29 . 2009-11-13 14:29 -------- d-----w- c:\documents and settings\William Greenway\Local Settings\Application Data\AIM Toolbar
2009-11-12 03:51 . 2009-11-12 03:51 -------- d-----w- c:\documents and settings\All Users\Application Data\Sony Corporation
2009-11-11 09:26 . 2009-11-11 09:26 -------- d-----w- c:\program files\MixMeister BPM Analyzer
2009-11-10 01:25 . 2009-11-10 01:25 56228 ---ha-w- c:\windows\system32\mlfcache.dat
2009-11-07 12:55 . 2009-11-07 12:55 36480 ----a-w- c:\windows\system32\drivers\srenum.sys
2009-11-06 02:14 . 2009-11-06 02:14 41872 ----a-w- c:\windows\system32\xfcodec.dll
2009-11-05 07:23 . 2009-11-04 13:38 58720 ----a-w- c:\documents and settings\All Users\Application Data\Seekdns\seekdns121.exe
2009-11-03 15:43 . 2009-11-03 15:43 -------- d-----w- c:\program files\iPod
2009-11-03 15:35 . 2009-11-03 15:35 79144 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe
2009-10-30 20:19 . 2009-10-30 20:19 -------- d-----w- c:\program files\ASIO4ALL v2
2009-10-30 20:19 . 2006-06-20 08:56 225280 ----a-w- c:\windows\system32\rewire.dll
2009-10-30 20:18 . 2009-10-30 20:19 -------- d-----w- c:\program files\VstPlugins
2009-10-30 20:18 . 2009-10-30 20:18 -------- d-----w- c:\program files\Outsim
2009-10-30 20:14 . 2009-10-30 20:18 -------- d-----w- c:\program files\Image-Line
2009-10-26 03:20 . 2009-10-26 03:20 -------- d-----w- c:\program files\Common Files\DivX Shared
2009-10-19 21:49 . 2009-11-06 01:15 -------- d-----w- c:\documents and settings\All Users\Application Data\Seekdns
2009-10-19 21:49 . 2009-11-06 01:15 -------- d-----w- c:\program files\Seekdns
2009-10-19 21:49 . 2009-10-28 05:03 -------- d-----w- c:\documents and settings\All Users\Application Data\HotbarSA

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-18 00:59 . 2006-08-21 01:51 -------- d-----w- c:\documents and settings\Chris\Application Data\Xfire
2009-11-18 00:58 . 2007-05-07 02:39 -------- d-----w- c:\program files\Steam
2009-11-17 18:48 . 2007-02-09 21:54 69728 ----a-w- c:\documents and settings\Chris\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-11-14 11:54 . 2009-07-20 22:32 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-11-14 11:47 . 2007-02-10 23:28 -------- d-s---w- c:\program files\Xfire
2009-11-14 10:31 . 2007-02-10 23:51 -------- d-----w- c:\documents and settings\Chris\Application Data\Azureus
2009-11-12 16:19 . 2007-02-08 15:47 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-11-12 03:52 . 2008-11-20 03:11 -------- d-----w- c:\program files\Sony
2009-11-03 15:44 . 2008-06-08 22:45 -------- d-----w- c:\program files\iTunes
2009-11-03 15:43 . 2007-12-27 01:58 -------- d-----w- c:\program files\Common Files\Apple
2009-11-03 15:33 . 2009-01-16 12:13 -------- d-----w- c:\program files\Safari
2009-10-26 03:21 . 2007-05-07 01:46 -------- d-----w- c:\program files\DivX
2009-10-09 19:05 . 2006-01-01 19:21 -------- d-----w- c:\documents and settings\Chris\Application Data\Apple Computer
2009-10-09 14:58 . 2009-10-09 14:58 -------- d-----w- c:\documents and settings\All Users\Application Data\acccore
2009-10-06 22:16 . 2006-04-04 21:32 -------- d-----w- c:\documents and settings\Ann\Application Data\Apple Computer
2009-10-06 22:14 . 2007-12-27 01:58 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
2009-10-06 21:26 . 2009-10-06 21:25 -------- d-----w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2009-10-06 21:23 . 2009-10-06 21:22 -------- d-----w- c:\program files\QuickTime
2009-10-06 21:21 . 2005-01-13 03:46 -------- d-----w- c:\documents and settings\All Users\Application Data\AOL
2009-10-06 21:21 . 2007-02-10 00:39 -------- d-----w- c:\program files\Common Files\AOL
2009-09-11 14:33 . 2002-08-29 19:00 133632 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-10 19:54 . 2009-07-20 22:32 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-10 19:53 . 2009-07-20 22:32 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-09-04 20:45 . 2002-08-29 19:00 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-08-29 08:08 . 2006-06-23 16:33 916480 ------w- c:\windows\system32\wininet.dll
2009-08-28 23:42 . 2009-10-06 21:19 2065696 ----a-w- c:\windows\system32\usbaaplrc.dll
2009-08-28 23:42 . 2007-12-27 01:59 40448 ----a-w- c:\windows\system32\drivers\usbaapl.sys
2009-08-26 08:16 . 2002-08-29 19:00 247326 ----a-w- c:\windows\system32\strmdll.dll
2006-01-02 21:01 . 2007-06-12 20:44 53248 ----a-w- c:\program files\mozilla firefox\components\GigagetComponent.dll
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-11-17_19.16.52 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-11-18 00:35 . 2009-11-18 00:35 16384 c:\windows\temp\Perflib_Perfdata_734.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr "= "c:\program files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]
"Steam "= "c:\program files\steam\steam.exe" [2009-10-28 1217808]
"WMPNSCFG "= "c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-19 204288]
"ctfmon.exe "= "c:\windows\system32\ctfmon.exe" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UserFaultCheck "= "c:\windows\system32\dumprep 0 -u" [X]
"SunJavaUpdateSched "= "c:\program files\Java\jre6\bin\jusched.exe" [2009-02-08 136600]
"DAEMON Tools "= "c:\program files\DAEMON Tools\daemon.exe" [2005-12-10 133016]
"XboxStat "= "c:\program files\Microsoft Xbox 360 Accessories\XboxStat.exe" [2007-09-26 734264]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]
"DLA "= "c:\windows\System32\DLA\DLACTRLW.EXE" [2006-06-13 127036]
"QuickTime Task "= "c:\program files\QuickTime\QTTask.exe" [2009-09-05 417792]
"AppleSyncNotifier "= "c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-08-13 177440]
"iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2009-10-29 141600]
"CTHelper "= "CTHELPER.EXE" - c:\windows\CTHELPER.EXE [2006-08-11 17920]
"CTxfiHlp "= "CTXFIHLP.EXE" - c:\windows\system32\CTXFIHLP.EXE [2006-08-11 18944]

c:\documents and settings\Chris\Start Menu\Programs\Startup\
Picture Motion Browser Media Check Tool.lnk - c:\program files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe [2009-11-11 385024]
Xfire.lnk - c:\program files\Xfire\xfire.exe [2009-11-5 3152272]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
NETGEAR WPNT121 Smart Wizard.lnk - c:\program files\NETGEAR\WPNT121\WPNT121.exe [2006-6-30 1769472]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall "= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe "=
"c:\\Program Files\\Xfire\\xfire.exe "=
"c:\\Program Files\\Azureus\\Azureus.exe "=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe "=
"c:\\Program Files\\MSN Messenger\\livecall.exe "=
"c:\\Program Files\\LimeWire\\LimeWire.exe "=
"c:\\Documents and Settings\\Ann\\Desktop\\MySpaceMp3Gopher.exe "=
"c:\\Program Files\\Steam\\Steam.exe "=
"c:\\Program Files\\mIRC\\mirc.exe "=
"c:\\Program Files\\GreedyTorrent\\GTor.exe "=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe "=
"c:\\Program Files\\Steam\\steamapps\\skvermillion13\\half-life\\hl.exe "=
"c:\\Program Files\\Steam\\steamapps\\munch5\\the ship\\ship.exe "=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe "=
"c:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Civilization4.exe "=
"c:\\Program Files\\iTunes\\iTunes.exe "=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP "= 3389:TCPxpsp2res.dll,-22009
"9420:TCP "= 9420:TCP:Akamai NetSession Interface
"5000:UDP "= 5000:UDP:Akamai NetSession Interface

R2 atisvc;atisvc;c:\program files\WebWatcherV5\atisvc.exe [11/13/2009 10:06 AM 454263]
R2 Seekdns Service;Seekdns Service;c:\documents and settings\All Users\Application Data\Seekdns\seekdns121.exe [11/5/2009 2:23 AM 58720]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2/15/2007 7:22 PM 24652]
R3 Airgo3U;NETGEAR RangeMax(TM) 240 Wireless USB 2.0 Adapter WPNT121;c:\windows\system32\drivers\TMIMO31U.sys [3/6/2006 7:49 PM 722432]
S2 srenum;srenum;c:\windows\system32\drivers\srenum.sys [11/7/2009 7:55 AM 36480]

--- Other Services/Drivers In Memory ---

*Deregistered* - mbr
.
Contents of the 'Scheduled Tasks' folder

2009-11-11 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 17:34]

2009-11-18 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-11-15 03:18]
.
.
------- Supplementary Scan -------
.
uInternet Settings,ProxyOverride = *.local
IE: &AIM Toolbar Search - c:\documents and settings\All Users\Application Data\AIM Toolbar\ieToolbar\resources\en-US\local\search.html
IE: &Download All by Gigaget - c:\program files\Giganology\Gigaget\getallurl.htm
IE: &Download by Gigaget - c:\program files\Giganology\Gigaget\geturl.htm
IE: &Search
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Chris\Application Data\Mozilla\Firefox\Profiles\m8mi9s2r.default\
FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=&query=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=&query=
FF - plugin: c:\program files\Mozilla Firefox\plugins\npclntax_HotbarSA.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\Unity\WebPlayer\loader\npUnity3D32.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-17 19:58
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe >>UNKNOWN [0x8738A808]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> 0x8738a808
\Driver\ACPI -> ACPI.sys @ 0xf763acb8
\Driver\atapi -> atapi.sys @ 0xf75d12f0
IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805a0084
ParseProcedure -> ntoskrnl.exe @ 0x8056f07e
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805a0084
ParseProcedure -> ntoskrnl.exe @ 0x8056f07e
NDIS: -> SendCompleteHandler -> 0x0
PacketIndicateHandler -> 0x0
SendHandler -> 0x0
Warning: possible MBR rootkit infection !
user & kernel MBR OK

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(632)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(2700)
c:\windows\system32\WININET.dll
c:\program files\Seekdns\seekdns.dll
c:\windows\system32\ctagent.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\System32\Ati2evxx.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Windows Media Player\WMPNetwk.exe
c:\program files\Viewpoint\Viewpoint Manager\ViewMgr.exe
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\wscntfy.exe
c:\program files\Seekdns\seekdns.exe
c:\progra~1\ACDSYS~1\DEVDET~1\DEVDET~1.EXE
c:\program files\iPod\bin\iPodService.exe
c:\program files\Internet Explorer\IEXPLORE.EXE
c:\windows\system32\dwwin.exe
.
**************************************************************************
.
Completion time: 2009-11-17 20:07 - machine was rebooted
ComboFix-quarantined-files.txt 2009-11-18 01:07
ComboFix2.txt 2009-11-17 19:26

Pre-Run: 9,906,888,704 bytes free
Post-Run: 9,858,572,288 bytes free

- - End Of File - - 38AF4BD24D78846D0C20CDAF755A4225

 

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:16:56 PM, on 11/17/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\WebWatcherV5\atisvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Documents and Settings\All Users\Application Data\Seekdns\seekdns121.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\WebWatcherV5\atisvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Seekdns\seekdns.exe
C:\Program Files\WebWatcherV5\atisvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\CTHELPER.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\PROGRA~1\ACDSYS~1\DEVDET~1\DEVDET~1.EXE
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\NETGEAR\WPNT121\WPNT121.exe
C:\Program Files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/?v=msgrv75
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: AIM Toolbar Search Class - {03402f96-3dc7-4285-bc50-9e81fefafe43} - C:\Program Files\AIM Toolbar\aimtb.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: GigagetIEHelper - {111CAA23-6F4F-42AC-8555-B48C1D87BBAB} - C:\WINDOWS\system32\gigagetbho_v10.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: AIM Toolbar Loader - {b0cda128-b425-4eef-a174-61a11ac5dbf8} - C:\Program Files\AIM Toolbar\aimtb.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: AIM Toolbar - {61539ecd-cc67-4437-a03c-9aaccbd14326} - C:\Program Files\AIM Toolbar\aimtb.dll
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe "
O4 - HKLM\..\Run: [Camera Detector] C:\PROGRA~1\ACDSYS~1\DEVDET~1\DEVDET~1.EXE -autorun
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [XboxStat] "C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe" silentrun
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe "
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - S-1-5-18 Startup: Picture Motion Browser Media Check Tool.lnk = C:\Program Files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe (User 'SYSTEM')
O4 - S-1-5-18 Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: Picture Motion Browser Media Check Tool.lnk = C:\Program Files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe (User 'Default user')
O4 - .DEFAULT Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe (User 'Default user')
O4 - Startup: Picture Motion Browser Media Check Tool.lnk = C:\Program Files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe
O4 - Global Startup: NETGEAR WPNT121 Smart Wizard.lnk = C:\Program Files\NETGEAR\WPNT121\WPNT121.exe
O8 - Extra context menu item: &AIM Toolbar Search - C:\Documents and Settings\All Users\Application Data\AIM Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: &Download All by Gigaget - C:\Program Files\Giganology\Gigaget\getallurl.htm
O8 - Extra context menu item: &Download by Gigaget - C:\Program Files\Giganology\Gigaget\geturl.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: AIM Toolbar - {0b83c99c-1efa-4259-858f-bcb33e007a5b} - C:\Program Files\AIM Toolbar\aimtb.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1170886903470
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1170887013642
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: atisvc - Unknown owner - C:\Program Files\WebWatcherV5\atisvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Seekdns Service - Unknown owner - C:\Documents and Settings\All Users\Application Data\Seekdns\seekdns121.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

--
End of file - 8648 bytes

 

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!


Completed script processing.

*******************

Finished! Terminate.