I think I have a virus?

Everytime I search in google it redirects me to another site. Also I cant update my Malwarebytes or AVG. Another thing is my computer turns off around 20 seconds when I go to safe mode. I tried everything…

Here's my HJT log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:00:20 PM, on 3/17/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\Cisco Systems\Clean Access Agent\CCAAgent.exe
C:\Windows\Explorer.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Program Files\Malwarebytes' Anti-Malware\Jack.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource=10&ctid=CT1098640
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…rio&pf=cnnb
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKUS\S-1-5-21-1943882607-3842070971-3894068450-1000\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun (User '?')
O4 - HKUS\S-1-5-21-1943882607-3842070971-3894068450-1000\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden (User '?')
O4 - HKUS\S-1-5-21-1943882607-3842070971-3894068450-1000\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe (User '?')
O4 - HKUS\S-1-5-21-1943882607-3842070971-3894068450-1000\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet (User '?')
O4 - HKUS\S-1-5-21-1943882607-3842070971-3894068450-1000\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount (User '?')
O4 - Global Startup: Clean Access Agent.lnk = C:\Program Files\Cisco Systems\Clean Access Agent\CCAAgent.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~3\Office12\GR99D3~1.DLL
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Recovery Service for Windows - Unknown owner - C:\Windows\SMINST\BLService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe (file missing)
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: VCL MySQL Database Server - Unknown owner - C:\Program Files\Chemistry Lab\mysql\bin\mysqld.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

–
End of file - 7102 bytes


Before I ran HJT, I ran combofix.. here's my log.

ComboFix 09-03-15.01 - Edwin 2009-03-17 12:40:06.1 - NTFSx86
Running from: c:\users\[removed]\Desktop\worknow.com.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\drivers\gaopdxkntpnxnbxddvosimlbuahdrqqhpxiktt.sys
c:\windows\system32\gaopdxsmitixevrsvtvciqcpgvyftuwvmwqgdv.dll
D:\Autorun.inf
d:\recycler\S-4-4-69-100026526-100017251-100004666-2708.com

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Service_gaopdxserv.sys


((((((((((((((((((((((((( Files Created from 2009-02-17 to 2009-03-17 )))))))))))))))))))))))))))))))
.

2009-03-17 11:26 . 2009-03-17 11:26 d——– c:\windows\System32\drivers\Avg
2009-03-17 11:26 . 2009-03-17 11:26 325,640 –a—— c:\windows\System32\drivers\avgldx86.sys
2009-03-17 11:26 . 2009-03-17 11:26 107,912 –a—— c:\windows\System32\drivers\avgtdix.sys
2009-03-17 11:26 . 2009-03-17 11:26 10,520 –a—— c:\windows\System32\avgrsstx.dll
2009-03-17 11:07 . 2009-03-17 11:07 253,692,015 –a—— c:\windows\MEMORY.DMP
2009-03-17 11:07 . 2009-03-17 11:51 32 –ahs—- c:\windows\System32\drivers\fidbox2.idx
2009-03-17 11:07 . 2009-03-17 11:51 32 –ahs—- c:\windows\System32\drivers\fidbox2.dat
2009-03-17 11:07 . 2009-03-17 11:51 32 –ahs—- c:\windows\System32\drivers\fidbox.idx
2009-03-17 11:07 . 2009-03-17 11:51 32 –ahs—- c:\windows\System32\drivers\fidbox.dat
2009-03-17 10:05 . 2009-03-17 10:05 d——– c:\users\All Users\Kaspersky Lab Setup Files
2009-03-17 10:05 . 2009-03-17 10:05 d——– c:\programdata\Kaspersky Lab Setup Files
2009-03-17 09:18 . 2009-03-17 09:18 d——– c:\users\Edwin\AppData\Roaming\Malwarebytes
2009-03-17 09:14 . 2009-03-17 09:14 d——– c:\users\All Users\Malwarebytes
2009-03-17 09:14 . 2009-03-17 09:14 d——– c:\programdata\Malwarebytes
2009-03-17 09:14 . 2009-03-17 09:18 d——– c:\program files\Malwarebytes' Anti-Malware
2009-03-17 09:14 . 2009-02-11 10:19 38,496 –a—— c:\windows\System32\drivers\mbamswissarmy.sys
2009-03-17 09:14 . 2009-02-11 10:19 15,504 –a—— c:\windows\System32\drivers\mbam.sys
2009-03-10 18:57 . 2008-12-15 20:29 8,147,456 –a—— c:\windows\System32\wmploc.DLL
2009-03-10 18:57 . 2009-02-08 20:10 2,033,152 –a—— c:\windows\System32\win32k.sys
2009-03-10 18:57 . 2008-11-26 21:43 268,288 –a—— c:\windows\System32\schannel.dll
2009-03-10 18:57 . 2008-12-15 22:31 7,680 –a—— c:\windows\System32\spwmp.dll
2009-03-10 18:57 . 2008-12-15 22:31 4,096 –a—— c:\windows\System32\msdxm.ocx
2009-03-10 18:57 . 2008-12-15 22:31 4,096 –a—— c:\windows\System32\dxmasf.dll
2009-03-09 18:31 . 2009-03-09 18:31 d——– c:\program files\Common Files\Microsoft Games
2009-03-09 16:42 . 2009-03-09 16:42 d——– c:\program files\PowerISO
2009-02-19 23:04 . 2009-02-19 23:04 107,888 –a—— c:\windows\System32\CmdLineExt.dll
2009-02-19 22:52 . 2009-02-19 22:52 d——– c:\program files\EA Sports
2009-02-19 22:52 . 2008-03-05 16:56 3,786,760 –a—— c:\windows\System32\D3DX9_37.dll
2009-02-19 22:52 . 2007-07-19 19:14 3,727,720 –a—— c:\windows\System32\d3dx9_35.dll
2009-02-19 22:52 . 2007-05-16 17:45 3,497,832 –a—— c:\windows\System32\d3dx9_34.dll
2009-02-19 22:52 . 2007-03-12 17:42 3,495,784 –a—— c:\windows\System32\d3dx9_33.dll
2009-02-19 22:52 . 2006-11-29 14:06 3,426,072 –a—— c:\windows\System32\d3dx9_32.dll
2009-02-19 22:52 . 2006-09-28 17:05 2,414,360 –a—— c:\windows\System32\d3dx9_31.dll
2009-02-19 22:52 . 2007-04-04 19:53 81,768 –a—— c:\windows\System32\xinput1_3.dll
2009-02-19 22:51 . 2005-05-26 16:34 2,297,552 –a—— c:\windows\System32\d3dx9_26.dll
2009-02-19 22:07 . 2008-02-22 04:30 334,792 –a—— c:\windows\System32\_AxShlEx.dll
2009-02-19 22:05 . 2009-02-19 22:05 d——– c:\program files\Alcohol Soft
2009-02-19 22:01 . 2009-02-19 22:30 717,296 –a—— c:\windows\System32\drivers\sptd.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-17 19:39 42,559 —-a-w c:\users\All Users\nvModes.dat
2009-03-17 19:39 42,559 —-a-w c:\programdata\nvModes.dat
2009-03-17 18:26 ——— d—–w c:\programdata\avg8
2009-03-17 16:04 ——— d—–w c:\users\Edwin\AppData\Roaming\uTorrent
2009-03-11 10:07 ——— d—–w c:\program files\Windows Mail
2009-03-10 01:31 ——— d–h–w c:\program files\InstallShield Installation Information
2009-03-09 23:56 ——— d—–w c:\program files\Microsoft Games
2009-02-12 02:46 ——— d—–w c:\users\Edwin\AppData\Roaming\dvdcss
2009-01-30 18:15 ——— d—–w c:\program files\Educational Simulations
2009-01-30 05:29 ——— d—–w c:\users\Edwin\AppData\Roaming\Aim
2009-01-30 05:29 ——— d—–w c:\program files\AIM
2009-01-28 05:39 ——— d—–w c:\program files\Model Science
2009-01-28 05:33 ——— d—–w c:\program files\Chemistry Lab
2009-01-15 06:11 827,392 —-a-w c:\windows\System32\wininet.dll
2008-08-31 21:58 262,144 —-a-w c:\programdata\ntuser.dat
2008-01-21 02:43 174 –sha-w c:\program files\desktop.ini
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-20 1233920]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-02-26 2289664]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-20 202240]
"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2008-11-05 4347120]
"AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 120\axcmd.exe" [2008-11-22 203720]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-03 13535776]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-03 92704]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-04-17 1049896]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-04-15 70912]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 31016]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-10-01 289576]
"PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2008-07-07 167936]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-03-17 1932568]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Clean Access Agent.lnk - c:\program files\Cisco Systems\Clean Access Agent\CCAAgent.exe [2007-04-26 2048074]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{902C1511-41EA-4F94-8EAA-2178A9826391}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{78946C39-7433-4430-8B05-9EAF59BB895A}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{9AC5B09D-381C-45F5-BE1F-4106A34C03F5}"= UDP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{F346E70B-D24C-4E15-94C3-1202DB09F46E}"= TCP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{A1E93560-EC77-46EA-A244-33E529792DA8}"= UDP:c:\program files\McAfee\Common Framework\FrameworkService.exe:McAfee Framework Service
"{FBCC3B3B-0B6D-4F1A-B59A-5DBFAD5F71AC}"= TCP:c:\program files\McAfee\Common Framework\FrameworkService.exe:McAfee Framework Service
"TCP Query User{47E5A261-AAF1-4A49-941B-D29EED8B5190}c:\\users\\edwin\\desktop\\starcraft\\starcraft.exe"= UDP:c:\users\edwin\desktop\starcraft\starcraft.exe:starcraft.exe
"UDP Query User{B81BE38B-DD87-4255-BF2D-A7CAC81AEB5D}c:\\users\\edwin\\desktop\\starcraft\\starcraft.exe"= TCP:c:\users\edwin\desktop\starcraft\starcraft.exe:starcraft.exe
"TCP Query User{C83C3825-82D4-44ED-9480-9193AD79751D}c:\\users\\edwin\\desktop\\starcraft\\starcraft.exe"= UDP:c:\users\edwin\desktop\starcraft\starcraft.exe:starcraft.exe
"UDP Query User{19A4767B-4315-44B5-B9B3-7485A93B152B}c:\\users\\edwin\\desktop\\starcraft\\starcraft.exe"= TCP:c:\users\edwin\desktop\starcraft\starcraft.exe:starcraft.exe
"{89AC23C7-B010-44EE-9FF8-FBB1103C8D26}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{F9FC0672-A609-48B6-A7C8-95699BC8EB21}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{B1CFCE39-692B-425F-BD76-C4A0C06837D0}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{2FEB88F4-BBC2-4D2D-804E-A1AE5A3B43FC}"= UDP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{C3251125-6D02-43B6-9133-A4C036014AF7}"= TCP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{48A75C18-0A7D-4F09-BCCC-344BEE0FDCBF}"= UDP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{80F6F122-053F-4994-B793-7B650D3716B0}"= TCP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{38A6850A-6892-471A-A6A8-15D07B4000D8}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{CC56FBEE-0EF7-4FF8-B08A-D2288118B58B}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"TCP Query User{774D5F62-28D5-41DF-BF80-C8022F6DF770}c:\\program files\\yahoo!\\messenger\\yahoomessenger.exe"= UDP:c:\program files\yahoo!\messenger\yahoomessenger.exe:Yahoo! Messenger
"UDP Query User{A9B22929-5BCB-4483-9BFA-2E3BFE64B886}c:\\program files\\yahoo!\\messenger\\yahoomessenger.exe"= TCP:c:\program files\yahoo!\messenger\yahoomessenger.exe:Yahoo! Messenger
"TCP Query User{8EF65885-4CD8-4588-B0A0-7B563711925C}c:\\users\\edwin\\desktop\\starcraft2 the real one\\starcraft.exe"= UDP:c:\users\edwin\desktop\starcraft2 the real one\starcraft.exe:starcraft.exe
"UDP Query User{1F28D9FD-D5F7-440C-97A2-A6A71DEA5F97}c:\\users\\edwin\\desktop\\starcraft2 the real one\\starcraft.exe"= TCP:c:\users\edwin\desktop\starcraft2 the real one\starcraft.exe:starcraft.exe
"TCP Query User{A08382AB-A777-4215-94F9-9C916EE60B30}c:\\users\\edwin\\desktop\\utorrent.exe"= UDP:c:\users\edwin\desktop\utorrent.exe:utorrent.exe
"UDP Query User{99698E5F-D968-4F28-83DD-F9BE358705BD}c:\\users\\edwin\\desktop\\utorrent.exe"= TCP:c:\users\edwin\desktop\utorrent.exe:utorrent.exe
"TCP Query User{8EEC3499-F839-469C-8438-BB8863AF5B37}c:\\program files\\ea sports\\fifa 09\\fifa09.exe"= UDP:c:\program files\ea sports\fifa 09\fifa09.exe:FIFA09
"UDP Query User{AAD0F688-5243-4533-A099-4E183369830D}c:\\program files\\ea sports\\fifa 09\\fifa09.exe"= TCP:c:\program files\ea sports\fifa 09\fifa09.exe:FIFA09
"TCP Query User{6E391B6F-E683-44DA-83A9-49FBEA779B54}c:\\users\\edwin\\desktop\\rld-fif9\\fifa09.exe"= UDP:c:\users\edwin\desktop\rld-fif9\fifa09.exe:FIFA09
"UDP Query User{002AB00B-02D6-4A3A-98D0-7EEC8391E8DA}c:\\users\\edwin\\desktop\\rld-fif9\\fifa09.exe"= TCP:c:\users\edwin\desktop\rld-fif9\fifa09.exe:FIFA09
"{0449724E-A132-47EC-A41E-E69D4414ACC9}"= c:\program files\AVG\AVG8\avgupd.exe:avgupd.exe
"{3E802C2D-A2E1-4617-8E1F-E2A83BF1B70C}"= c:\program files\AVG\AVG8\avgnsx.exe:avgnsx.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2009-02-11 38496]
S1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\Drivers\avgldx86.sys [2009-03-17 325640]
S1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\System32\Drivers\avgtdix.sys [2009-03-17 107912]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys [2008-07-09 20496]
S2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-03-17 298264]
S2 Recovery Service for Windows;Recovery Service for Windows;c:\windows\SMINST\BLService.exe [2008-04-25 361808]
S2 VCL MySQL Database Server;VCL MySQL Database Server; [x]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2008-05-03 42528]


— Other Services/Drivers In Memory —

*Deregistered* - adp94xx
*Deregistered* - adpahci
*Deregistered* - adpu160m
*Deregistered* - adpu320
*Deregistered* - AFD
*Deregistered* - aic78xx
*Deregistered* - aliide
*Deregistered* - amdide
*Deregistered* - arc
*Deregistered* - arcsas
*Deregistered* - AvgLdx86
*Deregistered* - AvgMfx86
*Deregistered* - AvgTdiX
*Deregistered* - Beep
*Deregistered* - bowser
*Deregistered* - CLFS
*Deregistered* - cmdide
*Deregistered* - Compbatt
*Deregistered* - crcdisk
*Deregistered* - DfsC
*Deregistered* - DXGKrnl
*Deregistered* - elxstor
*Deregistered* - FileInfo
*Deregistered* - FltMgr
*Deregistered* - HpCISSs
*Deregistered* - HTTP
*Deregistered* - i2omp
*Deregistered* - iaStorV
*Deregistered* - iirsp
*Deregistered* - intelide
*Deregistered* - isapnp
*Deregistered* - iScsiPrt
*Deregistered* - iteatapi
*Deregistered* - iteraid
*Deregistered* - KLIM6
*Deregistered* - KSecDD
*Deregistered* - lltdio
*Deregistered* - LSI_FC
*Deregistered* - LSI_SAS
*Deregistered* - LSI_SCSI
*Deregistered* - luafv
*Deregistered* - megasas
*Deregistered* - MegaSR
*Deregistered* - MountMgr
*Deregistered* - mpsdrv
*Deregistered* - Mraid35x
*Deregistered* - MRxDAV
*Deregistered* - mrxsmb
*Deregistered* - mrxsmb10
*Deregistered* - mrxsmb20
*Deregistered* - msahci
*Deregistered* - msdsm
*Deregistered* - Msfs
*Deregistered* - msisadrv
*Deregistered* - mssmbios
*Deregistered* - Mup
*Deregistered* - NativeWifiP
*Deregistered* - NDIS
*Deregistered* - Ndisuio
*Deregistered* - NdisWan
*Deregistered* - NDProxy
*Deregistered* - NetBIOS
*Deregistered* - netbt
*Deregistered* - nfrd960
*Deregistered* - Npfs
*Deregistered* - nsiproxy
*Deregistered* - Ntfs
*Deregistered* - Null
*Deregistered* - nvraid
*Deregistered* - nvstor
*Deregistered* - PEAUTH
*Deregistered* - PptpMiniport
*Deregistered* - PSched
*Deregistered* - ql2300
*Deregistered* - ql40xx
*Deregistered* - RasAcd
*Deregistered* - Rasl2tp
*Deregistered* - RasPppoe
*Deregistered* - RasSstp
*Deregistered* - rdbss
*Deregistered* - RDPCDD
*Deregistered* - RDPENCDD
*Deregistered* - rspndr
*Deregistered* - sbp2port
*Deregistered* - SCDEmu
*Deregistered* - secdrv
*Deregistered* - SiSRaid2
*Deregistered* - SiSRaid4
*Deregistered* - Smb
*Deregistered* - spldr
*Deregistered* - sptd
*Deregistered* - srv
*Deregistered* - srv2
*Deregistered* - srvnet
*Deregistered* - swenum
*Deregistered* - Sym_hi
*Deregistered* - Sym_u3
*Deregistered* - Symc8xx
*Deregistered* - Tcpip
*Deregistered* - tcpipreg
*Deregistered* - tdx
*Deregistered* - TermDD
*Deregistered* - tunmp
*Deregistered* - tunnel
*Deregistered* - uliahci
*Deregistered* - UlSata
*Deregistered* - ulsata2
*Deregistered* - umbus
*Deregistered* - VgaSave
*Deregistered* - viaide
*Deregistered* - volmgr
*Deregistered* - volmgrx
*Deregistered* - volsnap
*Deregistered* - vsmraid
*Deregistered* - Wanarpv6
*Deregistered* - Wd
*Deregistered* - Wdf01000
*Deregistered* - XAudio

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\shell\AutoRun\command - F:\dvdcheck.exe
\shell\directx\command - DirectX9\dxsetup.exe
\shell\setup\command - F:\setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
\shell\AutoRun\command - G:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6d2079ed-9420-11dd-9fc6-001d726533d4}]
\shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"c:\program files\Common Files\LightScribe\LSRunOnce.exe"
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT1098640
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=83&bd=Presario&pf=cnnb
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\Edwin\AppData\Roaming\Mozilla\Firefox\Profiles\laaduja2.default\
FF - prefs.js: browser.startup.homepage - www.yahoo.com
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-17 12:44:16
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files:

**************************************************************************
.
Completion time: 2009-03-17 12:46:52
ComboFix-quarantined-files.txt 2009-03-17 19:46:50

Pre-Run: 62,409,256,960 bytes free
Post-Run: 63,987,826,688 bytes free

305 — E O F — 2009-03-13 21:53:45