What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Browser redirect, System restore will not work, Malwar

10 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
My name is Mike. I run a music studio and this computer is my main computer for audio production plus I do other stuff dealing with video and graphics. I have a lot of expensive software and hardware in this computer and it must be fixed ASAP. I recently had another computer on the same network as this one that was infected and since then I have removed that computer from the internet and it has been cleaned of malware but now that leaves me with this one.

Half of the anti-malware and anti-virus programs I try to run do not ever open when I try. I had to rename the Malwarebytes program file just to get it to open and it finally did but it don't seem to be making a difference because the problems do not go away. Hijackthis does not even open when I click on the program but RSIT does so I will be using that to post a log with. Also, when i right click on the AVG icon in the system tray, both "Open AVG" and "Update" are grayed out. If I double click on the AVG icon in the system tray, AVG opens up but it says thjat no components are installed. I also have Lavasoft Ad-Aware and this program runs fine but the scans seem to be making no difference at all. Both when I run the renamed Malwarebytes and I run a Ad-Aware scan, they find infected items everytime but it makes no difference at all. I also tried to download and install Spybot Search and Destroy but when I try to run the program, it shows up in the task manager but the program never comes up.

Please somebody help me! I am lost on what to do here. Here is the log from RSIT:

Logfile of random's system information tool 1.06 (written by random/random)
Run by [removed] at 2009-07-25 08:46:07
Microsoft Windows XP Home Edition Service Pack 3
System drive D: has 7 GB (24%) free of 30 GB
Total RAM: 3071 MB (80% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:46:22 AM, on 7/25/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
D:\windows\System32\smss.exe
D:\windows\system32\winlogon.exe
D:\windows\system32\services.exe
D:\windows\system32\lsass.exe
D:\windows\system32\svchost.exe
D:\windows\System32\svchost.exe
E:\AVG\avgrsx.exe
D:\windows\system32\svchost.exe
D:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
D:\windows\Explorer.EXE
D:\WINDOWS\System32\M-AudioTaskBarIcon.exe
E:\AVG\avgtray.exe
D:\windows\system32\RUNDLL32.EXE
D:\windows\system32\spoolsv.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\Program Files\AIM6\aim6.exe
D:\Program Files\AIM6\aolsoftware.exe
D:\Documents and Settings\Absurd\Desktop\RSIT.exe
D:\Program Files\Trend Micro\HijackThis\Absurd.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - E:\AVG\Toolbar\IEToolbar.dll
R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: IDMIEHlprObj Class - {0055C089-8582-441B-A0BF-17B458C2A3A8} - D:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - E:\AVG\avgssie.dll
O2 - BHO: Spybot-S&D; IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - E:\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Update Helper - {77D7E795-33C5-4323-974D-A2A49AB75517} - D:\Program Files\Google\Update\1.2.131.11\GoopdateBho.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - E:\AVG\Toolbar\IEToolbar.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - D:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - E:\AVG\Toolbar\IEToolbar.dll
O4 - HKLM\..\Run: [M-Audio Taskbar Icon] D:\WINDOWS\System32\M-AudioTaskBarIcon.exe
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [AVG8_TRAY] E:\AVG\avgtray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - Startup: Adobe Gamma.lnk = D:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: Download All Links with IDM - D:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - D:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - D:\Program Files\Internet Download Manager\IEExt.htm
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - D:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog; This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - D:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo…sreqlab_nvd.cab
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownlo…iaSmartScan.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - E:\AVG\avgpp.dll
O20 - AppInit_DLLs: D:\WINDOWS\system32\guard32.dll
O20 - Winlogon Notify: !SASWinLogon - D:\windows\
O20 - Winlogon Notify: avgrsstarter - D:\windows\SYSTEM32\avgrsstx.dll
O23 - Service: Diskeeper - Unknown owner - C:\Disk Keeper\DkService.exe (file missing)
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - D:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - D:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O24 - Desktop Component 0: Aqua Real 2 - AD0FABD2-7EAE-40B8-8F44-6FCFE6C883CD

–
End of file - 5812 bytes

======Scheduled tasks folder======

D:\windows\tasks\GoogleUpdateTaskMachine.job
D:\windows\tasks\Uniblue SpeedUpMyPC Nag.job
D:\windows\tasks\Uniblue SpeedUpMyPC.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}]
IDMIEHlprObj Class - D:\Program Files\Internet Download Manager\IDMIECC.dll [2009-05-07 169392]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]
AVG Safe Search - E:\AVG\avgssie.dll [2009-07-11 1107224]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D; IE Protection - E:\SPYBOT~1\SDHelper.dll [2009-01-26 1879896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{77D7E795-33C5-4323-974D-A2A49AB75517}]
Google Update Helper - D:\Program Files\Google\Update\1.2.131.11\GoopdateBho.dll [2009-05-05 133616]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live Sign-in Helper - D:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
AVG Security Toolbar BHO - E:\AVG\Toolbar\IEToolbar.dll [2009-06-14 1004800]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java™ Plug-In 2 SSV Helper - D:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-05-21 41368]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - D:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-05-21 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - AVG Security Toolbar - E:\AVG\Toolbar\IEToolbar.dll [2009-06-14 1004800]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"M-Audio Taskbar Icon"=D:\WINDOWS\System32\M-AudioTaskBarIcon.exe [2008-05-15 356864]
"Kernel and Hardware Abstraction Layer"=D:\windows\KHALMNPR.EXE [2008-12-18 76304]
"AVG8_TRAY"=E:\AVG\avgtray.exe [2009-07-11 1948440]
"NvCplDaemon"=D:\WINDOWS\system32\NvCpl.dll [2009-06-10 13758464]
"nwiz"=nwiz.exe /install []
"NvMediaCenter"=D:\WINDOWS\system32\NvMcTray.dll [2009-06-10 86016]
"Adobe Reader Speed Launcher"=D:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-02-27 35696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ad-Watch]
D:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe [2009-07-24 520024]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EA Core]
D:\Program Files\Electronic Arts\EADM\Core.exe [2008-07-22 2772992]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H2O]
D:\Program Files\SyncroSoft\Pos\H2O\cledx.exe [2005-05-11 200069]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IDMan]
D:\Program Files\Internet Download Manager\IDMan.exe [2009-05-28 960944]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
D:\Program Files\Windows Live\Messenger\msnmsgr.exe [2009-02-06 3885408]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVIDIA nTune]
D:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe clear []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
D:\Program Files\QuickTime\qttask.exe [2008-09-06 413696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
E:\Spybot - Search & Destroy\TeaTimer.exe [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
D:\Program Files\Java\jre6\bin\jusched.exe [2009-05-21 148888]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
D:\Program Files\SUPERAntiSpyware\11b60ed9-558f-4a2f-bedc-e58aa3a9e0f8.exe [2008-12-22 1830128]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\D:^Documents and Settings^Absurd^Start Menu^Programs^Startup^ERUNT AutoBackup.lnk]
D:\PROGRA~1\ERUNT\AUTOBACK.EXE [2005-10-20 38912]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\D:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech SetPoint.lnk]
D:\PROGRA~1\Logitech\SetPoint\SetPoint.exe [2009-02-19 809488]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=3
"PnkBstrA"=2
"PLFlash DeviceIoControl Service"=2
"NVSvc"=2
"NMIndexingService"=3
"Nero BackItUp Scheduler 3"=2
"MA_CMIDI_InstallerService"=2
"LexBceS"=2
"LBTServ"=3
"JavaQuickStarterService"=2
"idsvc"=3
"IDriverT"=3
"gupdate1c9cd3721a28848"=2
"FLEXnet Licensing Service"=3
"digiSPTIService"=3
"DigiRefresh"=2
"cmdAgent"=2
"Bonjour Service"=2
"avg8wd"=2
"avg8emc"=2
"Autodata Limited License Service"=2
"Adobe LM Service"=3
"Diskeeper"=2

D:\Documents and Settings\Absurd\Start Menu\Programs\Startup
Adobe Gamma.lnk - D:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="D:\WINDOWS\system32\guard32.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\avgrsstarter]
D:\windows\system32\avgrsstx.dll [2009-07-11 11952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\LBTWlgn]
d:\program files\common files\logishrd\bluetooth\LBTWlgn.dll [2009-02-19 72208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WRNotifier]
D:\windows\system32\WRLogonNTF.dll [2005-11-18 492544]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - D:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\svcWRSSSDK]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Lavasoft Ad-Aware Service]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\svcWRSSSDK]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WdfLoadGroup]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"MemCheckBoxInRunDlg"=0
"NoStrCmpLogical"=0
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoChangeAnimation"=
"NoStrCmpLogical"=
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"D:\Program Files\GIGABYTE\@BIOS\gwflash.exe"="D:\Program Files\GIGABYTE\@BIOS\gwflash.exe:*:Enabled:gwflash"
"D:\WINDOWS\system32\PnkBstrA.exe"="D:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA"
"D:\WINDOWS\system32\PnkBstrB.exe"="D:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB"
"D:\Program Files\GIGABYTE\EasyTune4\update.exe"="D:\Program Files\GIGABYTE\EasyTune4\update.exe:*:Enabled:ftptest"
"D:\Program Files\Common Files\Nero\Nero Web\SetupX.exe"="D:\Program Files\Common Files\Nero\Nero Web\SetupX.exe:*:Enabled:Nero ControlCenter"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"G:\Avast\avgupd.exe"="G:\Avast\avgupd.exe:*:Enabled:avgupd.exe"
"D:\Program Files\Bonjour\mDNSResponder.exe"="D:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"D:\Program Files\Mozilla Firefox\firefox.exe"="D:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox"
"D:\Program Files\SmartFTP Client\SmartFTP.exe"="D:\Program Files\SmartFTP Client\SmartFTP.exe:*:Enabled:SmartFTP Client 2.5"
"D:\Program Files\Windows Live\Messenger\wlcsdk.exe"="D:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"
"D:\Program Files\Windows Live\Messenger\msnmsgr.exe"="D:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"D:\Program Files\Messenger\msmsgs.exe"="D:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"D:\Program Files\Internet Download Manager\IDMan.exe"="D:\Program Files\Internet Download Manager\IDMan.exe:*:Enabled:Internet Download Manager (IDM)"
"F:\Games\grid\GRID.exe"="F:\Games\grid\GRID.exe:*:Enabled:GRID"
"F:\Games\HAWX\HAWX.exe"="F:\Games\HAWX\HAWX.exe:*:Enabled:Tom Clancy's H.A.W.X"
"F:\Games\Ghost Recon Advanced Warfighter 2\graw2.exe"="F:\Games\Ghost Recon Advanced Warfighter 2\graw2.exe:*:Enabled:Ghost Recon Advanced Warfighter® 2"
"F:\Games\Ghost Recon Advanced Warfighter 2\graw2_dedicated.exe"="F:\Games\Ghost Recon Advanced Warfighter 2\graw2_dedicated.exe:*:Enabled:Ghost Recon Advanced Warfighter® 2 Dedicated Server"
"D:\Program Files\Common Files\AOL\Loader\aolload.exe"="D:\Program Files\Common Files\AOL\Loader\aolload.exe:*:Enabled:AOL Loader"
"D:\Program Files\AIM6\aim6.exe"="D:\Program Files\AIM6\aim6.exe:*:Enabled:AIM"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"D:\Program Files\Windows Live\Messenger\wlcsdk.exe"="D:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"
"D:\Program Files\Windows Live\Messenger\msnmsgr.exe"="D:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"

======File associations======

.js - edit -
.js - open -
.scr - open - D:\WINDOWS\system32\notepad.exe "%1"
.scr - install -
.scr - config -
.txt - open -

======List of files/folders created in the last 1 months======

2009-07-24 17:16:55 —-D—- D:\Program Files\Common Files\Adobe AIR
2009-07-24 16:57:01 —-A—- D:\windows\system32\wrlzma.dll
2009-07-24 16:57:01 —-A—- D:\windows\system32\WRLogonNtf.dll
2009-07-24 16:57:01 —-A—- D:\windows\system32\ssiefr.EXE
2009-07-24 16:57:01 —-A—- D:\windows\system32\islzma.dll
2009-07-24 16:56:56 —-D—- D:\Program Files\Webroot
2009-07-24 16:56:56 —-D—- D:\Documents and Settings\Absurd\Application Data\Webroot
2009-07-24 16:56:56 —-A—- D:\windows\WRUninstall.dll
2009-07-24 16:56:56 —-A—- D:\windows\system32\eSellerateEngine.dll
2009-07-24 16:56:56 —-A—- D:\windows\system32\eSellerateControl350.dll
2009-07-24 16:56:56 —-A—- D:\windows\ssleay32.dll
2009-07-24 16:56:56 —-A—- D:\windows\libeay32.dll
2009-07-24 12:17:45 —-D—- D:\Documents and Settings\Absurd\Application Data\AVG8
2009-07-24 11:37:24 —-D—- D:\SDFix
2009-07-24 08:28:41 —-A—- D:\Program Files\eumr.txt
2009-07-23 17:47:39 —-A—- D:\windows\system32\msvcsv60.dll
2009-07-23 17:30:28 —-A—- D:\windows\system32\lsdelete.exe
2009-07-23 17:26:51 —-D—- D:\Program Files\Malwarebytes' Anti-Malware
2009-07-23 17:19:47 —-HDC—- D:\Documents and Settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}
2009-07-23 17:19:28 —-D—- D:\Program Files\Lavasoft
2009-07-23 17:19:28 —-D—- D:\Documents and Settings\All Users\Application Data\Lavasoft
2009-07-22 19:06:36 —-A—- D:\windows\system32\wpa.bak
2009-07-22 09:43:07 —-A—- D:\windows\system32\tmpPrst.dll
2009-07-22 09:43:07 —-A—- D:\windows\system32\ssprs.dll
2009-07-22 09:43:07 —-A—- D:\windows\system32\lsprst7.dll
2009-07-22 08:55:21 —-D—- D:\Program Files\Steinberg
2009-07-22 08:54:50 —-A—- D:\windows\ReFX Slayer 2 VSTi v2.6-H2O Setup Log.txt
2009-07-22 08:48:13 —-A—- D:\windows\Packs Multi Presets Setup Log.txt
2009-07-22 08:45:43 —-A—- D:\windows\Pack DirectWave Setup Log.txt
2009-07-22 08:39:55 —-A—- D:\windows\FL Studio 8 Parche Setup Log.txt
2009-07-21 05:01:04 —-A—- D:\windows\setuplog.txt
2009-07-21 01:59:53 —-D—- D:\Program Files\EASEUS
2009-07-20 23:37:35 —-D—- D:\Program Files\WizardRecovery
2009-07-20 23:34:23 —-D—- D:\Program Files\Flobo Floppy Bad Sector Repair
2009-07-20 16:17:55 —-DC—- D:\windows\$NtUninstallKB973346$
2009-07-20 15:57:47 —-A—- D:\NTDETECT.COM
2009-07-19 23:19:37 —-D—- D:\Documents and Settings\Absurd\Application Data\Viewpoint
2009-07-17 02:35:49 —-D—- D:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
2009-07-16 21:42:47 —-D—- D:\Documents and Settings\All Users\Application Data\nView_Profiles
2009-07-16 21:40:44 —-D—- D:\windows\B83FC356B7C0441F8A4DD71E088E7974.TMP
2009-07-16 21:40:09 —-A—- D:\windows\system32\nvudisp.exe
2009-07-16 21:31:22 —-N—- D:\windows\system32\nvuide.exe
2009-07-16 21:31:08 —-A—- D:\windows\system32\nvusmb.exe
2009-07-16 21:24:57 —-A—- D:\windows\system32\NVUNINST.EXE
2009-07-16 20:59:07 —-A—- D:\windows\ntbtlog.txt
2009-07-16 20:52:31 —-D—- D:\windows\AC54E5443E42443CA91DA00A6974C592.TMP
2009-07-16 20:36:41 —-D—- D:\Program Files\SystemRequirementsLab
2009-07-16 20:00:58 —-D—- D:\Program Files\NOS
2009-07-16 20:00:57 —-D—- D:\Program Files\vghd
2009-07-16 17:09:03 —-D—- D:\windows\system32\$DXE_V2$
2009-07-16 13:30:45 —-D—- D:\Program Files\Viewpoint
2009-07-16 13:22:13 —-D—- D:\Program Files\Common Files\AOL
2009-07-16 13:21:51 —-D—- D:\Program Files\AIM6
2009-07-16 11:58:30 —-D—- D:\Documents and Settings\Absurd\Application Data\Roni Music
2009-07-16 07:08:18 —-SHD—- D:\RECYCLER
2009-07-16 06:58:08 —-A—- D:\ComboFix.txt
2009-07-16 05:45:35 —-D—- D:\Program Files\Common Files\Diskeeper Corporation
2009-07-16 05:45:33 —-D—- D:\Documents and Settings\All Users\Application Data\Diskeeper Corporation
2009-07-16 05:34:55 —-D—- D:\Documents and Settings\Absurd\Application Data\Desktopicon
2009-07-15 04:10:23 —-D—- D:\Program Files\SynthEdit
2009-07-14 15:13:28 —-D—- D:\windows\WBEM
2009-07-14 15:10:41 —-HDC—- D:\windows\ie8
2009-07-13 21:20:36 —-D—- D:\Documents and Settings\All Users\Application Data\NOS
2009-07-13 20:19:19 —-A—- D:\windows\NIRCMD.exe
2009-07-13 20:19:18 —-A—- D:\windows\PEV.exe
2009-07-13 20:19:17 —-A—- D:\windows\zip.exe
2009-07-13 20:19:17 —-A—- D:\windows\SWXCACLS.exe
2009-07-13 20:19:17 —-A—- D:\windows\SWSC.exe
2009-07-13 20:19:17 —-A—- D:\windows\sed.exe
2009-07-13 20:19:17 —-A—- D:\windows\grep.exe
2009-07-13 20:18:33 —-D—- D:\Qoobox
2009-07-12 18:55:08 —-D—- D:\rsit
2009-07-11 20:12:07 —-A—- D:\windows\rvdttvg.txt
2009-07-11 09:08:09 —-D—- D:\Documents and Settings\Absurd\Application Data\vlc
2009-07-11 06:45:21 —-HD—- D:\$AVG8.VAULT$
2009-07-11 04:09:44 —-D—- D:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2009-07-11 04:02:33 —-A—- D:\windows\system32\avgrsstx.dll
2009-07-11 04:02:23 —-D—- D:\Documents and Settings\All Users\Application Data\AVG Security Toolbar
2009-07-10 17:30:33 —-A—- D:\windows\swreg.exe
2009-07-10 17:29:50 —-D—- D:\Program Files\ERUNT
2009-07-10 16:10:54 —-D—- D:\Documents and Settings\Absurd\Application Data\REAPER
2009-07-10 14:31:37 —-D—- D:\Program Files\AMD
2009-07-10 14:30:45 —-D—- D:\windows\system32\AGEIA
2009-07-10 14:30:45 —-D—- D:\Program Files\AGEIA Technologies
2009-07-10 14:22:53 —-D—- D:\windows\nview(2)
2009-07-10 13:54:04 —-D—- D:\Program Files\Driver Sweeper
2009-07-10 13:04:03 —-A—- D:\windows\system32\javaws.exe
2009-07-10 13:04:03 —-A—- D:\windows\system32\javaw.exe
2009-07-10 13:04:03 —-A—- D:\windows\system32\java.exe
2009-07-07 13:27:06 —-A—- D:\windows\system32\mausbasio.dll
2009-07-07 13:27:06 —-A—- D:\windows\system32\M-AudioTaskBarIcon.exe
2009-07-07 13:27:06 —-A—- D:\windows\system32\madiousb.dll
2009-07-06 23:57:30 —-D—- D:\Config.Msi
2009-07-05 19:26:45 —-D—- D:\Documents and Settings\Absurd\Application Data\Ubisoft
2009-07-03 18:01:57 —-D—- D:\Program Files\Toontrack
2009-07-02 21:24:30 —-D—- D:\windows\system32\windows media
2009-07-02 20:06:16 —-A—- D:\windows\system32\D3DX9_41.dll
2009-07-02 20:06:16 —-A—- D:\windows\system32\D3DCompiler_41.dll
2009-07-02 20:06:15 —-A—- D:\windows\system32\XAudio2_4.dll
2009-07-02 20:06:15 —-A—- D:\windows\system32\XAPOFX1_3.dll
2009-07-02 20:06:14 —-A—- D:\windows\system32\xactengine3_4.dll
2009-07-02 20:06:13 —-A—- D:\windows\system32\X3DAudio1_6.dll
2009-07-02 14:39:08 —-D—- D:\Program Files\Common Files\aliaswavefront shared
2009-07-02 14:39:08 —-D—- D:\Program Files\Common Files\Alias Shared
2009-07-02 14:38:04 —-D—- D:\Program Files\Microsoft DirectX SDK (April 2007)
2009-06-29 07:37:20 —-HDC—- D:\Documents and Settings\All Users\Application Data\{0691F710-1ECA-4B5A-9727-25554F1BFDC6}
2009-06-29 07:31:03 —-D—- D:\Program Files\Electronic Arts
2009-06-27 12:32:27 —-D—- D:\Documents and Settings\Absurd\Application Data\KORG
2009-06-27 11:54:40 —-D—- D:\Program Files\Common Files\KORG
2009-06-27 11:54:40 —-D—- D:\Documents and Settings\All Users\Application Data\KORG
2009-06-27 10:32:39 —-D—- D:\Documents and Settings\All Users\Application Data\Codemasters
2009-06-27 10:31:04 —-D—- D:\Program Files\OpenAL
2009-06-27 10:31:04 —-A—- D:\windows\system32\wrap_oal.dll
2009-06-27 10:31:04 —-A—- D:\windows\system32\OpenAL32.dll
2009-06-27 01:22:15 —-A—- D:\windows\system32\WdfCoInstaller01001.dll
2009-06-27 01:22:04 —-D—- D:\Program Files\Microsoft Xbox 360 Accessories
2009-06-26 19:20:53 —-D—- D:\Program Files\EVGA Precision
2009-06-26 19:20:22 —-A—- D:\windows\system32\D3DCompiler_40.dll
2009-06-26 19:20:21 —-A—- D:\windows\system32\XAudio2_3.dll
2009-06-26 19:20:21 —-A—- D:\windows\system32\XAPOFX1_2.dll
2009-06-26 19:20:21 —-A—- D:\windows\system32\D3DX9_40.dll
2009-06-26 19:20:20 —-A—- D:\windows\system32\xactengine3_3.dll
2009-06-26 19:20:19 —-A—- D:\windows\system32\X3DAudio1_5.dll
2009-06-26 19:20:18 —-A—- D:\windows\system32\XAudio2_2.dll
2009-06-26 19:20:18 —-A—- D:\windows\system32\XAPOFX1_1.dll
2009-06-26 19:20:18 —-A—- D:\windows\system32\xactengine3_2.dll
2009-06-26 19:20:17 —-A—- D:\windows\system32\D3DCompiler_39.dll
2009-06-26 19:20:16 —-A—- D:\windows\system32\D3DX9_39.dll
2009-06-26 19:20:15 —-A—- D:\windows\system32\XAudio2_1.dll
2009-06-26 19:20:15 —-A—- D:\windows\system32\XAPOFX1_0.dll
2009-06-26 19:20:14 —-A—- D:\windows\system32\xactengine3_1.dll
2009-06-26 19:20:14 —-A—- D:\windows\system32\X3DAudio1_4.dll

======List of files/folders modified in the last 1 months======

2009-07-25 04:43:39 —-D—- D:\Program Files\Mozilla Firefox
2009-07-25 04:42:45 —-D—- D:\windows\system32\CatRoot2
2009-07-25 04:36:30 —-D—- D:\windows\temp
2009-07-25 04:34:35 —-A—- D:\windows\SchedLgU.Txt
2009-07-25 00:17:06 —-D—- D:\windows\Prefetch
2009-07-24 21:53:39 —-D—- D:\Documents and Settings\Absurd\Application Data\DMCache
2009-07-24 21:31:11 —-D—- D:\Documents and Settings\Absurd\Application Data\IDM
2009-07-24 19:49:16 —-SD—- D:\windows\Downloaded Program Files
2009-07-24 19:37:51 —-D—- D:\WINDOWS
2009-07-24 19:35:52 —-A—- D:\windows\NeroDigital.ini
2009-07-24 17:23:26 —-SHD—- D:\windows\Installer
2009-07-24 17:18:44 —-D—- D:\Program Files\Common Files\Adobe
2009-07-24 17:18:44 —-D—- D:\Program Files\Adobe
2009-07-24 17:18:29 —-D—- D:\windows\system32
2009-07-24 17:17:03 —-D—- D:\Documents and Settings\All Users\Application Data\Adobe
2009-07-24 17:17:03 —-D—- D:\Documents and Settings\Absurd\Application Data\Adobe
2009-07-24 17:16:55 —-D—- D:\Program Files\Common Files
2009-07-24 16:57:02 —-A—- D:\windows\win.ini
2009-07-24 16:57:01 —-D—- D:\windows\system32\drivers
2009-07-24 16:56:56 —-D—- D:\Program Files
2009-07-24 16:32:05 —-SD—- D:\windows\Tasks
2009-07-24 12:20:58 —-SD—- D:\Documents and Settings\Absurd\Application Data\Microsoft
2009-07-24 12:20:57 —-D—- D:\Documents and Settings\All Users\Application Data\avg8
2009-07-24 00:33:43 —-A—- D:\windows\system.ini
2009-07-23 17:45:24 —-D—- D:\Documents and Settings\All Users\Application Data\IK Multimedia
2009-07-22 09:02:36 —-A—- D:\windows\SIMSYNTH.INI
2009-07-22 09:02:03 —-A—- D:\windows\dsdxirmv.exe
2009-07-22 08:50:33 —-D—- D:\Program Files\Image-Line
2009-07-21 01:59:53 —-HD—- D:\Program Files\InstallShield Installation Information
2009-07-20 23:23:27 —-D—- D:\Documents and Settings\Absurd\Application Data\WinRAR
2009-07-20 18:20:54 —-A—- D:\windows\system32\PerfStringBackup.INI
2009-07-20 16:39:10 —-D—- D:\windows\system32\CatRoot
2009-07-20 16:35:38 —-D—- D:\windows\system32\config
2009-07-20 16:34:52 —-D—- D:\windows\system32\wbem
2009-07-20 16:34:51 —-D—- D:\windows\Registration
2009-07-20 16:33:54 —-HD—- D:\windows\$hf_mig$
2009-07-20 16:33:35 —-HD—- D:\windows\inf
2009-07-20 16:15:53 —-D—- D:\windows\Debug
2009-07-20 05:56:26 —-D—- D:\Temp
2009-07-16 21:42:11 —-D—- D:\windows\Help
2009-07-16 21:40:21 —-D—- D:\Program Files\Common Files\Wise Installation Wizard
2009-07-16 21:40:10 —-RSHDC—- D:\windows\system32\dllcache
2009-07-16 21:31:25 —-D—- D:\windows\system32\ReinstallBackups
2009-07-16 20:52:12 —-D—- D:\Documents and Settings\All Users\Application Data\NVIDIA Corporation
2009-07-16 20:01:24 —-D—- D:\Program Files\NetMeeting
2009-07-16 20:01:24 —-D—- D:\Program Files\MSN
2009-07-16 20:01:13 —-AD—- D:\Program Files\Outlook Express
2009-07-16 20:00:38 —-D—- D:\windows\system32\DirectX
2009-07-16 13:30:46 —-D—- D:\Documents and Settings\All Users\Application Data\Viewpoint
2009-07-16 13:13:35 —-D—- D:\Documents and Settings\Absurd\Application Data\Auslogics
2009-07-16 13:09:55 —-A—- D:\windows\Zmodeler.ini
2009-07-16 11:17:48 —-D—- D:\windows\UltraDefrag
2009-07-16 10:50:15 —-A—- D:\windows\teachpno.ini
2009-07-16 10:50:14 —-A—- D:\windows\recorsta.ini
2009-07-16 10:50:14 —-A—- D:\windows\jamkeys.ini
2009-07-16 10:50:14 —-A—- D:\windows\jam.ini
2009-07-16 10:50:14 —-A—- D:\windows\ARCADE.INI
2009-07-16 10:50:13 —-RSD—- D:\windows\Fonts
2009-07-16 06:44:29 —-D—- D:\windows\ERDNT
2009-07-16 06:41:05 —-D—- D:\windows\AppPatch
2009-07-15 23:22:19 —-D—- D:\windows\pss
2009-07-14 15:20:00 —-D—- D:\Program Files\Internet Explorer
2009-07-14 15:13:28 —-D—- D:\windows\system32\en-us
2009-07-14 15:12:59 —-D—- D:\windows\Media
2009-07-14 13:07:00 —-D—- D:\Documents and Settings\Absurd\Application Data\Digidesign
2009-07-14 12:48:55 —-AHD—- D:\Program Files\WindowsUpdate
2009-07-14 12:48:55 —-AHD—- D:\Program Files\Common Files\Microsoft Shared
2009-07-14 12:48:55 —-AHD—- D:\Documents and Settings\All Users\Application Data\Microsoft
2009-07-14 12:48:29 —-AD—- D:\Program Files\Common Files\System
2009-07-13 13:22:02 —-D—- D:\Program Files\Enigma Software Group
2009-07-11 06:31:45 —-D—- D:\Documents and Settings\Absurd\Application Data\SUPERAntiSpyware.com
2009-07-11 06:31:44 —-D—- D:\Program Files\SUPERAntiSpyware
2009-07-11 06:24:51 —-D—- D:\Program Files\Common Files\Apple
2009-07-11 06:22:48 —-D—- D:\Documents and Settings\Absurd\Application Data\Macromedia
2009-07-11 06:22:06 —-D—- D:\windows\Downloaded Installations
2009-07-11 06:14:59 —-D—- D:\Program Files\Matroska Pack
2009-07-11 05:02:39 —-D—- D:\windows\WinSxS
2009-07-11 04:14:41 —-D—- D:\Documents and Settings\All Users\Application Data\Autodesk
2009-07-11 04:14:40 —-D—- D:\Program Files\Common Files\Autodesk Shared
2009-07-11 04:09:09 —-RSD—- D:\windows\assembly
2009-07-10 14:31:42 —-DC—- D:\windows\system32\DRVSTORE
2009-07-10 13:04:00 —-D—- D:\Program Files\Java
2009-07-10 11:44:09 —-D—- D:\windows\Minidump
2009-07-10 07:53:11 —-D—- D:\Documents and Settings
2009-07-08 12:12:03 —-D—- D:\Program Files\Yahoo!
2009-07-07 13:26:58 —-D—- D:\Program Files\M-Audio
2009-07-06 23:58:53 —-D—- D:\Documents and Settings\All Users\Application Data\Ubisoft
2009-07-06 23:57:48 —-D—- D:\Program Files\NVIDIA Corporation
2009-07-03 08:15:50 —-D—- D:\windows\security
2009-07-03 07:52:30 —-D—- D:\Program Files\Windows Media Connect 2
2009-07-02 21:24:30 —-D—- D:\windows\RegisteredPackages
2009-07-01 15:32:41 —-AD—- D:\Documents and Settings\All Users\Application Data\TEMP
2009-06-29 07:44:33 —-A—- D:\windows\system32\CmdLineExt.dll
2009-06-27 13:08:13 —-D—- D:\Documents and Settings\All Users\Application Data\PACE Anti-Piracy
2009-06-27 13:08:13 —-D—- D:\Documents and Settings\Absurd\Application Data\PACE Anti-Piracy

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AmdK8;AMD Processor Driver; D:\windows\system32\DRIVERS\AmdK8.sys [2006-07-01 36864]
R1 AvgLdx86;AVG Free AVI Loader Driver x86; D:\windows\System32\Drivers\avgldx86.sys [2009-07-11 327688]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86; D:\windows\System32\Drivers\avgmfx86.sys [2009-07-11 27784]
R1 AvgTdiX;AVG Free8 Network Redirector; D:\windows\System32\Drivers\avgtdix.sys [2009-07-11 108552]
R1 BANTExt;Belarc SMBios Access; D:\windows\System32\Drivers\BANTExt.sys [2008-02-27 3840]
R1 cdrbsdrv;cdrbsdrv; D:\windows\system32\drivers\cdrbsdrv.sys [2008-09-08 33408]
R1 cmdGuard;COMODO Firewall Pro Sandbox Driver; D:\windows\System32\DRIVERS\cmdguard.sys [2009-01-19 101776]
R1 cmdHlp;COMODO Firewall Pro Helper Driver; D:\windows\System32\DRIVERS\cmdhlp.sys [2009-01-19 31504]
R1 kbdhid;Keyboard HID Driver; D:\windows\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
R1 PQNTDrv;PQNTDrv; D:\windows\system32\drivers\PQNTDrv.sys [2004-05-05 4228]
R1 prodrv06;StarForce Protection Environment Driver v6; D:\windows\System32\drivers\prodrv06.sys [2003-10-10 52128]
R2 Nsynas32;Nsynas32; D:\windows\system32\drivers\Nsynas32.sys [2001-04-09 17784]
R3 CLEDX;Team H2O CLEDX service; D:\windows\system32\DRIVERS\cledx.sys [2005-05-09 33792]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; D:\windows\SYSTEM32\DRIVERS\GEARAspiWDM.sys [2008-04-17 15464]
R3 hidusb;Microsoft HID Class Driver; D:\windows\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
R3 LHidFilt;Logitech SetPoint KMDF HID Filter Driver; D:\windows\system32\DRIVERS\LHidFilt.Sys [2008-12-18 35472]
R3 LMouFilt;Logitech SetPoint KMDF Mouse Filter Driver; D:\windows\system32\DRIVERS\LMouFilt.Sys [2008-12-18 37392]
R3 LUsbFilt;Logitech SetPoint KMDF USB Filter; D:\windows\System32\Drivers\LUsbFilt.Sys [2008-12-18 28816]
R3 MA_CMIDI;M-Audio USB Driver; D:\windows\system32\drivers\ma_cmidi.sys [2006-08-16 21888]
R3 MAUSBFTP;Service for M-Audio Fast Track Pro (WDM); D:\windows\system32\DRIVERS\mausb.sys [2008-03-11 143624]
R3 mouhid;Mouse HID Driver; D:\windows\system32\DRIVERS\mouhid.sys [2001-08-17 12160]
R3 nv;nv; D:\windows\system32\DRIVERS\nv4_mini.sys [2009-06-10 8087712]
R3 pfc;Padus ASPI Shell; D:\windows\system32\drivers\pfc.sys [2006-03-29 9856]
R3 USB20L;Linksys USB 2.0 10/100 Adapter; D:\windows\system32\DRIVERS\USB200M.sys [2002-09-23 14208]
R3 usbaudio;USB Audio Driver (WDM); D:\windows\system32\drivers\usbaudio.sys [2008-04-14 60032]
R3 usbccgp;Microsoft USB Generic Parent Driver; D:\windows\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; D:\windows\system32\DRIVERS\usbehci.sys [2008-04-14 30208]
R3 usbhub;Microsoft USB Standard Hub Driver; D:\windows\system32\DRIVERS\usbhub.sys [2008-04-14 59520]
R3 usbohci;Microsoft USB Open Host Controller Miniport Driver; D:\windows\system32\DRIVERS\usbohci.sys [2008-04-14 17152]
R3 Wdf01000;Wdf01000; D:\windows\system32\DRIVERS\Wdf01000.sys [2006-11-02 492000]
R3 xusb21;Xbox 360 Wireless Receiver Driver Service 21; D:\windows\system32\DRIVERS\xusb21.sys [2007-02-26 61984]
S1 nvport;NVIDIA PORT IO Control Driver; \??\D:\WINDOWS\system32\Drivers\nvport.sys []
S3 61883;61883 Unit Device; D:\windows\system32\DRIVERS\61883.sys [2008-04-14 48128]
S3 ade970x9;ade970x9; D:\windows\system32\drivers\ade970x9.sys []
S3 Ambfilt;Ambfilt; D:\windows\system32\drivers\Ambfilt.sys []
S3 Arp1394;1394 ARP Client Protocol; D:\windows\system32\DRIVERS\arp1394.sys [2008-04-14 60800]
S3 Avc;AVC Device; D:\windows\system32\DRIVERS\avc.sys [2008-04-14 38912]
S3 BCM43XX;Linksys Wireless-N PCI Adapter WMP300N; D:\windows\system32\DRIVERS\bcmwl5.sys [2006-07-07 564224]
S3 catchme;catchme; \??\D:\DOCUME~1\Absurd\LOCALS~1\Temp\catchme.sys []
S3 CCDECODE;Closed Caption Decoder; D:\windows\system32\DRIVERS\CCDECODE.sys [2008-04-14 17024]
S3 cpuz132;cpuz132; \??\D:\WINDOWS\system32\drivers\cpuz132_x32.sys []
S3 ENTECH;ENTECH; \??\D:\WINDOWS\system32\DRIVERS\ENTECH.sys []
S3 ETDrv;ETDrv; \??\D:\WINDOWS\system32\Drivers\ETDrv.sys []
S3 GVTDrv;GVTDrv; \??\D:\WINDOWS\system32\Drivers\GVTDrv.sys []
S3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; D:\windows\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
S3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); D:\windows\system32\drivers\RtkHDAud.sys []
S3 L8042Kbd;Logitech SetPoint Keyboard Driver; D:\windows\system32\DRIVERS\L8042Kbd.sys [2008-12-18 20240]
S3 MAUSB;Service for M-Audio Fast Track Pro Driver (WDM); D:\windows\system32\DRIVERS\mausb.sys [2008-03-11 143624]
S3 Monfilt;Monfilt; D:\windows\system32\drivers\Monfilt.sys []
S3 MSDV;Microsoft DV Camera and VCR; D:\windows\system32\DRIVERS\msdv.sys [2008-04-14 51200]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; D:\windows\system32\drivers\MSTEE.sys [2008-04-14 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; D:\windows\system32\DRIVERS\NABTSFEC.sys [2008-04-14 85248]
S3 NdisIP;Microsoft TV/Video Connection; D:\windows\system32\DRIVERS\NdisIP.sys [2008-04-14 10880]
S3 NIC1394;1394 Net Driver; D:\windows\system32\DRIVERS\nic1394.sys [2008-04-14 61824]
S3 SLIP;BDA Slip De-Framer; D:\windows\system32\DRIVERS\SLIP.sys [2008-04-14 11136]
S3 SONYPVU1;Sony USB Filter Driver (SONYPVU1); D:\windows\system32\DRIVERS\SONYPVU1.SYS [2001-08-17 7552]
S3 streamip;BDA IPSink; D:\windows\system32\DRIVERS\StreamIP.sys [2008-04-14 15232]
S3 SUPERWEBCAM;SuperWebcam, WDM Virtual Video Capture Device; D:\windows\system32\DRIVERS\superwebcam.sys [2006-06-27 31872]
S3 usbprint;Microsoft USB PRINTER Class; D:\windows\system32\DRIVERS\usbprint.sys [2008-04-14 25856]
S3 usbstor;USB Mass Storage Driver; D:\windows\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 VirtualFD;VirtualFD; \??\D:\Documents and Settings\Absurd\Desktop\virtual_floppy\virtual floppy\vfd.sys []
S3 WMP300Nv1;Linksys Wireless-N PCI Adapter WMP300N Driver; D:\windows\system32\DRIVERS\WMP300Nv1.sys []
S3 WSTCODEC;World Standard Teletext Codec; D:\windows\system32\DRIVERS\WSTCODEC.SYS [2008-04-14 19200]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; D:\windows\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; D:\windows\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 dwshd;dwshd; D:\windows\System32\drivers\dwshd.sys []
S4 IntelIde;IntelIde; D:\windows\system32\drivers\IntelIde.sys []
S4 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; D:\windows\System32\drivers\ws2ifsl.sys [2004-08-04 12032]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 svcWRSSSDK;Webroot Spy Sweeper Engine; D:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe [2005-11-18 2151936]
S2 Diskeeper;Diskeeper; C:\Disk Keeper\DkService.exe []
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service; D:\Program Files\Lavasoft\Ad-Aware\AAWService.exe [2009-07-24 1029456]
S3 aspnet_state;ASP.NET State Service; D:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; D:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; D:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 LPDSVC;TCP/IP Print Server; D:\windows\system32\tcpsvcs.exe [2004-08-04 19456]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; D:\windows\system32\svchost.exe [2008-04-14 14336]
S4 Adobe LM Service;Adobe LM Service; D:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [2008-08-13 72704]
S4 Autodata Limited License Service;Autodata Limited License Service; D:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe [2008-07-14 72704]
S4 avg8emc;AVG Free8 E-mail Scanner; E:\AVG\avgemc.exe [2009-07-11 906520]
S4 avg8wd;AVG Free8 WatchDog; E:\AVG\avgwdsvc.exe [2009-07-11 298776]
S4 Bonjour Service;Bonjour Service; D:\Program Files\Bonjour\mDNSResponder.exe [2008-08-29 238888]
S4 cmdAgent;COMODO Internet Security Helper Service; D:\Program Files\COMODO\Firewall\cmdagent.exe [2009-01-19 618232]
S4 DigiRefresh;Digidesign MME Refresh Service; G:\digidesign\Digidesign\Drivers\MMERefresh.exe [2007-10-31 77824]
S4 digiSPTIService;digiSPTIService; G:\digidesign\Digidesign\Pro Tools\digiSPTIService.exe [2007-10-31 159744]
S4 FLEXnet Licensing Service;FLEXnet Licensing Service; D:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2009-04-11 651720]
S4 gupdate1c9cd3721a28848;Google Update Service (gupdate1c9cd3721a28848); D:\Program Files\Google\Update\GoogleUpdate.exe [2009-05-05 133104]
S4 IDriverT;InstallDriver Table Manager; D:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S4 idsvc;Windows CardSpace; D:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S4 JavaQuickStarterService;Java Quick Starter; D:\Program Files\Java\jre6\bin\jqs.exe [2009-05-21 152984]
S4 LBTServ;Logitech Bluetooth Service; D:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe [2009-02-19 121360]
S4 LexBceS;LexBce Server; D:\WINDOWS\system32\LEXBCES.EXE [2004-05-24 311296]
S4 MA_CMIDI_InstallerService;M-Audio Series II MIDI Installer; D:\Program Files\M-Audio\M-Audio Series II MIDI\MA_CMIDI_Inst.exe [2007-01-08 94208]
S4 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3; D:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe [2008-02-18 877864]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; D:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]
S4 NMIndexingService;NMIndexingService; D:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe [2008-02-28 529704]
S4 nvsvc;NVIDIA Display Driver Service; D:\WINDOWS\system32\nvsvc32.exe [2009-06-10 168004]
S4 PLFlash DeviceIoControl Service;PLFlash DeviceIoControl Service; D:\WINDOWS\system32\IoctlSvc.exe [2006-12-19 81920]
S4 PnkBstrA;PnkBstrA; D:\WINDOWS\system32\PnkBstrA.exe [2008-04-06 66872]
S4 Viewpoint Manager Service;Viewpoint Manager Service; D:\Program Files\Viewpoint\Common\ViewpointService.exe [2007-01-04 24652]
S4 WMPNetworkSvc;Windows Media Player Network Sharing Service; D:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-18 913408]

—————–EOF—————–
Post #2 last edited
Hello and Welcome to the forum.

Unable to access websites


DO NOT use any TOOLS such as Combofix, Vundofix, or HijackThis fixes without supervision.

Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.


Stay with this topic until I give you the all clean post.

You might want to print these instructions out.

I suggest you do this:

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Uncheck "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Uncheck "Hide protected operating system files."
Click Apply, and then click OK.


Please do not delete anything unless instructed to.

NOTE: worksnow is actually Combofix renamed so user is able download and run Combofix

Download worksnow from HERE:


* IMPORTANT !!! Save worksnow to your Desktop


  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : Protective Programs

  • Double click on worksnow & follow the prompts.

    Note: worksnow will run without the Recovery Console installed.

    Note: Combofix will run without the Recovery Console installed.

  • As part of it's process, combofix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


[external image: Posted Image]



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
"copy/paste" a new HijackThis log file into this thread as well.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Give it atleast 20-30 minutes to finish if needed.


Also please describe how your computer behaves at the moment.
Post #3 last edited
When I ran worksnow it told me that Recovery Console was not installed and I selected to install it but it said it could not connect to the internet. It also said that Combo Fix was expired and will run in reduced functionality mode.

Here is the log it produced after it was done running:

ComboFix 09-06-09.06 - Absurd 07/27/2009 8:53.8 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3071.2389 [GMT -4:00]
Running from: d:\documents and settings\[removed]\Desktop\worksnow.exe
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: COMODO Firewall *enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
- REDUCED FUNCTIONALITY MODE -
.

((((((((((((((((((((((((( Files Created from 2009-06-27 to 2009-07-27 )))))))))))))))))))))))))))))))
.

2009-07-27 12:50 . 2009-07-27 12:53 ——– d-s—w- \worksnow
2009-07-25 19:35 . 2009-07-26 00:15 ——– d—–w- d:\documents and settings\Absurd\Application Data\SoundSpectrum
2009-07-25 19:35 . 2009-07-26 00:15 ——– d—–w- d:\docume~1\Absurd\APPLIC~1\SoundSpectrum
2009-07-25 01:56 . 2009-07-25 01:56 ——– d—–w- d:\documents and settings\NetworkService\Application Data\Webroot
2009-07-24 21:17 . 2009-02-12 09:35 38208 —-a-w- d:\documents and settings\Absurd\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2009-07-24 21:16 . 2009-07-24 21:16 ——– d—–w- d:\program files\Common Files\Adobe AIR
2009-07-24 20:57 . 2009-07-24 20:57 ——– d—–w- d:\documents and settings\LocalService\Application Data\Webroot
2009-07-24 20:57 . 2005-11-18 16:05 78336 —-a-w- d:\windows\system32\drivers\ssi.sys
2009-07-24 20:57 . 2004-02-11 22:27 102912 —-a-w- d:\windows\system32\islzma.dll
2009-07-24 20:56 . 2009-07-24 20:56 ——– d—–w- d:\program files\Webroot
2009-07-24 20:56 . 2009-07-24 20:56 ——– d—–w- d:\documents and settings\Absurd\Application Data\Webroot
2009-07-24 20:56 . 2009-07-24 20:56 ——– d—–w- d:\docume~1\Absurd\APPLIC~1\Webroot
2009-07-24 20:56 . 2005-05-20 04:58 356352 —-a-w- d:\windows\system32\eSellerateEngine.dll
2009-07-24 20:56 . 2003-06-06 14:21 81920 —-a-w- d:\windows\system32\eSellerateControl350.dll
2009-07-24 16:17 . 2009-07-24 16:17 ——– d—–w- d:\documents and settings\Absurd\Application Data\AVG8
2009-07-24 16:17 . 2009-07-24 16:17 ——– d—–w- d:\docume~1\Absurd\APPLIC~1\AVG8
2009-07-24 15:37 . 2009-07-24 17:24 ——– d—–w- D:\SDFix
2009-07-24 15:37 . 2009-07-24 17:24 ——– d—–w- \SDFix
2009-07-23 21:47 . 2009-07-23 22:11 16 —-a-w- d:\windows\system32\msvcsv60.dll
2009-07-23 21:30 . 2009-07-24 20:29 15688 —-a-w- d:\windows\system32\lsdelete.exe
2009-07-23 21:26 . 2009-07-13 17:36 38160 —-a-w- d:\windows\system32\drivers\mbamswissarmy.sys
2009-07-23 21:26 . 2009-07-24 12:22 ——– d—–w- d:\program files\Malwarebytes' Anti-Malware
2009-07-23 21:26 . 2009-07-13 17:36 19096 —-a-w- d:\windows\system32\drivers\mbam.sys
2009-07-23 21:19 . 2009-07-23 21:19 ——– dc-h–w- d:\docume~1\ALLUSE~1\APPLIC~1\{83C91755-2546-441D-AC40-9A6B4B860800}
2009-07-23 21:19 . 2009-07-23 21:23 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\Lavasoft
2009-07-23 21:19 . 2009-07-23 21:19 ——– d—–w- d:\program files\Lavasoft
2009-07-22 13:43 . 2009-07-22 13:44 73 —-a-w- d:\windows\system32\ssprs.dll
2009-07-22 13:43 . 2009-07-22 13:44 205 —-a-w- d:\windows\system32\lsprst7.dll
2009-07-22 13:43 . 2009-07-22 13:43 0 —-a-w- d:\windows\system32\tmpPrst.dll
2009-07-22 12:55 . 2009-07-22 12:55 ——– d—–w- d:\program files\Steinberg
2009-07-21 05:59 . 2009-07-21 05:59 ——– d—–w- d:\program files\EASEUS
2009-07-21 04:01 . 2009-07-21 04:01 ——– d-sh–w- d:\documents and settings\NetworkService\IETldCache
2009-07-21 03:37 . 2009-07-21 03:37 ——– d—–w- d:\program files\WizardRecovery
2009-07-21 03:35 . 2009-07-21 03:35 ——– d-sh–w- d:\windows\system32\config\systemprofile\IETldCache
2009-07-21 03:34 . 2009-07-21 03:34 ——– d—–w- d:\program files\Flobo Floppy Bad Sector Repair
2009-07-20 20:34 . 2009-07-20 20:34 ——– d—–w- d:\windows\system32\wbem\Repository
2009-07-20 19:57 . 2004-12-02 09:00 47564 —-a-w- \NTDETECT.COM
2009-07-20 09:56 . 2008-05-20 09:59 1570816 —-a-w- d:\temp\TSDNWIN.exe
2009-07-20 09:56 . 2008-01-24 10:37 2097152 —-a-w- d:\temp\autorun.bin
2009-07-20 03:19 . 2009-07-20 03:19 ——– d—–w- d:\documents and settings\Absurd\Application Data\Viewpoint
2009-07-20 03:19 . 2009-07-20 03:19 ——– d—–w- d:\docume~1\Absurd\APPLIC~1\Viewpoint
2009-07-17 06:35 . 2009-07-17 06:35 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\Office Genuine Advantage
2009-07-17 01:42 . 2009-07-17 01:42 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\nView_Profiles
2009-07-17 01:40 . 2009-07-17 01:40 ——– d—–w- d:\windows\B83FC356B7C0441F8A4DD71E088E7974.TMP
2009-07-17 01:40 . 2009-06-10 10:03 457248 —-a-w- d:\windows\system32\nvudisp.exe
2009-07-17 01:31 . 2006-04-14 18:00 208896 ——w- d:\windows\system32\nvuide.exe
2009-07-17 01:31 . 2006-12-18 20:33 356352 —-a-w- d:\windows\system32\nvusmb.exe
2009-07-17 01:24 . 2009-06-21 12:46 485920 —-a-w- d:\windows\system32\NVUNINST.EXE
2009-07-17 00:52 . 2009-07-17 00:52 ——– d—–w- d:\windows\AC54E5443E42443CA91DA00A6974C592.TMP
2009-07-17 00:36 . 2009-07-17 00:36 ——– d—–w- d:\program files\SystemRequirementsLab
2009-07-17 00:00 . 2009-07-24 23:49 ——– d—–w- d:\program files\NOS
2009-07-17 00:00 . 2009-07-17 00:00 ——– d—–w- d:\program files\vghd
2009-07-16 21:09 . 2009-07-17 00:00 ——– d—–w- d:\windows\system32\$DXE_V2$
2009-07-16 18:00 . 2009-07-16 18:00 23 –sha-w- d:\windows\system32\abedaebd.dat
2009-07-16 17:53 . 2009-07-16 17:53 23 –sha-w- d:\windows\system32\abedaebd_x.dat
2009-07-16 17:30 . 2009-07-16 17:30 ——– d—–w- d:\program files\Viewpoint
2009-07-16 17:22 . 2009-07-17 00:01 ——– d—–w- d:\program files\Common Files\AOL
2009-07-16 17:21 . 2009-07-16 17:30 ——– d—–w- d:\program files\AIM6
2009-07-16 15:58 . 2009-07-16 15:58 ——– d—–w- d:\documents and settings\Absurd\Application Data\Roni Music
2009-07-16 15:58 . 2009-07-16 15:58 ——– d—–w- d:\docume~1\Absurd\APPLIC~1\Roni Music
2009-07-16 10:01 . 2009-07-16 10:01 ——– d-sh–w- d:\documents and settings\LocalService\IETldCache
2009-07-16 09:45 . 2009-07-16 09:45 ——– d—–w- d:\program files\Common Files\Diskeeper Corporation
2009-07-16 09:45 . 2009-07-16 09:45 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\Diskeeper Corporation
2009-07-16 09:34 . 2009-07-16 09:34 ——– d—–w- d:\documents and settings\Absurd\Application Data\Desktopicon
2009-07-16 09:34 . 2009-07-16 09:34 ——– d—–w- d:\docume~1\Absurd\APPLIC~1\Desktopicon
2009-07-15 08:10 . 2009-07-15 11:00 ——– d—–w- d:\program files\SynthEdit
2009-07-14 19:28 . 2009-07-14 19:28 ——– d-sh–w- d:\documents and settings\Absurd\IECompatCache
2009-07-14 19:25 . 2009-07-14 19:25 ——– d-sh–w- d:\documents and settings\Absurd\PrivacIE
2009-07-14 19:20 . 2009-07-14 19:20 ——– d-sh–w- d:\documents and settings\Absurd\IETldCache
2009-07-14 19:10 . 2009-07-14 19:13 ——– dc-h–w- d:\windows\ie8
2009-07-14 01:20 . 2009-07-24 23:49 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\NOS
2009-07-14 01:12 . 2009-07-14 01:12 ——– dc—-w- d:\windows\system32\dllcache\cache
2009-07-14 00:18 . 2009-07-27 12:51 ——– d—–w- \Qoobox
2009-07-12 22:55 . 2009-07-12 22:56 ——– d—–w- D:\rsit
2009-07-12 22:55 . 2009-07-12 22:56 ——– d—–w- \rsit
2009-07-11 13:08 . 2009-07-11 13:13 ——– d—–w- d:\documents and settings\Absurd\Application Data\vlc
2009-07-11 13:08 . 2009-07-11 13:13 ——– d—–w- d:\docume~1\Absurd\APPLIC~1\vlc
2009-07-11 10:45 . 2009-07-17 00:47 ——– d–h–w- D:\$AVG8.VAULT$
2009-07-11 10:45 . 2009-07-17 00:47 ——– d–h–w- \$AVG8.VAULT$
2009-07-11 08:09 . 2009-07-16 04:29 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2009-07-11 08:06 . 2009-07-11 08:06 ——– d—–w- d:\documents and settings\Absurd\Local Settings\Application Data\AVG Security Toolbar
2009-07-11 08:06 . 2009-07-11 08:06 ——– d—–w- d:\docume~1\Absurd\LOCALS~1\APPLIC~1\AVG Security Toolbar
2009-07-11 08:02 . 2009-07-11 08:02 11952 —-a-w- d:\windows\system32\avgrsstx.dll
2009-07-11 08:02 . 2009-07-11 08:02 327688 —-a-w- d:\windows\system32\drivers\avgldx86.sys
2009-07-11 08:02 . 2009-07-11 08:02 27784 —-a-w- d:\windows\system32\drivers\avgmfx86.sys
2009-07-11 08:02 . 2009-07-16 21:49 ——– d—–w- d:\windows\system32\drivers\Avg
2009-07-11 08:02 . 2009-07-14 19:24 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\AVG Security Toolbar
2009-07-11 08:01 . 2009-07-11 08:01 108552 —-a-w- d:\windows\system32\drivers\avgtdix.sys
2009-07-10 21:29 . 2009-07-10 21:29 ——– d—–w- d:\program files\ERUNT
2009-07-10 20:10 . 2009-07-11 16:33 ——– d—–w- d:\documents and settings\Absurd\Application Data\REAPER
2009-07-10 20:10 . 2009-07-11 16:33 ——– d—–w- d:\docume~1\Absurd\APPLIC~1\REAPER
2009-07-10 18:31 . 2009-07-10 18:31 ——– d—–w- d:\program files\AMD
2009-07-10 18:30 . 2009-07-17 01:41 ——– d—–w- d:\program files\AGEIA Technologies
2009-07-10 18:30 . 2009-07-10 18:30 ——– d—–w- d:\windows\system32\AGEIA
2009-07-10 18:22 . 2009-07-10 18:22 ——– d—–w- d:\windows\nview(2)
2009-07-10 17:54 . 2009-07-10 18:31 ——– d—–w- d:\program files\Driver Sweeper
2009-07-10 17:02 . 2009-07-10 17:02 152576 —-a-w- d:\documents and settings\Absurd\Application Data\Sun\Java\jre1.6.0_14\lzma.dll
2009-07-10 12:15 . 2009-07-10 12:42 ——– d—–w- d:\documents and settings\Studio\Application Data\Digidesign
2009-07-10 12:10 . 2009-07-10 12:10 ——– d—–w- d:\documents and settings\Studio\Application Data\Waves Audio
2009-07-10 12:10 . 2009-07-10 12:10 ——– d—–w- d:\documents and settings\Studio\Local Settings\Application Data\Apple Computer
2009-07-10 12:10 . 2009-07-10 12:10 ——– d—–w- d:\documents and settings\Studio\Application Data\M-Audio
2009-07-10 12:10 . 2009-07-10 12:15 ——– d—–w- d:\documents and settings\Studio\Application Data\PACE Anti-Piracy
2009-07-10 12:10 . 2009-07-10 12:10 ——– d—–w- d:\documents and settings\Studio\Local Settings\Application Data\PACE Anti-Piracy
2009-07-07 17:27 . 2008-05-15 21:45 356864 —-a-w- d:\windows\system32\M-AudioTaskBarIcon.exe
2009-07-07 17:27 . 2008-03-11 20:37 143624 —-a-w- d:\windows\system32\drivers\mausb.sys
2009-07-07 17:27 . 2008-03-11 20:37 28680 —-a-w- d:\windows\system32\mausbasio.dll
2009-07-07 17:27 . 2008-03-11 20:37 2519712 —-a-w- d:\windows\system32\madiousb.dll
2009-07-07 03:57 . 2009-07-24 21:23 ——– d—–w- \Config.Msi
2009-07-06 22:05 . 2009-07-06 22:06 88616 —-a-w- d:\documents and settings\stickam\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-07-05 23:26 . 2009-07-05 23:26 ——– d—–w- d:\documents and settings\Absurd\Application Data\Ubisoft
2009-07-05 23:26 . 2009-07-05 23:26 ——– d—–w- d:\docume~1\Absurd\APPLIC~1\Ubisoft
2009-07-03 23:08 . 2009-07-03 23:08 3128 —-a-r- d:\documents and settings\Absurd\Application Data\Microsoft\Installer\{DB1299AF-9EE0-422B-959E-F4171B2AE0F7}\ARPPRODUCTICON.exe
2009-07-03 22:51 . 2009-07-03 22:51 3128 —-a-r- d:\documents and settings\Absurd\Application Data\Microsoft\Installer\{147567F0-8575-4BE0-B5B3-62706C67FA5A}\ARPPRODUCTICON.exe
2009-07-03 22:45 . 2009-07-03 22:45 3128 —-a-r- d:\documents and settings\Absurd\Application Data\Microsoft\Installer\{43E8D9E7-AFC9-4BA3-8106-B95E02B87AB7}\ARPPRODUCTICON.exe
2009-07-03 22:01 . 2009-07-03 22:01 ——– d—–w- d:\program files\Toontrack
2009-07-03 17:30 . 2001-11-19 23:05 3972 —-a-w- d:\windows\system32\drivers\PciBus.sys
2009-07-03 17:30 . 2004-06-22 19:44 5632 —-a-w- d:\windows\system32\drivers\Entech64.sys
2009-07-03 03:18 . 2009-03-27 05:16 12672 —-a-w- d:\windows\system32\drivers\cpuz132_x32.sys
2009-07-03 01:24 . 2009-07-03 01:24 ——– d—–w- d:\windows\system32\windows media
2009-07-03 00:06 . 2009-03-09 19:27 4178264 —-a-w- d:\windows\system32\D3DX9_41.dll
2009-07-03 00:06 . 2009-03-09 19:27 1846632 —-a-w- d:\windows\system32\D3DCompiler_41.dll
2009-07-03 00:06 . 2009-03-16 18:18 69448 —-a-w- d:\windows\system32\XAPOFX1_3.dll
2009-07-03 00:06 . 2009-03-16 18:18 517448 —-a-w- d:\windows\system32\XAudio2_4.dll
2009-07-03 00:06 . 2009-03-16 18:18 235352 —-a-w- d:\windows\system32\xactengine3_4.dll
2009-07-03 00:06 . 2009-03-16 18:18 22360 —-a-w- d:\windows\system32\X3DAudio1_6.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-27 12:49 . 2008-04-05 03:41 ——– d—–w- d:\documents and settings\Absurd\Application Data\DMCache
2009-07-27 12:49 . 2008-04-05 03:41 ——– d—–w- d:\docume~1\Absurd\APPLIC~1\DMCache
2009-07-26 10:43 . 2009-06-15 10:45 28672 —-a-w- d:\documents and settings\Absurd\Application Data\IDM\NP_IDM5.dll
2009-07-26 10:43 . 2009-06-15 10:45 28672 —-a-w- d:\documents and settings\Absurd\Application Data\IDM\NP_IDM4.dll
2009-07-26 10:43 . 2009-06-15 10:45 28672 —-a-w- d:\documents and settings\Absurd\Application Data\IDM\NP_IDM3.dll
2009-07-26 10:43 . 2009-06-15 10:45 28672 —-a-w- d:\documents and settings\Absurd\Application Data\IDM\NP_IDM2.dll
2009-07-26 10:43 . 2009-06-15 10:45 28672 —-a-w- d:\documents and settings\Absurd\Application Data\IDM\NP_IDM1.dll
2009-07-26 10:43 . 2008-05-04 09:02 ——– d—–w- d:\documents and settings\Absurd\Application Data\IDM
2009-07-26 10:43 . 2008-05-04 09:02 ——– d—–w- d:\docume~1\Absurd\APPLIC~1\IDM
2009-07-26 00:14 . 2009-06-23 07:30 ——– d—–w- d:\program files\SoundSpectrum
2009-07-24 21:18 . 2008-04-05 09:18 ——– d—–w- d:\program files\Common Files\Adobe
2009-07-24 16:20 . 2008-10-28 00:25 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\avg8
2009-07-24 12:28 . 2009-07-24 12:28 280 —-a-w- d:\program files\eumr.txt
2009-07-23 22:11 . 2008-06-20 23:23 208 —-a-w- d:\windows\msocreg32.dat
2009-07-23 21:45 . 2008-06-21 22:09 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\IK Multimedia
2009-07-22 13:02 . 2009-06-21 22:15 118784 —-a-w- d:\windows\dsdxirmv.exe
2009-07-22 12:50 . 2009-06-18 06:12 ——– d—–w- d:\program files\Image-Line
2009-07-21 05:59 . 2008-04-02 18:36 ——– d–h–w- d:\program files\InstallShield Installation Information
2009-07-17 01:40 . 2009-01-19 08:31 ——– d—–w- d:\program files\Common Files\Wise Installation Wizard
2009-07-17 00:52 . 2008-04-09 10:39 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\NVIDIA Corporation
2009-07-16 23:05 . 2008-04-02 18:43 56272 —-a-w- d:\documents and settings\Absurd\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-07-16 23:05 . 2008-04-02 18:43 56272 —-a-w- d:\docume~1\Absurd\LOCALS~1\APPLIC~1\GDIPFONTCACHEV1.DAT
2009-07-16 17:30 . 2008-06-23 00:28 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\Viewpoint
2009-07-16 17:13 . 2009-06-19 21:43 ——– d—–w- d:\documents and settings\Absurd\Application Data\Auslogics
2009-07-16 17:13 . 2009-06-19 21:43 ——– d—–w- d:\docume~1\Absurd\APPLIC~1\Auslogics
2009-07-14 17:07 . 2008-04-09 03:32 ——– d—–w- d:\documents and settings\Absurd\Application Data\Digidesign
2009-07-14 17:07 . 2008-04-09 03:32 ——– d—–w- d:\docume~1\Absurd\APPLIC~1\Digidesign
2009-07-13 17:22 . 2008-04-03 07:33 ——– d—–w- d:\program files\Enigma Software Group
2009-07-11 10:31 . 2009-01-19 08:59 ——– d—–w- d:\documents and settings\Absurd\Application Data\SUPERAntiSpyware.com
2009-07-11 10:31 . 2009-01-19 08:59 ——– d—–w- d:\docume~1\Absurd\APPLIC~1\SUPERAntiSpyware.com
2009-07-11 10:31 . 2009-01-19 08:59 ——– d—–w- d:\program files\SUPERAntiSpyware
2009-07-11 10:24 . 2008-04-02 23:20 ——– d—–w- d:\program files\Common Files\Apple
2009-07-11 10:14 . 2008-11-15 04:19 ——– d—–w- d:\program files\Matroska Pack
2009-07-11 08:14 . 2009-04-11 11:51 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\Autodesk
2009-07-11 08:14 . 2009-04-11 11:51 ——– d—–w- d:\program files\Common Files\Autodesk Shared
2009-07-10 17:04 . 2009-02-22 19:28 ——– d—–w- d:\program files\Java
2009-07-10 11:53 . 2009-07-10 11:53 ——– d—–w- d:\documents and settings\Studio\Application Data\Logitech
2009-07-10 11:53 . 2009-07-10 11:53 88616 —-a-w- d:\documents and settings\Studio\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-07-08 16:12 . 2009-06-19 23:02 ——– d—–w- d:\program files\Yahoo!
2009-07-07 17:26 . 2008-06-08 06:00 ——– d—–w- d:\program files\M-Audio
2009-07-07 03:58 . 2008-04-21 17:04 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\Ubisoft
2009-07-07 03:57 . 2008-08-15 08:49 ——– d—–w- d:\program files\NVIDIA Corporation
2009-07-03 11:52 . 2008-11-17 19:49 ——– d—–w- d:\program files\Windows Media Connect 2
2009-07-01 19:32 . 2008-04-09 10:09 ——– d—a-w- d:\docume~1\ALLUSE~1\APPLIC~1\TEMP
2009-07-01 12:59 . 2009-06-26 23:20 ——– d—–w- d:\program files\EVGA Precision
2009-06-29 11:44 . 2008-04-09 07:39 107888 —-a-w- d:\windows\system32\CmdLineExt.dll
2009-06-27 17:08 . 2008-04-06 06:22 ——– d—–w- d:\documents and settings\Absurd\Application Data\PACE Anti-Piracy
2009-06-27 17:08 . 2008-04-06 06:22 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\PACE Anti-Piracy
2009-06-27 17:08 . 2008-04-06 06:22 ——– d—–w- d:\docume~1\Absurd\APPLIC~1\PACE Anti-Piracy
2009-06-27 05:22 . 2009-06-27 05:22 0 —ha-w- d:\windows\system32\drivers\Msft_Kernel_xusb21_01001.Wdf
2009-06-27 05:22 . 2009-06-27 05:22 ——– d—–w- d:\program files\Microsoft Xbox 360 Accessories
2009-06-25 07:39 . 2009-06-25 07:39 ——– d—–w- d:\documents and settings\Absurd\Application Data\M-Audio
2009-06-25 07:39 . 2009-06-25 07:39 ——– d—–w- d:\docume~1\Absurd\APPLIC~1\M-Audio
2009-06-25 02:11 . 2009-06-25 02:11 2048 —-a-w- d:\windows\system32\sysprs7.dll
2009-06-25 02:11 . 2009-06-25 02:11 1025 —-a-w- d:\windows\system32\clauth2.dll
2009-06-25 02:11 . 2009-06-25 02:11 1025 —-a-w- d:\windows\system32\clauth1.dll
2009-06-25 00:47 . 2009-06-25 00:47 ——– d—–w- d:\program files\Syncrosoft
2009-06-25 00:40 . 2009-06-19 13:33 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\Cakewalk
2009-06-23 07:30 . 2009-06-23 07:30 ——– d—–w- d:\program files\Common Files\Real
2009-06-23 07:14 . 2009-06-23 07:11 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\ElectricSheep
2009-06-23 05:11 . 2009-06-23 05:11 ——– d—–w- d:\documents and settings\Absurd\Application Data\dBpoweramp
2009-06-23 05:11 . 2009-06-23 05:11 ——– d—–w- d:\docume~1\Absurd\APPLIC~1\dBpoweramp
2009-06-22 14:45 . 2009-06-22 14:45 ——– d—–w- d:\program files\Common Files\Voyetra
2009-06-22 14:33 . 2009-06-22 14:33 198064 —-a-w- d:\documents and settings\Absurd\Application Data\IDM\idmmzcc3\components\idmmzcc.dll
2009-06-22 14:32 . 2008-05-04 09:02 ——– d—–w- d:\program files\Internet Download Manager
2009-06-22 01:52 . 2009-06-22 01:52 ——– d—–w- d:\documents and settings\Absurd\Application Data\AccurateRip
2009-06-22 01:52 . 2009-06-22 01:52 ——– d—–w- d:\docume~1\Absurd\APPLIC~1\AccurateRip
2009-06-22 01:52 . 2009-06-22 01:52 13841 —-a-w- d:\windows\system32\SpoonUninstall-dBpoweramp Music Converter.dat
2009-06-22 01:44 . 2009-06-02 14:41 ——– d—–w- d:\documents and settings\Absurd\Application Data\Ableton
2009-06-22 01:44 . 2009-06-02 14:41 ——– d—–w- d:\docume~1\Absurd\APPLIC~1\Ableton
2009-06-21 23:24 . 2009-06-21 23:11 ——– d—–w- d:\documents and settings\Absurd\Application Data\Steinberg
2009-06-21 23:24 . 2009-06-21 23:11 ——– d—–w- d:\docume~1\Absurd\APPLIC~1\Steinberg
2009-06-21 23:15 . 2009-06-21 23:15 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\Steinberg
2009-06-21 22:32 . 2009-06-19 13:33 ——– d—–w- d:\documents and settings\Absurd\Application Data\Cakewalk
2009-06-21 22:32 . 2009-06-19 13:33 ——– d—–w- d:\docume~1\Absurd\APPLIC~1\Cakewalk
2009-06-20 08:34 . 2008-06-23 18:18 ——– d—–w- d:\program files\IK Multimedia
2009-06-19 23:15 . 2009-01-22 07:07 ——– d—–w- d:\program files\SmartFTP Client
2009-06-19 23:03 . 2009-06-19 23:03 ——– d—–w- d:\documents and settings\Absurd\Application Data\Yahoo!
2009-06-19 23:03 . 2009-06-19 23:03 ——– d—–w- d:\docume~1\Absurd\APPLIC~1\Yahoo!
2009-06-19 22:59 . 2009-06-19 22:59 ——– d—–w- d:\documents and settings\Absurd\Application Data\TweakNow RegCleaner
2009-06-19 22:59 . 2009-06-19 22:59 ——– d—–w- d:\docume~1\Absurd\APPLIC~1\TweakNow RegCleaner
2009-06-19 14:43 . 2009-06-03 05:50 ——– d—–w- d:\program files\Common Files\Native Instruments
2009-06-19 13:55 . 2009-06-19 13:55 ——– d—–w- d:\program files\LUXONIX
2009-06-19 08:25 . 2008-04-03 02:16 ——– d—–w- d:\program files\GIGABYTE
2009-06-19 07:41 . 2008-04-07 15:51 24944 —-a-w- d:\windows\system32\drivers\GVTDrv.sys
2009-06-19 06:52 . 2008-08-02 06:37 ——– d—–w- d:\program files\ZModeler
2009-06-19 06:40 . 2009-06-12 08:20 ——– d—–w- d:\program files\McDSP
2009-06-19 06:36 . 2008-09-18 09:01 ——– d—–w- d:\program files\Google
2009-06-19 05:47 . 2009-04-10 10:48 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\Alibre Design
2009-06-18 20:20 . 2009-06-18 20:20 ——– d—–w- d:\program files\Belarc
2009-06-18 12:36 . 2009-06-18 12:36 ——– dc-h–w- d:\docume~1\ALLUSE~1\APPLIC~1\{2ED18044-7049-4E7A-A58D-4017348FCDB7}
2009-06-18 12:35 . 2009-06-18 12:35 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\Native Instruments
2009-06-18 12:35 . 2008-08-05 04:52 ——– d—–w- d:\program files\Native Instruments
2009-06-18 12:35 . 2009-06-18 12:35 ——– dc-h–w- d:\docume~1\ALLUSE~1\APPLIC~1\{902029B2-957E-4066-85FA-30DA31731718}
2009-06-17 02:52 . 2009-06-17 02:52 ——– d—–w- d:\program files\Common Files\Software Update Utility
2009-06-17 02:49 . 2009-06-17 02:49 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\AOL Downloads
2009-06-13 21:31 . 2009-06-13 21:31 ——– d—–w- d:\program files\Sonnox
2009-06-13 11:17 . 2009-06-13 11:17 0 —ha-w- d:\windows\system32\drivers\Msft_Kernel_LUsbFilt_01005.Wdf
2009-06-12 09:56 . 2009-06-12 09:56 ——– d—–w- d:\documents and settings\Absurd\Application Data\FabFilter
2009-06-12 09:56 . 2009-06-12 09:56 ——– d—–w- d:\docume~1\Absurd\APPLIC~1\FabFilter
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2009-06-14 20:07 1004800 —-a-w- e:\avg\Toolbar\IEToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"M-Audio Taskbar Icon"="d:\windows\System32\M-AudioTaskBarIcon.exe" [2008-05-15 356864]
"AVG8_TRAY"="e:\avg\avgtray.exe" [2009-07-11 1948440]
"NvCplDaemon"="d:\windows\system32\NvCpl.dll" [2009-06-10 13758464]
"NvMediaCenter"="d:\windows\system32\NvMcTray.dll" [2009-06-10 86016]
"MSConfig"="d:\windows\pchealth\helpctr\Binaries\MSCONFIG.EXE" [2008-04-14 169984]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" - d:\windows\KHALMNPR.Exe [2008-12-19 76304]
"nwiz"="nwiz.exe" - d:\windows\system32\nwiz.exe [2009-06-10 1657376]

d:\documents and settings\Absurd\Start Menu\Programs\Startup\
Adobe Gamma.lnk - d:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-7-14 113664]

d:\docume~1\Absurd\STARTM~1\Programs\Startup\
Adobe Gamma.lnk - d:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-7-14 113664]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoChangeAnimation"= 0 (0x0)
"NoStrCmpLogical"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"MemCheckBoxInRunDlg"= 0 (0x0)
"NoStrCmpLogical"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2009-02-19 04:30 72208 —-a-w- d:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
[BU]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-07-11 08:02 11952 —-a-w- d:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=d:\windows\system32\guard32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"Midi1"=ma_cmidn.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0lsdelete\0SsiEfr.e

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\svcWRSSSDK]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKLM\~\startupfolder\D:^Documents and Settings^Absurd^Start Menu^Programs^Startup^ERUNT AutoBackup.lnk]
path=
backup=d:\windows\pss\ERUNT AutoBackup.lnkStartup

[HKLM\~\startupfolder\D:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech SetPoint.lnk]
path=
backup=d:\windows\pss\Logitech SetPoint.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=3 (0x3)
"PnkBstrA"=2 (0x2)
"PLFlash DeviceIoControl Service"=2 (0x2)
"NVSvc"=2 (0x2)
"NMIndexingService"=3 (0x3)
"Nero BackItUp Scheduler 3"=2 (0x2)
"MA_CMIDI_InstallerService"=2 (0x2)
"LexBceS"=2 (0x2)
"LBTServ"=3 (0x3)
"JavaQuickStarterService"=2 (0x2)
"idsvc"=3 (0x3)
"IDriverT"=3 (0x3)
"gupdate1c9cd3721a28848"=2 (0x2)
"FLEXnet Licensing Service"=3 (0x3)
"digiSPTIService"=3 (0x3)
"DigiRefresh"=2 (0x2)
"cmdAgent"=2 (0x2)
"Bonjour Service"=2 (0x2)
"avg8wd"=2 (0x2)
"avg8emc"=2 (0x2)
"Autodata Limited License Service"=2 (0x2)
"Adobe LM Service"=3 (0x3)
"Diskeeper"=2 (0x2)
"svcWRSSSDK"=2 (0x2)
"Lavasoft Ad-Aware Service"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"d:\\Program Files\\GIGABYTE\\@BIOS\\gwflash.exe"=
"d:\\WINDOWS\\system32\\PnkBstrA.exe"=
"d:\\WINDOWS\\system32\\PnkBstrB.exe"=
"d:\\Program Files\\GIGABYTE\\EasyTune4\\update.exe"=
"d:\\Program Files\\Common Files\\Nero\\Nero Web\\SetupX.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"d:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"d:\\Program Files\\SmartFTP Client\\SmartFTP.exe"=
"d:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"d:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"d:\\Program Files\\Messenger\\msmsgs.exe"=
"d:\\Program Files\\Internet Download Manager\\IDMan.exe"=
"f:\\Games\\grid\\GRID.exe"=
"f:\\Games\\HAWX\\HAWX.exe"=
"f:\\Games\\Ghost Recon Advanced Warfighter 2\\graw2.exe"=
"f:\\Games\\Ghost Recon Advanced Warfighter 2\\graw2_dedicated.exe"=
"d:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"d:\\Program Files\\AIM6\\aim6.exe"=

R0 DigiFilter;DigiFilter;d:\windows\system32\drivers\DigiFilt.sys [4/4/2008 4:21 AM 16384]
R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);d:\windows\system32\drivers\sfsync03.sys [12/6/2005 11:11 AM 35328]
R0 SSI;SSI;d:\windows\system32\drivers\ssi.sys [7/24/2009 4:57 PM 78336]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;d:\windows\system32\drivers\avgldx86.sys [7/11/2009 4:02 AM 327688]
R1 AvgTdiX;AVG Free8 Network Redirector;d:\windows\system32\drivers\avgtdix.sys [7/11/2009 4:01 AM 108552]
R1 cmdGuard;COMODO Firewall Pro Sandbox Driver;d:\windows\system32\drivers\cmdguard.sys [7/8/2008 9:32 PM 101776]
R1 cmdHlp;COMODO Firewall Pro Helper Driver;d:\windows\system32\drivers\cmdhlp.sys [7/8/2008 9:32 PM 31504]
R3 CLEDX;Team H2O CLEDX service;d:\windows\system32\drivers\cledx.sys [6/24/2009 8:48 PM 33792]
R3 MAUSBFTP;Service for M-Audio Fast Track Pro (WDM);d:\windows\system32\drivers\mausb.sys [7/7/2009 1:27 PM 143624]
S3 Ambfilt;Ambfilt;d:\windows\system32\drivers\Ambfilt.sys –> d:\windows\system32\drivers\Ambfilt.sys [?]
S3 cpuz132;cpuz132;d:\windows\system32\drivers\cpuz132_x32.sys [7/2/2009 11:18 PM 12672]
S3 ETDrv;ETDrv;d:\windows\system32\drivers\ETDrv.sys [6/19/2009 4:28 AM 185280]
S3 GVTDrv;GVTDrv;d:\windows\system32\drivers\GVTDrv.sys [4/7/2008 11:51 AM 24944]
S3 MAUSB;Service for M-Audio Fast Track Pro Driver (WDM);d:\windows\system32\drivers\mausb.sys [7/7/2009 1:27 PM 143624]
S3 SUPERWEBCAM;SuperWebcam, WDM Virtual Video Capture Device;d:\windows\system32\drivers\superwebcam.sys [4/2/2008 4:50 PM 31872]
S3 WMP300Nv1;Linksys Wireless-N PCI Adapter WMP300N Driver;d:\windows\system32\DRIVERS\WMP300Nv1.sys –> d:\windows\system32\DRIVERS\WMP300Nv1.sys [?]
S4 avg8emc;AVG Free8 E-mail Scanner;e:\avg\avgemc.exe [7/11/2009 4:01 AM 906520]
S4 avg8wd;AVG Free8 WatchDog;e:\avg\avgwdsvc.exe [7/11/2009 4:01 AM 298776]
S4 gupdate1c9cd3721a28848;Google Update Service (gupdate1c9cd3721a28848);d:\program files\Google\Update\GoogleUpdate.exe [5/5/2009 12:08 AM 133104]
S4 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;d:\program files\Lavasoft\Ad-Aware\AAWService.exe [1/18/2009 5:34 PM 1029456]
S4 Viewpoint Manager Service;Viewpoint Manager Service;d:\program files\Viewpoint\Common\ViewpointService.exe [7/16/2009 1:30 PM 24652]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"d:\windows\system32\rundll32.exe" "d:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
IE: Download All Links with IDM - d:\program files\Internet Download Manager\IEGetAll.htm
IE: Download FLV video content with IDM - d:\program files\Internet Download Manager\IEGetVL.htm
IE: Download with IDM - d:\program files\Internet Download Manager\IEExt.htm
Trusted Zone: stickam.com\www
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
FF - ProfilePath - d:\docume~1\Absurd\APPLIC~1\Mozilla\Firefox\Profiles\lmgq9aad.default\
FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType;=tb50fftrie7&query;=
FF - prefs.js: browser.search.selectedEngine - AIM Search
FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType;=tb50fftrab&query;=
FF - component: d:\documents and settings\Absurd\Application Data\Mozilla\Firefox\Profiles\lmgq9aad.default\extensions\[removed]\components\idmmzcc.dll
FF - component: e:\avg\Firefox\components\avgssff.dll
FF - component: e:\avg\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils2.dll
FF - component: e:\avg\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll
FF - component: e:\avg\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll
FF - component: e:\avg\Toolbar\Firefox\avg@igeared\components\xpavgtbapi.dll
FF - plugin: d:\program files\Google\Update\1.2.131.11\npGoogleOneClick5.dll
FF - plugin: d:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: d:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: d:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF - plugin: d:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-27 08:53
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files:

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(736)
d:\windows\system32\guard32.dll
d:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
d:\program files\common files\logishrd\bluetooth\LBTServ.dll
d:\windows\system32\WRLogonNTF.dll
d:\windows\System32\BCMLogon.dll

- - - - - - - > 'lsass.exe'(792)
d:\windows\system32\guard32.dll

- - - - - - - > 'explorer.exe'(2596)
d:\windows\system32\msi.dll
d:\windows\system32\ieframe.dll
d:\windows\system32\OneX.DLL
d:\windows\system32\eappprxy.dll
d:\windows\system32\webcheck.dll
d:\windows\system32\WPDShServiceObj.dll
d:\program files\SmartFTP Client\smarthook.dll
d:\windows\system32\PortableDeviceTypes.dll
d:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2009-07-27 8:54
ComboFix-quarantined-files.txt 2009-07-27 12:54
ComboFix2.txt 2009-07-16 10:58
ComboFix3.txt 2009-07-14 01:14

Pre-Run: 7,524,122,624 bytes free
Post-Run: 7,520,391,168 bytes free

Current=3 Default=3 Failed=1 LastKnownGood=4 Sets=1,2,3,4
426 — E O F — 2009-07-04 07:00







Hijackthis will still not run. Here is a new RSIT log:






Logfile of random's system information tool 1.06 (written by random/random)
Run by [removed] at 2009-07-27 09:11:41
Microsoft Windows XP Home Edition Service Pack 3
System drive D: has 7 GB (24%) free of 30 GB
Total RAM: 3071 MB (82% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:11:57 AM, on 7/27/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
D:\windows\System32\smss.exe
D:\windows\system32\winlogon.exe
D:\windows\system32\services.exe
D:\windows\system32\lsass.exe
D:\windows\system32\svchost.exe
D:\windows\System32\svchost.exe
E:\AVG\avgrsx.exe
D:\windows\system32\spoolsv.exe
D:\windows\system32\svchost.exe
D:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
D:\WINDOWS\System32\M-AudioTaskBarIcon.exe
E:\AVG\avgtray.exe
D:\windows\system32\RUNDLL32.EXE
D:\Program Files\AIM6\aolsoftware.exe
D:\Program Files\Google\Update\GoogleUpdate.exe
D:\windows\explorer.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\Documents and Settings\Absurd\Desktop\RSIT.exe
D:\Program Files\Trend Micro\HijackThis\Absurd.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - E:\AVG\Toolbar\IEToolbar.dll
R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: IDMIEHlprObj Class - {0055C089-8582-441B-A0BF-17B458C2A3A8} - D:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - E:\AVG\avgssie.dll
O2 - BHO: Spybot-S&D; IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - E:\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Update Helper - {77D7E795-33C5-4323-974D-A2A49AB75517} - D:\Program Files\Google\Update\1.2.131.11\GoopdateBho.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - E:\AVG\Toolbar\IEToolbar.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - D:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - E:\AVG\Toolbar\IEToolbar.dll
O4 - HKLM\..\Run: [M-Audio Taskbar Icon] D:\WINDOWS\System32\M-AudioTaskBarIcon.exe
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [AVG8_TRAY] E:\AVG\avgtray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [MSConfig] D:\windows\pchealth\helpctr\Binaries\MSCONFIG.EXE /auto
O4 - Startup: Adobe Gamma.lnk = D:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: Download All Links with IDM - D:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - D:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - D:\Program Files\Internet Download Manager\IEExt.htm
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - D:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog; This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - D:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo…sreqlab_nvd.cab
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownlo…iaSmartScan.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - E:\AVG\avgpp.dll
O20 - AppInit_DLLs: D:\WINDOWS\system32\guard32.dll
O20 - Winlogon Notify: !SASWinLogon - D:\windows\
O20 - Winlogon Notify: avgrsstarter - D:\windows\SYSTEM32\avgrsstx.dll
O24 - Desktop Component 0: Aqua Real 2 - AD0FABD2-7EAE-40B8-8F44-6FCFE6C883CD

–
End of file - 5484 bytes

======Scheduled tasks folder======

D:\windows\tasks\GoogleUpdateTaskMachine.job
D:\windows\tasks\Uniblue SpeedUpMyPC Nag.job
D:\windows\tasks\Uniblue SpeedUpMyPC.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}]
IDMIEHlprObj Class - D:\Program Files\Internet Download Manager\IDMIECC.dll [2009-05-07 169392]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]
AVG Safe Search - E:\AVG\avgssie.dll [2009-07-11 1107224]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D; IE Protection - E:\SPYBOT~1\SDHelper.dll [2009-01-26 1879896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{77D7E795-33C5-4323-974D-A2A49AB75517}]
Google Update Helper - D:\Program Files\Google\Update\1.2.131.11\GoopdateBho.dll [2009-05-05 133616]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live Sign-in Helper - D:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
AVG Security Toolbar BHO - E:\AVG\Toolbar\IEToolbar.dll [2009-06-14 1004800]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java™ Plug-In 2 SSV Helper - D:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-05-21 41368]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - D:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-05-21 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - AVG Security Toolbar - E:\AVG\Toolbar\IEToolbar.dll [2009-06-14 1004800]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"M-Audio Taskbar Icon"=D:\WINDOWS\System32\M-AudioTaskBarIcon.exe [2008-05-15 356864]
"Kernel and Hardware Abstraction Layer"=D:\windows\KHALMNPR.EXE [2008-12-18 76304]
"AVG8_TRAY"=E:\AVG\avgtray.exe [2009-07-11 1948440]
"NvCplDaemon"=D:\WINDOWS\system32\NvCpl.dll [2009-06-10 13758464]
"nwiz"=nwiz.exe /install []
"NvMediaCenter"=D:\WINDOWS\system32\NvMcTray.dll [2009-06-10 86016]
"MSConfig"=D:\windows\pchealth\helpctr\Binaries\MSCONFIG.EXE [2008-04-14 169984]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ad-Watch]
D:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe [2009-07-24 520024]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
D:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-02-27 35696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EA Core]
D:\Program Files\Electronic Arts\EADM\Core.exe [2008-07-22 2772992]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H2O]
D:\Program Files\SyncroSoft\Pos\H2O\cledx.exe [2005-05-11 200069]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IDMan]
D:\Program Files\Internet Download Manager\IDMan.exe [2009-05-28 960944]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
D:\Program Files\Windows Live\Messenger\msnmsgr.exe [2009-02-06 3885408]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVIDIA nTune]
D:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe clear []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
D:\Program Files\QuickTime\qttask.exe [2008-09-06 413696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
E:\Spybot - Search & Destroy\TeaTimer.exe [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
D:\Program Files\Java\jre6\bin\jusched.exe [2009-05-21 148888]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
D:\Program Files\SUPERAntiSpyware\11b60ed9-558f-4a2f-bedc-e58aa3a9e0f8.exe [2008-12-22 1830128]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\D:^Documents and Settings^Absurd^Start Menu^Programs^Startup^ERUNT AutoBackup.lnk]
D:\PROGRA~1\ERUNT\AUTOBACK.EXE [2005-10-20 38912]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\D:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech SetPoint.lnk]
D:\PROGRA~1\Logitech\SetPoint\SetPoint.exe [2009-02-19 809488]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=3
"PnkBstrA"=2
"PLFlash DeviceIoControl Service"=2
"NVSvc"=2
"NMIndexingService"=3
"Nero BackItUp Scheduler 3"=2
"MA_CMIDI_InstallerService"=2
"LexBceS"=2
"LBTServ"=3
"JavaQuickStarterService"=2
"idsvc"=3
"IDriverT"=3
"gupdate1c9cd3721a28848"=2
"FLEXnet Licensing Service"=3
"digiSPTIService"=3
"DigiRefresh"=2
"cmdAgent"=2
"Bonjour Service"=2
"avg8wd"=2
"avg8emc"=2
"Autodata Limited License Service"=2
"Adobe LM Service"=3
"Diskeeper"=2
"svcWRSSSDK"=2
"Lavasoft Ad-Aware Service"=2

D:\Documents and Settings\Absurd\Start Menu\Programs\Startup
Adobe Gamma.lnk - D:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="D:\WINDOWS\system32\guard32.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\avgrsstarter]
D:\windows\system32\avgrsstx.dll [2009-07-11 11952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\LBTWlgn]
d:\program files\common files\logishrd\bluetooth\LBTWlgn.dll [2009-02-19 72208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WRNotifier]
D:\windows\system32\WRLogonNTF.dll [2005-11-18 492544]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - D:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\svcWRSSSDK]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Lavasoft Ad-Aware Service]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\svcWRSSSDK]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WdfLoadGroup]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"MemCheckBoxInRunDlg"=0
"NoStrCmpLogical"=0
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoChangeAnimation"=
"NoStrCmpLogical"=
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"D:\Program Files\GIGABYTE\@BIOS\gwflash.exe"="D:\Program Files\GIGABYTE\@BIOS\gwflash.exe:*:Enabled:gwflash"
"D:\WINDOWS\system32\PnkBstrA.exe"="D:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA"
"D:\WINDOWS\system32\PnkBstrB.exe"="D:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB"
"D:\Program Files\GIGABYTE\EasyTune4\update.exe"="D:\Program Files\GIGABYTE\EasyTune4\update.exe:*:Enabled:ftptest"
"D:\Program Files\Common Files\Nero\Nero Web\SetupX.exe"="D:\Program Files\Common Files\Nero\Nero Web\SetupX.exe:*:Enabled:Nero ControlCenter"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"D:\Program Files\Bonjour\mDNSResponder.exe"="D:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"D:\Program Files\Mozilla Firefox\firefox.exe"="D:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox"
"D:\Program Files\SmartFTP Client\SmartFTP.exe"="D:\Program Files\SmartFTP Client\SmartFTP.exe:*:Enabled:SmartFTP Client 2.5"
"D:\Program Files\Windows Live\Messenger\wlcsdk.exe"="D:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"
"D:\Program Files\Windows Live\Messenger\msnmsgr.exe"="D:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"D:\Program Files\Messenger\msmsgs.exe"="D:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"D:\Program Files\Internet Download Manager\IDMan.exe"="D:\Program Files\Internet Download Manager\IDMan.exe:*:Enabled:Internet Download Manager (IDM)"
"F:\Games\grid\GRID.exe"="F:\Games\grid\GRID.exe:*:Enabled:GRID"
"F:\Games\HAWX\HAWX.exe"="F:\Games\HAWX\HAWX.exe:*:Enabled:Tom Clancy's H.A.W.X"
"F:\Games\Ghost Recon Advanced Warfighter 2\graw2.exe"="F:\Games\Ghost Recon Advanced Warfighter 2\graw2.exe:*:Enabled:Ghost Recon Advanced Warfighter® 2"
"F:\Games\Ghost Recon Advanced Warfighter 2\graw2_dedicated.exe"="F:\Games\Ghost Recon Advanced Warfighter 2\graw2_dedicated.exe:*:Enabled:Ghost Recon Advanced Warfighter® 2 Dedicated Server"
"D:\Program Files\Common Files\AOL\Loader\aolload.exe"="D:\Program Files\Common Files\AOL\Loader\aolload.exe:*:Enabled:AOL Loader"
"D:\Program Files\AIM6\aim6.exe"="D:\Program Files\AIM6\aim6.exe:*:Enabled:AIM"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"D:\Program Files\Windows Live\Messenger\wlcsdk.exe"="D:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"
"D:\Program Files\Windows Live\Messenger\msnmsgr.exe"="D:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"

======File associations======

.js - edit -
.js - open -
.scr - open - D:\WINDOWS\system32\notepad.exe "%1"
.scr - install -
.scr - config -
.txt - open -

======List of files/folders created in the last 1 months======

2009-07-27 08:55:02 —-D—- D:\windows\temp
2009-07-27 08:54:59 —-A—- D:\ComboFix.txt
2009-07-25 15:35:49 —-D—- D:\Documents and Settings\Absurd\Application Data\SoundSpectrum
2009-07-24 17:16:55 —-D—- D:\Program Files\Common Files\Adobe AIR
2009-07-24 16:57:01 —-A—- D:\windows\system32\wrlzma.dll
2009-07-24 16:57:01 —-A—- D:\windows\system32\WRLogonNtf.dll
2009-07-24 16:57:01 —-A—- D:\windows\system32\ssiefr.EXE
2009-07-24 16:57:01 —-A—- D:\windows\system32\islzma.dll
2009-07-24 16:56:56 —-D—- D:\Program Files\Webroot
2009-07-24 16:56:56 —-D—- D:\Documents and Settings\Absurd\Application Data\Webroot
2009-07-24 16:56:56 —-A—- D:\windows\WRUninstall.dll
2009-07-24 16:56:56 —-A—- D:\windows\system32\eSellerateEngine.dll
2009-07-24 16:56:56 —-A—- D:\windows\system32\eSellerateControl350.dll
2009-07-24 16:56:56 —-A—- D:\windows\ssleay32.dll
2009-07-24 16:56:56 —-A—- D:\windows\libeay32.dll
2009-07-24 12:17:45 —-D—- D:\Documents and Settings\Absurd\Application Data\AVG8
2009-07-24 11:37:24 —-D—- D:\SDFix
2009-07-24 08:28:41 —-A—- D:\Program Files\eumr.txt
2009-07-23 17:47:39 —-A—- D:\windows\system32\msvcsv60.dll
2009-07-23 17:30:28 —-A—- D:\windows\system32\lsdelete.exe
2009-07-23 17:26:51 —-D—- D:\Program Files\Malwarebytes' Anti-Malware
2009-07-23 17:19:47 —-HDC—- D:\Documents and Settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}
2009-07-23 17:19:28 —-D—- D:\Program Files\Lavasoft
2009-07-23 17:19:28 —-D—- D:\Documents and Settings\All Users\Application Data\Lavasoft
2009-07-22 19:06:36 —-A—- D:\windows\system32\wpa.bak
2009-07-22 09:43:07 —-A—- D:\windows\system32\tmpPrst.dll
2009-07-22 09:43:07 —-A—- D:\windows\system32\ssprs.dll
2009-07-22 09:43:07 —-A—- D:\windows\system32\lsprst7.dll
2009-07-22 08:55:21 —-D—- D:\Program Files\Steinberg
2009-07-22 08:54:50 —-A—- D:\windows\ReFX Slayer 2 VSTi v2.6-H2O Setup Log.txt
2009-07-22 08:48:13 —-A—- D:\windows\Packs Multi Presets Setup Log.txt
2009-07-22 08:45:43 —-A—- D:\windows\Pack DirectWave Setup Log.txt
2009-07-22 08:39:55 —-A—- D:\windows\FL Studio 8 Parche Setup Log.txt
2009-07-21 05:01:04 —-A—- D:\windows\setuplog.txt
2009-07-21 01:59:53 —-D—- D:\Program Files\EASEUS
2009-07-20 23:37:35 —-D—- D:\Program Files\WizardRecovery
2009-07-20 23:34:23 —-D—- D:\Program Files\Flobo Floppy Bad Sector Repair
2009-07-20 16:17:55 —-DC—- D:\windows\$NtUninstallKB973346$
2009-07-20 15:57:47 —-A—- D:\NTDETECT.COM
2009-07-19 23:19:37 —-D—- D:\Documents and Settings\Absurd\Application Data\Viewpoint
2009-07-17 02:35:49 —-D—- D:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
2009-07-16 21:42:47 —-D—- D:\Documents and Settings\All Users\Application Data\nView_Profiles
2009-07-16 21:40:44 —-D—- D:\windows\B83FC356B7C0441F8A4DD71E088E7974.TMP
2009-07-16 21:40:09 —-A—- D:\windows\system32\nvudisp.exe
2009-07-16 21:31:22 —-N—- D:\windows\system32\nvuide.exe
2009-07-16 21:31:08 —-A—- D:\windows\system32\nvusmb.exe
2009-07-16 21:24:57 —-A—- D:\windows\system32\NVUNINST.EXE
2009-07-16 20:59:07 —-A—- D:\windows\ntbtlog.txt
2009-07-16 20:52:31 —-D—- D:\windows\AC54E5443E42443CA91DA00A6974C592.TMP
2009-07-16 20:36:41 —-D—- D:\Program Files\SystemRequirementsLab
2009-07-16 20:00:58 —-D—- D:\Program Files\NOS
2009-07-16 20:00:57 —-D—- D:\Program Files\vghd
2009-07-16 17:09:03 —-D—- D:\windows\system32\$DXE_V2$
2009-07-16 13:30:45 —-D—- D:\Program Files\Viewpoint
2009-07-16 13:22:13 —-D—- D:\Program Files\Common Files\AOL
2009-07-16 13:21:51 —-D—- D:\Program Files\AIM6
2009-07-16 11:58:30 —-D—- D:\Documents and Settings\Absurd\Application Data\Roni Music
2009-07-16 05:45:35 —-D—- D:\Program Files\Common Files\Diskeeper Corporation
2009-07-16 05:45:33 —-D—- D:\Documents and Settings\All Users\Application Data\Diskeeper Corporation
2009-07-16 05:34:55 —-D—- D:\Documents and Settings\Absurd\Application Data\Desktopicon
2009-07-15 04:10:23 —-D—- D:\Program Files\SynthEdit
2009-07-14 15:13:28 —-D—- D:\windows\WBEM
2009-07-14 15:10:41 —-HDC—- D:\windows\ie8
2009-07-13 21:20:36 —-D—- D:\Documents and Settings\All Users\Application Data\NOS
2009-07-13 20:19:19 —-A—- D:\windows\NIRCMD.exe
2009-07-13 20:19:18 —-A—- D:\windows\PEV.exe
2009-07-13 20:19:17 —-A—- D:\windows\zip.exe
2009-07-13 20:19:17 —-A—- D:\windows\SWXCACLS.exe
2009-07-13 20:19:17 —-A—- D:\windows\SWSC.exe
2009-07-13 20:19:17 —-A—- D:\windows\sed.exe
2009-07-13 20:19:17 —-A—- D:\windows\grep.exe
2009-07-13 20:18:33 —-D—- D:\Qoobox
2009-07-12 18:55:08 —-D—- D:\rsit
2009-07-11 20:12:07 —-A—- D:\windows\rvdttvg.txt
2009-07-11 09:08:09 —-D—- D:\Documents and Settings\Absurd\Application Data\vlc
2009-07-11 06:45:21 —-HD—- D:\$AVG8.VAULT$
2009-07-11 04:09:44 —-D—- D:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2009-07-11 04:02:33 —-A—- D:\windows\system32\avgrsstx.dll
2009-07-11 04:02:23 —-D—- D:\Documents and Settings\All Users\Application Data\AVG Security Toolbar
2009-07-10 17:30:33 —-A—- D:\windows\swreg.exe
2009-07-10 17:29:50 —-D—- D:\Program Files\ERUNT
2009-07-10 16:10:54 —-D—- D:\Documents and Settings\Absurd\Application Data\REAPER
2009-07-10 14:31:37 —-D—- D:\Program Files\AMD
2009-07-10 14:30:45 —-D—- D:\windows\system32\AGEIA
2009-07-10 14:30:45 —-D—- D:\Program Files\AGEIA Technologies
2009-07-10 14:22:53 —-D—- D:\windows\nview(2)
2009-07-10 13:54:04 —-D—- D:\Program Files\Driver Sweeper
2009-07-10 13:04:03 —-A—- D:\windows\system32\javaws.exe
2009-07-10 13:04:03 —-A—- D:\windows\system32\javaw.exe
2009-07-10 13:04:03 —-A—- D:\windows\system32\java.exe
2009-07-07 13:27:06 —-A—- D:\windows\system32\mausbasio.dll
2009-07-07 13:27:06 —-A—- D:\windows\system32\M-AudioTaskBarIcon.exe
2009-07-07 13:27:06 —-A—- D:\windows\system32\madiousb.dll
2009-07-06 23:57:30 —-D—- D:\Config.Msi
2009-07-05 19:26:45 —-D—- D:\Documents and Settings\Absurd\Application Data\Ubisoft
2009-07-03 18:01:57 —-D—- D:\Program Files\Toontrack
2009-07-02 21:24:30 —-D—- D:\windows\system32\windows media
2009-07-02 20:06:16 —-A—- D:\windows\system32\D3DX9_41.dll
2009-07-02 20:06:16 —-A—- D:\windows\system32\D3DCompiler_41.dll
2009-07-02 20:06:15 —-A—- D:\windows\system32\XAudio2_4.dll
2009-07-02 20:06:15 —-A—- D:\windows\system32\XAPOFX1_3.dll
2009-07-02 20:06:14 —-A—- D:\windows\system32\xactengine3_4.dll
2009-07-02 20:06:13 —-A—- D:\windows\system32\X3DAudio1_6.dll
2009-07-02 14:39:08 —-D—- D:\Program Files\Common Files\aliaswavefront shared
2009-07-02 14:39:08 —-D—- D:\Program Files\Common Files\Alias Shared
2009-07-02 14:38:04 —-D—- D:\Program Files\Microsoft DirectX SDK (April 2007)
2009-06-29 07:37:20 —-HDC—- D:\Documents and Settings\All Users\Application Data\{0691F710-1ECA-4B5A-9727-25554F1BFDC6}
2009-06-29 07:31:03 —-D—- D:\Program Files\Electronic Arts

======List of files/folders modified in the last 1 months======

2009-07-27 08:56:52 —-D—- D:\Program Files\Mozilla Firefox
2009-07-27 08:55:06 —-D—- D:\windows\system32\drivers
2009-07-27 08:55:06 —-D—- D:\windows\system32
2009-07-27 08:55:02 —-D—- D:\WINDOWS
2009-07-27 08:54:17 —-D—- D:\windows\system32\CatRoot2
2009-07-27 08:53:52 —-A—- D:\windows\system.ini
2009-07-27 08:51:27 —-D—- D:\windows\ERDNT
2009-07-27 08:51:25 —-A—- D:\windows\SchedLgU.Txt
2009-07-27 08:51:21 —-D—- D:\windows\Prefetch
2009-07-27 08:49:50 —-D—- D:\Documents and Settings\Absurd\Application Data\DMCache
2009-07-26 06:43:01 —-D—- D:\Documents and Settings\Absurd\Application Data\IDM
2009-07-26 05:23:12 —-A—- D:\windows\win.ini
2009-07-25 20:14:32 —-D—- D:\Program Files\SoundSpectrum
2009-07-24 19:49:16 —-SD—- D:\windows\Downloaded Program Files
2009-07-24 19:35:52 —-A—- D:\windows\NeroDigital.ini
2009-07-24 17:23:26 —-SHD—- D:\windows\Installer
2009-07-24 17:18:44 —-D—- D:\Program Files\Common Files\Adobe
2009-07-24 17:18:44 —-D—- D:\Program Files\Adobe
2009-07-24 17:17:03 —-D—- D:\Documents and Settings\All Users\Application Data\Adobe
2009-07-24 17:17:03 —-D—- D:\Documents and Settings\Absurd\Application Data\Adobe
2009-07-24 17:16:55 —-D—- D:\Program Files\Common Files
2009-07-24 16:56:56 —-D—- D:\Program Files
2009-07-24 16:32:05 —-SD—- D:\windows\Tasks
2009-07-24 12:20:58 —-SD—- D:\Documents and Settings\Absurd\Application Data\Microsoft
2009-07-24 12:20:57 —-D—- D:\Documents and Settings\All Users\Application Data\avg8
2009-07-23 17:45:24 —-D—- D:\Documents and Settings\All Users\Application Data\IK Multimedia
2009-07-22 09:02:36 —-A—- D:\windows\SIMSYNTH.INI
2009-07-22 09:02:03 —-A—- D:\windows\dsdxirmv.exe
2009-07-22 08:50:33 —-D—- D:\Program Files\Image-Line
2009-07-21 01:59:53 —-HD—- D:\Program Files\InstallShield Installation Information
2009-07-20 23:23:27 —-D—- D:\Documents and Settings\Absurd\Application Data\WinRAR
2009-07-20 18:20:54 —-A—- D:\windows\system32\PerfStringBackup.INI
2009-07-20 16:39:10 —-D—- D:\windows\system32\CatRoot
2009-07-20 16:35:38 —-D—- D:\windows\system32\config
2009-07-20 16:34:52 —-D—- D:\windows\system32\wbem
2009-07-20 16:34:51 —-D—- D:\windows\Registration
2009-07-20 16:33:54 —-HD—- D:\windows\$hf_mig$
2009-07-20 16:33:35 —-HD—- D:\windows\inf
2009-07-20 16:15:53 —-D—- D:\windows\Debug
2009-07-20 05:56:26 —-D—- D:\Temp
2009-07-16 21:42:11 —-D—- D:\windows\Help
2009-07-16 21:40:21 —-D—- D:\Program Files\Common Files\Wise Installation Wizard
2009-07-16 21:40:10 —-RSHDC—- D:\windows\system32\dllcache
2009-07-16 21:31:25 —-D—- D:\windows\system32\ReinstallBackups
2009-07-16 20:52:12 —-D—- D:\Documents and Settings\All Users\Application Data\NVIDIA Corporation
2009-07-16 20:01:24 —-D—- D:\Program Files\NetMeeting
2009-07-16 20:01:24 —-D—- D:\Program Files\MSN
2009-07-16 20:01:13 —-AD—- D:\Program Files\Outlook Express
2009-07-16 20:00:38 —-D—- D:\windows\system32\DirectX
2009-07-16 13:30:46 —-D—- D:\Documents and Settings\All Users\Application Data\Viewpoint
2009-07-16 13:13:35 —-D—- D:\Documents and Settings\Absurd\Application Data\Auslogics
2009-07-16 13:09:55 —-A—- D:\windows\Zmodeler.ini
2009-07-16 11:17:48 —-D—- D:\windows\UltraDefrag
2009-07-16 10:50:15 —-A—- D:\windows\teachpno.ini
2009-07-16 10:50:14 —-A—- D:\windows\recorsta.ini
2009-07-16 10:50:14 —-A—- D:\windows\jamkeys.ini
2009-07-16 10:50:14 —-A—- D:\windows\jam.ini
2009-07-16 10:50:14 —-A—- D:\windows\ARCADE.INI
2009-07-16 10:50:13 —-RSD—- D:\windows\Fonts
2009-07-16 06:41:05 —-D—- D:\windows\AppPatch
2009-07-15 23:22:19 —-D—- D:\windows\pss
2009-07-14 15:20:00 —-D—- D:\Program Files\Internet Explorer
2009-07-14 15:13:28 —-D—- D:\windows\system32\en-us
2009-07-14 15:12:59 —-D—- D:\windows\Media
2009-07-14 13:07:00 —-D—- D:\Documents and Settings\Absurd\Application Data\Digidesign
2009-07-14 12:48:55 —-AHD—- D:\Program Files\WindowsUpdate
2009-07-14 12:48:55 —-AHD—- D:\Program Files\Common Files\Microsoft Shared
2009-07-14 12:48:55 —-AHD—- D:\Documents and Settings\All Users\Application Data\Microsoft
2009-07-14 12:48:29 —-AD—- D:\Program Files\Common Files\System
2009-07-13 13:22:02 —-D—- D:\Program Files\Enigma Software Group
2009-07-11 06:31:45 —-D—- D:\Documents and Settings\Absurd\Application Data\SUPERAntiSpyware.com
2009-07-11 06:31:44 —-D—- D:\Program Files\SUPERAntiSpyware
2009-07-11 06:24:51 —-D—- D:\Program Files\Common Files\Apple
2009-07-11 06:22:48 —-D—- D:\Documents and Settings\Absurd\Application Data\Macromedia
2009-07-11 06:22:06 —-D—- D:\windows\Downloaded Installations
2009-07-11 06:14:59 —-D—- D:\Program Files\Matroska Pack
2009-07-11 05:02:39 —-D—- D:\windows\WinSxS
2009-07-11 04:14:41 —-D—- D:\Documents and Settings\All Users\Application Data\Autodesk
2009-07-11 04:14:40 —-D—- D:\Program Files\Common Files\Autodesk Shared
2009-07-11 04:09:09 —-RSD—- D:\windows\assembly
2009-07-10 14:31:42 —-DC—- D:\windows\system32\DRVSTORE
2009-07-10 13:04:00 —-D—- D:\Program Files\Java
2009-07-10 11:44:09 —-D—- D:\windows\Minidump
2009-07-10 07:53:11 —-D—- D:\Documents and Settings
2009-07-08 12:12:03 —-D—- D:\Program Files\Yahoo!
2009-07-07 13:26:58 —-D—- D:\Program Files\M-Audio
2009-07-06 23:58:53 —-D—- D:\Documents and Settings\All Users\Application Data\Ubisoft
2009-07-06 23:57:48 —-D—- D:\Program Files\NVIDIA Corporation
2009-07-03 13:30:40 —-A—- D:\windows\system32\OpenAL32.dll
2009-07-03 08:15:50 —-D—- D:\windows\security
2009-07-03 07:52:30 —-D—- D:\Program Files\Windows Media Connect 2
2009-07-02 23:29:36 —-D—- D:\Program Files\OpenAL
2009-07-02 21:24:30 —-D—- D:\windows\RegisteredPackages
2009-07-01 15:32:41 —-AD—- D:\Documents and Settings\All Users\Application Data\TEMP
2009-07-01 08:59:02 —-D—- D:\Program Files\EVGA Precision
2009-06-29 07:44:33 —-A—- D:\windows\system32\CmdLineExt.dll

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AmdK8;AMD Processor Driver; D:\windows\system32\DRIVERS\AmdK8.sys [2006-07-01 36864]
R1 AvgLdx86;AVG Free AVI Loader Driver x86; D:\windows\System32\Drivers\avgldx86.sys [2009-07-11 327688]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86; D:\windows\System32\Drivers\avgmfx86.sys [2009-07-11 27784]
R1 AvgTdiX;AVG Free8 Network Redirector; D:\windows\System32\Drivers\avgtdix.sys [2009-07-11 108552]
R1 BANTExt;Belarc SMBios Access; D:\windows\System32\Drivers\BANTExt.sys [2008-02-27 3840]
R1 cdrbsdrv;cdrbsdrv; D:\windows\system32\drivers\cdrbsdrv.sys [2008-09-08 33408]
R1 cmdGuard;COMODO Firewall Pro Sandbox Driver; D:\windows\System32\DRIVERS\cmdguard.sys [2009-01-19 101776]
R1 cmdHlp;COMODO Firewall Pro Helper Driver; D:\windows\System32\DRIVERS\cmdhlp.sys [2009-01-19 31504]
R1 kbdhid;Keyboard HID Driver; D:\windows\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
R1 PQNTDrv;PQNTDrv; D:\windows\system32\drivers\PQNTDrv.sys [2004-05-05 4228]
R1 prodrv06;StarForce Protection Environment Driver v6; D:\windows\System32\drivers\prodrv06.sys [2003-10-10 52128]
R2 Nsynas32;Nsynas32; D:\windows\system32\drivers\Nsynas32.sys [2001-04-09 17784]
R3 CLEDX;Team H2O CLEDX service; D:\windows\system32\DRIVERS\cledx.sys [2005-05-09 33792]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; D:\windows\SYSTEM32\DRIVERS\GEARAspiWDM.sys [2008-04-17 15464]
R3 hidusb;Microsoft HID Class Driver; D:\windows\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
R3 LHidFilt;Logitech SetPoint KMDF HID Filter Driver; D:\windows\system32\DRIVERS\LHidFilt.Sys [2008-12-18 35472]
R3 LMouFilt;Logitech SetPoint KMDF Mouse Filter Driver; D:\windows\system32\DRIVERS\LMouFilt.Sys [2008-12-18 37392]
R3 LUsbFilt;Logitech SetPoint KMDF USB Filter; D:\windows\System32\Drivers\LUsbFilt.Sys [2008-12-18 28816]
R3 MA_CMIDI;M-Audio USB Driver; D:\windows\system32\drivers\ma_cmidi.sys [2006-08-16 21888]
R3 MAUSBFTP;Service for M-Audio Fast Track Pro (WDM); D:\windows\system32\DRIVERS\mausb.sys [2008-03-11 143624]
R3 mouhid;Mouse HID Driver; D:\windows\system32\DRIVERS\mouhid.sys [2001-08-17 12160]
R3 nv;nv; D:\windows\system32\DRIVERS\nv4_mini.sys [2009-06-10 8087712]
R3 pfc;Padus ASPI Shell; D:\windows\system32\drivers\pfc.sys [2006-03-29 9856]
R3 USB20L;Linksys USB 2.0 10/100 Adapter; D:\windows\system32\DRIVERS\USB200M.sys [2002-09-23 14208]
R3 usbccgp;Microsoft USB Generic Parent Driver; D:\windows\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; D:\windows\system32\DRIVERS\usbehci.sys [2008-04-14 30208]
R3 usbhub;Microsoft USB Standard Hub Driver; D:\windows\system32\DRIVERS\usbhub.sys [2008-04-14 59520]
R3 usbohci;Microsoft USB Open Host Controller Miniport Driver; D:\windows\system32\DRIVERS\usbohci.sys [2008-04-14 17152]
R3 Wdf01000;Wdf01000; D:\windows\system32\DRIVERS\Wdf01000.sys [2006-11-02 492000]
R3 xusb21;Xbox 360 Wireless Receiver Driver Service 21; D:\windows\system32\DRIVERS\xusb21.sys [2007-02-26 61984]
R4 catchme;catchme; \??\D:\DOCUME~1\Absurd\LOCALS~1\Temp\catchme.sys []
S1 nvport;NVIDIA PORT IO Control Driver; \??\D:\WINDOWS\system32\Drivers\nvport.sys []
S3 61883;61883 Unit Device; D:\windows\system32\DRIVERS\61883.sys [2008-04-14 48128]
S3 abamsnln;abamsnln; D:\windows\system32\drivers\abamsnln.sys []
S3 Ambfilt;Ambfilt; D:\windows\system32\drivers\Ambfilt.sys []
S3 Arp1394;1394 ARP Client Protocol; D:\windows\system32\DRIVERS\arp1394.sys [2008-04-14 60800]
S3 Avc;AVC Device; D:\windows\system32\DRIVERS\avc.sys [2008-04-14 38912]
S3 BCM43XX;Linksys Wireless-N PCI Adapter WMP300N; D:\windows\system32\DRIVERS\bcmwl5.sys [2006-07-07 564224]
S3 CCDECODE;Closed Caption Decoder; D:\windows\system32\DRIVERS\CCDECODE.sys [2008-04-14 17024]
S3 cpuz132;cpuz132; \??\D:\WINDOWS\system32\drivers\cpuz132_x32.sys []
S3 ENTECH;ENTECH; \??\D:\WINDOWS\system32\DRIVERS\ENTECH.sys []
S3 ETDrv;ETDrv; \??\D:\WINDOWS\system32\Drivers\ETDrv.sys []
S3 GVTDrv;GVTDrv; \??\D:\WINDOWS\system32\Drivers\GVTDrv.sys []
S3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; D:\windows\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
S3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); D:\windows\system32\drivers\RtkHDAud.sys []
S3 L8042Kbd;Logitech SetPoint Keyboard Driver; D:\windows\system32\DRIVERS\L8042Kbd.sys [2008-12-18 20240]
S3 MAUSB;Service for M-Audio Fast Track Pro Driver (WDM); D:\windows\system32\DRIVERS\mausb.sys [2008-03-11 143624]
S3 Monfilt;Monfilt; D:\windows\system32\drivers\Monfilt.sys []
S3 MSDV;Microsoft DV Camera and VCR; D:\windows\system32\DRIVERS\msdv.sys [2008-04-14 51200]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; D:\windows\system32\drivers\MSTEE.sys [2008-04-14 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; D:\windows\system32\DRIVERS\NABTSFEC.sys [2008-04-14 85248]
S3 NdisIP;Microsoft TV/Video Connection; D:\windows\system32\DRIVERS\NdisIP.sys [2008-04-14 10880]
S3 NIC1394;1394 Net Driver; D:\windows\system32\DRIVERS\nic1394.sys [2008-04-14 61824]
S3 SLIP;BDA Slip De-Framer; D:\windows\system32\DRIVERS\SLIP.sys [2008-04-14 11136]
S3 SONYPVU1;Sony USB Filter Driver (SONYPVU1); D:\windows\system32\DRIVERS\SONYPVU1.SYS [2001-08-17 7552]
S3 streamip;BDA IPSink; D:\windows\system32\DRIVERS\StreamIP.sys [2008-04-14 15232]
S3 SUPERWEBCAM;SuperWebcam, WDM Virtual Video Capture Device; D:\windows\system32\DRIVERS\superwebcam.sys [2006-06-27 31872]
S3 usbaudio;USB Audio Driver (WDM); D:\windows\system32\drivers\usbaudio.sys [2008-04-14 60032]
S3 usbprint;Microsoft USB PRINTER Class; D:\windows\system32\DRIVERS\usbprint.sys [2008-04-14 25856]
S3 usbstor;USB Mass Storage Driver; D:\windows\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 VirtualFD;VirtualFD; \??\D:\Documents and Settings\Absurd\Desktop\virtual_floppy\virtual floppy\vfd.sys []
S3 WMP300Nv1;Linksys Wireless-N PCI Adapter WMP300N Driver; D:\windows\system32\DRIVERS\WMP300Nv1.sys []
S3 WSTCODEC;World Standard Teletext Codec; D:\windows\system32\DRIVERS\WSTCODEC.SYS [2008-04-14 19200]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; D:\windows\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; D:\windows\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 dwshd;dwshd; D:\windows\System32\drivers\dwshd.sys []
S4 IntelIde;IntelIde; D:\windows\system32\drivers\IntelIde.sys []
S4 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; D:\windows\System32\drivers\ws2ifsl.sys [2004-08-04 12032]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R4 svcWRSSSDK;Webroot Spy Sweeper Engine; D:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe [2005-11-18 2151936]
S3 aspnet_state;ASP.NET State Service; D:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; D:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; D:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 LPDSVC;TCP/IP Print Server; D:\windows\system32\tcpsvcs.exe [2004-08-04 19456]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; D:\windows\system32\svchost.exe [2008-04-14 14336]
S4 Adobe LM Service;Adobe LM Service; D:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [2008-08-13 72704]
S4 Autodata Limited License Service;Autodata Limited License Service; D:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe [2008-07-14 72704]
S4 avg8emc;AVG Free8 E-mail Scanner; E:\AVG\avgemc.exe [2009-07-11 906520]
S4 avg8wd;AVG Free8 WatchDog; E:\AVG\avgwdsvc.exe [2009-07-11 298776]
S4 Bonjour Service;Bonjour Service; D:\Program Files\Bonjour\mDNSResponder.exe [2008-08-29 238888]
S4 cmdAgent;COMODO Internet Security Helper Service; D:\Program Files\COMODO\Firewall\cmdagent.exe [2009-01-19 618232]
S4 DigiRefresh;Digidesign MME Refresh Service; G:\digidesign\Digidesign\Drivers\MMERefresh.exe [2007-10-31 77824]
S4 digiSPTIService;digiSPTIService; G:\digidesign\Digidesign\Pro Tools\digiSPTIService.exe [2007-10-31 159744]
S4 Diskeeper;Diskeeper; C:\Disk Keeper\DkService.exe []
S4 FLEXnet Licensing Service;FLEXnet Licensing Service; D:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2009-04-11 651720]
S4 gupdate1c9cd3721a28848;Google Update Service (gupdate1c9cd3721a28848); D:\Program Files\Google\Update\GoogleUpdate.exe [2009-05-05 133104]
S4 IDriverT;InstallDriver Table Manager; D:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S4 idsvc;Windows CardSpace; D:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S4 JavaQuickStarterService;Java Quick Starter; D:\Program Files\Java\jre6\bin\jqs.exe [2009-05-21 152984]
S4 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service; D:\Program Files\Lavasoft\Ad-Aware\AAWService.exe [2009-07-24 1029456]
S4 LBTServ;Logitech Bluetooth Service; D:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe [2009-02-19 121360]
S4 LexBceS;LexBce Server; D:\WINDOWS\system32\LEXBCES.EXE [2004-05-24 311296]
S4 MA_CMIDI_InstallerService;M-Audio Series II MIDI Installer; D:\Program Files\M-Audio\M-Audio Series II MIDI\MA_CMIDI_Inst.exe [2007-01-08 94208]
S4 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3; D:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe [2008-02-18 877864]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; D:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]
S4 NMIndexingService;NMIndexingService; D:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe [2008-02-28 529704]
S4 nvsvc;NVIDIA Display Driver Service; D:\WINDOWS\system32\nvsvc32.exe [2009-06-10 168004]
S4 PLFlash DeviceIoControl Service;PLFlash DeviceIoControl Service; D:\WINDOWS\system32\IoctlSvc.exe [2006-12-19 81920]
S4 PnkBstrA;PnkBstrA; D:\WINDOWS\system32\PnkBstrA.exe [2008-04-06 66872]
S4 Viewpoint Manager Service;Viewpoint Manager Service; D:\Program Files\Viewpoint\Common\ViewpointService.exe [2007-01-04 24652]
S4 WMPNetworkSvc;Windows Media Player Network Sharing Service; D:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-18 913408]

—————–EOF—————–
Post #4
Lets see if you can get the newest Combofix now.


  • Click START then RUN
  • Now type Combofix /u in the runbox and click OK. Note the space between the X and the U, it needs to be there.

    • [external image: Posted Image]


    Download ComboFix from one of these locations:

    Link 1
    Link 2


    * IMPORTANT !!! Save ComboFix.exe to your Desktop


    • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : Protective Programs

    • Double click on ComboFix.exe & follow the prompts.

      Note: Combofix will run without the Recovery Console installed.

    • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

    • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

    **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


    [external image: Posted Image]



    Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

    [external image: Posted Image]


    Click on Yes, to continue scanning for malware.

    When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
    "copy/paste" a new HijackThis log file into this thread as well.

    Notes:

    1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
    2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
    3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
    4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

    Give it atleast 20-30 minutes to finish if needed.


    Also please describe how your computer behaves at the moment.
Post #5 last edited
Ok I uninstalled Combofix and downloaded the newer version but when I click on it on my desktop, it does not do anything. Should I rename it?
Post #6

Ok I uninstalled Combofix and downloaded the newer version but when I click on it on my desktop, it does not do anything. Should I rename it?

Yes. Try that.
Post #7 last edited
I renamed Combofix to "xxx.exe" and it worked. It could not connect to the internet to download the Microsoft Recovery Console though.

I noticed that the Spybot SD resident finally came up in my taskbar and Hijackthis also runs now.

Here are the logs:

ComboFix 09-07-27.02 - Absurd 07/27/2009 22:41.9.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3071.2748 [GMT -4:00]
Running from: d:\documents and settings\[removed]\Desktop\xxx.exe
FW: COMODO Firewall *enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

d:\windows\system32\drivers\ESQULjwcfxwfvmehxnsdovbgsnriqwwnyqbpx.sys
d:\windows\system32\ESQULdpbwekifhifmrmpjpasdthoataapmefv.dll
d:\windows\system32\ESQULibkilxwgbmqhbbeuyyskewyvsvdpxwbu.dll
d:\windows\system32\ESQULzcounter
d:\windows\system32\lsprst7.dll
d:\windows\system32\msvcsv60.dll
d:\windows\system32\ssprs.dll
d:\windows\system32\tmpPrst.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Service_ESQULserv.sys


((((((((((((((((((((((((( Files Created from 2009-06-28 to 2009-07-28 )))))))))))))))))))))))))))))))
.

2009-07-28 00:57 . 2009-07-28 00:58 ——– d-s—w- D:\worksnow
2009-07-27 14:20 . 2007-07-19 22:14 444776 —-a-w- d:\windows\system32\d3dx10_35.dll
2009-07-27 14:20 . 2007-05-16 20:45 443752 —-a-w- d:\windows\system32\d3dx10_34.dll
2009-07-27 14:20 . 2007-03-15 20:57 443752 —-a-w- d:\windows\system32\d3dx10_33.dll
2009-07-27 14:19 . 2009-07-27 14:19 ——– d—–w- d:\windows\D56B0E274A3E46C9B5C1D93D580C099C.TMP
2009-07-25 19:35 . 2009-07-26 00:15 ——– d—–w- d:\documents and settings\Absurd\Application Data\SoundSpectrum
2009-07-25 01:56 . 2009-07-25 01:56 ——– d—–w- d:\documents and settings\NetworkService\Application Data\Webroot
2009-07-24 21:17 . 2009-02-12 09:35 38208 —-a-w- d:\documents and settings\Absurd\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2009-07-24 21:16 . 2009-07-24 21:16 ——– d—–w- d:\program files\Common Files\Adobe AIR
2009-07-24 20:57 . 2009-07-24 20:57 ——– d—–w- d:\documents and settings\LocalService\Application Data\Webroot
2009-07-24 20:57 . 2005-11-18 16:05 78336 —-a-w- d:\windows\system32\drivers\ssi.sys
2009-07-24 20:57 . 2004-02-11 22:27 102912 —-a-w- d:\windows\system32\islzma.dll
2009-07-24 20:56 . 2009-07-24 20:56 ——– d—–w- d:\program files\Webroot
2009-07-24 20:56 . 2009-07-24 20:56 ——– d—–w- d:\documents and settings\Absurd\Application Data\Webroot
2009-07-24 20:56 . 2005-05-20 04:58 356352 —-a-w- d:\windows\system32\eSellerateEngine.dll
2009-07-24 20:56 . 2003-06-06 14:21 81920 —-a-w- d:\windows\system32\eSellerateControl350.dll
2009-07-24 16:17 . 2009-07-24 16:17 ——– d—–w- d:\documents and settings\Absurd\Application Data\AVG8
2009-07-23 21:30 . 2009-07-24 20:29 15688 —-a-w- d:\windows\system32\lsdelete.exe
2009-07-23 21:26 . 2009-07-13 17:36 38160 —-a-w- d:\windows\system32\drivers\mbamswissarmy.sys
2009-07-23 21:26 . 2009-07-24 12:22 ——– d—–w- d:\program files\Malwarebytes' Anti-Malware
2009-07-23 21:26 . 2009-07-13 17:36 19096 —-a-w- d:\windows\system32\drivers\mbam.sys
2009-07-23 21:19 . 2009-07-23 21:19 ——– dc-h–w- d:\docume~1\ALLUSE~1\APPLIC~1\{83C91755-2546-441D-AC40-9A6B4B860800}
2009-07-23 21:19 . 2009-07-23 21:23 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\Lavasoft
2009-07-23 21:19 . 2009-07-23 21:19 ——– d—–w- d:\program files\Lavasoft
2009-07-22 12:55 . 2009-07-22 12:55 ——– d—–w- d:\program files\Steinberg
2009-07-21 05:59 . 2009-07-21 05:59 ——– d—–w- d:\program files\EASEUS
2009-07-21 04:01 . 2009-07-21 04:01 ——– d-sh–w- d:\documents and settings\NetworkService\IETldCache
2009-07-21 03:37 . 2009-07-21 03:37 ——– d—–w- d:\program files\WizardRecovery
2009-07-21 03:35 . 2009-07-21 03:35 ——– d-sh–w- d:\windows\system32\config\systemprofile\IETldCache
2009-07-21 03:34 . 2009-07-21 03:34 ——– d—–w- d:\program files\Flobo Floppy Bad Sector Repair
2009-07-20 20:34 . 2009-07-20 20:34 ——– d—–w- d:\windows\system32\wbem\Repository
2009-07-20 09:56 . 2008-05-20 09:59 1570816 —-a-w- d:\temp\TSDNWIN.exe
2009-07-20 09:56 . 2008-01-24 10:37 2097152 —-a-w- d:\temp\autorun.bin
2009-07-20 03:19 . 2009-07-20 03:19 ——– d—–w- d:\documents and settings\Absurd\Application Data\Viewpoint
2009-07-17 06:35 . 2009-07-17 06:35 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\Office Genuine Advantage
2009-07-17 01:42 . 2009-07-17 01:42 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\nView_Profiles
2009-07-17 01:40 . 2009-07-17 01:40 ——– d—–w- d:\windows\B83FC356B7C0441F8A4DD71E088E7974.TMP
2009-07-17 01:40 . 2009-06-10 10:03 457248 —-a-w- d:\windows\system32\nvudisp.exe
2009-07-17 01:31 . 2006-04-14 18:00 208896 ——w- d:\windows\system32\nvuide.exe
2009-07-17 01:31 . 2006-12-18 20:33 356352 —-a-w- d:\windows\system32\nvusmb.exe
2009-07-17 01:24 . 2009-06-21 12:46 485920 —-a-w- d:\windows\system32\NVUNINST.EXE
2009-07-17 00:52 . 2009-07-17 00:52 ——– d—–w- d:\windows\AC54E5443E42443CA91DA00A6974C592.TMP
2009-07-17 00:36 . 2009-07-17 00:36 ——– d—–w- d:\program files\SystemRequirementsLab
2009-07-17 00:00 . 2009-07-24 23:49 ——– d—–w- d:\program files\NOS
2009-07-17 00:00 . 2009-07-17 00:00 ——– d—–w- d:\program files\vghd
2009-07-16 21:09 . 2009-07-17 00:00 ——– d—–w- d:\windows\system32\$DXE_V2$
2009-07-16 18:00 . 2009-07-16 18:00 23 –sha-w- d:\windows\system32\abedaebd.dat
2009-07-16 17:53 . 2009-07-16 17:53 23 –sha-w- d:\windows\system32\abedaebd_x.dat
2009-07-16 17:30 . 2009-07-16 17:30 ——– d—–w- d:\program files\Viewpoint
2009-07-16 17:22 . 2009-07-17 00:01 ——– d—–w- d:\program files\Common Files\AOL
2009-07-16 17:21 . 2009-07-16 17:30 ——– d—–w- d:\program files\AIM6
2009-07-16 15:58 . 2009-07-16 15:58 ——– d—–w- d:\documents and settings\Absurd\Application Data\Roni Music
2009-07-16 10:01 . 2009-07-16 10:01 ——– d-sh–w- d:\documents and settings\LocalService\IETldCache
2009-07-16 09:45 . 2009-07-16 09:45 ——– d—–w- d:\program files\Common Files\Diskeeper Corporation
2009-07-16 09:45 . 2009-07-16 09:45 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\Diskeeper Corporation
2009-07-16 09:34 . 2009-07-16 09:34 ——– d—–w- d:\documents and settings\Absurd\Application Data\Desktopicon
2009-07-15 08:10 . 2009-07-15 11:00 ——– d—–w- d:\program files\SynthEdit
2009-07-14 19:28 . 2009-07-14 19:28 ——– d-sh–w- d:\documents and settings\Absurd\IECompatCache
2009-07-14 19:25 . 2009-07-14 19:25 ——– d-sh–w- d:\documents and settings\Absurd\PrivacIE
2009-07-14 19:20 . 2009-07-14 19:20 ——– d-sh–w- d:\documents and settings\Absurd\IETldCache
2009-07-14 19:10 . 2009-07-14 19:13 ——– dc-h–w- d:\windows\ie8
2009-07-14 01:20 . 2009-07-24 23:49 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\NOS
2009-07-12 22:55 . 2009-07-12 22:56 ——– d—–w- D:\rsit
2009-07-11 13:08 . 2009-07-11 13:13 ——– d—–w- d:\documents and settings\Absurd\Application Data\vlc
2009-07-11 10:45 . 2009-07-17 00:47 ——– d–h–w- D:\$AVG8.VAULT$
2009-07-11 08:09 . 2009-07-16 04:29 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2009-07-11 08:06 . 2009-07-11 08:06 ——– d—–w- d:\documents and settings\Absurd\Local Settings\Application Data\AVG Security Toolbar
2009-07-11 08:02 . 2009-07-11 08:02 11952 —-a-w- d:\windows\system32\avgrsstx.dll
2009-07-11 08:02 . 2009-07-11 08:02 327688 —-a-w- d:\windows\system32\drivers\avgldx86.sys
2009-07-11 08:02 . 2009-07-11 08:02 27784 —-a-w- d:\windows\system32\drivers\avgmfx86.sys
2009-07-11 08:02 . 2009-07-16 21:49 ——– d—–w- d:\windows\system32\drivers\Avg
2009-07-11 08:02 . 2009-07-14 19:24 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\AVG Security Toolbar
2009-07-11 08:01 . 2009-07-11 08:01 108552 —-a-w- d:\windows\system32\drivers\avgtdix.sys
2009-07-10 21:29 . 2009-07-10 21:29 ——– d—–w- d:\program files\ERUNT
2009-07-10 20:10 . 2009-07-11 16:33 ——– d—–w- d:\documents and settings\Absurd\Application Data\REAPER
2009-07-10 18:31 . 2009-07-10 18:31 ——– d—–w- d:\program files\AMD
2009-07-10 18:30 . 2009-07-17 01:41 ——– d—–w- d:\program files\AGEIA Technologies
2009-07-10 18:30 . 2009-07-10 18:30 ——– d—–w- d:\windows\system32\AGEIA
2009-07-10 18:22 . 2009-07-10 18:22 ——– d—–w- d:\windows\nview(2)
2009-07-10 17:54 . 2009-07-10 18:31 ——– d—–w- d:\program files\Driver Sweeper
2009-07-10 17:02 . 2009-07-10 17:02 152576 —-a-w- d:\documents and settings\Absurd\Application Data\Sun\Java\jre1.6.0_14\lzma.dll
2009-07-10 12:15 . 2009-07-10 12:42 ——– d—–w- d:\documents and settings\Studio\Application Data\Digidesign
2009-07-10 12:10 . 2009-07-10 12:10 ——– d—–w- d:\documents and settings\Studio\Application Data\Waves Audio
2009-07-10 12:10 . 2009-07-10 12:10 ——– d—–w- d:\documents and settings\Studio\Local Settings\Application Data\Apple Computer
2009-07-10 12:10 . 2009-07-10 12:10 ——– d—–w- d:\documents and settings\Studio\Application Data\M-Audio
2009-07-10 12:10 . 2009-07-10 12:15 ——– d—–w- d:\documents and settings\Studio\Application Data\PACE Anti-Piracy
2009-07-10 12:10 . 2009-07-10 12:10 ——– d—–w- d:\documents and settings\Studio\Local Settings\Application Data\PACE Anti-Piracy
2009-07-07 17:27 . 2008-05-15 21:45 356864 —-a-w- d:\windows\system32\M-AudioTaskBarIcon.exe
2009-07-07 17:27 . 2008-03-11 20:37 143624 —-a-w- d:\windows\system32\drivers\mausb.sys
2009-07-07 17:27 . 2008-03-11 20:37 28680 —-a-w- d:\windows\system32\mausbasio.dll
2009-07-07 17:27 . 2008-03-11 20:37 2519712 —-a-w- d:\windows\system32\madiousb.dll
2009-07-06 22:05 . 2009-07-06 22:06 88616 —-a-w- d:\documents and settings\stickam\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-07-05 23:26 . 2009-07-05 23:26 ——– d—–w- d:\documents and settings\Absurd\Application Data\Ubisoft
2009-07-03 23:08 . 2009-07-03 23:08 3128 —-a-r- d:\documents and settings\Absurd\Application Data\Microsoft\Installer\{DB1299AF-9EE0-422B-959E-F4171B2AE0F7}\ARPPRODUCTICON.exe
2009-07-03 22:51 . 2009-07-03 22:51 3128 —-a-r- d:\documents and settings\Absurd\Application Data\Microsoft\Installer\{147567F0-8575-4BE0-B5B3-62706C67FA5A}\ARPPRODUCTICON.exe
2009-07-03 22:45 . 2009-07-03 22:45 3128 —-a-r- d:\documents and settings\Absurd\Application Data\Microsoft\Installer\{43E8D9E7-AFC9-4BA3-8106-B95E02B87AB7}\ARPPRODUCTICON.exe
2009-07-03 22:01 . 2009-07-03 22:01 ——– d—–w- d:\program files\Toontrack
2009-07-03 17:30 . 2001-11-19 23:05 3972 —-a-w- d:\windows\system32\drivers\PciBus.sys
2009-07-03 17:30 . 2004-06-22 19:44 5632 —-a-w- d:\windows\system32\drivers\Entech64.sys
2009-07-03 03:18 . 2009-03-27 05:16 12672 —-a-w- d:\windows\system32\drivers\cpuz132_x32.sys
2009-07-03 01:24 . 2009-07-03 01:24 ——– d—–w- d:\windows\system32\windows media
2009-07-03 00:06 . 2009-03-09 19:27 4178264 —-a-w- d:\windows\system32\D3DX9_41.dll
2009-07-03 00:06 . 2009-03-09 19:27 1846632 —-a-w- d:\windows\system32\D3DCompiler_41.dll
2009-07-03 00:06 . 2009-03-16 18:18 69448 —-a-w- d:\windows\system32\XAPOFX1_3.dll
2009-07-03 00:06 . 2009-03-16 18:18 517448 —-a-w- d:\windows\system32\XAudio2_4.dll
2009-07-03 00:06 . 2009-03-16 18:18 235352 —-a-w- d:\windows\system32\xactengine3_4.dll
2009-07-03 00:06 . 2009-03-16 18:18 22360 —-a-w- d:\windows\system32\X3DAudio1_6.dll
2009-07-02 18:39 . 2009-07-02 18:39 ——– d—–w- d:\program files\Common Files\aliaswavefront shared
2009-07-02 18:39 . 2009-07-02 18:39 ——– d—–w- d:\program files\Common Files\Alias Shared
2009-07-02 18:38 . 2009-07-02 23:45 ——– d—–w- d:\program files\Microsoft DirectX SDK (April 2007)
2009-07-01 02:31 . 2009-06-08 13:20 198064 —-a-w- d:\documents and settings\Absurd\Application Data\Mozilla\Firefox\Profiles\lmgq9aad.default\extensions\[removed]\components\idmmzcc.dll
2009-06-30 17:24 . 2005-08-30 20:19 1052672 —-a-w- d:\documents and settings\Absurd\Application Data\Macromedia\Dreamweaver 8\Configuration\Flash Player\FlashPlayerW.dll
2009-06-29 11:37 . 2009-06-29 11:37 ——– dc-h–w- d:\docume~1\ALLUSE~1\APPLIC~1\{0691F710-1ECA-4B5A-9727-25554F1BFDC6}
2009-06-29 11:31 . 2009-06-29 11:31 ——– d—–w- d:\program files\Electronic Arts
2009-06-29 11:30 . 2009-07-11 10:11 1942 —-a-w- d:\windows\system32\ealregsnapshot1.reg

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-28 02:35 . 2008-04-05 03:41 ——– d—–w- d:\documents and settings\Absurd\Application Data\DMCache
2009-07-27 20:08 . 2009-06-15 10:45 28672 —-a-w- d:\documents and settings\Absurd\Application Data\IDM\NP_IDM5.dll
2009-07-27 20:08 . 2009-06-15 10:45 28672 —-a-w- d:\documents and settings\Absurd\Application Data\IDM\NP_IDM4.dll
2009-07-27 20:08 . 2009-06-15 10:45 28672 —-a-w- d:\documents and settings\Absurd\Application Data\IDM\NP_IDM3.dll
2009-07-27 20:08 . 2009-06-15 10:45 28672 —-a-w- d:\documents and settings\Absurd\Application Data\IDM\NP_IDM2.dll
2009-07-27 20:08 . 2009-06-15 10:45 28672 —-a-w- d:\documents and settings\Absurd\Application Data\IDM\NP_IDM1.dll
2009-07-27 20:08 . 2008-05-04 09:02 ——– d—–w- d:\documents and settings\Absurd\Application Data\IDM
2009-07-27 14:19 . 2009-06-27 14:31 110592 —-a-w- d:\windows\system32\OpenAL32.dll
2009-07-27 14:19 . 2009-06-27 14:31 ——– d—–w- d:\program files\OpenAL
2009-07-27 14:19 . 2009-01-19 08:31 ——– d—–w- d:\program files\Common Files\Wise Installation Wizard
2009-07-26 00:14 . 2009-06-23 07:30 ——– d—–w- d:\program files\SoundSpectrum
2009-07-24 21:18 . 2008-04-05 09:18 ——– d—–w- d:\program files\Common Files\Adobe
2009-07-24 16:20 . 2008-10-28 00:25 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\avg8
2009-07-24 12:28 . 2009-07-24 12:28 280 —-a-w- d:\program files\eumr.txt
2009-07-23 22:11 . 2008-06-20 23:23 208 —-a-w- d:\windows\msocreg32.dat
2009-07-23 21:45 . 2008-06-21 22:09 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\IK Multimedia
2009-07-22 13:02 . 2009-06-21 22:15 118784 —-a-w- d:\windows\dsdxirmv.exe
2009-07-22 12:50 . 2009-06-18 06:12 ——– d—–w- d:\program files\Image-Line
2009-07-21 05:59 . 2008-04-02 18:36 ——– d–h–w- d:\program files\InstallShield Installation Information
2009-07-17 00:52 . 2008-04-09 10:39 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\NVIDIA Corporation
2009-07-16 23:05 . 2008-04-02 18:43 56272 —-a-w- d:\documents and settings\Absurd\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-07-16 17:30 . 2008-06-23 00:28 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\Viewpoint
2009-07-16 17:13 . 2009-06-19 21:43 ——– d—–w- d:\documents and settings\Absurd\Application Data\Auslogics
2009-07-14 17:07 . 2008-04-09 03:32 ——– d—–w- d:\documents and settings\Absurd\Application Data\Digidesign
2009-07-13 17:22 . 2008-04-03 07:33 ——– d—–w- d:\program files\Enigma Software Group
2009-07-11 10:31 . 2009-01-19 08:59 ——– d—–w- d:\documents and settings\Absurd\Application Data\SUPERAntiSpyware.com
2009-07-11 10:31 . 2009-01-19 08:59 ——– d—–w- d:\program files\SUPERAntiSpyware
2009-07-11 10:24 . 2008-04-02 23:20 ——– d—–w- d:\program files\Common Files\Apple
2009-07-11 10:14 . 2008-11-15 04:19 ——– d—–w- d:\program files\Matroska Pack
2009-07-11 08:14 . 2009-04-11 11:51 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\Autodesk
2009-07-11 08:14 . 2009-04-11 11:51 ——– d—–w- d:\program files\Common Files\Autodesk Shared
2009-07-10 17:04 . 2009-02-22 19:28 ——– d—–w- d:\program files\Java
2009-07-10 11:53 . 2009-07-10 11:53 ——– d—–w- d:\documents and settings\Studio\Application Data\Logitech
2009-07-10 11:53 . 2009-07-10 11:53 88616 —-a-w- d:\documents and settings\Studio\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-07-08 16:12 . 2009-06-19 23:02 ——– d—–w- d:\program files\Yahoo!
2009-07-07 17:26 . 2008-06-08 06:00 ——– d—–w- d:\program files\M-Audio
2009-07-07 03:58 . 2008-04-21 17:04 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\Ubisoft
2009-07-07 03:57 . 2008-08-15 08:49 ——– d—–w- d:\program files\NVIDIA Corporation
2009-07-03 11:52 . 2008-11-17 19:49 ——– d—–w- d:\program files\Windows Media Connect 2
2009-07-01 19:32 . 2008-04-09 10:09 ——– d—a-w- d:\docume~1\ALLUSE~1\APPLIC~1\TEMP
2009-07-01 12:59 . 2009-06-26 23:20 ——– d—–w- d:\program files\EVGA Precision
2009-06-29 11:44 . 2008-04-09 07:39 107888 —-a-w- d:\windows\system32\CmdLineExt.dll
2009-06-27 17:08 . 2008-04-06 06:22 ——– d—–w- d:\documents and settings\Absurd\Application Data\PACE Anti-Piracy
2009-06-27 17:08 . 2008-04-06 06:22 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\PACE Anti-Piracy
2009-06-27 16:32 . 2009-06-27 16:32 ——– d—–w- d:\documents and settings\Absurd\Application Data\KORG
2009-06-27 15:54 . 2009-06-27 15:54 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\KORG
2009-06-27 15:54 . 2009-06-27 15:54 ——– d—–w- d:\program files\Common Files\KORG
2009-06-27 14:32 . 2009-06-27 14:32 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\Codemasters
2009-06-27 14:31 . 2009-06-27 14:31 444952 —-a-w- d:\windows\system32\wrap_oal.dll
2009-06-27 05:22 . 2009-06-27 05:22 0 —ha-w- d:\windows\system32\drivers\Msft_Kernel_xusb21_01001.Wdf
2009-06-27 05:22 . 2009-06-27 05:22 ——– d—–w- d:\program files\Microsoft Xbox 360 Accessories
2009-06-25 07:39 . 2009-06-25 07:39 ——– d—–w- d:\documents and settings\Absurd\Application Data\M-Audio
2009-06-25 02:11 . 2009-06-25 02:11 2048 —-a-w- d:\windows\system32\sysprs7.dll
2009-06-25 02:11 . 2009-06-25 02:11 1025 —-a-w- d:\windows\system32\clauth2.dll
2009-06-25 02:11 . 2009-06-25 02:11 1025 —-a-w- d:\windows\system32\clauth1.dll
2009-06-25 00:47 . 2009-06-25 00:47 ——– d—–w- d:\program files\Syncrosoft
2009-06-25 00:40 . 2009-06-19 13:33 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\Cakewalk
2009-06-23 07:30 . 2009-06-23 07:30 ——– d—–w- d:\program files\Common Files\Real
2009-06-23 07:14 . 2009-06-23 07:11 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\ElectricSheep
2009-06-23 05:11 . 2009-06-23 05:11 ——– d—–w- d:\documents and settings\Absurd\Application Data\dBpoweramp
2009-06-22 14:45 . 2009-06-22 14:45 ——– d—–w- d:\program files\Common Files\Voyetra
2009-06-22 14:33 . 2009-06-22 14:33 198064 —-a-w- d:\documents and settings\Absurd\Application Data\IDM\idmmzcc3\components\idmmzcc.dll
2009-06-22 14:32 . 2008-05-04 09:02 ——– d—–w- d:\program files\Internet Download Manager
2009-06-22 01:52 . 2009-06-22 01:52 ——– d—–w- d:\documents and settings\Absurd\Application Data\AccurateRip
2009-06-22 01:52 . 2009-06-22 01:52 13841 —-a-w- d:\windows\system32\SpoonUninstall-dBpoweramp Music Converter.dat
2009-06-22 01:44 . 2009-06-02 14:41 ——– d—–w- d:\documents and settings\Absurd\Application Data\Ableton
2009-06-21 23:24 . 2009-06-21 23:11 ——– d—–w- d:\documents and settings\Absurd\Application Data\Steinberg
2009-06-21 23:15 . 2009-06-21 23:15 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\Steinberg
2009-06-21 22:32 . 2009-06-19 13:33 ——– d—–w- d:\documents and settings\Absurd\Application Data\Cakewalk
2009-06-20 08:34 . 2008-06-23 18:18 ——– d—–w- d:\program files\IK Multimedia
2009-06-19 23:15 . 2009-01-22 07:07 ——– d—–w- d:\program files\SmartFTP Client
2009-06-19 23:03 . 2009-06-19 23:03 ——– d—–w- d:\documents and settings\Absurd\Application Data\Yahoo!
2009-06-19 22:59 . 2009-06-19 22:59 ——– d—–w- d:\documents and settings\Absurd\Application Data\TweakNow RegCleaner
2009-06-19 14:43 . 2009-06-03 05:50 ——– d—–w- d:\program files\Common Files\Native Instruments
2009-06-19 13:55 . 2009-06-19 13:55 ——– d—–w- d:\program files\LUXONIX
2009-06-19 08:25 . 2008-04-03 02:16 ——– d—–w- d:\program files\GIGABYTE
2009-06-19 07:41 . 2008-04-07 15:51 24944 —-a-w- d:\windows\system32\drivers\GVTDrv.sys
2009-06-19 06:52 . 2008-08-02 06:37 ——– d—–w- d:\program files\ZModeler
2009-06-19 06:40 . 2009-06-12 08:20 ——– d—–w- d:\program files\McDSP
2009-06-19 06:36 . 2008-09-18 09:01 ——– d—–w- d:\program files\Google
2009-06-19 05:47 . 2009-04-10 10:48 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\Alibre Design
2009-06-18 20:20 . 2009-06-18 20:20 ——– d—–w- d:\program files\Belarc
2009-06-18 12:36 . 2009-06-18 12:36 ——– dc-h–w- d:\docume~1\ALLUSE~1\APPLIC~1\{2ED18044-7049-4E7A-A58D-4017348FCDB7}
2009-06-18 12:35 . 2009-06-18 12:35 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\Native Instruments
2009-06-18 12:35 . 2008-08-05 04:52 ——– d—–w- d:\program files\Native Instruments
2009-06-18 12:35 . 2009-06-18 12:35 ——– dc-h–w- d:\docume~1\ALLUSE~1\APPLIC~1\{902029B2-957E-4066-85FA-30DA31731718}
2009-06-17 02:52 . 2009-06-17 02:52 ——– d—–w- d:\program files\Common Files\Software Update Utility
2009-06-17 02:49 . 2009-06-17 02:49 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\AOL Downloads
2009-06-13 21:31 . 2009-06-13 21:31 ——– d—–w- d:\program files\Sonnox
2009-06-13 11:17 . 2009-06-13 11:17 0 —ha-w- d:\windows\system32\drivers\Msft_Kernel_LUsbFilt_01005.Wdf
2009-06-12 09:56 . 2009-06-12 09:56 ——– d—–w- d:\documents and settings\Absurd\Application Data\FabFilter
2009-06-12 09:52 . 2009-06-12 09:52 ——– d—–w- d:\program files\URS Plugins
2009-06-12 09:39 . 2009-06-12 09:39 27041 —-a-w- d:\windows\unins000.dat
2009-06-12 09:39 . 2009-06-12 09:39 ——– d—–w- d:\program files\Sonalksis
2009-06-12 09:39 . 2009-06-12 09:39 678746 —-a-w- d:\windows\unins000.exe
2009-06-12 09:37 . 2009-06-12 09:37 ——– d—–w- d:\program files\Vintage Amp Room
2009-06-12 09:35 . 2009-06-12 09:35 ——– d—–w- d:\program files\Serato
2009-06-12 09:30 . 2009-06-12 09:28 ——– d—–w- d:\program files\Roger Nichols Digital, Inc
2009-06-12 09:23 . 2009-06-12 09:23 ——– d—–w- d:\program files\Overloud
2009-06-12 09:23 . 2008-06-28 00:27 ——– d—–w- d:\program files\Nomad Factory
2009-07-22 22:13 . 2008-06-18 20:00 134648 —-a-w- d:\program files\mozilla firefox\components\brwsrcmp.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "e:\avg\Toolbar\IEToolbar.dll" [2009-06-14 1004800]

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2009-06-14 20:07 1004800 —-a-w- e:\avg\Toolbar\IEToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "e:\avg\Toolbar\IEToolbar.dll" [2009-06-14 1004800]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "e:\avg\Toolbar\IEToolbar.dll" [2009-06-14 1004800]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"M-Audio Taskbar Icon"="d:\windows\System32\M-AudioTaskBarIcon.exe" [2008-05-15 356864]
"AVG8_TRAY"="e:\avg\avgtray.exe" [2009-07-11 1948440]
"NvCplDaemon"="d:\windows\system32\NvCpl.dll" [2009-06-10 13758464]
"NvMediaCenter"="d:\windows\system32\NvMcTray.dll" [2009-06-10 86016]
"MSConfig"="d:\windows\pchealth\helpctr\Binaries\MSCONFIG.EXE" [2008-04-14 169984]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" - d:\windows\KHALMNPR.Exe [2008-12-19 76304]
"nwiz"="nwiz.exe" - d:\windows\system32\nwiz.exe [2009-06-10 1657376]

d:\documents and settings\Absurd\Start Menu\Programs\Startup\
Adobe Gamma.lnk - d:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-7-14 113664]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoChangeAnimation"= 0 (0x0)
"NoStrCmpLogical"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"MemCheckBoxInRunDlg"= 0 (0x0)
"NoStrCmpLogical"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2009-02-19 04:30 72208 —-a-w- d:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-07-11 08:02 11952 —-a-w- d:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=d:\windows\system32\guard32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"Midi1"=ma_cmidn.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0lsdelete\0SsiEfr.e

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\svcWRSSSDK]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKLM\~\startupfolder\D:^Documents and Settings^Absurd^Start Menu^Programs^Startup^ERUNT AutoBackup.lnk]
path=
backup=d:\windows\pss\ERUNT AutoBackup.lnkStartup

[HKLM\~\startupfolder\D:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech SetPoint.lnk]
path=
backup=d:\windows\pss\Logitech SetPoint.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=3 (0x3)
"PnkBstrA"=2 (0x2)
"PLFlash DeviceIoControl Service"=2 (0x2)
"NVSvc"=2 (0x2)
"NMIndexingService"=3 (0x3)
"Nero BackItUp Scheduler 3"=2 (0x2)
"MA_CMIDI_InstallerService"=2 (0x2)
"LexBceS"=2 (0x2)
"LBTServ"=3 (0x3)
"JavaQuickStarterService"=2 (0x2)
"idsvc"=3 (0x3)
"IDriverT"=3 (0x3)
"gupdate1c9cd3721a28848"=2 (0x2)
"FLEXnet Licensing Service"=3 (0x3)
"digiSPTIService"=3 (0x3)
"DigiRefresh"=2 (0x2)
"cmdAgent"=2 (0x2)
"Bonjour Service"=2 (0x2)
"avg8wd"=2 (0x2)
"avg8emc"=2 (0x2)
"Autodata Limited License Service"=2 (0x2)
"Adobe LM Service"=3 (0x3)
"Diskeeper"=2 (0x2)
"svcWRSSSDK"=2 (0x2)
"Lavasoft Ad-Aware Service"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"d:\\Program Files\\GIGABYTE\\@BIOS\\gwflash.exe"=
"d:\\WINDOWS\\system32\\PnkBstrA.exe"=
"d:\\WINDOWS\\system32\\PnkBstrB.exe"=
"d:\\Program Files\\GIGABYTE\\EasyTune4\\update.exe"=
"d:\\Program Files\\Common Files\\Nero\\Nero Web\\SetupX.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"d:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"d:\\Program Files\\SmartFTP Client\\SmartFTP.exe"=
"d:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"d:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"d:\\Program Files\\Messenger\\msmsgs.exe"=
"d:\\Program Files\\Internet Download Manager\\IDMan.exe"=
"f:\\Games\\grid\\GRID.exe"=
"f:\\Games\\HAWX\\HAWX.exe"=
"f:\\Games\\Ghost Recon Advanced Warfighter 2\\graw2.exe"=
"f:\\Games\\Ghost Recon Advanced Warfighter 2\\graw2_dedicated.exe"=
"d:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"d:\\Program Files\\AIM6\\aim6.exe"=

R0 DigiFilter;DigiFilter;d:\windows\system32\drivers\DigiFilt.sys [4/4/2008 4:21 AM 16384]
R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);d:\windows\system32\drivers\sfsync03.sys [12/6/2005 11:11 AM 35328]
R0 SSI;SSI;d:\windows\system32\drivers\ssi.sys [7/24/2009 4:57 PM 78336]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;d:\windows\system32\drivers\avgldx86.sys [7/11/2009 4:02 AM 327688]
R1 AvgTdiX;AVG Free8 Network Redirector;d:\windows\system32\drivers\avgtdix.sys [7/11/2009 4:01 AM 108552]
R1 cmdGuard;COMODO Firewall Pro Sandbox Driver;d:\windows\system32\drivers\cmdguard.sys [7/8/2008 9:32 PM 101776]
R1 cmdHlp;COMODO Firewall Pro Helper Driver;d:\windows\system32\drivers\cmdhlp.sys [7/8/2008 9:32 PM 31504]
R3 CLEDX;Team H2O CLEDX service;d:\windows\system32\drivers\cledx.sys [6/24/2009 8:48 PM 33792]
R3 MAUSBFTP;Service for M-Audio Fast Track Pro (WDM);d:\windows\system32\drivers\mausb.sys [7/7/2009 1:27 PM 143624]
S3 Ambfilt;Ambfilt;d:\windows\system32\drivers\Ambfilt.sys –> d:\windows\system32\drivers\Ambfilt.sys [?]
S3 cpuz132;cpuz132;d:\windows\system32\drivers\cpuz132_x32.sys [7/2/2009 11:18 PM 12672]
S3 ETDrv;ETDrv;d:\windows\system32\drivers\ETDrv.sys [6/19/2009 4:28 AM 185280]
S3 GVTDrv;GVTDrv;d:\windows\system32\drivers\GVTDrv.sys [4/7/2008 11:51 AM 24944]
S3 MAUSB;Service for M-Audio Fast Track Pro Driver (WDM);d:\windows\system32\drivers\mausb.sys [7/7/2009 1:27 PM 143624]
S3 SUPERWEBCAM;SuperWebcam, WDM Virtual Video Capture Device;d:\windows\system32\drivers\superwebcam.sys [4/2/2008 4:50 PM 31872]
S3 WMP300Nv1;Linksys Wireless-N PCI Adapter WMP300N Driver;d:\windows\system32\DRIVERS\WMP300Nv1.sys –> d:\windows\system32\DRIVERS\WMP300Nv1.sys [?]
S4 avg8emc;AVG Free8 E-mail Scanner;e:\avg\avgemc.exe [7/11/2009 4:01 AM 906520]
S4 avg8wd;AVG Free8 WatchDog;e:\avg\avgwdsvc.exe [7/11/2009 4:01 AM 298776]
S4 gupdate1c9cd3721a28848;Google Update Service (gupdate1c9cd3721a28848);d:\program files\Google\Update\GoogleUpdate.exe [5/5/2009 12:08 AM 133104]
S4 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;d:\program files\Lavasoft\Ad-Aware\AAWService.exe [1/18/2009 5:34 PM 1029456]
S4 Viewpoint Manager Service;Viewpoint Manager Service;d:\program files\Viewpoint\Common\ViewpointService.exe [7/16/2009 1:30 PM 24652]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"d:\windows\system32\rundll32.exe" "d:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
- - - - ORPHANS REMOVED - - - -

Notify-!SASWinLogon - (no file)


.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
IE: Download All Links with IDM - d:\program files\Internet Download Manager\IEGetAll.htm
IE: Download FLV video content with IDM - d:\program files\Internet Download Manager\IEGetVL.htm
IE: Download with IDM - d:\program files\Internet Download Manager\IEExt.htm
Trusted Zone: stickam.com\www
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
FF - ProfilePath - d:\docume~1\Absurd\APPLIC~1\Mozilla\Firefox\Profiles\lmgq9aad.default\
FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=tb50fftrie7&query=
FF - prefs.js: browser.search.selectedEngine - AIM Search
FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=tb50fftrab&query=
FF - component: d:\documents and settings\Absurd\Application Data\Mozilla\Firefox\Profiles\lmgq9aad.default\extensions\[removed]\components\idmmzcc.dll
FF - component: e:\avg\Firefox\components\avgssff.dll
FF - component: e:\avg\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils2.dll
FF - component: e:\avg\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll
FF - component: e:\avg\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll
FF - component: e:\avg\Toolbar\Firefox\avg@igeared\components\xpavgtbapi.dll
FF - plugin: d:\program files\Google\Update\1.2.131.11\npGoogleOneClick5.dll
FF - plugin: d:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: d:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: d:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF - plugin: d:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
.

**************************************************************************

driver loading error catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-27 22:47
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-1390067357-1935655697-839522115-1004\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{35D955B2-FCB2-090A-AB86-7620EE7FA4FB}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_USERS\S-1-5-21-1390067357-1935655697-839522115-1004\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:3c,10,da,82,f9,db,48,11,d9,7f,fc,87,ab,11,47,28,5a,3f,7b,4b,1d,45,f1,
41,84,42,6d,4d,3d,24,51,57,25,d2,27,c9,eb,65,bd,32,54,d2,f5,3e,10,ea,57,f8,\
"??"=hex:aa,f8,e9,f9,d4,11,1c,24,45,24,ef,c9,3e,c1,c2,96

[HKEY_USERS\S-1-5-21-1390067357-1935655697-839522115-1004\Software\SecuROM\License information*]
"datasecu"=hex:7f,5a,ee,e1,27,1d,17,9c,36,3c,78,71,ae,d6,9c,1e,4d,33,67,56,28,
70,43,0c,e7,34,59,53,55,98,35,09,42,cb,42,d4,b6,5f,34,0c,d9,f6,28,24,d8,4e,\
"rkeysecu"=hex:a6,7d,d7,1e,77,4c,df,e3,ce,92,66,7b,ba,f5,0f,50
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(736)
d:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
d:\program files\common files\logishrd\bluetooth\LBTServ.dll
d:\windows\system32\WRLogonNTF.dll
d:\windows\System32\BCMLogon.dll
.
Completion time: 2009-07-28 22:52
ComboFix-quarantined-files.txt 2009-07-28 02:52
ComboFix2.txt 2009-07-27 12:54

Pre-Run: 10,084,122,624 bytes free
Post-Run: 10,029,457,408 bytes free

Current=3 Default=3 Failed=1 LastKnownGood=4 Sets=1,2,3,4
435 — E O F — 2009-07-04 07:00




Hijack this log:


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:58:41 PM, on 7/27/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
D:\windows\System32\smss.exe
D:\windows\system32\winlogon.exe
D:\windows\system32\services.exe
D:\windows\system32\lsass.exe
D:\windows\system32\svchost.exe
D:\windows\System32\svchost.exe
E:\AVG\avgrsx.exe
D:\windows\system32\spoolsv.exe
D:\Program Files\Google\Update\GoogleUpdate.exe
D:\windows\system32\svchost.exe
E:\Spybot - Search & Destroy\TeaTimer.exe
D:\windows\explorer.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - E:\AVG\Toolbar\IEToolbar.dll
R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: IDMIEHlprObj Class - {0055C089-8582-441B-A0BF-17B458C2A3A8} - D:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - E:\AVG\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - E:\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Google Update Helper - {77D7E795-33C5-4323-974D-A2A49AB75517} - D:\Program Files\Google\Update\1.2.131.11\GoopdateBho.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - E:\AVG\Toolbar\IEToolbar.dll
O2 - BHO: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - D:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - E:\AVG\Toolbar\IEToolbar.dll
O4 - HKLM\..\Run: [M-Audio Taskbar Icon] D:\WINDOWS\System32\M-AudioTaskBarIcon.exe
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [AVG8_TRAY] E:\AVG\avgtray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [MSConfig] D:\windows\pchealth\helpctr\Binaries\MSCONFIG.EXE /auto
O4 - Startup: Adobe Gamma.lnk = D:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: Download All Links with IDM - D:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - D:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - D:\Program Files\Internet Download Manager\IEExt.htm
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - D:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - D:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo…sreqlab_nvd.cab
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownlo…iaSmartScan.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - E:\AVG\avgpp.dll
O20 - AppInit_DLLs: D:\WINDOWS\system32\guard32.dll
O20 - Winlogon Notify: !SASWinLogon - D:\windows\
O20 - Winlogon Notify: avgrsstarter - D:\windows\SYSTEM32\avgrsstx.dll
O24 - Desktop Component 0: Aqua Real 2 - AD0FABD2-7EAE-40B8-8F44-6FCFE6C883CD

–
End of file - 5668 bytes
Post #8
Copy/paste the text in the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text. 

File::
d:\temp\TSDNWIN.exe
d:\temp\autorun.bin
d:\windows\system32\sysprs7.dll
d:\windows\system32\clauth2.dll
d:\windows\system32\clauth1.dll

Folder::
d:\windows\D56B0E274A3E46C9B5C1D93D580C099C.TMP
d:\windows\B83FC356B7C0441F8A4DD71E088E7974.TMP
d:\program files\Viewpoint
d:\docume~1\ALLUSE~1\APPLIC~1\Viewpoint
d:\Program Files\Bonjour

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:
1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …


[external image: Posted Image]

Drag CFScript.txt into ComboFix.exe

Then post the results log and a new HijackThis log.


Also please describe how your computer behaves at the moment.
Post #9 last edited
Ok I did what you said and when I dragged the text file into Combofix, Combofix started to run and the windows opened but then all of the sudden the computer when to a blue screen and said the following: STOP: C000021a {Fatal system error} The Windows logon Process system process terminated unexpectedly with a status of OX0000354 (OX000000 00 OX00000000). The system has been shut down. I did notice that I am not getting anymore browser redirects anymore.
Post #11 last edited
Ok I Did it again and this time it worked. The system seems to be running a little bit better. I have not been getting redirected to any websites or anything. The only thing I still notice is that the AVG components are still not showing up and when I right click the AVG icon in the taskbar, it is still grayed out. Also, in the task manager there is a process that is named Googleupdate.exe. I think it was from when I had Google Chrome installed but I no longer have it installed on this machine. I always click end task in the task manager because it uses up some memory. I do not see any option to uninstall it anywhere and I was just wondering if you could also help me uninstall that please.

Here are the logs you requested:

ComboFix 09-07-27.02 - Absurd 07/29/2009 16:42.10.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3071.2602 [GMT -4:00]
Running from: d:\documents and settings\[removed]\Desktop\xxx.exe
Command switches used :: d:\documents and settings\Absurd\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: COMODO Firewall *enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
"d:\temp\autorun.bin"
"d:\temp\TSDNWIN.exe"
"d:\windows\system32\clauth1.dll"
"d:\windows\system32\clauth2.dll"
"d:\windows\system32\sysprs7.dll"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

d:\docume~1\ALLUSE~1\APPLIC~1\Viewpoint
d:\program files\Bonjour
d:\program files\Bonjour\mdnsNSP.dll
d:\program files\Bonjour\mDNSResponder.exe
d:\program files\Viewpoint
d:\program files\Viewpoint\Common\ViewpointService.exe
d:\program files\Viewpoint\Common\VistaBoot.sdll
d:\program files\Viewpoint\Viewpoint Media Player\AxMetaStream.dll
d:\program files\Viewpoint\Viewpoint Media Player\ClassIDs.ini
d:\program files\Viewpoint\Viewpoint Media Player\ComponentMgr.dll
d:\program files\Viewpoint\Viewpoint Media Player\ComponentRegistry.ini
d:\program files\Viewpoint\Viewpoint Media Player\Components\AOLUserShell.dll
d:\program files\Viewpoint\Viewpoint Media Player\Components\Cursors.dll
d:\program files\Viewpoint\Viewpoint Media Player\Components\JpegReader.dll
d:\program files\Viewpoint\Viewpoint Media Player\Components\Mts3Reader.dll
d:\program files\Viewpoint\Viewpoint Media Player\Components\SceneComponent.dll
d:\program files\Viewpoint\Viewpoint Media Player\Components\SreeDMMX.dll
d:\program files\Viewpoint\Viewpoint Media Player\Components\SWFView.dll
d:\program files\Viewpoint\Viewpoint Media Player\Components\VETScriptInterpreter.dll
d:\program files\Viewpoint\Viewpoint Media Player\Components\VMPSpeech.dll
d:\program files\Viewpoint\Viewpoint Media Player\Components\VMPVideo2.dll
d:\program files\Viewpoint\Viewpoint Media Player\HostRegistry.ini
d:\program files\Viewpoint\Viewpoint Media Player\MetaStreamConfig.ini
d:\program files\Viewpoint\Viewpoint Media Player\MetaStreamID.ini
d:\program files\Viewpoint\Viewpoint Media Player\MtsAxInstaller.exe
d:\program files\Viewpoint\Viewpoint Media Player\MTSDownloadSites.txt
d:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
d:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.xpt
d:\temp\autorun.bin
d:\temp\TSDNWIN.exe
d:\windows\B83FC356B7C0441F8A4DD71E088E7974.TMP
d:\windows\B83FC356B7C0441F8A4DD71E088E7974.TMP\WiseCustomCalla.dll
d:\windows\B83FC356B7C0441F8A4DD71E088E7974.TMP\WiseData.ini
d:\windows\D56B0E274A3E46C9B5C1D93D580C099C.TMP
d:\windows\D56B0E274A3E46C9B5C1D93D580C099C.TMP\WiseCustomCalla.dll
d:\windows\system32\clauth1.dll
d:\windows\system32\clauth2.dll
d:\windows\system32\msvcsv60.dll
d:\windows\system32\sysprs7.dll

.
((((((((((((((((((((((((( Files Created from 2009-06-28 to 2009-07-29 )))))))))))))))))))))))))))))))
.

2009-07-29 19:26 . 2009-07-29 19:26 ——– d—–w- d:\documents and settings\Absurd\Application Data\Mael
2009-07-29 06:09 . 2009-07-29 06:09 ——– d—–w- d:\documents and settings\Absurd\Local Settings\Application Data\DFX
2009-07-29 06:07 . 2009-07-29 06:09 ——– d—–w- d:\program files\DFX
2009-07-29 06:06 . 2009-07-29 06:06 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\DFX
2009-07-29 06:06 . 2009-07-29 06:06 ——– d—–w- d:\program files\Common Files\DFX
2009-07-29 04:21 . 2009-07-29 04:23 ——– d—–w- d:\program files\SoundSpectrum
2009-07-28 00:57 . 2009-07-28 00:58 ——– d-s—w- D:\worksnow
2009-07-27 14:20 . 2007-07-19 22:14 444776 —-a-w- d:\windows\system32\d3dx10_35.dll
2009-07-27 14:20 . 2007-05-16 20:45 443752 —-a-w- d:\windows\system32\d3dx10_34.dll
2009-07-27 14:20 . 2007-03-15 20:57 443752 —-a-w- d:\windows\system32\d3dx10_33.dll
2009-07-25 19:35 . 2009-07-29 06:18 ——– d—–w- d:\documents and settings\Absurd\Application Data\SoundSpectrum
2009-07-25 01:56 . 2009-07-25 01:56 ——– d—–w- d:\documents and settings\NetworkService\Application Data\Webroot
2009-07-24 21:17 . 2009-02-12 09:35 38208 —-a-w- d:\documents and settings\Absurd\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2009-07-24 21:16 . 2009-07-24 21:16 ——– d—–w- d:\program files\Common Files\Adobe AIR
2009-07-24 20:57 . 2009-07-24 20:57 ——– d—–w- d:\documents and settings\LocalService\Application Data\Webroot
2009-07-24 20:57 . 2005-11-18 16:05 78336 —-a-w- d:\windows\system32\drivers\ssi.sys
2009-07-24 20:57 . 2004-02-11 22:27 102912 —-a-w- d:\windows\system32\islzma.dll
2009-07-24 20:56 . 2009-07-24 20:56 ——– d—–w- d:\program files\Webroot
2009-07-24 20:56 . 2009-07-24 20:56 ——– d—–w- d:\documents and settings\Absurd\Application Data\Webroot
2009-07-24 20:56 . 2005-05-20 04:58 356352 —-a-w- d:\windows\system32\eSellerateEngine.dll
2009-07-24 20:56 . 2003-06-06 14:21 81920 —-a-w- d:\windows\system32\eSellerateControl350.dll
2009-07-24 16:17 . 2009-07-24 16:17 ——– d—–w- d:\documents and settings\Absurd\Application Data\AVG8
2009-07-23 21:30 . 2009-07-24 20:29 15688 —-a-w- d:\windows\system32\lsdelete.exe
2009-07-23 21:26 . 2009-07-13 17:36 38160 —-a-w- d:\windows\system32\drivers\mbamswissarmy.sys
2009-07-23 21:26 . 2009-07-24 12:22 ——– d—–w- d:\program files\Malwarebytes' Anti-Malware
2009-07-23 21:26 . 2009-07-13 17:36 19096 —-a-w- d:\windows\system32\drivers\mbam.sys
2009-07-23 21:19 . 2009-07-23 21:19 ——– dc-h–w- d:\docume~1\ALLUSE~1\APPLIC~1\{83C91755-2546-441D-AC40-9A6B4B860800}
2009-07-23 21:19 . 2009-07-23 21:23 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\Lavasoft
2009-07-23 21:19 . 2009-07-23 21:19 ——– d—–w- d:\program files\Lavasoft
2009-07-22 12:55 . 2009-07-22 12:55 ——– d—–w- d:\program files\Steinberg
2009-07-21 05:59 . 2009-07-21 05:59 ——– d—–w- d:\program files\EASEUS
2009-07-21 04:01 . 2009-07-21 04:01 ——– d-sh–w- d:\documents and settings\NetworkService\IETldCache
2009-07-21 03:37 . 2009-07-21 03:37 ——– d—–w- d:\program files\WizardRecovery
2009-07-21 03:35 . 2009-07-21 03:35 ——– d-sh–w- d:\windows\system32\config\systemprofile\IETldCache
2009-07-21 03:34 . 2009-07-21 03:34 ——– d—–w- d:\program files\Flobo Floppy Bad Sector Repair
2009-07-20 20:34 . 2009-07-20 20:34 ——– d—–w- d:\windows\system32\wbem\Repository
2009-07-20 03:19 . 2009-07-20 03:19 ——– d—–w- d:\documents and settings\Absurd\Application Data\Viewpoint
2009-07-17 06:35 . 2009-07-17 06:35 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\Office Genuine Advantage
2009-07-17 01:42 . 2009-07-17 01:42 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\nView_Profiles
2009-07-17 01:40 . 2009-06-10 10:03 457248 —-a-w- d:\windows\system32\nvudisp.exe
2009-07-17 01:31 . 2006-04-14 18:00 208896 ——w- d:\windows\system32\nvuide.exe
2009-07-17 01:31 . 2006-12-18 20:33 356352 —-a-w- d:\windows\system32\nvusmb.exe
2009-07-17 01:24 . 2009-06-21 12:46 485920 —-a-w- d:\windows\system32\NVUNINST.EXE
2009-07-17 00:52 . 2009-07-17 00:52 ——– d—–w- d:\windows\AC54E5443E42443CA91DA00A6974C592.TMP
2009-07-17 00:36 . 2009-07-17 00:36 ——– d—–w- d:\program files\SystemRequirementsLab
2009-07-17 00:00 . 2009-07-24 23:49 ——– d—–w- d:\program files\NOS
2009-07-17 00:00 . 2009-07-17 00:00 ——– d—–w- d:\program files\vghd
2009-07-16 21:09 . 2009-07-17 00:00 ——– d—–w- d:\windows\system32\$DXE_V2$
2009-07-16 18:00 . 2009-07-16 18:00 23 –sha-w- d:\windows\system32\abedaebd.dat
2009-07-16 17:53 . 2009-07-16 17:53 23 –sha-w- d:\windows\system32\abedaebd_x.dat
2009-07-16 17:22 . 2009-07-17 00:01 ——– d—–w- d:\program files\Common Files\AOL
2009-07-16 17:21 . 2009-07-16 17:30 ——– d—–w- d:\program files\AIM6
2009-07-16 15:58 . 2009-07-16 15:58 ——– d—–w- d:\documents and settings\Absurd\Application Data\Roni Music
2009-07-16 10:01 . 2009-07-16 10:01 ——– d-sh–w- d:\documents and settings\LocalService\IETldCache
2009-07-16 09:45 . 2009-07-16 09:45 ——– d—–w- d:\program files\Common Files\Diskeeper Corporation
2009-07-16 09:45 . 2009-07-16 09:45 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\Diskeeper Corporation
2009-07-16 09:34 . 2009-07-16 09:34 ——– d—–w- d:\documents and settings\Absurd\Application Data\Desktopicon
2009-07-15 08:10 . 2009-07-15 11:00 ——– d—–w- d:\program files\SynthEdit
2009-07-14 19:28 . 2009-07-14 19:28 ——– d-sh–w- d:\documents and settings\Absurd\IECompatCache
2009-07-14 19:25 . 2009-07-14 19:25 ——– d-sh–w- d:\documents and settings\Absurd\PrivacIE
2009-07-14 19:20 . 2009-07-14 19:20 ——– d-sh–w- d:\documents and settings\Absurd\IETldCache
2009-07-14 19:10 . 2009-07-14 19:13 ——– dc-h–w- d:\windows\ie8
2009-07-14 01:20 . 2009-07-24 23:49 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\NOS
2009-07-12 22:55 . 2009-07-12 22:56 ——– d—–w- D:\rsit
2009-07-11 13:08 . 2009-07-11 13:13 ——– d—–w- d:\documents and settings\Absurd\Application Data\vlc
2009-07-11 10:45 . 2009-07-17 00:47 ——– d–h–w- D:\$AVG8.VAULT$
2009-07-11 08:09 . 2009-07-28 08:54 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2009-07-11 08:06 . 2009-07-11 08:06 ——– d—–w- d:\documents and settings\Absurd\Local Settings\Application Data\AVG Security Toolbar
2009-07-11 08:02 . 2009-07-11 08:02 11952 —-a-w- d:\windows\system32\avgrsstx.dll
2009-07-11 08:02 . 2009-07-11 08:02 327688 —-a-w- d:\windows\system32\drivers\avgldx86.sys
2009-07-11 08:02 . 2009-07-11 08:02 27784 —-a-w- d:\windows\system32\drivers\avgmfx86.sys
2009-07-11 08:02 . 2009-07-16 21:49 ——– d—–w- d:\windows\system32\drivers\Avg
2009-07-11 08:02 . 2009-07-14 19:24 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\AVG Security Toolbar
2009-07-11 08:01 . 2009-07-11 08:01 108552 —-a-w- d:\windows\system32\drivers\avgtdix.sys
2009-07-10 21:29 . 2009-07-10 21:29 ——– d—–w- d:\program files\ERUNT
2009-07-10 20:10 . 2009-07-11 16:33 ——– d—–w- d:\documents and settings\Absurd\Application Data\REAPER
2009-07-10 18:31 . 2009-07-10 18:31 ——– d—–w- d:\program files\AMD
2009-07-10 18:30 . 2009-07-17 01:41 ——– d—–w- d:\program files\AGEIA Technologies
2009-07-10 18:30 . 2009-07-10 18:30 ——– d—–w- d:\windows\system32\AGEIA
2009-07-10 18:22 . 2009-07-10 18:22 ——– d—–w- d:\windows\nview(2)
2009-07-10 17:54 . 2009-07-10 18:31 ——– d—–w- d:\program files\Driver Sweeper
2009-07-10 17:02 . 2009-07-10 17:02 152576 —-a-w- d:\documents and settings\Absurd\Application Data\Sun\Java\jre1.6.0_14\lzma.dll
2009-07-10 12:15 . 2009-07-10 12:42 ——– d—–w- d:\documents and settings\Studio\Application Data\Digidesign
2009-07-10 12:10 . 2009-07-10 12:10 ——– d—–w- d:\documents and settings\Studio\Application Data\Waves Audio
2009-07-10 12:10 . 2009-07-10 12:10 ——– d—–w- d:\documents and settings\Studio\Local Settings\Application Data\Apple Computer
2009-07-10 12:10 . 2009-07-10 12:10 ——– d—–w- d:\documents and settings\Studio\Application Data\M-Audio
2009-07-10 12:10 . 2009-07-10 12:15 ——– d—–w- d:\documents and settings\Studio\Application Data\PACE Anti-Piracy
2009-07-10 12:10 . 2009-07-10 12:10 ——– d—–w- d:\documents and settings\Studio\Local Settings\Application Data\PACE Anti-Piracy
2009-07-07 17:27 . 2008-05-15 21:45 356864 —-a-w- d:\windows\system32\M-AudioTaskBarIcon.exe
2009-07-07 17:27 . 2008-03-11 20:37 143624 —-a-w- d:\windows\system32\drivers\mausb.sys
2009-07-07 17:27 . 2008-03-11 20:37 28680 —-a-w- d:\windows\system32\mausbasio.dll
2009-07-07 17:27 . 2008-03-11 20:37 2519712 —-a-w- d:\windows\system32\madiousb.dll
2009-07-06 22:05 . 2009-07-06 22:06 88616 —-a-w- d:\documents and settings\stickam\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-07-05 23:26 . 2009-07-05 23:26 ——– d—–w- d:\documents and settings\Absurd\Application Data\Ubisoft
2009-07-03 23:08 . 2009-07-03 23:08 3128 —-a-r- d:\documents and settings\Absurd\Application Data\Microsoft\Installer\{DB1299AF-9EE0-422B-959E-F4171B2AE0F7}\ARPPRODUCTICON.exe
2009-07-03 22:51 . 2009-07-03 22:51 3128 —-a-r- d:\documents and settings\Absurd\Application Data\Microsoft\Installer\{147567F0-8575-4BE0-B5B3-62706C67FA5A}\ARPPRODUCTICON.exe
2009-07-03 22:45 . 2009-07-03 22:45 3128 —-a-r- d:\documents and settings\Absurd\Application Data\Microsoft\Installer\{43E8D9E7-AFC9-4BA3-8106-B95E02B87AB7}\ARPPRODUCTICON.exe
2009-07-03 22:01 . 2009-07-03 22:01 ——– d—–w- d:\program files\Toontrack
2009-07-03 17:30 . 2001-11-19 23:05 3972 —-a-w- d:\windows\system32\drivers\PciBus.sys
2009-07-03 17:30 . 2004-06-22 19:44 5632 —-a-w- d:\windows\system32\drivers\Entech64.sys
2009-07-03 03:18 . 2009-03-27 05:16 12672 —-a-w- d:\windows\system32\drivers\cpuz132_x32.sys
2009-07-03 01:24 . 2009-07-03 01:24 ——– d—–w- d:\windows\system32\windows media
2009-07-03 00:06 . 2009-03-09 19:27 4178264 —-a-w- d:\windows\system32\D3DX9_41.dll
2009-07-03 00:06 . 2009-03-09 19:27 1846632 —-a-w- d:\windows\system32\D3DCompiler_41.dll
2009-07-03 00:06 . 2009-03-16 18:18 69448 —-a-w- d:\windows\system32\XAPOFX1_3.dll
2009-07-03 00:06 . 2009-03-16 18:18 517448 —-a-w- d:\windows\system32\XAudio2_4.dll
2009-07-03 00:06 . 2009-03-16 18:18 235352 —-a-w- d:\windows\system32\xactengine3_4.dll
2009-07-03 00:06 . 2009-03-16 18:18 22360 —-a-w- d:\windows\system32\X3DAudio1_6.dll
2009-07-02 18:39 . 2009-07-02 18:39 ——– d—–w- d:\program files\Common Files\aliaswavefront shared
2009-07-02 18:39 . 2009-07-02 18:39 ——– d—–w- d:\program files\Common Files\Alias Shared
2009-07-02 18:38 . 2009-07-02 23:45 ——– d—–w- d:\program files\Microsoft DirectX SDK (April 2007)
2009-07-01 02:31 . 2009-06-08 13:20 198064 —-a-w- d:\documents and settings\Absurd\Application Data\Mozilla\Firefox\Profiles\lmgq9aad.default\extensions\[removed]\components\idmmzcc.dll
2009-06-30 17:24 . 2005-08-30 20:19 1052672 —-a-w- d:\documents and settings\Absurd\Application Data\Macromedia\Dreamweaver 8\Configuration\Flash Player\FlashPlayerW.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-29 20:37 . 2008-04-05 03:41 ——– d—–w- d:\documents and settings\Absurd\Application Data\DMCache
2009-07-29 03:36 . 2009-06-15 10:45 28672 —-a-w- d:\documents and settings\Absurd\Application Data\IDM\NP_IDM5.dll
2009-07-29 03:36 . 2009-06-15 10:45 28672 —-a-w- d:\documents and settings\Absurd\Application Data\IDM\NP_IDM4.dll
2009-07-29 03:36 . 2009-06-15 10:45 28672 —-a-w- d:\documents and settings\Absurd\Application Data\IDM\NP_IDM3.dll
2009-07-29 03:36 . 2009-06-15 10:45 28672 —-a-w- d:\documents and settings\Absurd\Application Data\IDM\NP_IDM2.dll
2009-07-29 03:36 . 2009-06-15 10:45 28672 —-a-w- d:\documents and settings\Absurd\Application Data\IDM\NP_IDM1.dll
2009-07-29 03:36 . 2008-05-04 09:02 ——– d—–w- d:\documents and settings\Absurd\Application Data\IDM
2009-07-28 22:34 . 2008-06-20 23:23 208 —-a-w- d:\windows\msocreg32.dat
2009-07-27 14:19 . 2009-06-27 14:31 110592 —-a-w- d:\windows\system32\OpenAL32.dll
2009-07-27 14:19 . 2009-06-27 14:31 ——– d—–w- d:\program files\OpenAL
2009-07-27 14:19 . 2009-01-19 08:31 ——– d—–w- d:\program files\Common Files\Wise Installation Wizard
2009-07-24 21:18 . 2008-04-05 09:18 ——– d—–w- d:\program files\Common Files\Adobe
2009-07-24 16:20 . 2008-10-28 00:25 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\avg8
2009-07-24 12:28 . 2009-07-24 12:28 280 —-a-w- d:\program files\eumr.txt
2009-07-23 21:45 . 2008-06-21 22:09 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\IK Multimedia
2009-07-22 13:02 . 2009-06-21 22:15 118784 —-a-w- d:\windows\dsdxirmv.exe
2009-07-22 12:50 . 2009-06-18 06:12 ——– d—–w- d:\program files\Image-Line
2009-07-21 05:59 . 2008-04-02 18:36 ——– d–h–w- d:\program files\InstallShield Installation Information
2009-07-17 00:52 . 2008-04-09 10:39 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\NVIDIA Corporation
2009-07-16 23:05 . 2008-04-02 18:43 56272 —-a-w- d:\documents and settings\Absurd\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-07-16 17:13 . 2009-06-19 21:43 ——– d—–w- d:\documents and settings\Absurd\Application Data\Auslogics
2009-07-14 17:07 . 2008-04-09 03:32 ——– d—–w- d:\documents and settings\Absurd\Application Data\Digidesign
2009-07-13 17:22 . 2008-04-03 07:33 ——– d—–w- d:\program files\Enigma Software Group
2009-07-11 10:31 . 2009-01-19 08:59 ——– d—–w- d:\documents and settings\Absurd\Application Data\SUPERAntiSpyware.com
2009-07-11 10:31 . 2009-01-19 08:59 ——– d—–w- d:\program files\SUPERAntiSpyware
2009-07-11 10:24 . 2008-04-02 23:20 ——– d—–w- d:\program files\Common Files\Apple
2009-07-11 10:14 . 2008-11-15 04:19 ——– d—–w- d:\program files\Matroska Pack
2009-07-11 10:11 . 2009-06-29 11:30 1942 —-a-w- d:\windows\system32\ealregsnapshot1.reg
2009-07-11 08:14 . 2009-04-11 11:51 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\Autodesk
2009-07-11 08:14 . 2009-04-11 11:51 ——– d—–w- d:\program files\Common Files\Autodesk Shared
2009-07-10 17:04 . 2009-02-22 19:28 ——– d—–w- d:\program files\Java
2009-07-10 11:53 . 2009-07-10 11:53 ——– d—–w- d:\documents and settings\Studio\Application Data\Logitech
2009-07-10 11:53 . 2009-07-10 11:53 88616 —-a-w- d:\documents and settings\Studio\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-07-08 16:12 . 2009-06-19 23:02 ——– d—–w- d:\program files\Yahoo!
2009-07-07 17:26 . 2008-06-08 06:00 ——– d—–w- d:\program files\M-Audio
2009-07-07 03:58 . 2008-04-21 17:04 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\Ubisoft
2009-07-07 03:57 . 2008-08-15 08:49 ——– d—–w- d:\program files\NVIDIA Corporation
2009-07-03 11:52 . 2008-11-17 19:49 ——– d—–w- d:\program files\Windows Media Connect 2
2009-07-01 19:32 . 2008-04-09 10:09 ——– d—a-w- d:\docume~1\ALLUSE~1\APPLIC~1\TEMP
2009-07-01 12:59 . 2009-06-26 23:20 ——– d—–w- d:\program files\EVGA Precision
2009-06-29 11:44 . 2008-04-09 07:39 107888 —-a-w- d:\windows\system32\CmdLineExt.dll
2009-06-29 11:37 . 2009-06-29 11:37 ——– dc-h–w- d:\docume~1\ALLUSE~1\APPLIC~1\{0691F710-1ECA-4B5A-9727-25554F1BFDC6}
2009-06-29 11:31 . 2009-06-29 11:31 ——– d—–w- d:\program files\Electronic Arts
2009-06-27 17:08 . 2008-04-06 06:22 ——– d—–w- d:\documents and settings\Absurd\Application Data\PACE Anti-Piracy
2009-06-27 17:08 . 2008-04-06 06:22 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\PACE Anti-Piracy
2009-06-27 16:32 . 2009-06-27 16:32 ——– d—–w- d:\documents and settings\Absurd\Application Data\KORG
2009-06-27 15:54 . 2009-06-27 15:54 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\KORG
2009-06-27 15:54 . 2009-06-27 15:54 ——– d—–w- d:\program files\Common Files\KORG
2009-06-27 14:32 . 2009-06-27 14:32 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\Codemasters
2009-06-27 14:31 . 2009-06-27 14:31 444952 —-a-w- d:\windows\system32\wrap_oal.dll
2009-06-27 05:22 . 2009-06-27 05:22 0 —ha-w- d:\windows\system32\drivers\Msft_Kernel_xusb21_01001.Wdf
2009-06-27 05:22 . 2009-06-27 05:22 ——– d—–w- d:\program files\Microsoft Xbox 360 Accessories
2009-06-25 07:39 . 2009-06-25 07:39 ——– d—–w- d:\documents and settings\Absurd\Application Data\M-Audio
2009-06-25 00:47 . 2009-06-25 00:47 ——– d—–w- d:\program files\Syncrosoft
2009-06-25 00:40 . 2009-06-19 13:33 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\Cakewalk
2009-06-23 07:30 . 2009-06-23 07:30 ——– d—–w- d:\program files\Common Files\Real
2009-06-23 07:14 . 2009-06-23 07:11 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\ElectricSheep
2009-06-23 05:11 . 2009-06-23 05:11 ——– d—–w- d:\documents and settings\Absurd\Application Data\dBpoweramp
2009-06-22 14:45 . 2009-06-22 14:45 ——– d—–w- d:\program files\Common Files\Voyetra
2009-06-22 14:33 . 2009-06-22 14:33 198064 —-a-w- d:\documents and settings\Absurd\Application Data\IDM\idmmzcc3\components\idmmzcc.dll
2009-06-22 14:32 . 2008-05-04 09:02 ——– d—–w- d:\program files\Internet Download Manager
2009-06-22 01:52 . 2009-06-22 01:52 ——– d—–w- d:\documents and settings\Absurd\Application Data\AccurateRip
2009-06-22 01:52 . 2009-06-22 01:52 13841 —-a-w- d:\windows\system32\SpoonUninstall-dBpoweramp Music Converter.dat
2009-06-22 01:44 . 2009-06-02 14:41 ——– d—–w- d:\documents and settings\Absurd\Application Data\Ableton
2009-06-21 23:24 . 2009-06-21 23:11 ——– d—–w- d:\documents and settings\Absurd\Application Data\Steinberg
2009-06-21 23:15 . 2009-06-21 23:15 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\Steinberg
2009-06-21 22:32 . 2009-06-19 13:33 ——– d—–w- d:\documents and settings\Absurd\Application Data\Cakewalk
2009-06-20 08:34 . 2008-06-23 18:18 ——– d—–w- d:\program files\IK Multimedia
2009-06-19 23:15 . 2009-01-22 07:07 ——– d—–w- d:\program files\SmartFTP Client
2009-06-19 23:03 . 2009-06-19 23:03 ——– d—–w- d:\documents and settings\Absurd\Application Data\Yahoo!
2009-06-19 22:59 . 2009-06-19 22:59 ——– d—–w- d:\documents and settings\Absurd\Application Data\TweakNow RegCleaner
2009-06-19 14:43 . 2009-06-03 05:50 ——– d—–w- d:\program files\Common Files\Native Instruments
2009-06-19 13:55 . 2009-06-19 13:55 ——– d—–w- d:\program files\LUXONIX
2009-06-19 08:25 . 2008-04-03 02:16 ——– d—–w- d:\program files\GIGABYTE
2009-06-19 07:41 . 2008-04-07 15:51 24944 —-a-w- d:\windows\system32\drivers\GVTDrv.sys
2009-06-19 06:52 . 2008-08-02 06:37 ——– d—–w- d:\program files\ZModeler
2009-06-19 06:40 . 2009-06-12 08:20 ——– d—–w- d:\program files\McDSP
2009-06-19 06:36 . 2008-09-18 09:01 ——– d—–w- d:\program files\Google
2009-06-19 05:47 . 2009-04-10 10:48 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\Alibre Design
2009-06-18 20:20 . 2009-06-18 20:20 ——– d—–w- d:\program files\Belarc
2009-06-18 12:36 . 2009-06-18 12:36 ——– dc-h–w- d:\docume~1\ALLUSE~1\APPLIC~1\{2ED18044-7049-4E7A-A58D-4017348FCDB7}
2009-06-18 12:35 . 2009-06-18 12:35 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\Native Instruments
2009-06-18 12:35 . 2008-08-05 04:52 ——– d—–w- d:\program files\Native Instruments
2009-06-18 12:35 . 2009-06-18 12:35 ——– dc-h–w- d:\docume~1\ALLUSE~1\APPLIC~1\{902029B2-957E-4066-85FA-30DA31731718}
2009-06-17 02:52 . 2009-06-17 02:52 ——– d—–w- d:\program files\Common Files\Software Update Utility
2009-06-17 02:49 . 2009-06-17 02:49 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\AOL Downloads
2009-06-13 21:31 . 2009-06-13 21:31 ——– d—–w- d:\program files\Sonnox
2009-06-13 11:17 . 2009-06-13 11:17 0 —ha-w- d:\windows\system32\drivers\Msft_Kernel_LUsbFilt_01005.Wdf
2009-06-12 09:56 . 2009-06-12 09:56 ——– d—–w- d:\documents and settings\Absurd\Application Data\FabFilter
2009-06-12 09:52 . 2009-06-12 09:52 ——– d—–w- d:\program files\URS Plugins
2009-06-12 09:39 . 2009-06-12 09:39 27041 —-a-w- d:\windows\unins000.dat
2009-06-12 09:39 . 2009-06-12 09:39 ——– d—–w- d:\program files\Sonalksis
2009-06-12 09:39 . 2009-06-12 09:39 678746 —-a-w- d:\windows\unins000.exe
2009-06-12 09:37 . 2009-06-12 09:37 ——– d—–w- d:\program files\Vintage Amp Room
2009-06-12 09:35 . 2009-06-12 09:35 ——– d—–w- d:\program files\Serato
2009-06-12 09:30 . 2009-06-12 09:28 ——– d—–w- d:\program files\Roger Nichols Digital, Inc
2009-06-12 09:23 . 2009-06-12 09:23 ——– d—–w- d:\program files\Overloud
2009-06-12 09:23 . 2008-06-28 00:27 ——– d—–w- d:\program files\Nomad Factory
2009-06-12 09:14 . 2009-06-12 09:14 ——– d—–w- d:\program files\Common Files\Voce Spin
2009-06-12 09:12 . 2009-06-01 23:28 ——– d—–w- d:\program files\Digidesign
2009-07-22 22:13 . 2008-06-18 20:00 134648 —-a-w- d:\program files\mozilla firefox\components\brwsrcmp.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-07-28_02.48.10 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-12-17 15:28 . 2007-12-17 15:28 81920 d:\windows\system32\WhiteCap.scr
+ 2009-07-29 03:23 . 2008-04-14 09:42 23552 d:\windows\system32\ReinstallBackups\0016\DriverFiles\i386\wdmaud.drv
+ 2009-07-29 03:23 . 2008-04-14 04:15 60032 d:\windows\system32\ReinstallBackups\0016\DriverFiles\i386\USBAUDIO.sys
+ 2009-07-29 03:23 . 2004-07-09 08:27 48512 d:\windows\system32\ReinstallBackups\0016\DriverFiles\i386\stream.sys
+ 2009-07-29 03:23 . 2008-04-14 04:15 60160 d:\windows\system32\ReinstallBackups\0016\DriverFiles\i386\drmk.sys
+ 2007-12-17 15:29 . 2007-12-17 15:29 81920 d:\windows\system32\G-Force.scr
- 2008-01-03 15:57 . 2008-01-03 15:57 81920 d:\windows\system32\G-Force.scr
+ 2009-07-29 19:27 . 2009-07-29 19:27 10134 d:\windows\Installer\{E2AB70DA-0378-43AE-9EB6-A4DB20BF28D3}\_BC56ACABB24A375CBE61BC.exe
+ 2009-07-29 19:27 . 2009-07-29 19:27 10134 d:\windows\Installer\{E2AB70DA-0378-43AE-9EB6-A4DB20BF28D3}\_B1DD03F39F1C672CE40D81.exe
+ 2009-07-29 19:27 . 2009-07-29 19:27 10134 d:\windows\Installer\{E2AB70DA-0378-43AE-9EB6-A4DB20BF28D3}\_A4B497558121FDB524565C.exe
+ 2009-07-29 19:27 . 2009-07-29 19:27 10134 d:\windows\Installer\{E2AB70DA-0378-43AE-9EB6-A4DB20BF28D3}\_6B91CF0E9437F48515E666.exe
+ 2009-07-29 03:23 . 2002-12-12 04:14 4096 d:\windows\system32\ReinstallBackups\0016\DriverFiles\i386\ksuser.dll
+ 2009-07-29 19:27 . 2009-07-29 19:27 9774 d:\windows\Installer\{E2AB70DA-0378-43AE-9EB6-A4DB20BF28D3}\_6FEFF9B68218417F98F549.exe
+ 2009-07-29 19:27 . 2009-07-29 19:27 9774 d:\windows\Installer\{E2AB70DA-0378-43AE-9EB6-A4DB20BF28D3}\_42AB474906BC92CE0D8758.exe
+ 2009-07-29 03:23 . 2008-04-14 04:49 146048 d:\windows\system32\ReinstallBackups\0016\DriverFiles\i386\portcls.sys
+ 2009-07-29 19:27 . 2009-07-29 19:27 168448 d:\windows\Installer\3762901.msi
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "e:\avg\Toolbar\IEToolbar.dll" [2009-06-14 1004800]

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2009-06-14 20:07 1004800 —-a-w- e:\avg\Toolbar\IEToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "e:\avg\Toolbar\IEToolbar.dll" [2009-06-14 1004800]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "e:\avg\Toolbar\IEToolbar.dll" [2009-06-14 1004800]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"M-Audio Taskbar Icon"="d:\windows\System32\M-AudioTaskBarIcon.exe" [2008-05-15 356864]
"AVG8_TRAY"="e:\avg\avgtray.exe" [2009-07-11 1948440]
"NvCplDaemon"="d:\windows\system32\NvCpl.dll" [2009-06-10 13758464]
"NvMediaCenter"="d:\windows\system32\NvMcTray.dll" [2009-06-10 86016]
"MSConfig"="d:\windows\pchealth\helpctr\Binaries\MSCONFIG.EXE" [2008-04-14 169984]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" - d:\windows\KHALMNPR.Exe [2008-12-19 76304]
"nwiz"="nwiz.exe" - d:\windows\system32\nwiz.exe [2009-06-10 1657376]

d:\documents and settings\Absurd\Start Menu\Programs\Startup\
Adobe Gamma.lnk - d:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-7-14 113664]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoChangeAnimation"= 0 (0x0)
"NoStrCmpLogical"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"MemCheckBoxInRunDlg"= 0 (0x0)
"NoStrCmpLogical"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2009-02-19 04:30 72208 —-a-w- d:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
[BU]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-07-11 08:02 11952 —-a-w- d:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=d:\windows\system32\guard32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"Midi1"=ma_cmidn.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0lsdelete\0SsiEfr.e

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\svcWRSSSDK]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKLM\~\startupfolder\D:^Documents and Settings^Absurd^Start Menu^Programs^Startup^ERUNT AutoBackup.lnk]
path=
backup=d:\windows\pss\ERUNT AutoBackup.lnkStartup

[HKLM\~\startupfolder\D:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech SetPoint.lnk]
path=
backup=d:\windows\pss\Logitech SetPoint.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=3 (0x3)
"PnkBstrA"=2 (0x2)
"PLFlash DeviceIoControl Service"=2 (0x2)
"NVSvc"=2 (0x2)
"NMIndexingService"=3 (0x3)
"Nero BackItUp Scheduler 3"=2 (0x2)
"MA_CMIDI_InstallerService"=2 (0x2)
"LexBceS"=2 (0x2)
"LBTServ"=3 (0x3)
"JavaQuickStarterService"=2 (0x2)
"idsvc"=3 (0x3)
"IDriverT"=3 (0x3)
"gupdate1c9cd3721a28848"=2 (0x2)
"FLEXnet Licensing Service"=3 (0x3)
"digiSPTIService"=3 (0x3)
"DigiRefresh"=2 (0x2)
"cmdAgent"=2 (0x2)
"Bonjour Service"=2 (0x2)
"avg8wd"=2 (0x2)
"avg8emc"=2 (0x2)
"Autodata Limited License Service"=2 (0x2)
"Adobe LM Service"=3 (0x3)
"Diskeeper"=2 (0x2)
"svcWRSSSDK"=2 (0x2)
"Lavasoft Ad-Aware Service"=2 (0x2)
"BITS"=3 (0x3)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"d:\\Program Files\\GIGABYTE\\@BIOS\\gwflash.exe"=
"d:\\WINDOWS\\system32\\PnkBstrA.exe"=
"d:\\WINDOWS\\system32\\PnkBstrB.exe"=
"d:\\Program Files\\GIGABYTE\\EasyTune4\\update.exe"=
"d:\\Program Files\\Common Files\\Nero\\Nero Web\\SetupX.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"d:\\Program Files\\SmartFTP Client\\SmartFTP.exe"=
"d:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"d:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"d:\\Program Files\\Internet Download Manager\\IDMan.exe"=
"f:\\Games\\grid\\GRID.exe"=
"f:\\Games\\HAWX\\HAWX.exe"=
"f:\\Games\\Ghost Recon Advanced Warfighter 2\\graw2.exe"=
"f:\\Games\\Ghost Recon Advanced Warfighter 2\\graw2_dedicated.exe"=
"d:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"d:\\Program Files\\AIM6\\aim6.exe"=

R0 DigiFilter;DigiFilter;d:\windows\system32\drivers\DigiFilt.sys [4/4/2008 4:21 AM 16384]
R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);d:\windows\system32\drivers\sfsync03.sys [12/6/2005 11:11 AM 35328]
R0 SSI;SSI;d:\windows\system32\drivers\ssi.sys [7/24/2009 4:57 PM 78336]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;d:\windows\system32\drivers\avgldx86.sys [7/11/2009 4:02 AM 327688]
R1 AvgTdiX;AVG Free8 Network Redirector;d:\windows\system32\drivers\avgtdix.sys [7/11/2009 4:01 AM 108552]
R1 cmdGuard;COMODO Firewall Pro Sandbox Driver;d:\windows\system32\drivers\cmdguard.sys [7/8/2008 9:32 PM 101776]
R1 cmdHlp;COMODO Firewall Pro Helper Driver;d:\windows\system32\drivers\cmdhlp.sys [7/8/2008 9:32 PM 31504]
R3 CLEDX;H2O CLEDX service;d:\windows\system32\drivers\cledx.sys [6/24/2009 8:48 PM 33792]
R3 MAUSBFTP;Service for M-Audio Fast Track Pro (WDM);d:\windows\system32\drivers\mausb.sys [7/7/2009 1:27 PM 143624]
S3 Ambfilt;Ambfilt;d:\windows\system32\drivers\Ambfilt.sys –> d:\windows\system32\drivers\Ambfilt.sys [?]
S3 cpuz132;cpuz132;d:\windows\system32\drivers\cpuz132_x32.sys [7/2/2009 11:18 PM 12672]
S3 ETDrv;ETDrv;d:\windows\system32\drivers\ETDrv.sys [6/19/2009 4:28 AM 185280]
S3 GVTDrv;GVTDrv;d:\windows\system32\drivers\GVTDrv.sys [4/7/2008 11:51 AM 24944]
S3 MAUSB;Service for M-Audio Fast Track Pro Driver (WDM);d:\windows\system32\drivers\mausb.sys [7/7/2009 1:27 PM 143624]
S3 SUPERWEBCAM;SuperWebcam, WDM Virtual Video Capture Device;d:\windows\system32\drivers\superwebcam.sys [4/2/2008 4:50 PM 31872]
S3 WMP300Nv1;Linksys Wireless-N PCI Adapter WMP300N Driver;d:\windows\system32\DRIVERS\WMP300Nv1.sys –> d:\windows\system32\DRIVERS\WMP300Nv1.sys [?]
S4 avg8emc;AVG Free8 E-mail Scanner;e:\avg\avgemc.exe [7/11/2009 4:01 AM 906520]
S4 avg8wd;AVG Free8 WatchDog;e:\avg\avgwdsvc.exe [7/11/2009 4:01 AM 298776]
S4 gupdate1c9cd3721a28848;Google Update Service (gupdate1c9cd3721a28848);d:\program files\Google\Update\GoogleUpdate.exe [5/5/2009 12:08 AM 133104]
S4 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;d:\program files\Lavasoft\Ad-Aware\AAWService.exe [1/18/2009 5:34 PM 1029456]
S4 Viewpoint Manager Service;Viewpoint Manager Service;"d:\program files\Viewpoint\Common\ViewpointService.exe" –> d:\program files\Viewpoint\Common\ViewpointService.exe [?]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"d:\windows\system32\rundll32.exe" "d:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
- - - - ORPHANS REMOVED - - - -

BHO-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)


.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
IE: Download All Links with IDM - d:\program files\Internet Download Manager\IEGetAll.htm
IE: Download FLV video content with IDM - d:\program files\Internet Download Manager\IEGetVL.htm
IE: Download with IDM - d:\program files\Internet Download Manager\IEExt.htm
Trusted Zone: stickam.com\www
TCP: {F2D3389C-9E25-4EA2-94FB-5051F48C68FB} = 208.67.222.222,208.67.220.220
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
FF - ProfilePath - d:\docume~1\Absurd\APPLIC~1\Mozilla\Firefox\Profiles\lmgq9aad.default\
FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=tb50fftrie7&query=
FF - prefs.js: browser.search.selectedEngine - AIM Search
FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=tb50fftrab&query=
FF - component: d:\documents and settings\Absurd\Application Data\Mozilla\Firefox\Profiles\lmgq9aad.default\extensions\[removed]\components\idmmzcc.dll
FF - component: e:\avg\Firefox\components\avgssff.dll
FF - component: e:\avg\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils2.dll
FF - component: e:\avg\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll
FF - component: e:\avg\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll
FF - component: e:\avg\Toolbar\Firefox\avg@igeared\components\xpavgtbapi.dll
FF - plugin: d:\program files\Google\Update\1.2.131.11\npGoogleOneClick5.dll
FF - plugin: d:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: d:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: d:\program files\Mozilla Firefox\plugins\npViewpoint.dll
.

**************************************************************************

driver loading error catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-29 16:50
Windows 5.1.2600 Service Pack 3 NTFS

detected NTDLL code modification:
ZwClose

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-1390067357-1935655697-839522115-1004\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{35D955B2-FCB2-090A-AB86-7620EE7FA4FB}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_USERS\S-1-5-21-1390067357-1935655697-839522115-1004\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:3c,10,da,82,f9,db,48,11,d9,7f,fc,87,ab,11,47,28,5a,3f,7b,4b,1d,45,f1,
41,84,42,6d,4d,3d,24,51,57,25,d2,27,c9,eb,65,bd,32,54,d2,f5,3e,10,ea,57,f8,\
"??"=hex:aa,f8,e9,f9,d4,11,1c,24,45,24,ef,c9,3e,c1,c2,96

[HKEY_USERS\S-1-5-21-1390067357-1935655697-839522115-1004\Software\SecuROM\License information*]
"datasecu"=hex:7f,5a,ee,e1,27,1d,17,9c,36,3c,78,71,ae,d6,9c,1e,4d,33,67,56,28,
70,43,0c,e7,34,59,53,55,98,35,09,42,cb,42,d4,b6,5f,34,0c,d9,f6,28,24,d8,4e,\
"rkeysecu"=hex:a6,7d,d7,1e,77,4c,df,e3,ce,92,66,7b,ba,f5,0f,50
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(720)
d:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
d:\program files\common files\logishrd\bluetooth\LBTServ.dll
d:\windows\system32\WRLogonNTF.dll
d:\windows\System32\BCMLogon.dll

- - - - - - - > 'explorer.exe'(3676)
d:\windows\system32\ieframe.dll
d:\windows\system32\msi.dll
d:\windows\system32\OneX.DLL
d:\windows\system32\eappprxy.dll
d:\windows\system32\webcheck.dll
d:\windows\system32\WPDShServiceObj.dll
d:\program files\SmartFTP Client\smarthook.dll
d:\windows\system32\PortableDeviceTypes.dll
d:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
e:\avg\avgrsx.exe
d:\windows\system32\rundll32.exe
.
**************************************************************************
.
Completion time: 2009-07-29 16:57 - machine was rebooted
ComboFix-quarantined-files.txt 2009-07-29 20:57
ComboFix2.txt 2009-07-28 02:52
ComboFix3.txt 2009-07-27 12:54

Pre-Run: 9,968,893,952 bytes free
Post-Run: 9,913,569,280 bytes free

Current=3 Default=3 Failed=1 LastKnownGood=4 Sets=1,2,3,4
508 — E O F — 2009-07-04 07:00



Hijackthis log:


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:01:51 PM, on 7/29/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
D:\windows\System32\smss.exe
D:\windows\system32\winlogon.exe
D:\windows\system32\services.exe
D:\windows\system32\lsass.exe
D:\windows\system32\svchost.exe
D:\windows\System32\svchost.exe
E:\AVG\avgrsx.exe
D:\windows\system32\spoolsv.exe
D:\windows\system32\svchost.exe
D:\Program Files\Google\Update\GoogleUpdate.exe
D:\WINDOWS\System32\M-AudioTaskBarIcon.exe
E:\AVG\avgtray.exe
D:\windows\system32\RUNDLL32.EXE
D:\windows\explorer.exe
D:\windows\system32\notepad.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - E:\AVG\Toolbar\IEToolbar.dll
R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: IDMIEHlprObj Class - {0055C089-8582-441B-A0BF-17B458C2A3A8} - D:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - E:\AVG\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - E:\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Google Update Helper - {77D7E795-33C5-4323-974D-A2A49AB75517} - D:\Program Files\Google\Update\1.2.131.11\GoopdateBho.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - E:\AVG\Toolbar\IEToolbar.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - D:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - E:\AVG\Toolbar\IEToolbar.dll
O4 - HKLM\..\Run: [M-Audio Taskbar Icon] D:\WINDOWS\System32\M-AudioTaskBarIcon.exe
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [AVG8_TRAY] E:\AVG\avgtray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [MSConfig] D:\windows\pchealth\helpctr\Binaries\MSCONFIG.EXE /auto
O4 - Startup: Adobe Gamma.lnk = D:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: Download All Links with IDM - D:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - D:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - D:\Program Files\Internet Download Manager\IEExt.htm
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - D:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - D:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe (file missing)
O10 - Broken Internet access because of LSP provider 'd:\program files\bonjour\mdnsnsp.dll' missing
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo…sreqlab_nvd.cab
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownlo…iaSmartScan.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F2D3389C-9E25-4EA2-94FB-5051F48C68FB}: NameServer = 208.67.222.222,208.67.220.220
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - E:\AVG\avgpp.dll
O20 - AppInit_DLLs: D:\WINDOWS\system32\guard32.dll
O20 - Winlogon Notify: !SASWinLogon - D:\windows\
O20 - Winlogon Notify: avgrsstarter - D:\windows\SYSTEM32\avgrsstx.dll
O24 - Desktop Component 0: Aqua Real 2 - AD0FABD2-7EAE-40B8-8F44-6FCFE6C883CD

–
End of file - 5936 bytes
Post #12
Copy/paste the text in the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text. 

File::
d:\windows\AC54E5443E42443CA91DA00A6974C592.TMP
d:\program files\Google\Update\GoogleUpdate.exe [5/5/2009 12:08 AM 133104]

Folder::
d:\program files\Google\Update

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:
1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …


[external image: Posted Image]

Drag CFScript.txt into ComboFix.exe

Then post the results log and a new HijackThis log.


Also please describe how your computer behaves at the moment.
Post #13
Here are the logs you requested:

ComboFix 09-07-27.02 - Absurd 07/30/2009 0:57.11.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3071.2625 [GMT -4:00]
Running from: d:\documents and settings\[removed]\Desktop\xxx.exe
Command switches used :: d:\documents and settings\Absurd\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: COMODO Firewall *enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
"d:\program files\Google\Update\GoogleUpdate.exe [5/5/2009 12:08 AM 133104]"
"d:\windows\AC54E5443E42443CA91DA00A6974C592.TMP"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

d:\program files\Google\Update
d:\program files\Google\Update\1.2.131.11\GoogleUpdate.exe
d:\program files\Google\Update\1.2.131.11\GoogleUpdateHelper.msi
d:\program files\Google\Update\1.2.131.11\goopdate.dll
d:\program files\Google\Update\1.2.131.11\GoopdateBho.dll
d:\program files\Google\Update\1.2.131.11\goopdateres_ar.dll
d:\program files\Google\Update\1.2.131.11\goopdateres_bg.dll
d:\program files\Google\Update\1.2.131.11\goopdateres_ca.dll
d:\program files\Google\Update\1.2.131.11\goopdateres_cs.dll
d:\program files\Google\Update\1.2.131.11\goopdateres_da.dll
d:\program files\Google\Update\1.2.131.11\goopdateres_de.dll
d:\program files\Google\Update\1.2.131.11\goopdateres_el.dll
d:\program files\Google\Update\1.2.131.11\goopdateres_en-GB.dll
d:\program files\Google\Update\1.2.131.11\goopdateres_en.dll
d:\program files\Google\Update\1.2.131.11\goopdateres_es-419.dll
d:\program files\Google\Update\1.2.131.11\goopdateres_es.dll
d:\program files\Google\Update\1.2.131.11\goopdateres_et.dll
d:\program files\Google\Update\1.2.131.11\goopdateres_fi.dll
d:\program files\Google\Update\1.2.131.11\goopdateres_fil.dll
d:\program files\Google\Update\1.2.131.11\goopdateres_fr.dll
d:\program files\Google\Update\1.2.131.11\goopdateres_hi.dll
d:\program files\Google\Update\1.2.131.11\goopdateres_hr.dll
d:\program files\Google\Update\1.2.131.11\goopdateres_hu.dll
d:\program files\Google\Update\1.2.131.11\goopdateres_id.dll
d:\program files\Google\Update\1.2.131.11\goopdateres_it.dll
d:\program files\Google\Update\1.2.131.11\goopdateres_iw.dll
d:\program files\Google\Update\1.2.131.11\goopdateres_ja.dll
d:\program files\Google\Update\1.2.131.11\goopdateres_ko.dll
d:\program files\Google\Update\1.2.131.11\goopdateres_lt.dll
d:\program files\Google\Update\1.2.131.11\goopdateres_lv.dll
d:\program files\Google\Update\1.2.131.11\goopdateres_nl.dll
d:\program files\Google\Update\1.2.131.11\goopdateres_no.dll
d:\program files\Google\Update\1.2.131.11\goopdateres_pl.dll
d:\program files\Google\Update\1.2.131.11\goopdateres_pt-BR.dll
d:\program files\Google\Update\1.2.131.11\goopdateres_pt-PT.dll
d:\program files\Google\Update\1.2.131.11\goopdateres_ro.dll
d:\program files\Google\Update\1.2.131.11\goopdateres_ru.dll
d:\program files\Google\Update\1.2.131.11\goopdateres_sk.dll
d:\program files\Google\Update\1.2.131.11\goopdateres_sl.dll
d:\program files\Google\Update\1.2.131.11\goopdateres_sr.dll
d:\program files\Google\Update\1.2.131.11\goopdateres_sv.dll
d:\program files\Google\Update\1.2.131.11\goopdateres_th.dll
d:\program files\Google\Update\1.2.131.11\goopdateres_tr.dll
d:\program files\Google\Update\1.2.131.11\goopdateres_uk.dll
d:\program files\Google\Update\1.2.131.11\goopdateres_vi.dll
d:\program files\Google\Update\1.2.131.11\goopdateres_zh-CN.dll
d:\program files\Google\Update\1.2.131.11\goopdateres_zh-TW.dll
d:\program files\Google\Update\1.2.131.11\npGoogleOneClick5.dll
d:\program files\Google\Update\GoogleUpdate.exe

.
((((((((((((((((((((((((( Files Created from 2009-06-28 to 2009-07-30 )))))))))))))))))))))))))))))))
.

2009-07-29 19:26 . 2009-07-29 19:26 ——– d—–w- d:\documents and settings\Absurd\Application Data\Mael
2009-07-29 06:09 . 2009-07-29 06:09 ——– d—–w- d:\documents and settings\Absurd\Local Settings\Application Data\DFX
2009-07-29 06:07 . 2009-07-29 06:09 ——– d—–w- d:\program files\DFX
2009-07-29 06:06 . 2009-07-29 06:06 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\DFX
2009-07-29 06:06 . 2009-07-29 06:06 ——– d—–w- d:\program files\Common Files\DFX
2009-07-29 04:21 . 2009-07-29 04:23 ——– d—–w- d:\program files\SoundSpectrum
2009-07-28 00:57 . 2009-07-28 00:58 ——– d-s—w- D:\worksnow
2009-07-27 14:20 . 2007-07-19 22:14 444776 —-a-w- d:\windows\system32\d3dx10_35.dll
2009-07-27 14:20 . 2007-05-16 20:45 443752 —-a-w- d:\windows\system32\d3dx10_34.dll
2009-07-27 14:20 . 2007-03-15 20:57 443752 —-a-w- d:\windows\system32\d3dx10_33.dll
2009-07-25 19:35 . 2009-07-29 06:18 ——– d—–w- d:\documents and settings\Absurd\Application Data\SoundSpectrum
2009-07-25 01:56 . 2009-07-25 01:56 ——– d—–w- d:\documents and settings\NetworkService\Application Data\Webroot
2009-07-24 21:17 . 2009-02-12 09:35 38208 —-a-w- d:\documents and settings\Absurd\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2009-07-24 21:16 . 2009-07-24 21:16 ——– d—–w- d:\program files\Common Files\Adobe AIR
2009-07-24 20:57 . 2009-07-24 20:57 ——– d—–w- d:\documents and settings\LocalService\Application Data\Webroot
2009-07-24 20:57 . 2005-11-18 16:05 78336 —-a-w- d:\windows\system32\drivers\ssi.sys
2009-07-24 20:57 . 2004-02-11 22:27 102912 —-a-w- d:\windows\system32\islzma.dll
2009-07-24 20:56 . 2009-07-24 20:56 ——– d—–w- d:\program files\Webroot
2009-07-24 20:56 . 2009-07-24 20:56 ——– d—–w- d:\documents and settings\Absurd\Application Data\Webroot
2009-07-24 20:56 . 2005-05-20 04:58 356352 —-a-w- d:\windows\system32\eSellerateEngine.dll
2009-07-24 20:56 . 2003-06-06 14:21 81920 —-a-w- d:\windows\system32\eSellerateControl350.dll
2009-07-24 16:17 . 2009-07-24 16:17 ——– d—–w- d:\documents and settings\Absurd\Application Data\AVG8
2009-07-23 21:30 . 2009-07-24 20:29 15688 —-a-w- d:\windows\system32\lsdelete.exe
2009-07-23 21:26 . 2009-07-13 17:36 38160 —-a-w- d:\windows\system32\drivers\mbamswissarmy.sys
2009-07-23 21:26 . 2009-07-24 12:22 ——– d—–w- d:\program files\Malwarebytes' Anti-Malware
2009-07-23 21:26 . 2009-07-13 17:36 19096 —-a-w- d:\windows\system32\drivers\mbam.sys
2009-07-23 21:19 . 2009-07-23 21:19 ——– dc-h–w- d:\docume~1\ALLUSE~1\APPLIC~1\{83C91755-2546-441D-AC40-9A6B4B860800}
2009-07-23 21:19 . 2009-07-23 21:23 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\Lavasoft
2009-07-23 21:19 . 2009-07-23 21:19 ——– d—–w- d:\program files\Lavasoft
2009-07-22 12:55 . 2009-07-22 12:55 ——– d—–w- d:\program files\Steinberg
2009-07-21 05:59 . 2009-07-21 05:59 ——– d—–w- d:\program files\EASEUS
2009-07-21 04:01 . 2009-07-21 04:01 ——– d-sh–w- d:\documents and settings\NetworkService\IETldCache
2009-07-21 03:37 . 2009-07-21 03:37 ——– d—–w- d:\program files\WizardRecovery
2009-07-21 03:35 . 2009-07-21 03:35 ——– d-sh–w- d:\windows\system32\config\systemprofile\IETldCache
2009-07-21 03:34 . 2009-07-21 03:34 ——– d—–w- d:\program files\Flobo Floppy Bad Sector Repair
2009-07-20 20:34 . 2009-07-20 20:34 ——– d—–w- d:\windows\system32\wbem\Repository
2009-07-20 03:19 . 2009-07-20 03:19 ——– d—–w- d:\documents and settings\Absurd\Application Data\Viewpoint
2009-07-17 06:35 . 2009-07-17 06:35 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\Office Genuine Advantage
2009-07-17 01:42 . 2009-07-17 01:42 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\nView_Profiles
2009-07-17 01:40 . 2009-06-10 10:03 457248 —-a-w- d:\windows\system32\nvudisp.exe
2009-07-17 01:31 . 2006-04-14 18:00 208896 ——w- d:\windows\system32\nvuide.exe
2009-07-17 01:31 . 2006-12-18 20:33 356352 —-a-w- d:\windows\system32\nvusmb.exe
2009-07-17 01:24 . 2009-06-21 12:46 485920 —-a-w- d:\windows\system32\NVUNINST.EXE
2009-07-17 00:52 . 2009-07-17 00:52 ——– d—–w- d:\windows\AC54E5443E42443CA91DA00A6974C592.TMP
2009-07-17 00:36 . 2009-07-17 00:36 ——– d—–w- d:\program files\SystemRequirementsLab
2009-07-17 00:00 . 2009-07-24 23:49 ——– d—–w- d:\program files\NOS
2009-07-17 00:00 . 2009-07-17 00:00 ——– d—–w- d:\program files\vghd
2009-07-16 21:09 . 2009-07-17 00:00 ——– d—–w- d:\windows\system32\$DXE_V2$
2009-07-16 18:00 . 2009-07-16 18:00 23 –sha-w- d:\windows\system32\abedaebd.dat
2009-07-16 17:53 . 2009-07-16 17:53 23 –sha-w- d:\windows\system32\abedaebd_x.dat
2009-07-16 17:22 . 2009-07-17 00:01 ——– d—–w- d:\program files\Common Files\AOL
2009-07-16 17:21 . 2009-07-16 17:30 ——– d—–w- d:\program files\AIM6
2009-07-16 15:58 . 2009-07-16 15:58 ——– d—–w- d:\documents and settings\Absurd\Application Data\Roni Music
2009-07-16 10:01 . 2009-07-16 10:01 ——– d-sh–w- d:\documents and settings\LocalService\IETldCache
2009-07-16 09:45 . 2009-07-16 09:45 ——– d—–w- d:\program files\Common Files\Diskeeper Corporation
2009-07-16 09:45 . 2009-07-16 09:45 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\Diskeeper Corporation
2009-07-16 09:34 . 2009-07-16 09:34 ——– d—–w- d:\documents and settings\Absurd\Application Data\Desktopicon
2009-07-15 08:10 . 2009-07-15 11:00 ——– d—–w- d:\program files\SynthEdit
2009-07-14 19:28 . 2009-07-14 19:28 ——– d-sh–w- d:\documents and settings\Absurd\IECompatCache
2009-07-14 19:25 . 2009-07-14 19:25 ——– d-sh–w- d:\documents and settings\Absurd\PrivacIE
2009-07-14 19:20 . 2009-07-14 19:20 ——– d-sh–w- d:\documents and settings\Absurd\IETldCache
2009-07-14 19:10 . 2009-07-14 19:13 ——– dc-h–w- d:\windows\ie8
2009-07-14 01:20 . 2009-07-24 23:49 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\NOS
2009-07-12 22:55 . 2009-07-12 22:56 ——– d—–w- D:\rsit
2009-07-11 13:08 . 2009-07-11 13:13 ——– d—–w- d:\documents and settings\Absurd\Application Data\vlc
2009-07-11 10:45 . 2009-07-17 00:47 ——– d–h–w- D:\$AVG8.VAULT$
2009-07-11 08:09 . 2009-07-28 08:54 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2009-07-11 08:06 . 2009-07-11 08:06 ——– d—–w- d:\documents and settings\Absurd\Local Settings\Application Data\AVG Security Toolbar
2009-07-11 08:02 . 2009-07-11 08:02 11952 —-a-w- d:\windows\system32\avgrsstx.dll
2009-07-11 08:02 . 2009-07-11 08:02 327688 —-a-w- d:\windows\system32\drivers\avgldx86.sys
2009-07-11 08:02 . 2009-07-11 08:02 27784 —-a-w- d:\windows\system32\drivers\avgmfx86.sys
2009-07-11 08:02 . 2009-07-16 21:49 ——– d—–w- d:\windows\system32\drivers\Avg
2009-07-11 08:02 . 2009-07-14 19:24 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\AVG Security Toolbar
2009-07-11 08:01 . 2009-07-11 08:01 108552 —-a-w- d:\windows\system32\drivers\avgtdix.sys
2009-07-10 21:29 . 2009-07-10 21:29 ——– d—–w- d:\program files\ERUNT
2009-07-10 20:10 . 2009-07-11 16:33 ——– d—–w- d:\documents and settings\Absurd\Application Data\REAPER
2009-07-10 18:31 . 2009-07-10 18:31 ——– d—–w- d:\program files\AMD
2009-07-10 18:30 . 2009-07-17 01:41 ——– d—–w- d:\program files\AGEIA Technologies
2009-07-10 18:30 . 2009-07-10 18:30 ——– d—–w- d:\windows\system32\AGEIA
2009-07-10 18:22 . 2009-07-10 18:22 ——– d—–w- d:\windows\nview(2)
2009-07-10 17:54 . 2009-07-10 18:31 ——– d—–w- d:\program files\Driver Sweeper
2009-07-10 17:02 . 2009-07-10 17:02 152576 —-a-w- d:\documents and settings\Absurd\Application Data\Sun\Java\jre1.6.0_14\lzma.dll
2009-07-10 12:15 . 2009-07-10 12:42 ——– d—–w- d:\documents and settings\Studio\Application Data\Digidesign
2009-07-10 12:10 . 2009-07-10 12:10 ——– d—–w- d:\documents and settings\Studio\Application Data\Waves Audio
2009-07-10 12:10 . 2009-07-10 12:10 ——– d—–w- d:\documents and settings\Studio\Local Settings\Application Data\Apple Computer
2009-07-10 12:10 . 2009-07-10 12:10 ——– d—–w- d:\documents and settings\Studio\Application Data\M-Audio
2009-07-10 12:10 . 2009-07-10 12:15 ——– d—–w- d:\documents and settings\Studio\Application Data\PACE Anti-Piracy
2009-07-10 12:10 . 2009-07-10 12:10 ——– d—–w- d:\documents and settings\Studio\Local Settings\Application Data\PACE Anti-Piracy
2009-07-07 17:27 . 2008-05-15 21:45 356864 —-a-w- d:\windows\system32\M-AudioTaskBarIcon.exe
2009-07-07 17:27 . 2008-03-11 20:37 143624 —-a-w- d:\windows\system32\drivers\mausb.sys
2009-07-07 17:27 . 2008-03-11 20:37 28680 —-a-w- d:\windows\system32\mausbasio.dll
2009-07-07 17:27 . 2008-03-11 20:37 2519712 —-a-w- d:\windows\system32\madiousb.dll
2009-07-06 22:05 . 2009-07-06 22:06 88616 —-a-w- d:\documents and settings\stickam\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-07-05 23:26 . 2009-07-05 23:26 ——– d—–w- d:\documents and settings\Absurd\Application Data\Ubisoft
2009-07-03 23:08 . 2009-07-03 23:08 3128 —-a-r- d:\documents and settings\Absurd\Application Data\Microsoft\Installer\{DB1299AF-9EE0-422B-959E-F4171B2AE0F7}\ARPPRODUCTICON.exe
2009-07-03 22:51 . 2009-07-03 22:51 3128 —-a-r- d:\documents and settings\Absurd\Application Data\Microsoft\Installer\{147567F0-8575-4BE0-B5B3-62706C67FA5A}\ARPPRODUCTICON.exe
2009-07-03 22:45 . 2009-07-03 22:45 3128 —-a-r- d:\documents and settings\Absurd\Application Data\Microsoft\Installer\{43E8D9E7-AFC9-4BA3-8106-B95E02B87AB7}\ARPPRODUCTICON.exe
2009-07-03 22:01 . 2009-07-03 22:01 ——– d—–w- d:\program files\Toontrack
2009-07-03 17:30 . 2001-11-19 23:05 3972 —-a-w- d:\windows\system32\drivers\PciBus.sys
2009-07-03 17:30 . 2004-06-22 19:44 5632 —-a-w- d:\windows\system32\drivers\Entech64.sys
2009-07-03 03:18 . 2009-03-27 05:16 12672 —-a-w- d:\windows\system32\drivers\cpuz132_x32.sys
2009-07-03 01:24 . 2009-07-03 01:24 ——– d—–w- d:\windows\system32\windows media
2009-07-03 00:06 . 2009-03-09 19:27 4178264 —-a-w- d:\windows\system32\D3DX9_41.dll
2009-07-03 00:06 . 2009-03-09 19:27 1846632 —-a-w- d:\windows\system32\D3DCompiler_41.dll
2009-07-03 00:06 . 2009-03-16 18:18 69448 —-a-w- d:\windows\system32\XAPOFX1_3.dll
2009-07-03 00:06 . 2009-03-16 18:18 517448 —-a-w- d:\windows\system32\XAudio2_4.dll
2009-07-03 00:06 . 2009-03-16 18:18 235352 —-a-w- d:\windows\system32\xactengine3_4.dll
2009-07-03 00:06 . 2009-03-16 18:18 22360 —-a-w- d:\windows\system32\X3DAudio1_6.dll
2009-07-02 18:39 . 2009-07-02 18:39 ——– d—–w- d:\program files\Common Files\aliaswavefront shared
2009-07-02 18:39 . 2009-07-02 18:39 ——– d—–w- d:\program files\Common Files\Alias Shared
2009-07-02 18:38 . 2009-07-02 23:45 ——– d—–w- d:\program files\Microsoft DirectX SDK (April 2007)
2009-07-01 02:31 . 2009-06-08 13:20 198064 —-a-w- d:\documents and settings\Absurd\Application Data\Mozilla\Firefox\Profiles\lmgq9aad.default\extensions\[removed]\components\idmmzcc.dll
2009-06-30 17:24 . 2005-08-30 20:19 1052672 —-a-w- d:\documents and settings\Absurd\Application Data\Macromedia\Dreamweaver 8\Configuration\Flash Player\FlashPlayerW.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-30 05:01 . 2008-09-18 09:01 ——– d—–w- d:\program files\Google
2009-07-30 04:54 . 2008-04-05 03:41 ——– d—–w- d:\documents and settings\Absurd\Application Data\DMCache
2009-07-29 23:22 . 2009-06-15 10:45 28672 —-a-w- d:\documents and settings\Absurd\Application Data\IDM\NP_IDM5.dll
2009-07-29 23:22 . 2009-06-15 10:45 28672 —-a-w- d:\documents and settings\Absurd\Application Data\IDM\NP_IDM4.dll
2009-07-29 23:22 . 2008-05-04 09:02 ——– d—–w- d:\documents and settings\Absurd\Application Data\IDM
2009-07-29 23:22 . 2009-06-15 10:45 28672 —-a-w- d:\documents and settings\Absurd\Application Data\IDM\NP_IDM3.dll
2009-07-29 23:22 . 2009-06-15 10:45 28672 —-a-w- d:\documents and settings\Absurd\Application Data\IDM\NP_IDM2.dll
2009-07-29 23:22 . 2009-06-15 10:45 28672 —-a-w- d:\documents and settings\Absurd\Application Data\IDM\NP_IDM1.dll
2009-07-28 22:34 . 2008-06-20 23:23 208 —-a-w- d:\windows\msocreg32.dat
2009-07-27 14:19 . 2009-06-27 14:31 110592 —-a-w- d:\windows\system32\OpenAL32.dll
2009-07-27 14:19 . 2009-06-27 14:31 ——– d—–w- d:\program files\OpenAL
2009-07-27 14:19 . 2009-01-19 08:31 ——– d—–w- d:\program files\Common Files\Wise Installation Wizard
2009-07-24 21:18 . 2008-04-05 09:18 ——– d—–w- d:\program files\Common Files\Adobe
2009-07-24 16:20 . 2008-10-28 00:25 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\avg8
2009-07-24 12:28 . 2009-07-24 12:28 280 —-a-w- d:\program files\eumr.txt
2009-07-23 21:45 . 2008-06-21 22:09 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\IK Multimedia
2009-07-22 13:02 . 2009-06-21 22:15 118784 —-a-w- d:\windows\dsdxirmv.exe
2009-07-22 12:50 . 2009-06-18 06:12 ——– d—–w- d:\program files\Image-Line
2009-07-21 05:59 . 2008-04-02 18:36 ——– d–h–w- d:\program files\InstallShield Installation Information
2009-07-17 00:52 . 2008-04-09 10:39 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\NVIDIA Corporation
2009-07-16 23:05 . 2008-04-02 18:43 56272 —-a-w- d:\documents and settings\Absurd\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-07-16 17:13 . 2009-06-19 21:43 ——– d—–w- d:\documents and settings\Absurd\Application Data\Auslogics
2009-07-14 17:07 . 2008-04-09 03:32 ——– d—–w- d:\documents and settings\Absurd\Application Data\Digidesign
2009-07-13 17:22 . 2008-04-03 07:33 ——– d—–w- d:\program files\Enigma Software Group
2009-07-11 10:31 . 2009-01-19 08:59 ——– d—–w- d:\documents and settings\Absurd\Application Data\SUPERAntiSpyware.com
2009-07-11 10:31 . 2009-01-19 08:59 ——– d—–w- d:\program files\SUPERAntiSpyware
2009-07-11 10:24 . 2008-04-02 23:20 ——– d—–w- d:\program files\Common Files\Apple
2009-07-11 10:14 . 2008-11-15 04:19 ——– d—–w- d:\program files\Matroska Pack
2009-07-11 10:11 . 2009-06-29 11:30 1942 —-a-w- d:\windows\system32\ealregsnapshot1.reg
2009-07-11 08:14 . 2009-04-11 11:51 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\Autodesk
2009-07-11 08:14 . 2009-04-11 11:51 ——– d—–w- d:\program files\Common Files\Autodesk Shared
2009-07-10 17:04 . 2009-02-22 19:28 ——– d—–w- d:\program files\Java
2009-07-10 11:53 . 2009-07-10 11:53 ——– d—–w- d:\documents and settings\Studio\Application Data\Logitech
2009-07-10 11:53 . 2009-07-10 11:53 88616 —-a-w- d:\documents and settings\Studio\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-07-08 16:12 . 2009-06-19 23:02 ——– d—–w- d:\program files\Yahoo!
2009-07-07 17:26 . 2008-06-08 06:00 ——– d—–w- d:\program files\M-Audio
2009-07-07 03:58 . 2008-04-21 17:04 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\Ubisoft
2009-07-07 03:57 . 2008-08-15 08:49 ——– d—–w- d:\program files\NVIDIA Corporation
2009-07-03 11:52 . 2008-11-17 19:49 ——– d—–w- d:\program files\Windows Media Connect 2
2009-07-01 19:32 . 2008-04-09 10:09 ——– d—a-w- d:\docume~1\ALLUSE~1\APPLIC~1\TEMP
2009-07-01 12:59 . 2009-06-26 23:20 ——– d—–w- d:\program files\EVGA Precision
2009-06-29 11:44 . 2008-04-09 07:39 107888 —-a-w- d:\windows\system32\CmdLineExt.dll
2009-06-29 11:37 . 2009-06-29 11:37 ——– dc-h–w- d:\docume~1\ALLUSE~1\APPLIC~1\{0691F710-1ECA-4B5A-9727-25554F1BFDC6}
2009-06-29 11:31 . 2009-06-29 11:31 ——– d—–w- d:\program files\Electronic Arts
2009-06-27 17:08 . 2008-04-06 06:22 ——– d—–w- d:\documents and settings\Absurd\Application Data\PACE Anti-Piracy
2009-06-27 17:08 . 2008-04-06 06:22 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\PACE Anti-Piracy
2009-06-27 16:32 . 2009-06-27 16:32 ——– d—–w- d:\documents and settings\Absurd\Application Data\KORG
2009-06-27 15:54 . 2009-06-27 15:54 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\KORG
2009-06-27 15:54 . 2009-06-27 15:54 ——– d—–w- d:\program files\Common Files\KORG
2009-06-27 14:32 . 2009-06-27 14:32 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\Codemasters
2009-06-27 14:31 . 2009-06-27 14:31 444952 —-a-w- d:\windows\system32\wrap_oal.dll
2009-06-27 05:22 . 2009-06-27 05:22 0 —ha-w- d:\windows\system32\drivers\Msft_Kernel_xusb21_01001.Wdf
2009-06-27 05:22 . 2009-06-27 05:22 ——– d—–w- d:\program files\Microsoft Xbox 360 Accessories
2009-06-25 07:39 . 2009-06-25 07:39 ——– d—–w- d:\documents and settings\Absurd\Application Data\M-Audio
2009-06-25 00:47 . 2009-06-25 00:47 ——– d—–w- d:\program files\Syncrosoft
2009-06-25 00:40 . 2009-06-19 13:33 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\Cakewalk
2009-06-23 07:30 . 2009-06-23 07:30 ——– d—–w- d:\program files\Common Files\Real
2009-06-23 07:14 . 2009-06-23 07:11 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\ElectricSheep
2009-06-23 05:11 . 2009-06-23 05:11 ——– d—–w- d:\documents and settings\Absurd\Application Data\dBpoweramp
2009-06-22 14:45 . 2009-06-22 14:45 ——– d—–w- d:\program files\Common Files\Voyetra
2009-06-22 14:33 . 2009-06-22 14:33 198064 —-a-w- d:\documents and settings\Absurd\Application Data\IDM\idmmzcc3\components\idmmzcc.dll
2009-06-22 14:32 . 2008-05-04 09:02 ——– d—–w- d:\program files\Internet Download Manager
2009-06-22 01:52 . 2009-06-22 01:52 ——– d—–w- d:\documents and settings\Absurd\Application Data\AccurateRip
2009-06-22 01:52 . 2009-06-22 01:52 13841 —-a-w- d:\windows\system32\SpoonUninstall-dBpoweramp Music Converter.dat
2009-06-22 01:44 . 2009-06-02 14:41 ——– d—–w- d:\documents and settings\Absurd\Application Data\Ableton
2009-06-21 23:24 . 2009-06-21 23:11 ——– d—–w- d:\documents and settings\Absurd\Application Data\Steinberg
2009-06-21 23:15 . 2009-06-21 23:15 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\Steinberg
2009-06-21 22:32 . 2009-06-19 13:33 ——– d—–w- d:\documents and settings\Absurd\Application Data\Cakewalk
2009-06-20 08:34 . 2008-06-23 18:18 ——– d—–w- d:\program files\IK Multimedia
2009-06-19 23:15 . 2009-01-22 07:07 ——– d—–w- d:\program files\SmartFTP Client
2009-06-19 23:03 . 2009-06-19 23:03 ——– d—–w- d:\documents and settings\Absurd\Application Data\Yahoo!
2009-06-19 22:59 . 2009-06-19 22:59 ——– d—–w- d:\documents and settings\Absurd\Application Data\TweakNow RegCleaner
2009-06-19 14:43 . 2009-06-03 05:50 ——– d—–w- d:\program files\Common Files\Native Instruments
2009-06-19 13:55 . 2009-06-19 13:55 ——– d—–w- d:\program files\LUXONIX
2009-06-19 08:25 . 2008-04-03 02:16 ——– d—–w- d:\program files\GIGABYTE
2009-06-19 07:41 . 2008-04-07 15:51 24944 —-a-w- d:\windows\system32\drivers\GVTDrv.sys
2009-06-19 06:52 . 2008-08-02 06:37 ——– d—–w- d:\program files\ZModeler
2009-06-19 06:40 . 2009-06-12 08:20 ——– d—–w- d:\program files\McDSP
2009-06-19 05:47 . 2009-04-10 10:48 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\Alibre Design
2009-06-18 20:20 . 2009-06-18 20:20 ——– d—–w- d:\program files\Belarc
2009-06-18 12:36 . 2009-06-18 12:36 ——– dc-h–w- d:\docume~1\ALLUSE~1\APPLIC~1\{2ED18044-7049-4E7A-A58D-4017348FCDB7}
2009-06-18 12:35 . 2009-06-18 12:35 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\Native Instruments
2009-06-18 12:35 . 2008-08-05 04:52 ——– d—–w- d:\program files\Native Instruments
2009-06-18 12:35 . 2009-06-18 12:35 ——– dc-h–w- d:\docume~1\ALLUSE~1\APPLIC~1\{902029B2-957E-4066-85FA-30DA31731718}
2009-06-17 02:52 . 2009-06-17 02:52 ——– d—–w- d:\program files\Common Files\Software Update Utility
2009-06-17 02:49 . 2009-06-17 02:49 ——– d—–w- d:\docume~1\ALLUSE~1\APPLIC~1\AOL Downloads
2009-06-13 21:31 . 2009-06-13 21:31 ——– d—–w- d:\program files\Sonnox
2009-06-13 11:17 . 2009-06-13 11:17 0 —ha-w- d:\windows\system32\drivers\Msft_Kernel_LUsbFilt_01005.Wdf
2009-06-12 09:56 . 2009-06-12 09:56 ——– d—–w- d:\documents and settings\Absurd\Application Data\FabFilter
2009-06-12 09:52 . 2009-06-12 09:52 ——– d—–w- d:\program files\URS Plugins
2009-06-12 09:39 . 2009-06-12 09:39 27041 —-a-w- d:\windows\unins000.dat
2009-06-12 09:39 . 2009-06-12 09:39 ——– d—–w- d:\program files\Sonalksis
2009-06-12 09:39 . 2009-06-12 09:39 678746 —-a-w- d:\windows\unins000.exe
2009-06-12 09:37 . 2009-06-12 09:37 ——– d—–w- d:\program files\Vintage Amp Room
2009-06-12 09:35 . 2009-06-12 09:35 ——– d—–w- d:\program files\Serato
2009-06-12 09:30 . 2009-06-12 09:28 ——– d—–w- d:\program files\Roger Nichols Digital, Inc
2009-06-12 09:23 . 2009-06-12 09:23 ——– d—–w- d:\program files\Overloud
2009-06-12 09:23 . 2008-06-28 00:27 ——– d—–w- d:\program files\Nomad Factory
2009-06-12 09:14 . 2009-06-12 09:14 ——– d—–w- d:\program files\Common Files\Voce Spin
2009-06-12 09:12 . 2009-06-01 23:28 ——– d—–w- d:\program files\Digidesign
2009-07-22 22:13 . 2008-06-18 20:00 134648 —-a-w- d:\program files\mozilla firefox\components\brwsrcmp.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-07-28_02.48.10 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-12-17 15:28 . 2007-12-17 15:28 81920 d:\windows\system32\WhiteCap.scr
+ 2009-07-29 03:23 . 2008-04-14 09:42 23552 d:\windows\system32\ReinstallBackups\0016\DriverFiles\i386\wdmaud.drv
+ 2009-07-29 03:23 . 2008-04-14 04:15 60032 d:\windows\system32\ReinstallBackups\0016\DriverFiles\i386\USBAUDIO.sys
+ 2009-07-29 03:23 . 2004-07-09 08:27 48512 d:\windows\system32\ReinstallBackups\0016\DriverFiles\i386\stream.sys
+ 2009-07-29 03:23 . 2008-04-14 04:15 60160 d:\windows\system32\ReinstallBackups\0016\DriverFiles\i386\drmk.sys
+ 2007-12-17 15:29 . 2007-12-17 15:29 81920 d:\windows\system32\G-Force.scr
- 2008-01-03 15:57 . 2008-01-03 15:57 81920 d:\windows\system32\G-Force.scr
+ 2009-07-29 19:27 . 2009-07-29 19:27 10134 d:\windows\Installer\{E2AB70DA-0378-43AE-9EB6-A4DB20BF28D3}\_BC56ACABB24A375CBE61BC.exe
+ 2009-07-29 19:27 . 2009-07-29 19:27 10134 d:\windows\Installer\{E2AB70DA-0378-43AE-9EB6-A4DB20BF28D3}\_B1DD03F39F1C672CE40D81.exe
+ 2009-07-29 19:27 . 2009-07-29 19:27 10134 d:\windows\Installer\{E2AB70DA-0378-43AE-9EB6-A4DB20BF28D3}\_A4B497558121FDB524565C.exe
+ 2009-07-29 19:27 . 2009-07-29 19:27 10134 d:\windows\Installer\{E2AB70DA-0378-43AE-9EB6-A4DB20BF28D3}\_6B91CF0E9437F48515E666.exe
+ 2009-07-29 03:23 . 2002-12-12 04:14 4096 d:\windows\system32\ReinstallBackups\0016\DriverFiles\i386\ksuser.dll
+ 2009-07-29 19:27 . 2009-07-29 19:27 9774 d:\windows\Installer\{E2AB70DA-0378-43AE-9EB6-A4DB20BF28D3}\_6FEFF9B68218417F98F549.exe
+ 2009-07-29 19:27 . 2009-07-29 19:27 9774 d:\windows\Installer\{E2AB70DA-0378-43AE-9EB6-A4DB20BF28D3}\_42AB474906BC92CE0D8758.exe
+ 2009-07-29 03:23 . 2008-04-14 04:49 146048 d:\windows\system32\ReinstallBackups\0016\DriverFiles\i386\portcls.sys
+ 2009-07-29 19:27 . 2009-07-29 19:27 168448 d:\windows\Installer\3762901.msi
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "e:\avg\Toolbar\IEToolbar.dll" [2009-06-14 1004800]

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2009-06-14 20:07 1004800 —-a-w- e:\avg\Toolbar\IEToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "e:\avg\Toolbar\IEToolbar.dll" [2009-06-14 1004800]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "e:\avg\Toolbar\IEToolbar.dll" [2009-06-14 1004800]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"M-Audio Taskbar Icon"="d:\windows\System32\M-AudioTaskBarIcon.exe" [2008-05-15 356864]
"AVG8_TRAY"="e:\avg\avgtray.exe" [2009-07-11 1948440]
"NvCplDaemon"="d:\windows\system32\NvCpl.dll" [2009-06-10 13758464]
"NvMediaCenter"="d:\windows\system32\NvMcTray.dll" [2009-06-10 86016]
"MSConfig"="d:\windows\pchealth\helpctr\Binaries\MSCONFIG.EXE" [2008-04-14 169984]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" - d:\windows\KHALMNPR.Exe [2008-12-19 76304]
"nwiz"="nwiz.exe" - d:\windows\system32\nwiz.exe [2009-06-10 1657376]

d:\documents and settings\Absurd\Start Menu\Programs\Startup\
Adobe Gamma.lnk - d:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-7-14 113664]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoChangeAnimation"= 0 (0x0)
"NoStrCmpLogical"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"MemCheckBoxInRunDlg"= 0 (0x0)
"NoStrCmpLogical"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2009-02-19 04:30 72208 —-a-w- d:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
[BU]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-07-11 08:02 11952 —-a-w- d:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=d:\windows\system32\guard32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"Midi1"=ma_cmidn.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0lsdelete\0SsiEfr.e

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\svcWRSSSDK]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKLM\~\startupfolder\D:^Documents and Settings^Absurd^Start Menu^Programs^Startup^ERUNT AutoBackup.lnk]
path=
backup=d:\windows\pss\ERUNT AutoBackup.lnkStartup

[HKLM\~\startupfolder\D:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech SetPoint.lnk]
path=
backup=d:\windows\pss\Logitech SetPoint.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=3 (0x3)
"PnkBstrA"=2 (0x2)
"PLFlash DeviceIoControl Service"=2 (0x2)
"NVSvc"=2 (0x2)
"NMIndexingService"=3 (0x3)
"Nero BackItUp Scheduler 3"=2 (0x2)
"MA_CMIDI_InstallerService"=2 (0x2)
"LexBceS"=2 (0x2)
"LBTServ"=3 (0x3)
"JavaQuickStarterService"=2 (0x2)
"idsvc"=3 (0x3)
"IDriverT"=3 (0x3)
"gupdate1c9cd3721a28848"=2 (0x2)
"FLEXnet Licensing Service"=3 (0x3)
"digiSPTIService"=3 (0x3)
"DigiRefresh"=2 (0x2)
"cmdAgent"=2 (0x2)
"Bonjour Service"=2 (0x2)
"avg8wd"=2 (0x2)
"avg8emc"=2 (0x2)
"Autodata Limited License Service"=2 (0x2)
"Adobe LM Service"=3 (0x3)
"Diskeeper"=2 (0x2)
"svcWRSSSDK"=2 (0x2)
"Lavasoft Ad-Aware Service"=2 (0x2)
"BITS"=3 (0x3)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"d:\\Program Files\\GIGABYTE\\@BIOS\\gwflash.exe"=
"d:\\WINDOWS\\system32\\PnkBstrA.exe"=
"d:\\WINDOWS\\system32\\PnkBstrB.exe"=
"d:\\Program Files\\GIGABYTE\\EasyTune4\\update.exe"=
"d:\\Program Files\\Common Files\\Nero\\Nero Web\\SetupX.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"d:\\Program Files\\SmartFTP Client\\SmartFTP.exe"=
"d:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"d:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"d:\\Program Files\\Internet Download Manager\\IDMan.exe"=
"f:\\Games\\grid\\GRID.exe"=
"f:\\Games\\HAWX\\HAWX.exe"=
"f:\\Games\\Ghost Recon Advanced Warfighter 2\\graw2.exe"=
"f:\\Games\\Ghost Recon Advanced Warfighter 2\\graw2_dedicated.exe"=
"d:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"d:\\Program Files\\AIM6\\aim6.exe"=

R0 DigiFilter;DigiFilter;d:\windows\system32\drivers\DigiFilt.sys [4/4/2008 4:21 AM 16384]
R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);d:\windows\system32\drivers\sfsync03.sys [12/6/2005 11:11 AM 35328]
R0 SSI;SSI;d:\windows\system32\drivers\ssi.sys [7/24/2009 4:57 PM 78336]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;d:\windows\system32\drivers\avgldx86.sys [7/11/2009 4:02 AM 327688]
R1 AvgTdiX;AVG Free8 Network Redirector;d:\windows\system32\drivers\avgtdix.sys [7/11/2009 4:01 AM 108552]
R1 cmdGuard;COMODO Firewall Pro Sandbox Driver;d:\windows\system32\drivers\cmdguard.sys [7/8/2008 9:32 PM 101776]
R1 cmdHlp;COMODO Firewall Pro Helper Driver;d:\windows\system32\drivers\cmdhlp.sys [7/8/2008 9:32 PM 31504]
R3 CLEDX;Team H2O CLEDX service;d:\windows\system32\drivers\cledx.sys [6/24/2009 8:48 PM 33792]
R3 MAUSBFTP;Service for M-Audio Fast Track Pro (WDM);d:\windows\system32\drivers\mausb.sys [7/7/2009 1:27 PM 143624]
S3 Ambfilt;Ambfilt;d:\windows\system32\drivers\Ambfilt.sys –> d:\windows\system32\drivers\Ambfilt.sys [?]
S3 cpuz132;cpuz132;d:\windows\system32\drivers\cpuz132_x32.sys [7/2/2009 11:18 PM 12672]
S3 ETDrv;ETDrv;d:\windows\system32\drivers\ETDrv.sys [6/19/2009 4:28 AM 185280]
S3 GVTDrv;GVTDrv;d:\windows\system32\drivers\GVTDrv.sys [4/7/2008 11:51 AM 24944]
S3 MAUSB;Service for M-Audio Fast Track Pro Driver (WDM);d:\windows\system32\drivers\mausb.sys [7/7/2009 1:27 PM 143624]
S3 SUPERWEBCAM;SuperWebcam, WDM Virtual Video Capture Device;d:\windows\system32\drivers\superwebcam.sys [4/2/2008 4:50 PM 31872]
S3 WMP300Nv1;Linksys Wireless-N PCI Adapter WMP300N Driver;d:\windows\system32\DRIVERS\WMP300Nv1.sys –> d:\windows\system32\DRIVERS\WMP300Nv1.sys [?]
S4 avg8emc;AVG Free8 E-mail Scanner;e:\avg\avgemc.exe [7/11/2009 4:01 AM 906520]
S4 avg8wd;AVG Free8 WatchDog;e:\avg\avgwdsvc.exe [7/11/2009 4:01 AM 298776]
S4 gupdate1c9cd3721a28848;Google Update Service (gupdate1c9cd3721a28848);"d:\program files\Google\Update\GoogleUpdate.exe" /svc –> d:\program files\Google\Update\GoogleUpdate.exe [?]
S4 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;d:\program files\Lavasoft\Ad-Aware\AAWService.exe [1/18/2009 5:34 PM 1029456]
S4 Viewpoint Manager Service;Viewpoint Manager Service;"d:\program files\Viewpoint\Common\ViewpointService.exe" –> d:\program files\Viewpoint\Common\ViewpointService.exe [?]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"d:\windows\system32\rundll32.exe" "d:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
IE: Download All Links with IDM - d:\program files\Internet Download Manager\IEGetAll.htm
IE: Download FLV video content with IDM - d:\program files\Internet Download Manager\IEGetVL.htm
IE: Download with IDM - d:\program files\Internet Download Manager\IEExt.htm
Trusted Zone: stickam.com\www
TCP: {F2D3389C-9E25-4EA2-94FB-5051F48C68FB} = 208.67.222.222,208.67.220.220
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
FF - ProfilePath - d:\docume~1\Absurd\APPLIC~1\Mozilla\Firefox\Profiles\lmgq9aad.default\
FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=tb50fftrie7&query=
FF - prefs.js: browser.search.selectedEngine - AIM Search
FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=tb50fftrab&query=
FF - component: d:\documents and settings\Absurd\Application Data\Mozilla\Firefox\Profiles\lmgq9aad.default\extensions\[removed]\components\idmmzcc.dll
FF - component: e:\avg\Firefox\components\avgssff.dll
FF - component: e:\avg\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils2.dll
FF - component: e:\avg\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll
FF - component: e:\avg\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll
FF - component: e:\avg\Toolbar\Firefox\avg@igeared\components\xpavgtbapi.dll
FF - plugin: d:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: d:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: d:\program files\Mozilla Firefox\plugins\npViewpoint.dll
.

**************************************************************************

driver loading error catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-30 01:01
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-1390067357-1935655697-839522115-1004\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{35D955B2-FCB2-090A-AB86-7620EE7FA4FB}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_USERS\S-1-5-21-1390067357-1935655697-839522115-1004\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:3c,10,da,82,f9,db,48,11,d9,7f,fc,87,ab,11,47,28,5a,3f,7b,4b,1d,45,f1,
41,84,42,6d,4d,3d,24,51,57,25,d2,27,c9,eb,65,bd,32,54,d2,f5,3e,10,ea,57,f8,\
"??"=hex:aa,f8,e9,f9,d4,11,1c,24,45,24,ef,c9,3e,c1,c2,96

[HKEY_USERS\S-1-5-21-1390067357-1935655697-839522115-1004\Software\SecuROM\License information*]
"datasecu"=hex:7f,5a,ee,e1,27,1d,17,9c,36,3c,78,71,ae,d6,9c,1e,4d,33,67,56,28,
70,43,0c,e7,34,59,53,55,98,35,09,42,cb,42,d4,b6,5f,34,0c,d9,f6,28,24,d8,4e,\
"rkeysecu"=hex:a6,7d,d7,1e,77,4c,df,e3,ce,92,66,7b,ba,f5,0f,50
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(720)
d:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
d:\program files\common files\logishrd\bluetooth\LBTServ.dll
d:\windows\system32\WRLogonNTF.dll
d:\windows\System32\BCMLogon.dll
.
Completion time: 2009-07-30 1:05
ComboFix-quarantined-files.txt 2009-07-30 05:04
ComboFix2.txt 2009-07-29 20:57
ComboFix3.txt 2009-07-28 02:52
ComboFix4.txt 2009-07-27 12:54

Pre-Run: 9,894,404,096 bytes free
Post-Run: 9,850,720,256 bytes free

Current=3 Default=3 Failed=1 LastKnownGood=4 Sets=1,2,3,4
494 — E O F — 2009-07-04 07:00


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:41:18 PM, on 7/31/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
D:\windows\System32\smss.exe
D:\windows\system32\winlogon.exe
D:\windows\system32\services.exe
D:\windows\system32\lsass.exe
D:\windows\system32\svchost.exe
D:\windows\System32\svchost.exe
E:\AVG\avgrsx.exe
D:\windows\system32\spoolsv.exe
D:\windows\system32\svchost.exe
D:\WINDOWS\System32\M-AudioTaskBarIcon.exe
E:\AVG\avgtray.exe
D:\windows\explorer.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\Program Files\AIM6\aim6.exe
D:\Program Files\AIM6\aolsoftware.exe
D:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - E:\AVG\Toolbar\IEToolbar.dll
R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: IDMIEHlprObj Class - {0055C089-8582-441B-A0BF-17B458C2A3A8} - D:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - E:\AVG\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - E:\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Google Update Helper - {77D7E795-33C5-4323-974D-A2A49AB75517} - D:\Program Files\Google\Update\1.2.131.11\GoopdateBho.dll (file missing)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - E:\AVG\Toolbar\IEToolbar.dll
O2 - BHO: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - D:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - E:\AVG\Toolbar\IEToolbar.dll
O4 - HKLM\..\Run: [M-Audio Taskbar Icon] D:\WINDOWS\System32\M-AudioTaskBarIcon.exe
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [AVG8_TRAY] E:\AVG\avgtray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [MSConfig] D:\windows\pchealth\helpctr\Binaries\MSCONFIG.EXE /auto
O4 - Startup: Adobe Gamma.lnk = D:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: Download All Links with IDM - D:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - D:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - D:\Program Files\Internet Download Manager\IEExt.htm
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - D:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - D:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe (file missing)
O10 - Broken Internet access because of LSP provider 'd:\program files\bonjour\mdnsnsp.dll' missing
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo…sreqlab_nvd.cab
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownlo…iaSmartScan.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F2D3389C-9E25-4EA2-94FB-5051F48C68FB}: NameServer = 208.67.222.222,208.67.220.220
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - E:\AVG\avgpp.dll
O20 - AppInit_DLLs: D:\WINDOWS\system32\guard32.dll
O20 - Winlogon Notify: !SASWinLogon - D:\windows\
O20 - Winlogon Notify: avgrsstarter - D:\windows\SYSTEM32\avgrsstx.dll
O24 - Desktop Component 0: Aqua Real 2 - AD0FABD2-7EAE-40B8-8F44-6FCFE6C883CD

–
End of file - 5980 bytes
Post #15
It seems to be better. I only see the problem with my AVG software right now. It's still grayed out and it says there is no components installed

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI