[Closed] 2 weeks of problems

I'm running vista and still having problems after fixing stuff(I have for years but not on vista) Heres the short list:
malware and virus scans would only rin part way - resolved
Hotmail address book stolen and spans sent out - passwords changed, hotmail intact, resolution unknown
in the past week:
random sporadic abrupt shut down of computer in the middle of a running program, no error messages, I reboot into safe, do a proper shut down and everything is fine till the next time. - unresolved
3 days ago favorite game was victim of this abrupt shut down. Upon reboot it no longer ran but gave a stopped running error. The problem window said it wa an appcrash involving memory. A full un/reinstall failed to help - unresolved.

Please help! I've been running this game for years on various computers and 2 years on this one.



Mawarebytes updated
quick scan performed

Log

Malwarebytes' Anti-Malware 1.44
Database version: 3510
Windows 6.0.6001 Service Pack 1
Internet Explorer 7.0.6001.18000

2/17/2010 10:43:12 PM
mbam-log-2010-02-17 (22-43-12).txt

Scan type: Quick Scan
Objects scanned: 100068
Time elapsed: 8 minute(s), 3 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 6
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 2

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1c1b8a44-61fe-411e-8f33-813a4e2e2984} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{1c1b8a44-61fe-411e-8f33-813a4e2e2984} (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)






GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-02-18 12:47:02
Windows 6.0.6001 Service Pack 1
Running: c2yf1o8n.exe; Driver: C:\Users\A_HOLO~1\AppData\Local\Temp\fwtdqfow.sys


—- System - GMER 1.0.15 —-

SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwAlpcConnectPort [0x8BB6E706]
SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwConnectPort [0x8BB6E366]
SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreateFile [0x8BB6B974]
SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreateKey [0x8BB76388]
SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreatePort [0x8BB6EA3E]
SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreateProcess [0x8BB74166]
SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreateProcessEx [0x8BB74380]
SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreateSection [0x8BB77B9E]
SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreateWaitablePort [0x8BB6EACE]
SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwDeleteFile [0x8BB6BE54]
SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwDeleteKey [0x8BB76C84]
SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwDeleteValueKey [0x8BB76A00]
SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwDuplicateObject [0x8BB73F08]
SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwLoadKey [0x8BB76E34]
SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwOpenFile [0x8BB6BCEC]
SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwOpenProcess [0x8BB755C0]
SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwOpenThread [0x8BB753FE]
SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwRenameKey [0x8BB77810]
SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwReplaceKey [0x8BB77246]
SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwRequestWaitReplyPort [0x8BB6DFF0]
SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwRestoreKey [0x8BB77650]
SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwSecureConnectPort [0x8BB6E506]
SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwSetInformationFile [0x8BB6C042]
SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwSetValueKey [0x8BB76706]
SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwTerminateProcess [0x8BB749D0]
SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreateUserProcess [0x8BB7459E]

—- Kernel code sections - GMER 1.0.15 —-

.text ntkrnlpa.exe!KeSetTimerEx + 370 81CC1934 4 Bytes [06, E7, B6, 8B]
.text ntkrnlpa.exe!KeSetTimerEx + 3F4 81CC19B8 4 Bytes [66, E3, B6, 8B]
.text ntkrnlpa.exe!KeSetTimerEx + 40C 81CC19D0 4 Bytes [74, B9, B6, 8B] {JZ 0xffffffffffffffbb; MOV DH, 0x8b}
.text ntkrnlpa.exe!KeSetTimerEx + 41C 81CC19E0 4 Bytes JMP B7638881
.text ntkrnlpa.exe!KeSetTimerEx + 438 81CC19FC 12 Bytes JMP 41668BB6
.text …
.text C:\Windows\system32\DRIVERS\nvlddmkm.sys section is writeable [0x8BE0A320, 0x3DE447, 0xE8000020]

—- Files - GMER 1.0.15 —-

ADS C:\Program Files\Retro64 Games\hawaiian_explorer:_lost_island.exe 66143062 bytes executable
ADS C:\Program Files\Retro64 Games\hawaiian_explorer:_lost_island.exe 0 bytes executable
ADS C:\Program Files\Retro64 Games\hawaiian_explorer:_lost_island.exe 0 bytes executable
ADS C:\Program Files\Retro64 Games\mystery_solitaire:_secret_island.exe 16973102 bytes executable

—- EOF - GMER 1.0.15 —-








DDS (Ver_09-06-26.01) - NTFSx86
Run by [removed] at 13:51:37.58 on Thu 02/18/2010
Internet Explorer: 7.0.6001.18000 BrowserJavaVersion: 1.6.0_11
Microsoft® Windows Vista™ Home Basic 6.0.6001.1.1252.1.1033.18.2046.885 [GMT -5:00]

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
SP: AVG Anti-Virus Free *enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
SP: Spybot - Search and Destroy *disabled* (Outdated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
FW: ZoneAlarm Firewall *enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\rundll32.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\ZoneLabs\vsmon.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
c:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\RtHDVCpl.exe
C:\hp\support\hpsysdrv.exe
C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\ZyXEL\ZyXEL G-202 Wireless Adapter Utility\ZyXEL G-202.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Users\A_Holovacs\Downloads\dds.scr
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.sparkpeople.com/myspark/nutrition.asp
uDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Pavilion&pf=desktop
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Pavilion&pf=desktop
mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Pavilion&pf=desktop
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll
BHO: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - No File
BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - c:\progra~1\common~1\symant~1\ids\IPSBHO.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\micros~3\office12\GRA8E1~1.DLL
BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: MyPoints Toolbar: {a057a204-bacc-4d26-cec4-75a487fd6484} - c:\progra~1\mypoints\mypoints.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
TB: MyPoints Toolbar: {a057a204-bacc-4d26-cec4-75a487fd6484} - c:\progra~1\mypoints\mypoints.dll
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
mRun: [RtHDVCpl] RtHDVCpl.exe
mRun: [hpsysdrv] c:\hp\support\hpsysdrv.exe
mRun: [OsdMaestro] "c:\program files\hewlett-packard\on-screen osd indicator\OSD.exe"
mRun: []
mRun: [ZoneAlarm Client] "c:\program files\zone labs\zonealarm\zlclient.exe"
mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\zyxelg~1.lnk - c:\program files\zyxel\zyxel g-202 wireless adapter utility\ZyXEL G-202.exe
mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} - hxxp://www.ipix.com/download/ipixx.cab
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/F/D/9/FD9E437D-5BC8-4264-A093-DFA2C39D197E/LegitCheckControl.cab
DPF: {1A1F56AA-3401-46F9-B277-D57F3421F821} - hxxp://mypoints.worldwinner.com/games/v47/shared/FunGamesLoader.cab
DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} - hxxp://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} - hxxp://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://download.bitdefender.com/resources/scan8/oscan8.cab
DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6662.cab
DPF: {615F158E-D5CA-422F-A8E7-F6A5EED7063B} - hxxp://www.worldwinner.com/games/v46/bejeweled/bejeweled.cab
DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} - hxxp://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab
DPF: {6C7CAD20-85AA-475A-AC0D-303C4A9A69CE} - hxxp://www.shockwave.com/content/greatchocolatechase/sis/greatchocolatechaseweb.1.0.0.12.cab
DPF: {775879E2-7309-4619-BB02-AADE41F4B690} - hxxp://beta.shockwave.com/content/dreamchronicles/sis/dreamweb.1.0.0.10.cab
DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} - hxxp://www.worldwinner.com/games/shared/wwlaunch.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {97438FE9-D361-4279-BA82-98CC0877A717} - hxxp://www.worldwinner.com/games/v57/cubis/cubis.cab
DPF: {A7EA8AD2-287F-11D3-B120-006008C39542} - hxxp://offers.e-centives.com/cif/download/bin/actxcab.cab
DPF: {AC2881FD-5760-46DB-83AE-20A5C6432A7E} - hxxp://www.worldwinner.com/games/v67/swapit/swapit.cab
DPF: {BA94245D-2AA0-4953-9D9F-B0EE4CC02C43} - hxxp://www.worldwinner.com/games/v42/tilecity/tilecity.cab
DPF: {BAC761D3-DFFD-4DB4-A01D-173346E090A7} - hxxp://www.shockwave.com/content/zenerchi/sis/ZenerchiWeb.1.0.0.10.cab
DPF: {C93C1C34-CEA9-49B1-9046-040F59E0E0D8} - hxxp://www.worldwinner.com/games/v43/paint/paint.cab
DPF: {CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_04-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} - hxxp://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\progra~1\micros~3\office12\GR99D3~1.DLL
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
AppInit_DLLs: avgrsstx.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~3\office12\GRA8E1~1.DLL

================= FIREFOX ===================

FF - ProfilePath - c:\users\a_holo~1\appdata\roaming\mozilla\firefox\profiles\3fjrz0pz.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/webhp?rls=ig
FF - component: c:\program files\avg\avg8\firefox\components\avgssff.dll
FF - plugin: c:\program files\google\update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\photosynth\npPhotosynthMozilla.dll
FF - plugin: c:\program files\unity\webplayer\loader\npUnity3D32.dll
FF - plugin: c:\users\a_holovacs\appdata\local\google\update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\users\a_holovacs\appdata\roaming\move networks\plugins\npqmp071500000347.dll
FF - plugin: c:\users\a_holovacs\appdata\roaming\mozilla\firefox\profiles\3fjrz0pz.default\extensions\{0c7e3f01-99e9-4095-9bdc-f84724960b57}\plugins\NPCpnMgr.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}

============= SERVICES / DRIVERS ===============

R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2008-7-5 28544]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-12-25 335240]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-1-28 108552]
R2 SBSDWSCService;SBSD Security Center Service;c:\program files\spybot - search & destroy\SDWinSec.exe [2008-11-1 809296]
R3 ZY202_XP;ZyXEL 802.11g XG202 1211 Driver;c:\windows\system32\drivers\WlanUZXP.SYS [2009-5-16 437760]
S3 getPlusHelper;getPlus® Helper;c:\windows\system32\svchost.exe -k getPlusHelper [2008-1-20 21504]
S3 rcmirror;rcmirror;c:\windows\system32\drivers\rcmirror.sys [2007-12-14 5120]
S4 avg8emc;AVG8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe [2009-8-17 908056]
S4 avg8wd;AVG8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-8-17 297752]
S4 nvrd32;NVIDIA nForce RAID Driver;c:\windows\system32\drivers\nvrd32.sys [2008-5-5 132128]

============== File Associations ===============

regfile=regedit.exe "%1" %*
scrfile="%1" %*

=============== Created Last 30 ================

2010-02-17 22:33 38,224 a——- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-17 21:57 –d—– c:\program files\CCleaner
2010-02-17 13:18 –d—– c:\program files\Supreme(34)
2010-02-15 19:31 –d—– c:\program files\LoonylandDemo
2010-02-13 18:59 –d—– c:\users\a_holo~1\appdata\roaming\Simply Super Software
2010-02-13 18:59 –d—– c:\programdata\Simply Super Software
2010-02-13 18:59 –d—– c:\program files\Trojan Remover
2010-02-13 18:59 –d—– c:\progra~2\Simply Super Software
2010-02-09 18:52 –d—– c:\users\a_holo~1\appdata\roaming\TheFixerUpper
2010-02-07 15:16 –d—– c:\users\a_holo~1\appdata\roaming\Farm Mania 2
2010-02-03 10:11 –d—– c:\program files\TI Education
2010-02-02 14:58 –d—– c:\users\a_holo~1\appdata\roaming\Awem
2010-01-27 23:36 –d—– c:\users\a_holo~1\appdata\roaming\Hidato
2010-01-27 23:36 –d—– c:\programdata\Hidato
2010-01-27 23:36 –d—– c:\progra~2\Hidato
2010-01-19 14:08 –d—– c:\users\a_holo~1\appdata\roaming\EscapeTheMuseum2

==================== Find3M ====================

2010-02-18 13:51 352,615 a—h— c:\windows\system32\drivers\vsconfig.xml
2010-01-07 16:07 19,160 a——- c:\windows\system32\drivers\mbam.sys
2010-01-05 13:09 352,615 a—h— c:\windows\system32\drivers\vsconfig(221).xml
2009-09-13 10:04 6,390 a——- c:\users\a_holo~1\appdata\roaming\wklnhst.dat
2009-05-16 20:06 143,360 a——- c:\windows\inf\infstrng.dat
2009-05-16 20:06 86,016 a——- c:\windows\inf\infstor.dat
2009-05-16 20:06 51,200 a——- c:\windows\inf\infpub.dat
2008-11-12 18:47 2,788 a——- c:\users\a_holo~1\appdata\roaming\mindhabits.dat
2008-10-22 22:51 30 a——- c:\users\a_holovacs\jagex_runescape_preferences.dat
2008-06-11 11:37 665,600 a——- c:\windows\inf\drvindex.dat
2008-01-20 21:57 174 a–sh— c:\program files\desktop.ini
2006-11-02 07:39 287,440 a——- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 07:39 287,440 a——- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 07:39 30,674 a——- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 07:39 30,674 a——- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 04:20 287,440 a——- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 04:20 287,440 a——- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 04:20 30,674 a——- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 04:20 30,674 a——- c:\windows\inf\perflib\0000\perfc.dat
2005-02-16 10:06 218,112 a——- c:\program files\HijackThis.exe
2009-05-13 19:39 16,384 a–sh— c:\windows\serviceprofiles\localservice\appdata\local\microsoft\windows\history\history.ie5\index.dat
2008-07-28 15:25 32,768 a–sh— c:\windows\serviceprofiles\localservice\appdata\local\microsoft\windows\history\history.ie5\mshist012008072820080729\index.dat
2009-05-13 19:39 32,768 a–sh— c:\windows\serviceprofiles\localservice\appdata\local\microsoft\windows\temporary internet files\content.ie5\index.dat
2009-05-13 19:39 16,384 a–sh— c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\windows\cookies\index.dat
2009-05-13 19:36 245,760 a–sh— c:\windows\system32\config\systemprofile\appdata\roaming\microsoft\windows\ietldcache\index.dat

============= FINISH: 13:53:03.00 ===============

This is a continuation of the help session with catbytes request on 2/23 for a ComboFix log.

I don't know why defender and avg are shown as running. They are both show as disabled in the program and from startup.


ComboFix 10-02-27.04 - A_Holovacs 02/28/2010 10:58:37.2.2 - x86
Microsoft® Windows Vista™ Home Basic 6.0.6001.1.1252.1.1033.18.2046.1328 [GMT -5:00]
Running from: c:\users\[removed]\Downloads\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: ZoneAlarm Firewall *enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
SP: AVG Anti-Virus Free *enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
SP: Spybot - Search and Destroy *disabled* (Outdated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((( Files Created from 2010-01-28 to 2010-02-28 )))))))))))))))))))))))))))))))
.

2010-02-28 16:05 . 2010-02-28 16:05 ——– d—–w- c:\users\A_Holovacs\AppData\Local\temp
2010-02-28 16:05 . 2010-02-28 16:05 ——– d—–w- c:\users\Public\AppData\Local\temp
2010-02-28 16:05 . 2010-02-28 16:05 ——– d—–w- c:\users\Default\AppData\Local\temp
2010-02-23 23:03 . 2010-02-23 23:03 ——– d—–w- c:\users\A_Holovacs\Million
2010-02-23 21:55 . 2010-02-23 22:14 ——– d—–w- c:\programdata\Islands
2010-02-20 00:38 . 2010-02-20 00:38 ——– d—–w- c:\programdata\Kristanix Games
2010-02-18 20:40 . 2010-02-18 20:42 ——– d—–w- c:\program files\Supreme
2010-02-18 04:42 . 2010-02-18 04:42 ——– d—–w- c:\program files\ERUNT
2010-02-18 03:33 . 2010-01-07 21:07 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-18 03:33 . 2010-02-18 03:33 5115823 —-a-w- c:\programdata\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-02-18 02:57 . 2010-02-18 02:57 ——– d—–w- c:\program files\CCleaner
2010-02-16 00:31 . 2010-02-16 00:31 ——– d—–w- c:\program files\LoonylandDemo
2010-02-13 23:59 . 2010-02-13 23:59 ——– d—–w- c:\program files\Trojan Remover
2010-02-13 23:59 . 2010-02-13 23:59 ——– d—–w- c:\users\A_Holovacs\AppData\Roaming\Simply Super Software
2010-02-13 23:59 . 2010-02-13 23:59 ——– d—–w- c:\programdata\Simply Super Software
2010-02-09 23:52 . 2010-02-09 23:52 ——– d—–w- c:\users\A_Holovacs\AppData\Roaming\TheFixerUpper
2010-02-07 20:16 . 2010-02-07 20:16 ——– d—–w- c:\users\A_Holovacs\AppData\Roaming\Farm Mania 2
2010-02-03 15:11 . 2010-02-03 15:11 ——– d—–w- c:\program files\TI Education
2010-02-02 19:58 . 2010-02-02 19:58 ——– d—–w- c:\users\A_Holovacs\AppData\Roaming\Awem

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-28 15:54 . 2008-06-07 20:15 352615 —ha-w- c:\windows\system32\drivers\vsconfig.xml
2010-02-28 15:42 . 2008-05-28 23:32 ——– d—–w- c:\programdata\Spybot - Search & Destroy
2010-02-26 20:43 . 2008-10-02 17:06 ——– d—–w- c:\program files\Shockwave.com
2010-02-23 22:18 . 2009-08-23 17:32 ——– d—–w- c:\users\A_Holovacs\AppData\Roaming\Alawar
2010-02-19 22:25 . 2008-05-14 00:05 ——– d—–w- c:\programdata\JollyBear
2010-02-19 14:54 . 2008-06-29 09:06 62801889 —-a-w- c:\windows\Internet Logs\tvDebug.zip
2010-02-18 19:57 . 2008-09-21 15:27 ——– d—–w- c:\program files\mypoints
2010-02-18 03:33 . 2008-07-05 16:18 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-02-17 19:04 . 2008-05-28 23:32 ——– d—–w- c:\program files\Spybot - Search & Destroy
2010-02-12 04:31 . 2009-04-09 03:15 ——– d—–w- c:\users\A_Holovacs\AppData\Roaming\PoBros
2010-02-12 04:31 . 2009-04-09 03:15 ——– d—–w- c:\programdata\PoBros
2010-02-10 04:18 . 2009-04-05 04:25 ——– d—–w- c:\programdata\Rumbic Studio
2010-02-07 20:35 . 2010-01-19 18:21 ——– d—–w- c:\programdata\AtomShockwave
2010-02-05 03:34 . 2008-06-26 00:29 ——– d—–w- c:\users\A_Holovacs\AppData\Roaming\Boomzap
2010-02-02 18:19 . 2009-08-19 04:27 ——– d—–w- c:\users\A_Holovacs\AppData\Roaming\Merscom
2010-02-02 18:19 . 2009-08-19 04:27 ——– d—–w- c:\programdata\Merscom
2010-01-28 05:08 . 2008-06-05 21:11 ——– d—–w- c:\users\A_Holovacs\AppData\Roaming\Friday's games
2010-01-28 05:07 . 2010-01-28 04:36 ——– d—–w- c:\users\A_Holovacs\AppData\Roaming\Hidato
2010-01-28 04:36 . 2010-01-28 04:36 ——– d—–w- c:\programdata\Hidato
2010-01-23 21:39 . 2008-06-28 23:17 ——– d—–w- c:\users\A_Holovacs\AppData\Roaming\MysteryStudio
2010-01-20 17:25 . 2008-07-20 15:58 ——– d—–w- c:\program files\Google
2010-01-20 14:29 . 2008-09-08 16:46 ——– d—–w- c:\users\A_Holovacs\AppData\Roaming\OpenOffice.org2
2010-01-19 19:08 . 2010-01-19 19:08 ——– d—–w- c:\users\A_Holovacs\AppData\Roaming\EscapeTheMuseum2
2010-01-17 02:58 . 2010-01-03 03:50 ——– d—–w- c:\users\A_Holovacs\AppData\Roaming\SpinTop Games
2010-01-17 01:44 . 2010-01-17 01:42 ——– d—–w- c:\users\A_Holovacs\AppData\Roaming\Virtual City
2010-01-14 19:50 . 2008-05-20 00:45 ——– d—–w- c:\programdata\PlayFirst
2010-01-14 19:50 . 2008-05-18 23:19 ——– d—–w- c:\users\A_Holovacs\AppData\Roaming\PlayFirst
2010-01-08 04:18 . 2009-01-23 03:21 ——– d—–w- c:\users\A_Holovacs\AppData\Roaming\Atomv1001
2010-01-07 21:07 . 2008-07-05 16:18 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-01-05 20:40 . 2010-01-05 20:40 ——– d—–w- c:\users\A_Holovacs\AppData\Roaming\TitanicMystery
2010-01-05 20:40 . 2010-01-05 20:40 ——– d—–w- c:\programdata\1912 Titanic Mystery
2010-01-05 20:30 . 2010-01-05 20:30 ——– d—–w- c:\users\A_Holovacs\AppData\Roaming\GOA
2010-01-05 20:30 . 2010-01-05 20:30 ——– d—–w- c:\programdata\GOA
2010-01-05 18:09 . 2008-06-07 20:15 352615 —ha-w- c:\windows\system32\drivers\vsconfig(221).xml
2010-01-05 02:01 . 2008-09-08 16:50 1 —-a-w- c:\users\A_Holovacs\AppData\Roaming\OpenOffice.org2\user\uno_packages\cache\stamp.sys
2005-02-16 15:06 . 2005-02-16 15:06 218112 —-a-w- c:\program files\HijackThis.exe
.

((((((((((((((((((((((((((((( SnapShot@2010-02-28_15.40.27 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-01-21 01:58 . 2010-02-28 15:56 64804 c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
- 2006-11-02 13:02 . 2010-02-28 14:17 74870 c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2006-11-02 13:02 . 2010-02-28 15:56 74870 c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2008-05-12 19:17 . 2010-02-28 15:56 20766 c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3676337938-138929715-3517626340-1000_UserData.bin
- 2008-05-12 19:17 . 2010-02-28 14:17 20766 c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3676337938-138929715-3517626340-1000_UserData.bin
- 2008-05-12 19:12 . 2010-02-28 14:12 16384 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2008-05-12 19:12 . 2010-02-28 15:54 16384 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2008-05-12 19:12 . 2010-02-28 15:54 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2008-05-12 19:12 . 2010-02-28 14:12 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-05-12 19:12 . 2010-02-28 15:54 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2008-05-12 19:12 . 2010-02-28 14:12 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-02-28 15:54 . 2010-02-28 15:54 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2010-02-28 14:12 . 2010-02-28 14:12 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2010-02-28 15:54 . 2010-02-28 15:54 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2010-02-28 14:12 . 2010-02-28 14:12 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2006-11-02 10:33 . 2010-02-28 16:01 595446 c:\windows\System32\perfh009.dat
- 2006-11-02 10:33 . 2010-02-28 14:17 595446 c:\windows\System32\perfh009.dat
- 2006-11-02 10:33 . 2010-02-28 14:17 101144 c:\windows\System32\perfc009.dat
+ 2006-11-02 10:33 . 2010-02-28 16:01 101144 c:\windows\System32\perfc009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
"Google Update"="c:\users\A_Holovacs\AppData\Local\Google\Update\GoogleUpdate.exe" [2009-05-15 133104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2008-03-26 5369856]
"hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2007-04-18 65536]
"OsdMaestro"="c:\program files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe" [2007-02-15 118784]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-10 136600]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-07 13584928]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-10-07 92704]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
ZyXEL G-202 Wireless Adapter Utility.lnk - c:\program files\ZyXEL\ZyXEL G-202 Wireless Adapter Utility\ZyXEL G-202.exe [2009-5-16 10878976]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Snapfish Media Detector.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Snapfish Media Detector.lnk
backup=c:\windows\pss\Snapfish Media Detector.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^Users^A_Holovacs^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
path=c:\users\A_Holovacs\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnk.Startup
backupExtension=.Startup

[HKLM\~\startupfolder\C:^Users^A_Holovacs^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 2.4.lnk]
path=c:\users\A_Holovacs\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 2.4.lnk
backup=c:\windows\pss\OpenOffice.org 2.4.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-01-12 02:16 39792 —-a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG8_TRAY]
2009-12-14 00:12 2043160 —-a-w- c:\progra~1\AVG\AVG8\avgtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DPService]
2008-01-15 07:58 90112 ——w- c:\program files\HP\DVDPlay\DPService.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2009-05-15 13:40 133104 —-atw- c:\users\A_Holovacs\AppData\Local\Google\Update\GoogleUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2006-10-27 04:47 31016 —-a-w- c:\program files\Microsoft Office\Office12\GrooveMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2007-05-08 20:24 54840 —-a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPAdvisor]
2008-01-19 01:21 942080 —-a-w- c:\program files\Hewlett-Packard\HP Advisor\HPAdvisor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-05-26 21:18 413696 —-a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar]
2008-01-21 02:32 1233920 —-a-w- c:\program files\Windows Sidebar\sidebar.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
2008-07-07 13:42 2156368 –sha-r- c:\program files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2009-02-01 20:23 198160 —-a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
2008-01-21 02:35 202240 —-a-w- c:\program files\Windows Media Player\wmpnscfg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ZoneAlarm Client]
2008-03-03 19:05 959976 —-a-w- c:\program files\Zone Labs\ZoneAlarm\zlclient.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-3676337938-138929715-3517626340-1000]
"EnableNotificationsRef"=dword:00000003

R0 pavboot;pavboot;c:\windows\System32\drivers\pavboot.sys [7/5/2008 12:18 AM 28544]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\System32\drivers\avgldx86.sys [12/25/2008 7:33 AM 335240]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\System32\drivers\avgtdix.sys [1/28/2009 6:13 AM 108552]
R2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [11/1/2008 7:32 PM 809296]
R3 ZY202_XP;ZyXEL 802.11g XG202 1211 Driver;c:\windows\System32\drivers\WlanUZXP.SYS [5/16/2009 8:01 PM 437760]
S3 rcmirror;rcmirror;c:\windows\System32\drivers\rcmirror.sys [12/14/2007 12:48 PM 5120]
S4 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [8/17/2009 6:48 PM 908056]
S4 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [8/17/2009 6:48 PM 297752]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
getPlusHelper REG_MULTI_SZ getPlusHelper
.
Contents of the 'Scheduled Tasks' folder

2010-02-27 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3676337938-138929715-3517626340-1000Core.job
- c:\users\A_Holovacs\AppData\Local\Google\Update\GoogleUpdate.exe [2009-05-15 13:40]

2010-02-28 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3676337938-138929715-3517626340-1000UA.job
- c:\users\A_Holovacs\AppData\Local\Google\Update\GoogleUpdate.exe [2009-05-15 13:40]

2010-02-28 c:\windows\Tasks\User_Feed_Synchronization-{0152E71A-0C13-4C75-8B0E-AE8A699F44DE}.job
- c:\windows\system32\msfeedssync.exe [2008-01-21 02:34]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.sparkpeople.com/myspark/nutrition.asp
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Pavilion&pf=desktop
DPF: {6C7CAD20-85AA-475A-AC0D-303C4A9A69CE} - hxxp://www.shockwave.com/content/greatchocolatechase/sis/greatchocolatechaseweb.1.0.0.12.cab
DPF: {775879E2-7309-4619-BB02-AADE41F4B690} - hxxp://beta.shockwave.com/content/dreamchronicles/sis/dreamweb.1.0.0.10.cab
DPF: {A7EA8AD2-287F-11D3-B120-006008C39542} - hxxp://offers.e-centives.com/cif/download/bin/actxcab.cab
FF - ProfilePath - c:\users\A_Holovacs\AppData\Roaming\Mozilla\Firefox\Profiles\3fjrz0pz.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/webhp?rls=ig
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Photosynth\npPhotosynthMozilla.dll
FF - plugin: c:\program files\Unity\WebPlayer\loader\npUnity3D32.dll
FF - plugin: c:\users\A_Holovacs\AppData\Local\Google\Update\1.2.183.17\npGoogleOneClick8.dll
FF - plugin: c:\users\A_Holovacs\AppData\Roaming\Move Networks\plugins\npqmp071500000347.dll
FF - plugin: c:\users\A_Holovacs\AppData\Roaming\Mozilla\Firefox\Profiles\3fjrz0pz.default\extensions\{0C7E3F01-99E9-4095-9BDC-F84724960B57}\plugins\NPCpnMgr.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-28 11:05
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2010-02-28 11:07:14
ComboFix-quarantined-files.txt 2010-02-28 16:07
ComboFix2.txt 2010-02-28 15:42

Pre-Run: 217,940,078,592 bytes free
Post-Run: 217,895,772,160 bytes free

- - End Of File - - CEA227A3BBC7AF1BC43D997BDA0674EC