[Resolved] Rootkit detected - > audio gone -> internet gone

I had just reformatted my system unit, as I was installing the software, games and updates, an odd error occurred I can't remember it well but it was along the line of Generic Win Host Process error. Then my avast antivirus detected a worm in C:\Windows\system32\x.exe.

After a while the audio drivers are malfunctioning It is as if it is not detected but I checked the device manager but no yellow warnings nor red errors present. I let it be since it might have something to do with the updates. But after a while my internet connection was severed. I tried rebooting but the same pattern persist, Error -> audio gone -> internet cut off. I suspected that the infection came from the other hard drive but I let it rest since it was dawn.

Today I opened my system unit but the errors did not pop up no nothing. I do not know what kind of phenomena happened but the virus might still be in the system waiting or something. just to be on the safe side I posted this along with my HJT, MBAM, and DDS log files. Sincere thanks for reading and helping on a problem

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:03:00 PM, on 1/6/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\COMODO\COMODO Internet Security\cfp.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\PixArt\PAC7302\Monitor.exe
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Opera\opera.exe
C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DAEMON Tools Lite\DTLite.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Pando Networks\Media Booster\PMB.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Adobe\Adobe Bridge CS4\Bridge.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpohmr08.exe
C:\Program Files\HP\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Secunia\PSI\psi.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\HP\Digital Imaging\Bin\hpqSTE08.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\Documents and Settings\Root\Desktop\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files\Adobe\/Adobe Contribute CS4/contributeieplugin.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS4/contributeieplugin.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Program Files\COMODO\COMODO Internet Security\cfp.exe" -h
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [PAC7302_Monitor] C:\WINDOWS\PixArt\PAC7302\Monitor.exe
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [Adobe_ID0ENQBO] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Pando Media Booster] C:\Program Files\Pando Networks\Media Booster\PMB.exe
O4 - HKCU\..\Run: [AdobeBridge] "C:\Program Files\Adobe\Adobe Bridge CS4\Bridge.exe" -stealth
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O4 - Startup: Secunia PSI.lnk = C:\Program Files\Secunia\PSI\psi.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: Append Link Target to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Append to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert Link Target to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MIC273~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1262698680765
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll
O23 - Service: Adobe Version Cue CS4 - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

–
End of file - 11976 bytes




Malwarebytes' Anti-Malware 1.43
Database version: 3499
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

1/6/2010 7:49:31 PM
mbam-log-2010-01-06 (19-49-31).txt

Scan type: Quick Scan
Objects scanned: 139358
Time elapsed: 6 minute(s), 1 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\O5IJKP2Z\x[1] (Worm.AutoRun) -> Quarantined and deleted successfully.





DDS (Ver_09-06-26.01) - NTFSx86
Run by [removed] at 20:53:45.95 on Wed 01/06/2010
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_17
Microsoft Windows XP Professional 5.1.2600.3.1252.63.1033.18.3071.2179 [GMT 8:00]

AV: avast! antivirus 4.8.1368 [VPS 100105-0] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: COMODO Firewall *enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}

============== Running Processes ===============

C:\WINDOWS\system32\savedump.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
C:\WINDOWS\system32\svchost.exe -k netsvcs
C:\WINDOWS\system32\Ati2evxx.exe
svchost.exe
svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\COMODO\COMODO Internet Security\cfp.exe
svchost.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\PixArt\PAC7302\Monitor.exe
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe
C:\Program Files\Opera\opera.exe
C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DAEMON Tools Lite\DTLite.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Pando Networks\Media Booster\PMB.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Adobe\Adobe Bridge CS4\Bridge.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpohmr08.exe
C:\Program Files\HP\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Secunia\PSI\psi.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\HP\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\HP\Digital Imaging\Bin\hpqSTE08.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\wuauclt.exe
X:\Paradox\dds.scr
C:\Program Files\Alwil Software\Avast4\setup\avast.setup

============== Pseudo HJT Report ===============

uInternet Settings,ProxyOverride = *.local
BHO: ContributeBHO Class: {074c1dc5-9320-4a9a-947d-c042949c6216} - c:\program files\adobe\/Adobe Contribute CS4/contributeieplugin.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\micros~2\office12\GRA8E1~1.DLL
BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
BHO: Skype add-on for Internet Explorer: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: SmartSelect Class: {f4971ee7-daa0-4053-9964-665d8ee6a077} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
TB: Contribute Toolbar: {517bdde4-e3a7-4570-b21e-2b52b6139fc7} - c:\program files\adobe\/Adobe Contribute CS4/contributeieplugin.dll
uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe
uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\DTLite.exe" -autorun
uRun: [Messenger (Yahoo!)] "c:\program files\yahoo!\messenger\YahooMessenger.exe" -quiet
uRun: [Skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized
uRun: [Pando Media Booster] c:\program files\pando networks\media booster\PMB.exe
uRun: [AdobeBridge] "c:\program files\adobe\adobe bridge cs4\Bridge.exe" -stealth
mRun: [IMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC
mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName
mRun: [avast!] c:\progra~1\alwils~1\avast4\ashDisp.exe
mRun: [COMODO Internet Security] "c:\program files\comodo\comodo internet security\cfp.exe" -h
mRun: [ATICCC] "c:\program files\ati technologies\ati.ace\CLIStart.exe"
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [SkyTel] SkyTel.EXE
mRun: [Alcmtr] ALCMTR.EXE
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [PAC7302_Monitor] c:\windows\pixart\pac7302\Monitor.exe
mRun: [WinPatrol] c:\program files\billp studios\winpatrol\winpatrol.exe -expressboot
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [AdobeCS4ServiceManager] "c:\program files\common files\adobe\cs4servicemanager\CS4ServiceManager.exe" -launchedbylogin
mRun: [Adobe Acrobat Speed Launcher] "c:\program files\adobe\acrobat 9.0\acrobat\Acrobat_sl.exe"
mRun: []
mRun: [Acrobat Assistant 8.0] "c:\program files\adobe\acrobat 9.0\acrobat\Acrotray.exe"
mRun: [Adobe_ID0ENQBO] c:\progra~1\common~1\adobe\adobev~1\server\bin\VERSIO~2.EXE
mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
StartupFolder: c:\docume~1\root\startm~1\programs\startup\erunta~1.lnk - c:\program files\erunt\AUTOBACK.EXE
StartupFolder: c:\docume~1\root\startm~1\programs\startup\secuni~1.lnk - c:\program files\secunia\psi\psi.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hppsc1~1.lnk - c:\program files\hp\digital imaging\bin\hpohmr08.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpoddt~1.lnk - c:\program files\hp\digital imaging\bin\hpotdd01.exe
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Append Link Target to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mic273~1\office12\REFIEBAR.DLL
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1262698680765
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\progra~1\micros~2\office12\GR99D3~1.DLL
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: AtiExtEvent - Ati2evxx.dll
AppInit_DLLs: c:\windows\system32\guard32.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~2\office12\GRA8E1~1.DLL

================= FIREFOX ===================

FF - ProfilePath -
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox 3.6 beta 5\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

—- FIREFOX POLICIES —-
c:\program files\mozilla firefox 3.6 beta 5\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\mozilla firefox 3.6 beta 5\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\mozilla firefox 3.6 beta 5\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\mozilla firefox 3.6 beta 5\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\mozilla firefox 3.6 beta 5\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\mozilla firefox 3.6 beta 5\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\mozilla firefox 3.6 beta 5\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\mozilla firefox 3.6 beta 5\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\mozilla firefox 3.6 beta 5\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\mozilla firefox 3.6 beta 5\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\mozilla firefox 3.6 beta 5\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\mozilla firefox 3.6 beta 5\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\mozilla firefox 3.6 beta 5\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\mozilla firefox 3.6 beta 5\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\mozilla firefox 3.6 beta 5\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\mozilla firefox 3.6 beta 5\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\mozilla firefox 3.6 beta 5\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\mozilla firefox 3.6 beta 5\greprefs\all.js - pref("layout.css.devPixelsPerPx", "-1");
c:\program files\mozilla firefox 3.6 beta 5\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\mozilla firefox 3.6 beta 5\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\mozilla firefox 3.6 beta 5\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\mozilla firefox 3.6 beta 5\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\mozilla firefox 3.6 beta 5\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\mozilla firefox 3.6 beta 5\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\mozilla firefox 3.6 beta 5\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\mozilla firefox 3.6 beta 5\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\mozilla firefox 3.6 beta 5\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\mozilla firefox 3.6 beta 5\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\mozilla firefox 3.6 beta 5\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\mozilla firefox 3.6 beta 5\greprefs\all.js - pref("geo.enabled", true);
c:\program files\mozilla firefox 3.6 beta 5\greprefs\all.js - pref("html5.enable", false);
c:\program files\mozilla firefox 3.6 beta 5\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox 3.6 beta 5\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\mozilla firefox 3.6 beta 5\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\mozilla firefox 3.6 beta 5\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\mozilla firefox 3.6 beta 5\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\mozilla firefox 3.6 beta 5\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\mozilla firefox 3.6 beta 5\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\mozilla firefox 3.6 beta 5\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox 3.6 beta 5\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox 3.6 beta 5\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\mozilla firefox 3.6 beta 5\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\mozilla firefox 3.6 beta 5\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\mozilla firefox 3.6 beta 5\defaults\pref\firefox.js - pref("browser.urlbar.delay", 50);
c:\program files\mozilla firefox 3.6 beta 5\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\mozilla firefox 3.6 beta 5\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\mozilla firefox 3.6 beta 5\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\mozilla firefox 3.6 beta 5\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\mozilla firefox 3.6 beta 5\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\mozilla firefox 3.6 beta 5\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\mozilla firefox 3.6 beta 5\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\mozilla firefox 3.6 beta 5\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\mozilla firefox 3.6 beta 5\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\mozilla firefox 3.6 beta 5\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\mozilla firefox 3.6 beta 5\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\mozilla firefox 3.6 beta 5\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\mozilla firefox 3.6 beta 5\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\mozilla firefox 3.6 beta 5\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\mozilla firefox 3.6 beta 5\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\mozilla firefox 3.6 beta 5\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\mozilla firefox 3.6 beta 5\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\mozilla firefox 3.6 beta 5\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\mozilla firefox 3.6 beta 5\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\mozilla firefox 3.6 beta 5\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\mozilla firefox 3.6 beta 5\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\mozilla firefox 3.6 beta 5\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\mozilla firefox 3.6 beta 5\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\mozilla firefox 3.6 beta 5\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\mozilla firefox 3.6 beta 5\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\mozilla firefox 3.6 beta 5\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\mozilla firefox 3.6 beta 5\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\mozilla firefox 3.6 beta 5\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\mozilla firefox 3.6 beta 5\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
c:\program files\mozilla firefox 3.6 beta 5\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\mozilla firefox 3.6 beta 5\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\mozilla firefox 3.6 beta 5\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\mozilla firefox 3.6 beta 5\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2010-1-5 114768]
R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdguard.sys [2010-1-5 133064]
R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [2010-1-5 25160]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2010-1-5 20560]
R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast4\ashServ.exe [2010-1-4 138680]
R2 cmdAgent;COMODO Internet Security Helper Service;c:\program files\comodo\comodo internet security\cmdagent.exe [2010-1-5 723632]
R3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast4\ashMaiSv.exe [2010-1-4 254040]
R3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast4\ashWebSv.exe [2010-1-4 352920]
R3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [2009-6-17 12648]
S3 Adobe Version Cue CS4;Adobe Version Cue CS4;c:\program files\common files\adobe\adobe version cue cs4\server\bin\VersionCueCS4.exe [2008-8-15 284016]
S3 PAC7302;P228 USB PC CAMERA;c:\windows\system32\drivers\PAC7302.SYS [2010-1-5 458752]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\e:\ntglm7x.sys –> e:\NTGLM7X.sys [?]

=============== Created Last 30 ================

2010-01-06 19:40 –d—– c:\docume~1\root\applic~1\Malwarebytes
2010-01-06 19:40 38,224 a——- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-06 19:40 –d—– c:\docume~1\alluse~1\applic~1\Malwarebytes
2010-01-06 19:40 19,160 a——- c:\windows\system32\drivers\mbam.sys
2010-01-06 19:40 –d—– c:\program files\Malwarebytes' Anti-Malware
2010-01-06 19:34 –dsh— c:\documents and settings\root\IETldCache
2010-01-06 19:29 12,800 -c—— c:\windows\system32\dllcache\xpshims.dll
2010-01-06 19:28 11,069,952 -c—— c:\windows\system32\dllcache\ieframe.dll
2010-01-06 19:28 1,985,536 -c—— c:\windows\system32\dllcache\iertutil.dll
2010-01-06 19:28 594,432 -c—— c:\windows\system32\dllcache\msfeeds.dll
2010-01-06 19:28 246,272 -c—— c:\windows\system32\dllcache\ieproxy.dll
2010-01-06 19:28 55,296 -c—— c:\windows\system32\dllcache\msfeedsbs.dll
2010-01-06 19:28 –d—– c:\windows\ie8updates
2010-01-06 19:28 92,160 -c—— c:\windows\system32\dllcache\iecompat.dll
2010-01-06 19:27 -cd-h— c:\windows\ie8
2010-01-06 01:03 0 a——- c:\windows\system32\mini.exe
2010-01-06 01:03 83 a——- c:\windows\system32\i
2010-01-06 00:41 –d—– c:\docume~1\alluse~1\applic~1\PMB Files
2010-01-06 00:40 –d—– c:\program files\Pando Networks
2010-01-05 23:48 –d—– c:\docume~1\alluse~1\applic~1\MumboJumbo
2010-01-05 23:44 107,368 a——- c:\windows\system32\GEARAspi.dll
2010-01-05 23:44 26,600 a——- c:\windows\system32\drivers\GEARAspiWDM.sys
2010-01-05 23:36 56 a—h— c:\docume~1\alluse~1\applic~1\ezsidmv.dat
2010-01-05 23:14 726,528 ac—— c:\windows\system32\dllcache\jscript.dll
2010-01-05 22:31 30,617 a——- c:\windows\DIIUnin.dat
2010-01-05 22:31 94,208 a——- c:\windows\DIIUnin.exe
2010-01-05 22:31 2,829 a——- c:\windows\DIIUnin.pif
2010-01-05 22:28 –d—– c:\windows\system32\XPSViewer
2010-01-05 22:27 1,676,288 -c—— c:\windows\system32\dllcache\xpssvcs.dll
2010-01-05 22:27 597,504 -c—— c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2010-01-05 22:27 575,488 -c—— c:\windows\system32\dllcache\xpsshhdr.dll
2010-01-05 22:27 89,088 -c—— c:\windows\system32\dllcache\filterpipelineprintproc.dll
2010-01-05 22:27 1,676,288 ——– c:\windows\system32\xpssvcs.dll
2010-01-05 22:27 575,488 ——– c:\windows\system32\xpsshhdr.dll
2010-01-05 22:27 117,760 ——– c:\windows\system32\prntvpt.dll
2010-01-05 22:25 68,092 a——- c:\windows\War3Unin.dat
2010-01-05 22:25 139,264 a——- c:\windows\War3Unin.exe
2010-01-05 22:25 2,829 a——- c:\windows\War3Unin.pif
2010-01-05 22:22 –d—– C:\GAMES
2010-01-05 22:19 274,288 a——- c:\windows\system32\mucltui.dll
2010-01-05 22:19 16,736 a——- c:\windows\system32\mucltui.dll.mui
2010-01-05 22:10 221,184 a——- c:\windows\system32\wmpns.dll
2010-01-05 22:04 –d—– c:\windows\system32\scripting
2010-01-05 22:03 –d—– c:\windows\l2schemas
2010-01-05 22:03 –d—– c:\windows\system32\en
2010-01-05 22:03 –d—– c:\windows\system32\bits
2010-01-05 22:01 –d—– c:\windows\ServicePackFiles
2010-01-05 21:57 –d—– c:\windows\network diagnostic
2010-01-05 21:42 –d—– c:\program files\Microsoft Math 3.0
2010-01-05 21:39 –d—– c:\program files\Microsoft Expression
2010-01-05 21:37 –ds—- c:\documents and settings\root\UserData
2010-01-05 21:35 162 a——- c:\windows\ODBC.INI
2010-01-05 21:33 32,592 a——- c:\windows\system32\msonpmon.dll
2010-01-05 21:27 –d—– c:\program files\Microsoft Visual Studio 8
2010-01-05 21:27 –d—– c:\windows\SHELLNEW
2010-01-05 21:17 –d—– c:\docume~1\alluse~1\applic~1\ALM
2010-01-05 20:58 45,392 a—-r– c:\windows\system32\AdobePDF.dll
2010-01-05 20:58 22,872 a—-r– c:\windows\system32\AdobePDFUI.dll
2010-01-05 20:51 381,425 -c—— c:\windows\system32\dllcache\copycd.wmv
2010-01-05 20:31 –d—– c:\program files\common files\Macrovision Shared
2010-01-05 20:29 411,368 a——- c:\windows\system32\deploytk.dll
2010-01-05 20:29 73,728 a——- c:\windows\system32\javacpl.cpl
2010-01-05 20:25 a-dshr– C:\autorun.inf
2010-01-05 20:21 –d—– c:\program files\NT Registry Optimizer
2010-01-05 20:20 –d—– c:\program files\Stardock
2010-01-05 20:20 –d—– c:\program files\common files\Stardock
2010-01-05 08:48 –d—– c:\program files\mIRC
2010-01-05 08:48 –d—– c:\docume~1\root\applic~1\mIRC
2010-01-05 08:47 –d–r– c:\program files\Skype
2010-01-05 08:46 –d—– c:\program files\Yahoo!
2010-01-05 08:45 691,696 a——- c:\windows\system32\drivers\sptd.sys
2010-01-05 08:45 –d—– c:\program files\DAEMON Tools Lite
2010-01-05 08:45 –d—– c:\docume~1\root\applic~1\DAEMON Tools Lite
2010-01-05 08:44 –d—– c:\docume~1\alluse~1\applic~1\DAEMON Tools Lite
2010-01-05 08:43 –d—– c:\program files\Mozilla Firefox 3.6 Beta 5
2010-01-05 08:42 –d—– c:\program files\Combined Community Codec Pack
2010-01-05 08:41 –d—– c:\program files\foobar2000
2010-01-05 08:40 272,128 -c—— c:\windows\system32\dllcache\bthport.sys
2010-01-05 08:35 473,600 -c—— c:\windows\system32\dllcache\fastprox.dll
2010-01-05 08:35 453,120 -c—— c:\windows\system32\dllcache\wmiprvsd.dll
2010-01-05 08:35 401,408 -c—— c:\windows\system32\dllcache\rpcss.dll
2010-01-05 08:35 284,160 -c—— c:\windows\system32\dllcache\pdh.dll
2010-01-05 08:35 227,840 -c—— c:\windows\system32\dllcache\wmiprvse.exe
2010-01-05 08:35 110,592 -c—— c:\windows\system32\dllcache\services.exe
2010-01-05 08:35 714,752 -c—— c:\windows\system32\dllcache\ntdll.dll
2010-01-05 08:35 617,472 -c—— c:\windows\system32\dllcache\advapi32.dll
2010-01-05 08:30 153,088 -c—— c:\windows\system32\dllcache\triedit.dll
2010-01-05 08:25 128,512 -c—— c:\windows\system32\dllcache\dhtmled.ocx
2010-01-05 08:24 –d—– c:\program files\iPod
2010-01-05 08:24 –d—– c:\program files\iTunes
2010-01-05 08:24 –d—– c:\docume~1\alluse~1\applic~1\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2010-01-05 08:24 –d—– c:\program files\Bonjour
2010-01-05 08:23 203,136 -c—— c:\windows\system32\dllcache\rmcast.sys
2010-01-05 08:23 455,296 -c—— c:\windows\system32\dllcache\mrxsmb.sys
2010-01-05 08:23 333,952 -c—— c:\windows\system32\dllcache\srv.sys
2010-01-05 08:23 331,776 -c—— c:\windows\system32\dllcache\msadce.dll
2010-01-05 08:23 1,315,328 -c—— c:\windows\system32\dllcache\msoe.dll
2010-01-05 08:23 691,712 -c—— c:\windows\system32\dllcache\inetcomm.dll
2010-01-05 08:23 2,145,280 -c—— c:\windows\system32\dllcache\ntkrnlmp.exe
2010-01-05 08:22 2,023,936 -c—— c:\windows\system32\dllcache\ntkrpamp.exe
2010-01-05 08:22 2,066,048 -c—— c:\windows\system32\dllcache\ntkrnlpa.exe
2010-01-05 08:21 337,408 -c—— c:\windows\system32\dllcache\netapi32.dll
2010-01-05 08:20 –d—– c:\program files\Secunia
2010-01-05 08:20 –d—– c:\docume~1\root\applic~1\WinPatrol
2010-01-05 08:20 –d—– c:\program files\BillP Studios
2010-01-05 07:41 311,359 ac—— c:\windows\system32\dllcache\imepadsv.exe
2010-01-05 07:39 6,272 a——- c:\windows\system32\drivers\splitter.sys
2010-01-05 07:39 142,592 a——- c:\windows\system32\drivers\aec.sys
2010-01-05 07:39 56,576 a——- c:\windows\system32\drivers\swmidi.sys
2010-01-05 07:39 52,864 a——- c:\windows\system32\drivers\dmusic.sys
2010-01-05 07:39 7,552 a——- c:\windows\system32\drivers\mskssrv.sys
2010-01-05 07:39 5,376 a——- c:\windows\system32\drivers\mspclock.sys
2010-01-05 07:39 60,800 a——- c:\windows\system32\drivers\sysaudio.sys
2010-01-05 07:39 172,416 a——- c:\windows\system32\drivers\kmixer.sys
2010-01-05 07:39 83,072 a——- c:\windows\system32\drivers\wdmaud.sys
2010-01-05 07:39 2,944 a——- c:\windows\system32\drivers\drmkaud.sys
2010-01-05 07:39 4,992 a——- c:\windows\system32\drivers\mspqm.sys
2010-01-05 07:38 3,072 a——- c:\windows\system32\drivers\audstub.sys
2010-01-05 07:38 60,032 a——- c:\windows\system32\drivers\usbaudio.sys
2010-01-05 07:38 146,048 a——- c:\windows\system32\drivers\portcls.sys
2010-01-05 07:38 129,536 a——- c:\windows\system32\ksproxy.ax
2010-01-05 07:38 60,160 a——- c:\windows\system32\drivers\drmk.sys
2010-01-05 07:38 4,096 a——- c:\windows\system32\ksuser.dll
2010-01-05 07:38 57,600 a——- c:\windows\system32\drivers\redbook.sys
2010-01-05 07:38 25,856 a——- c:\windows\system32\drivers\usbprint.sys
2010-01-05 07:37 6,400 a——- c:\windows\system32\drivers\enum1394.sys
2010-01-05 07:37 74,240 a——- c:\windows\system32\usbui.dll
2010-01-05 07:36 –d—– c:\program files\common files\ODBC
2010-01-05 07:36 –d—– c:\program files\common files\SpeechEngines
2010-01-05 07:36 –d–r– c:\documents and settings\all users\Documents
2010-01-05 07:35 –d—– C:\Documents and Settings
2010-01-05 07:34 261 a——- c:\windows\system32\$winnt$.inf
2010-01-05 00:43 –d—– c:\program files\common files\PAC7302
2010-01-05 00:43 –d—– c:\program files\ANC
2010-01-05 00:39 –d—– c:\program files\common files\Hewlett-Packard
2010-01-05 00:34 –d—– c:\program files\common files\HP
2010-01-05 00:30 –d—– c:\program files\HP
2010-01-05 00:20 –d—– c:\program files\Realtek
2010-01-05 00:12 –d—– c:\program files\common files\ATI Technologies
2010-01-05 00:07 –d—– c:\program files\ATI Technologies
2010-01-05 00:02 –d—– c:\docume~1\alluse~1\applic~1\Comodo
2010-01-05 00:02 –d—– c:\program files\COMODO
2010-01-04 23:48 –dsh— c:\documents and settings\all users\DRM
2010-01-04 23:48 –d-h— c:\program files\WindowsUpdate
2010-01-04 23:47 –d—– c:\program files\common files\MSSoap
2010-01-04 23:46 –d—– c:\program files\Online Services
2010-01-04 23:46 –d—– c:\program files\Messenger
2010-01-04 23:46 –d—– c:\program files\MSN Gaming Zone
2010-01-04 23:45 –d—– c:\program files\Windows NT

==================== Find3M ====================

2010-01-05 00:41 20,441 a——- c:\windows\hpoins01.dat
2010-01-05 00:36 123,975 a——- c:\windows\HPHins12.dat
2010-01-05 00:20 315,392 a——- c:\windows\HideWin.exe
2010-01-05 00:02 171,552 a——- c:\windows\system32\guard32.dll
2010-01-05 00:02 133,064 a——- c:\windows\system32\drivers\cmdguard.sys
2010-01-05 00:02 25,160 a——- c:\windows\system32\drivers\cmdhlp.sys
2010-01-04 23:48 86,327 a——- c:\windows\pchealth\helpctr\offlinecache\index.dat
2010-01-04 23:46 21,640 a——- c:\windows\system32\emptyregdb.dat
2009-12-15 03:15 2,146,304 a——- c:\windows\system32\GPhotos.scr
2009-11-14 06:57 922,112 ——– c:\windows\system32\imapi2fs.dll
2009-11-14 06:57 426,496 ——– c:\windows\system32\imapi2.dll
2009-10-29 15:45 916,480 a——- c:\windows\system32\wininet.dll
2009-10-13 18:30 270,336 a——- c:\windows\system32\oakley.dll
2009-10-12 21:38 149,504 a——- c:\windows\system32\rastls.dll
2009-10-12 21:38 79,872 a——- c:\windows\system32\raschap.dll

============= FINISH: 20:55:00.23 ===============

As of now there seems to be nothing wrong after all the updates were done but I am a bit worried that it might come back


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:00:58 PM, on 1/10/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\COMODO\COMODO Internet Security\cfp.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\PixArt\PAC7302\Monitor.exe
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
X:\Paradox\[Stash]\Applications\uTorrent\uTorrent.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpohmr08.exe
C:\Program Files\HP\Digital Imaging\bin\hpotdd01.exe
X:\Paradox\[Stash]\Applications\Rainmeter\Rainmeter.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\HP\Digital Imaging\bin\hpoevm08.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\HP\Digital Imaging\Bin\hpoSTS08.exe
C:\Program Files\HP\Digital Imaging\Bin\hpqSTE08.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\GAMES\Granado Espada\release\Xtrap\XTrap.xt
C:\Program Files\Opera\Opera.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Documents and Settings\Root\Desktop\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files\Adobe\/Adobe Contribute CS4/contributeieplugin.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS4/contributeieplugin.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Program Files\COMODO\COMODO Internet Security\cfp.exe" -h
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [PAC7302_Monitor] C:\WINDOWS\PixArt\PAC7302\Monitor.exe
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [Adobe_ID0ENQBO] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [uTorrent] "X:\Paradox\[Stash]\Applications\uTorrent\uTorrent.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Shortcut to Rainmeter.lnk = X:\Paradox\[Stash]\Applications\Rainmeter\Rainmeter.exe
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: Append Link Target to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Append to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert Link Target to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1262698680765
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll
O23 - Service: Adobe Version Cue CS4 - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

–
End of file - 11808 bytes

The computer seems to run as expected. No errors or whatsoever

Here is the Combofix Log

ComboFix 10-01-04.01 - Carbuncle 01/11/2010 18:00:24.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.63.1033.18.3071.2471 [GMT 8:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: avast! antivirus 4.8.1368 [VPS 100109-1] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: COMODO Firewall *enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
—- Previous Run ——-
.
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\documents and settings\Carbuncle\Local Settings\Tempals_inst.exe
c:\documents and settings\Root\Local Settings\Tempals_inst.exe
c:\games\Children of the Nile - Enhanced Edition\Data\Audio\Desktop_.ini
c:\games\Children of the Nile - Enhanced Edition\Data\Audio\Music\Combat\Desktop_.ini
c:\games\Children of the Nile - Enhanced Edition\Data\Audio\Music\Desktop_.ini
c:\games\Children of the Nile - Enhanced Edition\Data\Audio\Music\Dissatisfaction\Desktop_.ini
c:\games\Children of the Nile - Enhanced Edition\Data\Audio\Music\Main Game\Desktop_.ini
c:\games\Children of the Nile - Enhanced Edition\Data\Audio\Sounds\actions\Desktop_.ini
c:\games\Children of the Nile - Enhanced Edition\Data\Audio\Sounds\ambience\Desktop_.ini
c:\games\Children of the Nile - Enhanced Edition\Data\Audio\Sounds\buildings\Desktop_.ini
c:\games\Children of the Nile - Enhanced Edition\Data\Audio\Sounds\Desktop_.ini
c:\games\Children of the Nile - Enhanced Edition\Data\Audio\Sounds\interface\Desktop_.ini
c:\games\Children of the Nile - Enhanced Edition\Data\Audio\Sounds\misc\Desktop_.ini
c:\games\Children of the Nile - Enhanced Edition\Data\Audio\Voice\Desktop_.ini
c:\games\Children of the Nile - Enhanced Edition\Data\Campaigns\Desktop_.ini
c:\games\Children of the Nile - Enhanced Edition\Data\db\Desktop_.ini
c:\games\Children of the Nile - Enhanced Edition\Data\Desktop_.ini
c:\games\Children of the Nile - Enhanced Edition\Data\Graphics\animals\Desktop_.ini
c:\games\Children of the Nile - Enhanced Edition\Data\Graphics\animals\models\Desktop_.ini
c:\games\Children of the Nile - Enhanced Edition\Data\Graphics\animals\textures\Desktop_.ini
c:\games\Children of the Nile - Enhanced Edition\Data\Graphics\buildings\Desktop_.ini
c:\games\Children of the Nile - Enhanced Edition\Data\Graphics\buildings\models\Desktop_.ini
c:\games\Children of the Nile - Enhanced Edition\Data\Graphics\buildings\textures\Desktop_.ini
c:\games\Children of the Nile - Enhanced Edition\Data\Graphics\Desktop_.ini
c:\games\Children of the Nile - Enhanced Edition\Data\Graphics\figures\Desktop_.ini
c:\games\Children of the Nile - Enhanced Edition\Data\Graphics\figures\models\Desktop_.ini
c:\games\Children of the Nile - Enhanced Edition\Data\Graphics\figures\textures\Desktop_.ini
c:\games\Children of the Nile - Enhanced Edition\Data\Graphics\fx\Desktop_.ini
c:\games\Children of the Nile - Enhanced Edition\Data\Graphics\fx\models\Desktop_.ini
c:\games\Children of the Nile - Enhanced Edition\Data\Graphics\fx\textures\Desktop_.ini
c:\games\Children of the Nile - Enhanced Edition\Data\Graphics\interface\backgrounds\Desktop_.ini
c:\games\Children of the Nile - Enhanced Edition\Data\Graphics\interface\buttons\Desktop_.ini
c:\games\Children of the Nile - Enhanced Edition\Data\Graphics\interface\Desktop_.ini
c:\games\Children of the Nile - Enhanced Edition\Data\Graphics\interface\help\Desktop_.ini
c:\games\Children of the Nile - Enhanced Edition\Data\Graphics\interface\icons\Desktop_.ini
c:\games\Children of the Nile - Enhanced Edition\Data\Graphics\interface\pointers\Desktop_.ini
c:\games\Children of the Nile - Enhanced Edition\Data\Graphics\interface\portraits\Desktop_.ini
c:\games\Children of the Nile - Enhanced Edition\Data\Graphics\misc\Desktop_.ini
c:\games\Children of the Nile - Enhanced Edition\Data\Graphics\misc\models\Desktop_.ini
c:\games\Children of the Nile - Enhanced Edition\Data\Graphics\misc\textures\Desktop_.ini
c:\games\Children of the Nile - Enhanced Edition\Data\Graphics\Monuments\Desktop_.ini
c:\games\Children of the Nile - Enhanced Edition\Data\Graphics\Monuments\models\Desktop_.ini
c:\games\Children of the Nile - Enhanced Edition\Data\Graphics\Monuments\textures\Desktop_.ini
c:\games\Children of the Nile - Enhanced Edition\Data\Graphics\resources\Desktop_.ini
c:\games\Children of the Nile - Enhanced Edition\Data\Graphics\resources\models\Desktop_.ini
c:\games\Children of the Nile - Enhanced Edition\Data\Graphics\resources\textures\Desktop_.ini
c:\games\Children of the Nile - Enhanced Edition\Data\Graphics\sfx\Desktop_.ini
c:\games\Children of the Nile - Enhanced Edition\Data\Graphics\sfx\models\Desktop_.ini
c:\games\Children of the Nile - Enhanced Edition\Data\Graphics\sfx\textures\Desktop_.ini
c:\games\Children of the Nile - Enhanced Edition\Data\Graphics\sprites\Desktop_.ini
c:\games\Children of the Nile - Enhanced Edition\Data\Graphics\sprites\models\Desktop_.ini
c:\games\Children of the Nile - Enhanced Edition\Data\Graphics\sprites\textures\Desktop_.ini
c:\games\Children of the Nile - Enhanced Edition\Data\Graphics\terraintextures\Desktop_.ini
c:\games\Children of the Nile - Enhanced Edition\Data\Graphics\world level\Desktop_.ini
c:\games\Children of the Nile - Enhanced Edition\Data\Graphics\world level\map\Desktop_.ini
c:\games\Children of the Nile - Enhanced Edition\Data\Graphics\world level\sprites\Desktop_.ini
c:\games\Children of the Nile - Enhanced Edition\Data\Movies\Desktop_.ini
c:\games\Children of the Nile - Enhanced Edition\Data\Scenarios\Desktop_.ini
c:\games\Children of the Nile - Enhanced Edition\Data\Tutorials\Desktop_.ini
c:\games\Children of the Nile - Enhanced Edition\Data\unit ai scripts\Desktop_.ini
c:\games\Children of the Nile - Enhanced Edition\Desktop_.ini
c:\games\Children of the Nile - Enhanced Edition\Documents\Desktop_.ini
c:\games\Children of the Nile - Enhanced Edition\Fonts\Desktop_.ini
c:\games\Children of the Nile - Enhanced Edition\Miles\Desktop_.ini
c:\games\Children of the Nile - Enhanced Edition\Shaders\Desktop_.ini
c:\games\Children of the Nile - Enhanced Edition\Snapshots\Desktop_.ini
c:\games\Diablo II\Desktop_.ini
c:\games\Diablo II\save\Desktop_.ini
c:\games\Diablo II\support\bnet\Desktop_.ini
c:\games\Diablo II\support\bnet\errors\Desktop_.ini
c:\games\Diablo II\support\Desktop_.ini
c:\windows\system32\i
c:\windows\system32\mini.exe

.
((((((((((((((((((((((((( Files Created from 2009-12-11 to 2010-01-11 )))))))))))))))))))))))))))))))
.

2010-01-10 13:28 . 2008-04-13 18:45 15104 -c–a-w- c:\windows\system32\dllcache\usbscan.sys
2010-01-10 13:28 . 2008-04-13 18:45 15104 —-a-w- c:\windows\system32\drivers\usbscan.sys
2010-01-10 10:02 . 2010-01-10 10:02 56 —ha-w- c:\windows\system32\ezsidmv.dat
2010-01-10 04:15 . 2010-01-10 04:15 ——– d—–w- c:\documents and settings\Carbuncle\Application Data\Media Player Classic
2010-01-07 14:35 . 2010-01-07 14:35 ——– d-sh–w- c:\documents and settings\Carbuncle\PrivacIE
2010-01-07 13:32 . 2010-01-07 13:32 ——– d—–w- c:\documents and settings\Carbuncle\Local Settings\Application Data\Google
2010-01-07 13:30 . 2010-01-07 13:30 ——– d—–w- c:\documents and settings\Carbuncle\Local Settings\Application Data\ATI
2010-01-07 13:30 . 2010-01-07 13:30 ——– d—–w- c:\documents and settings\Carbuncle\Application Data\ATI
2010-01-07 12:58 . 2010-01-07 12:58 ——– d—–w- c:\documents and settings\Carbuncle\C
2010-01-07 09:28 . 2010-01-07 09:28 ——– d-sh–w- c:\documents and settings\Default User\IETldCache
2010-01-07 08:55 . 2010-01-07 08:55 ——– d-sh–w- c:\documents and settings\Margieyl\PrivacIE
2010-01-07 08:54 . 2010-01-07 08:54 ——– d-sh–w- c:\documents and settings\Margieyl\IETldCache
2010-01-06 13:21 . 2010-01-06 13:21 ——– d-sh–w- c:\documents and settings\Carbuncle\IETldCache
2010-01-06 11:40 . 2010-01-06 11:40 ——– d—–w- c:\documents and settings\Root\Application Data\Malwarebytes
2010-01-06 11:40 . 2009-12-30 06:55 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-06 11:40 . 2010-01-06 11:40 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-01-06 11:40 . 2009-12-30 06:54 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-01-06 11:40 . 2010-01-06 11:55 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-01-06 11:38 . 2010-01-06 11:38 ——– d—–w- c:\documents and settings\Root\Local Settings\Application Data\Opera
2010-01-06 11:34 . 2010-01-06 11:34 ——– d-sh–w- c:\documents and settings\Root\IETldCache
2010-01-06 11:29 . 2009-10-29 07:45 12800 -c—-w- c:\windows\system32\dllcache\xpshims.dll
2010-01-06 11:28 . 2009-10-29 07:45 594432 -c—-w- c:\windows\system32\dllcache\msfeeds.dll
2010-01-06 11:28 . 2009-10-29 07:45 55296 -c—-w- c:\windows\system32\dllcache\msfeedsbs.dll
2010-01-06 11:28 . 2009-10-29 07:45 246272 -c—-w- c:\windows\system32\dllcache\ieproxy.dll
2010-01-06 11:28 . 2009-10-29 07:45 1985536 -c—-w- c:\windows\system32\dllcache\iertutil.dll
2010-01-06 11:28 . 2009-10-29 07:45 11069952 -c—-w- c:\windows\system32\dllcache\ieframe.dll
2010-01-06 11:28 . 2010-01-07 09:29 ——– d—–w- c:\windows\ie8updates
2010-01-06 11:28 . 2009-10-02 04:44 92160 -c—-w- c:\windows\system32\dllcache\iecompat.dll
2010-01-06 11:27 . 2010-01-06 11:28 ——– dc-h–w- c:\windows\ie8
2010-01-06 10:35 . 2010-01-06 10:35 ——– d-s—w- c:\documents and settings\Carbuncle\UserData
2010-01-06 10:18 . 2010-01-06 10:18 ——– d—–w- c:\documents and settings\Default User\Local Settings\Application Data\Microsoft Help
2010-01-06 10:13 . 2010-01-07 15:35 ——– d—–w- c:\documents and settings\Carbuncle\Application Data\Rainmeter
2010-01-05 16:48 . 2010-01-05 16:48 ——– d—–w- c:\documents and settings\Margieyl\Application Data\HP
2010-01-05 16:46 . 2010-01-05 16:46 ——– d—–w- c:\documents and settings\Mitzi\Local Settings\Application Data\Apple Computer
2010-01-05 16:44 . 2010-01-06 16:01 ——– d—–w- c:\documents and settings\Carbuncle\Local Settings\Application Data\PMB Files
2010-01-05 16:41 . 2010-01-10 09:51 ——– d—–w- c:\documents and settings\Root\Local Settings\Application Data\PMB Files
2010-01-05 16:41 . 2010-01-06 13:35 ——– d—–w- c:\documents and settings\All Users\Application Data\PMB Files
2010-01-05 16:40 . 2010-01-05 16:40 ——– d—–w- c:\program files\Pando Networks
2010-01-05 15:55 . 2009-12-26 06:42 110592 —-a-w- c:\documents and settings\Carbuncle\Application Data\Mozilla\Firefox\Profiles\e6hqr5bo.default\extensions\{81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}\components\XpcomOpusConnector.dll
2010-01-05 15:49 . 2010-01-05 15:49 ——– d—–w- c:\documents and settings\Carbuncle\Application Data\DAEMON Tools Lite
2010-01-05 15:48 . 2010-01-05 15:48 ——– d—–w- c:\documents and settings\All Users\Application Data\MumboJumbo
2010-01-05 15:47 . 2010-01-05 16:49 ——– d—–w- c:\documents and settings\Carbuncle\.rainlendar2
2010-01-05 15:44 . 2010-01-07 13:56 ——– d—–w- c:\documents and settings\Carbuncle\Application Data\Apple Computer
2010-01-05 15:44 . 2010-01-10 09:48 91848 —-a-w- c:\documents and settings\Carbuncle\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-01-05 15:44 . 2009-05-18 06:17 26600 —-a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2010-01-05 15:44 . 2008-04-17 05:12 107368 —-a-w- c:\windows\system32\GEARAspi.dll
2010-01-05 15:44 . 2010-01-05 15:44 ——– d—–w- c:\documents and settings\Carbuncle\Local Settings\Application Data\Stardock
2010-01-05 15:42 . 2010-01-05 15:42 ——– d—–w- c:\documents and settings\Carbuncle\Local Settings\Application Data\Opera
2010-01-05 15:40 . 2010-01-05 15:40 ——– d—–w- c:\documents and settings\Carbuncle\Local Settings\Application Data\Mozilla
2010-01-05 15:38 . 2010-01-06 15:37 ——– d—–w- c:\documents and settings\Carbuncle\Application Data\uTorrent
2010-01-05 15:36 . 2010-01-05 15:36 ——– d—–w- c:\documents and settings\Carbuncle\Local Settings\Application Data\Yahoo
2010-01-05 15:36 . 2010-01-05 15:36 ——– d—–w- c:\documents and settings\Carbuncle\Application Data\Yahoo!
2010-01-05 15:36 . 2010-01-11 09:55 ——– d—–w- c:\documents and settings\Carbuncle\Application Data\skypePM
2010-01-05 15:35 . 2010-01-11 09:56 ——– d—–w- c:\documents and settings\Carbuncle\Application Data\Skype
2010-01-05 15:35 . 2010-01-05 15:35 ——– d—–w- c:\documents and settings\Carbuncle\Application Data\HP
2010-01-05 15:34 . 2010-01-07 13:56 ——– d—–w- c:\documents and settings\Carbuncle\Local Settings\Application Data\Apple Computer
2010-01-05 15:34 . 2010-01-10 13:34 ——– d—–w- c:\documents and settings\Carbuncle\Local Settings\Application Data\Adobe
2010-01-05 15:14 . 2009-06-22 06:44 726528 -c–a-w- c:\windows\system32\dllcache\jscript.dll
2010-01-05 15:10 . 2010-01-05 15:10 40960 —-a-r- c:\documents and settings\Root\Application Data\Microsoft\Installer\{2510CF9A-3D92-4D1E-9124-080F53F4E293}\NewShortcut1_2510CF9A3D924D1E9124080F53F4E293.exe
2010-01-05 15:10 . 2010-01-05 15:10 40960 —-a-r- c:\documents and settings\Root\Application Data\Microsoft\Installer\{2510CF9A-3D92-4D1E-9124-080F53F4E293}\ARPPRODUCTICON.exe
2010-01-05 14:31 . 2010-01-05 14:36 30617 —-a-w- c:\windows\DIIUnin.dat
2010-01-05 14:31 . 2010-01-05 14:31 94208 —-a-w- c:\windows\DIIUnin.exe
2010-01-05 14:31 . 2010-01-05 14:31 2829 —-a-w- c:\windows\DIIUnin.pif
2010-01-05 14:28 . 2010-01-05 14:28 ——– d—–w- c:\windows\system32\XPSViewer
2010-01-05 14:28 . 2010-01-05 14:28 ——– d—–w- c:\program files\Reference Assemblies
2010-01-05 14:28 . 2008-07-06 12:06 89088 —-a-w- c:\windows\system32\Spool\prtprocs\w32x86\filterpipelineprintproc.dll
2010-01-05 14:27 . 2008-07-06 12:06 89088 -c—-w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2010-01-05 14:27 . 2008-07-06 12:06 575488 -c—-w- c:\windows\system32\dllcache\xpsshhdr.dll
2010-01-05 14:27 . 2008-07-06 12:06 575488 ——w- c:\windows\system32\xpsshhdr.dll
2010-01-05 14:27 . 2008-07-06 12:06 1676288 -c—-w- c:\windows\system32\dllcache\xpssvcs.dll
2010-01-05 14:27 . 2008-07-06 12:06 1676288 ——w- c:\windows\system32\xpssvcs.dll
2010-01-05 14:27 . 2008-07-06 12:06 117760 ——w- c:\windows\system32\prntvpt.dll
2010-01-05 14:27 . 2008-07-06 10:50 597504 -c—-w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2010-01-05 14:27 . 2008-07-06 10:50 597504 ——w- c:\windows\system32\Spool\prtprocs\w32x86\printfilterpipelinesvc.exe
2010-01-05 14:25 . 2010-01-05 14:33 68092 —-a-w- c:\windows\War3Unin.dat
2010-01-05 14:25 . 2010-01-05 14:31 2829 —-a-w- c:\windows\War3Unin.pif
2010-01-05 14:25 . 2010-01-05 14:31 139264 —-a-w- c:\windows\War3Unin.exe
2010-01-05 14:22 . 2010-01-10 09:31 ——– d—–w- C:\GAMES
2010-01-05 14:19 . 2009-08-06 11:23 274288 —-a-w- c:\windows\system32\mucltui.dll
2010-01-05 14:10 . 2008-04-14 00:12 221184 —-a-w- c:\windows\system32\wmpns.dll
2010-01-05 14:04 . 2010-01-05 14:04 ——– d—–w- c:\windows\system32\scripting
2010-01-05 14:03 . 2010-01-05 14:03 ——– d—–w- c:\windows\l2schemas
2010-01-05 14:03 . 2010-01-05 14:03 ——– d—–w- c:\windows\system32\en
2010-01-05 14:03 . 2010-01-05 14:03 ——– d—–w- c:\windows\system32\bits
2010-01-05 14:01 . 2010-01-05 14:05 ——– d—–w- c:\windows\ServicePackFiles
2010-01-05 13:42 . 2010-01-05 13:42 ——– d—–w- c:\program files\Microsoft Math 3.0
2010-01-05 13:39 . 2010-01-05 13:40 ——– d—–w- c:\program files\Microsoft Expression
2010-01-05 13:37 . 2010-01-05 13:37 ——– d-s—w- c:\documents and settings\Root\UserData
2010-01-05 13:33 . 2008-11-10 03:41 32656 —-a-w- c:\windows\system32\msonpmon.dll
2010-01-05 13:33 . 2006-10-26 11:56 33104 —-a-w- c:\windows\system32\Spool\prtprocs\w32x86\msonpppr.dll
2010-01-05 13:31 . 2010-01-08 11:33 ——– d—–w- c:\program files\Microsoft Works
2010-01-05 13:31 . 2010-01-05 14:28 ——– d—–w- c:\program files\MSBuild
2010-01-05 13:29 . 2010-01-05 13:29 ——– d—–w- c:\program files\Microsoft.NET
2010-01-05 13:29 . 2010-01-05 13:29 ——– d—–w- c:\documents and settings\All Users\Application Data\FLEXnet
2010-01-05 13:27 . 2010-01-05 13:27 ——– d—–w- c:\program files\Microsoft Visual Studio 8
2010-01-05 13:27 . 2010-01-05 13:37 ——– d—–w- c:\windows\SHELLNEW
2010-01-05 13:26 . 2010-01-05 13:26 ——– d—–w- c:\documents and settings\Root\Local Settings\Application Data\Microsoft Help
2010-01-05 13:26 . 2010-01-08 11:41 ——– d—–w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-01-05 13:25 . 2010-01-05 13:25 ——– d—–r- C:\MSOCache
2010-01-05 13:17 . 2010-01-05 13:17 ——– d—–w- c:\documents and settings\All Users\Application Data\ALM
2010-01-05 12:58 . 2008-04-06 21:38 22872 —-a-r- c:\windows\system32\AdobePDFUI.dll
2010-01-05 12:58 . 2008-04-06 21:38 45392 —-a-r- c:\windows\system32\AdobePDF.dll
2010-01-05 12:51 . 2004-08-03 14:29 73216 ——w- c:\windows\system32\drivers\atintuxx.sys
2010-01-05 12:41 . 2010-01-05 12:41 ——– d—–w- c:\program files\Adobe Media Player
2010-01-05 12:39 . 2010-01-05 12:39 ——– d—–w- c:\program files\Common Files\Adobe AIR
2010-01-05 12:32 . 2010-01-05 14:12 ——– d—–w- c:\documents and settings\Root\Local Settings\Application Data\Adobe
2010-01-05 12:31 . 2010-01-05 12:31 ——– d—–w- c:\program files\Common Files\Macrovision Shared
2010-01-05 12:29 . 2010-01-05 12:29 411368 —-a-w- c:\windows\system32\deploytk.dll
2010-01-05 12:28 . 2010-01-05 12:28 ——– d—–w- c:\program files\Java
2010-01-05 12:25 . 2010-01-05 14:12 ——– d—–w- c:\program files\Common Files\Adobe
2010-01-05 12:21 . 2010-01-05 12:21 ——– d—–w- c:\program files\ERUNT
2010-01-05 12:21 . 2010-01-05 12:21 ——– d—–w- c:\program files\NT Registry Optimizer
2010-01-05 12:20 . 2010-01-05 12:20 ——– d—–w- c:\program files\Stardock
2010-01-05 12:20 . 2010-01-05 12:20 ——– d—–w- c:\program files\Common Files\Stardock
2010-01-05 12:18 . 2010-01-10 09:51 ——– d—–w- c:\documents and settings\Root\Application Data\Skype
2010-01-05 00:51 . 2010-01-05 00:51 ——– d—–w- c:\documents and settings\Root\Application Data\Media Player Classic
2010-01-05 00:49 . 2010-01-05 00:51 ——– d—–w- c:\program files\Google
2010-01-05 00:48 . 2010-01-05 00:48 ——– d—–w- c:\program files\mIRC
2010-01-05 00:48 . 2010-01-05 00:48 ——– d—–w- c:\documents and settings\Root\Application Data\mIRC
2010-01-05 00:47 . 2010-01-05 00:47 ——– d—–w- c:\program files\Common Files\Skype
2010-01-05 00:47 . 2010-01-05 00:47 ——– d—–r- c:\program files\Skype
2010-01-05 00:47 . 2010-01-05 00:47 ——– d—–w- c:\documents and settings\All Users\Application Data\Skype
2010-01-05 00:47 . 2010-01-05 00:47 ——– d—–w- c:\documents and settings\All Users\Application Data\Yahoo!
2010-01-05 00:47 . 2009-11-10 06:39 607472 —-a-w- c:\documents and settings\All Users\Application Data\Yahoo!\YUpdater\yupdater.exe
2010-01-05 00:46 . 2010-01-05 00:47 ——– d—–w- c:\program files\Yahoo!

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-10 09:51 . 2010-01-04 16:17 91848 —-a-w- c:\documents and settings\Root\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-01-05 16:47 . 2010-01-05 16:47 ——– d—–w- c:\documents and settings\Mitzi\Application Data\HP
2010-01-05 14:44 . 2010-01-04 16:07 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-01-04 16:43 . 2010-01-04 16:43 ——– d—–w- c:\program files\Common Files\PAC7302
2010-01-04 16:43 . 2010-01-04 16:43 ——– d—–w- c:\program files\ANC
2010-01-04 16:41 . 2010-01-04 16:36 ——– d—–w- c:\documents and settings\Root\Application Data\HP
2010-01-04 16:41 . 2010-01-04 16:37 20441 —-a-w- c:\windows\hpoins01.dat
2010-01-04 16:40 . 2010-01-04 16:33 ——– d—–w- c:\program files\Hewlett-Packard
2010-01-04 16:39 . 2010-01-04 16:39 ——– d—–w- c:\program files\Common Files\Hewlett-Packard
2010-01-04 16:38 . 2010-01-04 16:30 ——– d—–w- c:\program files\HP
2010-01-04 16:36 . 2010-01-04 16:27 123975 —-a-w- c:\windows\HPHins12.dat
2010-01-04 16:36 . 2010-01-04 16:36 ——– d—–w- c:\documents and settings\All Users\Application Data\HP
2010-01-04 16:34 . 2010-01-04 16:34 ——– d—–w- c:\program files\Common Files\HP
2010-01-04 16:20 . 2010-01-04 16:20 ——– d—–w- c:\program files\Realtek
2010-01-04 16:20 . 2010-01-04 16:20 315392 —-a-w- c:\windows\HideWin.exe
2010-01-04 16:16 . 2010-01-04 16:16 ——– d—–w- c:\documents and settings\Root\Application Data\ATI
2010-01-04 16:15 . 2010-01-04 16:15 ——– d—–w- c:\program files\DIFX
2010-01-04 16:12 . 2010-01-04 16:07 ——– d—–w- c:\program files\ATI Technologies
2010-01-04 16:12 . 2010-01-04 16:06 ——– d—–w- c:\program files\Common Files\InstallShield
2010-01-04 16:12 . 2010-01-04 16:12 9158 —-a-r- c:\documents and settings\Root\Application Data\Microsoft\Installer\{C941F1F1-25B3-4DF5-83E6-888C51A1AAB6}\ARPPRODUCTICON.exe
2010-01-04 16:12 . 2010-01-04 16:12 ——– d—–w- c:\program files\Common Files\ATI Technologies
2010-01-04 16:05 . 2010-01-04 16:02 ——– d—–w- c:\documents and settings\All Users\Application Data\Comodo
2010-01-04 16:02 . 2010-01-04 16:02 87104 —-a-w- c:\windows\system32\drivers\inspect.sys
2010-01-04 16:02 . 2010-01-04 16:02 25160 —-a-w- c:\windows\system32\drivers\cmdhlp.sys
2010-01-04 16:02 . 2010-01-04 16:02 171552 —-a-w- c:\windows\system32\guard32.dll
2010-01-04 16:02 . 2010-01-04 16:02 133064 —-a-w- c:\windows\system32\drivers\cmdguard.sys
2010-01-04 16:02 . 2010-01-04 16:02 ——– d—–w- c:\program files\COMODO
2010-01-04 15:59 . 2010-01-04 15:59 ——– d—–w- c:\program files\Alwil Software
2010-01-04 15:49 . 2010-01-04 15:49 ——– d—–w- c:\program files\microsoft frontpage
2010-01-04 15:48 . 2010-01-04 15:48 86327 —-a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-01-04 15:46 . 2010-01-04 15:46 21640 —-a-w- c:\windows\system32\emptyregdb.dat
2009-12-14 19:15 . 2009-12-14 19:15 2146304 —-a-w- c:\windows\system32\GPhotos.scr
2009-11-24 23:54 . 2010-01-04 15:59 1280480 —-a-w- c:\windows\system32\aswBoot.exe
2009-11-24 23:51 . 2010-01-04 16:00 93424 —-a-w- c:\windows\system32\drivers\aswmon.sys
2009-11-24 23:50 . 2010-01-04 16:00 94160 —-a-w- c:\windows\system32\drivers\aswmon2.sys
2009-11-24 23:50 . 2010-01-04 16:00 114768 —-a-w- c:\windows\system32\drivers\aswSP.sys
2009-11-24 23:50 . 2010-01-04 16:00 20560 —-a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-11-24 23:49 . 2010-01-04 16:00 48560 —-a-w- c:\windows\system32\drivers\aswTdi.sys
2009-11-24 23:48 . 2010-01-04 16:00 23120 —-a-w- c:\windows\system32\drivers\aswRdr.sys
2009-11-24 23:47 . 2010-01-04 16:00 27408 —-a-w- c:\windows\system32\drivers\aavmker4.sys
2009-11-24 23:47 . 2010-01-04 16:00 97480 —-a-w- c:\windows\system32\AvastSS.scr
2009-11-13 22:57 . 2009-11-13 22:57 922112 ——w- c:\windows\system32\imapi2fs.dll
2009-11-13 22:57 . 2009-11-13 22:57 426496 ——w- c:\windows\system32\imapi2.dll
2009-10-29 07:45 . 2006-02-28 12:00 916480 —-a-w- c:\windows\system32\wininet.dll
2009-10-28 12:58 . 2009-10-28 12:58 79144 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe
2009-10-21 05:38 . 2006-02-28 12:00 75776 —-a-w- c:\windows\system32\strmfilt.dll
2009-10-21 05:38 . 2006-02-28 12:00 25088 —-a-w- c:\windows\system32\httpapi.dll
2009-10-20 16:20 . 2006-02-28 12:00 265728 —-a-w- c:\windows\system32\drivers\http.sys
2009-10-13 10:30 . 2006-02-28 12:00 270336 —-a-w- c:\windows\system32\oakley.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-09-04 417792]
"uTorrent"="x:\paradox\[Stash]\Applications\uTorrent\uTorrent.exe" [2010-01-05 15:39 319792]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-12-08 26694952]
"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-11-10 5244216]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2006-02-28 208952]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2006-02-28 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2006-02-28 455168]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]
"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2010-01-04 1800464]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-09-25 90112]
"RTHDCPL"="RTHDCPL.EXE" [2007-01-30 16116224]
"SkyTel"="SkyTel.EXE" [2006-05-16 2879488]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-18 49152]
"PAC7302_Monitor"="c:\windows\PixArt\PAC7302\Monitor.exe" [2006-11-03 319488]
"WinPatrol"="c:\program files\BillP Studios\WinPatrol\winpatrol.exe" [2009-10-10 320832]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-09-04 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-10-28 141600]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2010-01-05 149280]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-13 611712]
"Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2008-06-11 37232]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2008-06-11 640376]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Root\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
Secunia PSI.lnk - c:\program files\Secunia\PSI\psi.exe [2009-8-21 900816]

c:\documents and settings\Carbuncle\Start Menu\Programs\Startup\
Shortcut to Rainmeter.lnk - x:\paradox\[Stash]\Applications\Rainmeter\Rainmeter.exe [2009-11-1 119296]
Stardock ObjectDock.lnk - c:\program files\Stardock\ObjectDock\ObjectDock.exe [2010-1-5 3444008]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]
hp psc 1000 series.lnk - c:\program files\HP\Digital Imaging\bin\hpohmr08.exe [2003-4-9 147456]
hpoddt01.exe.lnk - c:\program files\HP\Digital Imaging\bin\hpotdd01.exe [2003-4-9 28672]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\guard32.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\Program Files\\Common Files\\Adobe\\Adobe Version Cue CS4\\Server\\bin\\VersionCueCS4.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\GAMES\\Microsoft Games\\Dungeon Siege 2\\DungeonSiege2.exe"=
"c:\\Documents and Settings\\Carbuncle\\My Documents\\uTorrent.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"x:\\Paradox\\[Stash]\\Applications\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4
"3703:TCP"= 3703:TCP:Adobe Version Cue CS4 Server
"3704:TCP"= 3704:TCP:Adobe Version Cue CS4 Server
"51000:TCP"= 51000:TCP:Adobe Version Cue CS4 Server
"51001:TCP"= 51001:TCP:Adobe Version Cue CS4 Server
"56870:TCP"= 56870:TCP:Pando Media Booster
"56870:UDP"= 56870:UDP:Pando Media Booster

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [1/5/2010 12:00 AM 114768]
R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdguard.sys [1/5/2010 12:02 AM 133064]
R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [1/5/2010 12:02 AM 25160]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [1/5/2010 12:00 AM 20560]
S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [1/5/2010 8:45 AM 691696]
S3 Adobe Version Cue CS4;Adobe Version Cue CS4;c:\program files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe [8/15/2008 5:46 AM 284016]
S3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [6/17/2009 8:20 PM 12648]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\e:\ntglm7x.sys –> e:\NTGLM7X.sys [?]
S3 XDva295;XDva295;\??\c:\windows\system32\XDva295.sys –> c:\windows\system32\XDva295.sys [?]
.
Contents of the 'Scheduled Tasks' folder

2010-01-05 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 04:34]

2010-01-04 c:\windows\Tasks\FRU Task 2003-04-10 00:56ewlett-Packard2003-04-10 00:56p psc 1100 series272A572217594EBCF1CEE215E352B92AD073FDE4262623270.job
- c:\program files\HP\Digital Imaging\Bin\hpqfrucl.exe [2003-04-09 09:56]
.
.
——- Supplementary Scan ——-
.
IE: Add to Google Photos Screensa&ver; - c:\windows\system32\GPhotos.scr/200
IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: {{898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
FF - ProfilePath - c:\documents and settings\Carbuncle\Application Data\Mozilla\Firefox\Profiles\e6hqr5bo.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.facebook.com/
FF - component: c:\documents and settings\Carbuncle\Application Data\Mozilla\Firefox\Profiles\e6hqr5bo.default\extensions\{81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}\components\XpcomOpusConnector.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Mozilla Firefox 3.6 Beta 5\plugins\npPandoWebInst.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox 3.6 Beta 5\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox 3.6 Beta 5\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox 3.6 Beta 5\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox 3.6 Beta 5\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox 3.6 Beta 5\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox 3.6 Beta 5\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox 3.6 Beta 5\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox 3.6 Beta 5\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox 3.6 Beta 5\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox 3.6 Beta 5\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox 3.6 Beta 5\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox 3.6 Beta 5\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox 3.6 Beta 5\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox 3.6 Beta 5\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox 3.6 Beta 5\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox 3.6 Beta 5\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox 3.6 Beta 5\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox 3.6 Beta 5\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox 3.6 Beta 5\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox 3.6 Beta 5\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox 3.6 Beta 5\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox 3.6 Beta 5\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox 3.6 Beta 5\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox 3.6 Beta 5\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox 3.6 Beta 5\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox 3.6 Beta 5\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox 3.6 Beta 5\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox 3.6 Beta 5\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox 3.6 Beta 5\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox 3.6 Beta 5\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox 3.6 Beta 5\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - ORPHANS REMOVED - - - -

AddRemove-Children of the Nile: Enhanced Edition - c:\games\Children of the Nile - Enhanced Edition\Uninstall.exe
AddRemove-Sengoku Rance English_is1 - c:\games\?????\Sengoku Rance English\unins000.exe
AddRemove-Utawarerumono English - c:\games\Leaf\???????DVD?\uninstall.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-11 18:05
Windows 5.1.2600 Service Pack 3 NTFS

detected NTDLL code modification:
ZwClose, ZwOpenFile

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(776)
c:\windows\system32\Ati2evxx.dll
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
.
Completion time: 2010-01-11 18:07:38
ComboFix-quarantined-files.txt 2010-01-11 10:07

Pre-Run: 256,014,704,640 bytes free
Post-Run: 255,975,165,952 bytes free

- - End Of File - - A4207FF3D2C35B71D06BDA1A24309096

And here is the HijackThis Log


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:10:02 PM, on 1/11/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Opera\Opera.exe
C:\Documents and Settings\Root\Desktop\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files\Adobe\/Adobe Contribute CS4/contributeieplugin.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS4/contributeieplugin.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Program Files\COMODO\COMODO Internet Security\cfp.exe" -h
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [PAC7302_Monitor] C:\WINDOWS\PixArt\PAC7302\Monitor.exe
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [Adobe_ID0ENQBO] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKCU\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [uTorrent] "X:\Paradox\[Stash]\Applications\uTorrent\uTorrent.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Shortcut to Rainmeter.lnk = X:\Paradox\[Stash]\Applications\Rainmeter\Rainmeter.exe
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O8 - Extra context menu item: Add to Google Photos Screensa&ver; - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: Append Link Target to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Append to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert Link Target to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end; to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1262698680765
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll
O23 - Service: Adobe Version Cue CS4 - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

–
End of file - 10158 bytes