Inactive Malware Infection. STrange Windows update Issue / redirects

[Inactive] Malware Infection. STrange Windows update Issue / redirects

Hi there, posting here as a last resort. I've googled and cleaned up my system as much as possible. I was randomly infected with the AV security suite on my PC several days ago. I followed online guides to get that removed (or so I thought).

Here's some info to help out:
Windows XP SP3

Ran Spybot S&D and fixed all issues
Ran Malware bytes and fixed all issues
Trend Micro House Call and fixed 1 trojan

Symptoms:
Any time the words "Windows Update" are joined together to form a single word and are submitted in the browser -- google searches, forum searches, any form variable etc. I simply get a dead page. Thus making it very hard to troubleshoot here.

I've checked out my host file and that's not the issue. It looks fine. I'm able to ping microsoft dot com but not windows update dot com (one word).

Argh, apparently there is a word in this post as well that keeps on sending me to a dead page when i try to submit

Ended up having to email this text to myself and then submit it from my laptop.

DDS Log:


DDS (Ver_10-03-17.01) - NTFSx86
Run by s0urce at 12:00:52.96 on Wed 07/07/2010
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_20
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1918.943 [GMT -7:00]


============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
C:\WINDOWS\system32\Ati2evxx.exe
svchost.exe
svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\Program Files\Logitech\Easy Synchronization\LogitechEasySync.exe
C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Logitech\QuickCam\Quickcam.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Hot Keyboard Pro\HotKeyb.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\UltraMon\UltraMon.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\UltraMon\UltraMonTaskbar.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Logitech\Easy Synchronization\servicestub.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Logitech\Easy Synchronization\LogitechEasySync.exe
C:\Program Files\Palm, Inc\novacom\x86\novacomd.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\TVersity\Media Server\MediaServer.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Windows NT\Accessories\WORDPAD.EXE
C:\Documents and Settings\s0urce\My Documents\Downloads\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://holesolutions.net/
uInternet Settings,ProxyServer = http=127.0.0.1:5577
uInternet Settings,ProxyOverride = <local>
BHO: ContributeBHO Class: {074c1dc5-9320-4a9a-947d-c042949c6216} - c:\program files\adobe\/Adobe Contribute CS4/contributeieplugin.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: SmartSelect Class: {f4971ee7-daa0-4053-9964-665d8ee6a077} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
TB: Contribute Toolbar: {517bdde4-e3a7-4570-b21e-2b52b6139fc7} - c:\program files\adobe\/Adobe Contribute CS4/contributeieplugin.dll
uRun: [Hot Keyboard] c:\program files\hot keyboard pro\HotKeyb.exe -minimized
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [LogitechSetup] c:\docume~1\s0urce\locals~1\temp\quickcam_11.1.0\setup.exe /skip_all_checks /p /start /restart /l:enu
mRun: [amd_dc_opt] c:\program files\amd\dual-core optimizer\amd_dc_opt.exe
mRun: [StartCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun
mRun: [googletalk] c:\program files\google\google talk\googletalk.exe /autostart
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe "
mRun: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
mRun: [Easy Synchronization] c:\program files\logitech\easy synchronization\LogitechEasySync.exe
mRun: [Adobe Acrobat Speed Launcher] "c:\program files\adobe\acrobat 9.0\acrobat\Acrobat_sl.exe "
mRun: [<NO NAME>]
mRun: [Acrobat Assistant 8.0] "c:\program files\adobe\acrobat 9.0\acrobat\Acrotray.exe "
mRun: [LogitechCommunicationsManager] "c:\program files\common files\logishrd\lcommgr\Communications_Helper.exe "
mRun: [LogitechQuickCamRibbon] "c:\program files\logitech\quickcam\Quickcam.exe" /hide
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe "
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe "
mRunOnce: [Easy Synchronization] c:\program files\logitech\easy synchronization\LogitechEasySync.exe --ports
StartupFolder: c:\documents and settings\s0urce\start menu\programs\startup\Pandora.lnk.disabled
StartupFolder: c:\documents and settings\all users\start menu\programs\startup\BDARemote.lnk.disabled
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\blueto~1.lnk - c:\program files\widcomm\bluetooth software\BTTray.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\logite~1.lnk - c:\program files\logitech\setpoint\SetPoint.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\ultramon.lnk - c:\windows\installer\{af0fa6d7-96f3-468a-abb7-28be006ea8e9}\IcoUltraMon.ico
uPolicies-explorer: NoSMConfigurePrograms = 1 (0x1)
dPolicies-explorer: ForceClassicControlPanel = 1 (0x1)
dPolicies-explorer: NoSMHelp = 1 (0x1)
dPolicies-explorer: NoSMConfigurePrograms = 1 (0x1)
IE: Append Link Target to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppend.html
IE: Assign &hot key - c:\program files\hot keyboard pro\IEScript.htm
IE: Convert Link Target to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECapture.html
IE: Send to &Bluetooth Device... - c:\program files\widcomm\bluetooth software\btsendto_ie_ctx.htm
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
Trusted Zone: microsoft.com\v4.windowsupdate
Trusted Zone: microsoft.com\windowsupdate
Trusted Zone: microsoft.com\www
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1265605580875
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1278486651336
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: AtiExtEvent - Ati2evxx.dll
Notify: LBTWlgn - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
SEH: ShellExecuteHook class: {fe24cd78-7c63-465d-8787-4edf7fc79895} - c:\program files\logitech\easy synchronization\shellexecutehook.dll
Hosts: 127.0.0.1 www.spywareinfo.com

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\s0urce\applic~1\mozilla\firefox\profiles\tbqrl7su.default\
FF - prefs.js: browser.startup.homepage - igoogle.com
FF - prefs.js: network.proxy.type - 0
FF - component: c:\documents and settings\s0urce\application data\mozilla\firefox\profiles\tbqrl7su.default\extensions\{81bf1d23-5f17-408d-ac6b-bd6df7caf670}\components\XpcomOpusConnector.dll
FF - plugin: c:\documents and settings\s0urce\application data\facebook\npfbplugin_1_0_3.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\all.js - pref( "ui.use_native_colors ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "ui.use_native_popup_windows ", false);
c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.enable_click_image_resizing ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "accessibility.browsewithcaret_shortcut.enabled ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "javascript.options.mem.high_water_mark ", 32);
c:\program files\mozilla firefox\greprefs\all.js - pref( "javascript.options.mem.gc_frequency ", 1600);
c:\program files\mozilla firefox\greprefs\all.js - pref( "network.IDN.whitelist.lu ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "network.IDN.whitelist.nu ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "network.IDN.whitelist.nz ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "network.IDN.whitelist.xn--mgberp4a5d4ar ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "network.IDN.whitelist.xn--p1ai ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "network.IDN.whitelist.xn--mgbayh7gpa ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "network.IDN.whitelist.tel ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "network.auth.force-generic-ntlm ", false);
c:\program files\mozilla firefox\greprefs\all.js - pref( "network.proxy.type ", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref( "dom.ipc.plugins.timeoutSecs ", 45);
c:\program files\mozilla firefox\greprefs\all.js - pref( "svg.smil.enabled ", false);
c:\program files\mozilla firefox\greprefs\all.js - pref( "ui.trackpoint_hack.enabled ", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.debug ", false);
c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.agedWeight ", 2);
c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.bucketSize ", 1);
c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.maxTimeGroupings ", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.timeGroupingSize ", 604800);
c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.boundaryWeight ", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.prefixWeight ", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref( "accelerometer.enabled ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "html5.enable ", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref( "security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref ", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref( "security.ssl.renego_unrestricted_hosts ", " ");
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref( "security.ssl.treat_unsafe_negotiation_as_broken ", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref( "security.ssl.require_safe_negotiation ", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref( "security.ssl3.rsa_seed_sha ", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref( "app.update.download.backgroundInterval ", 600);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref( "app.update.url.manual ", "http://www.firefox.com ");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref( "browser.search.param.yahoo-fr-ja ", "mozff ");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name ", "chrome://browser/locale/browser.properties ");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description ", "chrome://browser/locale/browser.properties ");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "xpinstall.whitelist.add ", "addons.mozilla.org ");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "xpinstall.whitelist.add.36 ", "getpersonas.com ");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "lightweightThemes.update.enabled ", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "browser.allTabs.previews ", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "plugins.hide_infobar_for_outdated_plugin ", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "plugins.update.notifyUser ", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "toolbar.customization.usesheet ", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "dom.ipc.plugins.enabled.nptest.dll ", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "dom.ipc.plugins.enabled.npswf32.dll ", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "dom.ipc.plugins.enabled.npctrl.dll ", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "dom.ipc.plugins.enabled.npqtplugin.dll ", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "dom.ipc.plugins.enabled ", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "browser.taskbar.previews.enable ", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "browser.taskbar.previews.max ", 20);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "browser.taskbar.previews.cachetime ", 20);

============= SERVICES / DRIVERS ===============

R2 LBeepKE;LBeepKE;c:\windows\system32\drivers\LBeepKE.sys [2009-11-22 10384]
R2 NovacomD;Palm Novacom;c:\program files\palm, inc\novacom\x86\novacomd.exe [2009-11-6 33280]
R2 UltraMonUtility;UltraMon Utility Driver;c:\program files\common files\realtime soft\ultramonmirrordrv\x32\UltraMonUtility.sys [2006-9-24 11776]
R3 rrau0002;rrau0002;c:\windows\system32\drivers\rrau0002.sys [2010-4-1 24576]
R3 rrwd0002;rrwd0002;c:\windows\system32\drivers\rrwd0002.sys [2010-4-1 97280]
R3 UltraMonMirror;UltraMonMirror;c:\windows\system32\drivers\UltraMonMirror.sys [2006-9-24 3584]
S3 Adobe Version Cue CS4;Adobe Version Cue CS4;c:\program files\common files\adobe\adobe version cue cs4\server\bin\VersionCueCS4.exe [2008-8-15 284016]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\ambfilt.sys --> c:\windows\system32\drivers\Ambfilt.sys [?]
S3 cmudaxp;C-Media Oxygen HD Audio Interface;c:\windows\system32\drivers\cmudaxp.sys [2009-10-20 1774080]

=============== Created Last 30 ================

2010-07-07 07:50:28 0 d-sh--w- c:\documents and settings\s0urce\IECompatCache
2010-07-07 07:08:49 73728 ----a-w- c:\windows\system32\javacpl.cpl
2010-07-07 07:08:49 411368 ----a-w- c:\windows\system32\deployJava1.dll
2010-07-07 04:55:01 0 d-----w- c:\docume~1\s0urce\applic~1\Malwarebytes
2010-07-07 04:54:55 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-07-07 04:54:54 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-07-07 04:54:54 0 d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-07-07 04:54:54 0 d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes
2010-07-07 04:49:38 126 ----a-w- c:\windows\wininit.ini
2010-07-06 00:33:33 7680 --sha-w- c:\windows\system32\Thumbs.db
2010-06-26 06:46:42 0 d-----w- c:\docume~1\s0urce\applic~1\Facebook
2010-06-23 03:24:28 0 d-----w- C:\CS5
2010-06-23 01:13:04 0 d-----w- c:\program files\nLite
2010-06-14 21:33:18 0 d-----w- C:\php-tools

==================== Find3M ====================

2010-06-28 17:04:41 0 ----a-w- c:\windows\system32\drivers\lvuvc.hs
2010-04-19 05:15:38 17488 ----a-w- c:\windows\gdrv.sys
2010-04-12 13:52:05 136 ----a-w- c:\program files\results.txt
2010-04-12 13:51:47 106 ----a-w- c:\program files\local.txt
2010-04-12 13:30:20 303 ----a-w- c:\program files\prime.txt
2010-04-07 01:34:48 1846 ----a-w- c:\program files\Bendometer PS.lnk
2009-07-13 12:04:46 5132288 ----a-w- c:\program files\prime95.exe

============= FINISH: 12:01:55.71 ===============



Attach.txt Log


UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-03-17.01)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 10/20/2009 4:37:06 PM
System Uptime: 7/7/2010 11:06:23 AM (1 hours ago)

Motherboard: Gigabyte Technology Co., Ltd. | | GA-MA69G-S3H
Processor: AMD Athlon(tm) 64 X2 Dual Core Processor 5400+ | Socket M2 | 2806/200mhz

==== Disk Partitions =========================

A: is Removable
C: is FIXED (NTFS) - 373 GiB total, 268.347 GiB free.
D: is FIXED (NTFS) - 373 GiB total, 2.359 GiB free.
E: is CDROM ()
F: is CDROM (UDF)

==== Disabled Device Manager Items =============

==== System Restore Points ===================

No restore point in system.

==== Installed Programs ======================

@BIOS
µTorrent
Acrobat.com
Actual Search & Replace Version 2.8.5
Adobe Acrobat 9 Pro - English, Français, Deutsch
Adobe Acrobat 9.3.3 - CPSID_83708
Adobe After Effects CS4
Adobe After Effects CS4 Presets
Adobe After Effects CS4 Third Party Content
Adobe AIR
Adobe Anchor Service CS4
Adobe Asset Services CS4
Adobe Bridge CS4
Adobe CMaps CS4
Adobe Color - Photoshop Specific CS4
Adobe Color EU Extra Settings CS4
Adobe Color JA Extra Settings CS4
Adobe Color NA Recommended Settings CS4
Adobe Color Video Profiles AE CS4
Adobe Color Video Profiles CS CS4
Adobe Contribute CS4
Adobe Creative Suite 4 Master Collection
Adobe CS4 American English Speech Analysis Models
Adobe CSI CS4
Adobe Default Language CS4
Adobe Device Central CS4
Adobe Dreamweaver CS4
Adobe Drive CS4
Adobe Dynamiclink Support
Adobe Encore CS4
Adobe Encore CS4 Codecs
Adobe ExtendScript Toolkit CS4
Adobe Extension Manager CS4
Adobe Fireworks CS4
Adobe Flash CS4
Adobe Flash CS4 Extension - Flash Lite STI en
Adobe Flash CS4 STI-en
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Fonts All
Adobe Illustrator CS4
Adobe InDesign CS4
Adobe InDesign CS4 Application Feature Set Files (Roman)
Adobe InDesign CS4 Common Base Files
Adobe InDesign CS4 Icon Handler
Adobe Linguistics CS4
Adobe Media Encoder CS4
Adobe Media Encoder CS4 Additional Exporter
Adobe Media Encoder CS4 Dolby
Adobe Media Encoder CS4 Exporter
Adobe Media Encoder CS4 Importer
Adobe Media Player
Adobe MotionPicture Color Files CS4
Adobe OnLocation CS4
Adobe Output Module
Adobe PDF Library Files CS4
Adobe Photoshop CS4
Adobe Photoshop CS4 Support
Adobe Premiere Pro CS4
Adobe Premiere Pro CS4 Functional Content
Adobe Premiere Pro CS4 Third Party Content
Adobe Reader 9.3.2
Adobe Search for Help
Adobe Service Manager Extension
Adobe Setup
Adobe SGM CS4
Adobe SING CS4
Adobe Soundbooth CS4
Adobe Soundbooth CS4 Codecs
Adobe Type Support CS4
Adobe Update Manager CS4
Adobe Version Cue CS4 Server
Adobe WinSoft Linguistics Plugin
Adobe XMP Panels CS4
AdobeColorCommonSetCMYK
AdobeColorCommonSetRGB
ATI - Software Uninstall Utility
ATI AVIVO Codecs
ATI Catalyst Control Center
ATI Display Driver
Catalyst Control Center - Branding
Catalyst Control Center Core Implementation
Catalyst Control Center Graphics Full Existing
Catalyst Control Center Graphics Full New
Catalyst Control Center Graphics Light
Catalyst Control Center Graphics Previews Common
Catalyst Control Center HydraVision Full
Catalyst Control Center Localization All
ccc-core-preinstall
ccc-core-static
ccc-utility
CCC Help Chinese Standard
CCC Help Chinese Traditional
CCC Help Czech
CCC Help Danish
CCC Help Dutch
CCC Help English
CCC Help Finnish
CCC Help French
CCC Help German
CCC Help Greek
CCC Help Hungarian
CCC Help Italian
CCC Help Japanese
CCC Help Korean
CCC Help Norwegian
CCC Help Polish
CCC Help Portuguese
CCC Help Russian
CCC Help Spanish
CCC Help Swedish
CCC Help Thai
CCC Help Turkish
CDDRV_Installer
Connect
CoreAVC Professional Edition (remove only)
Data Lifeguard Diagnostic for Windows
Dual-Core Optimizer
EDIROL FA-66 Driver
erLT
EVEREST Ultimate Edition v5.50
Facebook Plug-In
ffdshow [rev 1723] [2007-12-24]
Google Talk (remove only)
GTR 2 1.0.0.0
Haali Media Splitter
High Definition Audio Driver Package - KB835221
Hot Keyboard Pro 3.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Windows XP (KB954550-v5)
Java Auto Updater
Java(TM) 6 Update 20
JGsoft RegexBuddy 3 v.3.2.1
KhalInstallWrapper
kuler
Logitech QuickCam
Logitech SetPoint
Logitech® Camera Driver
Malwarebytes' Anti-Malware
Media Player Classic - Home Cinema v. 1.3.1249.0
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
Microsoft User-Mode Driver Framework Feature Pack 1.7
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft WinUsb 1.0
mIRC
mkv2vob
Mobile Phone Suite Easy Synchronization
Mozilla Firefox (3.6.6)
Mozilla Thunderbird (3.1)
MSXML 6.0 Parser
MVision
nLite 1.4.9.1
Notepad++
Novacomd
NVIDIA Photoshop Plug-ins
OpenOffice.org 3.1
Pandora
PDF Settings CS4
Photoshop Camera Raw
Pixel Bender Toolkit
PremiumSoft Navicat Premium 8.2
PuTTY Connection Manager 0.7.1.136beta
Security Update for Windows Internet Explorer 8 (KB976325)
Security Update for Windows Internet Explorer 8 (KB978207)
Skins
Skype™ 4.2
Spybot - Search & Destroy
Steam
Suite Shared Configuration CS4
Team Fortress 2
TrackMania United Forever
Trillian
TVersity Codec Pack 1.2
TVersity Media Server 1.8 Beta
UltraMon
Update for Windows Internet Explorer 8 (KB978506)
Update for Windows XP (KB898461)
USB Video Driver
Ventrilo Client
VLC media player 1.0.2
WIDCOMM Bluetooth Software
Winamp
Windows Driver Package - Advanced Micro Devices, Inc. (USB28xxBGA) Media (08/31/2007 5.7.0831.0)
Windows Driver Package - eMPIA Technology Inc, (emAudio) MEDIA (08/31/2007 5.7.0831.0)
Windows Driver Package - Palm (WinUSB) Palm Devices (11/30/2008 1.0.0)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 8
Windows Media Format Runtime
WinRAR archiver
WinSCP 4.2.4 beta

==== Event Viewer Messages From Past Week ========

7/7/2010 2:19:21 AM, error: Service Control Manager [7034] - The Network Location Awareness (NLA) service terminated unexpectedly. It has done this 2 time(s).
7/7/2010 2:19:21 AM, error: Service Control Manager [7034] - The COM+ Event System service terminated unexpectedly. It has done this 2 time(s).
7/7/2010 12:59:34 AM, error: Service Control Manager [7034] - The Logitech Easy Synchronization service terminated unexpectedly. It has done this 1 time(s).
7/7/2010 11:02:21 AM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the stisvc service.
7/7/2010 10:55:43 AM, error: TermService [1036] - Terminal Server session creation failed. The relevant status code was 0xC0000262.
7/7/2010 1:08:33 AM, error: Service Control Manager [7034] - The Process Monitor service terminated unexpectedly. It has done this 1 time(s).
7/6/2010 9:29:20 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Fips Processor
7/6/2010 9:28:14 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments " " in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
7/6/2010 6:15:29 PM, error: TermDD [50] - The RDP protocol component X.224 detected an error in the protocol stream and has disconnected the client.
7/6/2010 10:46:41 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments " " in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
7/5/2010 11:06:18 PM, error: TermService [1006] - The terminal server received large number of incomplete connections. The system may be under attack.

==== End Of File ===========================

 

Thank you so much for your help so far Broni. Things are starting to look good for the PC.

After a full system scan with avast there were several trojans that were deleted.

Combofix Log is below:

ComboFix 10-07-06.05 - s0urce 07/07/2010 16:08:34.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1918.1469 [GMT -7:00]
Running from: c:\documents and settings\s0urce\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Mozilla Firefox\searchplugins\zwunzi14.xml
c:\program files\Mozilla Firefox\searchplugins\zwunzi141.xml
c:\program files\Mozilla Firefox\searchplugins\zwunzi143.xml
c:\program files\Mozilla Firefox\searchplugins\zwunzi145.xml
c:\program files\Mozilla Firefox\searchplugins\zwunzi147.xml
c:\windows\system32\msconfig.exe
c:\windows\system32\Thumbs.db

Infected copy of c:\windows\system32\drivers\pciide.sys was found and disinfected
Restored copy from - Kitty had a snack
c:\windows\system32\srsvc.dll . . . is infected!!

.
((((((((((((((((((((((((( Files Created from 2010-06-07 to 2010-07-07 )))))))))))))))))))))))))))))))
.

2010-07-07 20:54 . 2010-06-28 20:32 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-07-07 20:54 . 2010-06-28 20:37 165456 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-07-07 20:54 . 2010-06-28 20:33 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-07-07 20:54 . 2010-06-28 20:37 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-07-07 20:54 . 2010-06-28 20:32 100176 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-07-07 20:54 . 2010-06-28 20:32 94544 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-07-07 20:54 . 2010-06-28 20:32 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2010-07-07 20:54 . 2010-06-28 20:57 38848 ----a-w- c:\windows\avastSS.scr
2010-07-07 20:54 . 2010-06-28 20:57 165032 ----a-w- c:\windows\system32\aswBoot.exe
2010-07-07 20:54 . 2010-07-07 20:54 -------- d-----w- c:\program files\Alwil Software
2010-07-07 20:54 . 2010-07-07 20:54 -------- d-----w- c:\documents and settings\All Users\Application Data\Alwil Software
2010-07-07 07:50 . 2010-07-07 07:50 -------- d-sh--w- c:\documents and settings\s0urce\IECompatCache
2010-07-07 07:09 . 2010-07-07 07:09 -------- d-----w- c:\program files\Common Files\Java
2010-07-07 07:08 . 2010-07-07 07:08 503808 ----a-w- c:\documents and settings\s0urce\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-5878d5d1-n\msvcp71.dll
2010-07-07 07:08 . 2010-07-07 07:08 61440 ----a-w- c:\documents and settings\s0urce\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-648f6d7c-n\decora-sse.dll
2010-07-07 07:08 . 2010-07-07 07:08 499712 ----a-w- c:\documents and settings\s0urce\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-5878d5d1-n\jmc.dll
2010-07-07 07:08 . 2010-07-07 07:08 348160 ----a-w- c:\documents and settings\s0urce\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-5878d5d1-n\msvcr71.dll
2010-07-07 07:08 . 2010-07-07 07:08 12800 ----a-w- c:\documents and settings\s0urce\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-648f6d7c-n\decora-d3d.dll
2010-07-07 07:08 . 2010-07-07 07:08 411368 ----a-w- c:\windows\system32\deployJava1.dll
2010-07-07 07:08 . 2010-07-07 07:08 -------- d-----w- c:\program files\Java
2010-07-07 04:55 . 2010-07-07 04:55 -------- d-----w- c:\documents and settings\s0urce\Application Data\Malwarebytes
2010-07-07 04:54 . 2010-04-29 22:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-07-07 04:54 . 2010-07-07 04:54 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-07-07 04:54 . 2010-07-07 04:54 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-07-07 04:54 . 2010-04-29 22:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-07-06 00:31 . 2010-07-06 00:31 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2010-07-01 21:39 . 2010-07-05 23:01 -------- d-----w- c:\documents and settings\s0urce\Application Data\dvdcss
2010-06-26 06:46 . 2010-06-26 06:46 50354 ----a-w- c:\documents and settings\s0urce\Application Data\Facebook\uninstall.exe
2010-06-26 06:46 . 2010-06-26 06:46 -------- d-----w- c:\documents and settings\s0urce\Application Data\Facebook
2010-06-23 03:24 . 2010-06-23 03:26 -------- d-----w- C:\CS5
2010-06-23 01:13 . 2010-06-23 03:11 -------- d-----w- c:\program files\nLite
2010-06-14 21:33 . 2010-06-14 21:33 -------- d-----w- C:\php-tools
2010-06-12 04:25 . 2010-06-12 04:25 -------- d-----w- c:\documents and settings\s0urce\Application Data\Notepad++
2010-06-12 04:25 . 2010-06-12 04:25 -------- d-----w- c:\program files\Notepad++
2010-06-09 10:45 . 2010-06-09 10:45 5591040 ----a-w- c:\documents and settings\s0urce\Application Data\Facebook\npfbplugin_1_0_3.dll
2010-06-09 08:06 . 2010-06-09 08:06 976832 ----a-w- c:\documents and settings\All Users\Application Data\Adobe\Acrobat\9.3\ARM\4869\AdobeARM.exe
2010-06-09 08:06 . 2010-06-09 08:06 70584 ----a-w- c:\documents and settings\All Users\Application Data\Adobe\Acrobat\9.3\ARM\4869\AdobeExtractFiles.dll
2010-06-09 08:06 . 2010-06-09 08:06 331176 ----a-w- c:\documents and settings\All Users\Application Data\Adobe\Acrobat\9.3\ARM\4869\ReaderUpdater.exe
2010-06-09 08:06 . 2010-06-09 08:06 331176 ----a-w- c:\documents and settings\All Users\Application Data\Adobe\Acrobat\9.3\ARM\4869\AcrobatUpdater.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-07 23:01 . 2010-04-21 09:58 0 ----a-w- c:\windows\system32\drivers\lvuvc.hs
2010-07-07 22:50 . 2009-12-16 02:06 -------- d-----w- c:\documents and settings\s0urce\Application Data\Skype
2010-07-07 18:37 . 2009-10-21 00:20 -------- d-----w- c:\documents and settings\s0urce\Application Data\vlc
2010-07-07 18:07 . 2010-01-16 09:49 -------- d-----w- c:\documents and settings\s0urce\Application Data\Hot Keyboard Pro Backup
2010-07-07 07:57 . 2009-10-20 23:49 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2010-07-07 07:56 . 2009-12-10 06:29 -------- d-----w- c:\program files\Common Files\Blizzard Entertainment
2010-07-07 04:08 . 2009-10-21 00:12 -------- d-----w- c:\documents and settings\s0urce\Application Data\uTorrent
2010-07-03 01:25 . 2009-11-03 09:26 -------- d-----w- c:\program files\Mozilla Thunderbird
2010-07-03 01:25 . 2009-11-03 09:26 -------- d-----w- c:\documents and settings\s0urce\Application Data\Thunderbird
2010-06-28 05:10 . 2009-10-21 00:27 -------- d-----w- c:\program files\Steam
2010-06-22 05:14 . 2010-01-15 00:43 1 ----a-w- c:\documents and settings\s0urce\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-06-05 01:10 . 2010-04-13 00:19 -------- d-----w- c:\program files\PuTTY Connection Manager
2010-05-19 04:24 . 2010-04-15 05:28 -------- d-----w- c:\program files\Trillian
2010-05-17 05:15 . 2009-10-21 00:12 -------- d-----w- c:\program files\uTorrent
2010-05-17 04:29 . 2010-05-17 04:29 -------- d-----w- c:\program files\SC2
2010-04-29 19:05 . 2010-06-06 11:26 10752 ----a-w- c:\documents and settings\s0urce\Application Data\Mozilla\Firefox\Profiles\tbqrl7su.default\extensions\{FFA36170-80B1-4535-B0E3-A4569E497DD0}\platform\WINNT_x86-msvc\components\mgMouseService.dll
2010-04-26 04:15 . 2010-04-26 04:15 29184 ----a-r- c:\documents and settings\s0urce\Application Data\Microsoft\Installer\{21AE04E8-EBF6-40DB-9AA9-B7A80C5D057D}\Icon21AE04E8.exe
2010-04-21 09:57 . 2010-04-21 09:57 10134 ----a-r- c:\documents and settings\s0urce\Application Data\Microsoft\Installer\{35725FBC-A136-4A46-9F29-091759D9BB93}\ARPPRODUCTICON.exe
2010-04-19 05:15 . 2010-04-11 11:51 17488 ----a-w- c:\windows\gdrv.sys
2010-04-12 13:52 . 2010-04-12 13:52 136 ----a-w- c:\program files\results.txt
2010-04-12 13:51 . 2010-04-12 13:29 106 ----a-w- c:\program files\local.txt
2010-04-12 13:30 . 2010-04-12 13:29 303 ----a-w- c:\program files\prime.txt
2010-04-07 01:34 . 2010-04-07 01:34 1846 ----a-w- c:\program files\Bendometer PS.lnk
2009-07-13 12:04 . 2010-04-12 09:58 5132288 ----a-w- c:\program files\prime95.exe
.

------- Sigcheck -------



[-] 2009-07-04 . 320D10A286EDB4F7B870F5D8BA94A752 . 1614848 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll


c:\windows\System32\srsvc.dll ... is missing !!
c:\windows\System32\wscntfy.exe ... is missing !!
c:\windows\System32\regsvc.dll ... is missing !!
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Hot Keyboard "= "c:\program files\Hot Keyboard Pro\HotKeyb.exe" [2009-12-08 1049256]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"amd_dc_opt "= "c:\program files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2008-07-22 77824]
"StartCCC "= "c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-07-21 61440]
"googletalk "= "c:\program files\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]
"Adobe ARM "= "c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"Kernel and Hardware Abstraction Layer "= "KHALMNPR.EXE" [2009-06-17 55824]
"Easy Synchronization "= "c:\program files\Logitech\Easy Synchronization\LogitechEasySync.exe" [2005-10-05 53248]
"Adobe Acrobat Speed Launcher "= "c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2010-06-20 38840]
"Acrobat Assistant 8.0 "= "c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2010-06-19 640440]
"LogitechCommunicationsManager "= "c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-07-25 563984]
"LogitechQuickCamRibbon "= "c:\program files\Logitech\QuickCam\Quickcam.exe" [2007-07-25 2027792]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]
"SunJavaUpdateSched "= "c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"avast5 "= "c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-06-28 2837864]

c:\documents and settings\s0urce\Start Menu\Programs\Startup\
Pandora.lnk.disabled [2009-12-31 628]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
BDARemote.lnk.disabled [2009-10-20 531]
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-11-29 561213]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2009-11-22 813584]
UltraMon.lnk - c:\windows\Installer\{AF0FA6D7-96F3-468A-ABB7-28BE006EA8E9}\IcoUltraMon.ico [2009-10-20 29310]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMConfigurePrograms "= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel "= 1 (0x1)
"NoSMHelp "= 1 (0x1)
"NoSMConfigurePrograms "= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{FE24CD78-7C63-465D-8787-4EDF7FC79895} "= "c:\program files\Logitech\Easy Synchronization\shellexecutehook.dll" [2005-10-05 69632]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2009-07-20 20:28 72208 ----a-w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@= "Driver "

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=" "

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Google Update "= "c:\documents and settings\s0urce\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
"AdobeBridge "=

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Cmaudio8788 "=RunDll32 cmicnfgp.cpl,CMICtrlWnd
"Adobe_ID0ENQBO "=c:\progra~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
"AdobeCS4ServiceManager "= "c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe "

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall "= 0 (0x0)
"DisableUnicastResponsesToMulticastBroadcast "= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"c:\\Program Files\\uTorrent\\uTorrent.exe "=
"c:\\Program Files\\Google\\Google Talk\\googletalk.exe "=
"c:\\Program Files\\Steam\\Steam.exe "=
"c:\\Program Files\\Steam\\steamapps\\common\\trackmania united\\TmForever.exe "=
"c:\\Program Files\\Steam\\steamapps\\common\\trackmania united\\TmForeverLauncher.exe "=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe "=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe "=
"c:\\Program Files\\Common Files\\Adobe\\Adobe Version Cue CS4\\Server\\bin\\VersionCueCS4.exe "=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe "=
"c:\\Program Files\\Skype\\Phone\\Skype.exe "=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP "= 3389:TCPxpsp2res.dll,-22009
"5353:TCP "= 5353:TCP:Adobe CSI CS4
"3703:TCP "= 3703:TCP:Adobe Version Cue CS4 Server
"3704:TCP "= 3704:TCP:Adobe Version Cue CS4 Server
"51000:TCP "= 51000:TCP:Adobe Version Cue CS4 Server
"51001:TCP "= 51001:TCP:Adobe Version Cue CS4 Server

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [7/7/2010 1:54 PM 165456]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [7/7/2010 1:54 PM 17744]
R2 LBeepKE;LBeepKE;c:\windows\system32\drivers\LBeepKE.sys [11/22/2009 2:13 AM 10384]
R2 NovacomD;Palm Novacom;c:\program files\Palm, Inc\novacom\x86\novacomd.exe [11/6/2009 1:03 PM 33280]
R2 UltraMonUtility;UltraMon Utility Driver;c:\program files\Common Files\Realtime Soft\UltraMonMirrorDrv\x32\UltraMonUtility.sys [9/24/2006 8:22 PM 11776]
R3 rrau0002;rrau0002;c:\windows\system32\drivers\rrau0002.sys [4/1/2010 7:54 PM 24576]
R3 rrwd0002;rrwd0002;c:\windows\system32\drivers\rrwd0002.sys [4/1/2010 7:54 PM 97280]
R3 UltraMonMirror;UltraMonMirror;c:\windows\system32\drivers\UltraMonMirror.sys [9/24/2006 8:23 PM 3584]
S3 Adobe Version Cue CS4;Adobe Version Cue CS4;c:\program files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe [8/15/2008 6:46 AM 284016]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys --> c:\windows\system32\drivers\Ambfilt.sys [?]
S3 cmudaxp;C-Media Oxygen HD Audio Interface;c:\windows\system32\drivers\cmudaxp.sys [10/20/2009 5:03 PM 1774080]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - HELPSVC

NETSVCS REQUIRES REPAIRS - current entries shown
6to4
AppMgmt
AudioSrv
Browser
CryptSvc
DMServer
DHCP
EventSystem
FastUserSwitchingCompatibility
HidServ
Ias
Iprip
Irmon
LanmanServer
LanmanWorkstation
Netman
Nla
NWCWorkstation
Nwsapagent
Rasauto
Rasman
Remoteaccess
Schedule
Seclogon
SENS
Sharedaccess
Tapisrv
Themes
W32Time
WZCSVC
Wmi
WmdmPmSp
winmgmt
xmlprov
napagent
hkmsvc
BITS
wuauserv
ShellHWDetection
WmdmPmSN

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs

.
Contents of the 'Scheduled Tasks' folder

2010-07-07 c:\windows\Tasks\daily sgdne.job
- c:\program files\PremiumSoft\Navicat Premium 8.2\navicat.exe [2010-03-29 18:06]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://holesolutions.net/
uInternet Settings,ProxyServer = http=127.0.0.1:5577
uInternet Settings,ProxyOverride = <local>
IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Assign &hot key - c:\program files\Hot Keyboard Pro\IEScript.htm
IE: Convert Link Target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
Trusted Zone: microsoft.com\v4.windowsupdate
Trusted Zone: microsoft.com\windowsupdate
Trusted Zone: microsoft.com\www
FF - ProfilePath - c:\documents and settings\s0urce\Application Data\Mozilla\Firefox\Profiles\tbqrl7su.default\
FF - prefs.js: browser.startup.homepage - igoogle.com
FF - prefs.js: network.proxy.type - 0
FF - component: c:\documents and settings\s0urce\Application Data\Mozilla\Firefox\Profiles\tbqrl7su.default\extensions\{81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}\components\XpcomOpusConnector.dll
FF - plugin: c:\documents and settings\s0urce\Application Data\Facebook\npfbplugin_1_0_3.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "ui.use_native_colors ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.lu ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.nu ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.nz ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.xn--mgberp4a5d4ar ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.xn--p1ai ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.xn--mgbayh7gpa ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.tel ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.auth.force-generic-ntlm ", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.proxy.type ", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "dom.ipc.plugins.timeoutSecs ", 45);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "svg.smil.enabled ", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "accelerometer.enabled ", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref ", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.ssl.renego_unrestricted_hosts ", " ");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.ssl.treat_unsafe_negotiation_as_broken ", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.ssl.require_safe_negotiation ", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name ", "chrome://browser/locale/browser.properties ");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description ", "chrome://browser/locale/browser.properties ");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "plugins.update.notifyUser ", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "dom.ipc.plugins.enabled.nptest.dll ", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "dom.ipc.plugins.enabled.npswf32.dll ", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "dom.ipc.plugins.enabled.npctrl.dll ", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "dom.ipc.plugins.enabled.npqtplugin.dll ", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "dom.ipc.plugins.enabled ", false);
.
- - - - ORPHANS REMOVED - - - -

AddRemove-EDIROL FA-66 Driver Setup - c:\program files\EDIROL\FA-66\uninst.exe Software\EDIROL\FA-66\Setup



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-07 16:15
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(800)
c:\windows\system32\Ati2evxx.dll
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
c:\program files\common files\logishrd\bluetooth\LBTServ.dll
.
Completion time: 2010-07-07 16:17:04
ComboFix-quarantined-files.txt 2010-07-07 23:16

Pre-Run: 287,462,195,200 bytes free
Post-Run: 289,131,143,168 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT= "Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS= "Microsoft Windows XP Professional" /noexecute=optin /fastdetect /usepmtimer

- - End Of File - - 98D31C62521F9802D93A0FDDE4DE8AEF

 

Should I post the logs from avast as well?

 

System Look Results:

SystemLook v1.0 by jpshortstuff (11.01.10)
Log created at 19:08 on 07/07/2010 by s0urce (Administrator - Elevation successful)

========== filefind ==========

Searching for "srsvc.dll "
No files found.

Searching for "wscntfy.exe "
No files found.

Searching for "regsvc.dll "
No files found.

-=End Of File=-

 

Broni, latest combofix log is below:

ComboFix 10-07-06.05 - s0urce 07/07/2010 20:50:35.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1918.1146 [GMT -7:00]
Running from: c:\documents and settings\s0urce\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\Thumbs.db

.
((((((((((((((((((((((((( Files Created from 2010-06-08 to 2010-07-08 )))))))))))))))))))))))))))))))
.

2010-07-08 03:49 . 2008-04-14 12:42 59904 ----a-w- c:\windows\system32\regsvc.dll
2010-07-08 03:49 . 2008-03-21 08:36 171008 ----a-w- c:\windows\system32\srsvc.dll
2010-07-08 03:49 . 2007-10-31 04:33 13824 ----a-w- c:\windows\system32\wscntfy.exe
2010-07-07 20:54 . 2010-06-28 20:32 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-07-07 20:54 . 2010-06-28 20:37 165456 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-07-07 20:54 . 2010-06-28 20:33 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-07-07 20:54 . 2010-06-28 20:37 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-07-07 20:54 . 2010-06-28 20:32 100176 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-07-07 20:54 . 2010-06-28 20:32 94544 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-07-07 20:54 . 2010-06-28 20:32 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2010-07-07 20:54 . 2010-06-28 20:57 38848 ----a-w- c:\windows\avastSS.scr
2010-07-07 20:54 . 2010-06-28 20:57 165032 ----a-w- c:\windows\system32\aswBoot.exe
2010-07-07 20:54 . 2010-07-07 20:54 -------- d-----w- c:\program files\Alwil Software
2010-07-07 20:54 . 2010-07-07 20:54 -------- d-----w- c:\documents and settings\All Users\Application Data\Alwil Software
2010-07-07 07:50 . 2010-07-07 07:50 -------- d-sh--w- c:\documents and settings\s0urce\IECompatCache
2010-07-07 07:09 . 2010-07-07 07:09 -------- d-----w- c:\program files\Common Files\Java
2010-07-07 07:08 . 2010-07-07 07:08 503808 ----a-w- c:\documents and settings\s0urce\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-5878d5d1-n\msvcp71.dll
2010-07-07 07:08 . 2010-07-07 07:08 61440 ----a-w- c:\documents and settings\s0urce\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-648f6d7c-n\decora-sse.dll
2010-07-07 07:08 . 2010-07-07 07:08 499712 ----a-w- c:\documents and settings\s0urce\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-5878d5d1-n\jmc.dll
2010-07-07 07:08 . 2010-07-07 07:08 348160 ----a-w- c:\documents and settings\s0urce\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-5878d5d1-n\msvcr71.dll
2010-07-07 07:08 . 2010-07-07 07:08 12800 ----a-w- c:\documents and settings\s0urce\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-648f6d7c-n\decora-d3d.dll
2010-07-07 07:08 . 2010-07-07 07:08 411368 ----a-w- c:\windows\system32\deployJava1.dll
2010-07-07 07:08 . 2010-07-07 07:08 -------- d-----w- c:\program files\Java
2010-07-07 04:55 . 2010-07-07 04:55 -------- d-----w- c:\documents and settings\s0urce\Application Data\Malwarebytes
2010-07-07 04:54 . 2010-04-29 22:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-07-07 04:54 . 2010-07-07 04:54 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-07-07 04:54 . 2010-07-07 04:54 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-07-07 04:54 . 2010-04-29 22:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-07-06 00:31 . 2010-07-06 00:31 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2010-07-01 21:39 . 2010-07-05 23:01 -------- d-----w- c:\documents and settings\s0urce\Application Data\dvdcss
2010-06-26 06:46 . 2010-06-26 06:46 50354 ----a-w- c:\documents and settings\s0urce\Application Data\Facebook\uninstall.exe
2010-06-26 06:46 . 2010-06-26 06:46 -------- d-----w- c:\documents and settings\s0urce\Application Data\Facebook
2010-06-23 03:24 . 2010-06-23 03:26 -------- d-----w- C:\CS5
2010-06-23 01:13 . 2010-06-23 03:11 -------- d-----w- c:\program files\nLite
2010-06-14 21:33 . 2010-06-14 21:33 -------- d-----w- C:\php-tools
2010-06-12 04:25 . 2010-06-12 04:25 -------- d-----w- c:\documents and settings\s0urce\Application Data\Notepad++
2010-06-12 04:25 . 2010-06-12 04:25 -------- d-----w- c:\program files\Notepad++
2010-06-09 10:45 . 2010-06-09 10:45 5591040 ----a-w- c:\documents and settings\s0urce\Application Data\Facebook\npfbplugin_1_0_3.dll
2010-06-09 08:06 . 2010-06-09 08:06 976832 ----a-w- c:\documents and settings\All Users\Application Data\Adobe\Acrobat\9.3\ARM\4869\AdobeARM.exe
2010-06-09 08:06 . 2010-06-09 08:06 70584 ----a-w- c:\documents and settings\All Users\Application Data\Adobe\Acrobat\9.3\ARM\4869\AdobeExtractFiles.dll
2010-06-09 08:06 . 2010-06-09 08:06 331176 ----a-w- c:\documents and settings\All Users\Application Data\Adobe\Acrobat\9.3\ARM\4869\ReaderUpdater.exe
2010-06-09 08:06 . 2010-06-09 08:06 331176 ----a-w- c:\documents and settings\All Users\Application Data\Adobe\Acrobat\9.3\ARM\4869\AcrobatUpdater.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-08 03:54 . 2009-12-16 02:06 -------- d-----w- c:\documents and settings\s0urce\Application Data\Skype
2010-07-08 00:39 . 2009-10-21 00:20 -------- d-----w- c:\documents and settings\s0urce\Application Data\vlc
2010-07-08 00:35 . 2010-01-16 09:49 -------- d-----w- c:\documents and settings\s0urce\Application Data\Hot Keyboard Pro Backup
2010-07-08 00:34 . 2010-04-21 09:58 0 ----a-w- c:\windows\system32\drivers\lvuvc.hs
2010-07-07 07:57 . 2009-10-20 23:49 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2010-07-07 07:56 . 2009-12-10 06:29 -------- d-----w- c:\program files\Common Files\Blizzard Entertainment
2010-07-07 04:08 . 2009-10-21 00:12 -------- d-----w- c:\documents and settings\s0urce\Application Data\uTorrent
2010-07-03 01:25 . 2009-11-03 09:26 -------- d-----w- c:\program files\Mozilla Thunderbird
2010-07-03 01:25 . 2009-11-03 09:26 -------- d-----w- c:\documents and settings\s0urce\Application Data\Thunderbird
2010-06-28 05:10 . 2009-10-21 00:27 -------- d-----w- c:\program files\Steam
2010-06-22 05:14 . 2010-01-15 00:43 1 ----a-w- c:\documents and settings\s0urce\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-06-05 01:10 . 2010-04-13 00:19 -------- d-----w- c:\program files\PuTTY Connection Manager
2010-05-19 04:24 . 2010-04-15 05:28 -------- d-----w- c:\program files\Trillian
2010-05-17 05:15 . 2009-10-21 00:12 -------- d-----w- c:\program files\uTorrent
2010-05-17 04:29 . 2010-05-17 04:29 -------- d-----w- c:\program files\SC2
2010-04-29 19:05 . 2010-06-06 11:26 10752 ----a-w- c:\documents and settings\s0urce\Application Data\Mozilla\Firefox\Profiles\tbqrl7su.default\extensions\{FFA36170-80B1-4535-B0E3-A4569E497DD0}\platform\WINNT_x86-msvc\components\mgMouseService.dll
2010-04-26 04:15 . 2010-04-26 04:15 29184 ----a-r- c:\documents and settings\s0urce\Application Data\Microsoft\Installer\{21AE04E8-EBF6-40DB-9AA9-B7A80C5D057D}\Icon21AE04E8.exe
2010-04-21 09:57 . 2010-04-21 09:57 10134 ----a-r- c:\documents and settings\s0urce\Application Data\Microsoft\Installer\{35725FBC-A136-4A46-9F29-091759D9BB93}\ARPPRODUCTICON.exe
2010-04-19 05:15 . 2010-04-11 11:51 17488 ----a-w- c:\windows\gdrv.sys
2010-04-12 13:52 . 2010-04-12 13:52 136 ----a-w- c:\program files\results.txt
2010-04-12 13:51 . 2010-04-12 13:29 106 ----a-w- c:\program files\local.txt
2010-04-12 13:30 . 2010-04-12 13:29 303 ----a-w- c:\program files\prime.txt
2010-04-07 01:34 . 2010-04-07 01:34 1846 ----a-w- c:\program files\Bendometer PS.lnk
2009-07-13 12:04 . 2010-04-12 09:58 5132288 ----a-w- c:\program files\prime95.exe
.

------- Sigcheck -------

[-] 2008-03-21 . F7E4331A79BA927333F3009E3FCD3772 . 171008 . . [5.1.2600.5508] . . c:\windows\system32\srsvc.dll

[-] 2007-10-31 . E9EEB38B858B637F4F8FA3401F325DC5 . 13824 . . [5.1.2600.3244] . . c:\windows\system32\wscntfy.exe

[-] 2009-07-04 . 320D10A286EDB4F7B870F5D8BA94A752 . 1614848 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((( SnapShot@2010-07-07_23.15.10 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-07-08 00:35 . 2010-07-08 00:35 16384 c:\windows\Temp\Perflib_Perfdata_714.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Hot Keyboard "= "c:\program files\Hot Keyboard Pro\HotKeyb.exe" [2009-12-08 1049256]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"amd_dc_opt "= "c:\program files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2008-07-22 77824]
"StartCCC "= "c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-07-21 61440]
"googletalk "= "c:\program files\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]
"Adobe ARM "= "c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"Kernel and Hardware Abstraction Layer "= "KHALMNPR.EXE" [2009-06-17 55824]
"Easy Synchronization "= "c:\program files\Logitech\Easy Synchronization\LogitechEasySync.exe" [2005-10-05 53248]
"Adobe Acrobat Speed Launcher "= "c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2010-06-20 38840]
"Acrobat Assistant 8.0 "= "c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2010-06-19 640440]
"LogitechCommunicationsManager "= "c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-07-25 563984]
"LogitechQuickCamRibbon "= "c:\program files\Logitech\QuickCam\Quickcam.exe" [2007-07-25 2027792]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]
"SunJavaUpdateSched "= "c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"avast5 "= "c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-06-28 2837864]

c:\documents and settings\s0urce\Start Menu\Programs\Startup\
Pandora.lnk.disabled [2009-12-31 628]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
BDARemote.lnk.disabled [2009-10-20 531]
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-11-29 561213]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2009-11-22 813584]
UltraMon.lnk - c:\windows\Installer\{AF0FA6D7-96F3-468A-ABB7-28BE006EA8E9}\IcoUltraMon.ico [2009-10-20 29310]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMConfigurePrograms "= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel "= 1 (0x1)
"NoSMHelp "= 1 (0x1)
"NoSMConfigurePrograms "= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{FE24CD78-7C63-465D-8787-4EDF7FC79895} "= "c:\program files\Logitech\Easy Synchronization\shellexecutehook.dll" [2005-10-05 69632]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2009-07-20 20:28 72208 ----a-w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@= "Driver "

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=" "

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Google Update "= "c:\documents and settings\s0urce\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
"AdobeBridge "=

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Cmaudio8788 "=RunDll32 cmicnfgp.cpl,CMICtrlWnd
"Adobe_ID0ENQBO "=c:\progra~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
"AdobeCS4ServiceManager "= "c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe "

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall "= 0 (0x0)
"DisableUnicastResponsesToMulticastBroadcast "= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"c:\\Program Files\\uTorrent\\uTorrent.exe "=
"c:\\Program Files\\Google\\Google Talk\\googletalk.exe "=
"c:\\Program Files\\Steam\\Steam.exe "=
"c:\\Program Files\\Steam\\steamapps\\common\\trackmania united\\TmForever.exe "=
"c:\\Program Files\\Steam\\steamapps\\common\\trackmania united\\TmForeverLauncher.exe "=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe "=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe "=
"c:\\Program Files\\Common Files\\Adobe\\Adobe Version Cue CS4\\Server\\bin\\VersionCueCS4.exe "=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe "=
"c:\\Program Files\\Skype\\Phone\\Skype.exe "=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP "= 3389:TCPxpsp2res.dll,-22009
"5353:TCP "= 5353:TCP:Adobe CSI CS4
"3703:TCP "= 3703:TCP:Adobe Version Cue CS4 Server
"3704:TCP "= 3704:TCP:Adobe Version Cue CS4 Server
"51000:TCP "= 51000:TCP:Adobe Version Cue CS4 Server
"51001:TCP "= 51001:TCP:Adobe Version Cue CS4 Server

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [7/7/2010 1:54 PM 165456]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [7/7/2010 1:54 PM 17744]
R2 LBeepKE;LBeepKE;c:\windows\system32\drivers\LBeepKE.sys [11/22/2009 2:13 AM 10384]
R2 NovacomD;Palm Novacom;c:\program files\Palm, Inc\novacom\x86\novacomd.exe [11/6/2009 1:03 PM 33280]
R2 UltraMonUtility;UltraMon Utility Driver;c:\program files\Common Files\Realtime Soft\UltraMonMirrorDrv\x32\UltraMonUtility.sys [9/24/2006 8:22 PM 11776]
R3 rrau0002;rrau0002;c:\windows\system32\drivers\rrau0002.sys [4/1/2010 7:54 PM 24576]
R3 rrwd0002;rrwd0002;c:\windows\system32\drivers\rrwd0002.sys [4/1/2010 7:54 PM 97280]
R3 UltraMonMirror;UltraMonMirror;c:\windows\system32\drivers\UltraMonMirror.sys [9/24/2006 8:23 PM 3584]
S3 Adobe Version Cue CS4;Adobe Version Cue CS4;c:\program files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe [8/15/2008 6:46 AM 284016]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys --> c:\windows\system32\drivers\Ambfilt.sys [?]
S3 cmudaxp;C-Media Oxygen HD Audio Interface;c:\windows\system32\drivers\cmudaxp.sys [10/20/2009 5:03 PM 1774080]

NETSVCS REQUIRES REPAIRS - current entries shown
6to4
AppMgmt
AudioSrv
Browser
CryptSvc
DMServer
DHCP
EventSystem
FastUserSwitchingCompatibility
HidServ
Ias
Iprip
Irmon
LanmanServer
LanmanWorkstation
Netman
Nla
NWCWorkstation
Nwsapagent
Rasauto
Rasman
Remoteaccess
Schedule
Seclogon
SENS
Sharedaccess
Tapisrv
Themes
W32Time
WZCSVC
Wmi
WmdmPmSp
winmgmt
xmlprov
napagent
hkmsvc
BITS
wuauserv
ShellHWDetection
WmdmPmSN

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs

.
Contents of the 'Scheduled Tasks' folder

2010-07-07 c:\windows\Tasks\daily sgdne.job
- c:\program files\PremiumSoft\Navicat Premium 8.2\navicat.exe [2010-03-29 18:06]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://holesolutions.net/
uInternet Settings,ProxyServer = http=127.0.0.1:5577
uInternet Settings,ProxyOverride = <local>
IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Assign &hot key - c:\program files\Hot Keyboard Pro\IEScript.htm
IE: Convert Link Target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
Trusted Zone: microsoft.com\v4.windowsupdate
Trusted Zone: microsoft.com\windowsupdate
Trusted Zone: microsoft.com\www
FF - ProfilePath - c:\documents and settings\s0urce\Application Data\Mozilla\Firefox\Profiles\tbqrl7su.default\
FF - prefs.js: browser.startup.homepage - igoogle.com
FF - prefs.js: network.proxy.type - 0
FF - component: c:\documents and settings\s0urce\Application Data\Mozilla\Firefox\Profiles\tbqrl7su.default\extensions\{81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}\components\XpcomOpusConnector.dll
FF - plugin: c:\documents and settings\s0urce\Application Data\Facebook\npfbplugin_1_0_3.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "ui.use_native_colors ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.lu ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.nu ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.nz ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.xn--mgberp4a5d4ar ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.xn--p1ai ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.xn--mgbayh7gpa ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.tel ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.auth.force-generic-ntlm ", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.proxy.type ", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "dom.ipc.plugins.timeoutSecs ", 45);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "svg.smil.enabled ", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "accelerometer.enabled ", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref ", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.ssl.renego_unrestricted_hosts ", " ");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.ssl.treat_unsafe_negotiation_as_broken ", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.ssl.require_safe_negotiation ", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name ", "chrome://browser/locale/browser.properties ");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description ", "chrome://browser/locale/browser.properties ");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "plugins.update.notifyUser ", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "dom.ipc.plugins.enabled.nptest.dll ", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "dom.ipc.plugins.enabled.npswf32.dll ", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "dom.ipc.plugins.enabled.npctrl.dll ", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "dom.ipc.plugins.enabled.npqtplugin.dll ", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "dom.ipc.plugins.enabled ", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-07 20:53
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(800)
c:\windows\system32\Ati2evxx.dll
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
c:\program files\common files\logishrd\bluetooth\LBTServ.dll
.
Completion time: 2010-07-07 20:55:21
ComboFix-quarantined-files.txt 2010-07-08 03:55
ComboFix2.txt 2010-07-07 23:17

Pre-Run: 289,133,326,336 bytes free
Post-Run: 289,147,523,072 bytes free

- - End Of File - - A835B671CD857EC46EF4CD21B230B3AC

 

MBAM Log:

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4287

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

7/9/2010 4:32:19 PM
mbam-log-2010-07-09 (16-32-19).txt

Scan type: Quick scan
Objects scanned: 118455
Time elapsed: 4 minute(s), 5 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

 

Extras:

OTL Extras logfile created on: 7/10/2010 11:35:15 AM - Run 1
OTL by OldTimer - Version 3.2.8.1 Folder = C:\Documents and Settings\s0urce\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 64.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 85.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 372.61 Gb Total Space | 268.21 Gb Free Space | 71.98% Space Free | Partition Type: NTFS
Drive D: | 372.61 Gb Total Space | 11.85 Gb Free Space | 3.18% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
Drive F: | 1.11 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: S0URCE-PC
Current User Name: s0urce
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Standard
Quick Scan

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.exe [@ = exefile] -- Reg Error: Key error. File not found
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1 "
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /k cd "%L" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [TVersity] -- "C:\Program Files\TVersity\Media Server\GUILaunch.exe" -type "folder" -url "%1" -title " " -tags " " ()
Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] -- "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
"DisableUnicastResponsesToMulticastBroadcast" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"3389:TCP" = 3389:TCP:*:Enabledxpsp2res.dll,-22009
"139:TCP" = 139:TCP:*:Enabledxpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabledxpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabledxpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabledxpsp2res.dll,-22002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
"DisableUnicastResponsesToMulticastBroadcast" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"3389:TCP" = 3389:TCP:*:Enabledxpsp2res.dll,-22009
"5353:TCP" = 5353:TCP:*:Enabled:Adobe CSI CS4
"3703:TCP" = 3703:TCP:*:Enabled:Adobe Version Cue CS4 Server
"3704:TCP" = 3704:TCP:*:Enabled:Adobe Version Cue CS4 Server
"51000:TCP" = 51000:TCP:*:Enabled:Adobe Version Cue CS4 Server
"51001:TCP" = 51001:TCP:*:Enabled:Adobe Version Cue CS4 Server
"139:TCP" = 139:TCP:LocalSubNet:Enabledxpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabledxpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabledxpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabledxpsp2res.dll,-22002

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\uTorrent\uTorrent.exe" = C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent -- (BitTorrent, Inc.)
"C:\Program Files\Google\Google Talk\googletalk.exe" = C:\Program Files\Google\Google Talk\googletalk.exe:*:Enabled:Google Talk -- (Google)
"C:\Program Files\Steam\Steam.exe" = C:\Program Files\Steam\Steam.exe:*:Enabled:Steam -- (Valve Corporation)
"C:\Program Files\Steam\steamapps\common\trackmania united\TmForever.exe" = C:\Program Files\Steam\steamapps\common\trackmania united\TmForever.exe:*:Enabled:TrackMania United Forever -- ()
"C:\Program Files\Steam\steamapps\common\trackmania united\TmForeverLauncher.exe" = C:\Program Files\Steam\steamapps\common\trackmania united\TmForeverLauncher.exe:*:Enabled:TrackMania United Forever -- ()
"C:\Program Files\Ventrilo\Ventrilo.exe" = C:\Program Files\Ventrilo\Ventrilo.exe:*:Enabled:Ventrilo.exe -- (Flagship Industries, Inc.)
"C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" = C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:*:Enabled:Adobe CSI CS4 -- (Adobe Systems Incorporated)
"C:\Program Files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe" = C:\Program Files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe:*:Enabled:Adobe Version Cue CS4 Server -- (Adobe Systems Incorporated)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00ADFB20-AE75-46F4-AD2C-F48B15AC3100}" = Adobe Color NA Recommended Settings CS4
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{05308C4E-7285-4066-BAE3-6B50DA6ED755}" = Adobe Update Manager CS4
"{054EFA56-2AC1-48F4-A883-0AB89874B972}" = Adobe Extension Manager CS4
"{055EE59D-217B-43A7-ABFF-507B966405D8}" = ATI Catalyst Control Center
"{0893078B-8A9A-84D6-D393-119B9B0B033A}" = CCC Help French
"{098727E1-775A-4450-B573-3F441F1CA243}" = kuler
"{0C826C5B-B131-423A-A229-C71B3CACCD6A}" = CDDRV_Installer
"{0D6013AB-A0C7-41DC-973C-E93129C9A29F}" = Adobe Color JA Extra Settings CS4
"{0E2A60F7-2907-5718-FF16-7D8FAF70051E}" = CCC Help Chinese Standard
"{0F723FC1-7606-4867-866C-CE80AD292DAF}" = Adobe CSI CS4
"{14F70205-1940-4000-88C7-BE799A6B2CAD}" = Adobe Soundbooth CS4
"{14FAE013-AE19-4FC9-B5BF-E56ADC01ECE6}" = CCC Help Turkish
"{15BF7AAF-846C-4A6D-80E1-5D1FC7FB461B}" = Adobe SGM CS4
"{1618734A-3957-4ADD-8199-F973763109A8}" = Adobe Anchor Service CS4
"{16E16F01-2E2D-4248-A42F-76261C147B6C}" = Adobe Drive CS4
"{16E6D2C1-7C90-4309-8EC4-D2212690AAA4}" = AdobeColorCommonSetRGB
"{17BB2784-6EE4-D7FF-FE63-58A3AD2B3708}" = CCC Help Russian
"{1B7C06E1-4888-47A6-992A-0990B9683486}" = Adobe Version Cue CS4 Server
"{1DCA3EAA-6EB5-4563-A970-EA14D75037BA}" = Adobe InDesign CS4
"{1E04CB54-AF4E-4AC3-B4B7-C0A160BE57F1}" = Adobe InDesign CS4 Icon Handler
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{2168245A-B5AD-40D8-A641-48E3E070B5B6}" = Adobe Flash CS4 STI-en
"{21AE04E8-EBF6-40DB-9AA9-B7A80C5D057D}" = mkv2vob
"{226b64e8-dc75-4eea-a6c8-abcb496320f2}-Google Talk" = Google Talk (remove only)
"{233588CF-96D5-46AF-EF74-7EC382662791}" = Catalyst Control Center Graphics Full Existing
"{23F79416-CAD1-41BF-99A3-040F6C814AAA}" = NVIDIA Photoshop Plug-ins
"{2624B969-7135-4EB1-B0F6-2D8C397B45F7}_is1" = Media Player Classic - Home Cinema v. 1.3.1249.0
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 20
"{2758691A-2CDE-4942-A4AC-0E8F61FE2067}" = USB Video Driver
"{297190A1-4B0D-4CD6-8B9F-3907F15C3FD8}" = Adobe CS4 American English Speech Analysis Models
"{2BAF2B96-7560-48B4-87D4-10178DDBE217}" = Adobe InDesign CS4 Application Feature Set Files (Roman)
"{30C8AA56-4088-426F-91D1-0EDFD3A25678}" = Adobe Dreamweaver CS4
"{3101CB58-3482-4D21-AF1A-7057FC935355}" = KhalInstallWrapper
"{3260ECBC-9DDF-E7A3-0863-449473BC7BD5}" = CCC Help Chinese Traditional
"{35725FBC-A136-4A46-9F29-091759D9BB93}" = MVision
"{35D94F92-1D3A-43C5-8605-EA268B1A7BD9}" = PDF Settings CS4
"{364EC092-93CF-4DDC-9D7A-7278452028E0}" = Logitech QuickCam
"{39C6C229-CFFD-639E-229A-E463FCD87478}" = CCC Help German
"{39F6E2B4-CFE8-C30A-66E8-489651F0F34C}" = Adobe Media Player
"{3A4E8896-C2E7-4084-A4A4-B8FD1894E739}" = Adobe XMP Panels CS4
"{3A6829EF-0791-4FDD-9382-C690DD0821B9}" = Adobe Flash Player 10 ActiveX
"{3D2C9DE6-9ADE-4252-A241-E43723B0CE02}" = Adobe Color - Photoshop Specific CS4
"{3DA8DF9A-044E-46C4-8531-DEDBB0EE37FF}" = Adobe WinSoft Linguistics Plugin
"{428FDF9F-E010-4C4C-A8BB-156960AFCA1C}" = Adobe Fireworks CS4
"{43509E18-076E-40FE-AF38-CA5ED400A5A9}" = Pixel Bender Toolkit
"{44E240EC-2224-4078-A88B-2CEE0D3016EF}" = Adobe After Effects CS4 Presets
"{45EC816C-0771-4C14-AE6D-72D1B578F4C8}" = Adobe After Effects CS4
"{4943EFF5-229F-435D-BEA9-BE3CAEA783A7}" = Adobe Service Manager Extension
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A52555C-032A-4083-BDD9-6A85ABFB39A8}" = Adobe SING CS4
"{4F11FC80-CE8C-1BD4-5C39-EBE5744E5135}" = CCC Help Portuguese
"{4FAB2BA7-E16C-95D2-F326-60A68409373F}" = Catalyst Control Center HydraVision Full
"{52232EF4-CC12-4C21-ABCF-ADB79618302D}" = Adobe Soundbooth CS4 Codecs
"{529AA9A8-5020-6CFB-A809-BC5943C87077}" = CCC Help Thai
"{53604297-26FD-516D-6FF7-1063BA64A0A4}" = Catalyst Control Center Graphics Light
"{5570C7F0-43D0-4916-8A9E-AEDD52FA86F4}" = Adobe Color EU Extra Settings CS4
"{55BD3B0B-F054-9341-514F-295A5F7EA450}" = CCC Help Spanish
"{561968FD-56A1-49FD-9ED0-F55482C7C5BC}" = Adobe Media Encoder CS4 Exporter
"{5A4FA9C8-ED56-08C3-153B-FC5C19256290}" = CCC Help Dutch
"{5EAD5443-7194-46CC-A055-428E6ABB1BAF}" = Adobe Encore CS4
"{60DB5894-B5A1-4B62-B0F3-669A22C0EE5D}" = Adobe Dynamiclink Support
"{61D6891E-E822-4448-9F9A-0AAAAEB6AF6C}" = Adobe Creative Suite 4 Master Collection
"{63C24A08-70F3-4C8E-B9FB-9F21A903801D}" = Adobe Color Video Profiles CS CS4
"{63E5CDBF-8214-4F03-84F8-CD3CE48639AD}" = Adobe Photoshop CS4 Support
"{67A9747A-E1F5-4E9A-81CC-12B5D5B81B6E}" = Adobe After Effects CS4 Third Party Content
"{67F0E67A-8E93-4C2C-B29D-47C48262738A}" = Adobe Device Central CS4
"{68243FF8-83CA-466B-B2B8-9F99DA5479C4}" = AdobeColorCommonSetCMYK
"{6C390D51-E5F0-4FCD-24C4-731ACAF34571}" = CCC Help Japanese
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7406DF60-016D-476B-A2C7-55D997592047}" = Adobe OnLocation CS4
"{75B61CF0-B8A8-46E2-8709-C4A79898AC1D}" = Data Lifeguard Diagnostic for Windows
"{789289CA-F73A-4A16-A331-54D498CE069F}" = Ventrilo Client
"{793D1D88-6141-43DE-BE58-59BCE31B4090}" = Adobe Flash CS4 Extension - Flash Lite STI en
"{7AA8FA9A-1656-7DBD-633B-FE7A62BBED0C}" = CCC Help Czech
"{7CC7BDD5-6F10-4724-96A1-EAC7D9F2831C}" = Adobe InDesign CS4 Common Base Files
"{8186FF34-D389-4B7E-9A2F-C197585BCFBD}" = Adobe Media Encoder CS4 Importer
"{820D3F45-F6EE-4AAF-81EF-CE21FF21D230}" = Adobe Type Support CS4
"{83877DB1-8B77-45BC-AB43-2BAC22E093E0}" = Adobe Bridge CS4
"{842B4B72-9E8F-4962-B3C1-1C422A5C4434}" = Suite Shared Configuration CS4
"{84814E6B-2581-46EC-926A-823BD1C670F6}" = WIDCOMM Bluetooth Software
"{87532CAB-7932-4F84-8937-823337622807}" = Adobe Illustrator CS4
"{89DE67AD-08B8-4699-A55D-CA5C0AF82BF3}" = ATI AVIVO Codecs
"{8C22131B-8634-CECF-F0D1-A2ECC160B450}" = CCC Help Norwegian
"{90FBE4D0-2ACA-A8A8-2CC4-CFFBAE528504}" = CCC Help Finnish
"{931AB7EA-3656-4BB7-864D-022B09E3DD67}" = Adobe Linguistics CS4
"{94D398EB-D2FD-4FD1-B8C4-592635E8A191}" = Adobe CMaps CS4
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9D74375E-3012-E7D2-9229-B220C91F326A}" = Catalyst Control Center Core Implementation
"{9EE8BDCA-7505-4895-D91E-8108DD16292E}" = CCC Help English
"{9FD6F1A8-5550-46AF-8509-271DF0E768B5}" = Dual-Core Optimizer
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A498D9EB-927B-459B-85D6-DD6EF8C2C564}" = erLT
"{A6EC82A0-1414-475D-8AFD-469089F3080D}" = Adobe Contribute CS4
"{A8AF8BD3-61B5-7945-4D1B-217421F604FC}" = CCC Help Hungarian
"{AA46E1C5-A709-6D9B-D99D-92E4C6E042A9}" = CCC Help Korean
"{AA62A33C-9E5E-3913-7D88-7E58A8CB1493}" = CCC Help Greek
"{AC134D03-97F1-45B9-B32A-52E885AFA895}" = Mobile Phone Suite Easy Synchronization
"{AC76BA86-1033-F400-7760-000000000004}" = Adobe Acrobat 9 Pro - English, Français, Deutsch
"{AC76BA86-1033-F400-7760-000000000004}_933" = Adobe Acrobat 9.3.3 - CPSID_83708
"{AC76BA86-7AD7-1033-7B44-A93000000001}" = Adobe Reader 9.3.3
"{AEB9948B-4FF2-47C9-990E-47014492A0FE}" = MSXML 6.0 Parser
"{AF0FA6D7-96F3-468A-ABB7-28BE006EA8E9}" = UltraMon
"{B05DE7B7-0B40-4411-BD4B-222CAE2D8F15}" = Adobe MotionPicture Color Files CS4
"{B15381DD-FF97-4FCD-A881-ED4DB0975500}" = Adobe Color Video Profiles AE CS4
"{B169BC97-B8AA-4ACA-9CF2-9D0FF5BABDF7}" = Adobe Premiere Pro CS4 Functional Content
"{B29AD377-CC12-490A-A480-1452337C618D}" = Connect
"{B2DC3F08-2EB2-49A5-AA24-15DFC8B1CB83}" = @BIOS
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B653F643-A1B4-9936-2DB6-FEA9A3110D8D}" = ccc-core-preinstall
"{B65BA85C-0A27-4BC0-A22D-A66F0E5B9494}" = Adobe Photoshop CS4
"{B71C4637-0247-78CE-6A3D-D61645CB8921}" = ccc-utility
"{B9F4561A-924D-4510-A85A-BB0960C338CB}" = Adobe Asset Services CS4
"{BA9A297F-0198-4EE8-90CB-F5036C180E1D}" = Novacomd
"{BB4E33EC-8181-4685-96F7-8554293DEC6A}" = Adobe Output Module
"{BC2E7C0B-1AC6-5F6C-F31D-E1E72D8E0B5C}" = CCC Help Danish
"{BE9CEAAA-F069-4331-BF2F-8D350F6504F4}" = Adobe Media Encoder CS4 Additional Exporter
"{BF8C7DA7-2DE6-ED67-6C82-6BE82F8BA8D3}" = Catalyst Control Center Graphics Full New
"{C09683A5-B834-6F63-4C54-06512BFB75F4}" = Pandora
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C409F338-BB20-6C4A-F40D-20CA07AF714C}" = CCC Help Polish
"{C52E3EC1-048C-45E1-8D53-10B0C6509683}" = Adobe Default Language CS4
"{C86E7C99-E4AD-79C7-375B-1AEF9A91EC2B}" = Acrobat.com
"{C938BE91-3BB5-4B84-9EF6-88F0505D0038}" = Adobe Premiere Pro CS4 Third Party Content
"{CC75AB5C-2110-4A7F-AF52-708680D22FE8}" = Photoshop Camera Raw
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D499F8DE-3F31-4900-9157-61061613704B}" = Adobe Premiere Pro CS4
"{D4B7B2DC-E688-A9D6-6EC0-56AE540E074C}" = Catalyst Control Center Localization All
"{D560A981-FEB3-42F0-A61A-13E9528E0C51}_is1" = GTR 2 1.0.0.0
"{D9CD701B-3F04-FC69-D974-F3A7F5E9BA30}" = CCC Help Swedish
"{D9D93D74-107D-4BD3-87D0-AABCF7C98BD5}" = Catalyst Control Center - Branding
"{DEB90B8E-0DCB-48CE-B90E-8842A2BD643E}" = Adobe Media Encoder CS4
"{E213321B-1E88-B38D-DAB2-D8CB9355984A}" = Skins
"{E6B87DC4-2B3D-4483-ADFF-E483BF718991}" = OpenOffice.org 3.1
"{E8EE9410-8AC4-4F43-A626-DDECA75C79F3}" = Adobe Setup
"{EE353798-E875-42E0-B58D-7E6696182EA8}" = Adobe Media Encoder CS4 Dolby
"{F0E64E2E-3A60-40D8-A55D-92F6831875DA}" = Adobe Search for Help
"{F29B21BD-CAA6-445F-8EF7-A7E2B9D8B14E}" = Logitech SetPoint
"{F4148D8F-ED3A-3097-509C-04D5560220F9}" = ccc-core-static
"{F6E99614-F042-4459-82B7-8B38B2601356}" = Adobe Flash CS4
"{F7E68997-E626-952B-A7BF-F72066CD5D77}" = Catalyst Control Center Graphics Previews Common
"{F8EF2B3F-C345-4F20-8FE4-791A20333CD5}" = Adobe ExtendScript Toolkit CS4
"{F93C84A6-0DC6-42AF-89FA-776F7C377353}" = Adobe PDF Library Files CS4
"{FA36C82B-464D-51F2-A6A1-0BC9140BE067}" = CCC Help Italian
"{FB2A5FCC-B81B-48C2-A009-7804694D83E9}" = Adobe Encore CS4 Codecs
"{FCDD51BB-CAD0-4BB1-B7DF-CE86D1032794}" = Adobe Fonts All
"69083DC58646DE46A09847A522A1CC487F918039" = Windows Driver Package - eMPIA Technology Inc, (emAudio) MEDIA (08/31/2007 5.7.0831.0)
"84713BEB4A2EB4B0E2F1346FDEBFFE94DAB5225D" = Windows Driver Package - Palm (WinUSB) Palm Devices (11/30/2008 1.0.0)
"9722CA1E8F72F362E93CBEC75A707FDABFC8D880" = Windows Driver Package - Advanced Micro Devices, Inc. (USB28xxBGA) Media (08/31/2007 5.7.0831.0)
"Actual Search & Replace_is1" = Actual Search & Replace Version 2.8.5
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe_b2d6abde968e6f277ddbfd501383e02" = Adobe Creative Suite 4 Master Collection
"All ATI Software" = ATI - Software Uninstall Utility
"ATI Display Driver" = ATI Display Driver
"avast5" = avast! Free Antivirus
"CoreAVC Professional Edition" = CoreAVC Professional Edition (remove only)
"EVEREST Ultimate Edition_is1" = EVEREST Ultimate Edition v5.50
"ffdshow_is1" = ffdshow [rev 1723] [2007-12-24]
"HaaliMkx" = Haali Media Splitter
"Hot Keyboard Pro_is1" = Hot Keyboard Pro 3.2
"ie8" = Windows Internet Explorer 8
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"mIRC" = mIRC
"Mozilla Firefox (3.6.6)" = Mozilla Firefox (3.6.6)
"Mozilla Thunderbird (3.1)" = Mozilla Thunderbird (3.1)
"nLite_is1" = nLite 1.4.9.1
"Notepad++" = Notepad++
"PremiumSoft Navicat Premium 8.2_is1" = PremiumSoft Navicat Premium 8.2
"PuTTY Connection Manager_is1" = PuTTY Connection Manager 0.7.1.136beta
"QcDrv" = Logitech® Camera Driver
"RegexBuddy 3" = JGsoft RegexBuddy 3 v.3.2.1
"Steam App 440" = Team Fortress 2
"Steam App 7200" = TrackMania United Forever
"Trillian" = Trillian
"TVersity Codec Pack" = TVersity Codec Pack 1.2
"TVersity Media Server" = TVersity Media Server 1.8 Beta
"uTorrent" = µTorrent
"VLC media player" = VLC media player 1.0.2
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
"Winamp" = Winamp
"Windows Media Format Runtime" = Windows Media Format Runtime
"WinRAR archiver" = WinRAR archiver
"winscp3_is1" = WinSCP 4.2.4 beta
"winusb0100" = Microsoft WinUsb 1.0
"Wudf01007" = Microsoft User-Mode Driver Framework Feature Pack 1.7

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Facebook Plug-In" = Facebook Plug-In

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 7/9/2010 2:34:22 PM | Computer Name = S0URCE-PC | Source = SCardSvr | ID = 2
Description =

Error - 7/9/2010 2:34:31 PM | Computer Name = S0URCE-PC | Source = SCardSvr | ID = 2
Description =

Error - 7/9/2010 2:35:12 PM | Computer Name = S0URCE-PC | Source = SCardSvr | ID = 2
Description =

Error - 7/9/2010 2:35:36 PM | Computer Name = S0URCE-PC | Source = SCardSvr | ID = 2
Description =

Error - 7/9/2010 2:35:46 PM | Computer Name = S0URCE-PC | Source = SCardSvr | ID = 2
Description =

Error - 7/9/2010 2:35:59 PM | Computer Name = S0URCE-PC | Source = SCardSvr | ID = 2
Description =

Error - 7/9/2010 2:36:20 PM | Computer Name = S0URCE-PC | Source = SCardSvr | ID = 2
Description =

Error - 7/9/2010 2:36:45 PM | Computer Name = S0URCE-PC | Source = SCardSvr | ID = 2
Description =

Error - 7/9/2010 2:37:09 PM | Computer Name = S0URCE-PC | Source = SCardSvr | ID = 2
Description =

Error - 7/9/2010 7:32:34 PM | Computer Name = S0URCE-PC | Source = crypt32 | ID = 131077
Description = Failed auto update retrieval of third-party root certificate from:
<http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/2796BAE63F1801E277261BA0D77770028F20EEE4.crt>
with error: This operation returned because the timeout period expired.

[ System Events ]
Error - 7/7/2010 8:36:01 PM | Computer Name = S0URCE-PC | Source = Service Control Manager | ID = 7000
Description = The helpsvc service failed to start due to the following error: %%2

Error - 7/7/2010 8:36:01 PM | Computer Name = S0URCE-PC | Source = Service Control Manager | ID = 7000
Description = The wscsvc service failed to start due to the following error: %%1083

Error - 7/7/2010 11:49:47 PM | Computer Name = S0URCE-PC | Source = Service Control Manager | ID = 7034
Description = The Process Monitor service terminated unexpectedly. It has done
this 1 time(s).

Error - 7/7/2010 11:50:23 PM | Computer Name = S0URCE-PC | Source = Service Control Manager | ID = 7034
Description = The Logitech Easy Synchronization service terminated unexpectedly.
It has done this 1 time(s).

Error - 7/7/2010 11:50:23 PM | Computer Name = S0URCE-PC | Source = Service Control Manager | ID = 7034
Description = The TVersityMediaServer service terminated unexpectedly. It has done
this 1 time(s).

Error - 7/8/2010 4:33:49 AM | Computer Name = S0URCE-PC | Source = Service Control Manager | ID = 7000
Description = The helpsvc service failed to start due to the following error: %%2

Error - 7/8/2010 4:33:49 AM | Computer Name = S0URCE-PC | Source = Service Control Manager | ID = 7000
Description = The wscsvc service failed to start due to the following error: %%1083

Error - 7/9/2010 7:27:38 PM | Computer Name = S0URCE-PC | Source = Service Control Manager | ID = 7034
Description = The Process Monitor service terminated unexpectedly. It has done
this 1 time(s).

Error - 7/10/2010 2:25:54 PM | Computer Name = S0URCE-PC | Source = Service Control Manager | ID = 7000
Description = The helpsvc service failed to start due to the following error: %%2

Error - 7/10/2010 2:25:54 PM | Computer Name = S0URCE-PC | Source = Service Control Manager | ID = 7000
Description = The wscsvc service failed to start due to the following error: %%1083


< End of report >

 

OTL.txt:

OTL logfile created on: 7/10/2010 11:35:15 AM - Run 1
OTL by OldTimer - Version 3.2.8.1 Folder = C:\Documents and Settings\s0urce\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 64.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 85.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 372.61 Gb Total Space | 268.21 Gb Free Space | 71.98% Space Free | Partition Type: NTFS
Drive D: | 372.61 Gb Total Space | 11.85 Gb Free Space | 3.18% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
Drive F: | 1.11 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: S0URCE-PC
Current User Name: s0urce
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Standard
Quick Scan

========== Processes (SafeList) ==========

PRC - [2010/07/09 16:28:38 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\s0urce\Desktop\OTL.exe
PRC - [2010/06/28 13:57:18 | 002,837,864 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastUI.exe
PRC - [2010/06/28 13:57:15 | 000,040,384 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
PRC - [2010/06/27 21:32:14 | 000,910,296 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2010/06/19 12:36:46 | 000,640,440 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files\Adobe\Acrobat 9.0\Acrobat\acrotray.exe
PRC - [2010/02/25 14:11:04 | 000,856,064 | ---- | M] () -- C:\Program Files\TVersity\Media Server\MediaServer.exe
PRC - [2009/12/08 04:42:58 | 001,049,256 | ---- | M] (Imposant) -- C:\Program Files\Hot Keyboard Pro\HotKeyb.exe
PRC - [2009/11/06 13:03:46 | 000,033,280 | ---- | M] (Palm) -- C:\Program Files\Palm, Inc\novacom\x86\novacomd.exe
PRC - [2009/07/20 13:30:50 | 000,813,584 | ---- | M] (Logitech, Inc.) -- C:\Program Files\Logitech\SetPoint\SetPoint.exe
PRC - [2009/07/20 13:28:10 | 000,121,360 | ---- | M] (Logitech, Inc.) -- C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
PRC - [2009/07/10 13:42:32 | 000,055,824 | ---- | M] (Logitech, Inc.) -- C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.exe
PRC - [2008/04/14 05:00:00 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2008/01/15 02:42:02 | 000,694,040 | ---- | M] (Realtime Soft Ltd) -- C:\Program Files\UltraMon\UltraMon.exe
PRC - [2008/01/14 19:24:46 | 000,283,136 | ---- | M] (Realtime Soft Ltd) -- C:\Program Files\UltraMon\UltraMonTaskbar.exe
PRC - [2007/07/25 16:06:30 | 002,027,792 | ---- | M] () -- C:\Program Files\Logitech\QuickCam\Quickcam.exe
PRC - [2007/07/25 16:02:54 | 000,563,984 | ---- | M] () -- C:\Program Files\Common Files\Logishrd\LComMgr\Communications_Helper.exe
PRC - [2007/07/25 16:02:32 | 000,403,728 | ---- | M] (Logitech Inc.) -- C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
PRC - [2007/07/20 00:40:48 | 000,137,752 | ---- | M] (Logitech Inc.) -- C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcSrv.exe
PRC - [2007/07/20 00:38:54 | 000,186,904 | ---- | M] (Logitech Inc.) -- C:\Program Files\Common Files\Logishrd\LVCOMSER\LVComSer.exe
PRC - [2007/01/01 14:22:02 | 003,739,648 | ---- | M] (Google) -- C:\Program Files\Google\Google Talk\googletalk.exe
PRC - [2006/11/29 23:37:20 | 000,561,213 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
PRC - [2005/10/05 13:00:44 | 000,053,248 | ---- | M] () -- C:\Program Files\Logitech\Easy Synchronization\LogitechEasySync.exe
PRC - [2005/10/05 13:00:06 | 000,065,536 | ---- | M] () -- C:\Program Files\Logitech\Easy Synchronization\servicestub.exe


========== Modules (SafeList) ==========

MOD - [2010/07/09 16:28:38 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\s0urce\Desktop\OTL.exe
MOD - [2009/07/20 13:29:06 | 000,045,584 | ---- | M] (Logitech, Inc.) -- C:\Program Files\Logitech\SetPoint\lgscroll.dll
MOD - [2008/07/25 12:17:20 | 000,635,904 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\msvcr80.dll
MOD - [2008/04/14 05:00:00 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx
MOD - [2008/01/14 19:24:48 | 000,057,856 | ---- | M] (Realtime Soft Ltd) -- C:\Program Files\UltraMon\RTSUltraMonHook.dll
MOD - [2007/07/20 00:40:36 | 000,113,176 | ---- | M] (Logitech Inc.) -- C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll
MOD - [2006/11/29 23:41:44 | 000,077,824 | ---- | M] (Broadcom Corporation.) -- C:\WINDOWS\system32\BtMmHook.dll
MOD - [2006/03/05 18:52:08 | 000,013,312 | ---- | M] () -- C:\Program Files\Hot Keyboard Pro\hkhook30.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [Auto | Stopped] -- C:\WINDOWS\System32\wscsvc.dll -- (wscsvc)
SRV - File not found [On_Demand | Stopped] -- C:\WINDOWS\System32\ups.exe -- (UPS)
SRV - File not found [Auto | Stopped] -- C:\WINDOWS\System32\ersvc.dll -- (ERSvc)
SRV - File not found [On_Demand | Stopped] -- C:\WINDOWS\System32\clipsrv.exe -- (ClipSrv)
SRV - File not found [On_Demand | Stopped] -- C:\WINDOWS\System32\cisvc.exe -- (CiSvc)
SRV - [2010/06/28 13:57:15 | 000,040,384 | ---- | M] (AVAST Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Web Scanner)
SRV - [2010/06/28 13:57:15 | 000,040,384 | ---- | M] (AVAST Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Mail Scanner)
SRV - [2010/06/28 13:57:15 | 000,040,384 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)
SRV - [2010/02/25 14:11:04 | 000,856,064 | ---- | M] () [Auto | Running] -- C:\Program Files\TVersity\Media Server\MediaServer.exe -- (TVersityMediaServer)
SRV - [2009/11/24 14:46:19 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2009/11/06 13:03:46 | 000,033,280 | ---- | M] (Palm) [Auto | Running] -- C:\Program Files\Palm, Inc\novacom\x86\novacomd.exe -- (NovacomD)
SRV - [2009/07/20 13:28:10 | 000,121,360 | ---- | M] (Logitech, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe -- (LBTServ)
SRV - [2008/08/15 06:46:20 | 000,284,016 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe -- (Adobe Version Cue CS4)
SRV - [2007/07/20 00:42:30 | 000,141,848 | ---- | M] (Logitech Inc.) [Auto | Stopped] -- C:\Program Files\Common Files\Logishrd\SrvLnch\SrvLnch.exe -- (LVSrvLauncher)
SRV - [2007/07/20 00:40:48 | 000,137,752 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe -- (LVPrcSrv)
SRV - [2007/07/20 00:38:54 | 000,186,904 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe -- (LVCOMSer)
SRV - [2005/10/05 13:00:06 | 000,065,536 | ---- | M] () [Auto | Running] -- C:\Program Files\Logitech\Easy Synchronization\servicestub.exe -- (Logitech Easy Synchronization)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\Monfilt.sys -- (Monfilt)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\DOCUME~1\s0urce\LOCALS~1\Temp\catchme.sys -- (catchme)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\Ambfilt.sys -- (Ambfilt)
DRV - [2010/06/28 13:37:52 | 000,046,672 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2010/06/28 13:37:30 | 000,165,456 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2010/06/28 13:33:13 | 000,023,376 | ---- | M] (ALWIL Software) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (aswRdr)
DRV - [2010/06/28 13:32:45 | 000,100,176 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2)
DRV - [2010/06/28 13:32:33 | 000,017,744 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2010/06/28 13:32:16 | 000,028,880 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4)
DRV - [2010/04/18 22:15:38 | 000,017,488 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\gdrv.sys -- (gdrv)
DRV - [2009/09/23 11:41:58 | 000,026,176 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\hamachi.sys -- (hamachi)
DRV - [2009/07/21 09:30:48 | 003,565,056 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2009/07/04 01:04:14 | 000,085,120 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtnicxp.sys -- (RTL8023xp)
DRV - [2009/06/17 09:56:16 | 000,037,392 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LMouFilt.Sys -- (LMouFilt)
DRV - [2009/06/17 09:56:06 | 000,035,472 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LHidFilt.Sys -- (LHidFilt)
DRV - [2009/06/17 09:55:34 | 000,010,384 | ---- | M] (Logitech, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\LBeepKE.sys -- (LBeepKE)
DRV - [2009/02/03 19:31:16 | 000,170,496 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\atinavt2.sys -- (ATIAVAIW)
DRV - [2008/08/14 08:57:42 | 000,074,720 | ---- | M] (Adobe Systems, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\System32\drivers\adfs.sys -- (adfs)
DRV - [2008/04/14 08:16:22 | 000,048,128 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\61883.sys -- (61883)
DRV - [2008/04/14 08:16:22 | 000,038,912 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\avc.sys -- (Avc)
DRV - [2008/04/14 08:15:14 | 000,060,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\USBAUDIO.sys -- (usbaudio) USB Audio Driver (WDM)
DRV - [2008/04/14 07:16:24 | 000,015,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\MPE.sys -- (MPE)
DRV - [2008/04/14 05:00:00 | 000,144,384 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus)
DRV - [2007/07/20 18:40:10 | 000,084,992 | ---- | M] (ATI Research Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV - [2007/07/20 00:39:50 | 002,142,488 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LVMVdrv.sys -- (LVMVDrv)
DRV - [2007/07/20 00:37:56 | 002,109,592 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Lvckap.sys -- (LVcKap)
DRV - [2007/07/18 17:44:22 | 003,599,000 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\lvuvc.sys -- (LVUVC) QuickCam Orbit/Sphere MP(UVC)
DRV - [2007/07/18 17:44:22 | 000,022,296 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\lvuvcflt.sys -- (FilterService)
DRV - [2007/07/18 17:44:00 | 000,041,752 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LVUSBSta.sys -- (LVUSBSta)
DRV - [2007/07/18 17:43:36 | 000,066,456 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\lvselsus.sys -- (lvselsus)
DRV - [2007/07/18 17:42:42 | 000,025,624 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LVPr2Mon.sys -- (LVPr2Mon)
DRV - [2007/07/18 17:42:28 | 001,920,920 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\lvpopflt.sys -- (lvpopflt)
DRV - [2007/06/29 14:47:34 | 000,034,304 | ---- | M] (AMD, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AmdLLD.sys -- (AmdLLD)
DRV - [2007/06/01 17:14:52 | 001,774,080 | ---- | M] (C-Media Inc) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\cmudaxp.sys -- (cmudaxp)
DRV - [2006/12/04 15:33:34 | 000,067,672 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btwusb.sys -- (BTWUSB)
DRV - [2006/12/04 15:33:34 | 000,047,907 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btwhid.sys -- (btwhid)
DRV - [2006/12/04 15:33:34 | 000,030,459 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btport.sys -- (BTDriver)
DRV - [2006/12/04 15:33:32 | 000,863,402 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btkrnl.sys -- (BTKRNL)
DRV - [2006/12/04 15:33:32 | 000,329,901 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btaudio.sys -- (btaudio)
DRV - [2006/11/02 08:00:08 | 000,039,368 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\winusb.sys -- (WinUSB)
DRV - [2006/09/24 20:23:14 | 000,003,584 | ---- | M] (Realtime Soft) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\UltraMonMirror.sys -- (UltraMonMirror)
DRV - [2006/09/24 20:22:52 | 000,011,776 | ---- | M] (Realtime Soft) [Kernel | Auto | Running] -- C:\Program Files\Common Files\Realtime Soft\UltraMonMirrorDrv\x32\UltraMonUtility.sys -- (UltraMonUtility)
DRV - [2005/10/05 13:00:06 | 000,047,104 | ---- | M] (ELTIMA Software) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\vserial.sys -- (vserial)
DRV - [2005/10/05 13:00:06 | 000,018,167 | ---- | M] (ELTIMA Software) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\vsb.sys -- (vsbus)
DRV - [2004/09/28 18:19:52 | 000,024,576 | ---- | M] (BridgeCo AG) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\rrau0002.sys -- (rrau0002)
DRV - [2004/09/28 18:19:46 | 000,097,280 | ---- | M] (BridgeCo AG) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\rrwd0002.sys -- (rrwd0002)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://holesolutions.net/
IE - HKCU\Software\Microsoft\Internet Explorer\SearchURL\g, = http://www.google.com/search?q=%s
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:5577

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "igoogle.com "
FF - prefs.js..extensions.enabledItems: {BAEC7B80-9A31-47b2-A68B-DCAC8DF48E87}:0.9.1
FF - prefs.js..extensions.enabledItems: {81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}:6.6.5.0
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {FFA36170-80B1-4535-B0E3-A4569E497DD0}:3.0.3
FF - prefs.js..extensions.enabledItems: pbupload@photobucket.com:1.3
FF - prefs.js..extensions.enabledItems: {9ab67d74-ec41-4cb2-b417-df5d93ba1beb}:1.5
FF - prefs.js..extensions.enabledItems: {c45c406e-ab73-11d8-be73-000a95be3b12}:1.1.8
FF - prefs.js..extensions.enabledItems: foxmarks@kei.com:3.6.14
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..network.proxy.type: 0

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/06/27 21:32:19 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/07/07 00:57:06 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2010/07/02 18:25:02 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins

[2010/07/02 18:25:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\s0urce\Application Data\Mozilla\Extensions
[2010/07/02 18:25:12 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\s0urce\Application Data\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2010/07/09 16:24:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\s0urce\Application Data\Mozilla\Firefox\Profiles\tbqrl7su.default\extensions
[2010/07/08 12:14:06 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\s0urce\Application Data\Mozilla\Firefox\Profiles\tbqrl7su.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/05/07 15:17:35 | 000,000,000 | ---D | M] (iMacros for Firefox) -- C:\Documents and Settings\s0urce\Application Data\Mozilla\Firefox\Profiles\tbqrl7su.default\extensions\{81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}
[2010/06/10 17:04:07 | 000,000,000 | ---D | M] (Table2Clipboard) -- C:\Documents and Settings\s0urce\Application Data\Mozilla\Firefox\Profiles\tbqrl7su.default\extensions\{9ab67d74-ec41-4cb2-b417-df5d93ba1beb}
[2010/04/01 20:15:53 | 000,000,000 | ---D | M] (CheckFox) -- C:\Documents and Settings\s0urce\Application Data\Mozilla\Firefox\Profiles\tbqrl7su.default\extensions\{BAEC7B80-9A31-47b2-A68B-DCAC8DF48E87}
[2010/01/08 03:53:28 | 000,000,000 | ---D | M] (Web Developer) -- C:\Documents and Settings\s0urce\Application Data\Mozilla\Firefox\Profiles\tbqrl7su.default\extensions\{c45c406e-ab73-11d8-be73-000a95be3b12}
[2010/06/06 04:26:28 | 000,000,000 | ---D | M] (Mouse Gestures Redox) -- C:\Documents and Settings\s0urce\Application Data\Mozilla\Firefox\Profiles\tbqrl7su.default\extensions\{FFA36170-80B1-4535-B0E3-A4569E497DD0}
[2010/04/22 13:22:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\s0urce\Application Data\Mozilla\Firefox\Profiles\tbqrl7su.default\extensions\foxmarks@kei.com
[2009/10/24 18:26:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\s0urce\Application Data\Mozilla\Firefox\Profiles\tbqrl7su.default\extensions\pbupload@photobucket.com
[2010/07/09 20:24:31 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2010/07/07 00:08:51 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/07/07 00:08:36 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll

O1 HOSTS File: ([2010/07/07 20:53:47 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (ContributeBHO Class) - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files\Adobe\/Adobe Contribute CS4/contributeieplugin.dll ()
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Contribute Toolbar) - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS4/contributeieplugin.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [Adobe Acrobat Speed Launcher] C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe (AMD)
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
O4 - HKLM..\Run: [Easy Synchronization] C:\Program Files\Logitech\Easy Synchronization\LogitechEasySync.exe ()
O4 - HKLM..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe (Google)
O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\WINDOWS\KHALMNPR.Exe (Logitech, Inc.)
O4 - HKLM..\Run: [LogitechCommunicationsManager] C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe ()
O4 - HKLM..\Run: [LogitechQuickCamRibbon] C:\Program Files\Logitech\QuickCam\Quickcam.exe ()
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKCU..\Run: [Hot Keyboard] C:\Program Files\Hot Keyboard Pro\HotKeyb.exe (Imposant)
O4 - HKLM..\RunOnce: [Easy Synchronization] C:\Program Files\Logitech\Easy Synchronization\LogitechEasySync.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\BDARemote.lnk.disabled ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Bluetooth.lnk = C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe (Logitech, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\UltraMon.lnk = C:\WINDOWS\Installer\{AF0FA6D7-96F3-468A-ABB7-28BE006EA8E9}\IcoUltraMon.ico ()
O4 - Startup: C:\Documents and Settings\s0urce\Start Menu\Programs\Startup\Pandora.lnk.disabled ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMConfigurePrograms = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMHelp = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Append Link Target to Existing PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Append to Existing PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Assign &hot key - C:\Program Files\Hot Keyboard Pro\IEScript.htm ()
O8 - Extra context menu item: Convert Link Target to Adobe PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to Adobe PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O15 - HKCU\..Trusted Domains: microsoft.com ([v4.windowsupdate] http in Trusted sites)
O15 - HKCU\..Trusted Domains: microsoft.com ([v4.windowsupdate] https in Trusted sites)
O15 - HKCU\..Trusted Domains: microsoft.com ([windowsupdate] http in Trusted sites)
O15 - HKCU\..Trusted Domains: microsoft.com ([www] http in Trusted sites)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1265605580875 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1278486651336 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 209.18.47.61 209.18.47.62
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\LBTWlgn: DllName - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll - c:\Program Files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O28 - HKLM ShellExecuteHooks: {FE24CD78-7C63-465D-8787-4EDF7FC79895} - C:\Program Files\Logitech\Easy Synchronization\shellexecutehook.dll ()
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/10/20 16:36:00 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKCU\...exe [@ = exefile] -- Reg Error: Key error. File not found

NetSvcs: 6to4 - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: aux - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: aux1 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: aux2 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi1 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi2 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi3 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi4 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi5 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midimapper - C:\WINDOWS\System32\midimap.dll (Microsoft Corporation)
Drivers32: mixer - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer1 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer2 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer3 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer4 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer5 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: msacm.imaadpcm - C:\WINDOWS\System32\imaadp32.acm (Microsoft Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.msadpcm - C:\WINDOWS\System32\msadp32.acm (Microsoft Corporation)
Drivers32: msacm.msaudio1 - C:\WINDOWS\System32\msaud32.acm (Microsoft Corporation)
Drivers32: msacm.msg711 - C:\WINDOWS\System32\msg711.acm (Microsoft Corporation)
Drivers32: msacm.msgsm610 - C:\WINDOWS\System32\msgsm32.acm (Microsoft Corporation)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.FFDS - C:\WINDOWS\System32\ff_vfw.dll ()
Drivers32: VIDC.FPS1 - C:\WINDOWS\System32\frapsvid.dll (Beepa P/L)
Drivers32: VIDC.I420 - C:\WINDOWS\System32\lvcodec2.dll (Logitech Inc.)
Drivers32: vidc.iv41 - ir41_32.ax File not found
Drivers32: VIDC.IYUV - C:\WINDOWS\System32\iyuv_32.dll (Microsoft Corporation)
Drivers32: vidc.mrle - C:\WINDOWS\System32\msrle32.dll (Microsoft Corporation)
Drivers32: vidc.msvc - C:\WINDOWS\System32\msvidc32.dll (Microsoft Corporation)
Drivers32: VIDC.UYVY - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)
Drivers32: VIDC.YUY2 - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)
Drivers32: VIDC.YVU9 - C:\WINDOWS\System32\tsbyuv.dll (Microsoft Corporation)
Drivers32: VIDC.YVYU - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)
Drivers32: wave - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave1 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave2 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave3 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave4 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave5 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wavemapper - C:\WINDOWS\System32\msacm32.drv (Microsoft Corporation)

========== Files/Folders - Created Within 90 Days ==========

[2010/07/10 11:27:31 | 000,000,000 | ---D | C] -- C:\WINDOWS\LastGood
[2010/07/09 16:28:39 | 000,574,976 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\s0urce\Desktop\OTL.exe
[2010/07/09 16:27:48 | 000,000,000 | --SD | C] -- C:\ComboFix
[2010/07/08 13:43:21 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2010/07/08 01:12:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\KB905474
[2010/07/07 15:56:42 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2010/07/07 15:51:17 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2010/07/07 13:54:30 | 000,017,744 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2010/07/07 13:54:29 | 000,165,456 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswSP.sys
[2010/07/07 13:54:28 | 000,023,376 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys
[2010/07/07 13:54:27 | 000,046,672 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys
[2010/07/07 13:54:25 | 000,100,176 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys
[2010/07/07 13:54:25 | 000,094,544 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswmon.sys
[2010/07/07 13:54:25 | 000,028,880 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys
[2010/07/07 13:54:17 | 000,165,032 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\aswBoot.exe
[2010/07/07 13:54:17 | 000,038,848 | ---- | C] (ALWIL Software) -- C:\WINDOWS\avastSS.scr
[2010/07/07 13:54:14 | 000,000,000 | ---D | C] -- C:\Program Files\Alwil Software
[2010/07/07 13:54:14 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Alwil Software
[2010/07/07 01:32:16 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Macromedia
[2010/07/07 01:32:11 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Adobe
[2010/07/07 00:54:50 | 000,000,000 | ---D | C] -- C:\WINDOWS\SoftwareDistribution
[2010/07/07 00:50:28 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\s0urce\IECompatCache
[2010/07/07 00:09:00 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2010/07/07 00:08:34 | 000,000,000 | ---D | C] -- C:\Program Files\Java
[2010/07/06 21:55:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\s0urce\Application Data\Malwarebytes
[2010/07/06 21:54:55 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/07/06 21:54:54 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/07/06 21:54:54 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/07/06 21:54:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/07/05 17:39:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2010/07/05 17:39:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Adobe
[2010/07/05 15:47:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\s0urce\Desktop\napa
[2010/07/01 14:50:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\s0urce\My Documents\Adobe
[2010/07/01 14:39:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\s0urce\Application Data\dvdcss
[2010/06/25 23:46:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\s0urce\Application Data\Facebook
[2010/06/25 14:49:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\s0urce\Desktop\Skydiving
[2010/06/22 20:24:28 | 000,000,000 | ---D | C] -- C:\CS5
[2010/06/22 18:13:04 | 000,000,000 | ---D | C] -- C:\Program Files\nLite
[2010/06/14 14:33:18 | 000,000,000 | ---D | C] -- C:\php-tools
[2010/06/11 21:25:22 | 000,000,000 | ---D | C] -- C:\Program Files\Notepad++
[2010/06/11 21:25:22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\s0urce\Application Data\Notepad++
[2010/05/23 20:28:31 | 000,000,000 | ---D | C] -- C:\Documents and Settings\s0urce\My Documents\manuals
[2010/05/08 21:29:11 | 000,000,000 | ---D | C] -- C:\Documents and Settings\s0urce\Oracle
[2010/04/25 21:15:06 | 000,000,000 | ---D | C] -- C:\Program Files\mkv2vob
[2010/04/25 04:19:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\s0urce\Application Data\Media Player Classic
[2010/04/25 04:19:44 | 000,000,000 | ---D | C] -- C:\Program Files\MPC HomeCinema
[2010/04/25 04:11:34 | 000,000,000 | ---D | C] -- C:\Program Files\Haali
[2010/04/25 04:11:30 | 000,000,000 | ---D | C] -- C:\Program Files\CoreCodec
[2010/04/14 22:28:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\s0urce\Application Data\Trillian
[2010/04/14 22:28:16 | 000,000,000 | ---D | C] -- C:\Program Files\Trillian
[2010/04/12 17:19:44 | 000,000,000 | ---D | C] -- C:\Program Files\PuTTY
[2010/04/12 17:19:15 | 000,000,000 | ---D | C] -- C:\Program Files\PuTTY Connection Manager
[2010/04/12 04:59:57 | 000,000,000 | ---D | C] -- C:\Program Files\Western Digital Corporation
[2010/04/12 04:28:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\s0urce\Local Settings\Application Data\Help
[2010/04/12 04:22:18 | 000,000,000 | -H-D | C] -- C:\WINDOWS\PIF
[2010/04/12 01:37:28 | 000,000,000 | ---D | C] -- C:\Program Files\Lavalys
[2010/04/12 01:10:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\s0urce\Application Data\Download Manager
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 90 Days ==========

[2010/07/10 11:33:42 | 000,001,729 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2010/07/10 11:27:56 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/07/10 11:25:32 | 000,002,299 | ---- | M] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\UltraMon.lnk
[2010/07/10 11:25:13 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010/07/10 11:25:04 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/07/10 11:24:32 | 000,000,000 | ---- | M] () -- C:\WINDOWS\System32\drivers\lvuvc.hs
[2010/07/10 11:23:13 | 010,485,760 | -H-- | M] () -- C:\Documents and Settings\s0urce\NTUSER.DAT
[2010/07/10 11:23:07 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\s0urce\ntuser.ini
[2010/07/10 09:55:18 | 000,119,521 | ---- | M] () -- C:\Documents and Settings\s0urce\Desktop\BlackOpsCover.png
[2010/07/10 09:54:57 | 000,001,743 | ---- | M] () -- C:\Documents and Settings\s0urce\Desktop\BlackOpsCover.gif
[2010/07/10 09:00:07 | 000,000,426 | ---- | M] () -- C:\WINDOWS\tasks\daily sgdne.job
[2010/07/09 16:28:38 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\s0urce\Desktop\OTL.exe
[2010/07/08 12:10:27 | 000,000,600 | ---- | M] () -- C:\Documents and Settings\s0urce\Local Settings\Application Data\PUTTY.RND
[2010/07/08 10:22:36 | 000,002,283 | ---- | M] () -- C:\Documents and Settings\s0urce\Application Data\Microsoft\Internet Explorer\Quick Launch\Skype.lnk
[2010/07/08 01:37:45 | 000,504,498 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2010/07/08 01:37:45 | 000,429,846 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010/07/08 01:37:45 | 000,066,042 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010/07/08 01:32:42 | 002,001,008 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010/07/07 20:53:52 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2010/07/07 20:53:47 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2010/07/07 19:07:28 | 000,100,908 | ---- | M] () -- C:\Documents and Settings\s0urce\Desktop\SystemLook.exe
[2010/07/07 17:39:55 | 000,001,700 | ---- | M] () -- C:\Documents and Settings\s0urce\Application Data\Microsoft\Internet Explorer\Quick Launch\avast! Free Antivirus.lnk
[2010/07/07 17:39:55 | 000,000,104 | ---- | M] () -- C:\Documents and Settings\s0urce\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk
[2010/07/07 17:32:55 | 004,313,738 | -H-- | M] () -- C:\Documents and Settings\s0urce\Local Settings\Application Data\IconCache.db
[2010/07/07 15:56:56 | 000,000,293 | RHS- | M] () -- C:\boot.ini
[2010/07/07 13:54:26 | 000,002,626 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
[2010/07/06 22:53:33 | 000,000,760 | ---- | M] () -- C:\Documents and Settings\s0urce\Application Data\setup_ldm.iss
[2010/07/06 21:54:57 | 000,000,714 | ---- | M] () -- C:\Documents and Settings\s0urce\Application Data\Microsoft\Internet Explorer\Quick Launch\Malwarebytes' Anti-Malware.lnk
[2010/07/06 21:49:38 | 000,000,126 | ---- | M] () -- C:\WINDOWS\wininit.ini
[2010/07/01 15:53:27 | 000,000,600 | ---- | M] () -- C:\Documents and Settings\s0urce\Application Data\winscp.rnd
[2010/06/28 13:57:33 | 000,038,848 | ---- | M] (ALWIL Software) -- C:\WINDOWS\avastSS.scr
[2010/06/28 13:57:12 | 000,165,032 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\aswBoot.exe
[2010/06/28 13:37:52 | 000,046,672 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys
[2010/06/28 13:37:30 | 000,165,456 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswSP.sys
[2010/06/28 13:33:13 | 000,023,376 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys
[2010/06/28 13:32:45 | 000,100,176 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys
[2010/06/28 13:32:42 | 000,094,544 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswmon.sys
[2010/06/28 13:32:33 | 000,017,744 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2010/06/28 13:32:16 | 000,028,880 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys
[2010/06/27 21:02:34 | 000,408,553 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20100705-182537.backup
[2010/06/22 22:30:42 | 000,000,720 | ---- | M] () -- C:\Documents and Settings\s0urce\Application Data\Microsoft\Internet Explorer\Quick Launch\Notepad++.lnk
[2010/05/23 20:26:06 | 000,000,340 | ---- | M] () -- C:\Documents and Settings\s0urce\Desktop\My Documents.lnk
[2010/05/23 20:25:34 | 000,000,505 | ---- | M] () -- C:\Documents and Settings\s0urce\Desktop\My Pictures.lnk
[2010/04/29 15:39:38 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/04/29 15:39:26 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/04/25 21:28:40 | 000,001,703 | ---- | M] () -- C:\Documents and Settings\s0urce\Application Data\Microsoft\Internet Explorer\Quick Launch\mkv2vob.lnk
[2010/04/25 04:19:44 | 000,000,666 | ---- | M] () -- C:\Documents and Settings\s0urce\Application Data\Microsoft\Internet Explorer\Quick Launch\Media Player Classic.lnk
[2010/04/25 04:05:17 | 000,000,000 | ---- | M] () -- C:\WINDOWS\GraphEdt.INI
[2010/04/24 04:09:11 | 000,000,600 | ---- | M] () -- C:\Documents and Settings\s0urce\Application Data\PUTTY.RND
[2010/04/22 13:20:47 | 000,001,781 | ---- | M] () -- C:\Documents and Settings\s0urce\Application Data\Microsoft\Internet Explorer\Quick Launch\Logitech QuickCam.lnk
[2010/04/14 22:28:34 | 000,000,772 | ---- | M] () -- C:\Documents and Settings\s0urce\Application Data\Microsoft\Internet Explorer\Quick Launch\Trillian.lnk
[2010/04/12 20:11:35 | 000,001,738 | -H-- | M] () -- C:\Documents and Settings\s0urce\My Documents\Default.rdp
[2010/04/12 18:06:16 | 000,000,644 | ---- | M] () -- C:\Documents and Settings\s0urce\Application Data\Microsoft\Internet Explorer\Quick Launch\Putty.lnk
[2010/04/12 17:19:16 | 000,000,871 | ---- | M] () -- C:\Documents and Settings\s0urce\Application Data\Microsoft\Internet Explorer\Quick Launch\PuTTY Connection Manager.lnk
[2010/04/12 01:37:31 | 000,000,805 | ---- | M] () -- C:\Documents and Settings\s0urce\Application Data\Microsoft\Internet Explorer\Quick Launch\EVEREST Ultimate Edition.lnk
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/07/10 11:33:42 | 000,001,729 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2010/07/10 09:55:18 | 000,119,521 | ---- | C] () -- C:\Documents and Settings\s0urce\Desktop\BlackOpsCover.png
[2010/07/10 09:54:57 | 000,001,743 | ---- | C] () -- C:\Documents and Settings\s0urce\Desktop\BlackOpsCover.gif
[2010/07/07 19:07:28 | 000,100,908 | ---- | C] () -- C:\Documents and Settings\s0urce\Desktop\SystemLook.exe
[2010/07/07 17:39:55 | 000,001,700 | ---- | C] () -- C:\Documents and Settings\s0urce\Application Data\Microsoft\Internet Explorer\Quick Launch\avast! Free Antivirus.lnk
[2010/07/07 17:39:55 | 000,000,104 | ---- | C] () -- C:\Documents and Settings\s0urce\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk
[2010/07/07 15:56:55 | 000,000,223 | ---- | C] () -- C:\Boot.bak
[2010/07/07 15:56:44 | 000,260,272 | ---- | C] () -- C:\cmldr
[2010/07/06 22:53:33 | 000,000,760 | ---- | C] () -- C:\Documents and Settings\s0urce\Application Data\setup_ldm.iss
[2010/07/06 21:54:57 | 000,000,714 | ---- | C] () -- C:\Documents and Settings\s0urce\Application Data\Microsoft\Internet Explorer\Quick Launch\Malwarebytes' Anti-Malware.lnk
[2010/07/06 21:49:38 | 000,000,126 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2010/06/22 22:30:42 | 000,000,720 | ---- | C] () -- C:\Documents and Settings\s0urce\Application Data\Microsoft\Internet Explorer\Quick Launch\Notepad++.lnk
[2010/05/23 20:26:06 | 000,000,340 | ---- | C] () -- C:\Documents and Settings\s0urce\Desktop\My Documents.lnk
[2010/05/23 20:25:34 | 000,000,505 | ---- | C] () -- C:\Documents and Settings\s0urce\Desktop\My Pictures.lnk
[2010/05/20 13:50:09 | 000,000,426 | ---- | C] () -- C:\WINDOWS\tasks\daily sgdne.job
[2010/04/25 21:28:40 | 000,001,703 | ---- | C] () -- C:\Documents and Settings\s0urce\Application Data\Microsoft\Internet Explorer\Quick Launch\mkv2vob.lnk
[2010/04/25 04:19:44 | 000,000,666 | ---- | C] () -- C:\Documents and Settings\s0urce\Application Data\Microsoft\Internet Explorer\Quick Launch\Media Player Classic.lnk
[2010/04/25 04:05:17 | 000,000,000 | ---- | C] () -- C:\WINDOWS\GraphEdt.INI
[2010/04/25 03:55:54 | 086,302,131 | ---- | C] () -- C:\m-dtc9-1080p-sample.mkv
[2010/04/22 13:20:47 | 000,001,781 | ---- | C] () -- C:\Documents and Settings\s0urce\Application Data\Microsoft\Internet Explorer\Quick Launch\Logitech QuickCam.lnk
[2010/04/21 02:58:55 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\drivers\lvuvc.hs
[2010/04/21 02:57:10 | 000,058,163 | ---- | C] () -- C:\WINDOWS\System32\lvcoinst.ini
[2010/04/21 02:57:10 | 000,019,344 | ---- | C] () -- C:\WINDOWS\System32\Repository.reg
[2010/04/15 06:35:38 | 000,000,600 | ---- | C] () -- C:\Documents and Settings\s0urce\Application Data\PUTTY.RND
[2010/04/14 22:28:34 | 000,000,772 | ---- | C] () -- C:\Documents and Settings\s0urce\Application Data\Microsoft\Internet Explorer\Quick Launch\Trillian.lnk
[2010/04/12 17:19:16 | 000,000,871 | ---- | C] () -- C:\Documents and Settings\s0urce\Application Data\Microsoft\Internet Explorer\Quick Launch\PuTTY Connection Manager.lnk
[2010/04/12 06:52:05 | 000,000,136 | ---- | C] () -- C:\Program Files\results.txt
[2010/04/12 06:29:09 | 000,000,303 | ---- | C] () -- C:\Program Files\prime.txt
[2010/04/12 06:29:09 | 000,000,106 | ---- | C] () -- C:\Program Files\local.txt
[2010/04/12 02:58:16 | 005,132,288 | ---- | C] () -- C:\Program Files\prime95.exe
[2010/04/12 01:37:31 | 000,000,805 | ---- | C] () -- C:\Documents and Settings\s0urce\Application Data\Microsoft\Internet Explorer\Quick Launch\EVEREST Ultimate Edition.lnk
[2010/03/28 18:05:28 | 001,589,248 | ---- | C] () -- C:\WINDOWS\System32\libmysql_d.dll
[2010/03/26 19:46:09 | 000,007,680 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2010/03/26 19:46:09 | 000,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest
[2009/12/07 21:01:01 | 000,151,552 | ---- | C] () -- C:\WINDOWS\System32\nvRegDev.dll
[2009/10/29 18:32:01 | 000,000,262 | ---- | C] () -- C:\WINDOWS\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
[2009/10/20 17:31:36 | 000,363,520 | ---- | C] () -- C:\WINDOWS\System32\PsisDecd.dll
[2009/10/20 17:04:07 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\CMRMDRVP.dll
[2009/10/20 17:04:07 | 000,000,229 | ---- | C] () -- C:\WINDOWS\Cmicnfgp.ini.cfl
[2009/10/20 17:03:35 | 000,003,775 | ---- | C] () -- C:\WINDOWS\Cmicnfgp.ini.cfg
[2009/07/04 01:03:00 | 000,008,463 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2007/07/18 17:42:42 | 000,025,624 | ---- | C] () -- C:\WINDOWS\System32\drivers\LVPr2Mon.sys
[2006/11/29 23:24:10 | 000,090,112 | ---- | C] () -- C:\WINDOWS\System32\btprn2k.dll
[2005/02/17 12:41:32 | 000,000,603 | ---- | C] () -- C:\WINDOWS\System32\BTNeighborhood.dll.manifest
[2005/02/17 12:41:30 | 000,000,593 | ---- | C] () -- C:\WINDOWS\System32\btcss.dll.manifest
[2001/11/14 13:56:00 | 001,802,240 | ---- | C] () -- C:\WINDOWS\System32\lcppn21.dll

========== LOP Check ==========

[2010/07/07 13:54:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Alwil Software
[2009/10/31 00:26:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TrackMania
[2009/11/19 11:41:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\s0urce\Application Data\Actual Search & Replace
[2010/02/27 02:13:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\s0urce\Application Data\CanuckSoftware
[2009/12/31 19:11:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\s0urce\Application Data\com.pandora.desktop.FB9956FD96E03239939108614098AD95535EE674.1
[2010/06/25 23:46:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\s0urce\Application Data\Facebook
[2010/02/12 14:55:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\s0urce\Application Data\Free Sound Recorder
[2010/01/16 02:50:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\s0urce\Application Data\Hot Keyboard
[2010/07/10 11:25:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\s0urce\Application Data\Hot Keyboard Pro Backup
[2009/12/08 22:07:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\s0urce\Application Data\JGsoft
[2009/11/22 02:13:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\s0urce\Application Data\Leadertech
[2010/06/11 21:25:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\s0urce\Application Data\Notepad++
[2010/01/14 17:43:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\s0urce\Application Data\OpenOffice.org
[2010/03/23 15:22:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\s0urce\Application Data\Thinstall
[2010/07/02 18:25:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\s0urce\Application Data\Thunderbird
[2010/04/14 22:28:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\s0urce\Application Data\Trillian
[2010/07/06 21:08:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\s0urce\Application Data\uTorrent
[2010/07/10 09:00:07 | 000,000,426 | ---- | M] () -- C:\WINDOWS\Tasks\daily sgdne.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2009/10/20 16:36:00 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
[2009/10/20 16:46:28 | 000,000,223 | ---- | M] () -- C:\Boot.bak
[2010/07/07 15:56:56 | 000,000,293 | RHS- | M] () -- C:\boot.ini
[2004/08/03 23:00:00 | 000,260,272 | ---- | M] () -- C:\cmldr
[2010/07/07 20:55:22 | 000,020,771 | ---- | M] () -- C:\ComboFix.txt
[2009/10/20 16:36:00 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2009/10/31 01:38:57 | 1580,031,150 | ---- | M] () -- C:\gtr2-virgin-install.rar
[2010/06/16 11:55:24 | 000,000,000 | ---- | M] () -- C:\HotKeyb.txt
[2009/10/20 16:36:00 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2009/11/27 04:08:37 | 086,302,131 | ---- | M] () -- C:\m-dtc9-1080p-sample.mkv
[2009/10/20 16:36:00 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2008/04/14 05:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2008/04/14 05:00:00 | 000,250,048 | RHS- | M] () -- C:\ntldr
[2010/07/10 11:24:30 | 2145,386,496 | -HS- | M] () -- C:\pagefile.sys
[2010/07/05 17:49:22 | 000,000,411 | ---- | M] () -- C:\rkill.log

< %systemroot%\system32\Spool\prtprocs\w32x86\*.dll >
[2008/07/06 05:06:10 | 000,089,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll

< %systemroot%\system32\*.wt >

< %systemroot%\system32\*.ruy >

< %systemroot%\Fonts\*.com >
[2006/04/18 16:39:28 | 000,026,040 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 15:53:56 | 000,026,489 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 16:39:28 | 000,029,779 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 15:58:52 | 000,030,808 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\system32\spool\prtprocs\w32x86\*.tmp >

< %systemroot%\*. /mp /s >


< %systemroot%\system32\*.dll /lockedfiles >
[2009/07/21 08:55:26 | 000,442,368 | ---- | M] (Advanced Micro Devices, Inc.) Unable to obtain MD5 -- C:\WINDOWS\system32\ATIDEMGX.dll
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2009/10/19 19:47:24 | 000,065,536 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2009/10/19 19:47:24 | 001,056,768 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2009/10/19 19:47:24 | 000,692,224 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

< %systemroot%\system32\user32.dll /md5 >
[2008/04/14 05:00:00 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=B26B135FF1B9F60C9388B4A7D16F600B -- C:\WINDOWS\system32\user32.dll
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\system32\ws2_32.dll /md5 >
[2008/04/14 05:00:00 | 000,082,432 | ---- | M] (Microsoft Corporation) MD5=2CCC474EB85CEAA3E1FA1726580A3E5A -- C:\WINDOWS\system32\ws2_32.dll
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\system32\ws2help.dll /md5 >
[2008/04/14 05:00:00 | 000,019,968 | ---- | M] (Microsoft Corporation) MD5=9789E95E1D88EEB4B922BF3EA7779C28 -- C:\WINDOWS\system32\ws2help.dll
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >

< End of report >

 

OTL Log again: I no longer have the card that uses that realtek audio driver installed. That could most likely be ignored.

All processes killed
========== OTL ==========
Service wscsvc stopped successfully!
Service wscsvc deleted successfully!
File C:\WINDOWS\System32\wscsvc.dll not found.
Service UPS stopped successfully!
Service UPS deleted successfully!
File C:\WINDOWS\System32\ups.exe not found.
Service ERSvc stopped successfully!
Service ERSvc deleted successfully!
File C:\WINDOWS\System32\ersvc.dll not found.
Service ClipSrv stopped successfully!
Service ClipSrv deleted successfully!
File C:\WINDOWS\System32\clipsrv.exe not found.
Service CiSvc stopped successfully!
Service CiSvc deleted successfully!
File C:\WINDOWS\System32\cisvc.exe not found.
Service Monfilt stopped successfully!
Service Monfilt deleted successfully!
File C:\WINDOWS\System32\drivers\Monfilt.sys not found.
Error: No service named IntcAzAudAddService) Service for Realtek HD Audio (WDM was found to stop!
Service\Driver key IntcAzAudAddService) Service for Realtek HD Audio (WDM not found.
File C:\WINDOWS\System32\drivers\RtkHDAud.sys not found.
Service catchme stopped successfully!
Service catchme deleted successfully!
File C:\DOCUME~1\s0urce\LOCALS~1\Temp\catchme.sys not found.
Service Ambfilt stopped successfully!
Service Ambfilt deleted successfully!
File C:\WINDOWS\System32\drivers\Ambfilt.sys not found.
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully!
C:\WINDOWS\system32\drivers\lvuvc.hs moved successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\\ "EnableFirewall" |dword:00000001 /E : value set successfully!
========== FILES ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 41620 bytes

User: LocalService
->Temp folder emptied: 65748 bytes
->Temporary Internet Files folder emptied: 32902 bytes
->Flash cache emptied: 5705 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes
->Flash cache emptied: 15278 bytes

User: s0urce
->Temp folder emptied: 23774781 bytes
->Temporary Internet Files folder emptied: 1266585 bytes
->Java cache emptied: 45436344 bytes
->FireFox cache emptied: 97906074 bytes
->Flash cache emptied: 4123340 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2402044 bytes
%systemroot%\System32 .tmp files removed: 2577 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 101039 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 65887418 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 1759782995 bytes

Total Files Cleaned = 1,908.00 mb


[EMPTYFLASH]

User: All Users

User: Default User
->Flash cache emptied: 0 bytes

User: LocalService
->Flash cache emptied: 0 bytes

User: NetworkService
->Flash cache emptied: 0 bytes

User: s0urce
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb

C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

OTL by OldTimer - Version 3.2.8.1 log created on 07102010_164816

Files\Folders moved on Reboot...
File\Folder C:\WINDOWS\temp\_avast5_\Webshlock.txt not found!

Registry entries deleted on Reboot...