Hey Mike,
Thanks again for the help, following will be the next combofix log plus after the anti malware log and I will as well attach the other combofix log as requested...
I don't think all cracks are that bad...I had no problems with the one for Eset, and I had it installed for a bit. But I do know most are considered mal/spyware.
Anyhow here are my logs starting with Combo Fix + CF Script:
ComboFix 08-07-29.1 - Administrator 2008-07-31 23:47:20.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.530 [GMT -7:00]
Running from: C:\Documents and Settings\Administrator\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Administrator\Desktop\CFScript.txt
* Created a new restore point
FILE ::
C:\WINDOWS\nod32fixtemdono.reg
C:\WINDOWS\nod32restoretemdono.reg
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\All Users\Application Data\ESET
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Charon\CACHE.NDB
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\EHttpSrv.xml
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\EpfwUser.dat
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\httpblk.dat
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Installer\16a3.msi
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Logs\eScan\ndl14318.dat
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Logs\eScan\ndl22769.dat
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Logs\eScan\ndl4467.dat
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Logs\virlog.dat
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Logs\warnlog.dat
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Updfiles\base_nonnups\
0_3_0_nod24D0.nup
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Updfiles\continuous\nod0962.nup
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Updfiles\continuous\nod0A07.nup
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Updfiles\continuous\nod198E.nup
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Updfiles\continuous\nod2D9C.nup
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Updfiles\continuous\nod4367.nup
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Updfiles\em003_32_l0.nup
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Updfiles\em003_32_l1.nup
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Updfiles\em004_32_l0.nup
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Updfiles\em004_32_l1.nup
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Updfiles\em005_32_l0.nup
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Updfiles\em005_32_l1.nup
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Updfiles\em005_32_l2.nup
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Updfiles\http_89.202.157.135\update.ver
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Updfiles\http_89.202.157.137\update.ver
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Updfiles\http_89.202.157.138\update.ver
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Updfiles\http_89.202.157.139\update.ver
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Updfiles\http_u21.eset.com\update.ver
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Updfiles\http_u24.eset.com\update.ver
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Updfiles\http_u30.eset.com\update.ver
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Updfiles\http_u31.eset.com\update.ver
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Updfiles\http_u32.eset.com\update.ver
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Updfiles\http_u33.eset.com\update.ver
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Updfiles\http_u34.eset.com\update.ver
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Updfiles\http_u35.eset.com\update.ver
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Updfiles\http_u36.eset.com\update.ver
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Updfiles\http_u37.eset.com\update.ver
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Updfiles\http_u38.eset.com\update.ver
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Updfiles\http_u39.eset.com\update.ver
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Updfiles\http_u40.eset.com\update.ver
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Updfiles\http_u41.eset.com\update.ver
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Updfiles\http_u42.eset.com\update.ver
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Updfiles\http_u43.eset.com\update.ver
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Updfiles\http_u44.eset.com\update.ver
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Updfiles\http_u45.eset.com\update.ver
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Updfiles\http_u46.eset.com\update.ver
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Updfiles\http_u47.eset.com\update.ver
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Updfiles\http_u48.eset.com\update.ver
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Updfiles\http_u49.eset.com\update.ver
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Updfiles\lastupd.ver
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Updfiles\nod1B85.nup
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Updfiles\nod361C.nup
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Updfiles\nod4097.nup
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Updfiles\nod4A34.nup
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Updfiles\nod50AE.nup
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Updfiles\nod5DA2.nup
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Updfiles\nod620D.nup
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Updfiles\nod6931.nup
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Updfiles\reverse\nod7FA8.nup
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Updfiles\upd.ver
C:\program files\ESET
C:\program files\ESET\ESET NOD32 Antivirus\callmsi.exe
C:\program files\ESET\ESET NOD32 Antivirus\Drivers\eamon\eamon.cat
C:\program files\ESET\ESET NOD32 Antivirus\Drivers\eamon\eamon.inf
C:\program files\ESET\ESET NOD32 Antivirus\Drivers\eamon\eamon.sys
C:\program files\ESET\ESET NOD32 Antivirus\Drivers\easdrv\easdrv.cat
C:\program files\ESET\ESET NOD32 Antivirus\Drivers\easdrv\easdrv.inf
C:\program files\ESET\ESET NOD32 Antivirus\Drivers\easdrv\easdrv.sys
C:\program files\ESET\ESET NOD32 Antivirus\Drivers\epfwtdir\epfwtdir.cat
C:\program files\ESET\ESET NOD32 Antivirus\Drivers\epfwtdir\epfwtdir.inf
C:\program files\ESET\ESET NOD32 Antivirus\Drivers\epfwtdir\epfwtdir.sys
C:\program files\ESET\ESET NOD32 Antivirus\ecls.exe
C:\program files\ESET\ESET NOD32 Antivirus\ecmd.exe
C:\program files\ESET\ESET NOD32 Antivirus\egui.exe
C:\program files\ESET\ESET NOD32 Antivirus\eguiAmon.dll
C:\program files\ESET\ESET NOD32 Antivirus\eguiEmon.dll
C:\program files\ESET\ESET NOD32 Antivirus\eguiEpfw.dll
C:\program files\ESET\ESET NOD32 Antivirus\eguiMailPlugins.dll
C:\program files\ESET\ESET NOD32 Antivirus\eguiProduct.dll
C:\program files\ESET\ESET NOD32 Antivirus\eguiScan.dll
C:\program files\ESET\ESET NOD32 Antivirus\eguiUpdate.dll
C:\program files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
C:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\program files\ESET\ESET NOD32 Antivirus\ekrnAmon.dll
C:\program files\ESET\ESET NOD32 Antivirus\ekrnEmon.dll
C:\program files\ESET\ESET NOD32 Antivirus\ekrnEpfw.dll
C:\program files\ESET\ESET NOD32 Antivirus\ekrnMailPlugins.dll
C:\program files\ESET\ESET NOD32 Antivirus\ekrnScan.dll
C:\program files\ESET\ESET NOD32 Antivirus\ekrnUpdate.dll
C:\program files\ESET\ESET NOD32 Antivirus\em000_32.dat
C:\program files\ESET\ESET NOD32 Antivirus\em001_32.dat
C:\program files\ESET\ESET NOD32 Antivirus\em002_32.dat
C:\program files\ESET\ESET NOD32 Antivirus\em003_32.dat
C:\program files\ESET\ESET NOD32 Antivirus\em004_32.dat
C:\program files\ESET\ESET NOD32 Antivirus\em005_32.dat
C:\program files\ESET\ESET NOD32 Antivirus\em006_32.dat
C:\program files\ESET\ESET NOD32 Antivirus\eplgHooks.dll
C:\program files\ESET\ESET NOD32 Antivirus\eplgOE.dll
C:\program files\ESET\ESET NOD32 Antivirus\eplgOEEmon.dll
C:\program files\ESET\ESET NOD32 Antivirus\eplgOutlook.dll
C:\program files\ESET\ESET NOD32 Antivirus\eplgOutlookEmon.dll
C:\program files\ESET\ESET NOD32 Antivirus\eset.chm
C:\program files\ESET\ESET NOD32 Antivirus\eula.rtf
C:\program files\ESET\ESET NOD32 Antivirus\http_dll.dll
C:\program files\ESET\ESET NOD32 Antivirus\mfc80.dll
C:\program files\ESET\ESET NOD32 Antivirus\mfc80u.dll
C:\program files\ESET\ESET NOD32 Antivirus\Microsoft.VC80.CRT.manifest
C:\program files\ESET\ESET NOD32 Antivirus\Microsoft.VC80.MFC.manifest
C:\program files\ESET\ESET NOD32 Antivirus\Microsoft.VC80.MFCLOC.manifest
C:\program files\ESET\ESET NOD32 Antivirus\mod_comp.dat
C:\program files\ESET\ESET NOD32 Antivirus\msvcp80.dll
C:\program files\ESET\ESET NOD32 Antivirus\msvcr80.dll
C:\program files\ESET\ESET NOD32 Antivirus\shellExt.dll
C:\program files\ESET\ESET NOD32 Antivirus\unins000.dat
C:\program files\ESET\ESET NOD32 Antivirus\unins000.exe
C:\program files\ESET\ESET NOD32 Antivirus\updater.dll
C:\program files\ESET\Install\advheur.nup
C:\program files\ESET\Install\archs.nup
C:\program files\ESET\Install\charon.nup
C:\program files\ESET\Install\engine.nup
C:\program files\ESET\Install\main.dll
C:\program files\ESET\Install\mfc42.dll
C:\program files\ESET\Install\mfc42u.dll
C:\program files\ESET\Install\msvcrt.dll
C:\program files\ESET\Install\ntbaseen.nup
C:\program files\ESET\Install\ntineten.nup
C:\program files\ESET\Install\ntstden.nup
C:\program files\ESET\Install\pwscan.nup
C:\program files\ESET\Install\readme.txt
C:\program files\ESET\Install\setup.exe
C:\program files\ESET\Install\setup.xml
C:\program files\ESET\Install\utilmod.nup
C:\WINDOWS\nod32fixtemdono.reg
C:\WINDOWS\nod32restoretemdono.reg
.
((((((((((((((((((((((((( Files Created from 2008-07-01 to 2008-08-01 )))))))))))))))))))))))))))))))
.
2008-07-30 01:21 . 2008-07-30 01:21 <DIR> d-------- C:\Program Files\Trend Micro
2008-07-29 23:16 . 2008-07-31 18:06 1,606 --a------ C:\WINDOWS\system32\PerfStringBackup.TMP
2008-07-29 18:19 . 2008-07-29 18:19 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\NVIDIA
2008-07-29 18:15 . 2008-07-29 18:16 <DIR> d-------- C:\WINDOWS\nview
2008-07-29 18:15 . 2006-10-22 12:22 208,896 --a------ C:\WINDOWS\system32\nvudisp.exe
2008-07-29 18:15 . 2006-10-22 12:22 17,056 --a------ C:\WINDOWS\system32\nvdisp.nvu
2008-07-29 18:11 . 2006-10-22 15:06 208,896 --a------ C:\WINDOWS\system32\NVUNINST.EXE
2008-07-29 18:10 . 2008-07-29 18:10 <DIR> d-------- C:\NVIDIA
2008-07-29 18:00 . 2008-07-29 18:01 <DIR> d-------- C:\Program Files\SystemRequirementsLab
2008-07-29 18:00 . 2008-07-29 18:00 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\SystemRequirementsLab
2008-07-18 22:56 . 2008-07-18 22:56 <DIR> d-------- C:\Program Files\Gabest
2008-07-17 18:21 . 2008-07-17 21:20 <DIR> d-------- C:\Program Files\Audacity
2008-07-09 18:18 . 2008-07-28 19:13 <DIR> d-------- C:\Program Files\SpeedFan
2008-07-09 18:18 . 2008-07-09 18:18 45 --a------ C:\WINDOWS\system32\initdebug.nfo
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-01 06:24 --------- d-----w C:\Program Files\PeerGuardian2
2008-07-31 04:59 --------- d-----w C:\Program Files\E.M. Youtube Video Download Tool
2008-07-30 03:16 --------- d-----w C:\Program Files\mIRC
2008-07-23 02:17 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Vso
2008-06-26 17:50 --------- d-----w C:\Program Files\Mypops
2008-06-26 07:15 --------- d-----w C:\Program Files\MSTpscre
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-19 22:57 --------- d-----w C:\Program Files\DVD2SVCD
2008-06-19 22:46 --------- d-----w C:\Program Files\AviSynth 2.5
2008-06-19 04:01 --------- d-----w C:\Program Files\Custom Technology
2008-06-17 02:58 --------- d-----w C:\Program Files\Xvid
2008-06-17 01:52 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Pegasys Inc
2008-06-17 01:51 --------- d-----w C:\Program Files\Pegasys Inc
2008-06-13 13:10 272,128 ------w C:\WINDOWS\system32\drivers\bthport.sys
2008-06-09 08:19 --------- d-----w C:\Program Files\MSN Messenger
2008-06-09 05:42 47,360 ----a-w C:\WINDOWS\system32\drivers\pcouffin.sys
2008-06-09 05:42 47,360 ----a-w C:\Documents and Settings\Administrator\Application Data\pcouffin.sys
2008-06-09 05:42 --------- d-----w C:\Program Files\VSO
2008-06-06 06:01 --------- d-----w C:\Program Files\Google
2006-11-16 03:09 32,320 ----a-w C:\Documents and Settings\Administrator\Application Data\GDIPFONTCACHEV1.DAT
2006-08-15 05:26 25,600 ----a-w C:\Documents and Settings\Administrator\usbsermptxp.sys
2006-08-15 05:26 22,768 ----a-w C:\Documents and Settings\Administrator\usbsermpt.sys
.
(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
---- Directory of C:\Y.D.T ----
2008-06-26 00:03 5079015 --a------ C:\Y.D.T\Downloaded\YouTube - Fatt Snak - Beer Day (situations).flv
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2008-06-03 23:46 5724184]
"PeerGuardian"="C:\Program Files\PeerGuardian2\pg2.exe" [2005-09-18 18:40 1421824]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SiSUSBRG"="C:\WINDOWS\SiSUSBrg.exe" [2002-07-12 03:15 106496]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-09-12 22:10 335872]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 19:50 155648]
"D-Link AirPlus XtremeG"="C:\Program Files\D-Link\AirPlus XtremeG\AirPlusCFG.exe" [2004-10-27 16:07 987136]
"Tpscrex"="C:\Program Files\MSTpscre\Tpscrex.exe" [2008-06-26 00:15 110080]
"ypops"="C:\Program Files\Mypops\ypops.exe" [2008-06-26 10:50 88896]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 12:22 7700480]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"MSACM.MI-SC4"= MI-SC4.acm
"VIDC.HFYU"= huffyuv.dll
[HKLM\~\startupfolder\C:^Documents and Settings^Administrator^Start Menu^Programs^Startup^Rapidown.lnk]
path=C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\Rapidown.lnk
backup=C:\WINDOWS\pss\Rapidown.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ANIWZCS2Service]
--a------ 2004-10-14 10:17 45056 C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AnyDVD]
--a------ 2006-10-06 13:04 492032 C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ Lite]
--a------ 2006-07-11 03:06 3144800 C:\Program Files\ICQLite\ICQLite.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
--a------ 2006-10-22 12:22 7700480 C:\WINDOWS\system32\nvcpl.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
--a------ 2006-10-22 12:22 86016 C:\WINDOWS\system32\nvmctray.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OpwareSE4]
--a------ 2006-10-11 12:45 75304 C:\Program Files\ScanSoft\OmniPageSE4.0\OpWareSE4.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate]
--a------ 2006-09-28 13:16 185896 C:\Program Files\Common Files\ScanSoft Shared\SSBkgdUpdate\SSBkgdUpdate.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-03-14 03:43 83608 C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
-ra------ 2006-03-30 16:45 313472 C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 2006-10-22 12:22 1622016 C:\WINDOWS\system32\nwiz.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableNotifications"= 1 (0x1)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\WINDOWS\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\ICQLite\\ICQLite.exe"=
"C:\\WINDOWS\\PCHealth\\HelpCtr\\Binaries\\helpctr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
R0 SiSRaid1;SiSRaid1;C:\WINDOWS\system32\DRIVERS\SiSRaid1.sys [2003-12-09 00:50]
R1 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2008-02-20 11:11]
S2 NOD32FiXTemDono;Eset Nod32 Boot;C:\WINDOWS\system32\regedt32.exe [2001-08-23 05:00]
S3 A5AGU;D-Link USB Wireless Network Adapter Service;C:\WINDOWS\system32\DRIVERS\A5AGU.sys [2004-10-06 10:39]
S3 ATHFMWDL;D-Link predator Bootloader driver;C:\WINDOWS\system32\Drivers\ATHFMWDL.sys [2005-03-15 18:11]
S3 dwusbdnt;dwusbdnt;C:\WINDOWS\system32\DRIVERS\dwusbdnt.sys [2002-05-24 11:52]
.
Contents of the 'Scheduled Tasks' folder
2004-10-29 C:\WINDOWS\Tasks\Spybot - Search & Destroy - Scheduled Task.job
- C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe []
.
- - - - ORPHANS REMOVED - - - -
HKLM-Run-egui - C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2008-07-31 23:50:52
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\wdfmgr.exe
.
**************************************************************************
.
Completion time: 2008-07-31 23:58:12 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-01 06:58:09
ComboFix2.txt 2008-07-31 02:21:10
ComboFix3.txt 2008-07-31 02:16:39
Pre-Run: 9,203,908,608 bytes free
Post-Run: 9,157,263,360 bytes free
295 --- E O F --- 2008-07-08 23:47:45
and now the malware log
Malwarebytes' Anti-Malware 1.24
Database version: 1014
Windows 5.1.2600 Service Pack 2
12:16:34 AM 8/1/2008
mbam-log-8-1-2008 (00-16-34).txt
Scan type: Quick Scan
Objects scanned: 38049
Time elapsed: 3 minute(s), 11 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 101
Registry Values Infected: 1
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
HKEY_CLASSES_ROOT\istx.installer (Adware.ISTBar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\mywebsearchtoolbar.settingsplugin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\mywebsearchtoolbar.settingsplugin.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\funwebproducts.iecookiesmanager (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\funwebproducts.iecookiesmanager.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\funwebproducts.datacontrol.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\funwebproducts.shellviewcontrol (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\funwebproducts.shellviewcontrol.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\funwebproducts.htmlmenu (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\funwebproducts.htmlmenu.2 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\mywebsearch.htmlpanel (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\mywebsearch.htmlpanel.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\mywebsearchtoolbar.toolbarplugin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\mywebsearchtoolbar.toolbarplugin.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\funwebproducts.popswattersettingscontrol (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\funwebproducts.popswattersettingscontrol.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\mywebsearch.pseudotransparentplugin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\mywebsearch.pseudotransparentplugin.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\funwebproducts.popswatterbarbutton (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\funwebproducts.popswatterbarbutton.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\funwebproducts.htmlmenu.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\screensavercontrol.screensaverinstaller (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\screensavercontrol.screensaverinstaller.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\funwebproducts.browseroverlayembed (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\funwebproducts.browseroverlayembed.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{a6573479-9075-4a65-98a6-19fd29cf7374} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{a6573479-9075-4a65-98a6-19fd29cf7374} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\mywebsearch.outlookaddin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\mywebsearch.outlookaddin.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\funwebproducts.killerobjmanager (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\funwebproducts.killerobjmanager.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\funwebproducts.historykillerscheduler (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\funwebproducts.historykillerscheduler.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\funwebproducts.historyswattercontrolbar (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\funwebproducts.historyswattercontrolbar.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\funwebproducts.browseroverlaybarbutton (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\funwebproducts.browseroverlaybarbutton.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{d778513b-1c40-4819-b0c5-49e40b39afd0} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\mywebsearch.chatsessionplugin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\mywebsearch.chatsessionplugin.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{e79dfbca-5697-4fbd-94e5-5b2a9c7c1612} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{e79dfbca-5697-4fbd-94e5-5b2a9c7c1612} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{07b18eaa-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{07b18eac-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{f87d7fb5-9dc5-4c8c-b998-d8dfe02e2978} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{07b18ea0-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{e342af55-b78a-4cd0-a2bb-da7f52d9d25e} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{e342af55-b78a-4cd0-a2bb-da7f52d9d25f} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{0d26bc71-a633-4e71-ad31-eadc3a1b6a3a} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{1093995a-ba37-41d2-836e-091067c4ad17} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{120927bf-1700-43bc-810f-fab92549b390} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{17de5e5e-bfe3-4e83-8e1f-8755795359ec} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{1f52a5fa-a705-4415-b975-88503b291728} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{247a115f-06c2-4fb3-967d-2d62d3cf4f0a} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{2763e333-b168-41a0-a112-d35f96f410c0} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{2e3537fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{2e9937fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{29d67d3c-509a-4544-903f-c8c1b8236554} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{38a7c9da-8db7-4d0f-a7b1-c4b1a305bddb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{3e1656ed-f60e-4597-b6aa-b6a58e171495} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{3e53e2cb-86db-4a4a-8bd9-ffeb7a64df82} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{3e720451-b472-4954-b7aa-33069eb53906} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{3e720453-b472-4954-b7aa-33069eb53906} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{3e720450-b472-4954-b7aa-33069eb53906} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{621feacd-8857-43a6-ae26-451d670d5370} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{63d0ed2b-b45b-4458-8b3b-60c69bbbd83c} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{63d0ed2d-b45b-4458-8b3b-60c69bbbd83c} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{6e74766c-4d93-4cc0-96d1-47b8e07ff9ca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{741de825-a6f0-4497-9aa6-8023cf9b0fff} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{7473d291-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{7473d293-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{7473d295-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{7473d297-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{7473d290-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{90449521-d834-4703-bb4e-d3aa44042ff8} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{991aac62-b100-47ce-8b75-253965244f69} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{bbabdc90-f3d5-4801-863a-ee6ae529862d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{d6ff3684-ad3b-48eb-bbb4-b9e6c5a355c1} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{eb9e5c1c-b1f9-4c2b-be8a-27d6446fdaf8} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{8ca01f0e-987c-49c3-b852-2f1ac4a7094c} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{8d292ec0-6792-4a38-82ed-73a087e41ba6} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{8e6f1830-9607-4440-8530-13be7c4b1d14} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{98635087-3f5d-418f-990c-b1efe0797a3b} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{a626cdbd-3d13-4f78-b819-440a28d7e8fc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{c8cecde3-1ae1-4c4a-ad82-6d5b00212144} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{de38c398-b328-4f4c-a3ad-1b5e4ed93477} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{e47caee0-deea-464a-9326-3f2801535a4d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{e79dfbc9-5697-4fbd-94e5-5b2a9c7c1612} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{e79dfbcb-5697-4fbd-94e5-5b2a9c7c1612} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{e79dfbc0-5697-4fbd-94e5-5b2a9c7c1612} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{f42228fb-e84e-479e-b922-fbbd096e792c} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\fdkowvbp.bvar (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\fdkowvbp.toolbar.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\sais (Adware.180Solutions) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\MIME\Database\Content Type\application/x-f3embed (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyWebSearch bar Uninstall (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media\WMSDK\Sources\f3PopularScreensavers (Adware.MyWebSearch) -> Quarantined and deleted successfully.
Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowHelp (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)
and now time to attach the other file or combo log from previous scan...
Cheers thanks for all the help, comp is running much better than previous:)