[cocolleran]

Hi
Ran ComboFix again. It rebooted and I checked the C:\ComboFix folder. There are two *.txt files in it
(1) ComboFix.txt:
ComboFix 08-02.05.3 - Ciaran O'Callarain 2008-02-07 16:14:44.5 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1540 [GMT 0:00]
Running from: C:\Documents and Settings\Ciaran O'Callarain\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

(2)pend.txt:
\??\C:\ntdetect.com\0\0
\??\C:\boot.ini\0\0
\??\C:\ntldr\0\0
\??\C:\WINDOWS\0\0
\??\C:\WINDOWS\explorer.exe\0\0
\??\C:\WINDOWS\system32\csrss.exe\0\0
\??\C:\WINDOWS\system32\lsass.exe\0\0
\??\C:\WINDOWS\system32\services.exe\0\0
\??\C:\WINDOWS\system32\smss.exe\0\0
\??\C:\WINDOWS\system32\svchost.exe\0\0
\??\C:\WINDOWS\system32\userinit.exe\0\0
\??\C:\WINDOWS\system32\winlogon.exe\0\0
\??\C:\WINDOWS\system32\hal.dll\0\0
\??\C:\WINDOWS\system32\ntdll.dll\0\0
\??\C:\WINDOWS\system32\config\0\0
\??\C:\WINDOWS\system32\drivers\0\0
\??\C:\WINDOWS\system32\wbem\0\0


I can't see any other log files.

[Advertisements]

Do this

Please download Deckard's System Scanner (DSS) and save it to your Desktop.

• Close all other windows before proceeding.
• Double-click on dss.exe and follow the prompts.
• If your anti-virus or firewall complains, please allow this script to run as it is not malicious.
• When it has finished, dss will open two Notepads main.txt and extra.txt -- please copy (CTRL+A and then CTRL+C) and paste (CTRL+V) the contents of main.txt and extra.txt in your next reply.

[Rorschach112]

Do this

Please download Deckard's System Scanner (DSS) and save it to your Desktop.

• Close all other windows before proceeding.
• Double-click on dss.exe and follow the prompts.
• If your anti-virus or firewall complains, please allow this script to run as it is not malicious.
• When it has finished, dss will open two Notepads main.txt and extra.txt -- please copy (CTRL+A and then CTRL+C) and paste (CTRL+V) the contents of main.txt and extra.txt in your next reply.

[cocolleran]

Hi
Did that,
main.txt:

Deckard's System Scanner v20071014.68
Run by Ciaran O'Callarain on 2008-02-07 17:15:33
Computer is in Normal Mode.
--------------------------------------------------------------------------------



-- HijackThis (run as Ciaran O'Callarain.exe) ----------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:15, on 2008-02-07
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\FolderSize\FolderSizeSvc.exe
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\cryptainersrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Dell\MediaDirect\PCMService.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\TomTom HOME 2\HOMERunner.exe
C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\SetPoint\SetPoint.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclBCBTSrv.exe
C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\FlashGet\flashget.exe
C:\Documents and Settings\Ciaran O'Callarain\Desktop\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\CIARAN~1.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.ie/ig/dell?hl=en&client=dell-row&channel=ie&ibd=1070106
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.google.ie...amp;ibd=1070106
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch_1.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O2 - BHO: IEPlugin Class - {CF7C3CF0-4B15-11D1-ABED-709549C10000} - C:\Program Files\Advanced System Optimizer\IEHelper.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,Start
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\MediaDirect\PCMService.exe"
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\HOMERunner.exe" -s
O4 - HKLM\..\Run: [BluetoothAuthorizationAgent] C:\WINDOWS\system32\BluetoothAuthorizationAgent.exe
O4 - HKLM\..\Run: [XboxStat] "c:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe" silentrun
O4 - HKLM\..\Run: [combofix] C:\WINDOWS\system32\kmd.exe /c C:\ComboFix\Combobatch.bat
O4 - HKCU\..\Run: [ModemOnHold] C:\Program Files\NetWaiting\netWaiting.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: SetPoint.lnk = ?
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: PacificPoker - {94EDF7B4-4272-4af3-8F8B-4E2F68E225B7} - C:\PROGRA~1\PACIFI~1\pacificpoker.exe
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky...can_unicode.cab
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) - http://a516.g.akamai...cat-no-eula.cab
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.co.../sysreqlab2.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx...owserPlugin.cab
O16 - DPF: {6F750202-1362-4815-A476-88533DE61D0C} (Kodak Gallery Easy Upload Manager Class) - http://www.kodakgall..._2/axofupld.cab
O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemreq...m/sysreqlab.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.m...ash/swflash.cab
O16 - DPF: {FEE1002D-90A5-4A5D-AABE-01803FFBCF7A} - http://ps.itv.mop.co...0.10-signed.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: McAfee Application Installer Cleanup (0132561175087898) (0132561175087898mcinstcleanup) - Unknown owner - C:\DOCUME~1\CIARAN~1\LOCALS~1\Temp\013256~1.EXE (file missing)
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Folder Size (FolderSize) - Brio - C:\Program Files\FolderSize\FolderSizeSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Cryptainer service (ssoftservice) - Cypherix Software (India) Pvt. Ltd. - C:\WINDOWS\SYSTEM32\cryptainersrv.exe
O23 - Service: Intel® PROSet/Wireless SSO Service (WLANKEEPER) - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

--
End of file - 12110 bytes

-- Files created between 2008-01-07 and 2008-02-07 -----------------------------

2008-02-07 14:28:23 0 dr-h----- C:\Documents and Settings\Ciaran O'Callarain\Recent
2008-02-07 13:04:08 46080 --a------ C:\Program Files\tmp3883281.exe
2008-02-07 13:03:47 46080 --a------ C:\WINDOWS\system32\actcontroller.exe
2008-02-07 13:03:37 37632 --a------ C:\WINDOWS\system32\drivers\ntio922.sys
2008-02-07 13:03:36 7040 --a------ C:\WINDOWS\system32\drivers\ndisaluo.sys
2008-02-07 13:03:36 62976 --a------ C:\nethlpr.exe
2008-02-07 13:03:35 2 --a------ C:\-1674219165
2008-02-07 13:03:34 3584 --a------ C:\sofnfgm.exe
2008-02-07 13:03:32 60961 --a------ C:\tuvbo.exe
2008-02-07 13:03:31 37446 --a------ C:\msrv.exe
2008-02-07 13:03:29 54764 --a------ C:\WINDOWS\system32\4fdw.dll
2008-02-07 13:03:27 58368 --a------ C:\pcjjyjvi.exe
2008-02-07 13:03:19 69632 --a------ C:\WINDOWS\system32\csrssw.dll
2008-02-04 22:52:30 60416 --a------ C:\WINDOWS\system32\drivers\ComboFix.sys
2008-02-04 22:46:19 68096 --a------ C:\WINDOWS\system32\zip.exe
2008-02-04 22:46:19 98816 --a------ C:\WINDOWS\system32\sed.exe
2008-02-04 22:46:19 80412 --a------ C:\WINDOWS\system32\grep.exe
2008-02-04 22:46:19 73728 --a------ C:\WINDOWS\system32\fdsv.exe <Not Verified; Smallfrogs Studio; >
2008-02-04 22:46:16 53248 --a------ C:\WINDOWS\PSEXESVC.EXE <Not Verified; Sysinternals; Sysinternals PsExec>
2008-02-04 22:41:48 0 d-------- C:\f90d40cfe47b8d6bcb82
2008-02-04 21:50:06 0 d-------- C:\Program Files\Microsoft Silverlight
2008-02-03 23:14:59 0 d-------- C:\Program Files\DS-MP3 Source
2008-02-03 23:14:51 0 d-------- C:\WINDOWS\system32\languages
2008-02-03 23:14:50 60273 --a------ C:\WINDOWS\system32\pthreadGC2.dll <Not Verified; Open Source Software community project; >
2008-02-03 23:14:49 691717 --a------ C:\WINDOWS\system32\unins000.exe
2008-02-03 23:14:49 42500 --a------ C:\WINDOWS\system32\unins000.dat
2008-02-03 23:14:49 102912 --a------ C:\WINDOWS\system32\ff_tremor.dll
2008-02-03 23:14:49 397312 --a------ C:\WINDOWS\system32\ff_libfaad2.dll
2008-02-03 23:14:34 0 d-------- C:\Program Files\DirectVobSub
2008-02-01 21:22:03 0 d-------- C:\Documents and Settings\Ciaran O'Callarain\Application Data\Move Networks
2008-01-31 23:53:59 1158 --a------ C:\WINDOWS\mozver.dat
2008-01-31 23:50:32 0 --a------ C:\WINDOWS\nsreg.dat
2008-01-31 17:58:20 0 d-------- C:\Program Files\Atari
2008-01-30 20:47:50 0 d-------- C:\WINDOWS\ERUNT
2008-01-30 20:13:21 0 d-------- C:\Program Files\SpywareBlaster
2008-01-30 19:56:19 0 d-------- C:\Program Files\AntiVirusPro
2008-01-30 19:45:34 0 d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-01-30 19:45:13 0 d-------- C:\Program Files\SUPERAntiSpyware
2008-01-30 19:45:13 0 d-------- C:\Documents and Settings\Ciaran O'Callarain\Application Data\SUPERAntiSpyware.com
2008-01-30 19:44:56 4288 --a------ C:\WINDOWS\system32\tmp.reg
2008-01-30 19:43:52 25600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-01-30 19:43:52 289144 --a------ C:\WINDOWS\system32\VCCLSID.exe <Not Verified; S!Ri; >
2008-01-30 19:43:52 288417 --a------ C:\WINDOWS\system32\SrchSTS.exe <Not Verified; S!Ri; SrchSTS>
2008-01-30 19:43:52 53248 --a------ C:\WINDOWS\system32\Process.exe <Not Verified; http://www.beyondlogic.org; Command Line Process Utility>
2008-01-30 19:43:52 81920 --a------ C:\WINDOWS\system32\IEDFix.exe <Not Verified; S!Ri.URZ; IEDFix>
2008-01-30 19:43:52 51200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-01-30 17:08:44 0 d-------- C:\0f3f51c465732407af170bcd2fe57f6c
2008-01-30 17:05:29 0 d-------- C:\Program Files\Microsoft Xbox 360 Accessories
2008-01-30 11:53:16 0 d-------- C:\temp
2008-01-30 11:30:16 0 d-------- C:\Program Files\THQ
2008-01-29 16:18:11 0 d-------- C:\Documents and Settings\Ciaran O'Callarain\Application Data\skypePM
2008-01-29 16:18:11 32 --a------ C:\Documents and Settings\All Users\Application Data\ezsid.dat
2008-01-29 16:17:58 0 d-------- C:\Program Files\Common Files\Skype
2008-01-28 10:40:35 0 d-------- C:\Program Files\FolderSize
2008-01-27 01:44:32 0 d-------- C:\Program Files\Amazon
2008-01-24 13:02:18 0 d-------- C:\Documents and Settings\Ciaran O'Callarain\Application Data\TomTom
2008-01-24 13:02:18 0 d-------- C:\Documents and Settings\Ciaran O'Callarain\Application Data\Mozilla
2008-01-24 12:46:29 0 d-------- C:\Program Files\TomTom HOME 2
2008-01-18 11:14:48 0 d-------- C:\Program Files\Valvesoftware
2008-01-10 10:27:16 0 d-------- C:\Program Files\Activision Value
2008-01-10 10:18:32 0 d-------- C:\Documents and Settings\Ciaran O'Callarain\Application Data\Nokia Multimedia Player


-- Find3M Report ---------------------------------------------------------------

2008-02-07 17:14:56 0 d-------- C:\Program Files\FlashGet
2008-02-07 13:03:22 0 d-------- C:\Program Files\NetWaiting
2008-02-07 12:16:28 0 d-------- C:\Documents and Settings\Ciaran O'Callarain\Application Data\OpenOffice.org2
2008-02-06 12:34:10 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-01-31 23:54:10 0 d-------- C:\Documents and Settings\Ciaran O'Callarain\Application Data\Adobe
2008-01-31 21:46:21 38481 --a------ C:\WINDOWS\system32\nvModes.dat
2008-01-31 12:46:26 0 d-------- C:\Documents and Settings\Ciaran O'Callarain\Application Data\PC Suite
2008-01-30 23:41:03 0 d-------- C:\Documents and Settings\Ciaran O'Callarain\Application Data\Skype
2008-01-30 22:10:27 0 d-------- C:\Program Files\SlySoft
2008-01-30 19:54:35 0 d-------- C:\Program Files\SopCast
2008-01-30 19:54:33 0 d-------- C:\Program Files\SetPoint
2008-01-30 19:44:47 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-01-30 19:36:36 0 d-------- C:\Program Files\Winamp
2008-01-30 18:09:34 0 d-------- C:\Program Files\DivX
2008-01-30 17:23:47 0 d-------- C:\Documents and Settings\Ciaran O'Callarain\Application Data\UseNeXT
2008-01-30 11:38:50 0 d-------- C:\Program Files\SonicWALL
2008-01-30 11:37:31 0 d-------- C:\Documents and Settings\Ciaran O'Callarain\Application Data\SonicWALL
2008-01-30 11:36:42 0 d-------- C:\Program Files\Common Files\Deterministic Networks
2008-01-30 09:04:38 0 d-------- C:\Program Files\id Software
2008-01-29 16:18:00 0 d-------- C:\Program Files\Skype
2008-01-29 16:17:58 0 d-------- C:\Program Files\Common Files
2008-01-27 13:53:28 536 --a------ C:\Program Files\CloneDVD2.lnk
2008-01-24 14:01:55 0 d-------- C:\Program Files\TomTomActivation
2008-01-24 12:46:38 0 d-------- C:\Program Files\TomTom HOME
2008-01-11 10:45:15 0 d-------- C:\Program Files\Activision
2008-01-09 21:39:45 0 d-------- C:\Documents and Settings\Ciaran O'Callarain\Application Data\SopCast
2007-12-27 12:39:47 0 d-------- C:\Program Files\TomTom DesktopSuite
2007-12-25 17:41:07 0 d-------- C:\Program Files\Online Services
2007-12-25 13:04:05 0 d-------- C:\Program Files\SystemRequirementsLab
2007-12-25 12:41:06 0 d-------- C:\Program Files\Steam
2007-12-25 12:38:28 0 d-------- C:\Documents and Settings\Ciaran O'Callarain\Application Data\CopyTrans
2007-12-25 11:18:08 0 d-------- C:\Program Files\WindSolutions
2007-12-21 23:20:48 0 d-------- C:\Documents and Settings\Ciaran O'Callarain\Application Data\uTorrent
2007-12-21 20:43:29 0 d-------- C:\Program Files\Electronic Arts
2007-12-21 00:52:32 526 --a------ C:\Documents and Settings\Ciaran O'Callarain\Application Data\NMM-MetaData.db
2007-12-20 19:35:26 0 d-------- C:\Program Files\Trend Micro
2007-12-12 12:36:52 0 d-------- C:\Documents and Settings\Ciaran O'Callarain\Application Data\Nokia
2007-12-12 12:30:32 0 d-------- C:\Program Files\DIFX
2007-12-12 12:30:14 0 d-------- C:\Program Files\Common Files\PCSuite
2007-12-12 12:30:14 0 d-------- C:\Program Files\Common Files\Nokia
2007-12-12 12:30:13 0 d-------- C:\Program Files\Nokia
2007-12-12 12:29:47 0 d-------- C:\Program Files\PC Connectivity Solution
2007-12-12 09:10:14 0 d-------- C:\Program Files\Midway Home Entertainment
2007-12-08 16:54:16 0 d-------- C:\Program Files\Java
2007-12-06 18:29:48 3101696 -----n--- C:\WINDOWS\system32\libavcodec.dll
2007-12-03 16:39:34 122880 --a------ C:\WINDOWS\system32\libmpeg2_ff.dll
2007-12-03 16:39:20 56320 --a------ C:\WINDOWS\system32\ff_unrar.dll
2007-12-03 16:38:54 188416 --a------ C:\WINDOWS\system32\ff_theora.dll
2007-12-03 16:38:30 135168 --a------ C:\WINDOWS\system32\ff_samplerate.dll
2007-12-03 16:38:24 118784 --a------ C:\WINDOWS\system32\ff_realaac.dll
2007-12-03 16:38:14 143360 --a------ C:\WINDOWS\system32\ff_libmad.dll
2007-12-03 16:37:44 54784 --a------ C:\WINDOWS\system32\ff_liba52.dll
2007-12-03 16:37:38 167936 --a------ C:\WINDOWS\system32\ff_libdts.dll
2007-12-03 16:34:32 26624 --a------ C:\WINDOWS\system32\ff_wmv9.dll
2007-12-03 16:34:26 7680 --a------ C:\WINDOWS\system32\ff_vfw.dll
2007-12-01 13:43:30 520192 --a------ C:\WINDOWS\system32\ff_x264.dll
2007-11-30 13:15:28 54 ---h----- C:\WINDOWS\popcreg.dat
2007-11-30 13:15:28 16 --a------ C:\WINDOWS\popcinfot.dat
2007-11-29 13:17:32 662016 --a------ C:\WINDOWS\system32\xvidcore.dll
2007-11-29 13:14:04 404992 --a------ C:\WINDOWS\system32\libmplayer.dll
2007-11-29 12:52:34 204800 --a------ C:\WINDOWS\system32\TomsMoComp_ff.dll
2007-11-29 12:52:34 204800 --a------ C:\WINDOWS\system32\ff_kernelDeint.dll
2007-11-22 21:02:02 0 -rahs---- C:\MSDOS.SYS
2007-11-22 21:02:02 0 -rahs---- C:\IO.SYS
2007-11-18 18:31:49 669184 --a------ C:\WINDOWS\system32\pbsvc.exe


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-05-01 07:46]
"nwiz"="nwiz.exe" [2006-05-01 07:46 C:\WINDOWS\system32\nwiz.exe]
"NVHotkey"="nvHotkey.dll" [2006-05-01 07:46 C:\WINDOWS\system32\nvhotkey.dll]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]
"SigmatelSysTrayApp"="stsystra.exe" [2006-03-24 23:30 C:\WINDOWS\stsystra.exe]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-08 18:48]
"IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [2006-05-01 09:28]
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2006-05-01 09:28]
"DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2005-09-08 05:20]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 16:50]
"PCMService"="C:\Program Files\Dell\MediaDirect\PCMService.exe" [2006-08-22 15:32]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2005-12-20 17:38 C:\WINDOWS\KHALMNPR.Exe]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" []
"Dell QuickSet"="C:\Program Files\Dell\QuickSet\quickset.exe" [2006-09-08 15:43]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 16:50]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-16 09:54]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-01-21 21:34]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 18:51]
"TomTomHOME.exe"="C:\Program Files\TomTom HOME 2\HOMERunner.exe" [2007-10-31 10:19]
"BluetoothAuthorizationAgent"="C:\WINDOWS\system32\BluetoothAuthorizationAgent.exe" []
"XboxStat"="c:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe" [2007-09-26 18:05]
"combofix"="C:\WINDOWS\system32\kmd.exe" [2004-08-04 05:00]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ModemOnHold"="C:\Program Files\NetWaiting\netWaiting.exe" []
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 05:00]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 16:24]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-08-16 11:24]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-02-27 11:39]
"PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" [2007-12-10 10:12]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-05-24 18:28:28]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2000-01-21 08:15:54]
SetPoint.lnk - C:\Program Files\SetPoint\SetPoint.exe [2007-01-06 09:02:49]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 12:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-02-27 11:39 282624 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 nwprovau

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PSEXESVC]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CleanUp]
c:\program files\mcafee.com\shared\mcappins.exe /v=3 /cleanup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDTray]
"C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Creative Detector]
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTSyncU.exe]
"C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eBayToolbar]
C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirtualCloneDrive]
"C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s




-- End of Deckard's System Scanner: finished at 2008-02-07 17:16:41 ------------

extra.txt:
Deckard's System Scanner v20071014.68
Extra logfile - please post this as an attachment with your post.
--------------------------------------------------------------------------------

-- System Information ----------------------------------------------------------

Microsoft Windows XP Professional (build 2600) SP 2.0
Architecture: X86; Language: English

CPU 0: Intel® Core™2 CPU T7600 @ 2.33GHz
CPU 1: Intel® Core™2 CPU T7600 @ 2.33GHz
Percentage of Memory in Use: 27%
Physical Memory (total/avail): 2046.39 MiB / 1479.94 MiB
Pagefile Memory (total/avail): 3938.61 MiB / 3505.3 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1926.52 MiB

C: is Fixed (NTFS) - 143.95 GiB total, 65.76 GiB free.
D: is CDROM (No Media)
E: is CDROM (No Media)
F: is CDROM (No Media)

\\.\PHYSICALDRIVE0 - Hitachi HTS541616J9SA00 - 149.05 GiB - 4 partitions
\PARTITION0 - Unknown - 86.26 MiB
\PARTITION1 (bootable) - Installable File System - 143.95 GiB - C:
\PARTITION2 - Extended w/Extended Int 13 - 2047.35 MiB
\PARTITION3 - Unknown - 3 GiB



-- Security Center -------------------------------------------------------------

AUOptions is set to notify before install.
Windows Internal Firewall is disabled.

FirstRunDisabled is set.


[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


-- Environment Variables -------------------------------------------------------

ALLUSERSPROFILE=C:\Documents and Settings\All Users
APPDATA=C:\Documents and Settings\Ciaran O'Callarain\Application Data
CLASSPATH=.;C:\Program Files\Java\jre1.5.0_10\lib\ext\QTJava.zip
CLIENTNAME=Console
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=CIARAN-LAPTOP
ComSpec=C:\WINDOWS\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Documents and Settings\Ciaran O'Callarain
LOGONSERVER=\\CIARAN-LAPTOP
NUMBER_OF_PROCESSORS=2
OS=Windows_NT
Path=C:\Program Files\PC Connectivity Solution\;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Program Files\Common Files\Roxio Shared\DLLShared\;C:\Program Files\QuickTime\QTSystem\
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 6 Model 15 Stepping 6, GenuineIntel
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=0f06
ProgramFiles=C:\Program Files
PROMPT=$P$G
QTJAVA=C:\Program Files\Java\jre1.5.0_10\lib\ext\QTJava.zip
SESSIONNAME=Console
SonicCentral=C:\Program Files\Common Files\Sonic Shared\Sonic Central\
SystemDrive=C:
SystemRoot=C:\WINDOWS
TEMP=C:\DOCUME~1\CIARAN~1\LOCALS~1\Temp
TMP=C:\DOCUME~1\CIARAN~1\LOCALS~1\Temp
USERDOMAIN=CIARAN-LAPTOP
USERNAME=Ciaran O'Callarain
USERPROFILE=C:\Documents and Settings\Ciaran O'Callarain
windir=C:\WINDOWS


-- User Profiles ---------------------------------------------------------------

Ciaran O'Callarain (admin)
Administrator (admin)


-- Add/Remove Programs ---------------------------------------------------------

--> "C:\Program Files\Creative Installation Information\CREATIVE_MEDIASOURCE_U\Setup.exe" /remove /l0x0009
--> "C:\Program Files\Creative Installation Information\E-CENTER_NET_CONTENT_U\Setup.exe" /remove /l0x0009
--> "C:\Program Files\Creative Installation Information\E-CENTER_PLUGIN_CDBURNER_U\Setup.exe" /remove /l0x0009
--> "C:\Program Files\Creative Installation Information\E-CENTER_PLUGIN_MTP_U\Setup.exe" /remove /l0x0009
--> "C:\Program Files\Creative Installation Information\E-CENTER_PLUGIN_NOMADJUKEBOXTYPE2_U\Setup.exe" /remove /l0x0009
--> "C:\Program Files\Creative Installation Information\MEDIASOURCE_PLAYER_SKINPACK_U\Setup.exe" /remove /l0x0009
--> C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
--> C:\Program Files\DivX\ConverterUninstall.exe /CONVERTER
--> C:\WINDOWS\IsUninst.exe -fC:\WINDOWS\orun32.isu
--> C:\WINDOWS\system32\\MSIEXEC.EXE /x {075473F5-846A-448B-BCB3-104AA1760205}
--> C:\WINDOWS\system32\\MSIEXEC.EXE /x {1206EF92-2E83-4859-ACCB-2048C3CB7DA6}
--> C:\WINDOWS\system32\\MSIEXEC.EXE /x {AB708C9B-97C8-4AC9-899B-DBF226AC9382}
--> C:\WINDOWS\system32\\MSIEXEC.EXE /x {B12665F4-4E93-4AB4-B7FC-37053B524629}
--> MsiExec /X{45235788-142C-44BE-8A4D-DDE9A84492E5}
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{0B095086-7205-4D48-90DF-DCD16613C6D4}\setup.exe" -l0x9
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{0B095086-7205-4D48-90DF-DCD16613C6D4}\setup.exe" -l0x9 /remove
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{103BCDA0-E063-46AC-8028-64E78722ABA7}\setup.exe" -l0x9
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{103BCDA0-E063-46AC-8028-64E78722ABA7}\setup.exe" -l0x9 /remove
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2616B36E-38CE-4357-8AB5-8B3EE9B1C117}\setup.exe" -l0x9
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2616B36E-38CE-4357-8AB5-8B3EE9B1C117}\setup.exe" -l0x9 /remove
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{3414C9E5-FCFE-11D8-8469-00D0B726B56E}\setup.exe" -l0x9
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{3414C9E5-FCFE-11D8-8469-00D0B726B56E}\setup.exe" -l0x9 /remove
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{57FA4E0F-82C9-417D-87BC-0186D6CB7A44}\setup.exe" -l0x9
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{63A317D0-60A6-43FC-848A-9FE4A53B29CE}\setup.exe" -l0x9
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{700932B3-A964-4878-82A2-96054622A1F7}\setup.exe" -l0x9
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{700932B3-A964-4878-82A2-96054622A1F7}\setup.exe" -l0x9 /remove
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{836612F0-1571-4C65-A4B7-58A39AA578EE}\setup.exe" -l0x9
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{836612F0-1571-4C65-A4B7-58A39AA578EE}\setup.exe" -l0x9 /remove
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{8DF9BF77-7E10-4973-965E-3B7013ABEA6D}\setup.exe" -l0x9
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{8DF9BF77-7E10-4973-965E-3B7013ABEA6D}\setup.exe" -l0x9 /remove
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9744AE38-1CC6-414F-96CE-0643AEE30A9B}\setup.exe" -l0x9
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9744AE38-1CC6-414F-96CE-0643AEE30A9B}\setup.exe" -l0x9 /remove
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{98181885-5B28-4280-9B56-452FF877D5B9}\setup.exe" -l0x9
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{98181885-5B28-4280-9B56-452FF877D5B9}\setup.exe" -l0x9 /remove
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9A0B5225-B59B-4D72-B3FE-71AAA693A8E2}\setup.exe" -l0x9
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9A0B5225-B59B-4D72-B3FE-71AAA693A8E2}\setup.exe" -l0x9 /remove
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9AB14DF5-3B04-4E3B-9969-695DBA7F2008}\setup.exe" -l0x9
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9AB14DF5-3B04-4E3B-9969-695DBA7F2008}\setup.exe" -l0x9 /remove
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9E54F486-CD4A-44A5-B041-16D4E1E56A53}\setup.exe" -l0x9
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A82F10CB-18B5-4EAC-AEF2-FA49CD565626}\setup.exe" -l0x9
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A9BB081B-C020-4D02-A763-D32204D2563D}\setup.exe" -l0x9
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A9BB081B-C020-4D02-A763-D32204D2563D}\setup.exe" -l0x9 /remove
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{CB99E420-8071-48F9-9567-4A53BE7569C4}\setup.exe" -l0x9
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{CB99E420-8071-48F9-9567-4A53BE7569C4}\setup.exe" -l0x9 /remove
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D42EFA6C-0553-45F7-AD03-6D36207CA6D4}\setup.exe" -l0x9
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D42EFA6C-0553-45F7-AD03-6D36207CA6D4}\setup.exe" -l0x9 /remove
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D524239C-FD5C-4183-A49C-7930915A9C0A}\setup.exe" -l0x9
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D524239C-FD5C-4183-A49C-7930915A9C0A}\setup.exe" -l0x9 /remove
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{DD2D9012-E5A1-4717-8EE9-8DB3F36E2F8C}\setup.exe" -l0x9
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{DD2D9012-E5A1-4717-8EE9-8DB3F36E2F8C}\setup.exe" -l0x9 /remove
--> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
[Activation] v0.3 Beta 3 --> "C:\Program Files\TomTomActivation\Uninstall.exe"
ABBYY FineReader 6.0 Sprint --> MsiExec.exe /I{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}
Adobe Acrobat 5.0 --> C:\WINDOWS\ISUNINST.EXE -f"C:\Program Files\Common Files\Adobe\Acrobat 5.0\NT\Uninst.isu" -c"C:\Program Files\Common Files\Adobe\Acrobat 5.0\NT\Uninst.dll"
Adobe Flash Player ActiveX --> C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe PageMaker 6.5 --> C:\WINDOWS\uninst.exe -fC:\PM65\DeIsL1.isu
Adobe Photoshop 4.0 LE --> C:\WINDOWS\uninst.exe -f"c:\program files\adobe\DeIsL1.isu"
Adobe Reader 8.1.1 --> MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81000000003}
Advanced System Optimizer 2.01 --> "C:\Program Files\Advanced System Optimizer\unins000.exe"
Advanced Zip Repair v1.8 --> C:\PROGRA~1\AZR\UNWISE.EXE C:\PROGRA~1\AZR\INSTALL.LOG
AGEIA PhysX v7.09.13 --> MsiExec.exe /X{45235788-142C-44BE-8A4D-DDE9A84492E5}
Anonymizer --> MsiExec.exe /X{59366175-55F2-411B-9911-3D71D46CD073}
Anonymizer Anonymous Surfing --> MsiExec.exe /X{2989FF05-0673-4C00-9268-97AA364269E1}
Archos MPG4 Translator V3.0.11 --> C:\Program Files\Archos MP4SP\Uninstal.exe
AudibleManager --> C:\Program Files\Audible\Bin\Upgrade.exe /Uninstall
Belarc Advisor 7.0 --> C:\PROGRA~1\Belarc\Advisor\Uninstall.exe C:\PROGRA~1\Belarc\Advisor\INSTALL.LOG
BenchemAll (remove only) --> "C:\Program Files\BenchemAll\uninstall.exe"
Broadcom Advanced Control Suite --> MsiExec.exe /X{26E1BFB0-E87E-4696-9F89-B467F01F81E5}
Call of Duty® 4 - Modern Warfare™ --> C:\Program Files\InstallShield Installation Information\{E48469CC-635E-4FD5-A122-1497C286D217}\setup.exe -runfromtemp -l0x0409
CCleaner (remove only) --> "C:\Program Files\CCleaner\uninst.exe"
CloneCD --> "C:\Program Files\SlySoft\CloneCD\ccd-uninst.exe" /D="C:\Program Files\SlySoft\CloneCD"
CloneDVD2 --> "C:\Program Files\Elaborate Bytes\CloneDVD2\CloneDVD2-uninst.exe" /D="C:\Program Files\Elaborate Bytes\CloneDVD2"
Cole2k Media - Codec Pack (Advanced) --> C:\WINDOWS\system32\C2MP\Uninst.exe
Conexant HDA D110 MDC V.92 Modem --> C:\Program Files\CONEXANT\CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2BFA&SUBSYS_14F100C3\HXFSETUP.EXE -U -Idel1028p.inf
CopyTrans Suite (remove only) --> "C:\Program Files\WindSolutions\CopyTrans Suite\uninstall.exe"
Creative Jukebox Driver --> C:\Program Files\Creative\Jukebox 3 Drivers\DrvUnins.exe /s
Creative MediaSource --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2E0C1913-886B-4C5C-8DAF-D1E649CE5FCC}\setup.exe" -l0x9 /remove
Creative MediaSource 5 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{BEEFC4F8-2909-48B3-AFAA-55D3533FDEDD}\SETUP.EXE" -l0x9 /remove
Creative Removable Disk Manager --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{57FA4E0F-82C9-417D-87BC-0186D6CB7A44}\setup.exe" -l0x9 /remove
Creative System Information --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{63A317D0-60A6-43FC-848A-9FE4A53B29CE}\setup.exe" -l0x9 /remove
Creative Zen Micro (PlaysForSure) --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{964032DD-EC00-4442-98A0-57665B746068}\SETUP.EXE" -l0x9 /remove
Creative ZEN Vision M Series --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{31C44235-A613-4E95-B297-207BF6C6A8C1}\SETUP.EXE" -l0x9 /remove
Cryptainer LE --> "C:\Program Files\CCleaner\Cryptainer LE\unins000.exe"
Cucusoft MPEG/MOV/RM/DivX/AVI to DVD/VCD/SVCD Creator Pro 7.07 --> "C:\Program Files\Cucusoft\avi-dvd-pro\unins000.exe"
Dell Network Assistant --> MsiExec.exe /I{0240BDFB-2995-4A3F-8C96-18D41282B716}
Dell Support 3.2.1 --> MsiExec.exe /X{CEE2252C-4035-4B27-8EC6-0B085DD3A413}
Digital Line Detect --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{E646DCF0-5A68-11D5-B229-002078017FBF}\setup.exe" -l0x9 ControlPanel
DirectVobSub (remove only) --> "C:\Program Files\DirectVobSub\uninstall.exe"
DivX --> C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC
DivX Content Uploader --> C:\Program Files\DivX\DivXContentUploaderUninstall.exe /CUPLOADER
DivX Converter --> C:\Program Files\DivX\ConverterUninstall.exe /CONVERTER
DivX Player --> C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER
DivX Web Player --> C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
DS-MP3 Source 1.30 --> "C:\Program Files\DS-MP3 Source\Uninstall.exe"
DVD to VCD AVI DivX Converter v3.2 (build 069) --> C:\PROGRA~1\MAGICD~1\UNWISE.EXE C:\PROGRA~1\MAGICD~1\INSTALL.LOG
DVDFab Decrypter 3.0.5.5 --> "C:\Program Files\DVDFab Decrypter 3\unins000.exe"
Easy Uninstaller --> "C:\Program Files\Easy Uninstaller\Uninstall.exe"
eBay Toolbar --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{3DB5FD00-BB93-4AF3-B925-77DAA0E4E2F4}\setup.exe" -l0x9 /z"Uninstall eBay Toolbar"
EPSON Attach To Email --> C:\Program Files\Common Files\InstallShield\Driver\8\Intel 32\IDriver.exe /M{20C45B32-5AB6-46A4-94EF-58950CAF05E5} /l1033 ADDREMOVEDLG
EPSON Copy Utility 3 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{67EDD823-135A-4D59-87BD-950616D6E857}\SETUP.EXE" -l0x9 -UnInstall
EPSON Easy Photo Print --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{BC69DDB8-4840-4D9B-BB31-0D4DB2BA1312}\SETUP.EXE" -l0x9 UNINST
EPSON File Manager --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{E86BC406-944E-41F6-ADE6-2C136734C96B}\Setup.exe" -l0x9 UNINST
EPSON Printer Software --> C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EPUPDATE.EXE /R
EPSON Scan --> C:\Program Files\epson\escndv\setup\setup.exe /r
EPSON Scan Assistant --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2A88F1BF-7041-4E42-84B1-6B4ACB83AC64}\Setup.exe" -l0x9 -u
EPSON Web-To-Page --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{7F14F68C-17FA-4F88-B3FD-7F449C1EBF32}\SETUP.EXE" -l0x9 -anything
ESDX4000_4050_CX3900 --> C:\Program Files\EPSON\TPMANUAL\ESDX4000_4050_CX3900\USE_G\DOCUNINS.EXE
ffdshow [rev 1685] [2007-12-06] --> "C:\WINDOWS\system32\unins000.exe"
FlashGet 1.9.6.1073 --> C:\Program Files\FlashGet\uninst.exe
FM Modifier 2.22 --> MsiExec.exe /I{AE86AE81-CD7F-496F-A39F-0210C985E71B}
Folder Size for Windows --> MsiExec.exe /I{FC8D21C8-7B29-4104-ADB0-FEE9CA1C7922}
Football Manager 2008 --> "C:\Program Files\Sports Interactive\Football Manager 2008\Uninstall_Football Manager 2008\Uninstall Football Manager 2008.exe"
FreeMind --> "C:\Program Files\FreeMind\unins000.exe"
GOM Player --> "C:\Program Files\GRETECH\GomPlayer\Uninstall.exe"
Google Earth --> MsiExec.exe /I{1E04F83B-2AB9-4301-9EF7-E86307F79C72}
High Definition Audio Driver Package - KB835221 --> C:\WINDOWS\$NtUninstallKB835221WXP$\spuninst\spuninst.exe
HijackThis 2.0.2 --> "C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Hotfix for Windows Media Format 11 SDK (KB929399) --> "C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
Icon Constructor 3 --> "C:\Program Files\Icon Constructor 3\unins000.exe"
Intel® PROSet/Wireless Software --> C:\WINDOWS\Installer\iProInst.exe
IsoBuster 2.1 --> "C:\Program Files\Smart Projects\IsoBuster\Uninst\unins000.exe"
iTunes --> MsiExec.exe /I{AB90749C-7422-4580-8A7A-66CC5E9E5F98}
IZArc 3.5 beta 3 --> "C:\Program Files\IZArc\unins000.exe"
J2SE Runtime Environment 5.0 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150000}
J2SE Runtime Environment 5.0 Update 10 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150100}
J2SE Runtime Environment 5.0 Update 6 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150060}
Java™ 6 Update 2 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160020}
Java™ 6 Update 3 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160030}
Java™ SE Runtime Environment 6 Update 1 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160010}
Kaspersk

[Rorschach112]

Hello

* I notice that you have no firewall on your PC, this is extremely dangerous and leaves your PC open to vulnerabilities, so please download and install one of the following programs : ZoneAlarm, Comodo, or
Outpost
Make sure you only use one firewall though. A tutorial on understanding and using firewalls may be found here.

* I notice that you have no anti-virus program on your PC, this is extremely dangerous and leaves your PC open to vulnerabilities, so please download and install one of the following programs :
AVG makes an excellent free antivirus client, as do AntiVir or avast!.



1. Close any open browsers.

2. Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\Program Files\tmp3883281.exe
C:\WINDOWS\system32\actcontroller.exe
C:\WINDOWS\system32\drivers\ntio922.sys
C:\WINDOWS\system32\drivers\ndisaluo.sys
C:\nethlpr.exe
C:\sofnfgm.exe
C:\tuvbo.exe
C:\msrv.exe
C:\WINDOWS\system32\4fdw.dll
C:\pcjjyjvi.exe
C:\WINDOWS\system32\csrssw.dll

Folder::
C:\-1674219165

Save this as CFScript.txt, in the same location as ComboFix.exe




Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at "C:\ComboFix.txt"

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall



1. Please re-open HiJackThis and choose do a system scan only. Check the boxes next to ONLY the entries listed below(if present):

O4 - HKLM\..\Run: [combofix] C:\WINDOWS\system32\kmd.exe /c C:\ComboFix\Combobatch.bat

2. Now close all windows other than HiJackThis, including browsers, so that nothing other than HijackThis is open, then click Fix Checked. A box will pop up asking you if you wish to fix the selected items. Please choose YES. Once it has fixed them, please exit/close HijackThis.

[cocolleran]

Hi
I reinstalled ComboFix and this time it gave me a decent log after doing what you said:
ComboFix 08-02.05.3 - Ciaran O'Callarain 2008-02-07 18:06:09.6 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1448 [GMT 0:00]
Running from: C:\Documents and Settings\Ciaran O'Callarain\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Ciaran O'Callarain\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE
C:\msrv.exe
C:\nethlpr.exe
C:\pcjjyjvi.exe
C:\Program Files\tmp3883281.exe
C:\sofnfgm.exe
C:\tuvbo.exe
C:\WINDOWS\system32\4fdw.dll
C:\WINDOWS\system32\actcontroller.exe
C:\WINDOWS\system32\csrssw.dll
C:\WINDOWS\system32\drivers\ndisaluo.sys
C:\WINDOWS\system32\drivers\ntio922.sys
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\-1674219165\
C:\msrv.exe
C:\nethlpr.exe
C:\pcjjyjvi.exe
C:\Program Files\tmp3883281.exe
C:\sofnfgm.exe
C:\tuvbo.exe
C:\WINDOWS\system32\4fdw.dll
C:\WINDOWS\system32\actcontroller.exe
C:\WINDOWS\system32\csrssw.dll
C:\WINDOWS\system32\drivers\ndisaluo.sys
C:\WINDOWS\system32\drivers\ntio922.sys
.
---- Previous Run -------
.
C:\Documents and Settings\Ciaran O'Callarain\Application Data\microsoft\internet explorer\Desktop.htt
C:\WINDOWS\inf\ultra.inf
C:\WINDOWS\ORUN32.EXE
C:\WINDOWS\system32\1335687541.dll
C:\WINDOWS\system32\6_exception.nls
C:\WINDOWS\system32\CMMGR32.EXE
C:\WINDOWS\system32\cryptne.dll
C:\WINDOWS\system32\drivers\sfggaolt.dat
C:\WINDOWS\system32\kr_done1
C:\WINDOWS\system32\ntload.sys
C:\WINDOWS\system32\vx.tll
C:\WINDOWS\system32\ybadd.ini2

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_CDDKFXIS
-------\cddkfxis


-------\cddkfxis


-------\LEGACY_NTLOAD








((((((((((((((((((((((((( Files Created from 2008-01-07 to 2008-02-07 )))))))))))))))))))))))))))))))
.

2008-02-07 13:02 . 2008-02-07 13:02 31,606 --a------ C:\WINDOWS\system32\dllgh8jkd1q2.exe~
2008-02-07 13:02 . 2008-02-07 13:02 13,682 --a------ C:\WINDOWS\system32\dllgh8jkd1q5.exe~
2008-02-07 13:02 . 2008-02-07 13:02 12,746 --a------ C:\WINDOWS\system32\dllgh8jkd1q1.exe~
2008-02-07 12:01 . 2008-02-07 12:01 269,334 --a------ C:\WINDOWS\system32\snipgjmlkfapsn.bmp
2008-02-06 15:45 . 2008-02-06 15:45 <DIR> d-------- C:\Deckard
2008-02-05 18:21 . 2008-02-05 18:21 0 --a------ C:\WINDOWS\system32\sex4.ico.tmp
2008-02-05 18:20 . 2008-02-05 18:20 0 --a------ C:\WINDOWS\system32\sex3.ico.tmp
2008-02-05 18:20 . 2008-02-05 18:20 0 --a------ C:\WINDOWS\system32\sex2.ico.tmp
2008-02-04 22:46 . 2004-08-04 05:00 388,608 --a------ C:\kmd.exe
2008-02-04 22:41 . 2008-02-04 22:41 <DIR> d-------- C:\f90d40cfe47b8d6bcb82
2008-02-04 21:50 . 2008-02-04 21:50 <DIR> d-------- C:\Program Files\Microsoft Silverlight
2008-02-03 23:14 . 2008-02-03 23:14 <DIR> d-------- C:\WINDOWS\system32\languages
2008-02-03 23:14 . 2008-02-03 23:14 <DIR> d-------- C:\Program Files\DS-MP3 Source
2008-02-03 23:14 . 2008-02-03 23:14 <DIR> d-------- C:\Program Files\DirectVobSub
2008-02-03 23:14 . 2008-02-03 23:14 691,717 --a------ C:\WINDOWS\system32\unins000.exe
2008-02-03 23:14 . 2007-12-03 16:38 397,312 --a------ C:\WINDOWS\system32\ff_libfaad2.dll
2008-02-03 23:14 . 2007-12-03 16:39 102,912 --a------ C:\WINDOWS\system32\ff_tremor.dll
2008-02-03 23:14 . 2007-11-29 12:52 60,273 --a------ C:\WINDOWS\system32\pthreadGC2.dll
2008-02-03 23:14 . 2008-02-03 23:14 42,500 --a------ C:\WINDOWS\system32\unins000.dat
2008-02-03 23:14 . 2007-11-29 12:52 1,708 --a------ C:\WINDOWS\system32\openIE.js
2008-02-01 21:22 . 2008-02-01 21:22 <DIR> d-------- C:\Documents and Settings\Ciaran O'Callarain\Application Data\Move Networks
2008-01-31 23:53 . 2008-01-31 23:53 1,158 --a------ C:\WINDOWS\mozver.dat
2008-01-31 23:50 . 2008-01-31 23:50 0 --a------ C:\WINDOWS\nsreg.dat
2008-01-31 21:27 . 2008-02-07 16:37 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-01-31 21:27 . 2008-01-31 21:27 1,409 --a------ C:\WINDOWS\QTFont.for
2008-01-31 17:58 . 2008-01-31 17:58 <DIR> d-------- C:\Program Files\Atari
2008-01-31 12:15 . 2008-01-31 12:15 4,128 --a------ C:\INFCACHE.1
2008-01-30 20:47 . 2008-01-30 20:48 <DIR> d-------- C:\WINDOWS\ERUNT
2008-01-30 20:31 . 2008-01-30 21:50 <DIR> d-------- C:\SDFix
2008-01-30 20:13 . 2008-01-30 20:13 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-01-30 19:56 . 2008-01-30 20:08 <DIR> d-------- C:\Program Files\AntiVirusPro
2008-01-30 19:55 . 2008-01-30 19:55 29,436 --a------ C:\WINDOWS\system32\BluetoothAuthorizationAgent.exe~
2008-01-30 19:45 . 2008-02-07 14:38 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2008-01-30 19:45 . 2008-01-30 19:45 <DIR> d-------- C:\Documents and Settings\Ciaran O'Callarain\Application Data\SUPERAntiSpyware.com
2008-01-30 19:45 . 2008-01-30 19:45 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-01-30 19:44 . 2008-02-07 15:08 4,288 --a------ C:\WINDOWS\system32\tmp.reg
2008-01-30 19:43 . 2007-09-05 23:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-01-30 19:43 . 2006-04-27 16:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-01-30 19:43 . 2008-01-27 14:37 81,920 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-01-30 19:43 . 2003-06-05 20:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-01-30 19:43 . 2004-07-31 17:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-01-30 19:43 . 2007-10-03 23:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-01-30 17:10 . 2008-01-30 17:10 0 --ah----- C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01001_Coinstaller_Critical.Wdf
2008-01-30 17:10 . 2008-01-30 17:10 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_xusb21_01001.Wdf
2008-01-30 17:05 . 2008-02-07 14:35 <DIR> d-------- C:\Program Files\Microsoft Xbox 360 Accessories
2008-01-30 17:05 . 2007-02-27 01:15 1,421,216 --a------ C:\WINDOWS\system32\WdfCoInstaller01001.dll
2008-01-30 17:05 . 2007-02-27 01:15 61,984 --a------ C:\WINDOWS\system32\drivers\xusb21.sys
2008-01-30 11:53 . 2008-02-04 21:50 <DIR> d-------- C:\temp
2008-01-30 11:30 . 2008-01-30 11:30 <DIR> d-------- C:\Program Files\THQ
2008-01-30 09:17 . 2008-01-30 19:36 <DIR> d-------- C:\Program Files\Unlocker
2008-01-29 16:18 . 2008-01-30 22:23 <DIR> d-------- C:\Documents and Settings\Ciaran O'Callarain\Application Data\skypePM
2008-01-29 16:18 . 2008-01-29 16:18 32 --a------ C:\Documents and Settings\All Users\Application Data\ezsid.dat
2008-01-29 16:17 . 2008-01-29 16:17 <DIR> d-------- C:\Program Files\Common Files\Skype
2008-01-28 10:40 . 2008-01-28 10:40 <DIR> d-------- C:\Program Files\FolderSize
2008-01-27 01:44 . 2008-01-28 09:47 <DIR> d-------- C:\Program Files\Amazon
2008-01-24 13:02 . 2008-01-24 13:02 <DIR> d-------- C:\Documents and Settings\Ciaran O'Callarain\Application Data\TomTom
2008-01-24 12:46 . 2008-01-24 12:46 <DIR> d-------- C:\Program Files\TomTom HOME 2
2008-01-18 11:14 . 2008-01-18 11:14 <DIR> d-------- C:\Program Files\Valvesoftware
2008-01-11 11:19 . 2008-01-29 13:24 316 --a------ C:\WINDOWS\game.ini
2008-01-10 10:27 . 2008-01-10 10:27 <DIR> d-------- C:\Program Files\Activision Value
2008-01-10 10:18 . 2008-01-10 10:18 <DIR> d-------- C:\Documents and Settings\Ciaran O'Callarain\Application Data\Nokia Multimedia Player

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-07 18:05 --------- d-----w C:\Program Files\FlashGet
2008-02-07 18:05 --------- d-----w C:\Documents and Settings\Ciaran O'Callarain\Application Data\OpenOffice.org2
2008-02-07 17:39 --------- d-----w C:\Documents and Settings\All Users\Application Data\WholeSecurity
2008-02-07 13:03 --------- d-----w C:\Program Files\NetWaiting
2008-02-06 12:34 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-31 12:46 --------- d-----w C:\Documents and Settings\Ciaran O'Callarain\Application Data\PC Suite
2008-01-31 12:17 --------- d-----w C:\Documents and Settings\All Users\Application Data\Installations
2008-01-30 23:41 --------- d-----w C:\Documents and Settings\Ciaran O'Callarain\Application Data\Skype
2008-01-30 22:10 --------- d-----w C:\Program Files\SlySoft
2008-01-30 19:54 --------- d-----w C:\Program Files\SopCast
2008-01-30 19:54 --------- d-----w C:\Program Files\SetPoint
2008-01-30 19:44 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-01-30 19:36 --------- d-----w C:\Program Files\Winamp
2008-01-30 18:09 --------- d-----w C:\Program Files\DivX
2008-01-30 17:23 --------- d-----w C:\Documents and Settings\Ciaran O'Callarain\Application Data\UseNeXT
2008-01-30 11:38 --------- d-----w C:\Program Files\SonicWALL
2008-01-30 11:37 --------- d-----w C:\Documents and Settings\Ciaran O'Callarain\Application Data\SonicWALL
2008-01-30 11:36 --------- d-----w C:\Program Files\Common Files\Deterministic Networks
2008-01-30 09:04 --------- d-----w C:\Program Files\id Software
2008-01-29 16:18 --------- d-----w C:\Program Files\Skype
2008-01-29 16:18 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skype
2008-01-27 13:53 536 ----a-w C:\Program Files\CloneDVD2.lnk
2008-01-24 14:01 --------- d-----w C:\Program Files\TomTomActivation
2008-01-24 12:46 --------- d-----w C:\Program Files\TomTom HOME
2008-01-11 10:45 --------- d-----w C:\Program Files\Activision
2008-01-09 21:39 --------- d-----w C:\Documents and Settings\Ciaran O'Callarain\Application Data\SopCast
2007-12-27 12:39 --------- d-----w C:\Program Files\TomTom DesktopSuite
2007-12-25 13:04 --------- d-----w C:\Program Files\SystemRequirementsLab
2007-12-25 12:41 --------- d-----w C:\Program Files\Steam
2007-12-25 12:38 --------- d-----w C:\Documents and Settings\Ciaran O'Callarain\Application Data\CopyTrans
2007-12-25 11:18 --------- d-----w C:\Program Files\WindSolutions
2007-12-21 23:20 --------- d-----w C:\Documents and Settings\Ciaran O'Callarain\Application Data\uTorrent
2007-12-21 20:43 --------- d-----w C:\Program Files\Electronic Arts
2007-12-20 19:35 --------- d-----w C:\Program Files\Trend Micro
2007-12-20 19:05 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-12-12 12:36 --------- d-----w C:\Documents and Settings\Ciaran O'Callarain\Application Data\Nokia
2007-12-12 12:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\PC Suite
2007-12-12 12:30 --------- d-----w C:\Program Files\Nokia
2007-12-12 12:30 --------- d-----w C:\Program Files\DIFX
2007-12-12 12:30 --------- d-----w C:\Program Files\Common Files\PCSuite
2007-12-12 12:30 --------- d-----w C:\Program Files\Common Files\Nokia
2007-12-12 12:29 --------- d-----w C:\Program Files\PC Connectivity Solution
2007-12-12 09:10 --------- d-----w C:\Program Files\Midway Home Entertainment
2007-12-08 16:54 --------- d-----w C:\Program Files\Java
2007-11-18 18:32 22,328 ------w C:\Documents and Settings\Ciaran O'Callarain\Application Data\PnkBstrK.sys
2007-05-08 16:01 1 ------w C:\Documents and Settings\Ciaran O'Callarain\SI.bin
2006-12-22 12:25 4,710,400 ----a-w C:\Program Files\CloneDVD2.exe
2007-02-07 23:20 88 --sh--r C:\WINDOWS\system32\4231C0722C.sys
2007-03-08 13:13 88 --sh--r C:\WINDOWS\system32\5C61ED4DBD.sys
2007-03-08 13:45 2,828 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ModemOnHold"="C:\Program Files\NetWaiting\netWaiting.exe" [ ]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 05:00 15360]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 16:24 1694208]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-08-16 11:24 167368]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-02-27 11:39 1310720]
"PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" [2007-12-10 10:12 695808]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-05-01 07:46 7561216]
"nwiz"="nwiz.exe" [2006-05-01 07:46 1519616 C:\WINDOWS\system32\nwiz.exe]
"NVHotkey"="nvHotkey.dll" [2006-05-01 07:46 73728 C:\WINDOWS\system32\nvhotkey.dll]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"SigmatelSysTrayApp"="stsystra.exe" [2006-03-24 23:30 282624 C:\WINDOWS\stsystra.exe]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-08 18:48 761947]
"IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [2006-05-01 09:28 667718]
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2006-05-01 09:28 602182]
"DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2005-09-08 05:20 122940]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 16:50 81920]
"PCMService"="C:\Program Files\Dell\MediaDirect\PCMService.exe" [2006-08-22 15:32 184320]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2005-12-20 17:38 28160 C:\WINDOWS\KHALMNPR.Exe]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [ ]
"Dell QuickSet"="C:\Program Files\Dell\QuickSet\quickset.exe" [2006-09-08 15:43 1036288]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 16:50 221184]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-16 09:54 282624]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-01-21 21:34 185896]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 18:51 39792]
"TomTomHOME.exe"="C:\Program Files\TomTom HOME 2\HOMERunner.exe" [2007-10-31 10:19 378784]
"BluetoothAuthorizationAgent"="C:\WINDOWS\system32\BluetoothAuthorizationAgent.exe" [ ]
"XboxStat"="c:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe" [2007-09-26 18:05 734264]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 05:00 15360]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-11-07 17:35 1294336]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-05-24 18:28:28 622653]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2000-01-21 08:15:54 65588]
SetPoint.lnk - C:\Program Files\SetPoint\SetPoint.exe [2007-01-06 09:02:49 532480]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 12:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-02-27 11:39 282624 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CleanUp]
c:\program files\mcafee.com\shared\mcappins.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDTray]
--a------ 2006-09-28 19:21 57344 C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Creative Detector]
--------- 2004-12-02 17:23 102400 C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTSyncU.exe]
--------- 2006-06-12 13:32 700416 C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eBayToolbar]
--a------ 2008-01-19 10:53 623856 C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2004-10-13 16:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2007-01-21 21:34 185896 C:\Program Files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirtualCloneDrive]
--a------ 2006-04-29 13:21 94208 C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe

R2 hnmwrlspkt;HomeNet Manager Wireless Protocol;C:\WINDOWS\system32\DRIVERS\hnm_wrls_pkt.sys [2006-07-14 01:01]
R2 ssoftnt4;ssoftnt4;C:\WINDOWS\system32\Drivers\ssoftnt4.sys [2007-01-24 12:16]
R2 wsppkt;Wireless Security Protocol;C:\WINDOWS\system32\DRIVERS\wsp_pkt.sys [2006-07-14 01:02]
S2 0132561175087898mcinstcleanup;McAfee Application Installer Cleanup (0132561175087898);C:\DOCUME~1\CIARAN~1\LOCALS~1\Temp\013256~1.EXE C:\PROGRA~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog []
S3 rcvpn;SonicWALL VPN Adapter;C:\WINDOWS\system32\DRIVERS\rcvpn.sys [2003-08-20 14:01]

.
Contents of the 'Scheduled Tasks' folder
"2008-02-01 18:30:00 C:\WINDOWS\Tasks\McAfee.com Scan for Viruses - My Computer (CIARAN-Ciaran O'Callarain).job"
- c:\program files\mcafee.com\vso\mcmnhdlr.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-07 18:10:13
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\System32\SCardSvr.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\FolderSize\FolderSizeSvc.exe
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\cryptainersrv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclBCBTSrv.exe
C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
.
**************************************************************************
.
Completion time: 2008-02-07 18:12:49 - machine was rebooted [Ciaran O'Callarain]
ComboFix-quarantined-files.txt 2008-02-07 18:12:46
.
2008-01-09 19:47:10 --- E O F ---


I ran Hijackthis but couldn't find an entry like you had:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:25:31, on 07/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\FolderSize\FolderSizeSvc.exe
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\cryptainersrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Dell\MediaDirect\PCMService.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\TomTom HOME 2\HOMERunner.exe
C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclBCBTSrv.exe
C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
C:\WINDOWS\system32\notepad.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
C:\Program Files\OpenOffice.org 2.0\program\soffice.exe
C:\Program Files\OpenOffice.org 2.0\program\soffice.BIN
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FAMTBEE.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FARNBEE.EXE
C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\SAGENT4.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.ie/ig/dell?hl=en&client=dell-row&channel=ie&ibd=1070106
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.google.ie...amp;ibd=1070106
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch_1.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O2 - BHO: IEPlugin Class - {CF7C3CF0-4B15-11D1-ABED-709549C10000} - C:\Program Files\Advanced System Optimizer\IEHelper.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,Start
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\MediaDirect\PCMService.exe"
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\HOMERunner.exe" -s
O4 - HKLM\..\Run: [BluetoothAuthorizationAgent] C:\WINDOWS\system32\BluetoothAuthorizationAgent.exe
O4 - HKLM\..\Run: [XboxStat] "c:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe" silentrun
O4 - HKCU\..\Run: [ModemOnHold] C:\Program Files\NetWaiting\netWaiting.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: SetPoint.lnk = ?
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: PacificPoker - {94EDF7B4-4272-4af3-8F8B-4E2F68E225B7} - C:\PROGRA~1\PACIFI~1\pacificpoker.exe
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky...can_unicode.cab
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) - http://a516.g.akamai...cat-no-eula.cab
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.co.../sysreqlab2.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx...owserPlugin.cab
O16 - DPF: {6F750202-1362-4815-A476-88533DE61D0C} (Kodak Gallery Easy Upload Manager Class) - http://www.kodakgall..._2/axofupld.cab
O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemreq...m/sysreqlab.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.m...ash/swflash.cab
O16 - DPF: {FEE1002D-90A5-4A5D-AABE-01803FFBCF7A} - http://ps.itv.mop.co...0.10-signed.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: McAfee Application Installer Cleanup (0132561175087898) (0132561175087898mcinstcleanup) - Unknown owner - C:\DOCUME~1\CIARAN~1\LOCALS~1\Temp\013256~1.EXE (file missing)
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Folder Size (FolderSize) - Brio - C:\Program Files\FolderSize\FolderSizeSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Cryptainer service (ssoftservice) - Cypherix Software (India) Pvt. Ltd. - C:\WINDOWS\SYSTEM32\cryptainersrv.exe
O23 - Service: Intel® PROSet/Wireless SSO Service (WLANKEEPER) - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

--
End of file - 12264 bytes

I've also set up a firewall and am about to install AVG

On the plus side, no more pop-ups so far

[Rorschach112]

Hello

1. Close any open browsers.

2. Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\WINDOWS\system32\dllgh8jkd1q2.exe~
C:\WINDOWS\system32\dllgh8jkd1q5.exe~
C:\WINDOWS\system32\dllgh8jkd1q1.exe~
C:\WINDOWS\system32\snipgjmlkfapsn.bmp

Save this as CFScript.txt, in the same location as ComboFix.exe




Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at "C:\ComboFix.txt"

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

[cocolleran]

Hi
Log reads:
ComboFix 08-02.05.3 - Ciaran O'Callarain 2008-02-07 19:30:14.7 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1409 [GMT 0:00]
Running from: C:\Documents and Settings\Ciaran O'Callarain\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Ciaran O'Callarain\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE
C:\WINDOWS\system32\dllgh8jkd1q1.exe~
C:\WINDOWS\system32\dllgh8jkd1q2.exe~
C:\WINDOWS\system32\dllgh8jkd1q5.exe~
C:\WINDOWS\system32\snipgjmlkfapsn.bmp
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
C:\WINDOWS\system32\dllgh8jkd1q1.exe~
C:\WINDOWS\system32\dllgh8jkd1q2.exe~
C:\WINDOWS\system32\dllgh8jkd1q5.exe~
C:\WINDOWS\system32\snipgjmlkfapsn.bmp

----- BITS: Possible infected sites -----

hxxp://www.download.windowsupdate.com
.
((((((((((((((((((((((((( Files Created from 2008-01-07 to 2008-02-07 )))))))))))))))))))))))))))))))
.

2008-02-07 18:39 . 2008-02-07 18:39 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\AVG7
2008-02-07 18:39 . 2008-02-07 18:41 <DIR> d-------- C:\Documents and Settings\Ciaran O'Callarain\Application Data\AVG7
2008-02-07 18:39 . 2008-02-07 18:39 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-02-07 18:39 . 2008-02-07 18:41 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg7
2008-02-07 18:03 . 2004-08-04 05:00 388,608 --a------ C:\kmd.exe
2008-02-06 15:45 . 2008-02-06 15:45 <DIR> d-------- C:\Deckard
2008-02-05 18:21 . 2008-02-05 18:21 0 --a------ C:\WINDOWS\system32\sex4.ico.tmp
2008-02-05 18:20 . 2008-02-05 18:20 0 --a------ C:\WINDOWS\system32\sex3.ico.tmp
2008-02-05 18:20 . 2008-02-05 18:20 0 --a------ C:\WINDOWS\system32\sex2.ico.tmp
2008-02-04 22:41 . 2008-02-04 22:41 <DIR> d-------- C:\f90d40cfe47b8d6bcb82
2008-02-04 21:50 . 2008-02-04 21:50 <DIR> d-------- C:\Program Files\Microsoft Silverlight
2008-02-03 23:14 . 2008-02-03 23:14 <DIR> d-------- C:\WINDOWS\system32\languages
2008-02-03 23:14 . 2008-02-03 23:14 <DIR> d-------- C:\Program Files\DS-MP3 Source
2008-02-03 23:14 . 2008-02-03 23:14 <DIR> d-------- C:\Program Files\DirectVobSub
2008-02-03 23:14 . 2008-02-03 23:14 691,717 --a------ C:\WINDOWS\system32\unins000.exe
2008-02-03 23:14 . 2007-12-03 16:38 397,312 --a------ C:\WINDOWS\system32\ff_libfaad2.dll
2008-02-03 23:14 . 2007-12-03 16:39 102,912 --a------ C:\WINDOWS\system32\ff_tremor.dll
2008-02-03 23:14 . 2007-11-29 12:52 60,273 --a------ C:\WINDOWS\system32\pthreadGC2.dll
2008-02-03 23:14 . 2008-02-03 23:14 42,500 --a------ C:\WINDOWS\system32\unins000.dat
2008-02-03 23:14 . 2007-11-29 12:52 1,708 --a------ C:\WINDOWS\system32\openIE.js
2008-02-01 21:22 . 2008-02-01 21:22 <DIR> d-------- C:\Documents and Settings\Ciaran O'Callarain\Application Data\Move Networks
2008-01-31 23:53 . 2008-01-31 23:53 1,158 --a------ C:\WINDOWS\mozver.dat
2008-01-31 23:50 . 2008-01-31 23:50 0 --a------ C:\WINDOWS\nsreg.dat
2008-01-31 21:27 . 2008-02-07 16:37 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-01-31 21:27 . 2008-01-31 21:27 1,409 --a------ C:\WINDOWS\QTFont.for
2008-01-31 17:58 . 2008-01-31 17:58 <DIR> d-------- C:\Program Files\Atari
2008-01-31 12:15 . 2008-01-31 12:15 4,128 --a------ C:\INFCACHE.1
2008-01-30 20:47 . 2008-01-30 20:48 <DIR> d-------- C:\WINDOWS\ERUNT
2008-01-30 20:31 . 2008-01-30 21:50 <DIR> d-------- C:\SDFix
2008-01-30 20:13 . 2008-01-30 20:13 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-01-30 19:56 . 2008-01-30 20:08 <DIR> d-------- C:\Program Files\AntiVirusPro
2008-01-30 19:55 . 2008-01-30 19:55 29,436 --a------ C:\WINDOWS\system32\BluetoothAuthorizationAgent.exe~
2008-01-30 19:45 . 2008-02-07 14:38 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2008-01-30 19:45 . 2008-01-30 19:45 <DIR> d-------- C:\Documents and Settings\Ciaran O'Callarain\Application Data\SUPERAntiSpyware.com
2008-01-30 19:45 . 2008-01-30 19:45 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-01-30 19:44 . 2008-02-07 15:08 4,288 --a------ C:\WINDOWS\system32\tmp.reg
2008-01-30 19:43 . 2007-09-05 23:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-01-30 19:43 . 2006-04-27 16:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-01-30 19:43 . 2008-01-27 14:37 81,920 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-01-30 19:43 . 2003-06-05 20:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-01-30 19:43 . 2004-07-31 17:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-01-30 19:43 . 2007-10-03 23:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-01-30 17:10 . 2008-01-30 17:10 0 --ah----- C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01001_Coinstaller_Critical.Wdf
2008-01-30 17:10 . 2008-01-30 17:10 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_xusb21_01001.Wdf
2008-01-30 17:05 . 2008-02-07 14:35 <DIR> d-------- C:\Program Files\Microsoft Xbox 360 Accessories
2008-01-30 17:05 . 2007-02-27 01:15 1,421,216 --a------ C:\WINDOWS\system32\WdfCoInstaller01001.dll
2008-01-30 17:05 . 2007-02-27 01:15 61,984 --a------ C:\WINDOWS\system32\drivers\xusb21.sys
2008-01-30 11:53 . 2008-02-04 21:50 <DIR> d-------- C:\temp
2008-01-30 11:30 . 2008-01-30 11:30 <DIR> d-------- C:\Program Files\THQ
2008-01-30 09:17 . 2008-01-30 19:36 <DIR> d-------- C:\Program Files\Unlocker
2008-01-29 16:18 . 2008-01-30 22:23 <DIR> d-------- C:\Documents and Settings\Ciaran O'Callarain\Application Data\skypePM
2008-01-29 16:18 . 2008-01-29 16:18 32 --a------ C:\Documents and Settings\All Users\Application Data\ezsid.dat
2008-01-29 16:17 . 2008-01-29 16:17 <DIR> d-------- C:\Program Files\Common Files\Skype
2008-01-28 10:40 . 2008-01-28 10:40 <DIR> d-------- C:\Program Files\FolderSize
2008-01-27 01:44 . 2008-01-28 09:47 <DIR> d-------- C:\Program Files\Amazon
2008-01-24 13:02 . 2008-01-24 13:02 <DIR> d-------- C:\Documents and Settings\Ciaran O'Callarain\Application Data\TomTom
2008-01-24 12:46 . 2008-01-24 12:46 <DIR> d-------- C:\Program Files\TomTom HOME 2
2008-01-18 11:14 . 2008-01-18 11:14 <DIR> d-------- C:\Program Files\Valvesoftware
2008-01-11 11:19 . 2008-01-29 13:24 316 --a------ C:\WINDOWS\game.ini
2008-01-10 10:27 . 2008-01-10 10:27 <DIR> d-------- C:\Program Files\Activision Value
2008-01-10 10:18 . 2008-01-10 10:18 <DIR> d-------- C:\Documents and Settings\Ciaran O'Callarain\Application Data\Nokia Multimedia Player

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-07 19:33 --------- d-----w C:\Program Files\FlashGet
2008-02-07 19:27 --------- d-----w C:\Documents and Settings\All Users\Application Data\WholeSecurity
2008-02-07 18:27 --------- d-----w C:\Documents and Settings\Ciaran O'Callarain\Application Data\OpenOffice.org2
2008-02-07 13:03 --------- d-----w C:\Program Files\NetWaiting
2008-02-06 12:34 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-31 12:46 --------- d-----w C:\Documents and Settings\Ciaran O'Callarain\Application Data\PC Suite
2008-01-31 12:17 --------- d-----w C:\Documents and Settings\All Users\Application Data\Installations
2008-01-30 23:41 --------- d-----w C:\Documents and Settings\Ciaran O'Callarain\Application Data\Skype
2008-01-30 22:10 --------- d-----w C:\Program Files\SlySoft
2008-01-30 19:54 --------- d-----w C:\Program Files\SopCast
2008-01-30 19:54 --------- d-----w C:\Program Files\SetPoint
2008-01-30 19:44 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-01-30 19:36 --------- d-----w C:\Program Files\Winamp
2008-01-30 18:09 --------- d-----w C:\Program Files\DivX
2008-01-30 17:23 --------- d-----w C:\Documents and Settings\Ciaran O'Callarain\Application Data\UseNeXT
2008-01-30 11:38 --------- d-----w C:\Program Files\SonicWALL
2008-01-30 11:37 --------- d-----w C:\Documents and Settings\Ciaran O'Callarain\Application Data\SonicWALL
2008-01-30 11:36 --------- d-----w C:\Program Files\Common Files\Deterministic Networks
2008-01-30 09:04 --------- d-----w C:\Program Files\id Software
2008-01-29 16:18 --------- d-----w C:\Program Files\Skype
2008-01-29 16:18 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skype
2008-01-27 13:53 536 ----a-w C:\Program Files\CloneDVD2.lnk
2008-01-24 14:01 --------- d-----w C:\Program Files\TomTomActivation
2008-01-24 12:46 --------- d-----w C:\Program Files\TomTom HOME
2008-01-11 10:45 --------- d-----w C:\Program Files\Activision
2008-01-09 21:39 --------- d-----w C:\Documents and Settings\Ciaran O'Callarain\Application Data\SopCast
2007-12-27 12:39 --------- d-----w C:\Program Files\TomTom DesktopSuite
2007-12-25 13:04 --------- d-----w C:\Program Files\SystemRequirementsLab
2007-12-25 12:41 --------- d-----w C:\Program Files\Steam
2007-12-25 12:38 --------- d-----w C:\Documents and Settings\Ciaran O'Callarain\Application Data\CopyTrans
2007-12-25 11:18 --------- d-----w C:\Program Files\WindSolutions
2007-12-21 23:20 --------- d-----w C:\Documents and Settings\Ciaran O'Callarain\Application Data\uTorrent
2007-12-21 20:43 --------- d-----w C:\Program Files\Electronic Arts
2007-12-20 19:35 --------- d-----w C:\Program Files\Trend Micro
2007-12-20 19:05 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-12-12 12:36 --------- d-----w C:\Documents and Settings\Ciaran O'Callarain\Application Data\Nokia
2007-12-12 12:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\PC Suite
2007-12-12 12:30 --------- d-----w C:\Program Files\Nokia
2007-12-12 12:30 --------- d-----w C:\Program Files\DIFX
2007-12-12 12:30 --------- d-----w C:\Program Files\Common Files\PCSuite
2007-12-12 12:30 --------- d-----w C:\Program Files\Common Files\Nokia
2007-12-12 12:29 --------- d-----w C:\Program Files\PC Connectivity Solution
2007-12-12 09:10 --------- d-----w C:\Program Files\Midway Home Entertainment
2007-12-08 16:54 --------- d-----w C:\Program Files\Java
2007-11-18 18:32 22,328 ------w C:\Documents and Settings\Ciaran O'Callarain\Application Data\PnkBstrK.sys
2007-05-08 16:01 1 ------w C:\Documents and Settings\Ciaran O'Callarain\SI.bin
2006-12-22 12:25 4,710,400 ----a-w C:\Program Files\CloneDVD2.exe
2007-02-07 23:20 88 --sh--r C:\WINDOWS\system32\4231C0722C.sys
2007-03-08 13:13 88 --sh--r C:\WINDOWS\system32\5C61ED4DBD.sys
2007-03-08 13:45 2,828 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ModemOnHold"="C:\Program Files\NetWaiting\netWaiting.exe" [ ]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 05:00 15360]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 16:24 1694208]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-08-16 11:24 167368]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-02-27 11:39 1310720]
"PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" [2007-12-10 10:12 695808]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-05-01 07:46 7561216]
"nwiz"="nwiz.exe" [2006-05-01 07:46 1519616 C:\WINDOWS\system32\nwiz.exe]
"NVHotkey"="nvHotkey.dll" [2006-05-01 07:46 73728 C:\WINDOWS\system32\nvhotkey.dll]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"SigmatelSysTrayApp"="stsystra.exe" [2006-03-24 23:30 282624 C:\WINDOWS\stsystra.exe]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-08 18:48 761947]
"IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [2006-05-01 09:28 667718]
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2006-05-01 09:28 602182]
"DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2005-09-08 05:20 122940]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 16:50 81920]
"PCMService"="C:\Program Files\Dell\MediaDirect\PCMService.exe" [2006-08-22 15:32 184320]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2005-12-20 17:38 28160 C:\WINDOWS\KHALMNPR.Exe]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [ ]
"Dell QuickSet"="C:\Program Files\Dell\QuickSet\quickset.exe" [2006-09-08 15:43 1036288]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 16:50 221184]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-16 09:54 282624]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-01-21 21:34 185896]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 18:51 39792]
"TomTomHOME.exe"="C:\Program Files\TomTom HOME 2\HOMERunner.exe" [2007-10-31 10:19 378784]
"BluetoothAuthorizationAgent"="C:\WINDOWS\system32\BluetoothAuthorizationAgent.exe" [ ]
"XboxStat"="c:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe" [2007-09-26 18:05 734264]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-02-07 18:40 579072]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 05:00 15360]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-11-07 17:35 1294336]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-02-07 18:39 219136]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-05-24 18:28:28 622653]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2000-01-21 08:15:54 65588]
SetPoint.lnk - C:\Program Files\SetPoint\SetPoint.exe [2007-01-06 09:02:49 532480]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 12:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-02-27 11:39 282624 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CleanUp]
c:\program files\mcafee.com\shared\mcappins.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDTray]
--a------ 2006-09-28 19:21 57344 C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Creative Detector]
--------- 2004-12-02 17:23 102400 C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTSyncU.exe]
--------- 2006-06-12 13:32 700416 C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eBayToolbar]
--a------ 2008-01-19 10:53 623856 C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2004-10-13 16:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2007-01-21 21:34 185896 C:\Program Files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirtualCloneDrive]
--a------ 2006-04-29 13:21 94208 C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe

R2 hnmwrlspkt;HomeNet Manager Wireless Protocol;C:\WINDOWS\system32\DRIVERS\hnm_wrls_pkt.sys [2006-07-14 01:01]
R2 ssoftnt4;ssoftnt4;C:\WINDOWS\system32\Drivers\ssoftnt4.sys [2007-01-24 12:16]
R2 wsppkt;Wireless Security Protocol;C:\WINDOWS\system32\DRIVERS\wsp_pkt.sys [2006-07-14 01:02]
S2 0132561175087898mcinstcleanup;McAfee Application Installer Cleanup (0132561175087898);C:\DOCUME~1\CIARAN~1\LOCALS~1\Temp\013256~1.EXE C:\PROGRA~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog []
S3 rcvpn;SonicWALL VPN Adapter;C:\WINDOWS\system32\DRIVERS\rcvpn.sys [2003-08-20 14:01]

*Newly Created Service* - BANTEXT
.
Contents of the 'Scheduled Tasks' folder
"2008-02-01 18:30:00 C:\WINDOWS\Tasks\McAfee.com Scan for Viruses - My Computer (CIARAN-Ciaran O'Callarain).job"
- c:\program files\mcafee.com\vso\mcmnhdlr.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-07 19:35:23
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\System32\SCardSvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\FolderSize\FolderSizeSvc.exe
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\cryptainersrv.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclBCBTSrv.exe
C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
.
**************************************************************************
.
Completion time: 2008-02-07 19:38:45 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-07 19:38:42
ComboFix2.txt 2008-02-07 18:12:50
.
2008-01-09 19:47:10 --- E O F ---


Thanks

[Rorschach112]

We are making progress

Nearly done

Please do an online scan with Kaspersky WebScanner

Click on Kaspersky Online Scanner and click Accept

You will be prompted to install an ActiveX component from Kaspersky, Click Yes.

• The program will launch and then begin downloading the latest definition files:
• Once the files have been downloaded click on NEXT
  
• Now click on Scan Settings
• In the scan settings make that the following are selected:
  • Scan using the following Anti-Virus database:
  Extended (if available otherwise Standard)
  
  • Scan Options:
  Scan Archives
  Scan Mail Bases
• Click OK
• Now under select a target to scan:Select My Computer
• This will program will start and scan your system.
• The scan will take a while so be patient and let it run.
• Once the scan is complete it will display if your system has been infected.
  
  • Now click on the Save as Text button:
• Save the file to your desktop.
• Copy and paste that information in your next post.

Download SysProt AntiRootkit to your desktop and unzip it to it's own folder there.

• Close all open windows and run SysProt.exe
  Click on the Log tab at the far right and check the boxes beside the following :
  
  
• Process
• SSDT
• Kernel Hooks
• Ports
• Registry

This will run for a shortwhile and will save the log at C:\SysProtLog.txt

Click OK at the prompt and close the program. Post the SysProtLog here in your reply.

[cocolleran]

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Thursday, February 07, 2008 9:46:08 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 7/02/2008
Kaspersky Anti-Virus database records: 553461
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: false

Scan Target - My Computer:
C:\
D:\
E:\
F:\

Scan Statistics:
Total number of scanned objects: 88686
Number of viruses found: 33
Number of infected objects: 78
Number of suspicious objects: 0
Duration of the scan process: 01:30:40

Infected Object Name / Virus Name / Last Action
C:\5A.tmp Infected: Trojan-Downloader.Win32.Diehard.dt skipped
C:\60.tmp Infected: Trojan-Downloader.Win32.Tibs.ul skipped
C:\Deckard\System Scanner\20080207171532\backup\WINDOWS\Downloaded Program Files\popcaploader.dll Infected: not-a-virus:Downloader.Win32.PopCap.b skipped
C:\Documents and Settings\All Users\Application Data\avg7\Log\emc.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\QSLLPSVCShare Object is locked skipped
C:\Documents and Settings\Ciaran O'Callarain\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SUPERANTISPYWARE.LOG Object is locked skipped
C:\Documents and Settings\Ciaran O'Callarain\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Ciaran O'Callarain\Desktop\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Documents and Settings\Ciaran O'Callarain\Desktop\SmitfraudFix.exe/data.rar/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Documents and Settings\Ciaran O'Callarain\Desktop\SmitfraudFix.exe/data.rar Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Documents and Settings\Ciaran O'Callarain\Desktop\SmitfraudFix.exe RarSFX: infected - 2 skipped
C:\Documents and Settings\Ciaran O'Callarain\Desktop\Work\SmitfraudFix.exe/data.rar/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Documents and Settings\Ciaran O'Callarain\Desktop\Work\SmitfraudFix.exe/data.rar Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Documents and Settings\Ciaran O'Callarain\Desktop\Work\SmitfraudFix.exe RarSFX: infected - 2 skipped
C:\Documents and Settings\Ciaran O'Callarain\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Ciaran O'Callarain\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Ciaran O'Callarain\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Ciaran O'Callarain\Local Settings\History\History.IE5\MSHist012008020720080208\index.dat Object is locked skipped
C:\Documents and Settings\Ciaran O'Callarain\Local Settings\Temp\aax1BF.tmp\ccp1D3.tmp Object is locked skipped
C:\Documents and Settings\Ciaran O'Callarain\Local Settings\Temp\aax1BF.tmp\statistics.xml Object is locked skipped
C:\Documents and Settings\Ciaran O'Callarain\Local Settings\Temp\~DF55F4.tmp Object is locked skipped
C:\Documents and Settings\Ciaran O'Callarain\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
C:\Documents and Settings\Ciaran O'Callarain\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Ciaran O'Callarain\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Ciaran O'Callarain\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Program Files\FlashGet\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\QooBox\Quarantine\C\nethlpr.exe.vir Infected: Trojan-Proxy.Win32.Wopla.at skipped
C:\QooBox\Quarantine\C\Program Files\tmp3883281.exe.vir Infected: Trojan-Downloader.Win32.Agent.ipp skipped
C:\QooBox\Quarantine\C\sofnfgm.exe.vir Infected: Trojan-Downloader.Win32.Agent.hyy skipped
C:\QooBox\Quarantine\C\tuvbo.exe.vir Infected: Trojan-Proxy.Win32.Wopla.at skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\actcontroller.exe.vir Infected: Email-Worm.Win32.Mydoom.bj skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\csrssw.dll.vir Infected: Trojan-Spy.Win32.Agent.bcq skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\dllgh8jkd1q1.exe~.vir Infected: Packed.Win32.Tibs.ib skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\dllgh8jkd1q2.exe~.vir Infected: Packed.Win32.Tibs.ib skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\dllgh8jkd1q5.exe~.vir Infected: Packed.Win32.Tibs.ib skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\ndisaluo.sys.vir Infected: Trojan-Proxy.Win32.Wopla.at skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\ntio922.sys.vir Infected: Trojan-Proxy.Win32.Wopla.at skipped
C:\SDFix\backups\backups.zip/backups/xlibgfl254.dll Infected: Trojan-Downloader.Win32.Agent.bfj skipped
C:\SDFix\backups\backups.zip ZIP: infected - 1 skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP14\A0013846.exe Infected: Packed.Win32.Tibs.ib skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP14\A0013847.exe Infected: Packed.Win32.Tibs.ib skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP14\A0013848.exe Infected: Packed.Win32.Tibs.ib skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP14\A0013851.dll Infected: Trojan-Spy.Win32.Agent.bcq skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP14\A0013852.exe Infected: Trojan.Win32.Qhost.aes skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP14\A0013853.exe Infected: Trojan.Win32.Qhost.aes skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP14\A0013854.exe Infected: Trojan.Win32.Qhost.aes skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP14\A0013855.exe Infected: Trojan.Win32.Qhost.aes skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP14\A0013858.exe Infected: Trojan.Win32.Agent.dqx skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP14\A0013859.exe Infected: Trojan.Win32.Qhost.aes skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP14\A0013860.sys Infected: Email-Worm.Win32.Zhelatin.sd skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP14\A0013861.sys Infected: Trojan-Downloader.Win32.Diehard.dr skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP14\A0013862.sys Infected: Trojan-Downloader.Win32.Agent.ici skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP14\A0013863.sys Object is locked skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP14\A0013864.sys Object is locked skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP14\A0013866.dll Object is locked skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP14\A0013867.dll Object is locked skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP14\A0013868.dll Object is locked skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP14\A0013876.exe Infected: Trojan-Downloader.Win32.Alphabet.gen skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP14\A0013877.exe Infected: Trojan-Downloader.Win32.Alphabet.gen skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP14\A0013880.exe Object is locked skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP14\A0013881.dll Infected: not-a-virus:AdWare.Win32.E404.a skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP14\A0013882.dll Infected: not-a-virus:AdWare.Win32.E404.a skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP14\A0013883.dll Infected: Trojan-Downloader.Win32.BHO.cm skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP14\A0013884.dll Infected: Trojan-Downloader.Win32.BHO.cm skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP14\A0013885.dll Infected: Trojan-Downloader.Win32.BHO.cm skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP14\A0013886.exe Infected: Trojan-Downloader.Win32.Agent.iug skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP14\A0013887.exe Infected: Packed.Win32.Tibs.ib skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP14\A0013888.exe Infected: Packed.Win32.Tibs.ib skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP14\A0013891.exe Infected: Email-Worm.Win32.Zhelatin.uq skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP14\A0013892.exe Infected: Trojan-Proxy.Win32.Saturn.ag skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP14\A0013893.exe Object is locked skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP14\A0013894.exe Object is locked skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP14\A0013895.exe Infected: Trojan-Downloader.Win32.VB.cga skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP14\A0013896.dll Infected: Trojan.Win32.Qhost.abh skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP14\A0013897.dll Object is locked skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP14\A0013898.exe Infected: Packed.Win32.Tibs.ib skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP14\A0013900.exe Infected: Trojan-Spy.Win32.BZub.bxp skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP14\A0013905.exe Infected: Trojan.Win32.Qhost.aes skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP14\A0014001.exe Infected: Trojan.Win32.Qhost.aes skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP14\A0014003.exe Infected: Trojan.Win32.Qhost.aes skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP14\A0014053.exe:ext.exe:$DATA Infected: Trojan.Win32.Agent.evw skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP15\A0014306.exe Infected: Trojan-Proxy.Win32.Wopla.at skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP15\A0014308.exe Infected: Trojan-Downloader.Win32.Agent.ipp skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP15\A0014309.exe Infected: Trojan-Downloader.Win32.Agent.hyy skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP15\A0014310.exe Infected: Trojan-Proxy.Win32.Wopla.at skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP15\A0014312.exe Object is locked skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP15\A0014313.dll Infected: Trojan-Spy.Win32.Agent.bcq skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP15\A0014314.sys Infected: Trojan-Proxy.Win32.Wopla.at skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP15\A0014315.sys Infected: Trojan-Proxy.Win32.Wopla.at skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP2\A0007009.exe/data.rar/keygen.exe Infected: Trojan-Downloader.Win32.Agent.htu skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP2\A0007009.exe/data.rar/crack.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.dux skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP2\A0007009.exe/data.rar/serial.exe Infected: Trojan.Win32.Dialer.yz skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP2\A0007009.exe/data.rar/install.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP2\A0007009.exe/data.rar Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP2\A0007009.exe RarSFX: infected - 5 skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP22\change.log Object is locked skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP3\A0010167.exe Object is locked skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP3\A0010168.exe Object is locked skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP3\A0010169.dll Infected: not-a-virus:AdWare.Win32.BHO.sr skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP3\A0010176.exe Object is locked skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP3\A0010177.exe Object is locked skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP3\A0010179.dll Infected: not-a-virus:AdWare.Win32.BHO.sr skipped
C:\WINDOWS\CSC\00000001 Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\Installer\{bb1b067d-7f0e-4b29-acb3-a51fcfd7de31}\RomRunOnce.dll Infected: Trojan.Win32.Agent.evy skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\55135140.Evt Infected: Trojan-Proxy.Win32.Saturn.ag skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\DEFAULT Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SYSTEM Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\LogFiles\WUDF\WUDFTrace.etl Object is locked skipped
C:\WINDOWS\system32\vedxg4am1et2.exe~ Infected: Packed.Win32.Tibs.ib skipped
C:\WINDOWS\system32\vedxga1me4t1.exe~ Infected: Packed.Win32.Tibs.ib skipped
C:\WINDOWS\system32\vedxga4m1et4.exe~ Infected: Trojan-Downloader.Win32.Tibs.uo skipped
C:\WINDOWS\system32\vedxga8me6.exe~ Infected: Packed.Win32.Tibs.ib skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.



Syaprotlog:

SysProt AntiRootkit v1.0.0.5
by swatkat

Process:
Name: [System Process]
PID: 0
Hidden: No
Window Visible: No

Name: C:\Documents and Settings\Ciaran O'Callarain\Desktop\SysProt.exe
PID: 4852
Hidden: No
Window Visible: Yes

Name: System
PID: 4
Hidden: No
Window Visible: No

Name: C:\WINDOWS\system32\smss.exe
PID: 988
Hidden: No
Window Visible: No

Name: C:\WINDOWS\system32\csrss.exe
PID: 1040
Hidden: No
Window Visible: No

Name: C:\WINDOWS\system32\winlogon.exe
PID: 1068
Hidden: No
Window Visible: No

Name: C:\WINDOWS\system32\services.exe
PID: 1112
Hidden: No
Window Visible: No

Name: C:\WINDOWS\system32\lsass.exe
PID: 1124
Hidden: No
Window Visible: No

Name: C:\WINDOWS\system32\svchost.exe
PID: 1324
Hidden: No
Window Visible: No

Name: C:\WINDOWS\system32\svchost.exe
PID: 1372
Hidden: No
Window Visible: No

Name: C:\WINDOWS\system32\svchost.exe
PID: 1516
Hidden: No
Window Visible: No

Name: C:\WINDOWS\system32\svchost.exe
PID: 1556
Hidden: No
Window Visible: No

Name: C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
PID: 1676
Hidden: No
Window Visible: No

Name: C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
PID: 1708
Hidden: No
Window Visible: No

Name: C:\Program Files\Intel\Wireless\Bin\WLKEEPER.exe
PID: 1752
Hidden: No
Window Visible: No

Name: C:\WINDOWS\system32\svchost.exe
PID: 1788
Hidden: No
Window Visible: No

Name: C:\WINDOWS\system32\svchost.exe
PID: 272
Hidden: No
Window Visible: No

Name: C:\WINDOWS\system32\spoolsv.exe
PID: 720
Hidden: No
Window Visible: No

Name: C:\WINDOWS\system32\scardsvr.exe
PID: 768
Hidden: No
Window Visible: No

Name: C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
PID: 1912
Hidden: No
Window Visible: No

Name: C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
PID: 1964
Hidden: No
Window Visible: No

Name: C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
PID: 1996
Hidden: No
Window Visible: No

Name: C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
PID: 2016
Hidden: No
Window Visible: No

Name: C:\WINDOWS\system32\CTSVCCDA.EXE
PID: 232
Hidden: No
Window Visible: No

Name: C:\Program Files\FolderSize\FolderSizeSvc.exe
PID: 296
Hidden: No
Window Visible: No

Name: C:\Program Files\Dell\QuickSet\NicConfigSvc.exe
PID: 464
Hidden: No
Window Visible: No

Name: C:\WINDOWS\system32\nvsvc32.exe
PID: 500
Hidden: No
Window Visible: No

Name: C:\WINDOWS\explorer.exe
PID: 916
Hidden: No
Window Visible: Yes

Name: C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
PID: 684
Hidden: No
Window Visible: No

Name: C:\WINDOWS\system32\cryptainersrv.exe
PID: 1544
Hidden: No
Window Visible: No

Name: C:\WINDOWS\system32\svchost.exe
PID: 1616
Hidden: No
Window Visible: No

Name: C:\WINDOWS\system32\alg.exe
PID: 2584
Hidden: No
Window Visible: No

Name: C:\WINDOWS\system32\wbem\wmiprvse.exe
PID: 2784
Hidden: No
Window Visible: No

Name: C:\WINDOWS\system32\rundll32.exe
PID: 2716
Hidden: No
Window Visible: No

Name: C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
PID: 2724
Hidden: No
Window Visible: No

Name: C:\WINDOWS\stsystra.exe
PID: 2644
Hidden: No
Window Visible: No

Name: C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
PID: 1420
Hidden: No
Window Visible: Yes

Name: C:\Program Files\Intel\Wireless\Bin\ZCfgSvc.exe
PID: 2748
Hidden: No
Window Visible: No

Name: C:\Program Files\Intel\Wireless\Bin\iFrmewrk.exe
PID: 2772
Hidden: No
Window Visible: No

Name: C:\WINDOWS\system32\DLA\DLACTRLW.EXE
PID: 2864
Hidden: No
Window Visible: No

Name: C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
PID: 2872
Hidden: No
Window Visible: No

Name: C:\Program Files\Dell\MediaDirect\PCMService.exe
PID: 2880
Hidden: No
Window Visible: No

Name: C:\Program Files\Dell\QuickSet\quickset.exe
PID: 2896
Hidden: No
Window Visible: No

Name: C:\Program Files\QuickTime\qttask.exe
PID: 2928
Hidden: No
Window Visible: No

Name: C:\Program Files\Common Files\Real\Update_OB\realsched.exe
PID: 2968
Hidden: No
Window Visible: No

Name: C:\Program Files\TomTom HOME 2\HOMERunner.exe
PID: 3060
Hidden: No
Window Visible: No

Name: C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe
PID: 3076
Hidden: No
Window Visible: No

Name: C:\WINDOWS\system32\ctfmon.exe
PID: 3236
Hidden: No
Window Visible: No

Name: C:\Program Files\DAEMON Tools\daemon.exe
PID: 3368
Hidden: No
Window Visible: No

Name: C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
PID: 3436
Hidden: No
Window Visible: No

Name: C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe
PID: 3464
Hidden: No
Window Visible: No

Name: C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
PID: 3880
Hidden: No
Window Visible: No

Name: C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe
PID: 4080
Hidden: No
Window Visible: No

Name: C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
PID: 3708
Hidden: No
Window Visible: No

Name: C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
PID: 1488
Hidden: No
Window Visible: No

Name: C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
PID: 840
Hidden: No
Window Visible: No

Name: C:\Program Files\PC Connectivity Solution\Transports\NclBCBTSrv.exe
PID: 1668
Hidden: No
Window Visible: No

Name: C:\Program Files\SetPoint\SetPoint.exe
PID: 2088
Hidden: No
Window Visible: No

Name: C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
PID: 2680
Hidden: No
Window Visible: No

Name: C:\Program Files\Internet Explorer\iexplore.exe
PID: 3728
Hidden: No
Window Visible: Yes

Name: C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
PID: 2540
Hidden: No
Window Visible: No

Name: C:\Program Files\FlashGet\flashget.exe
PID: 3008
Hidden: No
Window Visible: Yes

Name: C:\Program Files\DivX\DivX Converter\Converter.exe
PID: 2608
Hidden: No
Window Visible: No

Name: C:\Program Files\OpenOffice.org 2.0\program\soffice.exe
PID: 4592
Hidden: No
Window Visible: No

Name: C:\Program Files\OpenOffice.org 2.0\program\soffice.bin
PID: 4860
Hidden: No
Window Visible: Yes

Name: C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
PID: 3044
Hidden: No
Window Visible: No

Name: C:\WINDOWS\system32\notepad.exe
PID: 6872
Hidden: No
Window Visible: Yes

********************************************************************************
**********
SSDT:
Function Name: ZwCreateKey
Address: B9EBE0D0
Driver Base: B9EBD000
Driver End: B9FA7000
Driver Name: sptd.sys

Function Name: ZwEnumerateKey
Address: B9EC3FB2
Driver Base: B9EBD000
Driver End: B9FA7000
Driver Name: sptd.sys

Function Name: ZwEnumerateValueKey
Address: B9EC4340
Driver Base: B9EBD000
Driver End: B9FA7000
Driver Name: sptd.sys

Function Name: ZwOpenKey
Address: B9EBE0B0
Driver Base: B9EBD000
Driver End: B9FA7000
Driver Name: sptd.sys

Function Name: ZwQueryKey
Address: B9EC4418
Driver Base: B9EBD000
Driver End: B9FA7000
Driver Name: sptd.sys

Function Name: ZwQueryValueKey
Address: B9EC4298
Driver Base: B9EBD000
Driver End: B9FA7000
Driver Name: sptd.sys

Function Name: ZwSetValueKey
Address: B9EC44AA
Driver Base: B9EBD000
Driver End: B9FA7000
Driver Name: sptd.sys

********************************************************************************
**********
No Kernel Hooks found

********************************************************************************
**********
No hidden Services key found in Registry

********************************************************************************
**********
Ports:
Local Address: CIARAN-LAPTOP:3264
Remote Address: 66-199-250-170.REVERSE.EZZI.NET:8911
Type: TCP
Process: C:\Program Files\FlashGet\flashget.exe
State: SYN_SENT

Local Address: CIARAN-LAPTOP:3263
Remote Address: 72.51.37.237:8899
Type: TCP
Process: C:\Program Files\FlashGet\flashget.exe
State: SYN_SENT

Local Address: CIARAN-LAPTOP:3262
Remote Address: 60.28.197.35:28221
Type: TCP
Process: C:\Program Files\FlashGet\flashget.exe
State: SYN_SENT

Local Address: CIARAN-LAPTOP:3261
Remote Address: 219.239.90.172:28221
Type: TCP
Process: C:\Program Files\FlashGet\flashget.exe
State: SYN_SENT

Local Address: CIARAN-LAPTOP:3219
Remote Address: 59.151.31.139:DOMAIN
Type: TCP
Process: C:\Program Files\FlashGet\flashget.exe
State: ESTABLISHED

Local Address: CIARAN-LAPTOP:2934
Remote Address: 80.252.110.146:4661
Type: TCP
Process: C:\Program Files\FlashGet\flashget.exe
State: ESTABLISHED

Local Address: CIARAN-LAPTOP:NETBIOS-SSN
Remote Address: 0.0.0.0:0
Type: TCP
Process: System
State: LISTENING

Local Address: CIARAN-LAPTOP:10110
Remote Address: 0.0.0.0:0
Type: TCP
Process: C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
State: LISTENING

Local Address: CIARAN-LAPTOP:1025
Remote Address: 0.0.0.0:0
Type: TCP
Process: C:\WINDOWS\system32\alg.exe
State: LISTENING

Local Address: CIARAN-LAPTOP:36762
Remote Address: 0.0.0.0:0
Type: TCP
Process: C:\Program Files\FlashGet\flashget.exe
State: LISTENING

Local Address: CIARAN-LAPTOP:MICROSOFT-DS
Remote Address: 0.0.0.0:0
Type: TCP
Process: System
State: LISTENING

Local Address: CIARAN-LAPTOP:EPMAP
Remote Address: 0.0.0.0:0
Type: TCP
Process: C:\WINDOWS\system32\svchost.exe
State: LISTENING

Local Address: CIARAN-LAPTOP:138
Remote Address: NA
Type: UDP
Process: System
State: NA

Local Address: CIARAN-LAPTOP:NETBIOS-NS
Remote Address: NA
Type: UDP
Process: System
State: NA

Local Address: CIARAN-LAPTOP:123
Remote Address: NA
Type: UDP
Process: C:\WINDOWS\system32\svchost.exe
State: NA

Local Address: CIARAN-LAPTOP:1239
Remote Address: NA
Type: UDP
Process: C:\Program Files\FlashGet\flashget.exe
State: NA

Local Address: CIARAN-LAPTOP:1029
Remote Address: NA
Type: UDP
Process: C:\Program Files\Internet Explorer\iexplore.exe
State: NA

Local Address: CIARAN-LAPTOP:123
Remote Address: NA
Type: UDP
Process: C:\WINDOWS\system32\svchost.exe
State: NA

Local Address: CIARAN-LAPTOP:36763
Remote Address: NA
Type: UDP
Process: C:\Program Files\FlashGet\flashget.exe
State: NA

Local Address: CIARAN-LAPTOP:36762
Remote Address: NA
Type: UDP
Process: C:\Program Files\FlashGet\flashget.exe
State: NA

Local Address: CIARAN-LAPTOP:4500
Remote Address: NA
Type: UDP
Process: C:\WINDOWS\system32\lsass.exe
State: NA

Local Address: CIARAN-LAPTOP:1828
Remote Address: NA
Type: UDP
Process: C:\WINDOWS\system32\svchost.exe
State: NA

Local Address: CIARAN-LAPTOP:1251
Remote Address: NA
Type: UDP
Process: C:\WINDOWS\system32\svchost.exe
State: NA

Local Address: CIARAN-LAPTOP:1238
Remote Address: NA
Type: UDP
Process: C:\Program Files\FlashGet\flashget.exe
State: NA

Local Address: CIARAN-LAPTOP:1030
Remote Address: NA
Type: UDP
Process: C:\WINDOWS\system32\svchost.exe
State: NA

Local Address: CIARAN-LAPTOP:1027
Remote Address: NA
Type: UDP
Process: C:\WINDOWS\system32\svchost.exe
State: NA

Local Address: CIARAN-LAPTOP:500
Remote Address: NA
Type: UDP
Process: C:\WINDOWS\system32\lsass.exe
State: NA

Local Address: CIARAN-LAPTOP:MICROSOFT-DS
Remote Address: NA
Type: UDP
Process: System
State: NA

[Rorschach112]

We are making good progress

Please download the OTMoveIt2 by OldTimer.

• Save it to your desktop.
• Please double-click OTMoveIt2.exe to run it.
• Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  

  C:\5A.tmp
  C:\60.tmp
  C:\WINDOWS\Installer\{bb1b067d-7f0e-4b29-acb3-a51fcfd7de31}\RomRunOnce.dll
  C:\WINDOWS\system32\config\55135140.Evt
  C:\WINDOWS\system32\vedxg4am1et2.exe~ 
  C:\WINDOWS\system32\vedxga1me4t1.exe~ 
  C:\WINDOWS\system32\vedxga4m1et4.exe~ 
  C:\WINDOWS\system32\vedxga8me6.exe~

• Return to OTMoveIt2, right click in the "Paste List of Files/Folders to be Moved" window (under the light blue bar) and choose Paste.
  
• Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  

  purity

• Return to OTMoveIt2, right click in the "Paste List Of Files/Patterns To Search For and Move" window (under the yellow bar) and choose Paste.
  
• Click the red Moveit! button.
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
• Close OTMoveIt2

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.



Also post a new HijackThis log and tell me how your PC is running now

[cocolleran]

Hi Rorschach,
Your perseverance is great. Did that and results read:
C:\5A.tmp moved successfully.
C:\60.tmp moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\Installer\{bb1b067d-7f0e-4b29-acb3-a51fcfd7de31}\RomRunOnce.dll
C:\WINDOWS\Installer\{bb1b067d-7f0e-4b29-acb3-a51fcfd7de31}\RomRunOnce.dll NOT unregistered.
C:\WINDOWS\Installer\{bb1b067d-7f0e-4b29-acb3-a51fcfd7de31}\RomRunOnce.dll moved successfully.
C:\WINDOWS\system32\config\55135140.Evt moved successfully.
C:\WINDOWS\system32\vedxg4am1et2.exe~ moved successfully.
C:\WINDOWS\system32\vedxga1me4t1.exe~ moved successfully.
C:\WINDOWS\system32\vedxga4m1et4.exe~ moved successfully.
C:\WINDOWS\system32\vedxga8me6.exe~ moved successfully.
[Custom Input]
< purity >

OTMoveIt2 v1.0.19 log created on 02082008_090558

[Rorschach112]

Hello

Please post a new DSS log and tell me how your PC is running

[cocolleran]

Hi
She seems to be running perfectly again. My sincerest thanks for your help with this.
Log:

Deckard's System Scanner v20071014.68
Run by Ciaran O'Callarain on 2008-02-08 15:25:50
Computer is in Normal Mode.
--------------------------------------------------------------------------------



-- HijackThis (run as Ciaran O'Callarain.exe) ----------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:26:14, on 08/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\FolderSize\FolderSizeSvc.exe
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\cryptainersrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\TomTom HOME 2\HOMERunner.exe
C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
C:\Program Files\FlashGet\flashget.exe
C:\Program Files\DivX\DivX Converter\Converter.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclBCBTSrv.exe
C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Ciaran O'Callarain\Desktop\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\CIARAN~1.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.ie/ig/dell?hl=en&client=dell-row&channel=ie&ibd=1070106
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.google.ie...amp;ibd=1070106
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch_1.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O2 - BHO: IEPlugin Class - {CF7C3CF0-4B15-11D1-ABED-709549C10000} - C:\Program Files\Advanced System Optimizer\IEHelper.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,Start
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\MediaDirect\PCMService.exe"
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\HOMERunner.exe" -s
O4 - HKLM\..\Run: [BluetoothAuthorizationAgent] C:\WINDOWS\system32\BluetoothAuthorizationAgent.exe
O4 - HKLM\..\Run: [XboxStat] "c:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe" silentrun
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [ModemOnHold] C:\Program Files\NetWaiting\netWaiting.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: SetPoint.lnk = ?
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: PacificPoker - {94EDF7B4-4272-4af3-8F8B-4E2F68E225B7} - C:\PROGRA~1\PACIFI~1\pacificpoker.exe
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky...can_unicode.cab
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) - http://a516.g.akamai...cat-no-eula.cab
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.co.../sysreqlab2.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx...owserPlugin.cab
O16 - DPF: {6F750202-1362-4815-A476-88533DE61D0C} (Kodak Gallery Easy Upload Manager Class) - http://www.kodakgall..._2/axofupld.cab
O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemreq...m/sysreqlab.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.m...ash/swflash.cab
O16 - DPF: {FEE1002D-90A5-4A5D-AABE-01803FFBCF7A} - http://ps.itv.mop.co...0.10-signed.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: McAfee Application Installer Cleanup (0132561175087898) (0132561175087898mcinstcleanup) - Unknown owner - C:\DOCUME~1\CIARAN~1\LOCALS~1\Temp\013256~1.EXE (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Folder Size (FolderSize) - Brio - C:\Program Files\FolderSize\FolderSizeSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Cryptainer service (ssoftservice) - Cypherix Software (India) Pvt. Ltd. - C:\WINDOWS\SYSTEM32\cryptainersrv.exe
O23 - Service: Intel® PROSet/Wireless SSO Service (WLANKEEPER) - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

--
End of file - 13073 bytes

-- Files created between 2008-01-08 and 2008-02-08 -----------------------------

2008-02-08 12:06:37 0 d-------- C:\Program Files\Sports Interactive
2008-02-08 00:31:20 0 d-------- C:\Documents and Settings\Ciaran O'Callarain\Application Data\Sports Interactive
2008-02-07 19:11:27 0 dr-h----- C:\$VAULT$.AVG
2008-02-07 18:39:37 0 d-------- C:\Documents and Settings\Ciaran O'Callarain\Application Data\AVG7
2008-02-07 18:39:22 0 d-------- C:\Documents and Settings\LocalService\Application Data\AVG7
2008-02-07 18:39:08 0 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-02-07 18:39:08 0 d-------- C:\Documents and Settings\All Users\Application Data\avg7
2008-02-07 18:05:12 68096 --a------ C:\WINDOWS\system32\zip.exe
2008-02-07 18:05:12 98816 --a------ C:\WINDOWS\system32\sed.exe
2008-02-07 18:05:12 80412 --a------ C:\WINDOWS\system32\grep.exe
2008-02-07 18:05:12 73728 --a------ C:\WINDOWS\system32\fdsv.exe <Not Verified; Smallfrogs Studio; >
2008-02-07 14:28:23 0 dr-h----- C:\Documents and Settings\Ciaran O'Callarain\Recent
2008-02-07 13:03:35 2 --a------ C:\-1674219165
2008-02-04 22:41:48 0 d-------- C:\f90d40cfe47b8d6bcb82
2008-02-04 21:50:06 0 d-------- C:\Program Files\Microsoft Silverlight
2008-02-03 23:14:59 0 d-------- C:\Program Files\DS-MP3 Source
2008-02-03 23:14:51 0 d-------- C:\WINDOWS\system32\languages
2008-02-03 23:14:50 60273 --a------ C:\WINDOWS\system32\pthreadGC2.dll <Not Verified; Open Source Software community project; >
2008-02-03 23:14:49 691717 --a------ C:\WINDOWS\system32\unins000.exe
2008-02-03 23:14:49 42500 --a------ C:\WINDOWS\system32\unins000.dat
2008-02-03 23:14:49 102912 --a------ C:\WINDOWS\system32\ff_tremor.dll
2008-02-03 23:14:49 397312 --a------ C:\WINDOWS\system32\ff_libfaad2.dll
2008-02-03 23:14:34 0 d-------- C:\Program Files\DirectVobSub
2008-02-01 21:22:03 0 d-------- C:\Documents and Settings\Ciaran O'Callarain\Application Data\Move Networks
2008-01-31 23:53:59 1158 --a------ C:\WINDOWS\mozver.dat
2008-01-31 23:50:32 0 --a------ C:\WINDOWS\nsreg.dat
2008-01-31 17:58:20 0 d-------- C:\Program Files\Atari
2008-01-30 20:47:50 0 d-------- C:\WINDOWS\ERUNT
2008-01-30 20:13:21 0 d-------- C:\Program Files\SpywareBlaster
2008-01-30 19:56:19 0 d-------- C:\Program Files\AntiVirusPro
2008-01-30 19:45:34 0 d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-01-30 19:45:13 0 d-------- C:\Program Files\SUPERAntiSpyware
2008-01-30 19:45:13 0 d-------- C:\Documents and Settings\Ciaran O'Callarain\Application Data\SUPERAntiSpyware.com
2008-01-30 19:44:56 4288 --a------ C:\WINDOWS\system32\tmp.reg
2008-01-30 19:43:52 25600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-01-30 19:43:52 289144 --a------ C:\WINDOWS\system32\VCCLSID.exe <Not Verified; S!Ri; >
2008-01-30 19:43:52 288417 --a------ C:\WINDOWS\system32\SrchSTS.exe <Not Verified; S!Ri; SrchSTS>
2008-01-30 19:43:52 53248 --a------ C:\WINDOWS\system32\Process.exe <Not Verified; http://www.beyondlogic.org; Command Line Process Utility>
2008-01-30 19:43:52 81920 --a------ C:\WINDOWS\system32\IEDFix.exe <Not Verified; S!Ri.URZ; IEDFix>
2008-01-30 19:43:52 51200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-01-30 17:08:44 0 d-------- C:\0f3f51c465732407af170bcd2fe57f6c
2008-01-30 17:05:29 0 d-------- C:\Program Files\Microsoft Xbox 360 Accessories
2008-01-30 11:53:16 0 d-------- C:\temp
2008-01-30 11:30:16 0 d-------- C:\Program Files\THQ
2008-01-29 16:18:11 0 d-------- C:\Documents and Settings\Ciaran O'Callarain\Application Data\skypePM
2008-01-29 16:18:11 32 --a------ C:\Documents and Settings\All Users\Application Data\ezsid.dat
2008-01-29 16:17:58 0 d-------- C:\Program Files\Common Files\Skype
2008-01-28 10:40:35 0 d-------- C:\Program Files\FolderSize
2008-01-27 01:44:32 0 d-------- C:\Program Files\Amazon
2008-01-24 13:02:18 0 d-------- C:\Documents and Settings\Ciaran O'Callarain\Application Data\TomTom
2008-01-24 13:02:18 0 d-------- C:\Documents and Settings\Ciaran O'Callarain\Application Data\Mozilla
2008-01-24 12:46:29 0 d-------- C:\Program Files\TomTom HOME 2
2008-01-18 11:14:48 0 d-------- C:\Program Files\Valvesoftware
2008-01-10 10:27:16 0 d-------- C:\Program Files\Activision Value
2008-01-10 10:18:32 0 d-------- C:\Documents and Settings\Ciaran O'Callarain\Application Data\Nokia Multimedia Player


-- Find3M Report ---------------------------------------------------------------

2008-02-08 15:21:42 0 d-------- C:\Program Files\FlashGet
2008-02-08 11:54:53 0 d-------- C:\Documents and Settings\Ciaran O'Callarain\Application Data\OpenOffice.org2
2008-02-08 00:32:47 38481 --a------ C:\WINDOWS\system32\nvModes.dat
2008-02-07 13:03:22 0 d-------- C:\Program Files\NetWaiting
2008-02-06 12:34:10 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-01-31 23:54:10 0 d-------- C:\Documents and Settings\Ciaran O'Callarain\Application Data\Adobe
2008-01-31 12:46:26 0 d-------- C:\Documents and Settings\Ciaran O'Callarain\Application Data\PC Suite
2008-01-30 23:41:03 0 d-------- C:\Documents and Settings\Ciaran O'Callarain\Application Data\Skype
2008-01-30 22:10:27 0 d-------- C:\Program Files\SlySoft
2008-01-30 19:54:35 0 d-------- C:\Program Files\SopCast
2008-01-30 19:54:33 0 d-------- C:\Program Files\SetPoint
2008-01-30 19:44:47 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-01-30 19:36:36 0 d-------- C:\Program Files\Winamp
2008-01-30 18:09:34 0 d-------- C:\Program Files\DivX
2008-01-30 17:23:47 0 d-------- C:\Documents and Settings\Ciaran O'Callarain\Application Data\UseNeXT
2008-01-30 11:38:50 0 d-------- C:\Program Files\SonicWALL
2008-01-30 11:37:31 0 d-------- C:\Documents and Settings\Ciaran O'Callarain\Application Data\SonicWALL
2008-01-30 11:36:42 0 d-------- C:\Program Files\Common Files\Deterministic Networks
2008-01-30 09:04:38 0 d-------- C:\Program Files\id Software
2008-01-29 16:18:00 0 d-------- C:\Program Files\Skype
2008-01-29 16:17:58 0 d-------- C:\Program Files\Common Files
2008-01-27 13:53:28 536 --a------ C:\Program Files\CloneDVD2.lnk
2008-01-24 14:01:55 0 d-------- C:\Program Files\TomTomActivation
2008-01-24 12:46:38 0 d-------- C:\Program Files\TomTom HOME
2008-01-11 10:45:15 0 d-------- C:\Program Files\Activision
2008-01-09 21:39:45 0 d-------- C:\Documents and Settings\Ciaran O'Callarain\Application Data\SopCast
2007-12-27 12:39:47 0 d-------- C:\Program Files\TomTom DesktopSuite
2007-12-25 17:41:07 0 d-------- C:\Program Files\Online Services
2007-12-25 13:04:05 0 d-------- C:\Program Files\SystemRequirementsLab
2007-12-25 12:41:06 0 d-------- C:\Program Files\Steam
2007-12-25 12:38:28 0 d-------- C:\Documents and Settings\Ciaran O'Callarain\Application Data\CopyTrans
2007-12-25 11:18:08 0 d-------- C:\Program Files\WindSolutions
2007-12-21 23:20:48 0 d-------- C:\Documents and Settings\Ciaran O'Callarain\Application Data\uTorrent
2007-12-21 20:43:29 0 d-------- C:\Program Files\Electronic Arts
2007-12-21 00:52:32 526 --a------ C:\Documents and Settings\Ciaran O'Callarain\Application Data\NMM-MetaData.db
2007-12-20 19:35:26 0 d-------- C:\Program Files\Trend Micro
2007-12-12 12:36:52 0 d-------- C:\Documents and Settings\Ciaran O'Callarain\Application Data\Nokia
2007-12-12 12:30:32 0 d-------- C:\Program Files\DIFX
2007-12-12 12:30:14 0 d-------- C:\Program Files\Common Files\PCSuite
2007-12-12 12:30:14 0 d-------- C:\Program Files\Common Files\Nokia
2007-12-12 12:30:13 0 d-------- C:\Program Files\Nokia
2007-12-12 12:29:47 0 d-------- C:\Program Files\PC Connectivity Solution
2007-12-12 09:10:14 0 d-------- C:\Program Files\Midway Home Entertainment
2007-12-08 16:54:16 0 d-------- C:\Program Files\Java
2007-12-06 18:29:48 3101696 -----n--- C:\WINDOWS\system32\libavcodec.dll
2007-12-03 16:39:34 122880 --a------ C:\WINDOWS\system32\libmpeg2_ff.dll
2007-12-03 16:39:20 56320 --a------ C:\WINDOWS\system32\ff_unrar.dll
2007-12-03 16:38:54 188416 --a------ C:\WINDOWS\system32\ff_theora.dll
2007-12-03 16:38:30 135168 --a------ C:\WINDOWS\system32\ff_samplerate.dll
2007-12-03 16:38:24 118784 --a------ C:\WINDOWS\system32\ff_realaac.dll
2007-12-03 16:38:14 143360 --a------ C:\WINDOWS\system32\ff_libmad.dll
2007-12-03 16:37:44 54784 --a------ C:\WINDOWS\system32\ff_liba52.dll
2007-12-03 16:37:38 167936 --a------ C:\WINDOWS\system32\ff_libdts.dll
2007-12-03 16:34:32 26624 --a------ C:\WINDOWS\system32\ff_wmv9.dll
2007-12-03 16:34:26 7680 --a------ C:\WINDOWS\system32\ff_vfw.dll
2007-12-01 13:43:30 520192 --a------ C:\WINDOWS\system32\ff_x264.dll
2007-11-30 13:15:28 54 ---h----- C:\WINDOWS\popcreg.dat
2007-11-30 13:15:28 16 --a------ C:\WINDOWS\popcinfot.dat
2007-11-29 13:17:32 662016 --a------ C:\WINDOWS\system32\xvidcore.dll
2007-11-29 13:14:04 404992 --a------ C:\WINDOWS\system32\libmplayer.dll
2007-11-29 12:52:34 204800 --a------ C:\WINDOWS\system32\TomsMoComp_ff.dll
2007-11-29 12:52:34 204800 --a------ C:\WINDOWS\system32\ff_kernelDeint.dll
2007-11-22 21:02:02 0 -rahs---- C:\MSDOS.SYS
2007-11-22 21:02:02 0 -rahs---- C:\IO.SYS
2007-11-18 18:31:49 669184 --a------ C:\WINDOWS\system32\pbsvc.exe


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [01/05/2006 07:46]
"nwiz"="nwiz.exe" [01/05/2006 07:46 C:\WINDOWS\system32\nwiz.exe]
"NVHotkey"="nvHotkey.dll" [01/05/2006 07:46 C:\WINDOWS\system32\nvhotkey.dll]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [25/09/2007 01:11]
"SigmatelSysTrayApp"="stsystra.exe" [24/03/2006 23:30 C:\WINDOWS\stsystra.exe]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [08/03/2006 18:48]
"IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [01/05/2006 09:28]
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [01/05/2006 09:28]
"DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [08/09/2005 05:20]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [27/07/2004 16:50]
"PCMService"="C:\Program Files\Dell\MediaDirect\PCMService.exe" [22/08/2006 15:32]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [20/12/2005 17:38 C:\WINDOWS\KHALMNPR.Exe]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" []
"Dell QuickSet"="C:\Program Files\Dell\QuickSet\quickset.exe" [08/09/2006 15:43]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [27/07/2004 16:50]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [16/02/2007 09:54]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [21/01/2007 21:34]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [10/10/2007 18:51]
"TomTomHOME.exe"="C:\Program Files\TomTom HOME 2\HOMERunner.exe" [31/10/2007 10:19]
"BluetoothAuthorizationAgent"="C:\WINDOWS\system32\BluetoothAuthorizationAgent.exe" []
"XboxStat"="c:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe" [26/09/2007 18:05]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [07/02/2008 18:40]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ModemOnHold"="C:\Program Files\NetWaiting\netWaiting.exe" []
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [04/08/2004 05:00]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [13/10/2004 16:24]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [16/08/2007 11:24]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [27/02/2007 11:39]
"PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" [10/12/2007 10:12]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [24/05/2006 18:28:28]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [21/01/2000 08:15:54]
SetPoint.lnk - C:\Program Files\SetPoint\SetPoint.exe [06/01/2007 09:02:49]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [20/12/2006 12:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 27/02/2007 11:39 282624 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 nwprovau

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CleanUp]
c:\program files\mcafee.com\shared\mcappins.exe /v=3 /cleanup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDTray]
"C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Creative Detector]
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTSyncU.exe]
"C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eBayToolbar]
C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirtualCloneDrive]
"C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{28e98c02-0c74-11dc-8716-00188ba1e9e3}]
AutoRun\command- E:\autorun.exe

*Newly Created Service* - BANTEXT



-- End of Deckard's System Scanner: finished at 2008-02-08 15:26:54 ------------

[Rorschach112]

Your logs are clean ! We need to do a few things

You can delete the tools that we used


Now we need to create a new System Restore point.

Click Start Menu > Run > type (or copy and paste)

%SystemRoot%\System32\restore\rstrui.exe

Press OK. Choose Create a Restore Point then click Next. Name it and click Create, when the confirmation screen shows the restore point has been created click Close.

Next goto Start Menu > Run > type

cleanmgr

Click OK, Disk Cleanup will open and start calculating the amount of space that can be freed, Once thats finished it will open the Disk Cleanup options screen, click the More Options tab then click Clean up on the system restore area and choose Yes at the confirmation window which will remove all the restore points except the one we just created.

To close Disk Cleanup and remove the Temporary Internet Files detected in the initial scan click OK then choose Yes on the confirmation window.



Below I have included a number of recommendations for how to protect your computer against malware infections.

* Keep Windows updated by regularly checking their website at :
http://windowsupdate.microsoft.com/
This will ensure your computer has always the latest security updates available installed on your computer.

* To reduce re-infection for malware in the future, I strongly recommend installing these free programs:
SpywareBlaster protects against bad ActiveX
IE-SPYAD puts over 5000 sites in your restricted zone so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all
Have a look at this tutorial for IE-Spyad here

* SpywareGuard offers realtime protection from spyware installation attempts.

Make Internet Explorer more secure

• Click Start > Run
• Type Inetcpl.cpl & click OK
• Click on the Security tab
• Click Reset all zones to default level
• Make sure the Internet Zone is selected & Click Custom level
• In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
• Next Click OK, then Apply button and then OK to exit the Internet Properties page.

* MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.

* Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more
secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in pop up
blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from
Here

* Take a good look at the following suggestions for malware prevention by reading Tony Klein’s article 'How Did I Get Infected In The First Place'
Here

Thank you for your patience, and performing all of the procedures requested.

[cocolleran]

Hi Rorschach,
All done, you've been a legend with all your help.
Cheers mate!!