[Resolved] PC slowdown, HijackThis log included

JavaRa and ComboFix logs:


JavaRa 1.13 Removal Log.Report follows after line.————————————The JavaRa removal process was started on Sun Apr 26 10:00:06 2009

Found and removed: C:\Program Files\Java\j2re1.4.2_03Found and removed: SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}Found and removed: SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA}Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBB}Found and removed: SOFTWARE\Classes\JavaPlugin.142_03Found and removed: SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA}Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_02Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_03Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_04Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2.0_01Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBB}————————————Finished reporting.


===================COMBOFIX LOG=================================================================

ComboFix 09-04-25.A3 - Dave 04/26/2009 10:07.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.510.199 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated)
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2009-05-26 to 2009-4-26 )))))))))))))))))))))))))))))))
.

2009-04-25 21:33 . 2009-04-25 21:33 54156 —ha-w c:\windows\QTFont.qfn
2009-04-25 21:33 . 2009-04-25 21:33 1409 —-a-w c:\windows\QTFont.for
2009-04-22 15:20 . 2009-04-22 15:20 10520 —-a-w c:\windows\system32\avgrsstx.dll
2009-04-22 15:20 . 2009-04-22 15:20 108552 —-a-w c:\windows\system32\drivers\avgtdix.sys
2009-04-22 15:19 . 2009-04-22 15:19 325640 —-a-w c:\windows\system32\drivers\avgldx86.sys
2009-04-22 15:19 . 2009-04-26 13:15 ——– d—–w c:\windows\system32\drivers\Avg
2009-04-20 19:29 . 2009-04-20 19:29 ——– d—–w c:\windows\system32\scripting
2009-04-20 19:29 . 2009-04-20 19:29 ——– d—–w c:\windows\l2schemas
2009-04-20 19:29 . 2009-04-20 19:29 ——– d—–w c:\windows\system32\en
2009-04-20 19:29 . 2009-04-20 19:29 ——– d—–w c:\windows\system32\bits
2009-04-20 19:25 . 2009-04-20 19:29 ——– d—–w c:\windows\ServicePackFiles
2009-04-18 01:37 . 2009-04-18 01:37 73728 —-a-w c:\windows\system32\javacpl.cpl
2009-04-18 01:37 . 2009-04-18 01:37 410984 —-a-w c:\windows\system32\deploytk.dll
2009-04-17 23:53 . 2009-04-17 23:53 ——– d—–w c:\program files\TagScanner
2009-04-17 21:48 . 2009-04-17 21:51 ——– d—–w c:\program files\The GodFather
2009-04-17 21:45 . 2009-04-17 21:48 ——– d—–w c:\documents and settings\Dave\Application Data\Mp3tag
2009-04-17 21:45 . 2009-04-17 21:45 ——– d—–w c:\program files\Mp3tag
2009-04-17 20:50 . 2008-05-03 11:55 2560 ——w c:\windows\system32\xpsp4res.dll
2009-04-17 20:50 . 2009-03-27 06:58 1203922 ——w c:\windows\system32\dllcache\sysmain.sdb
2009-04-17 20:50 . 2008-04-21 12:08 215552 ——w c:\windows\system32\dllcache\wordpad.exe
2009-04-16 21:40 . 2009-04-16 21:40 ——– d—–w c:\documents and settings\Dave\Application Data\Malwarebytes
2009-04-16 21:40 . 2009-04-06 19:32 15504 —-a-w c:\windows\system32\drivers\mbam.sys
2009-04-16 21:40 . 2009-04-06 19:32 38496 —-a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-16 21:40 . 2009-04-16 21:40 ——– d—–w c:\program files\Malwarebytes' Anti-Malware
2009-04-16 21:40 . 2009-04-16 21:40 ——– d—–w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-04-15 21:52 . 2009-04-15 21:53 ——– d—–w C:\music
2009-04-13 16:57 . 2009-04-13 16:57 ——– d—–w c:\program files\AVG
2009-04-12 14:31 . 2009-04-12 14:31 ——– d—–w c:\program files\Trend Micro
2009-04-07 22:14 . 2009-04-22 15:19 ——– d—–w c:\documents and settings\All Users\Application Data\avg8
2009-04-07 00:15 . 2009-02-13 15:31 55640 —-a-w c:\windows\system32\drivers\avgntflt.sys
2009-04-06 01:39 . 2009-04-23 17:11 ——– d–h–w C:\$AVG8.VAULT$
2009-04-04 14:57 . 2009-04-04 14:57 ——– d—–w c:\program files\AudioShell
2009-04-04 14:48 . 2009-04-04 14:48 ——– d—–w c:\documents and settings\All Users\Application Data\NCH Swift Sound
2009-03-29 22:05 . 2009-03-29 22:08 ——– d—–w c:\program files\URUSoft
2009-03-28 12:31 . 2009-04-13 20:36 ——– d—–w c:\program files\FLAC

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-26 14:04 . 2007-10-16 21:09 ——– d—a-w c:\documents and settings\All Users\Application Data\TEMP
2009-04-26 14:00 . 2009-04-26 14:00 6543 —-a-w C:\JavaRa.log
2009-04-26 14:00 . 2005-12-15 01:46 ——– d—–w c:\program files\Java
2009-04-25 04:13 . 2007-09-26 16:00 ——– d—–w c:\documents and settings\All Users\Application Data\DVD Shrink
2009-04-24 17:22 . 2007-10-06 00:09 ——– d—–w c:\program files\SpywareGuard
2009-04-21 00:40 . 2007-09-26 16:20 28040 —-a-w c:\documents and settings\Dave\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-20 19:32 . 2005-08-16 10:41 88699 —-a-w c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-04-20 19:22 . 2005-08-16 10:18 250048 –sha-r C:\ntldr
2009-04-19 17:43 . 2007-10-10 17:02 ——– d—–w c:\documents and settings\Dave\Application Data\OpenOffice.org2
2009-04-19 15:14 . 2007-10-06 00:30 ——– d—–w c:\documents and settings\Dave\Application Data\Lavasoft
2009-04-16 14:31 . 2007-10-16 21:06 ——– d—–w c:\documents and settings\Dave\Application Data\VideoReDoPlus
2009-04-14 00:06 . 2007-10-06 00:07 ——– d—–w c:\program files\SpywareBlaster
2009-04-13 16:57 . 2009-01-18 23:43 ——– d—–w c:\program files\Gabest
2009-04-07 01:07 . 2009-04-05 18:55 731 ——w C:\Win32.Worm.Downladup.Gen.log
2009-04-06 02:07 . 2005-08-17 02:54 ——– d—–w c:\program files\DIGStream
2009-04-01 23:04 . 2009-03-30 13:13 732 —-a-w C:\muxman.log
2009-03-29 22:08 . 2009-01-18 23:49 ——– d—–w c:\program files\VisualSubSync
2009-03-21 14:06 . 2009-03-21 14:06 989696 ——w c:\windows\system32\dllcache\kernel32.dll
2009-03-18 16:18 . 2007-10-06 00:08 ——– d—–w c:\program files\Spybot - Search & Destroy
2009-03-18 16:18 . 2007-10-06 00:08 ——– d—–w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-03-16 13:46 . 2005-12-15 01:55 ——– d—–w c:\documents and settings\All Users\Application Data\QuickTime
2009-03-06 14:22 . 2009-04-19 01:27 284160 ——w c:\windows\system32\dllcache\pdh.dll
2009-03-06 14:22 . 2005-08-16 10:18 284160 —-a-w c:\windows\system32\pdh.dll
2009-03-03 00:18 . 2007-06-26 14:35 826368 —-a-w c:\windows\system32\dllcache\wininet.dll
2009-03-03 00:18 . 2005-08-16 10:18 826368 —-a-w c:\windows\system32\wininet.dll
2009-03-02 04:46 . 2008-09-18 23:37 ——– d—–w c:\program files\WinFF
2009-03-02 00:41 . 2008-02-01 03:00 ——– d—–w c:\documents and settings\Dave\Application Data\Winff
2009-02-28 04:54 . 2007-08-13 23:43 636072 ——w c:\windows\system32\dllcache\iexplore.exe
2009-02-26 16:15 . 2009-02-26 16:15 ——– d—–w c:\documents and settings\Dave\Application Data\RipIt4Me
2009-02-20 10:20 . 2007-08-17 10:20 13824 ——w c:\windows\system32\dllcache\ieudinit.exe
2009-02-20 10:20 . 2007-08-13 23:39 70656 ——w c:\windows\system32\dllcache\ie4uinit.exe
2009-02-20 05:14 . 2007-08-13 22:56 161792 ——w c:\windows\system32\dllcache\ieakui.dll
2009-02-09 12:10 . 2009-04-19 01:27 729088 ——w c:\windows\system32\dllcache\lsasrv.dll
2009-02-09 12:10 . 2005-08-16 10:18 729088 —-a-w c:\windows\system32\lsasrv.dll
2009-02-09 12:10 . 2009-04-19 01:27 714752 ——w c:\windows\system32\dllcache\ntdll.dll
2009-02-09 12:10 . 2009-04-19 01:27 617472 ——w c:\windows\system32\dllcache\advapi32.dll
2009-02-09 12:10 . 2009-04-19 01:27 473600 ——w c:\windows\system32\dllcache\fastprox.dll
2009-02-09 12:10 . 2009-04-19 01:27 453120 ——w c:\windows\system32\dllcache\wmiprvsd.dll
2009-02-09 12:10 . 2009-04-19 01:27 401408 ——w c:\windows\system32\dllcache\rpcss.dll
2009-02-09 12:10 . 2005-08-16 10:18 401408 —-a-w c:\windows\system32\rpcss.dll
2009-02-09 12:10 . 2005-08-16 10:18 714752 —-a-w c:\windows\system32\ntdll.dll
2009-02-09 12:10 . 2005-08-16 10:18 617472 —-a-w c:\windows\system32\advapi32.dll
2009-02-09 11:13 . 2008-10-16 00:47 1846784 ——w c:\windows\system32\dllcache\win32k.sys
2009-02-09 11:13 . 2005-08-16 10:18 1846784 —-a-w c:\windows\system32\win32k.sys
2009-02-07 23:02 . 2009-02-07 23:02 2066048 ——w c:\windows\system32\dllcache\ntkrnlpa.exe
2009-02-06 11:11 . 2009-04-19 01:27 110592 ——w c:\windows\system32\dllcache\services.exe
2009-02-06 11:11 . 2005-08-16 10:18 110592 —-a-w c:\windows\system32\services.exe
2009-02-06 11:08 . 2009-04-19 01:27 2189056 ——w c:\windows\system32\dllcache\ntoskrnl.exe
2009-02-06 11:06 . 2009-04-19 01:27 2145280 ——w c:\windows\system32\dllcache\ntkrnlmp.exe
2009-02-06 11:06 . 2005-08-16 10:18 2145280 —-a-w c:\windows\system32\ntoskrnl.exe
2009-02-06 10:39 . 2009-04-19 01:27 35328 ——w c:\windows\system32\dllcache\sc.exe
2009-02-06 10:39 . 2005-08-16 10:18 35328 —-a-w c:\windows\system32\sc.exe
2009-02-06 10:32 . 2009-04-19 01:27 2023936 ——w c:\windows\system32\dllcache\ntkrpamp.exe
2009-02-06 10:32 . 2004-08-04 04:59 2023936 —-a-w c:\windows\system32\ntkrnlpa.exe
2009-02-06 10:10 . 2009-04-19 01:27 227840 ——w c:\windows\system32\dllcache\wmiprvse.exe
2009-02-03 19:59 . 2009-02-03 19:59 56832 ——w c:\windows\system32\dllcache\secur32.dll
2009-02-03 19:59 . 2005-08-16 10:18 56832 —-a-w c:\windows\system32\secur32.dll
2008-08-02 23:48 . 2008-08-02 23:48 47360 —-a-w c:\documents and settings\Dave\Application Data\pcouffin.sys
2007-10-03 02:56 . 2007-09-26 04:59 127 —-a-w c:\documents and settings\Dave\Local Settings\Application Data\fusioncache.dat
2005-08-17 02:52 . 2005-08-17 02:52 136 —-a-w c:\documents and settings\Administrator\Local Settings\Application Data\fusioncache.dat
2005-05-13 21:12 . 2005-05-13 21:12 217073 –sha-r c:\windows\meta4.exe
2005-10-24 15:13 . 2005-10-24 15:13 66560 –sha-r c:\windows\MOTA113.exe
2008-08-07 03:13 . 2008-08-07 03:11 24 –sh–w c:\windows\S5EBCFEA5.tmp
2005-10-14 01:27 . 2005-10-14 01:27 422400 –sha-r c:\windows\x2.64.exe
2005-07-14 16:31 . 2005-07-14 16:31 27648 –sha-r c:\windows\system32\AVSredirect.dll
2005-06-26 19:32 . 2005-06-26 19:32 616448 –sha-r c:\windows\system32\cygwin1.dll
2005-06-22 02:37 . 2005-06-22 02:37 45568 –sha-r c:\windows\system32\cygz.dll
2004-01-25 04:00 . 2004-01-25 04:00 70656 –sha-r c:\windows\system32\i420vfw.dll
2006-04-27 14:24 . 2006-04-27 14:24 2945024 –sha-r c:\windows\system32\Smab.dll
2005-02-28 17:16 . 2005-02-28 17:16 240128 –sha-r c:\windows\system32\x.264.exe
2004-01-25 04:00 . 2004-01-25 04:00 70656 –sha-r c:\windows\system32\yv12vfw.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"PhotoShow Deluxe Media Manager"="c:\progra~1\Ahead\Ahead\data\Xtras\mssysmgr.exe" [2004-05-12 196608]
"DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-29 67584]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-06 344064]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 53248]
"RealTray"="c:\program files\Real\RealPlayer\RealPlay.exe" [2005-12-15 26112]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2005-12-15 98304]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-12-06 127035]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 249856]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 81920]
"MSKDetectorExe"="c:\program files\McAfee\SpamKiller\MSKDetct.exe" [2005-07-13 1117184]
"Dell AIO Printer A920"="c:\program files\Dell AIO Printer A920\dlbkbmgr.exe" [2003-05-12 270336]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-04-18 148888]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-04-22 1932568]
"SigmatelSysTrayApp"="stsystra.exe" - c:\windows\stsystra.exe [2005-03-23 339968]

c:\documents and settings\Dave\Start Menu\Programs\Startup\
SpywareGuard.lnk - c:\program files\SpywareGuard\sgmain.exe [2003-8-29 360448]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-9-29 113664]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2005-12-14 24576]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [2000-1-21 65588]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-04-22 15:20 10520 —-a-w c:\windows\system32\avgrsstx.dll

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32
"wave"= serwvdrv.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=

R3 KBCAM;JamC@m USB service;c:\windows\system32\Drivers\KBCAM.sys [2000-10-09 16384]
S1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\Drivers\avgldx86.sys [2009-04-22 325640]
S1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\System32\Drivers\avgtdix.sys [2009-04-22 108552]
S2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-04-22 298264]


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}]
\Shell\AutoRun\command - E:\setup.exe
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
TCP: {4AEEE83A-196B-45D4-A779-1303EEFF36B8} = 64.136.173.5 64.136.164.77
FF - ProfilePath - c:\documents and settings\Dave\Application Data\Mozilla\Firefox\Profiles\96u2iqfh.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://google.com
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-26 10:10
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-04-26 10:12
ComboFix-quarantined-files.txt 2009-04-26 14:12

Pre-Run: 37,796,593,664 bytes free
Post-Run: 37,780,434,944 bytes free

Current=1 Default=1 Failed=0 LastKnownGood=4 Sets=1,2,3,4
197 — E O F — 2009-04-21 23:10