Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

Vista Antivirus 2008, PC Health, temp\install-privacy-danger.bat

Started by Byggarebob , Jul 12 2008 05:07 PM

  • This topic is locked This topic is locked

#1
Byggarebob
Posted 12 July 2008 - 05:07 PM

Byggarebob

    Member

  • Member
  • PipPip
  • 11 posts
Hey everybody! I need some help with some bad viruses i got :)

I think i have deleted the VAV virus but it seems to start when i start my pc. I havent looked at the regedit.

I maked a log file (main.txt) user DSS.exe (DSS)

I have a PCHEALTH folder in my C:\WINDOWS folder that i tried to delete but it says it cant delete "pchsvc.dll" because it runs in another program.

This is what i got:



Deckard's System Scanner v20071014.68
Run by Pizza on 2008-07-13 00:11:52
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Successfully created a Deckard's System Scanner Restore Point.


-- Last 5 Restore Point(s) --
5: 2008-07-12 22:11:56 UTC - RP5 - Deckard's System Scanner Restore Point
4: 2008-07-12 21:05:51 UTC - RP4 - Installed Ad-Aware
3: 2008-07-12 18:03:04 UTC - RP3 - Installation av osignerad drivrutin
2: 2008-07-12 17:57:32 UTC - RP2 - Last known good configuration
1: 2008-07-12 17:57:30 UTC - RP1 - Systemkontrollpunkt


Backed up registry hives.
Performed disk cleanup.



-- HijackThis Clone ------------------------------------------------------------


Emulating logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2008-07-13 00:14:44
Platform: Windows XP Service Pack 2 (5.01.2600)
MSIE: Internet Explorer (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\system32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program\Lavasoft\Ad-Aware\aawservice.exe
C:\Program\Alwil Software\Avast4\aswUpdSv.exe
C:\Program\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\explorer.exe
C:\Program\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program\Alwil Software\Avast4\ashMaiSv.exe
C:\Program\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program\Alwil Software\Avast4\ashDisp.exe
C:\Program\Kiwee Toolbar2\1.5.131\kwtbaim.exe
C:\Program\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program\Java\jre1.6.0_05\bin\jusched.exe
C:\Program\Logitech\GamePanel Software\LCD Manager\Applets\LCDClock.exe
C:\Program\Logitech\GamePanel Software\LCD Manager\Applets\LCDCountdown.exe
C:\Program\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\Program\Logitech\GamePanel Software\LCD Manager\Applets\LCDPop3.exe
C:\Program\Logitech\GamePanel Software\LCD Manager\Applets\LCDMedia.exe
C:\Program\Echovoice\Gamer Statistics\G15 Echovoice Gamer Statistics.exe
C:\WINDOWS\RTHDCPL.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program\Windows Live\Messenger\msnmsgr.exe
C:\Program\Messenger\msmsgs.exe
C:\Program\Skype\Phone\Skype.exe
C:\Program\Delade filer\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\Program\Skype\Plugin Manager\skypePM.exe
C:\Documents and Settings\Pizza\Skrivbord\dss.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\wscntfy.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar
R3 - URLSearchHook: Kiwee Toolbar - {6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - C:\Program\Kiwee Toolbar2\1.5.131\KiweeIEToolbar.dll
O2 - BHO: {c1c37022-a146-60fb-1de4-72a341b35fa1} - {1af53b14-3a27-4ed1-bf06-641a22073c1c} - C:\WINDOWS\system32\suqaah.dll
O2 - BHO: Kiwee Toolbar - {6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - C:\Program\Kiwee Toolbar2\1.5.131\KiweeIEToolbar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Windows Live inloggningshjälpen - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program\Delade filer\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {CE6F8AB9-45C2-4295-980E-259C5664E588} - C:\WINDOWS\system32\mLedDVnn.dll
O2 - BHO: (no name) - {F8AC36D7-F602-4B69-99B5-2A812E05779F} - C:\WINDOWS\system32\hgGayvtR.dll
O3 - Toolbar: Kiwee Toolbar - {6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - C:\Program\Kiwee Toolbar2\1.5.131\KiweeIEToolbar.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program\Adobe\/Adobe Contribute CS3/contributeieplugin.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program\Winamp Toolbar\winamptb.dll
O3 - Toolbar: sqvgnrpx - {7DABF7D4-47D9-42A8-8AA7-C74EC2E81F9A} - C:\WINDOWS\sqvgnrpx.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program\Logitech\GamePanel Software\LCD Manager\LCDMon.exe"
O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program\Logitech\GamePanel Software\G-series Software\LGDCore.exe" /SHOWHIDE
O4 - HKLM\..\Run: [avast!] C:\Program\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [KiweeHook] "C:\Program\Kiwee Toolbar2\1.5.131\kwtbaim.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [Adobe_ID0EYTHM] C:\Program\DELADE~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
O4 - HKLM\..\Run: [WinampAgent] C:\Program\Winamp\winampa.exe
O4 - HKLM\..\Run: [Echovoice Gamer Statistics] C:\Program\Echovoice\Gamer Statistics\G15 Echovoice Gamer Statistics.exe
O4 - HKLM\..\Run: [MsUpdate] C:\DOCUME~1\Pizza\LOKALA~1\Temp\\Setup_ver1.1427.0.exe
O4 - HKLM\..\Run: [Antivirus] C:\Program\VAV\vav.exe
O4 - HKLM\..\Run: [DelayLoad] C:\DOCUME~1\Pizza\LOKALA~1\Temp\atmadm2.exe
O4 - HKLM\..\Run: [Sys1.exe] C:\Windows\Sys1.exe
O4 - HKLM\..\Run: [Sys2.exe] C:\Windows\Sys2.exe
O4 - HKLM\..\Run: [Sys4.exe] C:\Windows\Sys4.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [2088de0d] rundll32.exe "C:\WINDOWS\system32\clcmagia.dll",b
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [Skype] "C:\Program\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Comrade.exe] C:\Program\GameSpy\Comrade\Comrade.exe
O4 - HKCU\..\Run: [Antivirus] C:\Program\VAV\vav.exe
O4 - HKCU\..\Run: [Sys1.exe] C:\Windows\Sys1.exe
O4 - HKCU\..\Run: [Sys2.exe] C:\Windows\Sys2.exe
O4 - HKCU\..\Run: [Sys4.exe] C:\Windows\Sys4.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: SetPointII.lnk = C:\Program\Logitech\SetPoint II\SetpointII.exe
O8 - Extra context menu item: &Clean Traces - C:\Program\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program\DAP\dapextie.htm
O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: Append to existing PDF - res://C:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Download &all with DAP - C:\Program\DAP\dapextie2.htm
O8 - Extra context menu item: E&xportera till Microsoft Excel - res://C:\Program\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Skicka till OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program\Microsoft Office\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Ski&cka till OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program\Microsoft Office\Office12\ONBttnIE.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O16 - DPF: CabBuilder () - http://kiw.imgag.com...llerControl.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://fpdownload.ma...director/sw.cab
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} () - http://fpdownload.ma...t/ultrashim.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program\Windows Live\Messenger\msgrapp.9.0.1407.1107.dll
O18 - Protocol: ms-help - {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program\Delade filer\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program\Windows Live\Messenger\msgrapp.9.0.1407.1107.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program\Delade filer\Skype\Skype4COM.dll
O18 - Filter: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program\Delade filer\Microsoft Shared\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: hgGayvtR - C:\WINDOWS\system32\hgGayvtR.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O21 - SSODL: fsrpknov - {1F78C1E7-7121-4D52-A4C7-EA35346AAE1E} - C:\WINDOWS\fsrpknov.dll
O21 - SSODL: fdxbameg - {75B64B61-787B-40CE-9AB2-239C846B63E7} - C:\WINDOWS\fdxbameg.dll (file missing)
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Adobe Version Cue CS3 - Adobe Systems Incorporated - C:\Program\Delade filer\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program\Delade filer\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O24 - Desktop Component 0: Privacy Protection - file:///C:\WINDOWS\privacy_danger\index.htm

--
End of file - 11836 bytes

-- File Associations -----------------------------------------------------------

.js - JSFile - DefaultIcon - "C:\Program\Adobe\Adobe Dreamweaver CS3\Dreamweaver.exe",7
.js - JSFile - shell\open\command - "C:\Program\Adobe\Adobe Dreamweaver CS3\Dreamweaver.exe","%1"


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R3 pcouffin (VSO Software pcouffin) - c:\windows\system32\drivers\pcouffin.sys <Not Verified; VSO Software; Patin couffin engine>

S3 xnacc (Microsoft Common Controller For Windows Driver Service) - c:\windows\system32\drivers\xnacc.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 Bonjour Service (##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##) - c:\program\bonjour\mdnsresponder.exe <Not Verified; Apple Computer, Inc.; Bonjour>
R3 FLEXnet Licensing Service - "c:\program\delade filer\macrovision shared\flexnet publisher\fnplicensingservice.exe" <Not Verified; Macrovision Europe Ltd.; FLEXnet Publisher (32 bit)>

S3 WLSetupSvc (Windows Live Setup Service) - "c:\program\windows live\installer\wlsetupsvc.exe" <Not Verified; Microsoft Corporation; Windows Live installer>


-- Device Manager: Disabled ----------------------------------------------------

Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description: SM-busstyrenhet
Device ID: PCI\VEN_8086&DEV_2930&SUBSYS_023D1028&REV_02\3&2411E6FE&0&FB
Manufacturer:
Name: SM-busstyrenhet
PNP Device ID: PCI\VEN_8086&DEV_2930&SUBSYS_023D1028&REV_02\3&2411E6FE&0&FB
Service:


-- Scheduled Tasks -------------------------------------------------------------

2008-05-27 20:04:53 106 --a------ C:\WINDOWS\Tasks\SesamTVMC.job


-- Files created between 2008-06-13 and 2008-07-13 -----------------------------

2008-07-12 23:05:54 0 d-------- C:\Program\Lavasoft
2008-07-12 23:05:53 0 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-07-12 19:58:03 116864 --a------ C:\WINDOWS\system32\suqaah.dll
2008-07-12 19:58:02 116864 --a------ C:\WINDOWS\system32\hacbxsqh.dll
2008-07-12 19:58:02 92672 --a------ C:\WINDOWS\system32\clcmagia.dll
2008-07-12 19:57:20 12644 --ahs---- C:\WINDOWS\system32\nnVDdeLm.ini2
2008-07-12 19:57:16 322816 --a------ C:\WINDOWS\system32\mLedDVnn.dll
2008-07-12 19:45:07 0 d-------- C:\WINDOWS\Prefetch
2008-07-12 18:52:03 33152 --a------ C:\WINDOWS\system32\xxyawWQH.dll
2008-07-12 18:52:02 33152 --a------ C:\WINDOWS\system32\efcYSlkH.dll
2008-07-12 13:57:08 33152 --a------ C:\WINDOWS\system32\pmnmljKe.dll
2008-07-12 13:57:07 33152 --a------ C:\WINDOWS\system32\hgGayvtR.dll
2008-07-12 13:56:00 155648 --a------ C:\WINDOWS\sqvgnrpx.dll
2008-07-12 13:56:00 180224 --a------ C:\WINDOWS\gpefaowr.exe
2008-07-12 13:56:00 274432 --a------ C:\WINDOWS\fsrpknov.dll
2008-07-12 13:56:00 163840 --a------ C:\WINDOWS\eonv.exe
2008-07-12 12:40:46 0 d-------- C:\Program\Sigma Production Inc
2008-07-12 11:53:47 0 d-------- C:\Program\Aspyr
2008-07-07 20:48:12 664 --a------ C:\WINDOWS\system32\d3d9caps.dat
2008-07-07 12:54:16 0 d-------- C:\Documents and Settings\Pizza\Application Data\vlc
2008-07-07 12:50:38 0 d-------- C:\Program\VideoLAN
2008-07-06 22:22:32 0 d-------- C:\Documents and Settings\Pizza\Tracing
2008-07-06 01:57:15 0 d-------- C:\Program\Windows Live Safety Center
2008-07-06 00:29:34 0 d-------- C:\Program\GameSpy
2008-07-06 00:28:44 0 d-------- C:\WINDOWS\system32\URTTEMP
2008-07-06 00:27:37 669184 --a------ C:\WINDOWS\system32\pbsvc.exe
2008-07-06 00:23:46 0 d-------- C:\Program\Electronic Arts
2008-07-05 18:15:14 0 d-------- C:\Program\Echovoice
2008-07-05 17:26:36 0 d-------- C:\Program\Winamp Toolbar
2008-07-05 17:26:36 0 d-------- C:\Documents and Settings\All Users\Application Data\Winamp Toolbar
2008-07-05 17:26:14 0 d-------- C:\Program\Winamp
2008-07-05 17:26:14 0 d-------- C:\Documents and Settings\Pizza\Application Data\Winamp
2008-07-05 15:42:57 21840 --a------ C:\WINDOWS\system32\SIntfNT.dll
2008-07-05 15:42:57 17212 --a------ C:\WINDOWS\system32\SIntf32.dll
2008-07-05 15:42:57 12067 --a------ C:\WINDOWS\system32\SIntf16.dll
2008-07-05 15:33:35 30592 --a------ C:\WINDOWS\DIIUnin.dat
2008-07-05 15:33:34 2829 --a------ C:\WINDOWS\DIIUnin.pif
2008-07-05 15:33:34 94208 --a------ C:\WINDOWS\DIIUnin.exe <Not Verified; Blizzard Entertainment; Diablo II Uninstaller>
2008-07-05 15:31:19 0 d-------- C:\Program\Diablo II
2008-07-05 15:13:29 0 d-------- C:\Diablo 2
2008-06-30 14:17:09 0 d-------- C:\CSS Skins
2008-06-30 14:14:27 0 --a------ C:\WINDOWS\nsreg.dat
2008-06-30 14:14:25 0 d-------- C:\Documents and Settings\Pizza\Application Data\Mozilla
2008-06-29 19:12:33 45056 --a------ C:\WINDOWS\system32\WNASPI32.DLL <Not Verified; Adaptec; Adaptec's ASPI Layer>
2008-06-29 19:12:33 16512 --a------ C:\WINDOWS\system32\drivers\ASPI32.SYS <Not Verified; Adaptec; Adaptec's ASPI Layer>
2008-06-29 19:12:23 0 d-------- C:\Program\ImTOO
2008-06-29 19:11:17 47360 --a------ C:\WINDOWS\system32\drivers\pcouffin.sys <Not Verified; VSO Software; Patin couffin engine>
2008-06-29 19:11:17 0 d-------- C:\Documents and Settings\Pizza\Application Data\Vso
2008-06-29 19:11:17 47360 --a------ C:\Documents and Settings\Pizza\Application Data\pcouffin.sys <Not Verified; VSO Software; Patin couffin engine>
2008-06-29 19:11:07 0 d-------- C:\Program\DVDFab Platinum 4
2008-06-27 20:42:38 0 d-------- C:\Program\GCFScape
2008-06-25 22:02:49 0 d-------- C:\Program\Game Extractor
2008-06-25 21:44:10 0 d-------- C:\dsbuff
2008-06-24 14:55:27 0 d-------- C:\Program\7-Zip
2008-06-22 13:40:54 0 d-------- C:\Program\MultiMedia Lab V
2008-06-22 13:40:24 307200 --a------ C:\WINDOWS\IsUn041d.exe <Not Verified; InstallShield Software Corporation; InstallShield® unInstaller>
2008-06-21 17:43:53 0 d-------- C:\Documents and Settings\Pizza\Application Data\CoreFTP
2008-06-21 17:43:27 0 d-------- C:\Program\CoreFTP
2008-06-21 17:33:00 0 d-------- C:\Documents and Settings\Pizza\Application Data\SmartFTP
2008-06-21 15:00:49 0 d-------- C:\Program\Whisper Technology
2008-06-20 19:21:02 0 d-------- C:\Documents and Settings\Pizza\Application Data\Media Player Classic
2008-06-20 18:56:52 0 d-------- C:\Program\BreakPoint Software
2008-06-18 11:46:47 0 d-------- C:\Program\WinAVI MP4 Converter
2008-06-13 19:43:22 0 d-------- C:\gh3temp
2008-06-13 19:23:33 0 d-------- C:\Program\GoldWave


-- Find3M Report ---------------------------------------------------------------

2008-07-13 00:03:36 0 d-------- C:\Documents and Settings\Pizza\Application Data\Skype
2008-07-13 00:02:08 0 d-------- C:\Documents and Settings\Pizza\Application Data\skypePM
2008-07-12 23:05:20 0 d-------- C:\Program\Delade filer\Wise Installation Wizard
2008-07-12 19:52:42 441280 --a------ C:\WINDOWS\system32\perfh01D.dat
2008-07-12 19:52:42 82930 --a------ C:\WINDOWS\system32\perfc01D.dat
2008-07-12 19:39:40 23468 --a------ C:\WINDOWS\system32\emptyregdb.dat
2008-07-12 12:49:47 0 d-------- C:\Documents and Settings\Pizza\Application Data\uTorrent
2008-07-12 00:26:10 0 d-------- C:\Documents and Settings\Pizza\Application Data\LimeWire
2008-07-06 22:20:38 0 d-------- C:\Program\Windows Live
2008-07-05 23:12:09 0 d-------- C:\Documents and Settings\Pizza\Application Data\Adobe
2008-07-02 12:20:21 0 d-------- C:\Documents and Settings\Pizza\Application Data\Publish Providers
2008-06-29 19:11:21 34 --a------ C:\Documents and Settings\Pizza\Application Data\pcouffin.log
2008-06-29 19:11:17 1144 --a------ C:\Documents and Settings\Pizza\Application Data\pcouffin.inf
2008-06-29 19:11:17 7887 --a------ C:\Documents and Settings\Pizza\Application Data\pcouffin.cat
2008-06-24 20:02:38 0 d-------- C:\Program\Realtek
2008-06-12 15:59:03 0 d--h----- C:\Program\InstallShield Installation Information
2008-06-12 15:55:19 0 d-------- C:\Program\Activision
2008-06-11 20:43:25 56 --ah----- C:\WINDOWS\system32\ezsidmv.dat
2008-06-11 20:41:53 0 d-------- C:\Program\Skype
2008-06-11 20:41:50 0 d-------- C:\Program\Delade filer
2008-06-11 20:41:50 0 d-------- C:\Program\Delade filer\Skype
2008-06-11 18:17:44 0 d-------- C:\Program\NINTENDO DS GAME BROWSER
2008-06-11 18:16:33 286720 --a------ C:\WINDOWS\Setup1.exe <Not Verified; Microsoft Corporation; Microsoft Visual Basic for Windows>
2008-06-11 18:16:32 73216 --a------ C:\WINDOWS\ST6UNST.EXE <Not Verified; Microsoft Corporation; Microsoft® Visual Basic for Windows>
2008-06-08 21:58:01 0 d-------- C:\Program\VentSrv
2008-06-08 21:45:25 0 d-------- C:\Program\Ventrilo Mix
2008-06-04 18:21:11 0 d-------- C:\Program\Guitar Pro 5
2008-05-31 11:35:32 0 d-------- C:\Program\Delade filer\Adobe
2008-05-31 11:34:07 0 d-------- C:\Program\Delade filer\Control Panels
2008-05-31 11:24:36 0 d-------- C:\Program\QuickTime
2008-05-31 11:15:39 0 d-------- C:\Program\Bonjour
2008-05-31 11:12:29 0 d-------- C:\Program\Delade filer\Macrovision Shared
2008-05-29 15:05:36 0 d-------- C:\Program\MSXML 6.0
2008-05-28 15:57:02 0 d-------- C:\Documents and Settings\Pizza\Application Data\Sony
2008-05-28 15:45:20 0 d-------- C:\Program\Sony
2008-05-28 15:40:11 0 d-------- C:\Program\MSBuild
2008-05-28 15:38:07 0 d-------- C:\Program\Reference Assemblies
2008-05-28 15:33:27 0 d-------- C:\Documents and Settings\Pizza\Application Data\Sony Setup
2008-05-28 15:33:19 0 d-------- C:\Program\Sony Setup
2008-05-27 21:17:53 0 d-------- C:\Program\Windows Media Connect 2
2008-05-27 17:10:27 0 d-------- C:\Program\K-Lite Codec Pack
2008-05-27 17:08:16 306629 --a------ C:\WINDOWS\SesamTV Media Center Uninstaller.exe
2008-05-27 16:48:33 0 d-------- C:\Program\Dusco
2008-05-26 17:51:27 0 d-------- C:\Documents and Settings\Pizza\Application Data\AccurateRip
2008-05-26 17:51:26 12890 --a------ C:\WINDOWS\system32\SpoonUninstall-dBpoweramp Music Converter.dat
2008-05-26 17:51:24 0 d-------- C:\Program\Illustrate
2008-05-24 22:05:06 0 d-------- C:\Documents and Settings\Pizza\Application Data\Sun
2008-05-24 22:04:44 0 d-------- C:\Program\Java
2008-05-23 20:31:47 0 d-------- C:\Program\LimeWire
2008-05-23 20:31:08 0 d-------- C:\Program\Delade filer\Java
2008-05-22 12:31:50 0 dr-h----- C:\Documents and Settings\Pizza\Application Data\SecuROM
2008-05-21 16:09:16 0 d-------- C:\Program\DAEMON Tools Lite
2008-05-21 15:39:47 0 d-------- C:\Documents and Settings\Pizza\Application Data\Leadertech
2008-05-21 15:39:46 0 d-------- C:\Program\Delade filer\Logishrd
2008-05-21 15:39:09 0 d-------- C:\Program\Logitech
2008-05-20 23:07:40 0 d-------- C:\Program\DAP
2008-05-20 23:06:25 50688 --a------ C:\WINDOWS\system32\wbhelp2.dll <Not Verified; Stardock.Net, Inc; WindowBlinds for Win32 x86 machines>
2008-05-20 22:39:23 0 d-------- C:\Program\uTorrent
2008-05-20 22:13:49 0 d-------- C:\Program\Microsoft Works
2008-05-20 22:06:15 0 d-------- C:\Documents and Settings\Pizza\Application Data\DAEMON Tools
2008-05-20 20:34:11 0 d-------- C:\Program\Kiwee Toolbar2
2008-05-20 20:21:08 0 d-------- C:\Documents and Settings\Pizza\Application Data\ImgBurn
2008-05-20 20:14:06 0 d-------- C:\Program\ImgBurn
2008-05-20 16:40:40 0 d-------- C:\Documents and Settings\Pizza\Application Data\Ventrilo
2008-05-18 21:33:08 0 d-------- C:\Program\Buggy
2008-05-18 21:25:56 0 d-------- C:\Program\Messenger
2008-05-18 20:55:10 0 d--hs--c- C:\Program\Delade filer\WindowsLiveInstaller
2008-05-18 16:35:13 0 d-------- C:\Documents and Settings\Pizza\Application Data\WinRAR
2008-05-18 16:20:31 0 d-------- C:\Program\Delade filer\ODBC
2008-05-18 16:20:29 0 d-------- C:\Program\Delade filer\SpeechEngines
2008-05-18 16:20:12 62 --ahs---- C:\Documents and Settings\Pizza\Application Data\desktop.ini
2008-05-18 14:57:39 0 d-------- C:\Program\Alwil Software
2008-05-18 14:49:01 315392 --a------ C:\WINDOWS\HideWin.exe <Not Verified; Realtek Semiconductor Corp.; HD Audio Hide windows program>
2008-05-18 14:46:18 0 d-------- C:\Program\Delade filer\InstallShield
2008-05-18 14:44:01 0 d-------- C:\Documents and Settings\Pizza\Application Data\Macromedia
2008-05-18 14:42:55 0 d-------- C:\Program\Intel
2008-05-18 14:41:42 0 d-------- C:\Program\Dell
2008-05-18 14:39:56 0 d-------- C:\Documents and Settings\Pizza\Application Data\Identities
2008-05-18 14:35:49 0 d-------- C:\Program\microsoft frontpage
2008-05-18 14:35:40 0 -rahs---- C:\MSDOS.SYS
2008-05-18 14:35:40 0 -rahs---- C:\IO.SYS
2008-05-18 14:35:40 0 --a------ C:\CONFIG.SYS
2008-05-18 14:35:40 0 --a------ C:\AUTOEXEC.BAT
2008-05-18 14:34:57 0 d--h----- C:\Program\WindowsUpdate
2008-05-18 14:34:54 0 d-------- C:\Program\Onlinetjänster
2008-05-18 14:34:21 0 d-------- C:\Program\Delade filer\MSSoap
2008-05-18 14:34:15 0 d-------- C:\Program\Movie Maker
2008-05-18 14:33:23 0 d-------- C:\Program\MSN Gaming Zone
2008-05-18 14:33:17 0 d-------- C:\Program\Windows NT
2008-05-03 05:46:00 1019904 --a------ C:\WINDOWS\system32\nvwimg.dll
2008-05-03 05:46:00 1703936 --a------ C:\WINDOWS\system32\nvwdmcpl.dll
2008-05-03 05:46:00 466944 --a------ C:\WINDOWS\system32\nvshell.dll
2008-05-03 05:46:00 1630208 --a------ C:\WINDOWS\system32\nwiz.exe
2008-05-03 05:46:00 1486848 --a------ C:\WINDOWS\system32\nview.dll
2008-05-03 05:46:00 1339392 --a------ C:\WINDOWS\system32\nvdspsch.exe
2008-05-03 05:46:00 442368 --a------ C:\WINDOWS\system32\nvappbar.exe
2008-05-03 05:46:00 425984 --a------ C:\WINDOWS\system32\keystone.exe


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1af53b14-3a27-4ed1-bf06-641a22073c1c}]
2008-07-12 19:58 116864 --a------ C:\WINDOWS\system32\suqaah.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6638A9DE-0745-4292-8A2E-AE530E7B9B3F}]
2008-04-03 10:52 265360 --a------ C:\Program\Kiwee Toolbar2\1.5.131\KiweeIEToolbar.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CE6F8AB9-45C2-4295-980E-259C5664E588}]
2008-07-12 19:57 322816 --a------ C:\WINDOWS\system32\mLedDVnn.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F8AC36D7-F602-4B69-99B5-2A812E05779F}]
2008-07-12 13:57 33152 --a------ C:\WINDOWS\system32\hgGayvtR.dll

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{6638A9DE-0745-4292-8A2E-AE530E7B9B3F}"= C:\Program\Kiwee Toolbar2\1.5.131\KiweeIEToolbar.dll [2008-04-03 10:52 265360]
"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program\Winamp Toolbar\winamptb.dll [2008-03-20 00:36 1267040]

[-HKEY_CLASSES_ROOT\CLSID\{6638A9DE-0745-4292-8A2E-AE530E7B9B3F}]
[HKEY_CLASSES_ROOT\KiweeIEToolbar.KiweeToolbar.1]
[HKEY_CLASSES_ROOT\TypeLib\{259EEB17-79AA-44DF-8410-8E55F82A902A}]
[HKEY_CLASSES_ROOT\KiweeIEToolbar.KiweeToolbar]

[-HKEY_CLASSES_ROOT\CLSID\{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-03 05:46]
"nwiz"="nwiz.exe" [2008-05-03 05:46 C:\WINDOWS\system32\nwiz.exe]
"Launch LCDMon"="C:\Program\Logitech\GamePanel Software\LCD Manager\LCDMon.exe" [2007-12-13 17:43]
"Launch LGDCore"="C:\Program\Logitech\GamePanel Software\G-series Software\LGDCore.exe" [2007-12-13 17:57]
"avast!"="C:\Program\ALWILS~1\Avast4\ashDisp.exe" [2008-05-16 01:19]
"KiweeHook"="C:\Program\Kiwee Toolbar2\1.5.131\kwtbaim.exe" [2008-04-03 10:51]
"GrooveMonitor"="C:\Program\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-07-17 17:39 C:\WINDOWS\KHALMNPR.Exe]
"SunJavaUpdateSched"="C:\Program\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25]
"Acrobat Assistant 8.0"="C:\Program\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2008-01-11 19:54]
"@"="" []
"Adobe_ID0EYTHM"="C:\Program\DELADE~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE" [2007-03-20 16:40]
"WinampAgent"="C:\Program\Winamp\winampa.exe" [2008-03-27 08:35]
"Echovoice Gamer Statistics"="C:\Program\Echovoice\Gamer Statistics\G15 Echovoice Gamer Statistics.exe" [2006-11-28 23:52]
"MsUpdate"="C:\DOCUME~1\Pizza\LOKALA~1\Temp\\Setup_ver1.1427.0.exe" []
"Antivirus"="C:\Program\VAV\vav.exe" []
"DelayLoad"="C:\DOCUME~1\Pizza\LOKALA~1\Temp\atmadm2.exe" []
"Sys1.exe"="C:\Windows\Sys1.exe" []
"Sys2.exe"="C:\Windows\Sys2.exe" []
"Sys4.exe"="C:\Windows\Sys4.exe" []
"RTHDCPL"="RTHDCPL.EXE" [2007-05-28 16:32 C:\WINDOWS\RTHDCPL.exe]
"Alcmtr"="ALCMTR.EXE" [2005-05-03 18:43 C:\WINDOWS\Alcmtr.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-03 05:46]
"2088de0d"="C:\WINDOWS\system32\clcmagia.dll" [2008-07-12 19:58]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-16 17:16]
"MsnMsgr"="C:\Program\Windows Live\Messenger\MsnMsgr.exe" [2007-11-07 15:34]
"MSMSGS"="C:\Program\Messenger\msmsgs.exe" [2004-10-13 18:24]
"DAEMON Tools Lite"="C:\Program\DAEMON Tools Lite\daemon.exe" [2008-04-01 11:39]
"Skype"="C:\Program\Skype\Phone\Skype.exe" [2008-05-30 15:54]
"Comrade.exe"="C:\Program\GameSpy\Comrade\Comrade.exe" [2007-06-29 15:03]
"Antivirus"="C:\Program\VAV\vav.exe" []
"Sys1.exe"="C:\Windows\Sys1.exe" []
"Sys2.exe"="C:\Windows\Sys2.exe" []
"Sys4.exe"="C:\Windows\Sys4.exe" []

C:\Documents and Settings\All Users\Start-meny\Program\Autostart\
SetPointII.lnk - C:\Program\Logitech\SetPoint II\SetpointII.exe [2007-08-30 18:13:06]

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
Source= file:///C:\WINDOWS\privacy_danger\index.htm
FriendlyName= Privacy Protection

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{F8AC36D7-F602-4B69-99B5-2A812E05779F}"= C:\WINDOWS\system32\hgGayvtR.dll [2008-07-12 13:57 33152]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"fsrpknov"= {1F78C1E7-7121-4D52-A4C7-EA35346AAE1E} - C:\WINDOWS\fsrpknov.dll [2008-07-12 11:33 274432]
"fdxbameg"= {75B64B61-787B-40CE-9AB2-239C846B63E7} - C:\WINDOWS\fdxbameg.dll [ ]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\hgGayvtR]
hgGayvtR.dll 2008-07-12 13:57 33152 C:\WINDOWS\system32\hgGayvtR.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\system32\mLedDVnn

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\clbdriver.sys]
@="driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""




-- End of Deckard's System Scanner: finished at 2008-07-13 00:15:23 ------------








EDIT: Here is the extra.txt:



Deckard's System Scanner v20071014.68
Extra logfile - please post this as an attachment with your post.
--------------------------------------------------------------------------------

-- System Information ----------------------------------------------------------

Microsoft Windows XP Home Edition (build 2600) SP 2.0
Architecture: X86; Language: Swedish

CPU 0: Intel® Core™2 Duo CPU E6850 @ 3.00GHz
CPU 1: Intel® Core™2 Duo CPU E6850 @ 3.00GHz
Percentage of Memory in Use: 18%
Physical Memory (total/avail): 3070.1 MiB / 2489.96 MiB
Pagefile Memory (total/avail): 4955.75 MiB / 4503.71 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1915.61 MiB

C: is Fixed (NTFS) - 288.04 GiB total, 57.09 GiB free.
D: is Fixed (NTFS) - 298.09 GiB total, 27.85 GiB free.
E: is Removable (No Media)
F: is Removable (No Media)
G: is Removable (No Media)
H: is Removable (No Media)
I: is Fixed (NTFS) - 10 GiB total, 6.11 GiB free.
J: is CDROM (CDFS)

\\.\PHYSICALDRIVE1 - Hitachi HDT725032VLA360 - 298.09 GiB - 1 partition
\PARTITION0 - Installerbart filsystem - 298.09 GiB - D:

\\.\PHYSICALDRIVE0 - SAMSUNG HD321KJ - 298.09 GiB - 3 partitions
\PARTITION0 - Unknown - 54.88 MiB
\PARTITION1 - Installerbart filsystem - 10 GiB - I:
\PARTITION2 (bootable) - Installerbart filsystem - 288.04 GiB - C:

\\.\PHYSICALDRIVE2 - TEAC USB HS-CF Card USB Device

\\.\PHYSICALDRIVE4 - TEAC USB HS-MS Card USB Device

\\.\PHYSICALDRIVE5 - TEAC USB HS-SD Card USB Device

\\.\PHYSICALDRIVE3 - TEAC USB HS-xD/SM USB Device



-- Security Center -------------------------------------------------------------

AUOptions is scheduled to auto-install.
Windows Internal Firewall is enabled.

FirstRunDisabled is set.

AV: avast! antivirus 4.8.1201 [VPS 080712-1] v4.8.1201 (ALWIL Software)

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program\\Windows Live\\Messenger\\livecall.exe"="C:\\Program\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\\Program\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program\\Windows Live\\Messenger\\wlcsdk.exe"="C:\\Program\\Windows Live\\Messenger\\wlcsdk.exe:*:Enabled:Windows Live Messenger (Phone)"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Steam\\SteamApps\\snakee93\\counter-strike source\\hl2.exe"="C:\\Steam\\SteamApps\\snakee93\\counter-strike source\\hl2.exe:*:Enabled:hl2"
"C:\\Program\\Windows Live\\Messenger\\livecall.exe"="C:\\Program\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"D:\\srcds\\srcds.exe"="D:\\srcds\\srcds.exe:*:Enabled:srcds"
"C:\\Steam\\Steam.exe"="C:\\Steam\\Steam.exe:*:Enabled:Steam"
"C:\\Program\\Microsoft Office\\Office12\\OUTLOOK.EXE"="C:\\Program\\Microsoft Office\\Office12\\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\\Program\\Microsoft Office\\Office12\\GROOVE.EXE"="C:\\Program\\Microsoft Office\\Office12\\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"C:\\Program\\Microsoft Office\\Office12\\ONENOTE.EXE"="C:\\Program\\Microsoft Office\\Office12\\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"C:\\Program\\uTorrent\\uTorrent.exe"="C:\\Program\\uTorrent\\uTorrent.exe:*:Enabled:µTorrent"
"C:\\Program\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"="C:\\Program\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe:*:Enabled:Call of Duty® 4 - Modern Warfare™ "
"D:\\Server\\srcds.exe"="D:\\Server\\srcds.exe:*:Enabled:srcds"
"C:\\Program\\Internet Explorer\\iexplore.exe"="C:\\Program\\Internet Explorer\\iexplore.exe:*:Enabled:Internet Explorer"
"C:\\Steam\\SteamApps\\snakee93\\day of defeat source beta\\hl2.exe"="C:\\Steam\\SteamApps\\snakee93\\day of defeat source beta\\hl2.exe:*:Enabled:hl2"
"C:\\Program\\Bonjour\\mDNSResponder.exe"="C:\\Program\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\\Program\\Delade filer\\Adobe\\Adobe Version Cue CS3\\Server\\bin\\VersionCueCS3.exe"="C:\\Program\\Delade filer\\Adobe\\Adobe Version Cue CS3\\Server\\bin\\VersionCueCS3.exe:*:Enabled:Adobe Version Cue CS3 Server"
"C:\\Steam\\SteamApps\\timbo_95\\counter-strike source\\hl2.exe"="C:\\Steam\\SteamApps\\timbo_95\\counter-strike source\\hl2.exe:*:Enabled:hl2"
"C:\\Steam\\SteamApps\\leo_93123\\counter-strike\\hl.exe"="C:\\Steam\\SteamApps\\leo_93123\\counter-strike\\hl.exe:*:Enabled:Half-Life Launcher"
"C:\\Program\\VentSrv\\ventrilo_srv.exe"="C:\\Program\\VentSrv\\ventrilo_srv.exe:*:Enabled:ventrilo_srv"
"D:\\srcdsIID\\srcds.exe"="D:\\srcdsIID\\srcds.exe:*:Enabled:srcds"
"C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"="C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe:*:Enabled:Fjärrhjälp - Windows Messenger och tal"
"C:\\Program\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"="C:\\Program\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe:*:Enabled:Crysis_32"
"C:\\Program\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"="C:\\Program\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe:*:Enabled:CrysisDedicatedServer_32"
"C:\\WINDOWS\\system32\\PnkBstrA.exe"="C:\\WINDOWS\\system32\\PnkBstrA.exe:*:Enabled:PnkBstrA"
"C:\\WINDOWS\\system32\\PnkBstrB.exe"="C:\\WINDOWS\\system32\\PnkBstrB.exe:*:Enabled:PnkBstrB"
"C:\\Program\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program\\Windows Live\\Messenger\\wlcsdk.exe"="C:\\Program\\Windows Live\\Messenger\\wlcsdk.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\\Program\\Aspyr\\Guitar Hero III\\GH3.exe"="C:\\Program\\Aspyr\\Guitar Hero III\\GH3.exe:*:Enabled:Guitar Hero III"
"C:\\Program\\Skype\\Phone\\Skype.exe"="C:\\Program\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"
"C:\\Documents and Settings\\Pizza\\Skrivbord\\dss.exe"="C:\\Documents and Settings\\Pizza\\Skrivbord\\dss.exe:*:Enabled:dss.exe"


-- Environment Variables -------------------------------------------------------

ALLUSERSPROFILE=C:\Documents and Settings\All Users
APPDATA=C:\Documents and Settings\Pizza\Application Data
CLIENTNAME=Console
CommonProgramFiles=C:\Program\Delade filer
COMPUTERNAME=LEO
ComSpec=C:\WINDOWS\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Documents and Settings\Pizza
LOGONSERVER=\\LEO
NUMBER_OF_PROCESSORS=2
OS=Windows_NT
Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\system32\WBEM;C:\Program\Intel\DMIX
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 6 Model 15 Stepping 11, GenuineIntel
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=0f0b
ProgramFiles=C:\Program
PROMPT=$P$G
SESSIONNAME=Console
sourcesdk=c:\steam\steamapps\snakee93\sourcesdk
SystemDrive=C:
SystemRoot=C:\WINDOWS
TEMP=C:\DOCUME~1\Pizza\LOKALA~1\Temp
TMP=C:\DOCUME~1\Pizza\LOKALA~1\Temp
USERDOMAIN=LEO
USERNAME=Pizza
USERPROFILE=C:\Documents and Settings\Pizza
VProject=c:\steam\steamapps\snakee93\counter-strike source\cstrike
windir=C:\WINDOWS


-- User Profiles ---------------------------------------------------------------

Pizza (admin)
Familj (admin)


-- Add/Remove Programs ---------------------------------------------------------

--> MsiExec.exe /I{403EF592-953B-4794-BCEF-ECAB835C2095}
--> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
7-Zip 4.57 --> "C:\Program\7-Zip\Uninstall.exe"
Ad-Aware --> MsiExec.exe /I{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}
Add or Remove Adobe Creative Suite 3 Master Collection --> C:\Program\Delade filer\Adobe\Installers\4dcfd9b7e901b57f81f667144603236\Setup.exe
Adobe Acrobat 8.1.2 Security Update 1 (KB403742) -->
Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742) --> MsiExec.exe /X{6846389C-BAC0-4374-808E-B120F86AF5D7}
Adobe After Effects CS3 --> MsiExec.exe /I{EB0202F7-016A-410C-ADE4-40F848CCC661}
Adobe After Effects CS3 Presets --> MsiExec.exe /I{193EAFD0-1BAF-4FB4-B18F-79D5D6A4B285}
Adobe Anchor Service CS3 --> MsiExec.exe /I{90176341-0A8B-4CCC-A78D-F862228A6B95}
Adobe Asset Services CS3 --> MsiExec.exe /I{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}
Adobe Bridge CS3 --> MsiExec.exe /I{9C9824D9-9000-4373-A6A5-D0E5D4831394}
Adobe Bridge Start Meeting --> MsiExec.exe /I{08B32819-6EEF-4057-AEDA-5AB681A36A23}
Adobe BridgeTalk Plugin CS3 --> MsiExec.exe /I{B73CFB12-C814-4638-AFFD-7E3AAFAF0B4E}
Adobe Camera Raw 4.0 --> MsiExec.exe /I{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}
Adobe CMaps --> MsiExec.exe /I{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}
Adobe Color - Photoshop Specific --> MsiExec.exe /I{A2D81E70-2A98-4A08-A628-94388B063C5E}
Adobe Color Common Settings --> C:\Program\Delade filer\Adobe\Installers\6c8e2cb4fd241c55406016127a6ab2e\Setup.exe
Adobe Color Common Settings --> MsiExec.exe /I{6D4AC5A4-4CF9-4F90-8111-B9B53CE257BF}
Adobe Color EU Extra Settings --> MsiExec.exe /I{51846830-E7B2-4218-8968-B77F0FF475B8}
Adobe Color JA Extra Settings --> MsiExec.exe /I{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}
Adobe Color NA Recommended Settings --> MsiExec.exe /I{95655ED4-7CA5-46DF-907F-7144877A32E5}
Adobe Contribute CS3 --> MsiExec.exe /I{FC9E08AA-CD59-4C59-BEF9-87E05B9E37D7}
Adobe Creative Suite 3 Master Collection --> MsiExec.exe /I{8718DC03-D066-4957-94E5-50C3C5042E8E}
Adobe Default Language CS3 --> MsiExec.exe /I{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}
Adobe Device Central CS3 --> MsiExec.exe /I{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}
Adobe Dreamweaver CS3 --> MsiExec.exe /I{7C10F5C7-F00F-4BD3-A110-C7D240D2DD25}
Adobe Encore CS3 --> MsiExec.exe /I{54B2EAD9-A110-43F7-B010-2859A1BD2AFE}
Adobe Encore CS3 Codecs --> MsiExec.exe /I{B8B7A4D8-80E1-4DAE-BD33-7FD535BA3931}
Adobe ExtendScript Toolkit 2 --> C:\Program\Delade filer\Adobe\Installers\3e054d2218e7aa282c2369d939e58ff\Setup.exe
Adobe ExtendScript Toolkit 2 --> MsiExec.exe /I{24D7346D-D4B4-45E8-98EA-75EC14B42DD8}
Adobe Extension Manager CS3 --> MsiExec.exe /I{BE5F3842-8309-4754-92D5-83E02E6077A3}
Adobe Fireworks CS3 --> MsiExec.exe /I{7DFC1012-D346-46CE-B03E-FF79125AE029}
Adobe Flash CS3 --> MsiExec.exe /I{6B52140A-F189-4945-BFFC-DB3F00B8C589}
Adobe Flash Player 9 ActiveX --> MsiExec.exe /X{BC4F8E84-5E29-49EC-B4E7-E6F9CB50986C}
Adobe Flash Player ActiveX --> C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player Plugin --> C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Flash Video Encoder --> MsiExec.exe /I{2EFFFC71-1E66-454E-A6E6-CEEC800B96D2}
Adobe Fonts All --> MsiExec.exe /I{6ABE0BEE-D572-4FE8-B434-9E72A289431B}
Adobe Help Viewer CS3 --> MsiExec.exe /I{7ACFB90E-8FD0-4397-AD3A-5195412623A3}
Adobe Illustrator CS3 --> MsiExec.exe /I{F08E8D2E-F132-4742-9C87-D5FF223A016A}
Adobe InDesign CS3 --> MsiExec.exe /I{CB3F8375-B600-4B9F-83C9-238ED1E583FD}
Adobe InDesign CS3 Icon Handler --> MsiExec.exe /I{EA7B3CC4-366D-4CF6-8350-FD7A7034116E}
Adobe Linguistics CS3 --> MsiExec.exe /I{54793AA1-5001-42F4-ABB6-C364617C6078}
Adobe MotionPicture Color Files --> MsiExec.exe /I{6B708481-748A-4EB4-97C1-CD386244FF77}
Adobe PDF Library Files --> MsiExec.exe /I{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}
Adobe Photoshop CS3 --> MsiExec.exe /I{0046FA01-C5B9-4985-BACB-398DC480FC05}
Adobe Premiere Pro CS3 --> MsiExec.exe /I{58DCEEE5-532E-44F4-B1D7-A146EF9E9FDA}
Adobe Premiere Pro CS3 Functional Content --> MsiExec.exe /I{50F102CA-4BE2-41A9-9810-5BB05EB91B9A}
Adobe Premiere Pro CS3 Third Party Content --> MsiExec.exe /I{485ACF57-F364-440A-8496-E1E81C8FA1AA}
Adobe Setup --> MsiExec.exe /I{4458C442-7376-4CF9-AF58-E8CEA6722363}
Adobe Setup --> MsiExec.exe /I{64C1FA9A-FA94-4B6E-B3E4-8573738E4AD1}
Adobe Setup --> MsiExec.exe /I{B3C02EC1-A7B0-4987-9A43-8789426AAA7D}
Adobe Shockwave Player 11 --> C:\WINDOWS\system32\adobe\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Adobe\SHOCKW~1\Install.log
Adobe SING CS3 --> MsiExec.exe /I{B671CBFD-4109-4D35-9252-3062D3CCB7B2}
Adobe Soundbooth CS3 --> MsiExec.exe /I{A6B23EFA-6590-482C-A11F-5ACE1B91F5B9}
Adobe Soundbooth CS3 Codecs --> MsiExec.exe /I{0327FA9D-975C-448C-A086-577D57BB25B8}
Adobe Stock Photos CS3 --> MsiExec.exe /I{29E5EA97-5F74-4A57-B8B2-D4F169117183}
Adobe Type Support --> MsiExec.exe /I{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}
Adobe Update Manager CS3 --> MsiExec.exe /I{E69AE897-9E0B-485C-8552-7841F48D42D8}
Adobe WAS CS3 --> MsiExec.exe /I{C5BD220A-EFE8-48A5-B70E-9503D535FACE}
Adobe Version Cue CS3 Client --> MsiExec.exe /I{D0DFF92A-492E-4C40-B862-A74A173C25C5}
Adobe Version Cue CS3 Server {ko_KR} --> MsiExec.exe /I{1D58229F-C505-45CA-8223-F35F3A34B963}
Adobe Video Profiles --> MsiExec.exe /I{845A8DB9-8802-4FD3-9FE3-938A6C46A2EC}
Adobe WinSoft Linguistics Plugin --> MsiExec.exe /I{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}
Adobe XMP DVA Panels CS3 --> MsiExec.exe /I{0224CACC-994D-45F8-B973-D65056EA9C2F}
Adobe XMP Panels CS3 --> MsiExec.exe /I{D5A31AB1-345D-47C7-A87B-036A669F6DF1}
AHV content for Acrobat and Flash --> MsiExec.exe /I{6BBAA81D-6A7E-43AD-8889-2F002DCAAFDD}
µTorrent --> "C:\Program\uTorrent\uTorrent.exe" /UNINSTALL
avast! Antivirus --> C:\Program\Alwil Software\Avast4\aswRunDll.exe "C:\Program\Alwil Software\Avast4\Setup\setiface.dll",RunSetup
Buggy v0.1 Setup --> C:\WINDOWS\st6unst.exe -n "C:\Program\Buggy\ST6UNST.LOG"
Call of Duty® 4 - Modern Warfare™ --> C:\Program\InstallShield Installation Information\{E48469CC-635E-4FD5-A122-1497C286D217}\setup.exe -runfromtemp -l0x0409
Call of Duty® 4 - Modern Warfare™ 1.4 Patch --> C:\Program\InstallShield Installation Information\{3BD633E0-4BF8-4499-9149-88F0767D449C}\setup.exe -runfromtemp -l0x0409
Call of Duty® 4 - Modern Warfare™ 1.5 Multiplayer Patch --> C:\Program\InstallShield Installation Information\{8503C901-85D7-4262-88D2-8D8B2A7B08B8}\setup.exe -runfromtemp -l0x0409
Core FTP LE 2.1 --> C:\Program\CoreFTP\UNWISE.EXE C:\Program\CoreFTP\INSTALL.LOG
Counter-Strike --> "C:\Steam\steam.exe" steam://uninstall/10
Crysis® --> MsiExec.exe /I{000E79B7-E725-4F01-870A-C12942B7F8E4}
Day of Defeat: Source Beta --> "C:\Steam\steam.exe" steam://uninstall/302
dBpoweramp Music Converter --> "C:\WINDOWS\system32\SpoonUninstall.exe" <uninstall>C:\WINDOWS\system32\SpoonUninstall-dBpoweramp Music Converter.dat
Dell Resource CD --> MsiExec.exe /X{42929F0F-CE14-47AF-9FC7-FF297A603021}
Diablo II --> C:\WINDOWS\DIIUnin.exe C:\WINDOWS\DIIUnin.dat
Download Accelerator Plus (DAP) --> C:\Program\DAP\DAPREMOVE.EXE
DVDFab Platinum 4.1.2.0 Final by Team RES --> "C:\Program\DVDFab Platinum 4\unins000.exe"
Echovoice Gamer Statistics 1.14 --> "C:\Program\Echovoice\Gamer Statistics\UninstallEVGS.exe"
er100LT --> MsiExec.exe /I{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}
Fraps (remove only) --> "C:\Fraps\uninstall.exe"
Game Extractor 2.0 --> C:\Program\Game Extractor\uninst.exe
GCFScape 1.6.8 --> "C:\Program\GCFScape\unins000.exe"
GoldWave v5.25 --> "C:\Program\GoldWave\unstall.exe" "GoldWave v5.25" "C:\Program\GoldWave\unstall.log"
Guitar Hero III --> MsiExec.exe /I{0CE1A6C0-F3F7-49E6-8F9D-2431F9827441}
Guitar Hero Three Control Panel --> MsiExec.exe /X{D2D3F435-00D4-4864-8353-974639B5B5C2}
Guitar Pro 5.2 --> "C:\Program\Guitar Pro 5\unins000.exe"
Half-Life 2: Lost Coast --> "C:\Steam\steam.exe" steam://uninstall/340
Hex Workshop v5.1 --> MsiExec.exe /I{8F4BE727-08A2-4F90-88C3-46C9C71E7A34}
ImgBurn --> "C:\Program\ImgBurn\uninstall.exe"
ImTOO AVI to DVD Converter --> C:\Program\ImTOO\AVI to DVD Converter\Uninstall.exe
ImTOO DVD Ripper 4 --> C:\Program\ImTOO\DVD Ripper 4\Uninstall.exe
Intel® PRO Network Connections 12.1.12.0 --> MsiExec.exe /i{777CA40C-0206-4EF6-A0FC-618BF06BF8D0} ARPREMOVE=1
Java™ 6 Update 4 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160040}
Java™ 6 Update 5 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050}
K-Lite Codec Pack 3.9.0 Full --> "C:\Program\K-Lite Codec Pack\unins000.exe"
Ki

Attached Files


Edited by Byggarebob, 12 July 2008 - 05:11 PM.

  • 0

Advertisements

#2
kahdah
Posted 12 July 2008 - 05:11 PM

kahdah

    GeekU Teacher

  • Retired Staff
  • 15,822 posts
Hello Byggarebob

Welcome to G2Go. :)
=====================
Please disable your antivirus before running ComboFix.

Please visit this web page for instructions for downloading and running Combofix >ComboFix Instructions
We now suggest that you install the Windows Recovery Console.
The Windows recovery console will allow you to boot up into a special recovery mode that allows us to help you in the case that your computer has a problem after an attempted removal of malware.

Post the log from ComboFix when you've accomplished all of that, along with a new HijackThis log.
  • 0

#3
Byggarebob
Posted 12 July 2008 - 05:48 PM

Byggarebob

    Member

  • Topic Starter
  • Member
  • PipPip
  • 11 posts
This is the log i got from Combofix:




ComboFix 08-07-12.1 - Pizza 2008-07-13 1:18:10.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1053.18.2538 [GMT 2:00]
Running from: C:\Documents and Settings\Pizza\Skrivbord\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Pizza\Application Data\inst.exe
C:\install.exe
C:\WINDOWS\eonv.exe
C:\WINDOWS\fsrpknov.dll
C:\WINDOWS\gpefaowr.exe
C:\WINDOWS\sqvgnrpx.dll
C:\WINDOWS\system32\aigamclc.ini
C:\WINDOWS\system32\clcmagia.dll
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\nnVDdeLm.ini
C:\WINDOWS\system32\nnVDdeLm.ini2
C:\WINDOWS\system32\sex2.ico

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_CLBDRIVER
-------\Service_clbdriver


((((((((((((((((((((((((( Files Created from 2008-06-12 to 2008-07-12 )))))))))))))))))))))))))))))))
.

2008-07-13 00:11 . 2008-07-13 00:11 <KAT> d-------- C:\Deckard
2008-07-12 23:05 . 2008-07-12 23:05 <KAT> d-------- C:\Program\Lavasoft
2008-07-12 23:05 . 2008-07-12 23:11 <KAT> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-07-12 19:58 . 2008-07-12 19:58 116,864 --a------ C:\WINDOWS\system32\suqaah.dll
2008-07-12 19:58 . 2008-07-12 19:58 116,864 --a------ C:\WINDOWS\system32\hacbxsqh.dll
2008-07-12 19:57 . 2008-07-12 19:57 322,816 --a------ C:\WINDOWS\system32\mLedDVnn.dll
2008-07-12 19:41 . 2004-09-16 17:19 13,463,552 --a--c--- C:\WINDOWS\system32\dllcache\hwxjpn.dll
2008-07-12 19:40 . 2008-07-12 19:40 749 -rah----- C:\WINDOWS\WindowsShell.Manifest
2008-07-12 19:40 . 2008-07-12 19:40 749 -rah----- C:\WINDOWS\system32\wuaucpl.cpl.manifest
2008-07-12 19:40 . 2008-07-12 19:40 749 -rah----- C:\WINDOWS\system32\sapi.cpl.manifest
2008-07-12 19:40 . 2008-07-12 19:40 749 -rah----- C:\WINDOWS\system32\ncpa.cpl.manifest
2008-07-12 19:40 . 2008-07-12 19:40 488 -rah----- C:\WINDOWS\system32\logonui.exe.manifest
2008-07-12 19:28 . 2004-09-16 17:23 1,895,804 --a--c--- C:\WINDOWS\system32\dllcache\NT5.CAT
2008-07-12 19:02 . 2004-09-16 17:15 4,224 --a------ C:\WINDOWS\system32\beep.sys
2008-07-12 18:52 . 2008-07-12 18:52 33,152 --a------ C:\WINDOWS\system32\xxyawWQH.dll
2008-07-12 18:52 . 2008-07-12 18:52 33,152 --a------ C:\WINDOWS\system32\efcYSlkH.dll
2008-07-12 13:57 . 2008-07-12 13:57 33,152 --a------ C:\WINDOWS\system32\pmnmljKe.dll
2008-07-12 13:57 . 2008-07-12 13:57 33,152 --a------ C:\WINDOWS\system32\hgGayvtR.dll
2008-07-12 12:40 . 2008-07-12 12:40 <KAT> d-------- C:\Program\Sigma Production Inc
2008-07-12 11:53 . 2008-07-12 11:53 <KAT> d-------- C:\Program\Aspyr
2008-07-07 20:48 . 2008-07-07 20:48 664 --a------ C:\WINDOWS\system32\d3d9caps.dat
2008-07-07 12:54 . 2008-07-07 12:54 <KAT> d-------- C:\Documents and Settings\Pizza\Application Data\vlc
2008-07-07 12:50 . 2008-07-07 12:50 <KAT> d-------- C:\Program\VideoLAN
2008-07-06 22:22 . 2008-07-12 20:35 <KAT> d-------- C:\Documents and Settings\Pizza\Tracing
2008-07-06 01:57 . 2008-07-12 20:37 <KAT> d-------- C:\Program\Windows Live Safety Center
2008-07-06 00:29 . 2008-07-06 00:29 <KAT> d-------- C:\Program\GameSpy
2008-07-06 00:28 . 2008-07-06 00:28 <KAT> d-------- C:\WINDOWS\system32\URTTEMP
2008-07-06 00:27 . 2007-07-19 18:14 1,358,192 --a------ C:\WINDOWS\system32\D3DCompiler_35.dll
2008-07-06 00:27 . 2008-07-06 00:27 669,184 --a------ C:\WINDOWS\system32\pbsvc.exe
2008-07-06 00:27 . 2007-07-19 18:14 444,776 --a------ C:\WINDOWS\system32\d3dx10_35.dll
2008-07-06 00:27 . 2008-07-06 00:27 103,736 --a------ C:\WINDOWS\system32\PnkBstrB.exe
2008-07-06 00:27 . 2008-07-06 00:27 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe
2008-07-06 00:27 . 2008-07-06 00:27 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-07-06 00:27 . 2008-07-06 00:27 22,328 --a------ C:\Documents and Settings\Pizza\Application Data\PnkBstrK.sys
2008-07-06 00:23 . 2008-07-06 00:23 <KAT> d-------- C:\Program\Electronic Arts
2008-07-05 18:15 . 2008-07-05 18:15 <KAT> d-------- C:\Program\Echovoice
2008-07-05 17:26 . 2008-07-05 17:26 <KAT> d-------- C:\Program\Winamp Toolbar
2008-07-05 17:26 . 2008-07-05 17:26 <KAT> d-------- C:\Program\Winamp
2008-07-05 17:26 . 2008-07-05 17:32 <KAT> d-------- C:\Documents and Settings\Pizza\Application Data\Winamp
2008-07-05 17:26 . 2008-07-05 17:26 <KAT> d-------- C:\Documents and Settings\All Users\Application Data\Winamp Toolbar
2008-07-05 15:42 . 2008-07-05 15:42 21,840 --a------ C:\WINDOWS\system32\SIntfNT.dll
2008-07-05 15:42 . 2008-07-05 15:42 17,212 --a------ C:\WINDOWS\system32\SIntf32.dll
2008-07-05 15:42 . 2008-07-05 15:42 12,067 --a------ C:\WINDOWS\system32\SIntf16.dll
2008-07-05 15:33 . 2008-07-05 15:33 94,208 --a------ C:\WINDOWS\DIIUnin.exe
2008-07-05 15:33 . 2008-07-05 15:39 30,592 --a------ C:\WINDOWS\DIIUnin.dat
2008-07-05 15:33 . 2008-07-05 15:33 2,829 --a------ C:\WINDOWS\DIIUnin.pif
2008-07-05 15:31 . 2008-07-05 15:47 <KAT> d-------- C:\Program\Diablo II
2008-07-05 15:13 . 2008-07-05 15:15 <KAT> d-------- C:\Diablo 2
2008-07-04 14:45 . 2008-07-04 14:45 268 --ah----- C:\sqmdata02.sqm
2008-07-04 14:45 . 2008-07-04 14:45 244 --ah----- C:\sqmnoopt02.sqm
2008-06-30 14:17 . 2008-06-30 14:17 <KAT> d-------- C:\CSS Skins
2008-06-30 14:14 . 2008-06-30 14:14 0 --a------ C:\WINDOWS\nsreg.dat
2008-06-29 19:12 . 2008-06-29 19:12 <KAT> d-------- C:\Program\ImTOO
2008-06-29 19:12 . 2005-11-21 07:48 45,056 --a------ C:\WINDOWS\system32\WNASPI32.DLL
2008-06-29 19:12 . 2005-11-21 07:48 16,512 --a------ C:\WINDOWS\system32\drivers\ASPI32.SYS
2008-06-29 19:11 . 2008-06-29 19:11 <KAT> d-------- C:\Program\DVDFab Platinum 4
2008-06-29 19:11 . 2008-06-29 19:13 <KAT> d-------- C:\Documents and Settings\Pizza\Application Data\Vso
2008-06-29 19:11 . 2008-06-29 19:11 47,360 --a------ C:\WINDOWS\system32\drivers\pcouffin.sys
2008-06-29 19:11 . 2008-06-29 19:11 47,360 --a------ C:\Documents and Settings\Pizza\Application Data\pcouffin.sys
2008-06-27 20:42 . 2008-06-27 20:44 <KAT> d-------- C:\Program\GCFScape
2008-06-25 22:02 . 2008-06-25 22:02 <KAT> d-------- C:\Program\Game Extractor
2008-06-25 21:44 . 2008-06-25 21:45 <KAT> d-------- C:\dsbuff
2008-06-24 14:55 . 2008-06-24 14:55 <KAT> d-------- C:\Program\7-Zip
2008-06-22 13:41 . 1999-08-11 05:00 2,020,864 --a------ C:\WINDOWS\system32\VCL50.BPL
2008-06-22 13:41 . 1999-08-11 05:00 248,832 --a------ C:\WINDOWS\system32\VCLX50.BPL
2008-06-22 13:41 . 2000-01-24 05:01 241,664 --a------ C:\WINDOWS\system32\VCLIE50.BPL
2008-06-22 13:41 . 1999-08-11 05:00 101,888 --a------ C:\WINDOWS\system32\VCLJPG50.BPL
2008-06-22 13:41 . 1999-08-11 05:00 66,048 --a------ C:\WINDOWS\system32\vclsmp50.bpl
2008-06-22 13:40 . 2008-06-22 13:41 <KAT> d-------- C:\Program\MultiMedia Lab V
2008-06-22 13:40 . 1998-11-13 13:13 307,200 --a------ C:\WINDOWS\IsUn041d.exe
2008-06-22 12:22 . 2008-06-22 12:22 39,034 --a------ C:\logo.jpg
2008-06-21 17:43 . 2008-06-26 23:02 <KAT> d-------- C:\Program\CoreFTP
2008-06-21 17:43 . 2008-06-26 23:02 <KAT> d-------- C:\Documents and Settings\Pizza\Application Data\CoreFTP
2008-06-21 17:33 . 2008-06-21 17:33 <KAT> d-------- C:\Documents and Settings\Pizza\Application Data\SmartFTP
2008-06-21 15:00 . 2008-06-21 15:00 <KAT> d-------- C:\Program\Whisper Technology
2008-06-20 19:21 . 2008-06-20 19:21 <KAT> d-------- C:\Documents and Settings\Pizza\Application Data\Media Player Classic
2008-06-20 18:56 . 2008-06-20 18:56 <KAT> d-------- C:\Program\BreakPoint Software
2008-06-19 00:22 . 2008-06-19 00:22 268 --ah----- C:\sqmdata01.sqm
2008-06-19 00:22 . 2008-06-19 00:22 244 --ah----- C:\sqmnoopt01.sqm
2008-06-18 11:46 . 2008-06-18 11:46 <KAT> d-------- C:\Program\WinAVI MP4 Converter
2008-06-18 11:42 . 2008-06-18 11:43 38 --a------ C:\WINDOWS\avisplitter.INI
2008-06-18 00:16 . 2008-06-18 00:16 268 --ah----- C:\sqmdata00.sqm
2008-06-18 00:16 . 2008-06-18 00:16 244 --ah----- C:\sqmnoopt00.sqm
2008-06-14 13:32 . 2008-06-14 17:09 4,699,979,776 --a------ C:\Guitar.Hero.3.Stereo.USA.Wii.iso
2008-06-13 19:43 . 2008-06-14 15:30 <KAT> d-------- C:\gh3temp
2008-06-13 19:23 . 2008-06-13 19:23 <KAT> d-------- C:\Program\GoldWave

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-12 22:48 --------- d-----w C:\Documents and Settings\Pizza\Application Data\Skype
2008-07-12 22:46 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kiwee Toolbar2
2008-07-12 22:02 --------- d-----w C:\Documents and Settings\Pizza\Application Data\skypePM
2008-07-12 21:32 --------- d-----w C:\Program\WinRAR
2008-07-12 21:05 --------- d-----w C:\Program\Delade filer\Wise Installation Wizard
2008-07-12 18:37 --------- d-----w C:\Program\Windows Live Safety Center
2008-07-12 17:39 --------- d-----w C:\Program\Windows Media Player
2008-07-12 10:49 --------- d-----w C:\Documents and Settings\Pizza\Application Data\uTorrent
2008-07-12 10:10 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-07-11 22:26 --------- d-----w C:\Documents and Settings\Pizza\Application Data\LimeWire
2008-07-09 22:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-07-07 10:54 --------- d-----w C:\Documents and Settings\Pizza\Application Data\vlc
2008-07-07 10:50 --------- d-----w C:\Program\VideoLAN
2008-07-06 20:20 --------- d-----w C:\Program\Windows Live
2008-07-05 15:26 --------- d-----w C:\Program\Winamp Toolbar
2008-07-05 15:26 --------- d-----w C:\Program\Winamp
2008-07-02 10:20 --------- d-----w C:\Documents and Settings\Pizza\Application Data\Publish Providers
2008-06-29 17:13 --------- d-----w C:\Documents and Settings\Pizza\Application Data\Vso
2008-06-24 18:02 --------- d-----w C:\Program\Realtek
2008-06-12 13:59 --------- d--h--w C:\Program\InstallShield Installation Information
2008-06-12 13:55 --------- d-----w C:\Program\Activision
2008-06-11 18:41 --------- d-----w C:\Program\Skype
2008-06-11 18:41 --------- d-----w C:\Program\Delade filer\Skype
2008-06-11 18:41 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skype
2008-06-11 16:17 --------- d-----w C:\Program\NINTENDO DS GAME BROWSER
2008-06-11 16:16 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE
2008-06-11 16:16 286,720 ----a-w C:\WINDOWS\Setup1.exe
2008-06-08 19:58 --------- d-----w C:\Program\VentSrv
2008-06-08 19:45 --------- d-----w C:\Program\Ventrilo Mix
2008-06-04 16:21 --------- d-----w C:\Program\Guitar Pro 5
2008-05-31 09:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\FLEXnet
2008-05-31 09:35 --------- d-----w C:\Program\Delade filer\Adobe
2008-05-31 09:34 --------- d-----w C:\Program\Delade filer\Control Panels
2008-05-31 09:32 --------- d-----w C:\Documents and Settings\All Users\Application Data\ALM
2008-05-31 09:24 --------- d-----w C:\Program\QuickTime
2008-05-31 09:15 --------- d-----w C:\Program\Bonjour
2008-05-31 09:12 --------- d-----w C:\Program\Delade filer\Macrovision Shared
2008-05-29 13:05 --------- d-----w C:\Program\MSXML 6.0
2008-05-28 13:57 --------- d-----w C:\Documents and Settings\Pizza\Application Data\Sony
2008-05-28 13:45 --------- d-----w C:\Program\Sony
2008-05-28 13:45 --------- d-----w C:\Documents and Settings\All Users\Application Data\Sony
2008-05-28 13:40 --------- d-----w C:\Program\MSBuild
2008-05-28 13:38 --------- d-----w C:\Program\Reference Assemblies
2008-05-28 13:33 --------- d-----w C:\Program\Sony Setup
2008-05-28 13:33 --------- d-----w C:\Documents and Settings\Pizza\Application Data\Sony Setup
2008-05-27 19:17 --------- d-----w C:\Program\Windows Media Connect 2
2008-05-27 15:10 --------- d-----w C:\Program\K-Lite Codec Pack
2008-05-27 15:08 306,629 ----a-w C:\WINDOWS\SesamTV Media Center Uninstaller.exe
2008-05-27 14:48 --------- d-----w C:\Program\Dusco
2008-05-26 15:51 4,230,520 ----a-w C:\WINDOWS\system32\SpoonUninstall.exe
2008-05-26 15:51 --------- d-----w C:\Program\Illustrate
2008-05-26 15:51 --------- d-----w C:\Documents and Settings\Pizza\Application Data\AccurateRip
2008-05-24 20:04 --------- d-----w C:\Program\Java
2008-05-23 18:31 --------- d-----w C:\Program\LimeWire
2008-05-23 18:31 --------- d-----w C:\Program\Delade filer\Java
2008-05-22 10:31 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-05-22 10:31 --------- d--h--r C:\Documents and Settings\Pizza\Application Data\SecuROM
2008-05-21 14:09 --------- d-----w C:\Program\DAEMON Tools Lite
2008-05-21 13:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\LogiShrd
2008-05-21 13:39 0 ---ha-w C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-05-21 13:39 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
2008-05-21 13:39 --------- d-----w C:\Program\Logitech
2008-05-21 13:39 --------- d-----w C:\Program\Delade filer\Logishrd
2008-05-21 13:39 --------- d-----w C:\Documents and Settings\Pizza\Application Data\Leadertech
2008-05-20 21:07 --------- d-----w C:\Program\DAP
2008-05-20 21:06 50,688 ----a-w C:\WINDOWS\system32\wbhelp2.dll
2008-05-20 20:39 --------- d-----w C:\Program\uTorrent
2008-05-20 20:13 --------- d-----w C:\Program\Microsoft Works
2008-05-20 20:06 717,296 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-05-20 20:06 --------- d-----w C:\Documents and Settings\Pizza\Application Data\DAEMON Tools
2008-05-20 18:34 --------- d-----w C:\Program\Kiwee Toolbar2
2008-05-20 18:21 --------- d-----w C:\Documents and Settings\Pizza\Application Data\ImgBurn
2008-05-20 18:14 --------- d-----w C:\Program\ImgBurn
2008-05-20 14:40 --------- d-----w C:\Documents and Settings\Pizza\Application Data\Ventrilo
2008-05-18 19:33 --------- d-----w C:\Program\Buggy
2008-05-18 18:55 --------- dcsh--w C:\Program\Delade filer\WindowsLiveInstaller
2008-05-18 18:52 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-05-18 12:57 --------- d-----w C:\Program\Alwil Software
2008-05-18 12:53 --------- d-----w C:\Documents and Settings\All Users\Application Data\Logitech
2008-05-18 12:49 315,392 ----a-w C:\WINDOWS\HideWin.exe
2008-05-18 12:46 --------- d-----w C:\Program\Delade filer\InstallShield
2008-05-18 12:42 --------- d-----w C:\Program\Intel
2008-05-18 12:41 --------- d-----w C:\Program\Dell
2008-05-18 12:35 --------- d-----w C:\Program\microsoft frontpage
2008-05-18 12:34 --------- d--h--w C:\Program\WindowsUpdate
2008-05-18 12:34 --------- d-----w C:\Program\Onlinetjänster
2008-05-18 12:33 --------- d-----w C:\Program\Windows NT
2008-05-16 09:58 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe
2008-04-30 15:27 442,368 ----a-w C:\WINDOWS\system32\NVUNINST.EXE
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6638A9DE-0745-4292-8A2E-AE530E7B9B3F}]
2008-04-03 10:52 265360 --a------ C:\Program\Kiwee Toolbar2\1.5.131\KiweeIEToolbar.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{89BB8621-3737-48CF-8927-03F19B704ACE}]
2008-07-13 01:35 322816 --a------ C:\WINDOWS\system32\iifefGXo.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E7C67C0E-38EE-4E1F-90C6-60C46E022CF7}]
2008-07-12 19:57 322816 --a------ C:\WINDOWS\system32\mLedDVnn.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F8AC36D7-F602-4B69-99B5-2A812E05779F}]
2008-07-12 13:57 33152 --a------ C:\WINDOWS\system32\hgGayvtR.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ff2f15ac-c02b-4aef-aa45-fb3126bab528}]
2008-07-13 01:38 116864 --a------ C:\WINDOWS\system32\hulpaz.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{6638A9DE-0745-4292-8A2E-AE530E7B9B3F}"= "C:\Program\Kiwee Toolbar2\1.5.131\KiweeIEToolbar.dll" [2008-04-03 10:52 265360]

[HKEY_CLASSES_ROOT\clsid\{6638a9de-0745-4292-8a2e-ae530e7b9b3f}]
[HKEY_CLASSES_ROOT\KiweeIEToolbar.KiweeToolbar.1]
[HKEY_CLASSES_ROOT\TypeLib\{259EEB17-79AA-44DF-8410-8E55F82A902A}]
[HKEY_CLASSES_ROOT\KiweeIEToolbar.KiweeToolbar]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{6638A9DE-0745-4292-8A2E-AE530E7B9B3F}"= "C:\Program\Kiwee Toolbar2\1.5.131\KiweeIEToolbar.dll" [2008-04-03 10:52 265360]

[HKEY_CLASSES_ROOT\clsid\{6638a9de-0745-4292-8a2e-ae530e7b9b3f}]
[HKEY_CLASSES_ROOT\KiweeIEToolbar.KiweeToolbar.1]
[HKEY_CLASSES_ROOT\TypeLib\{259EEB17-79AA-44DF-8410-8E55F82A902A}]
[HKEY_CLASSES_ROOT\KiweeIEToolbar.KiweeToolbar]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-16 17:16 15360]
"MsnMsgr"="C:\Program\Windows Live\Messenger\MsnMsgr.Exe" [2007-11-07 15:34 3739672]
"MSMSGS"="C:\Program\Messenger\msmsgs.exe" [2004-10-13 18:24 1694208]
"DAEMON Tools Lite"="C:\Program\DAEMON Tools Lite\daemon.exe" [2008-04-01 11:39 486856]
"Skype"="C:\Program\Skype\Phone\Skype.exe" [2008-05-30 15:54 21718312]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-03 05:46 13529088]
"Launch LCDMon"="C:\Program\Logitech\GamePanel Software\LCD Manager\LCDMon.exe" [2007-12-13 17:43 2051096]
"Launch LGDCore"="C:\Program\Logitech\GamePanel Software\G-series Software\LGDCore.exe" [2007-12-13 17:57 2095640]
"KiweeHook"="C:\Program\Kiwee Toolbar2\1.5.131\kwtbaim.exe" [2008-04-03 10:51 56456]
"GrooveMonitor"="C:\Program\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47 31016]
"SunJavaUpdateSched"="C:\Program\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"Acrobat Assistant 8.0"="C:\Program\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2008-01-11 19:54 623992]
"Adobe_ID0EYTHM"="C:\Program\DELADE~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE" [2007-03-20 16:40 1884160]
"WinampAgent"="C:\Program\Winamp\winampa.exe" [2008-03-27 08:35 36352]
"Echovoice Gamer Statistics"="C:\Program\Echovoice\Gamer Statistics\G15 Echovoice Gamer Statistics.exe" [2006-11-28 23:52 53248]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-03 05:46 86016]
"2088de0d"="C:\WINDOWS\system32\rffudude.dll" [2008-07-13 01:37 92672]
"nwiz"="nwiz.exe" [2008-05-03 05:46 1630208 C:\WINDOWS\system32\nwiz.exe]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-07-17 17:39 55824 C:\WINDOWS\KHALMNPR.Exe]
"RTHDCPL"="RTHDCPL.EXE" [2007-05-28 16:32 16132608 C:\WINDOWS\RTHDCPL.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-16 17:16 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{F8AC36D7-F602-4B69-99B5-2A812E05779F}"= "C:\WINDOWS\system32\hgGayvtR.dll" [2008-07-12 13:57 33152]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\hgGayvtR]
2008-07-12 13:57 33152 C:\WINDOWS\system32\hgGayvtR.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.YV12"= yv12vfw.dll
"msacm.imc"= xbadpcm.acm

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 C:\WINDOWS\system32\iifefGXo

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Comrade.exe]
--a------ 2007-06-29 15:03 36864 C:\Program\GameSpy\Comrade\Comrade.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Steam\\SteamApps\\snakee93\\counter-strike source\\hl2.exe"=
"D:\\srcds\\srcds.exe"=
"C:\\Steam\\Steam.exe"=
"C:\\Program\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program\\Microsoft Office\\Office12\\GROOVE.EXE"=
"C:\\Program\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"C:\\Program\\uTorrent\\uTorrent.exe"=
"C:\\Program\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"D:\\Server\\srcds.exe"=
"C:\\Program\\Internet Explorer\\iexplore.exe"=
"C:\\Steam\\SteamApps\\snakee93\\day of defeat source beta\\hl2.exe"=
"C:\\Program\\Bonjour\\mDNSResponder.exe"=
"C:\\Program\\Delade filer\\Adobe\\Adobe Version Cue CS3\\Server\\bin\\VersionCueCS3.exe"=
"C:\\Steam\\SteamApps\\timbo_95\\counter-strike source\\hl2.exe"=
"C:\\Steam\\SteamApps\\leo_93123\\counter-strike\\hl.exe"=
"C:\\Program\\VentSrv\\ventrilo_srv.exe"=
"D:\\srcdsIID\\srcds.exe"=
"C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
"C:\\Program\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=
"C:\\Program\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
"C:\\WINDOWS\\system32\\PnkBstrA.exe"=
"C:\\WINDOWS\\system32\\PnkBstrB.exe"=
"C:\\Program\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program\\Windows Live\\Messenger\\wlcsdk.exe"=
"C:\\Program\\Aspyr\\Guitar Hero III\\GH3.exe"=
"C:\\Documents and Settings\\Pizza\\Skrivbord\\dss.exe"=
"C:\\Program\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3703:TCP"= 3703:TCP:Adobe Version Cue CS3 Server
"3704:TCP"= 3704:TCP:Adobe Version Cue CS3 Server
"50900:TCP"= 50900:TCP:Adobe Version Cue CS3 Server
"50901:TCP"= 50901:TCP:Adobe Version Cue CS3 Server

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 01:20]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16]

.
Contents of the 'Scheduled Tasks' folder
"2008-05-27 18:04:53 C:\WINDOWS\Tasks\SesamTVMC.job"
.
- - - - ORPHANS REMOVED - - - -

Toolbar-{7DABF7D4-47D9-42A8-8AA7-C74EC2E81F9A} - C:\WINDOWS\sqvgnrpx.dll
SSODL-fsrpknov-{1F78C1E7-7121-4D52-A4C7-EA35346AAE1E} - C:\WINDOWS\fsrpknov.dll
SSODL-fdxbameg-{75B64B61-787B-40CE-9AB2-239C846B63E7} - C:\WINDOWS\fdxbameg.dll
MSConfigStartUp-Antivirus - C:\Program\VAV\vav.exe
MSConfigStartUp-DelayLoad - C:\DOCUME~1\Pizza\LOKALA~1\Temp\atmadm2.exe
MSConfigStartUp-MsUpdate - C:\DOCUME~1\Pizza\LOKALA~1\Temp\\Setup_ver1.1427.0.exe
MSConfigStartUp-Sys1 - C:\Windows\Sys1.exe
MSConfigStartUp-Sys2 - C:\Windows\Sys2.exe
MSConfigStartUp-Sys4 - C:\Windows\Sys4.exe


**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-13 01:30:45
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\hgGayvtR.dll

PROCESS: C:\WINDOWS\explorer.exe
-> C:\WINDOWS\system32\rffudude.dll
-> C:\WINDOWS\system32\iifefGXo.dll
.
------------------------ Other Running Processes ------------------------
.
C:\Program\Lavasoft\Ad-Aware\aawservice.exe
C:\Program\Alwil Software\Avast4\aswUpdSv.exe
C:\Program\Alwil Software\Avast4\ashServ.exe
C:\Program\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program\Alwil Software\Avast4\ashMaiSv.exe
C:\Program\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\cmd.exe
C:\Program\Logitech\GamePanel Software\LCD Manager\Applets\LCDClock.exe
C:\Program\Logitech\GamePanel Software\LCD Manager\Applets\LCDCountdown.exe
C:\Program\Logitech\GamePanel Software\LCD Manager\Applets\LCDPop3.exe
C:\Program\Logitech\GamePanel Software\LCD Manager\Applets\LCDMedia.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program\Delade filer\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2008-07-13 1:45:30 - machine was rebooted
ComboFix-quarantined-files.txt 2008-07-12 23:44:22

Pre-Run: 61,216,456,704 byte ledigt
Post-Run: 61,988,732,928 byte ledigt

363 --- E O F --- 2008-07-09 22:00:16
  • 0

#4
kahdah
Posted 12 July 2008 - 05:51 PM

kahdah

    GeekU Teacher

  • Retired Staff
  • 15,822 posts
We now suggest that you install the Windows Recovery Console. The Windows recovery console will allow you to boot up into a special recovery mode that allows us to help you in the case that your computer has a problem after an attempted removal of malware.

Go to Microsoft's website => http://support.microsoft.com/kb/310994
Select the download that's appropriate for your Operating System.


Posted Image


Download the file & save it as it's originally named, next to ComboFix.exe.



Posted Image


Now close all open windows and programs, then drag the setup package onto ComboFix.exe and drop it. Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Microsoft Recovery Console. When prompted to scan for infected files chose no, when done a log named CF_RC.txt will open. Please post the contents of that log.


Please do not reboot your machine until we have reviewed the log.
  • 0

#5
Byggarebob
Posted 13 July 2008 - 03:58 AM

Byggarebob

    Member

  • Topic Starter
  • Member
  • PipPip
  • 11 posts
Here is the log i got with the recovery console:





WindowsXP-KB310994-SP2-Home-BootDisk-SVE.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(3)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(3)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
  • 0

#6
kahdah
Posted 13 July 2008 - 05:58 AM

kahdah

    GeekU Teacher

  • Retired Staff
  • 15,822 posts
1. Please open Notepad
  • Click Start , then Run
  • type in notepad in the Run Box then hit ok.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

File::
C:\WINDOWS\system32\suqaah.dll
C:\WINDOWS\system32\hacbxsqh.dll
C:\WINDOWS\system32\mLedDVnn.dll
C:\WINDOWS\system32\dllcache\hwxjpn.dll
C:\WINDOWS\system32\xxyawWQH.dll
C:\WINDOWS\system32\efcYSlkH.dll
C:\WINDOWS\system32\pmnmljKe.dll
C:\WINDOWS\system32\hgGayvtR.dll
C:\WINDOWS\system32\iifefGXo.dll
C:\WINDOWS\system32\hulpaz.dll
C:\WINDOWS\system32\rffudude.dll
Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{89BB8621-3737-48CF-8927-03F19B704ACE}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E7C67C0E-38EE-4E1F-90C6-60C46E022CF7}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F8AC36D7-F602-4B69-99B5-2A812E05779F}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ff2f15ac-c02b-4aef-aa45-fb3126bab528}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"2088de0d"=-
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{F8AC36D7-F602-4B69-99B5-2A812E05779F}"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\hgGayvtR]


3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

Posted Image


5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
  • Combofix.txt
  • A new HijackThis log.

  • 0

#7
Byggarebob
Posted 13 July 2008 - 07:17 AM

Byggarebob

    Member

  • Topic Starter
  • Member
  • PipPip
  • 11 posts
Ok here is the Combofix log:


ComboFix 08-07-12.1 - Pizza 2008-07-13 14:41:34.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1053.18.2567 [GMT 2:00]
Running from: C:\Documents and Settings\Pizza\Skrivbord\ComboFix.exe
Command switches used :: C:\Documents and Settings\Pizza\Skrivbord\CFScript.txt
* Created a new restore point

FILE ::
C:\WINDOWS\system32\dllcache\hwxjpn.dll
C:\WINDOWS\system32\efcYSlkH.dll
C:\WINDOWS\system32\hacbxsqh.dll
C:\WINDOWS\system32\hgGayvtR.dll
C:\WINDOWS\system32\hulpaz.dll
C:\WINDOWS\system32\iifefGXo.dll
C:\WINDOWS\system32\mLedDVnn.dll
C:\WINDOWS\system32\pmnmljKe.dll
C:\WINDOWS\system32\rffudude.dll
C:\WINDOWS\system32\suqaah.dll
C:\WINDOWS\system32\xxyawWQH.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\cookies.ini
C:\WINDOWS\system32\dllcache\hwxjpn.dll
C:\WINDOWS\system32\eduduffr.ini
C:\WINDOWS\system32\efcYSlkH.dll
C:\WINDOWS\system32\hacbxsqh.dll
C:\WINDOWS\system32\hgGayvtR.dll
C:\WINDOWS\system32\hulpaz.dll
C:\WINDOWS\system32\mLedDVnn.dll
C:\WINDOWS\system32\mntoairw.ini
C:\WINDOWS\system32\nnVDdeLm.ini
C:\WINDOWS\system32\nnVDdeLm.ini2
C:\WINDOWS\system32\pmnmljKe.dll
C:\WINDOWS\system32\suqaah.dll
C:\WINDOWS\system32\wriaotnm.dll
C:\WINDOWS\system32\xxyawWQH.dll

.
((((((((((((((((((((((((( Files Created from 2008-06-13 to 2008-07-13 )))))))))))))))))))))))))))))))
.

2008-07-13 13:09 . 2008-07-13 13:09 116,864 --a------ C:\WINDOWS\system32\vrfqvmhy.dll
2008-07-13 13:09 . 2008-07-13 13:09 116,864 --a------ C:\WINDOWS\system32\moxlxt.dll
2008-07-13 01:45 . 2008-07-13 01:45 <KAT> d-------- C:\WINDOWS\system32\config\systemprofile\Lokala inställningar
2008-07-13 01:45 . 2008-07-13 01:45 <KAT> d-------- C:\Documents and Settings\Pizza\Lokala inställningar
2008-07-13 01:45 . 2008-07-13 01:45 <KAT> d-------- C:\Documents and Settings\NetworkService\Lokala inställningar
2008-07-13 01:45 . 2008-07-13 01:45 <KAT> d-------- C:\Documents and Settings\LocalService\Lokala inställningar
2008-07-13 01:45 . 2008-07-13 01:45 <KAT> d-------- C:\Documents and Settings\Familj\Lokala inställningar
2008-07-13 01:38 . 2008-07-13 01:38 116,864 --a------ C:\WINDOWS\system32\gqoisxfw.dll
2008-07-13 00:11 . 2008-07-13 00:11 <KAT> d-------- C:\Deckard
2008-07-12 23:05 . 2008-07-12 23:05 <KAT> d-------- C:\Program\Lavasoft
2008-07-12 23:05 . 2008-07-12 23:11 <KAT> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-07-12 19:41 . 2004-09-16 17:19 10,129,408 --a--c--- C:\WINDOWS\system32\dllcache\hwxkor.dll
2008-07-12 19:40 . 2008-07-12 19:40 749 -rah----- C:\WINDOWS\WindowsShell.Manifest
2008-07-12 19:40 . 2008-07-12 19:40 749 -rah----- C:\WINDOWS\system32\wuaucpl.cpl.manifest
2008-07-12 19:40 . 2008-07-12 19:40 749 -rah----- C:\WINDOWS\system32\sapi.cpl.manifest
2008-07-12 19:40 . 2008-07-12 19:40 749 -rah----- C:\WINDOWS\system32\ncpa.cpl.manifest
2008-07-12 19:40 . 2008-07-12 19:40 488 -rah----- C:\WINDOWS\system32\logonui.exe.manifest
2008-07-12 19:28 . 2004-09-16 17:23 1,895,804 --a--c--- C:\WINDOWS\system32\dllcache\NT5.CAT
2008-07-12 19:02 . 2004-09-16 17:15 4,224 --a------ C:\WINDOWS\system32\beep.sys
2008-07-12 12:40 . 2008-07-12 12:40 <KAT> d-------- C:\Program\Sigma Production Inc
2008-07-12 11:53 . 2008-07-12 11:53 <KAT> d-------- C:\Program\Aspyr
2008-07-07 20:48 . 2008-07-07 20:48 664 --a------ C:\WINDOWS\system32\d3d9caps.dat
2008-07-07 12:54 . 2008-07-07 12:54 <KAT> d-------- C:\Documents and Settings\Pizza\Application Data\vlc
2008-07-07 12:50 . 2008-07-07 12:50 <KAT> d-------- C:\Program\VideoLAN
2008-07-06 22:22 . 2008-07-13 13:06 <KAT> d-------- C:\Documents and Settings\Pizza\Tracing
2008-07-06 01:57 . 2008-07-12 20:37 <KAT> d-------- C:\Program\Windows Live Safety Center
2008-07-06 00:29 . 2008-07-06 00:29 <KAT> d-------- C:\Program\GameSpy
2008-07-06 00:28 . 2008-07-06 00:28 <KAT> d-------- C:\WINDOWS\system32\URTTEMP
2008-07-06 00:27 . 2007-07-19 18:14 1,358,192 --a------ C:\WINDOWS\system32\D3DCompiler_35.dll
2008-07-06 00:27 . 2008-07-06 00:27 669,184 --a------ C:\WINDOWS\system32\pbsvc.exe
2008-07-06 00:27 . 2007-07-19 18:14 444,776 --a------ C:\WINDOWS\system32\d3dx10_35.dll
2008-07-06 00:27 . 2008-07-06 00:27 103,736 --a------ C:\WINDOWS\system32\PnkBstrB.exe
2008-07-06 00:27 . 2008-07-06 00:27 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe
2008-07-06 00:27 . 2008-07-06 00:27 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-07-06 00:27 . 2008-07-06 00:27 22,328 --a------ C:\Documents and Settings\Pizza\Application Data\PnkBstrK.sys
2008-07-06 00:23 . 2008-07-06 00:23 <KAT> d-------- C:\Program\Electronic Arts
2008-07-05 18:15 . 2008-07-05 18:15 <KAT> d-------- C:\Program\Echovoice
2008-07-05 17:26 . 2008-07-05 17:26 <KAT> d-------- C:\Program\Winamp Toolbar
2008-07-05 17:26 . 2008-07-05 17:26 <KAT> d-------- C:\Program\Winamp
2008-07-05 17:26 . 2008-07-05 17:32 <KAT> d-------- C:\Documents and Settings\Pizza\Application Data\Winamp
2008-07-05 17:26 . 2008-07-05 17:26 <KAT> d-------- C:\Documents and Settings\All Users\Application Data\Winamp Toolbar
2008-07-05 15:42 . 2008-07-05 15:42 21,840 --a------ C:\WINDOWS\system32\SIntfNT.dll
2008-07-05 15:42 . 2008-07-05 15:42 17,212 --a------ C:\WINDOWS\system32\SIntf32.dll
2008-07-05 15:42 . 2008-07-05 15:42 12,067 --a------ C:\WINDOWS\system32\SIntf16.dll
2008-07-05 15:33 . 2008-07-05 15:33 94,208 --a------ C:\WINDOWS\DIIUnin.exe
2008-07-05 15:33 . 2008-07-05 15:39 30,592 --a------ C:\WINDOWS\DIIUnin.dat
2008-07-05 15:33 . 2008-07-05 15:33 2,829 --a------ C:\WINDOWS\DIIUnin.pif
2008-07-05 15:31 . 2008-07-05 15:47 <KAT> d-------- C:\Program\Diablo II
2008-07-05 15:13 . 2008-07-05 15:15 <KAT> d-------- C:\Diablo 2
2008-07-04 14:45 . 2008-07-04 14:45 268 --ah----- C:\sqmdata02.sqm
2008-07-04 14:45 . 2008-07-04 14:45 244 --ah----- C:\sqmnoopt02.sqm
2008-06-30 14:17 . 2008-06-30 14:17 <KAT> d-------- C:\CSS Skins
2008-06-30 14:14 . 2008-06-30 14:14 0 --a------ C:\WINDOWS\nsreg.dat
2008-06-29 19:12 . 2008-06-29 19:12 <KAT> d-------- C:\Program\ImTOO
2008-06-29 19:12 . 2005-11-21 07:48 45,056 --a------ C:\WINDOWS\system32\WNASPI32.DLL
2008-06-29 19:12 . 2005-11-21 07:48 16,512 --a------ C:\WINDOWS\system32\drivers\ASPI32.SYS
2008-06-29 19:11 . 2008-06-29 19:11 <KAT> d-------- C:\Program\DVDFab Platinum 4
2008-06-29 19:11 . 2008-06-29 19:13 <KAT> d-------- C:\Documents and Settings\Pizza\Application Data\Vso
2008-06-29 19:11 . 2008-06-29 19:11 47,360 --a------ C:\WINDOWS\system32\drivers\pcouffin.sys
2008-06-29 19:11 . 2008-06-29 19:11 47,360 --a------ C:\Documents and Settings\Pizza\Application Data\pcouffin.sys
2008-06-27 20:42 . 2008-06-27 20:44 <KAT> d-------- C:\Program\GCFScape
2008-06-25 22:02 . 2008-06-25 22:02 <KAT> d-------- C:\Program\Game Extractor
2008-06-25 21:44 . 2008-06-25 21:45 <KAT> d-------- C:\dsbuff
2008-06-24 14:55 . 2008-06-24 14:55 <KAT> d-------- C:\Program\7-Zip
2008-06-22 13:41 . 1999-08-11 05:00 2,020,864 --a------ C:\WINDOWS\system32\VCL50.BPL
2008-06-22 13:41 . 1999-08-11 05:00 248,832 --a------ C:\WINDOWS\system32\VCLX50.BPL
2008-06-22 13:41 . 2000-01-24 05:01 241,664 --a------ C:\WINDOWS\system32\VCLIE50.BPL
2008-06-22 13:41 . 1999-08-11 05:00 101,888 --a------ C:\WINDOWS\system32\VCLJPG50.BPL
2008-06-22 13:41 . 1999-08-11 05:00 66,048 --a------ C:\WINDOWS\system32\vclsmp50.bpl
2008-06-22 13:40 . 2008-06-22 13:41 <KAT> d-------- C:\Program\MultiMedia Lab V
2008-06-22 13:40 . 1998-11-13 13:13 307,200 --a------ C:\WINDOWS\IsUn041d.exe
2008-06-22 12:22 . 2008-06-22 12:22 39,034 --a------ C:\logo.jpg
2008-06-21 17:43 . 2008-06-26 23:02 <KAT> d-------- C:\Program\CoreFTP
2008-06-21 17:43 . 2008-06-26 23:02 <KAT> d-------- C:\Documents and Settings\Pizza\Application Data\CoreFTP
2008-06-21 17:33 . 2008-06-21 17:33 <KAT> d-------- C:\Documents and Settings\Pizza\Application Data\SmartFTP
2008-06-21 15:00 . 2008-06-21 15:00 <KAT> d-------- C:\Program\Whisper Technology
2008-06-20 19:21 . 2008-06-20 19:21 <KAT> d-------- C:\Documents and Settings\Pizza\Application Data\Media Player Classic
2008-06-20 18:56 . 2008-06-20 18:56 <KAT> d-------- C:\Program\BreakPoint Software
2008-06-19 00:22 . 2008-06-19 00:22 268 --ah----- C:\sqmdata01.sqm
2008-06-19 00:22 . 2008-06-19 00:22 244 --ah----- C:\sqmnoopt01.sqm
2008-06-18 11:46 . 2008-06-18 11:46 <KAT> d-------- C:\Program\WinAVI MP4 Converter
2008-06-18 11:42 . 2008-06-18 11:43 38 --a------ C:\WINDOWS\avisplitter.INI
2008-06-18 00:16 . 2008-06-18 00:16 268 --ah----- C:\sqmdata00.sqm
2008-06-18 00:16 . 2008-06-18 00:16 244 --ah----- C:\sqmnoopt00.sqm
2008-06-14 13:32 . 2008-06-14 17:09 4,699,979,776 --a------ C:\Guitar.Hero.3.Stereo.USA.Wii.iso
2008-06-13 19:43 . 2008-06-14 15:30 <KAT> d-------- C:\gh3temp
2008-06-13 19:23 . 2008-06-13 19:23 <KAT> d-------- C:\Program\GoldWave

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-13 12:38 --------- d-----w C:\Documents and Settings\Pizza\Application Data\Skype
2008-07-13 11:08 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kiwee Toolbar2
2008-07-13 09:50 --------- d-----w C:\Documents and Settings\Pizza\Application Data\skypePM
2008-07-12 21:32 --------- d-----w C:\Program\WinRAR
2008-07-12 21:05 --------- d-----w C:\Program\Delade filer\Wise Installation Wizard
2008-07-12 18:37 --------- d-----w C:\Program\Windows Live Safety Center
2008-07-12 17:39 --------- d-----w C:\Program\Windows Media Player
2008-07-12 10:49 --------- d-----w C:\Documents and Settings\Pizza\Application Data\uTorrent
2008-07-12 10:10 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-07-11 22:26 --------- d-----w C:\Documents and Settings\Pizza\Application Data\LimeWire
2008-07-09 22:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-07-07 10:54 --------- d-----w C:\Documents and Settings\Pizza\Application Data\vlc
2008-07-07 10:50 --------- d-----w C:\Program\VideoLAN
2008-07-06 20:20 --------- d-----w C:\Program\Windows Live
2008-07-05 15:26 --------- d-----w C:\Program\Winamp Toolbar
2008-07-05 15:26 --------- d-----w C:\Program\Winamp
2008-07-02 10:20 --------- d-----w C:\Documents and Settings\Pizza\Application Data\Publish Providers
2008-06-29 17:13 --------- d-----w C:\Documents and Settings\Pizza\Application Data\Vso
2008-06-24 18:02 --------- d-----w C:\Program\Realtek
2008-06-12 13:59 --------- d--h--w C:\Program\InstallShield Installation Information
2008-06-12 13:55 --------- d-----w C:\Program\Activision
2008-06-11 18:41 --------- d-----w C:\Program\Skype
2008-06-11 18:41 --------- d-----w C:\Program\Delade filer\Skype
2008-06-11 18:41 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skype
2008-06-11 16:17 --------- d-----w C:\Program\NINTENDO DS GAME BROWSER
2008-06-11 16:16 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE
2008-06-11 16:16 286,720 ----a-w C:\WINDOWS\Setup1.exe
2008-06-08 19:58 --------- d-----w C:\Program\VentSrv
2008-06-08 19:45 --------- d-----w C:\Program\Ventrilo Mix
2008-06-04 16:21 --------- d-----w C:\Program\Guitar Pro 5
2008-05-31 09:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\FLEXnet
2008-05-31 09:35 --------- d-----w C:\Program\Delade filer\Adobe
2008-05-31 09:34 --------- d-----w C:\Program\Delade filer\Control Panels
2008-05-31 09:32 --------- d-----w C:\Documents and Settings\All Users\Application Data\ALM
2008-05-31 09:24 --------- d-----w C:\Program\QuickTime
2008-05-31 09:15 --------- d-----w C:\Program\Bonjour
2008-05-31 09:12 --------- d-----w C:\Program\Delade filer\Macrovision Shared
2008-05-29 13:05 --------- d-----w C:\Program\MSXML 6.0
2008-05-28 13:57 --------- d-----w C:\Documents and Settings\Pizza\Application Data\Sony
2008-05-28 13:45 --------- d-----w C:\Program\Sony
2008-05-28 13:45 --------- d-----w C:\Documents and Settings\All Users\Application Data\Sony
2008-05-28 13:40 --------- d-----w C:\Program\MSBuild
2008-05-28 13:38 --------- d-----w C:\Program\Reference Assemblies
2008-05-28 13:33 --------- d-----w C:\Program\Sony Setup
2008-05-28 13:33 --------- d-----w C:\Documents and Settings\Pizza\Application Data\Sony Setup
2008-05-27 19:17 --------- d-----w C:\Program\Windows Media Connect 2
2008-05-27 15:10 --------- d-----w C:\Program\K-Lite Codec Pack
2008-05-27 15:08 306,629 ----a-w C:\WINDOWS\SesamTV Media Center Uninstaller.exe
2008-05-27 14:48 --------- d-----w C:\Program\Dusco
2008-05-26 15:51 --------- d-----w C:\Program\Illustrate
2008-05-26 15:51 --------- d-----w C:\Documents and Settings\Pizza\Application Data\AccurateRip
2008-05-24 20:04 --------- d-----w C:\Program\Java
2008-05-23 18:31 --------- d-----w C:\Program\LimeWire
2008-05-23 18:31 --------- d-----w C:\Program\Delade filer\Java
2008-05-22 10:31 --------- d--h--r C:\Documents and Settings\Pizza\Application Data\SecuROM
2008-05-21 14:09 --------- d-----w C:\Program\DAEMON Tools Lite
2008-05-21 13:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\LogiShrd
2008-05-21 13:39 0 ---ha-w C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-05-21 13:39 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
2008-05-21 13:39 --------- d-----w C:\Program\Logitech
2008-05-21 13:39 --------- d-----w C:\Program\Delade filer\Logishrd
2008-05-21 13:39 --------- d-----w C:\Documents and Settings\Pizza\Application Data\Leadertech
2008-05-20 21:07 --------- d-----w C:\Program\DAP
2008-05-20 20:39 --------- d-----w C:\Program\uTorrent
2008-05-20 20:13 --------- d-----w C:\Program\Microsoft Works
2008-05-20 20:06 717,296 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-05-20 20:06 --------- d-----w C:\Documents and Settings\Pizza\Application Data\DAEMON Tools
2008-05-20 18:34 --------- d-----w C:\Program\Kiwee Toolbar2
2008-05-20 18:21 --------- d-----w C:\Documents and Settings\Pizza\Application Data\ImgBurn
2008-05-20 18:14 --------- d-----w C:\Program\ImgBurn
2008-05-20 14:40 --------- d-----w C:\Documents and Settings\Pizza\Application Data\Ventrilo
2008-05-18 19:33 --------- d-----w C:\Program\Buggy
2008-05-18 18:55 --------- dcsh--w C:\Program\Delade filer\WindowsLiveInstaller
2008-05-18 18:52 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-05-18 12:57 --------- d-----w C:\Program\Alwil Software
2008-05-18 12:53 --------- d-----w C:\Documents and Settings\All Users\Application Data\Logitech
2008-05-18 12:49 315,392 ----a-w C:\WINDOWS\HideWin.exe
2008-05-18 12:46 --------- d-----w C:\Program\Delade filer\InstallShield
2008-05-18 12:42 --------- d-----w C:\Program\Intel
2008-05-18 12:41 --------- d-----w C:\Program\Dell
2008-05-18 12:35 --------- d-----w C:\Program\microsoft frontpage
2008-05-18 12:34 --------- d--h--w C:\Program\WindowsUpdate
2008-05-18 12:34 --------- d-----w C:\Program\Onlinetjänster
2008-05-18 12:33 --------- d-----w C:\Program\Windows NT
.

((((((((((((((((((((((((((((( snapshot@2008-07-13_ 1.43.24.32 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-07-12 23:29:52 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-07-13 12:51:00 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-07-12 23:36:53 10,558 ----a-w C:\WINDOWS\SoftwareDistribution\EventCache\{B1BCA7D1-85FF-4994-A78F-6C9F1466A94A}.bin
+ 2008-07-13 11:09:48 116,864 ----a-w C:\WINDOWS\system32\vrfqvmhy.dll
+ 2008-07-13 12:51:04 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_5dc.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6638A9DE-0745-4292-8A2E-AE530E7B9B3F}]
2008-04-03 10:52 265360 --a------ C:\Program\Kiwee Toolbar2\1.5.131\KiweeIEToolbar.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{69cf6595-5102-4af3-a3f8-e9b291c5086a}]
2008-07-13 13:09 116864 --a------ C:\WINDOWS\system32\moxlxt.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{6638A9DE-0745-4292-8A2E-AE530E7B9B3F}"= "C:\Program\Kiwee Toolbar2\1.5.131\KiweeIEToolbar.dll" [2008-04-03 10:52 265360]

[HKEY_CLASSES_ROOT\clsid\{6638a9de-0745-4292-8a2e-ae530e7b9b3f}]
[HKEY_CLASSES_ROOT\KiweeIEToolbar.KiweeToolbar.1]
[HKEY_CLASSES_ROOT\TypeLib\{259EEB17-79AA-44DF-8410-8E55F82A902A}]
[HKEY_CLASSES_ROOT\KiweeIEToolbar.KiweeToolbar]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{6638A9DE-0745-4292-8A2E-AE530E7B9B3F}"= "C:\Program\Kiwee Toolbar2\1.5.131\KiweeIEToolbar.dll" [2008-04-03 10:52 265360]

[HKEY_CLASSES_ROOT\clsid\{6638a9de-0745-4292-8a2e-ae530e7b9b3f}]
[HKEY_CLASSES_ROOT\KiweeIEToolbar.KiweeToolbar.1]
[HKEY_CLASSES_ROOT\TypeLib\{259EEB17-79AA-44DF-8410-8E55F82A902A}]
[HKEY_CLASSES_ROOT\KiweeIEToolbar.KiweeToolbar]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-16 17:16 15360]
"MsnMsgr"="C:\Program\Windows Live\Messenger\MsnMsgr.Exe" [2007-11-07 15:34 3739672]
"MSMSGS"="C:\Program\Messenger\msmsgs.exe" [2004-10-13 18:24 1694208]
"DAEMON Tools Lite"="C:\Program\DAEMON Tools Lite\daemon.exe" [2008-04-01 11:39 486856]
"Skype"="C:\Program\Skype\Phone\Skype.exe" [2008-05-30 15:54 21718312]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-03 05:46 13529088]
"Launch LCDMon"="C:\Program\Logitech\GamePanel Software\LCD Manager\LCDMon.exe" [2007-12-13 17:43 2051096]
"Launch LGDCore"="C:\Program\Logitech\GamePanel Software\G-series Software\LGDCore.exe" [2007-12-13 17:57 2095640]
"KiweeHook"="C:\Program\Kiwee Toolbar2\1.5.131\kwtbaim.exe" [2008-04-03 10:51 56456]
"GrooveMonitor"="C:\Program\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47 31016]
"SunJavaUpdateSched"="C:\Program\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"Acrobat Assistant 8.0"="C:\Program\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2008-01-11 19:54 623992]
"Adobe_ID0EYTHM"="C:\Program\DELADE~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE" [2007-03-20 16:40 1884160]
"WinampAgent"="C:\Program\Winamp\winampa.exe" [2008-03-27 08:35 36352]
"Echovoice Gamer Statistics"="C:\Program\Echovoice\Gamer Statistics\G15 Echovoice Gamer Statistics.exe" [2006-11-28 23:52 53248]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-03 05:46 86016]
"nwiz"="nwiz.exe" [2008-05-03 05:46 1630208 C:\WINDOWS\system32\nwiz.exe]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-07-17 17:39 55824 C:\WINDOWS\KHALMNPR.Exe]
"RTHDCPL"="RTHDCPL.EXE" [2007-05-28 16:32 16132608 C:\WINDOWS\RTHDCPL.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-16 17:16 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.YV12"= yv12vfw.dll
"msacm.imc"= xbadpcm.acm

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Comrade.exe]
--a------ 2007-06-29 15:03 36864 C:\Program\GameSpy\Comrade\Comrade.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Steam\\SteamApps\\snakee93\\counter-strike source\\hl2.exe"=
"D:\\srcds\\srcds.exe"=
"C:\\Steam\\Steam.exe"=
"C:\\Program\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program\\Microsoft Office\\Office12\\GROOVE.EXE"=
"C:\\Program\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"C:\\Program\\uTorrent\\uTorrent.exe"=
"C:\\Program\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"D:\\Server\\srcds.exe"=
"C:\\Program\\Internet Explorer\\iexplore.exe"=
"C:\\Steam\\SteamApps\\snakee93\\day of defeat source beta\\hl2.exe"=
"C:\\Program\\Bonjour\\mDNSResponder.exe"=
"C:\\Program\\Delade filer\\Adobe\\Adobe Version Cue CS3\\Server\\bin\\VersionCueCS3.exe"=
"C:\\Steam\\SteamApps\\timbo_95\\counter-strike source\\hl2.exe"=
"C:\\Steam\\SteamApps\\leo_93123\\counter-strike\\hl.exe"=
"C:\\Program\\VentSrv\\ventrilo_srv.exe"=
"D:\\srcdsIID\\srcds.exe"=
"C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
"C:\\Program\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=
"C:\\Program\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
"C:\\WINDOWS\\system32\\PnkBstrA.exe"=
"C:\\WINDOWS\\system32\\PnkBstrB.exe"=
"C:\\Program\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program\\Windows Live\\Messenger\\wlcsdk.exe"=
"C:\\Program\\Aspyr\\Guitar Hero III\\GH3.exe"=
"C:\\Documents and Settings\\Pizza\\Skrivbord\\dss.exe"=
"C:\\Program\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3703:TCP"= 3703:TCP:Adobe Version Cue CS3 Server
"3704:TCP"= 3704:TCP:Adobe Version Cue CS3 Server
"50900:TCP"= 50900:TCP:Adobe Version Cue CS3 Server
"50901:TCP"= 50901:TCP:Adobe Version Cue CS3 Server

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 01:20]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16]

.
Contents of the 'Scheduled Tasks' folder
"2008-05-27 18:04:53 C:\WINDOWS\Tasks\SesamTVMC.job"
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-13 14:51:26
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program\Lavasoft\Ad-Aware\aawservice.exe
C:\Program\Alwil Software\Avast4\aswUpdSv.exe
C:\Program\Alwil Software\Avast4\ashServ.exe
C:\Program\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program\Alwil Software\Avast4\ashMaiSv.exe
C:\Program\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program\Logitech\GamePanel Software\LCD Manager\Applets\LCDClock.exe
C:\Program\Logitech\GamePanel Software\LCD Manager\Applets\LCDCountdown.exe
C:\Program\Logitech\GamePanel Software\LCD Manager\Applets\LCDPop3.exe
C:\Program\Logitech\GamePanel Software\LCD Manager\Applets\LCDMedia.exe
C:\Program\Delade filer\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
.
**************************************************************************
.
Completion time: 2008-07-13 15:13:42 - machine was rebooted [Pizza]
ComboFix-quarantined-files.txt 2008-07-13 13:12:39
ComboFix2.txt 2008-07-12 23:45:31

Pre-Run: 61,787,123,712 byte ledigt
Post-Run: 61,697,839,104 byte ledigt

346 --- E O F --- 2008-07-13 12:55:18



And here are the hijackthis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:15:50, on 2008-07-13
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program\Lavasoft\Ad-Aware\aawservice.exe
C:\Program\Alwil Software\Avast4\aswUpdSv.exe
C:\Program\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program\Alwil Software\Avast4\ashMaiSv.exe
C:\Program\Alwil Software\Avast4\ashWebSv.exe
C:\Program\Kiwee Toolbar2\1.5.131\kwtbaim.exe
C:\Program\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program\Java\jre1.6.0_05\bin\jusched.exe
C:\Program\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\Program\Echovoice\Gamer Statistics\G15 Echovoice Gamer Statistics.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program\Messenger\msmsgs.exe
C:\Program\Logitech\GamePanel Software\LCD Manager\Applets\LCDClock.exe
C:\Program\Logitech\GamePanel Software\LCD Manager\Applets\LCDCountdown.exe
C:\Program\Logitech\GamePanel Software\LCD Manager\Applets\LCDPop3.exe
C:\Program\Logitech\GamePanel Software\LCD Manager\Applets\LCDMedia.exe
C:\Program\Delade filer\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program\Mozilla Firefox\firefox.exe
C:\Program\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar
R3 - URLSearchHook: Kiwee Toolbar - {6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - C:\Program\Kiwee Toolbar2\1.5.131\KiweeIEToolbar.dll
O2 - BHO: Kiwee Toolbar - {6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - C:\Program\Kiwee Toolbar2\1.5.131\KiweeIEToolbar.dll
O2 - BHO: {a6805c19-2b9e-8f3a-3fa4-20155956fc96} - {69cf6595-5102-4af3-a3f8-e9b291c5086a} - C:\WINDOWS\system32\moxlxt.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Windows Live inloggningshjälpen - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program\Delade filer\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Kiwee Toolbar - {6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - C:\Program\Kiwee Toolbar2\1.5.131\KiweeIEToolbar.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program\Adobe\/Adobe Contribute CS3/contributeieplugin.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program\Winamp Toolbar\winamptb.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program\Logitech\GamePanel Software\LCD Manager\LCDMon.exe"
O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program\Logitech\GamePanel Software\G-series Software\LGDCore.exe" /SHOWHIDE
O4 - HKLM\..\Run: [KiweeHook] "C:\Program\Kiwee Toolbar2\1.5.131\kwtbaim.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [Adobe_ID0EYTHM] C:\Program\DELADE~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
O4 - HKLM\..\Run: [WinampAgent] C:\Program\Winamp\winampa.exe
O4 - HKLM\..\Run: [Echovoice Gamer Statistics] C:\Program\Echovoice\Gamer Statistics\G15 Echovoice Gamer Statistics.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [Skype] "C:\Program\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKAL TJÄNST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Clean Traces - C:\Program\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program\DAP\dapextie.htm
O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: Append to existing PDF - res://C:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Download &all with DAP - C:\Program\DAP\dapextie2.htm
O8 - Extra context menu item: E&xportera till Microsoft Excel - res://C:\Program\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Skicka till OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Ski&cka till OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O16 - DPF: CabBuilder - http://kiw.imgag.com...llerControl.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program\DELADE~1\Skype\SKYPE4~1.DLL
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Adobe Version Cue CS3 - Adobe Systems Incorporated - C:\Program\Delade filer\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program\Delade filer\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

--
End of file - 9461 bytes

Edited by Byggarebob, 13 July 2008 - 07:19 AM.

  • 0

#8
kahdah
Posted 13 July 2008 - 07:29 AM

kahdah

    GeekU Teacher

  • Retired Staff
  • 15,822 posts
1. Please open Notepad
  • Click Start , then Run
  • Type notepad .exe in the Run Box.
2. Now copy/paste the entire content of the codebox below into the Notepad window:

http://www.geekstogo.com/forum/Vista-Antivirus-2008-PC-Health-tempinstall-privacy-danger-bat-t204892.html

Collect::
C:\WINDOWS\system32\vrfqvmhy.dll
C:\WINDOWS\system32\moxlxt.dll
C:\WINDOWS\system32\gqoisxfw.dll
Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{69cf6595-5102-4af3-a3f8-e9b291c5086a}]

3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

Posted Image


5. Additonally, ComboFix will generate the following files on your desktop
  • A zipped file on your desktop called Submit [Date Time].zip
  • And another file named - CF-Submit.htm
6. ComboFix may need to reboot to finish its work. Let it.

7. When CF has finished running, it will generate the ComboFix.log which will appear on your screen.

8. If CF-Submit.htm is detected, ComboFix will generate this message box:

Posted Image

Clicking OK will cause the machine's browser to load CF-Submit.htm

Posted Image

9. Click the "Browse" button and locate the Submit [Date Time].zip file on your desktop.
  • Click on the file to Select it.
  • Submit the file by clicking "OK"
10. Once the file has been submitted, please DELETE both files on your desktop.

11. Post the following reports/logs into your next reply:
  • Combofix.txt
  • A new HijackThis log (run after ComboFix has finished its work.)

  • 0

#9
Byggarebob
Posted 13 July 2008 - 07:45 AM

Byggarebob

    Member

  • Topic Starter
  • Member
  • PipPip
  • 11 posts
Ok here is the Combofix log :


ComboFix 08-07-12.1 - Pizza 2008-07-13 15:37:45.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1053.18.2532 [GMT 2:00]
Running from: C:\Documents and Settings\Pizza\Skrivbord\ComboFix.exe
Command switches used :: C:\Documents and Settings\Pizza\Skrivbord\CFScript.txt
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\gqoisxfw.dll
C:\WINDOWS\system32\moxlxt.dll
C:\WINDOWS\system32\vrfqvmhy.dll

.
((((((((((((((((((((((((( Files Created from 2008-06-13 to 2008-07-13 )))))))))))))))))))))))))))))))
.

2008-07-13 15:15 . 2008-07-13 15:15 <KAT> d-------- C:\Program\Trend Micro
2008-07-13 14:54 . 2008-07-13 14:55 <KAT> d-------- C:\WINDOWS\LastGood
2008-07-13 01:45 . 2008-07-13 15:13 <KAT> d-------- C:\WINDOWS\system32\config\systemprofile\Lokala instõllningar
2008-07-13 01:45 . 2008-07-13 15:13 <KAT> d-------- C:\Documents and Settings\Pizza\Lokala instõllningar
2008-07-13 01:45 . 2008-07-13 15:13 <KAT> d-------- C:\Documents and Settings\NetworkService\Lokala instõllningar
2008-07-13 01:45 . 2008-07-13 15:13 <KAT> d-------- C:\Documents and Settings\LocalService\Lokala instõllningar
2008-07-13 01:45 . 2008-07-13 15:13 <KAT> d-------- C:\Documents and Settings\Familj\Lokala instõllningar
2008-07-13 00:11 . 2008-07-13 00:11 <KAT> d-------- C:\Deckard
2008-07-12 23:05 . 2008-07-12 23:05 <KAT> d-------- C:\Program\Lavasoft
2008-07-12 23:05 . 2008-07-12 23:11 <KAT> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-07-12 19:41 . 2004-09-16 17:19 10,129,408 --a--c--- C:\WINDOWS\system32\dllcache\hwxkor.dll
2008-07-12 19:40 . 2008-07-12 19:40 749 -rah----- C:\WINDOWS\WindowsShell.Manifest
2008-07-12 19:40 . 2008-07-12 19:40 749 -rah----- C:\WINDOWS\system32\wuaucpl.cpl.manifest
2008-07-12 19:40 . 2008-07-12 19:40 749 -rah----- C:\WINDOWS\system32\sapi.cpl.manifest
2008-07-12 19:40 . 2008-07-12 19:40 749 -rah----- C:\WINDOWS\system32\ncpa.cpl.manifest
2008-07-12 19:40 . 2008-07-12 19:40 488 -rah----- C:\WINDOWS\system32\logonui.exe.manifest
2008-07-12 19:28 . 2004-09-16 17:23 1,895,804 --a--c--- C:\WINDOWS\system32\dllcache\NT5.CAT
2008-07-12 19:02 . 2004-09-16 17:15 4,224 --a------ C:\WINDOWS\system32\beep.sys
2008-07-12 12:40 . 2008-07-12 12:40 <KAT> d-------- C:\Program\Sigma Production Inc
2008-07-12 11:53 . 2008-07-12 11:53 <KAT> d-------- C:\Program\Aspyr
2008-07-07 20:48 . 2008-07-07 20:48 664 --a------ C:\WINDOWS\system32\d3d9caps.dat
2008-07-07 12:54 . 2008-07-07 12:54 <KAT> d-------- C:\Documents and Settings\Pizza\Application Data\vlc
2008-07-07 12:50 . 2008-07-07 12:50 <KAT> d-------- C:\Program\VideoLAN
2008-07-06 22:22 . 2008-07-13 15:21 <KAT> d-------- C:\Documents and Settings\Pizza\Tracing
2008-07-06 01:57 . 2008-07-12 20:37 <KAT> d-------- C:\Program\Windows Live Safety Center
2008-07-06 00:29 . 2008-07-06 00:29 <KAT> d-------- C:\Program\GameSpy
2008-07-06 00:28 . 2008-07-06 00:28 <KAT> d-------- C:\WINDOWS\system32\URTTEMP
2008-07-06 00:27 . 2007-07-19 18:14 1,358,192 --a------ C:\WINDOWS\system32\D3DCompiler_35.dll
2008-07-06 00:27 . 2008-07-06 00:27 669,184 --a------ C:\WINDOWS\system32\pbsvc.exe
2008-07-06 00:27 . 2007-07-19 18:14 444,776 --a------ C:\WINDOWS\system32\d3dx10_35.dll
2008-07-06 00:27 . 2008-07-06 00:27 103,736 --a------ C:\WINDOWS\system32\PnkBstrB.exe
2008-07-06 00:27 . 2008-07-06 00:27 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe
2008-07-06 00:27 . 2008-07-06 00:27 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-07-06 00:27 . 2008-07-06 00:27 22,328 --a------ C:\Documents and Settings\Pizza\Application Data\PnkBstrK.sys
2008-07-06 00:23 . 2008-07-06 00:23 <KAT> d-------- C:\Program\Electronic Arts
2008-07-05 18:15 . 2008-07-05 18:15 <KAT> d-------- C:\Program\Echovoice
2008-07-05 17:26 . 2008-07-05 17:26 <KAT> d-------- C:\Program\Winamp Toolbar
2008-07-05 17:26 . 2008-07-05 17:26 <KAT> d-------- C:\Program\Winamp
2008-07-05 17:26 . 2008-07-05 17:32 <KAT> d-------- C:\Documents and Settings\Pizza\Application Data\Winamp
2008-07-05 17:26 . 2008-07-05 17:26 <KAT> d-------- C:\Documents and Settings\All Users\Application Data\Winamp Toolbar
2008-07-05 15:42 . 2008-07-05 15:42 21,840 --a------ C:\WINDOWS\system32\SIntfNT.dll
2008-07-05 15:42 . 2008-07-05 15:42 17,212 --a------ C:\WINDOWS\system32\SIntf32.dll
2008-07-05 15:42 . 2008-07-05 15:42 12,067 --a------ C:\WINDOWS\system32\SIntf16.dll
2008-07-05 15:33 . 2008-07-05 15:33 94,208 --a------ C:\WINDOWS\DIIUnin.exe
2008-07-05 15:33 . 2008-07-05 15:39 30,592 --a------ C:\WINDOWS\DIIUnin.dat
2008-07-05 15:33 . 2008-07-05 15:33 2,829 --a------ C:\WINDOWS\DIIUnin.pif
2008-07-05 15:31 . 2008-07-05 15:47 <KAT> d-------- C:\Program\Diablo II
2008-07-05 15:13 . 2008-07-05 15:15 <KAT> d-------- C:\Diablo 2
2008-07-04 14:45 . 2008-07-04 14:45 268 --ah----- C:\sqmdata02.sqm
2008-07-04 14:45 . 2008-07-04 14:45 244 --ah----- C:\sqmnoopt02.sqm
2008-06-30 14:17 . 2008-06-30 14:17 <KAT> d-------- C:\CSS Skins
2008-06-30 14:14 . 2008-06-30 14:14 0 --a------ C:\WINDOWS\nsreg.dat
2008-06-29 19:12 . 2008-06-29 19:12 <KAT> d-------- C:\Program\ImTOO
2008-06-29 19:12 . 2005-11-21 07:48 45,056 --a------ C:\WINDOWS\system32\WNASPI32.DLL
2008-06-29 19:12 . 2005-11-21 07:48 16,512 --a------ C:\WINDOWS\system32\drivers\ASPI32.SYS
2008-06-29 19:11 . 2008-06-29 19:11 <KAT> d-------- C:\Program\DVDFab Platinum 4
2008-06-29 19:11 . 2008-06-29 19:13 <KAT> d-------- C:\Documents and Settings\Pizza\Application Data\Vso
2008-06-29 19:11 . 2008-06-29 19:11 47,360 --a------ C:\WINDOWS\system32\drivers\pcouffin.sys
2008-06-29 19:11 . 2008-06-29 19:11 47,360 --a------ C:\Documents and Settings\Pizza\Application Data\pcouffin.sys
2008-06-27 20:42 . 2008-06-27 20:44 <KAT> d-------- C:\Program\GCFScape
2008-06-25 22:02 . 2008-06-25 22:02 <KAT> d-------- C:\Program\Game Extractor
2008-06-25 21:44 . 2008-06-25 21:45 <KAT> d-------- C:\dsbuff
2008-06-24 14:55 . 2008-06-24 14:55 <KAT> d-------- C:\Program\7-Zip
2008-06-22 13:41 . 1999-08-11 05:00 2,020,864 --a------ C:\WINDOWS\system32\VCL50.BPL
2008-06-22 13:41 . 1999-08-11 05:00 248,832 --a------ C:\WINDOWS\system32\VCLX50.BPL
2008-06-22 13:41 . 2000-01-24 05:01 241,664 --a------ C:\WINDOWS\system32\VCLIE50.BPL
2008-06-22 13:41 . 1999-08-11 05:00 101,888 --a------ C:\WINDOWS\system32\VCLJPG50.BPL
2008-06-22 13:41 . 1999-08-11 05:00 66,048 --a------ C:\WINDOWS\system32\vclsmp50.bpl
2008-06-22 13:40 . 2008-06-22 13:41 <KAT> d-------- C:\Program\MultiMedia Lab V
2008-06-22 13:40 . 1998-11-13 13:13 307,200 --a------ C:\WINDOWS\IsUn041d.exe
2008-06-22 12:22 . 2008-06-22 12:22 39,034 --a------ C:\logo.jpg
2008-06-21 17:43 . 2008-06-26 23:02 <KAT> d-------- C:\Program\CoreFTP
2008-06-21 17:43 . 2008-06-26 23:02 <KAT> d-------- C:\Documents and Settings\Pizza\Application Data\CoreFTP
2008-06-21 17:33 . 2008-06-21 17:33 <KAT> d-------- C:\Documents and Settings\Pizza\Application Data\SmartFTP
2008-06-21 15:00 . 2008-06-21 15:00 <KAT> d-------- C:\Program\Whisper Technology
2008-06-20 19:21 . 2008-06-20 19:21 <KAT> d-------- C:\Documents and Settings\Pizza\Application Data\Media Player Classic
2008-06-20 18:56 . 2008-06-20 18:56 <KAT> d-------- C:\Program\BreakPoint Software
2008-06-19 00:22 . 2008-06-19 00:22 268 --ah----- C:\sqmdata01.sqm
2008-06-19 00:22 . 2008-06-19 00:22 244 --ah----- C:\sqmnoopt01.sqm
2008-06-18 11:46 . 2008-06-18 11:46 <KAT> d-------- C:\Program\WinAVI MP4 Converter
2008-06-18 11:42 . 2008-06-18 11:43 38 --a------ C:\WINDOWS\avisplitter.INI
2008-06-18 00:16 . 2008-06-18 00:16 268 --ah----- C:\sqmdata00.sqm
2008-06-18 00:16 . 2008-06-18 00:16 244 --ah----- C:\sqmnoopt00.sqm
2008-06-14 13:32 . 2008-06-14 17:09 4,699,979,776 --a------ C:\Guitar.Hero.3.Stereo.USA.Wii.iso
2008-06-13 19:43 . 2008-06-14 15:30 <KAT> d-------- C:\gh3temp
2008-06-13 19:23 . 2008-06-13 19:23 <KAT> d-------- C:\Program\GoldWave

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-13 13:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kiwee Toolbar2
2008-07-13 12:53 --------- d-----w C:\Documents and Settings\Pizza\Application Data\Skype
2008-07-13 09:50 --------- d-----w C:\Documents and Settings\Pizza\Application Data\skypePM
2008-07-12 21:32 --------- d-----w C:\Program\WinRAR
2008-07-12 21:05 --------- d-----w C:\Program\Delade filer\Wise Installation Wizard
2008-07-12 18:37 --------- d-----w C:\Program\Windows Live Safety Center
2008-07-12 17:39 --------- d-----w C:\Program\Windows Media Player
2008-07-12 10:49 --------- d-----w C:\Documents and Settings\Pizza\Application Data\uTorrent
2008-07-12 10:10 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-07-11 22:26 --------- d-----w C:\Documents and Settings\Pizza\Application Data\LimeWire
2008-07-09 22:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-07-07 10:54 --------- d-----w C:\Documents and Settings\Pizza\Application Data\vlc
2008-07-07 10:50 --------- d-----w C:\Program\VideoLAN
2008-07-06 20:20 --------- d-----w C:\Program\Windows Live
2008-07-05 15:26 --------- d-----w C:\Program\Winamp Toolbar
2008-07-05 15:26 --------- d-----w C:\Program\Winamp
2008-07-02 10:20 --------- d-----w C:\Documents and Settings\Pizza\Application Data\Publish Providers
2008-06-29 17:13 --------- d-----w C:\Documents and Settings\Pizza\Application Data\Vso
2008-06-24 18:02 --------- d-----w C:\Program\Realtek
2008-06-12 13:59 --------- d--h--w C:\Program\InstallShield Installation Information
2008-06-12 13:55 --------- d-----w C:\Program\Activision
2008-06-11 18:41 --------- d-----w C:\Program\Skype
2008-06-11 18:41 --------- d-----w C:\Program\Delade filer\Skype
2008-06-11 18:41 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skype
2008-06-11 16:17 --------- d-----w C:\Program\NINTENDO DS GAME BROWSER
2008-06-11 16:16 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE
2008-06-11 16:16 286,720 ----a-w C:\WINDOWS\Setup1.exe
2008-06-08 19:58 --------- d-----w C:\Program\VentSrv
2008-06-08 19:45 --------- d-----w C:\Program\Ventrilo Mix
2008-06-04 16:21 --------- d-----w C:\Program\Guitar Pro 5
2008-05-31 09:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\FLEXnet
2008-05-31 09:35 --------- d-----w C:\Program\Delade filer\Adobe
2008-05-31 09:34 --------- d-----w C:\Program\Delade filer\Control Panels
2008-05-31 09:32 --------- d-----w C:\Documents and Settings\All Users\Application Data\ALM
2008-05-31 09:24 --------- d-----w C:\Program\QuickTime
2008-05-31 09:15 --------- d-----w C:\Program\Bonjour
2008-05-31 09:12 --------- d-----w C:\Program\Delade filer\Macrovision Shared
2008-05-29 13:05 --------- d-----w C:\Program\MSXML 6.0
2008-05-28 13:57 --------- d-----w C:\Documents and Settings\Pizza\Application Data\Sony
2008-05-28 13:45 --------- d-----w C:\Program\Sony
2008-05-28 13:45 --------- d-----w C:\Documents and Settings\All Users\Application Data\Sony
2008-05-28 13:40 --------- d-----w C:\Program\MSBuild
2008-05-28 13:38 --------- d-----w C:\Program\Reference Assemblies
2008-05-28 13:33 --------- d-----w C:\Program\Sony Setup
2008-05-28 13:33 --------- d-----w C:\Documents and Settings\Pizza\Application Data\Sony Setup
2008-05-27 19:17 --------- d-----w C:\Program\Windows Media Connect 2
2008-05-27 15:10 --------- d-----w C:\Program\K-Lite Codec Pack
2008-05-27 15:08 306,629 ----a-w C:\WINDOWS\SesamTV Media Center Uninstaller.exe
2008-05-27 14:48 --------- d-----w C:\Program\Dusco
2008-05-26 15:51 4,230,520 ----a-w C:\WINDOWS\system32\SpoonUninstall.exe
2008-05-26 15:51 --------- d-----w C:\Program\Illustrate
2008-05-26 15:51 --------- d-----w C:\Documents and Settings\Pizza\Application Data\AccurateRip
2008-05-24 20:04 --------- d-----w C:\Program\Java
2008-05-23 18:31 --------- d-----w C:\Program\LimeWire
2008-05-23 18:31 --------- d-----w C:\Program\Delade filer\Java
2008-05-22 10:31 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-05-22 10:31 --------- d--h--r C:\Documents and Settings\Pizza\Application Data\SecuROM
2008-05-21 14:09 --------- d-----w C:\Program\DAEMON Tools Lite
2008-05-21 13:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\LogiShrd
2008-05-21 13:39 0 ---ha-w C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-05-21 13:39 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
2008-05-21 13:39 --------- d-----w C:\Program\Logitech
2008-05-21 13:39 --------- d-----w C:\Program\Delade filer\Logishrd
2008-05-21 13:39 --------- d-----w C:\Documents and Settings\Pizza\Application Data\Leadertech
2008-05-20 21:07 --------- d-----w C:\Program\DAP
2008-05-20 21:06 50,688 ----a-w C:\WINDOWS\system32\wbhelp2.dll
2008-05-20 20:39 --------- d-----w C:\Program\uTorrent
2008-05-20 20:13 --------- d-----w C:\Program\Microsoft Works
2008-05-20 20:06 717,296 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-05-20 20:06 --------- d-----w C:\Documents and Settings\Pizza\Application Data\DAEMON Tools
2008-05-20 18:34 --------- d-----w C:\Program\Kiwee Toolbar2
2008-05-20 18:21 --------- d-----w C:\Documents and Settings\Pizza\Application Data\ImgBurn
2008-05-20 18:14 --------- d-----w C:\Program\ImgBurn
2008-05-20 14:40 --------- d-----w C:\Documents and Settings\Pizza\Application Data\Ventrilo
2008-05-18 19:33 --------- d-----w C:\Program\Buggy
2008-05-18 18:55 --------- dcsh--w C:\Program\Delade filer\WindowsLiveInstaller
2008-05-18 18:52 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-05-18 12:57 --------- d-----w C:\Program\Alwil Software
2008-05-18 12:53 --------- d-----w C:\Documents and Settings\All Users\Application Data\Logitech
2008-05-18 12:49 315,392 ----a-w C:\WINDOWS\HideWin.exe
2008-05-18 12:46 --------- d-----w C:\Program\Delade filer\InstallShield
2008-05-18 12:42 --------- d-----w C:\Program\Intel
2008-05-18 12:41 --------- d-----w C:\Program\Dell
2008-05-18 12:35 --------- d-----w C:\Program\microsoft frontpage
2008-05-18 12:34 --------- d--h--w C:\Program\WindowsUpdate
2008-05-18 12:34 --------- d-----w C:\Program\Onlinetjänster
2008-05-18 12:33 --------- d-----w C:\Program\Windows NT
2008-05-16 09:58 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe
2008-04-30 15:27 442,368 ----a-w C:\WINDOWS\system32\NVUNINST.EXE
.

((((((((((((((((((((((((((((( snapshot@2008-07-13_ 1.43.24.32 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-07-12 23:29:52 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-07-13 12:51:00 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-07-13 12:57:15 20,474 ----a-w C:\WINDOWS\SoftwareDistribution\EventCache\{60B6A3D2-8C54-4385-A769-EAA6DD18C5AF}.bin
+ 2008-07-13 12:51:04 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_5dc.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6638A9DE-0745-4292-8A2E-AE530E7B9B3F}]
2008-04-03 10:52 265360 --a------ C:\Program\Kiwee Toolbar2\1.5.131\KiweeIEToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{6638A9DE-0745-4292-8A2E-AE530E7B9B3F}"= "C:\Program\Kiwee Toolbar2\1.5.131\KiweeIEToolbar.dll" [2008-04-03 10:52 265360]

[HKEY_CLASSES_ROOT\clsid\{6638a9de-0745-4292-8a2e-ae530e7b9b3f}]
[HKEY_CLASSES_ROOT\KiweeIEToolbar.KiweeToolbar.1]
[HKEY_CLASSES_ROOT\TypeLib\{259EEB17-79AA-44DF-8410-8E55F82A902A}]
[HKEY_CLASSES_ROOT\KiweeIEToolbar.KiweeToolbar]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{6638A9DE-0745-4292-8A2E-AE530E7B9B3F}"= "C:\Program\Kiwee Toolbar2\1.5.131\KiweeIEToolbar.dll" [2008-04-03 10:52 265360]

[HKEY_CLASSES_ROOT\clsid\{6638a9de-0745-4292-8a2e-ae530e7b9b3f}]
[HKEY_CLASSES_ROOT\KiweeIEToolbar.KiweeToolbar.1]
[HKEY_CLASSES_ROOT\TypeLib\{259EEB17-79AA-44DF-8410-8E55F82A902A}]
[HKEY_CLASSES_ROOT\KiweeIEToolbar.KiweeToolbar]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-16 17:16 15360]
"MsnMsgr"="C:\Program\Windows Live\Messenger\MsnMsgr.Exe" [2007-11-07 15:34 3739672]
"MSMSGS"="C:\Program\Messenger\msmsgs.exe" [2004-10-13 18:24 1694208]
"DAEMON Tools Lite"="C:\Program\DAEMON Tools Lite\daemon.exe" [2008-04-01 11:39 486856]
"Skype"="C:\Program\Skype\Phone\Skype.exe" [2008-05-30 15:54 21718312]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-03 05:46 13529088]
"Launch LCDMon"="C:\Program\Logitech\GamePanel Software\LCD Manager\LCDMon.exe" [2007-12-13 17:43 2051096]
"Launch LGDCore"="C:\Program\Logitech\GamePanel Software\G-series Software\LGDCore.exe" [2007-12-13 17:57 2095640]
"KiweeHook"="C:\Program\Kiwee Toolbar2\1.5.131\kwtbaim.exe" [2008-04-03 10:51 56456]
"GrooveMonitor"="C:\Program\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47 31016]
"SunJavaUpdateSched"="C:\Program\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"Acrobat Assistant 8.0"="C:\Program\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2008-01-11 19:54 623992]
"Adobe_ID0EYTHM"="C:\Program\DELADE~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE" [2007-03-20 16:40 1884160]
"WinampAgent"="C:\Program\Winamp\winampa.exe" [2008-03-27 08:35 36352]
"Echovoice Gamer Statistics"="C:\Program\Echovoice\Gamer Statistics\G15 Echovoice Gamer Statistics.exe" [2006-11-28 23:52 53248]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-03 05:46 86016]
"nwiz"="nwiz.exe" [2008-05-03 05:46 1630208 C:\WINDOWS\system32\nwiz.exe]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-07-17 17:39 55824 C:\WINDOWS\KHALMNPR.Exe]
"RTHDCPL"="RTHDCPL.EXE" [2007-05-28 16:32 16132608 C:\WINDOWS\RTHDCPL.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-16 17:16 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.YV12"= yv12vfw.dll
"msacm.imc"= xbadpcm.acm

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Comrade.exe]
--a------ 2007-06-29 15:03 36864 C:\Program\GameSpy\Comrade\Comrade.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Steam\\SteamApps\\snakee93\\counter-strike source\\hl2.exe"=
"D:\\srcds\\srcds.exe"=
"C:\\Steam\\Steam.exe"=
"C:\\Program\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program\\Microsoft Office\\Office12\\GROOVE.EXE"=
"C:\\Program\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"C:\\Program\\uTorrent\\uTorrent.exe"=
"C:\\Program\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"D:\\Server\\srcds.exe"=
"C:\\Program\\Internet Explorer\\iexplore.exe"=
"C:\\Steam\\SteamApps\\snakee93\\day of defeat source beta\\hl2.exe"=
"C:\\Program\\Bonjour\\mDNSResponder.exe"=
"C:\\Program\\Delade filer\\Adobe\\Adobe Version Cue CS3\\Server\\bin\\VersionCueCS3.exe"=
"C:\\Steam\\SteamApps\\timbo_95\\counter-strike source\\hl2.exe"=
"C:\\Steam\\SteamApps\\leo_93123\\counter-strike\\hl.exe"=
"C:\\Program\\VentSrv\\ventrilo_srv.exe"=
"D:\\srcdsIID\\srcds.exe"=
"C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
"C:\\Program\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=
"C:\\Program\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
"C:\\WINDOWS\\system32\\PnkBstrA.exe"=
"C:\\WINDOWS\\system32\\PnkBstrB.exe"=
"C:\\Program\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program\\Windows Live\\Messenger\\wlcsdk.exe"=
"C:\\Program\\Aspyr\\Guitar Hero III\\GH3.exe"=
"C:\\Documents and Settings\\Pizza\\Skrivbord\\dss.exe"=
"C:\\Program\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3703:TCP"= 3703:TCP:Adobe Version Cue CS3 Server
"3704:TCP"= 3704:TCP:Adobe Version Cue CS3 Server
"50900:TCP"= 50900:TCP:Adobe Version Cue CS3 Server
"50901:TCP"= 50901:TCP:Adobe Version Cue CS3 Server

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 01:20]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16]

.
Contents of the 'Scheduled Tasks' folder
"2008-05-27 18:04:53 C:\WINDOWS\Tasks\SesamTVMC.job"
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-13 15:38:27
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-07-13 15:40:22
ComboFix-quarantined-files.txt 2008-07-13 13:40:04
ComboFix2.txt 2008-07-13 13:13:43
ComboFix3.txt 2008-07-12 23:45:31

Pre-Run: 61,654,949,888 byte ledigt
Post-Run: 61,643,567,104 byte ledigt

306 --- E O F --- 2008-07-13 12:55:18



And here is the hijackthis log file


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:43:36, on 2008-07-13
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program\Lavasoft\Ad-Aware\aawservice.exe
C:\Program\Alwil Software\Avast4\aswUpdSv.exe
C:\Program\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program\Alwil Software\Avast4\ashMaiSv.exe
C:\Program\Alwil Software\Avast4\ashWebSv.exe
C:\Program\Kiwee Toolbar2\1.5.131\kwtbaim.exe
C:\Program\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program\Java\jre1.6.0_05\bin\jusched.exe
C:\Program\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\Program\Echovoice\Gamer Statistics\G15 Echovoice Gamer Statistics.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program\Messenger\msmsgs.exe
C:\Program\Logitech\GamePanel Software\LCD Manager\Applets\LCDClock.exe
C:\Program\Logitech\GamePanel Software\LCD Manager\Applets\LCDCountdown.exe
C:\Program\Delade filer\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\explorer.exe
C:\Program\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar
R3 - URLSearchHook: Kiwee Toolbar - {6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - C:\Program\Kiwee Toolbar2\1.5.131\KiweeIEToolbar.dll
O2 - BHO: Kiwee Toolbar - {6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - C:\Program\Kiwee Toolbar2\1.5.131\KiweeIEToolbar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Windows Live inloggningshjälpen - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program\Delade filer\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Kiwee Toolbar - {6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - C:\Program\Kiwee Toolbar2\1.5.131\KiweeIEToolbar.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program\Adobe\/Adobe Contribute CS3/contributeieplugin.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program\Winamp Toolbar\winamptb.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program\Logitech\GamePanel Software\LCD Manager\LCDMon.exe"
O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program\Logitech\GamePanel Software\G-series Software\LGDCore.exe" /SHOWHIDE
O4 - HKLM\..\Run: [KiweeHook] "C:\Program\Kiwee Toolbar2\1.5.131\kwtbaim.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [Adobe_ID0EYTHM] C:\Program\DELADE~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
O4 - HKLM\..\Run: [WinampAgent] C:\Program\Winamp\winampa.exe
O4 - HKLM\..\Run: [Echovoice Gamer Statistics] C:\Program\Echovoice\Gamer Statistics\G15 Echovoice Gamer Statistics.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [Skype] "C:\Program\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKAL TJÄNST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Clean Traces - C:\Program\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program\DAP\dapextie.htm
O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: Append to existing PDF - res://C:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Download &all with DAP - C:\Program\DAP\dapextie2.htm
O8 - Extra context menu item: E&xportera till Microsoft Excel - res://C:\Program\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Skicka till OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Ski&cka till OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O16 - DPF: CabBuilder - http://kiw.imgag.com...llerControl.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program\DELADE~1\Skype\SKYPE4~1.DLL
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Adobe Version Cue CS3 - Adobe Systems Incorporated - C:\Program\Delade filer\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program\Delade filer\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

--
End of file - 9164 bytes
  • 0

#10
kahdah
Posted 13 July 2008 - 08:48 AM

kahdah

    GeekU Teacher

  • Retired Staff
  • 15,822 posts
Please submit the following file to one of these online file scanners.
(All you have to do is copy and paste it in)

C:\WINDOWS\system32\dllcache\hwxkor.dll

Jotti File Scan
VirusTotal File Scan

This will produce a report after the scan is complete, please copy and paste those results in your next post.
  • 0

Advertisements

#11
Byggarebob
Posted 13 July 2008 - 09:05 AM

Byggarebob

    Member

  • Topic Starter
  • Member
  • PipPip
  • 11 posts
This is the results i got from VirusTotal File Scan:

Antivirus Version Senaste Uppdatering Resultat
Microsoft 1.3704 2008.07.13 -
Norman 5.80.02 2008.07.11 -
Prevx1 V2 2008.07.13 -
Övrig information
File size: 10129408 bytes
MD5...: e798c16b83cea34a143f8296c43a64b7
SHA1..: 2bb5e77d7d492633229b2166c846ab3b54931084
SHA256: 05d5e3ff62d8b96f2be1731d00b95fb56e623ef9690266821afc675a8cc53ec3
SHA512: 8289fac7fd470ee0c6dd56154ecc0eeb0f617f431ce0bfc6f4d3252f81239987
8903cee25d7c4949f39f600bf47b373246b745055f3e18605788a50914fcf7e1
PEiD..: Armadillo v1.xx - v2.xx
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x638a3ca5
timedatestamp.....: 0x3b97cf2c (Thu Sep 06 19:31:56 2001)
machinetype.......: 0x14c (I386)

( 5 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x187c3 0x19000 6.63 eab3d718e84ec25a3f3ddd5e057849cf
.rdata 0x1a000 0x1851 0x2000 4.57 5934b54bb7df7df7133205c42595bddd
.data 0x1c000 0x5728 0x4000 4.07 908fc0f5450538a3a325c44ad678002e
.rsrc 0x22000 0x981f90 0x982000 6.99 442f9efbdcb090b56ce6be2f8f463781
.reloc 0x9a4000 0x6bac 0x7000 1.10 8eaa3df107ab44796f4f428d17a75462

( 2 imports )
> ole32.dll: CoCreateInstance, CoTaskMemFree, CoInitialize
> KERNEL32.dll: TlsGetValue, LockResource, LoadResource, FindResourceW, SetLastError, HeapAlloc, HeapFree, GetCommandLineA, GetVersion, GetProcAddress, GetModuleHandleA, HeapDestroy, HeapCreate, VirtualFree, InitializeCriticalSection, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, ExitProcess, VirtualAlloc, HeapReAlloc, RaiseException, GetLastError, CloseHandle, WideCharToMultiByte, GetStringTypeA, GetStringTypeW, TerminateProcess, GetCurrentProcess, GetCurrentThreadId, TlsSetValue, TlsAlloc, TlsFree, SetHandleCount, GetStdHandle, GetFileType, GetStartupInfoA, GetModuleFileNameA, FreeEnvironmentStringsA, FreeEnvironmentStringsW, GetEnvironmentStrings, GetEnvironmentStringsW, WriteFile, InterlockedDecrement, InterlockedIncrement, SetStdHandle, FlushFileBuffers, SetFilePointer, RtlUnwind, LCMapStringW, GetCPInfo, GetACP, GetOEMCP, LoadLibraryA, MultiByteToWideChar, LCMapStringA

( 32 exports )
AddPenInputHRC, CreateCompatibleHRC, CreateInksetHRCRESULT, DestroyHRC, DestroyHRCRESULT, DestroyInkset, EndPenInputHRC, GetAlternateWordsHRCRESULT, GetBaselineHRCRESULT, GetInksetInterval, GetInksetIntervalCount, GetResultsHRC, GetSymbolCountHRCRESULT, GetSymbolsHRCRESULT, HwxALCPriority, HwxALCValid, HwxConfig, HwxCreate, HwxDestroy, HwxEndInput, HwxGetResults, HwxInput, HwxProcess, HwxResultsAvailable, HwxSetAbort, HwxSetContext, HwxSetGuide, HwxSetPartial, ProcessHRC, SetAlphabetHRC, SetGuideHRC, SymbolToCharacterW
  • 0

#12
kahdah
Posted 13 July 2008 - 09:17 AM

kahdah

    GeekU Teacher

  • Retired Staff
  • 15,822 posts
It appears that it did not finish.
There should be about 15 results from different Antivirus vendors.
Please resubmit the file please as before in my previous post.
Thanks.
  • 0

#13
Byggarebob
Posted 13 July 2008 - 09:46 AM

Byggarebob

    Member

  • Topic Starter
  • Member
  • PipPip
  • 11 posts
Ok here is the updated one:




Antivirus Version Senaste Uppdatering Resultat
AhnLab-V3 2008.7.11.0 2008.07.11 -
AntiVir 7.8.0.64 2008.07.13 -
Authentium 5.1.0.4 2008.07.13 -
Avast 4.8.1195.0 2008.07.13 -
AVG 7.5.0.516 2008.07.12 -
BitDefender 7.2 2008.07.13 -
CAT-QuickHeal 9.50 2008.07.11 -
ClamAV 0.93.1 2008.07.13 -
DrWeb 4.44.0.09170 2008.07.12 -
eSafe 7.0.17.0 2008.07.13 -
eTrust-Vet 31.6.5949 2008.07.12 -
Ewido 4.0 2008.07.13 -
F-Prot 4.4.4.56 2008.07.13 -
F-Secure 7.60.13501.0 2008.07.12 -
Fortinet 3.14.0.0 2008.07.13 -
GData 2.0.7306.1023 2008.07.13 -
Ikarus T3.1.1.26.0 2008.07.13 -
Kaspersky 7.0.0.125 2008.07.13 -
McAfee 5337 2008.07.11 -
Microsoft 1.3704 2008.07.13 -
NOD32v2 3263 2008.07.11 -
Norman 5.80.02 2008.07.11 -
Panda 9.0.0.4 2008.07.13 -
Prevx1 V2 2008.07.13 -
Rising 20.52.62.00 2008.07.13 -
Sophos 4.31.0 2008.07.13 -
Sunbelt 3.1.1536.1 2008.07.12 -
Symantec 10 2008.07.13 -
TheHacker 6.2.96.378 2008.07.13 -
TrendMicro 8.700.0.1004 2008.07.11 -
VBA32 3.12.6.9 2008.07.12 -
VirusBuster 4.5.11.0 2008.07.12 -
Webwasher-Gateway 6.6.2 2008.07.13 -
Övrig information
File size: 10129408 bytes
MD5...: e798c16b83cea34a143f8296c43a64b7
SHA1..: 2bb5e77d7d492633229b2166c846ab3b54931084
SHA256: 05d5e3ff62d8b96f2be1731d00b95fb56e623ef9690266821afc675a8cc53ec3
SHA512: 8289fac7fd470ee0c6dd56154ecc0eeb0f617f431ce0bfc6f4d3252f81239987
8903cee25d7c4949f39f600bf47b373246b745055f3e18605788a50914fcf7e1
PEiD..: Armadillo v1.xx - v2.xx
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x638a3ca5
timedatestamp.....: 0x3b97cf2c (Thu Sep 06 19:31:56 2001)
machinetype.......: 0x14c (I386)

( 5 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x187c3 0x19000 6.63 eab3d718e84ec25a3f3ddd5e057849cf
.rdata 0x1a000 0x1851 0x2000 4.57 5934b54bb7df7df7133205c42595bddd
.data 0x1c000 0x5728 0x4000 4.07 908fc0f5450538a3a325c44ad678002e
.rsrc 0x22000 0x981f90 0x982000 6.99 442f9efbdcb090b56ce6be2f8f463781
.reloc 0x9a4000 0x6bac 0x7000 1.10 8eaa3df107ab44796f4f428d17a75462

( 2 imports )
> ole32.dll: CoCreateInstance, CoTaskMemFree, CoInitialize
> KERNEL32.dll: TlsGetValue, LockResource, LoadResource, FindResourceW, SetLastError, HeapAlloc, HeapFree, GetCommandLineA, GetVersion, GetProcAddress, GetModuleHandleA, HeapDestroy, HeapCreate, VirtualFree, InitializeCriticalSection, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, ExitProcess, VirtualAlloc, HeapReAlloc, RaiseException, GetLastError, CloseHandle, WideCharToMultiByte, GetStringTypeA, GetStringTypeW, TerminateProcess, GetCurrentProcess, GetCurrentThreadId, TlsSetValue, TlsAlloc, TlsFree, SetHandleCount, GetStdHandle, GetFileType, GetStartupInfoA, GetModuleFileNameA, FreeEnvironmentStringsA, FreeEnvironmentStringsW, GetEnvironmentStrings, GetEnvironmentStringsW, WriteFile, InterlockedDecrement, InterlockedIncrement, SetStdHandle, FlushFileBuffers, SetFilePointer, RtlUnwind, LCMapStringW, GetCPInfo, GetACP, GetOEMCP, LoadLibraryA, MultiByteToWideChar, LCMapStringA

( 32 exports )
AddPenInputHRC, CreateCompatibleHRC, CreateInksetHRCRESULT, DestroyHRC, DestroyHRCRESULT, DestroyInkset, EndPenInputHRC, GetAlternateWordsHRCRESULT, GetBaselineHRCRESULT, GetInksetInterval, GetInksetIntervalCount, GetResultsHRC, GetSymbolCountHRCRESULT, GetSymbolsHRCRESULT, HwxALCPriority, HwxALCValid, HwxConfig, HwxCreate, HwxDestroy, HwxEndInput, HwxGetResults, HwxInput, HwxProcess, HwxResultsAvailable, HwxSetAbort, HwxSetContext, HwxSetGuide, HwxSetPartial, ProcessHRC, SetAlphabetHRC, SetGuideHRC, SymbolToCharacterW
  • 0

#14
kahdah
Posted 13 July 2008 - 10:10 AM

kahdah

    GeekU Teacher

  • Retired Staff
  • 15,822 posts
Please download the OTMoveIt2 by OldTimer.
  • Save it to your desktop.
  • Please double-click OTMoveIt2.exe to run it. (Vista users, please right click on OTMoveit2.exe and select "Run as an Administrator")
  • Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

    C:\WINDOWS\system32\dllcache\hwxkor.dll
  • Return to OTMoveIt2, right click in the "Paste List of Files/Folders to be Moved" window (under the light Yellow bar) and choose Paste.
  • Click the red Moveit! button.
  • OTMoveit2 will create a log of moved files in the C:\_OTMoveIt\MovedFiles folder. The log's name will appear as the date and time it was created, with the format mmddyyyy_hhmmss.log. Open this log in Notepad and post its contents in your next reply.
  • Close OTMoveIt2
If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.
==========================
Please download Malwarebytes' Anti-Malware from Here or Here

Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Full Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatley.
=====================================
Post those logs and a new dss log in your next reply.
  • 0

#15
Byggarebob
Posted 13 July 2008 - 11:53 AM

Byggarebob

    Member

  • Topic Starter
  • Member
  • PipPip
  • 11 posts
Ok now its done. I didnt need to reboot my pc anytime so its not rebooted after all these steps.

Here is the MoveIt! log

DllUnregisterServer procedure not found in C:\WINDOWS\system32\dllcache\hwxkor.dll
C:\WINDOWS\system32\dllcache\hwxkor.dll NOT unregistered.
C:\WINDOWS\system32\dllcache\hwxkor.dll moved successfully.

OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 07132008_181522


Here is the nbam-log-7.13.2008 (19-46-39).txt log (the anti-malmware program)


Malwarebytes' Anti-Malware 1.20
Database version: 945
Windows 5.1.2600 Service Pack 2

19:46:39 2008-07-13
mbam-log-7-13-2008 (19-46-39).txt

Scan type: Full Scan (C:\|D:\|I:\|)
Objects scanned: 411859
Time elapsed: 1 hour(s), 14 minute(s), 33 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 3
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 26

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VSPlugin (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\sqvgnrpx.bwkx (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\sqvgnrpx.toolbar.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Deckard\System Scanner\20080713005919\backup\DOCUME~1\Pizza\LOKALA~1\Temp\lwpower.exe (Rogue.Installer) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\eonv.exe.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\clcmagia.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\efcYSlkH.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\hacbxsqh.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\hgGayvtR.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\hulpaz.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\mLedDVnn.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\pmnmljKe.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\suqaah.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\wriaotnm.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\xxyawWQH.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{47DF6B46-6AD9-48A7-9D0D-21E32C02A606}\RP11\A0000770.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{47DF6B46-6AD9-48A7-9D0D-21E32C02A606}\RP11\A0000771.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{47DF6B46-6AD9-48A7-9D0D-21E32C02A606}\RP11\A0000772.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{47DF6B46-6AD9-48A7-9D0D-21E32C02A606}\RP11\A0000773.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{47DF6B46-6AD9-48A7-9D0D-21E32C02A606}\RP11\A0000774.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{47DF6B46-6AD9-48A7-9D0D-21E32C02A606}\RP11\A0000775.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{47DF6B46-6AD9-48A7-9D0D-21E32C02A606}\RP11\A0000776.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{47DF6B46-6AD9-48A7-9D0D-21E32C02A606}\RP11\A0000777.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{47DF6B46-6AD9-48A7-9D0D-21E32C02A606}\RP11\A0000778.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{47DF6B46-6AD9-48A7-9D0D-21E32C02A606}\RP6\A0000477.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{47DF6B46-6AD9-48A7-9D0D-21E32C02A606}\RP6\A0000479.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{47DF6B46-6AD9-48A7-9D0D-21E32C02A606}\RP9\A0000654.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{47DF6B46-6AD9-48A7-9D0D-21E32C02A606}\RP9\A0000655.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
D:\!!!BACKUP!!!\Program\The_Pirate_Bay\tbThe_.dll (Adware.Shopper) -> Quarantined and deleted successfully.


And last here is the dss log

Deckard's System Scanner v20071014.68
Run by Pizza on 2008-07-13 19:48:42
Computer is in Normal Mode.
--------------------------------------------------------------------------------



-- HijackThis (run as Pizza.exe) -----------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:48:54, on 2008-07-13
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program\Lavasoft\Ad-Aware\aawservice.exe
C:\Program\Alwil Software\Avast4\aswUpdSv.exe
C:\Program\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program\Alwil Software\Avast4\ashMaiSv.exe
C:\Program\Alwil Software\Avast4\ashWebSv.exe
C:\Program\Kiwee Toolbar2\1.5.131\kwtbaim.exe
C:\Program\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program\Java\jre1.6.0_05\bin\jusched.exe
C:\Program\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\Program\Echovoice\Gamer Statistics\G15 Echovoice Gamer Statistics.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program\Messenger\msmsgs.exe
C:\Program\Logitech\GamePanel Software\LCD Manager\Applets\LCDClock.exe
C:\Program\Logitech\GamePanel Software\LCD Manager\Applets\LCDCountdown.exe
C:\Program\Delade filer\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Pizza\Skrivbord\dss.exe
C:\Program\TRENDM~1\HIJACK~1\Pizza.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar
R3 - URLSearchHook: Kiwee Toolbar - {6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - C:\Program\Kiwee Toolbar2\1.5.131\KiweeIEToolbar.dll
O2 - BHO: Kiwee Toolbar - {6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - C:\Program\Kiwee Toolbar2\1.5.131\KiweeIEToolbar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Windows Live inloggningshjälpen - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program\Delade filer\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Kiwee Toolbar - {6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - C:\Program\Kiwee Toolbar2\1.5.131\KiweeIEToolbar.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program\Adobe\/Adobe Contribute CS3/contributeieplugin.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program\Winamp Toolbar\winamptb.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program\Logitech\GamePanel Software\LCD Manager\LCDMon.exe"
O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program\Logitech\GamePanel Software\G-series Software\LGDCore.exe" /SHOWHIDE
O4 - HKLM\..\Run: [KiweeHook] "C:\Program\Kiwee Toolbar2\1.5.131\kwtbaim.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [Adobe_ID0EYTHM] C:\Program\DELADE~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
O4 - HKLM\..\Run: [WinampAgent] C:\Program\Winamp\winampa.exe
O4 - HKLM\..\Run: [Echovoice Gamer Statistics] C:\Program\Echovoice\Gamer Statistics\G15 Echovoice Gamer Statistics.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [Skype] "C:\Program\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKAL TJÄNST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Clean Traces - C:\Program\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program\DAP\dapextie.htm
O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: Append to existing PDF - res://C:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Download &all with DAP - C:\Program\DAP\dapextie2.htm
O8 - Extra context menu item: E&xportera till Microsoft Excel - res://C:\Program\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Skicka till OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Ski&cka till OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O16 - DPF: CabBuilder - http://kiw.imgag.com...llerControl.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program\DELADE~1\Skype\SKYPE4~1.DLL
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Adobe Version Cue CS3 - Adobe Systems Incorporated - C:\Program\Delade filer\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program\Delade filer\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

--
End of file - 9205 bytes

-- Files created between 2008-06-13 and 2008-07-13 -----------------------------

2008-07-13 18:16:50 0 d-------- C:\Documents and Settings\Pizza\Application Data\Malwarebytes
2008-07-13 18:16:48 0 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-07-13 18:16:47 0 d-------- C:\Program\Malwarebytes' Anti-Malware
2008-07-13 15:15:40 0 d-------- C:\Program\Trend Micro
2008-07-13 14:54:48 0 d-------- C:\WINDOWS\LastGood
2008-07-13 11:55:47 0 d-------- C:\cmdcons
2008-07-13 01:45:36 0 d-------- C:\Documents and Settings\Pizza\Lokala instõllningar
2008-07-13 01:45:36 0 d-------- C:\Documents and Settings\NetworkService\Lokala instõllningar
2008-07-13 01:45:36 0 d-------- C:\Documents and Settings\LocalService\Lokala instõllningar
2008-07-13 01:45:36 0 d-------- C:\Documents and Settings\Familj\Lokala instõllningar
2008-07-13 01:18:20 0 d-------- C:\Documents and Settings\Pizza\Start Menu
2008-07-13 01:16:31 68096 --a------ C:\WINDOWS\zip.exe
2008-07-13 01:16:31 49152 --a------ C:\WINDOWS\VFind.exe
2008-07-13 01:16:31 212480 --a------ C:\WINDOWS\swxcacls.exe <Not Verified; SteelWerX; SteelWerX Extended Configurator ACLists>
2008-07-13 01:16:31 136704 --a------ C:\WINDOWS\swsc.exe <Not Verified; SteelWerX; SteelWerX Service Controller>
2008-07-13 01:16:31 161792 --a------ C:\WINDOWS\swreg.exe <Not Verified; SteelWerX; SteelWerX Registry Editor>
2008-07-13 01:16:31 98816 --a------ C:\WINDOWS\sed.exe
2008-07-13 01:16:31 80412 --a------ C:\WINDOWS\grep.exe
2008-07-13 01:16:31 89504 --a------ C:\WINDOWS\fdsv.exe <Not Verified; Smallfrogs Studio; >
2008-07-13 00:39:03 0 d-------- C:\WINDOWS\pss
2008-07-12 23:05:54 0 d-------- C:\Program\Lavasoft
2008-07-12 23:05:53 0 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-07-12 19:45:07 0 d-------- C:\WINDOWS\Prefetch
2008-07-12 12:40:46 0 d-------- C:\Program\Sigma Production Inc
2008-07-12 11:53:47 0 d-------- C:\Program\Aspyr
2008-07-07 20:48:12 664 --a------ C:\WINDOWS\system32\d3d9caps.dat
2008-07-07 12:54:16 0 d-------- C:\Documents and Settings\Pizza\Application Data\vlc
2008-07-07 12:50:38 0 d-------- C:\Program\VideoLAN
2008-07-06 22:22:32 0 d-------- C:\Documents and Settings\Pizza\Tracing
2008-07-06 01:57:15 0 d-------- C:\Program\Windows Live Safety Center
2008-07-06 00:29:34 0 d-------- C:\Program\GameSpy
2008-07-06 00:28:44 0 d-------- C:\WINDOWS\system32\URTTEMP
2008-07-06 00:27:37 669184 --a------ C:\WINDOWS\system32\pbsvc.exe
2008-07-06 00:23:46 0 d-------- C:\Program\Electronic Arts
2008-07-05 18:15:14 0 d-------- C:\Program\Echovoice
2008-07-05 17:26:36 0 d-------- C:\Program\Winamp Toolbar
2008-07-05 17:26:36 0 d-------- C:\Documents and Settings\All Users\Application Data\Winamp Toolbar
2008-07-05 17:26:14 0 d-------- C:\Program\Winamp
2008-07-05 17:26:14 0 d-------- C:\Documents and Settings\Pizza\Application Data\Winamp
2008-07-05 15:42:57 21840 --a------ C:\WINDOWS\system32\SIntfNT.dll
2008-07-05 15:42:57 17212 --a------ C:\WINDOWS\system32\SIntf32.dll
2008-07-05 15:42:57 12067 --a------ C:\WINDOWS\system32\SIntf16.dll
2008-07-05 15:33:35 30592 --a------ C:\WINDOWS\DIIUnin.dat
2008-07-05 15:33:34 2829 --a------ C:\WINDOWS\DIIUnin.pif
2008-07-05 15:33:34 94208 --a------ C:\WINDOWS\DIIUnin.exe <Not Verified; Blizzard Entertainment; Diablo II Uninstaller>
2008-07-05 15:31:19 0 d-------- C:\Program\Diablo II
2008-07-05 15:13:29 0 d-------- C:\Diablo 2
2008-06-30 14:17:09 0 d-------- C:\CSS Skins
2008-06-30 14:14:27 0 --a------ C:\WINDOWS\nsreg.dat
2008-06-30 14:14:25 0 d-------- C:\Documents and Settings\Pizza\Application Data\Mozilla
2008-06-29 19:12:33 45056 --a------ C:\WINDOWS\system32\WNASPI32.DLL <Not Verified; Adaptec; Adaptec's ASPI Layer>
2008-06-29 19:12:33 16512 --a------ C:\WINDOWS\system32\drivers\ASPI32.SYS <Not Verified; Adaptec; Adaptec's ASPI Layer>
2008-06-29 19:12:23 0 d-------- C:\Program\ImTOO
2008-06-29 19:11:17 47360 --a------ C:\WINDOWS\system32\drivers\pcouffin.sys <Not Verified; VSO Software; Patin couffin engine>
2008-06-29 19:11:17 0 d-------- C:\Documents and Settings\Pizza\Application Data\Vso
2008-06-29 19:11:17 47360 --a------ C:\Documents and Settings\Pizza\Application Data\pcouffin.sys <Not Verified; VSO Software; Patin couffin engine>
2008-06-29 19:11:07 0 d-------- C:\Program\DVDFab Platinum 4
2008-06-27 20:42:38 0 d-------- C:\Program\GCFScape
2008-06-25 22:02:49 0 d-------- C:\Program\Game Extractor
2008-06-25 21:44:10 0 d-------- C:\dsbuff
2008-06-24 14:55:27 0 d-------- C:\Program\7-Zip
2008-06-22 13:40:54 0 d-------- C:\Program\MultiMedia Lab V
2008-06-22 13:40:24 307200 --a------ C:\WINDOWS\IsUn041d.exe <Not Verified; InstallShield Software Corporation; InstallShield® unInstaller>
2008-06-21 17:43:53 0 d-------- C:\Documents and Settings\Pizza\Application Data\CoreFTP
2008-06-21 17:43:27 0 d-------- C:\Program\CoreFTP
2008-06-21 17:33:00 0 d-------- C:\Documents and Settings\Pizza\Application Data\SmartFTP
2008-06-21 15:00:49 0 d-------- C:\Program\Whisper Technology
2008-06-20 19:21:02 0 d-------- C:\Documents and Settings\Pizza\Application Data\Media Player Classic
2008-06-20 18:56:52 0 d-------- C:\Program\BreakPoint Software
2008-06-18 11:46:47 0 d-------- C:\Program\WinAVI MP4 Converter
2008-06-13 19:43:22 0 d-------- C:\gh3temp
2008-06-13 19:23:33 0 d-------- C:\Program\GoldWave


-- Find3M Report ---------------------------------------------------------------

2008-07-13 14:53:25 0 d-------- C:\Documents and Settings\Pizza\Application Data\Skype
2008-07-13 11:50:22 0 d-------- C:\Documents and Settings\Pizza\Application Data\skypePM
2008-07-12 23:05:20 0 d-------- C:\Program\Delade filer\Wise Installation Wizard
2008-07-12 19:52:42 441280 --a------ C:\WINDOWS\system32\perfh01D.dat
2008-07-12 19:52:42 82930 --a------ C:\WINDOWS\system32\perfc01D.dat
2008-07-12 19:39:40 23468 --a------ C:\WINDOWS\system32\emptyregdb.dat
2008-07-12 12:49:47 0 d-------- C:\Documents and Settings\Pizza\Application Data\uTorrent
2008-07-12 00:26:10 0 d-------- C:\Documents and Settings\Pizza\Application Data\LimeWire
2008-07-06 22:20:38 0 d-------- C:\Program\Windows Live
2008-07-05 23:12:09 0 d-------- C:\Documents and Settings\Pizza\Application Data\Adobe
2008-07-02 12:20:21 0 d-------- C:\Documents and Settings\Pizza\Application Data\Publish Providers
2008-06-29 19:11:21 34 --a------ C:\Documents and Settings\Pizza\Application Data\pcouffin.log
2008-06-29 19:11:17 1144 --a------ C:\Documents and Settings\Pizza\Application Data\pcouffin.inf
2008-06-29 19:11:17 7887 --a------ C:\Documents and Settings\Pizza\Application Data\pcouffin.cat
2008-06-24 20:02:38 0 d-------- C:\Program\Realtek
2008-06-12 15:59:03 0 d--h----- C:\Program\InstallShield Installation Information
2008-06-12 15:55:19 0 d-------- C:\Program\Activision
2008-06-11 20:43:25 56 --ah----- C:\WINDOWS\system32\ezsidmv.dat
2008-06-11 20:41:53 0 d-------- C:\Program\Skype
2008-06-11 20:41:50 0 d-------- C:\Program\Delade filer
2008-06-11 20:41:50 0 d-------- C:\Program\Delade filer\Skype
2008-06-11 18:17:44 0 d-------- C:\Program\NINTENDO DS GAME BROWSER
2008-06-11 18:16:33 286720 --a------ C:\WINDOWS\Setup1.exe <Not Verified; Microsoft Corporation; Microsoft Visual Basic for Windows>
2008-06-11 18:16:32 73216 --a------ C:\WINDOWS\ST6UNST.EXE <Not Verified; Microsoft Corporation; Microsoft® Visual Basic for Windows>
2008-06-08 21:58:01 0 d-------- C:\Program\VentSrv
2008-06-08 21:45:25 0 d-------- C:\Program\Ventrilo Mix
2008-06-04 18:21:11 0 d-------- C:\Program\Guitar Pro 5
2008-05-31 11:35:32 0 d-------- C:\Program\Delade filer\Adobe
2008-05-31 11:34:07 0 d-------- C:\Program\Delade filer\Control Panels
2008-05-31 11:24:36 0 d-------- C:\Program\QuickTime
2008-05-31 11:15:39 0 d-------- C:\Program\Bonjour
2008-05-31 11:12:29 0 d-------- C:\Program\Delade filer\Macrovision Shared
2008-05-29 15:05:36 0 d-------- C:\Program\MSXML 6.0
2008-05-28 15:57:02 0 d-------- C:\Documents and Settings\Pizza\Application Data\Sony
2008-05-28 15:45:20 0 d-------- C:\Program\Sony
2008-05-28 15:40:11 0 d-------- C:\Program\MSBuild
2008-05-28 15:38:07 0 d-------- C:\Program\Reference Assemblies
2008-05-28 15:33:27 0 d-------- C:\Documents and Settings\Pizza\Application Data\Sony Setup
2008-05-28 15:33:19 0 d-------- C:\Program\Sony Setup
2008-05-27 21:17:53 0 d-------- C:\Program\Windows Media Connect 2
2008-05-27 17:10:27 0 d-------- C:\Program\K-Lite Codec Pack
2008-05-27 17:08:16 306629 --a------ C:\WINDOWS\SesamTV Media Center Uninstaller.exe
2008-05-27 16:48:33 0 d-------- C:\Program\Dusco
2008-05-26 17:51:27 0 d-------- C:\Documents and Settings\Pizza\Application Data\AccurateRip
2008-05-26 17:51:26 12890 --a------ C:\WINDOWS\system32\SpoonUninstall-dBpoweramp Music Converter.dat
2008-05-26 17:51:24 0 d-------- C:\Program\Illustrate
2008-05-24 22:05:06 0 d-------- C:\Documents and Settings\Pizza\Application Data\Sun
2008-05-24 22:04:44 0 d-------- C:\Program\Java
2008-05-23 20:31:47 0 d-------- C:\Program\LimeWire
2008-05-23 20:31:08 0 d-------- C:\Program\Delade filer\Java
2008-05-22 12:31:50 0 dr-h----- C:\Documents and Settings\Pizza\Application Data\SecuROM
2008-05-21 16:09:16 0 d-------- C:\Program\DAEMON Tools Lite
2008-05-21 15:39:47 0 d-------- C:\Documents and Settings\Pizza\Application Data\Leadertech
2008-05-21 15:39:46 0 d-------- C:\Program\Delade filer\Logishrd
2008-05-21 15:39:09 0 d-------- C:\Program\Logitech
2008-05-20 23:07:40 0 d-------- C:\Program\DAP
2008-05-20 23:06:25 50688 --a------ C:\WINDOWS\system32\wbhelp2.dll <Not Verified; Stardock.Net, Inc; WindowBlinds for Win32 x86 machines>
2008-05-20 22:39:23 0 d-------- C:\Program\uTorrent
2008-05-20 22:13:49 0 d-------- C:\Program\Microsoft Works
2008-05-20 22:06:15 0 d-------- C:\Documents and Settings\Pizza\Application Data\DAEMON Tools
2008-05-20 20:34:11 0 d-------- C:\Program\Kiwee Toolbar2
2008-05-20 20:21:08 0 d-------- C:\Documents and Settings\Pizza\Application Data\ImgBurn
2008-05-20 20:14:06 0 d-------- C:\Program\ImgBurn
2008-05-20 16:40:40 0 d-------- C:\Documents and Settings\Pizza\Application Data\Ventrilo
2008-05-18 21:33:08 0 d-------- C:\Program\Buggy
2008-05-18 21:25:56 0 d-------- C:\Program\Messenger
2008-05-18 20:55:10 0 d--hs--c- C:\Program\Delade filer\WindowsLiveInstaller
2008-05-18 16:35:13 0 d-------- C:\Documents and Settings\Pizza\Application Data\WinRAR
2008-05-18 16:20:31 0 d-------- C:\Program\Delade filer\ODBC
2008-05-18 16:20:29 0 d-------- C:\Program\Delade filer\SpeechEngines
2008-05-18 16:20:12 62 --ahs---- C:\Documents and Settings\Pizza\Application Data\desktop.ini
2008-05-18 14:57:39 0 d-------- C:\Program\Alwil Software
2008-05-18 14:49:01 315392 --a------ C:\WINDOWS\HideWin.exe <Not Verified; Realtek Semiconductor Corp.; HD Audio Hide windows program>
2008-05-18 14:46:18 0 d-------- C:\Program\Delade filer\InstallShield
2008-05-18 14:44:01 0 d-------- C:\Documents and Settings\Pizza\Application Data\Macromedia
2008-05-18 14:42:55 0 d-------- C:\Program\Intel
2008-05-18 14:41:42 0 d-------- C:\Program\Dell
2008-05-18 14:39:56 0 d-------- C:\Documents and Settings\Pizza\Application Data\Identities
2008-05-18 14:35:49 0 d-------- C:\Program\microsoft frontpage
2008-05-18 14:35:40 0 -rahs---- C:\MSDOS.SYS
2008-05-18 14:35:40 0 -rahs---- C:\IO.SYS
2008-05-18 14:35:40 0 --a------ C:\CONFIG.SYS
2008-05-18 14:35:40 0 --a------ C:\AUTOEXEC.BAT
2008-05-18 14:34:57 0 d--h----- C:\Program\WindowsUpdate
2008-05-18 14:34:54 0 d-------- C:\Program\Onlinetjänster
2008-05-18 14:34:21 0 d-------- C:\Program\Delade filer\MSSoap
2008-05-18 14:34:15 0 d-------- C:\Program\Movie Maker
2008-05-18 14:33:23 0 d-------- C:\Program\MSN Gaming Zone
2008-05-18 14:33:17 0 d-------- C:\Program\Windows NT
2008-05-03 05:46:00 1019904 --a------ C:\WINDOWS\system32\nvwimg.dll
2008-05-03 05:46:00 1703936 --a------ C:\WINDOWS\system32\nvwdmcpl.dll
2008-05-03 05:46:00 466944 --a------ C:\WINDOWS\system32\nvshell.dll
2008-05-03 05:46:00 1630208 --a------ C:\WINDOWS\system32\nwiz.exe
2008-05-03 05:46:00 1486848 --a------ C:\WINDOWS\system32\nview.dll
2008-05-03 05:46:00 1339392 --a------ C:\WINDOWS\system32\nvdspsch.exe
2008-05-03 05:46:00 442368 --a------ C:\WINDOWS\system32\nvappbar.exe
2008-05-03 05:46:00 425984 --a------ C:\WINDOWS\system32\keystone.exe


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6638A9DE-0745-4292-8A2E-AE530E7B9B3F}]
2008-04-03 10:52 265360 --a------ C:\Program\Kiwee Toolbar2\1.5.131\KiweeIEToolbar.dll

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{6638A9DE-0745-4292-8A2E-AE530E7B9B3F}"= C:\Program\Kiwee Toolbar2\1.5.131\KiweeIEToolbar.dll [2008-04-03 10:52 265360]
"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program\Winamp Toolbar\winamptb.dll [2008-03-20 00:36 1267040]

[-HKEY_CLASSES_ROOT\CLSID\{6638A9DE-0745-4292-8A2E-AE530E7B9B3F}]
[HKEY_CLASSES_ROOT\KiweeIEToolbar.KiweeToolbar.1]
[HKEY_CLASSES_ROOT\TypeLib\{259EEB17-79AA-44DF-8410-8E55F82A902A}]
[HKEY_CLASSES_ROOT\KiweeIEToolbar.KiweeToolbar]

[-HKEY_CLASSES_ROOT\CLSID\{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-03 05:46]
"nwiz"="nwiz.exe" [2008-05-03 05:46 C:\WINDOWS\system32\nwiz.exe]
"Launch LCDMon"="C:\Program\Logitech\GamePanel Software\LCD Manager\LCDMon.exe" [2007-12-13 17:43]
"Launch LGDCore"="C:\Program\Logitech\GamePanel Software\G-series Software\LGDCore.exe" [2007-12-13 17:57]
"KiweeHook"="C:\Program\Kiwee Toolbar2\1.5.131\kwtbaim.exe" [2008-04-03 10:51]
"GrooveMonitor"="C:\Program\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-07-17 17:39 C:\WINDOWS\KHALMNPR.Exe]
"SunJavaUpdateSched"="C:\Program\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25]
"Acrobat Assistant 8.0"="C:\Program\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2008-01-11 19:54]
"Adobe_ID0EYTHM"="C:\Program\DELADE~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE" [2007-03-20 16:40]
"WinampAgent"="C:\Program\Winamp\winampa.exe" [2008-03-27 08:35]
"Echovoice Gamer Statistics"="C:\Program\Echovoice\Gamer Statistics\G15 Echovoice Gamer Statistics.exe" [2006-11-28 23:52]
"RTHDCPL"="RTHDCPL.EXE" [2007-05-28 16:32 C:\WINDOWS\RTHDCPL.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-03 05:46]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-16 17:16]
"MsnMsgr"="C:\Program\Windows Live\Messenger\MsnMsgr.exe" [2007-11-07 15:34]
"MSMSGS"="C:\Program\Messenger\msmsgs.exe" [2004-10-13 18:24]
"DAEMON Tools Lite"="C:\Program\DAEMON Tools Lite\daemon.exe" [2008-04-01 11:39]
"Skype"="C:\Program\Skype\Phone\Skype.exe" [2008-05-30 15:54]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)
"HideLegacyLogonScripts"=0 (0x0)
"HideLogoffScripts"=0 (0x0)
"RunLogonScriptSync"=1 (0x1)
"RunStartupScriptSync"=0 (0x0)
"HideStartupScripts"=0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"HideLegacyLogonScripts"=0 (0x0)
"HideLogoffScripts"=0 (0x0)
"RunLogonScriptSync"=1 (0x1)
"RunStartupScriptSync"=0 (0x0)
"HideStartupScripts"=0 (0x0)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Comrade.exe]
C:\Program\GameSpy\Comrade\Comrade.exe




-- End of Deckard's System Scanner: finished at 2008-07-13 19:49:22 ------------
  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP