[Resolved] Not Sure what is going on with my computer

Hi,

Been a while since I was last here. You guys fixed my problem with malware a few years ago, and now I have another problem but not sure what it is.

The other day I came to my computer after a few hours and there were no programs in my start menu or all programs. I restarted it and they came back, but now when the computer is left for over an hour without use I lose programs off my desktop and in the start menu. I also get random error messages about memory and stuff.

I have ran a malwarebytes scan and it found nothing, also I have Avira installed and run a scan daily and it finds nothing. I am very hesitant to do anything on here in case I have a trojan or something lurking somewhere.

Can anyone give me any idea as to what could be my problem.

Please help……..

Hijack this log follows.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:01:00 PM, on 24/02/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Avira\AntiVir Desktop\avmailc.exe
C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\LeapFrog\LeapFrog Connect\CommandService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Motorola\MotoConnectService\MotoConnectService.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Motorola\MotoConnectService\MotoConnect.exe
C:\WINDOWS\vVX1000.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\LeapFrog\LeapFrog Connect\Monitor.exe
C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe
C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe
C:\Program Files\Hiro-Media\HiroClient\HiroClient.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Program Files\Common Files\Nokia\NoA\nokiaaserver.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O1 - Hosts: 66.98.136.25 auto.search.msn.com
O1 - Hosts: 66.98.136.25 auto.search.msn.es
O1 - Hosts: 66.98.136.25 pagead2.googlesyndication.com
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [VX1000] C:\WINDOWS\vVX1000.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Monitor] "C:\Program Files\LeapFrog\LeapFrog Connect\Monitor.exe"
O4 - HKLM\..\Run: [NokiaMServer] C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles startup
O4 - HKLM\..\Run: [NokiaMusic FastStart] "C:\Program Files\Nokia\Ovi Player\NokiaOviPlayer.exe" /command:faststart
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\CCleaner.exe" /AUTO
O4 - HKCU\..\Run: [NokiaOviSuite2] C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe -tray
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Hiro-Media Client.lnk = C:\Program Files\Hiro-Media\HiroClient\HiroClient.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: Add to AMV Converter… - C:\Program Files\MP3 Player Utilities 4.18\AMVConverter\grab.html
O8 - Extra context menu item: Append Link Target to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://dsl.optusnet.com.au/
O15 - Trusted Zone: http://*.MUZNIKTIF
O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/dow…llerControl.cab
O16 - DPF: {0BE35204-8F91-11CE-9DE3-00AA004BB851} (CLSID_StdPict) - http://wwwau.kodak.com/AU/en/consumer/prin…e/OPW_25900.cab
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1…toUploader5.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {25365FF3-2746-4230-9DA7-163CCA318309} (Automatic Driver Installation Control) - http://inst.c-wss.com/vwhpro/EN/install/gtdownlr.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} - http://www4.snapfish.com.au/SnapfishActivia.cab
O16 - DPF: {459E93B6-150E-45D5-8D4B-45C66FC035FE} - http://apps.corel.com/nos_dl_manager_dev/p…IEGetPlugin.ocx
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/vers…vex-2.2.4.1.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1134597093746
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab
O16 - DPF: {7A0D1738-10EA-47FF-92BE-4E137B5BE1A4} (Stm Class) - https://mpsnare.iesnare.com/StmOCX.cab
O16 - DPF: {8C244272-1DC1-4CE7-9C6C-FABCA09EB543} (Siebel Desktop Integration) - https://flex.afgonline.com.au/fins_enu/2042…Integration.cab
O16 - DPF: {B2B2C3F9-CFB2-49CC-942D-103E68E09B74} (Siebel Email Support for Microsoft Outlook and Lotus Notes) - https://flex.afgonline.com.au/fins_enu/2042…tBound_mail.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {BB383206-6DA1-4E80-B62A-3DF950FCC697} (Create & Print ActiveX Plug-in) - http://www.imgag.com/cp/install/AxCtp2.cab
O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/4h/pla…0/Installer.exe
O16 - DPF: {CD9C0F1B-D8F9-4229-B76C-5EF6B14372E4} (Siebel High Interactivity Framework) - https://flex.afgonline.com.au/fins_enu/2042…x_HI_Client.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/5m/vir…l/installer.exe
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} - http://driveragent.com/files/driveragent.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: hiro - {50BA1131-168F-4C08-A69B-4012273F222E} - C:\Program Files\Hiro-Media\HiroClient\OldHiroProtocolHandler.dll
O18 - Protocol: hirodownload - {77F2FF4C-CEDD-4C71-8ABF-DF7CC05EFC63} - C:\Program Files\Hiro-Media\HiroClient\HiroProtocolHandler.dll
O23 - Service: Avira Firewall (AntiVirFirewallService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avfwsvc.exe
O23 - Service: Avira AntiVir MailGuard (AntiVirMailService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avmailc.exe
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Avira Upgrade Service (AntiVirUpgradeService) - Unknown owner - C:\DOCUME~1\Nikki\LOCALS~1\Temp\AVSETUP_4a13c9ff\basic\avupgsvc.exe (file missing)
O23 - Service: Avira AntiVir WebGuard (AntiVirWebService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe
O23 - Service: LeapFrog Connect Device Service - LeapFrog Enterprises, Inc. - C:\Program Files\LeapFrog\LeapFrog Connect\CommandService.exe
O23 - Service: MotoConnect Service - Unknown owner - C:\Program Files\Motorola\MotoConnectService\MotoConnectService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PostgreSQL Database Server 8.3 (pgsql-8.3) - PostgreSQL Global Development Group - C:\Program Files\PostgreSQL\8.3\bin\pg_ctl.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: TwonkyMedia - PacketVideo - C:\Program Files\Nokia\Nokia Home Media Server\Media Server\TwonkyMedia.exe

–
End of file - 15039 bytes

Hi Thanks for your reply.

Here are the logs as requested.


DDS (Ver_09-12-01.01) - NTFSx86
Run by [removed] at 11:53:04.98 on Thu 25/02/2010
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_18
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1023.300 [GMT 10:00]

AV: AntiVir Desktop *On-access scanning enabled* (Updated) {11638345-E4FC-4BEE-BB73-EC754659C5F6}
FW: Avira Firewall *enabled* {11638345-E4FC-4BEE-BB73-EC754659C5F6}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
svchost.exe
C:\Program Files\Avira\AntiVir Desktop\avmailc.exe
C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\LeapFrog\LeapFrog Connect\CommandService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Motorola\MotoConnectService\MotoConnectService.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Motorola\MotoConnectService\MotoConnect.exe
C:\WINDOWS\vVX1000.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\LeapFrog\LeapFrog Connect\Monitor.exe
C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe
C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe
C:\Program Files\Hiro-Media\HiroClient\HiroClient.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\Common Files\Nokia\NoA\nokiaaserver.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Nikki\My Documents\Downloads\dds.com

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com.au/
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Easy-WebPrint: {327c2873-e90d-4c37-aa9d-10ac9baba46c} - c:\program files\canon\easy-webprint\Toolband.dll
TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -
TB: {BC4FFE41-DE9F-46FA-B455-AAD49B9F9938} - No File
TB: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [NBJ] "c:\program files\ahead\nero backitup\NBJ.exe"
uRun: [ccleaner] "c:\program files\ccleaner\CCleaner.exe" /AUTO
uRun: [AdobeBridge]
uRun: []
uRun: [NokiaOviSuite2] c:\program files\nokia\nokia ovi suite\NokiaOviSuite.exe -tray
uRun: [PC Suite Tray] "c:\program files\nokia\nokia pc suite 7\PCSuite.exe" -onlytray
mRun: [nwiz] nwiz.exe /install
mRun: [UpdReg] c:\windows\UpdReg.EXE
mRun: [LifeCam] "c:\program files\microsoft lifecam\LifeExp.exe"
mRun: [VX1000] c:\windows\vVX1000.exe
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [Easy-PrintToolBox] c:\program files\canon\easy-printtoolbox\BJPSMAIN.EXE /logon
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [Adobe Photo Downloader] "c:\program files\adobe\photoshop album starter edition\3.0\apps\apdproxy.exe"
mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
mRun: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
mRun: [Monitor] "c:\program files\leapfrog\leapfrog connect\Monitor.exe"
mRun: [NokiaMServer] c:\program files\common files\nokia\mplatform\NokiaMServer /watchfiles startup
mRun: [NokiaMusic FastStart] "c:\program files\nokia\ovi player\NokiaOviPlayer.exe" /command:faststart
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hiro-m~1.lnk - c:\program files\hiro-media\hiroclient\HiroClient.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\logite~2.lnk - c:\program files\logitech\desktop messenger\8876480\program\LogitechDesktopMessenger.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\logite~1.lnk - c:\program files\logitech\setpoint\SetPoint.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\winzip~1.lnk - c:\program files\winzip\WZQKPICK.EXE
IE: Add to AMV Converter… - c:\program files\mp3 player utilities 4.18\amvconverter\grab.html
IE: Append Link Target to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - c:\program files\pokerstars\PokerStarsUpdate.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
LSP: c:\program files\avira\antivir desktop\avsda.dll
Trusted Zone: afgonline.com.au
Trusted Zone: afgonline.com.au\flex
Trusted Zone: MUZNIKTIF
DPF: CabBuilder - hxxp://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
DPF: {0BE35204-8F91-11CE-9DE3-00AA004BB851} - hxxp://wwwau.kodak.com/AU/en/consumer/printOnline/OPW_25900.cab
DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} - hxxp://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {25365FF3-2746-4230-9DA7-163CCA318309} - hxxp://inst.c-wss.com/vwhpro/EN/install/gtdownlr.cab
DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\yinsthelper.dll
DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} - hxxp://www.cult3d.com/download/cult.cab
DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} - hxxp://www4.snapfish.com.au/SnapfishActivia.cab
DPF: {459E93B6-150E-45D5-8D4B-45C66FC035FE} - hxxp://apps.corel.com/nos_dl_manager_dev/plugin/IEGetPlugin.ocx
DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} - hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.4.1.cab
DPF: {48DD0448-9209-4F81-9F6D-D83562940134} - hxxp://lads.myspace.com/upload/MySpaceUploader1006.cab
DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1134597093746
DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} - hxxp://www.nick.com/common/groove/gx/GrooveAX27.cab
DPF: {7A0D1738-10EA-47FF-92BE-4E137B5BE1A4} - hxxps://mpsnare.iesnare.com/StmOCX.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {8C244272-1DC1-4CE7-9C6C-FABCA09EB543} - hxxps://flex.afgonline.com.au/fins_enu/20420/applets/SiebelAx_Desktop_Integration.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {B2B2C3F9-CFB2-49CC-942D-103E68E09B74} - hxxps://flex.afgonline.com.au/fins_enu/20420/applets/SiebelAx_OutBound_mail.cab
DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} - hxxp://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
DPF: {BB383206-6DA1-4E80-B62A-3DF950FCC697} - hxxp://www.imgag.com/cp/install/AxCtp2.cab
DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} - hxxp://a532.g.akamai.net/f/532/6712/4h/player.virtools.com/downloads/player/Install3.0/Installer.exe
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {CD9C0F1B-D8F9-4229-B76C-5EF6B14372E4} - hxxps://flex.afgonline.com.au/fins_enu/20420/applets/SiebelAx_HI_Client.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} - hxxp://a532.g.akamai.net/f/532/6712/5m/virtools.download.akamai.com/6712/player/install/installer.exe
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} - hxxp://driveragent.com/files/driveragent.cab
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\logitech\desktop messenger\8876480\program\GAPlugProtocol-8876480.dll
Handler: hiro - {50BA1131-168F-4c08-A69B-4012273F222E} - c:\program files\hiro-media\hiroclient\OldHiroProtocolHandler.dll
Handler: hirodownload - {77F2FF4C-CEDD-4c71-8ABF-DF7CC05EFC63} - c:\program files\hiro-media\hiroclient\HiroProtocolHandler.dll
Notify: LBTWlgn - c:\program files\common files\logitech\bluetooth\LBTWlgn.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
Hosts: 66.98.136.25 auto.search.msn.com
Hosts: 66.98.136.25 auto.search.msn.es
Hosts: 66.98.136.25 pagead2.googlesyndication.com
================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\nikki\applic~1\mozilla\firefox\profiles\t87f21mq.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - component: c:\documents and settings\nikki\application data\mozilla\firefox\profiles\t87f21mq.default\extensions\{13e0b548-6fc9-47e9-9874-470915f46548}\components\FFExternalAlert.dll
FF - component: c:\documents and settings\nikki\application data\mozilla\firefox\profiles\t87f21mq.default\extensions\{13e0b548-6fc9-47e9-9874-470915f46548}\components\RadioWMPCore.dll
FF - component: c:\program files\nokia\nokia ovi suite\connectors\bookmarks connector\firefoxextension\components\FirefoxExtension.dll
FF - component: c:\program files\nokia\nokia pc suite 7\bkmrksync\components\BkMrkExt.dll
FF - plugin: c:\program files\common-use signing interface\bin\npCsiPlugin.dll
FF - plugin: c:\program files\microsoft\office live\npOLW.dll
FF - plugin: c:\program files\mozilla firefox\plugins\nppopcaploader.dll
FF - plugin: c:\program files\virtools\3d life player\npvirtools.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}

—- FIREFOX POLICIES —-
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

============= SERVICES / DRIVERS ===============

R1 avfwot;avfwot;c:\windows\system32\drivers\avfwot.sys [2010-2-7 97608]
R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2010-2-7 11608]
R2 AntiVirFirewallService;Avira Firewall;c:\program files\avira\antivir desktop\avfwsvc.exe [2010-2-7 388865]
R2 AntiVirMailService;Avira AntiVir MailGuard;c:\program files\avira\antivir desktop\avmailc.exe [2010-2-7 194817]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2010-2-7 108289]
R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2010-2-7 185089]
R2 AntiVirWebService;Avira AntiVir WebGuard;c:\program files\avira\antivir desktop\avwebgrd.exe [2010-2-7 434945]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2009-5-20 56816]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [2009-4-3 54752]
R2 MotoConnect Service;MotoConnect Service;c:\program files\motorola\motoconnectservice\MotoConnectService.exe [2010-1-15 91392]
R3 avfwim;AvFw Packet Filter Miniport;c:\windows\system32\drivers\avfwim.sys [2010-2-7 69632]
S2 AntiVirUpgradeService;Avira Upgrade Service;"c:\docume~1\nikki\locals~1\temp\avsetup_4a13c9ff\basic\avupgsvc.exe" /tempstart:""c:\docume~1\nikki\locals~1\temp\avsetup_4a13c9ff\basic\setup.exe" /notempcleanup /crossupgrade" –> c:\docume~1\nikki\locals~1\temp\avsetup_4a13c9ff\basic\avupgsvc.exe [?]
S2 pgsql-8.3;PostgreSQL Database Server 8.3;c:\program files\postgresql\8.3\bin\pg_ctl.exe [2008-9-19 65536]
S2 TwonkyMedia;TwonkyMedia;c:\program files\nokia\nokia home media server\media server\twonkymedia.exe -serviceversion 0 –> c:\program files\nokia\nokia home media server\media server\TwonkyMedia.exe -serviceversion 0 [?]
S3 ADM8511;ADMtek ADM8511/AN986 USB To Fast Ethernet Converter;c:\windows\system32\drivers\ADM8511.SYS [2005-8-31 20160]
S3 fsssvc;Windows Live Family Safety Service;c:\program files\windows live\family safety\fsssvc.exe [2009-8-5 704864]
S3 Revoflt;Revoflt;c:\windows\system32\drivers\revoflt.sys [2010-2-7 27064]
S3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;c:\windows\system32\drivers\wg111v2.sys [2008-4-8 272128]

=============== Created Last 30 ================

2010-02-07 10:19:10 0 d—–w- c:\docume~1\nikki\applic~1\Avira
2010-02-07 09:56:42 97608 —-a-w- c:\windows\system32\drivers\avfwot.sys
2010-02-07 09:56:42 69632 —-a-w- c:\windows\system32\drivers\avfwim.sys
2010-02-07 09:56:28 0 d—–w- c:\program files\Avira
2010-02-07 09:56:28 0 d—–w- c:\docume~1\alluse~1\applic~1\Avira
2010-02-07 08:43:33 27064 —-a-w- c:\windows\system32\drivers\revoflt.sys
2010-02-07 08:35:42 0 d—–w- c:\windows\system32\wbem\Repository

==================== Find3M ====================

2010-02-07 09:52:56 56816 —-a-w- c:\windows\system32\drivers\avgntflt.sys
2010-01-16 00:53:07 0 —ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
2010-01-15 10:43:00 0 —ha-w- c:\windows\system32\drivers\Msft_User_PCCSWpdDriver_01_07_00.Wdf
2010-01-15 10:42:52 0 —ha-w- c:\windows\system32\drivers\MsftWdf_user_01_07_00.Wdf
2010-01-15 06:10:56 0 —ha-w- c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01007.Wdf
2010-01-07 06:07:14 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 06:07:04 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-12-31 16:50:03 353792 —-a-w- c:\windows\system32\drivers\srv.sys
2009-12-21 19:14:05 916480 —-a-w- c:\windows\system32\wininet.dll
2009-12-17 07:14:00 411368 —-a-w- c:\windows\system32\deploytk.dll
2009-12-16 18:43:27 343040 —-a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:08:23 33280 —-a-w- c:\windows\system32\csrsrv.dll
2009-12-08 19:27:51 2189184 —-a-w- c:\windows\system32\ntoskrnl.exe
2009-12-08 18:43:50 2066048 —-a-w- c:\windows\system32\ntkrnlpa.exe
2009-11-27 17:11:44 17920 —-a-w- c:\windows\system32\msyuv.dll
2009-11-27 17:11:44 1291776 —-a-w- c:\windows\system32\quartz.dll
2009-11-27 16:07:35 8704 —-a-w- c:\windows\system32\tsbyuv.dll
2009-11-27 16:07:35 28672 —-a-w- c:\windows\system32\msvidc32.dll
2009-11-27 16:07:34 84992 —-a-w- c:\windows\system32\avifil32.dll
2009-11-27 16:07:34 48128 —-a-w- c:\windows\system32\iyuv_32.dll
2009-11-27 16:07:34 11264 —-a-w- c:\windows\system32\msrle32.dll
2008-04-27 08:43:40 0 —-a-w- c:\program files\temp01
2006-08-12 00:56:20 3563166 -c–a-w- c:\program files\Propackcodec203b.exe
2004-10-01 05:00:16 40960 —-a-w- c:\program files\Uninstall_CDS.exe
2008-06-06 05:17:35 32768 –sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008060620080607\index.dat

============= FINISH: 11:53:22.98 ===============
GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-02-25 15:20:26
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\Nikki\LOCALS~1\Temp\pfliapog.sys


I apologise but I was unable to attach a file to this reply so the attach is listed here.


UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-12-01.01)

Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume2
Install Date: 25/08/2005 10:44:31 PM
System Uptime: 25/02/2010 10:23:46 AM (1 hours ago)

Motherboard: Dell Computer Corp. | | 0N2828
Processor: Intel® Pentium® 4 CPU 2.80GHz | Microprocessor | 2793/533mhz

==== Disk Partitions =========================

A: is Removable
C: is FIXED (NTFS) - 112 GiB total, 25.645 GiB free.
D: is CDROM ()
E: is CDROM ()
F: is FIXED (FAT32) - 931 GiB total, 883.35 GiB free.

==== Disabled Device Manager Items =============

Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: 1394 Net Adapter
Device ID: V1394\NIC1394\31978A1B5042A1
Manufacturer: Microsoft
Name: 1394 Net Adapter
PNP Device ID: V1394\NIC1394\31978A1B5042A1
Service: NIC1394

==== System Restore Points ===================

RP1741: 29/01/2010 5:11:13 AM - System Checkpoint
RP1742: 29/01/2010 5:35:43 AM - System Checkpoint
RP1743: 29/01/2010 10:38:17 AM - Installed Java™ 6 Update 18
RP1744: 30/01/2010 11:07:53 AM - System Checkpoint
RP1745: 31/01/2010 1:43:31 PM - System Checkpoint
RP1746: 1/02/2010 1:44:46 PM - System Checkpoint
RP1747: 2/02/2010 7:51:20 PM - System Checkpoint
RP1748: 3/02/2010 8:46:46 PM - System Checkpoint
RP1749: 4/02/2010 9:30:02 PM - System Checkpoint
RP1750: 6/02/2010 9:03:41 AM - System Checkpoint
RP1751: 7/02/2010 6:34:22 PM - Restore Operation
RP1752: 7/02/2010 6:45:19 PM - Revo Uninstaller Pro's restore point - TwonkyMedia
RP1753: 7/02/2010 6:57:00 PM - Revo Uninstaller Pro's restore point - Avira AntiVir Personal - Free Antivirus
RP1754: 7/02/2010 6:57:20 PM - Avira AntiVir Personal - 7/02/2010 18:57
RP1755: 7/02/2010 7:54:15 PM - Premium Security Suite - 7/02/2010 19:54
RP1756: 8/02/2010 9:12:35 PM - System Checkpoint
RP1757: 9/02/2010 9:57:02 PM - System Checkpoint
RP1758: 11/02/2010 7:59:15 AM - System Checkpoint
RP1759: 12/02/2010 3:00:39 AM - Software Distribution Service 3.0
RP1760: 14/02/2010 5:54:39 PM - System Checkpoint
RP1761: 15/02/2010 6:49:00 PM - System Checkpoint
RP1762: 16/02/2010 7:52:41 PM - System Checkpoint
RP1763: 17/02/2010 9:19:39 PM - System Checkpoint
RP1764: 18/02/2010 9:36:18 PM - System Checkpoint
RP1765: 19/02/2010 10:13:21 PM - System Checkpoint
RP1766: 20/02/2010 10:33:03 PM - System Checkpoint
RP1767: 23/02/2010 5:25:25 AM - System Checkpoint
RP1768: 23/02/2010 9:51:53 PM - Automatic Restore Point
RP1769: 23/02/2010 9:55:20 PM - Automatic Restore Point
RP1770: 24/02/2010 9:11:09 PM - OTL Restore Point
RP1771: 24/02/2010 11:01:58 PM - Software Distribution Service 3.0

==== Installed Programs ======================

1-2-3FileConvert v4.1
3D Groove Playback Engine
3DVIA player 5.0
Acrobat.com
Ad-Aware SE Personal
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Media Player
Adobe Reader 9.3
Adobe Shockwave Player 11
Adobe® Photoshop® Album Starter Edition 3.0
Adobe® Photoshop® Album Starter Edition 3.0.1
Apple Mobile Device Support
Apple Software Update
ApplyOnline Mobile
Authentium AntiVirus SDK - 2
Avanquest update
Avery Wizard 3.1
Avira Premium Security Suite
AVS Audio Converter version 5.1
AVS Cover Editor [removed] (AVS4YOU)
AVS Disc Creator version 3.5
AVS DVD Authoring
AVS DVD Copy version 1.4
AVS DVD to GO 1.5.1
AVS DVDMenu Editor 1.2.1.19
AVS Registry Cleaner version 1.1
AVS Update Manager 1.0
AVS Video Converter 5.6
AVS Video Converter 6
AVS Video Recorder 2.4 (Service Version)
AVS4YOU Software Navigator 1.3
Big Fish Games: Game Manager
BigPond Broadband Cable Self Install Kit
Bink and Smacker
Bonjour
Bubble Town
Canon Camera Access Library
Canon CanoScan Toolbox 4.9
Canon Digital Camera RS-232C TWAIN Driver
Canon Digital Camera Solution Disk 40-46 Software Starter Guide
Canon Digital Camera USB Driver
Canon iP5200
Canon MOV Decoder
Canon MOV Encoder
Canon MovieEdit Task for ZoomBrowser EX
Canon Personal Printing Guide
Canon PhotoRecord
Canon ScanGear Starter
Canon Setup Utility 2.0
Canon Utilities CameraWindow
Canon Utilities CameraWindow DC
Canon Utilities CameraWindow DC_DV 6 for ZoomBrowser EX
Canon Utilities Easy-PhotoPrint
Canon Utilities Easy-PrintToolBox
Canon Utilities MyCamera
Canon Utilities MyCamera DC
Canon Utilities PhotoStitch
Canon Utilities RAW Image Converter
Canon Utilities RemoteCapture 1.4
Canon Utilities RemoteCapture Task for ZoomBrowser EX
Canon Utilities ZoomBrowser EX
Canon ZoomBrowser EX Memory Card Utility
Cashflow Manager 2004
CCleaner
CD-LabelPrint
CDBurnerXP Pro 3
CDDRV_Installer
Click'N Design 3D (V5)
Common-Use Signing Interface
Conexant SmartHSFi V92 56K DF PCI Modem
Critical Update for Windows Media Player 11 (KB959772)
D-Link DSL-302G USB Driver
DesignPro 5.4 Limited Edition
Dora Saves the Snow Princess
DVD Solution
Easy-WebPrint
Easy Cover Design Pro 2.09
ERUNT 1.1j
Farm Craft
Farm Frenzy
Farm Frenzy 2
Farm Frenzy 3
Farm Frenzy 3: American Pie
Farm Frenzy Pizza Party
Farm Mania
Farmer Jane
FaxTools
FileZilla Client 3.3.1
Fontlist
Free iPod Video Converter 1.34
Google SketchUp 6
Graboid Video 1.65
HijackThis 2.0.2
HIRO Client
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB954708)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB979306)
Ice Cream Dee Lites
Intel® PRO Network Adapters and Drivers
IrfanView (remove only)
IsoBuster 2.1
Java Auto Updater
Java™ 6 Update 11
Java™ 6 Update 18
Java™ 6 Update 7
Junk Mail filter update
K-Lite Codec Pack 2.84 Full
Kaspersky Online Scanner
KhalInstallWrapper
KODAK Picture CD Volume 2 Issue 3-International English
Laugh & Learn™
LeapFrog Connect
LeapFrog Tag Plugin
LG ODD Auto Firmware Update
Logitech Desktop Messenger
Logitech SetPoint
Mahjong Towers Eternity™
Malwarebytes' Anti-Malware
Megaplex Madness: Now Playing
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Application Error Reporting
Microsoft Choice Guard
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
Microsoft LifeCam
Microsoft National Language Support Downlevel APIs
Microsoft Office Live Add-in 1.3
Microsoft Office Outlook Connector
Microsoft Office Professional Edition 2003
Microsoft Search Enhancement Pack
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Sync Framework Runtime Native v1.0 (x86)
Microsoft Sync Framework Services Native v1.0 (x86)
Microsoft User-Mode Driver Framework Feature Pack 1.7
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Web Publishing Wizard 1.52
Motorola Driver Installation 4.0.0
Motorola Phone Tools
Motorola Software Update
Mozilla Firefox (3.5.8)
MP3 Player Utilities 4.18
MSVC80_x86
MSVC80_x86_v2
MSVC90_x86
MSVCRT
MSXML 4.0 SP2 (KB925672)
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 4.0 SP2 Parser and SDK
MSXML 6.0 Parser (KB933579)
Multimedia Launcher
Nero 6 Ultra Edition
Netbet Pro
Nokia Connectivity Cable Driver
Nokia Download!
Nokia Home Media Server
Nokia Map Loader
Nokia Ovi Application Installer
Nokia Ovi Application Installer 6.85.3011
Nokia Ovi Content Copier
Nokia Ovi Content Copier 6.85.3011
Nokia Ovi One Touch Access
Nokia Ovi One Touch Access 6.85.3019
Nokia Ovi Player
Nokia Ovi Suite
Nokia Ovi Suite Software Updater
Nokia Ovi System Utilities
Nokia Ovi System Utilities 6.85.3018
Nokia PC Suite
Nokia Photos
Nokia Software Updater
Nokia_Multimedia_Common_Components_2_5
NVIDIA Drivers
OGA Notifier 1.7.0105.35.0
Ovi Desktop Sync Engine
OviMPlatform
PC Connectivity Solution
Peggle Deluxe
Peggle Nights
Pet Shop Hop
PokerRoom.com (remove only)
PokerStars
PopCap Browser Plugin
PostgreSQL 8.3
PowerDVD
PowerProducer
Print@Kodak Internet Print Service for XP
Print@Kodak Network
PrintMaster 7.00
QuickTime
ReaConverter 4.0 Pro
Revo Uninstaller 1.83
Revo Uninstaller Pro 2.1.0
Security Update for CAPICOM (KB931906)
Security Update for Windows Internet Explorer 7 (KB937143)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 8 (KB969897)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB972260)
Security Update for Windows Internet Explorer 8 (KB974455)
Security Update for Windows Internet Explorer 8 (KB976325)
Security Update for Windows Internet Explorer 8 (KB978207)
Security Update for Windows Media Encoder (KB954156)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977165)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978706)
Segoe UI
Serif DrawPlus 3.0
Sound Blaster Live!
Spelling Dictionaries Support For Adobe Reader 9
The Lost Cases of Sherlock Holmes
The Secret of Margrave Manor
Tory's Shop N' Rush
TwonkyMedia
Ulead Video ToolBox 2.0 Plus Nokia Edition
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows Internet Explorer 7 (KB928089)
Update for Windows Internet Explorer 8 (KB969497)
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows Internet Explorer 8 (KB976749)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB955839)
Update for Windows XP (KB961503)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
Use the entry named LeapFrog Connect to uninstall (LeapFrog Tag Plugin)
VideoLAN VLC media player 0.8.6d
WD Diagnostics
WebFldrs XP
Windows Defender Signatures
Windows Driver Package - 2Wire (2WIREPCP) Net (09/18/2002 1.4.0.5)
Windows Driver Package - LeapFrog (FlyUsb) USB (11/05/2008 1.1.1.0)
Windows Driver Package - Nokia Modem (05/22/2008 3.8)
Windows Driver Package - Nokia Modem (05/22/2008 7.00.0.1)
Windows Driver Package - Nokia Modem (06/01/2009 7.01.0.4)
Windows Driver Package - Nokia Modem (10/05/2009 4.2)
Windows Driver Package - Nokia pccsmcfd (08/22/2008 7.0.0.0)
Windows Genuine Advantage v1.3.0254.0
Windows Internet Explorer 8
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Family Safety
Windows Live Mail
Windows Live Messenger
Windows Live OneCare safety scanner
Windows Live Photo Gallery
Windows Live Sign-in Assistant
Windows Live Sync
Windows Live Toolbar
Windows Live Upload Tool
Windows Live Writer
Windows Media Encoder 9 Series
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player Firefox Plugin
Windows XP Service Pack 3
WinISO 5.3
WinZip 14.0

==== Event Viewer Messages From Past Week ========

20/02/2010 8:16:00 AM, error: Service Control Manager [7000] - The Avira Upgrade Service service failed to start due to the following error: The system cannot find the path specified.

==== End Of File ===========================



—- System - GMER 1.0.15 —-

SSDT F7F19A76 ZwCreateKey
SSDT F7F19A6C ZwCreateThread
SSDT F7F19A7B ZwDeleteKey
SSDT F7F19A85 ZwDeleteValueKey
SSDT F7F19A8A ZwLoadKey
SSDT F7F19A58 ZwOpenProcess
SSDT F7F19A5D ZwOpenThread
SSDT F7F19A94 ZwReplaceKey
SSDT F7F19A8F ZwRestoreKey
SSDT F7F19A80 ZwSetValueKey
SSDT F7F19A67 ZwTerminateProcess
SSDT F7F19A62 ZwWriteVirtualMemory

Code 8702BD28 ZwCreateSection
Code 87022D28 ZwDuplicateObject
Code 871E1B70 ZwSetInformationFile
Code 87186EE8 ZwSetSystemInformation
Code 87175438 ZwWriteFile
Code 8702BD27 NtCreateSection
Code 87022D27 NtDuplicateObject
Code 871E1B6F NtSetInformationFile
Code 87175437 NtWriteFile

—- Devices - GMER 1.0.15 —-

Device \FileSystem\Fastfat \FatCdrom Code 86C32D28

AttachedDevice \Driver\Tcpip \Device\Ip avfwot.sys (TDI filtering kernel driver/Avira GmbH)
AttachedDevice \Driver\Tcpip \Device\Tcp avfwot.sys (TDI filtering kernel driver/Avira GmbH)
AttachedDevice \Driver\Tcpip \Device\Udp avfwot.sys (TDI filtering kernel driver/Avira GmbH)
AttachedDevice \Driver\Tcpip \Device\RawIp avfwot.sys (TDI filtering kernel driver/Avira GmbH)

Device \FileSystem\Fastfat \Fat Code 86C32D28

AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

—- Registry - GMER 1.0.15 —-

Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{64B09380-C9F1-4E9F-1A3C-8067E59C46B9}
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{64B09380-C9F1-4E9F-1A3C-8067E59C46B9}@ealnpfhnok 0x66 0x61 0x66 0x6F …
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{64B09380-C9F1-4E9F-1A3C-8067E59C46B9}@daapcbld 0x64 0x62 0x6E 0x70 …
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{64B09380-C9F1-4E9F-1A3C-8067E59C46B9}@iadbomgnjmimobjbdi 0x6B 0x61 0x6B 0x6A …
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{64B09380-C9F1-4E9F-1A3C-8067E59C46B9}@hanpalbphbplimoa 0x69 0x61 0x67 0x6B …

—- EOF - GMER 1.0.15 —-

Hi I ran combo-fix.

It ran then flashes an error about a missing Dll but I missed what the error exacltly was.

Thanks for the help you are giving me.

ComboFix 10-02-25.02 - Nikki 26/02/2010 21:20:33.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1023.454 [GMT 10:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {11638345-E4FC-4BEE-BB73-EC754659C5F6}
FW: Avira Firewall *disabled* {11638345-E4FC-4BEE-BB73-EC754659C5F6}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Nikki\Application Data\inst.exe
C:\Images
C:\LOGC0.tmp
C:\Thumbs.db
c:\windows\srchasst\nls302en.lex
c:\windows\system32\Data
c:\windows\system32\SHELLLNK.TLB
c:\windows\system32\Thumbs.db
c:\windows\system32\VB6KO.DLL
F:\autorun.inf

.
((((((((((((((((((((((((( Files Created from 2010-01-26 to 2010-02-26 )))))))))))))))))))))))))))))))
.

2010-02-26 11:30 . 2010-02-26 11:31 ——– d—–w- c:\temp\MotoConnectTemp
2010-02-23 11:57 . 2010-02-23 11:57 ——– d—–w- c:\program files\ERUNT
2010-02-07 10:19 . 2010-02-07 10:19 ——– d—–w- c:\documents and settings\Nikki\Application Data\Avira
2010-02-07 09:56 . 2010-02-07 09:53 96104 —-a-w- c:\windows\system32\drivers\avipbb.sys
2010-02-07 09:56 . 2010-02-07 09:52 22360 —-a-w- c:\windows\system32\drivers\avgntmgr.sys
2010-02-07 09:56 . 2010-02-07 09:52 45416 —-a-w- c:\windows\system32\drivers\avgntdd.sys
2010-02-07 09:56 . 2010-02-07 09:52 97608 —-a-w- c:\windows\system32\drivers\avfwot.sys
2010-02-07 09:56 . 2010-02-07 09:52 69632 —-a-w- c:\windows\system32\drivers\avfwim.sys
2010-02-07 09:56 . 2010-02-07 09:56 ——– d—–w- c:\documents and settings\All Users\Application Data\Avira
2010-02-07 09:56 . 2010-02-07 09:56 ——– d—–w- c:\program files\Avira
2010-02-07 08:44 . 2010-02-07 08:44 ——– d—–w- c:\documents and settings\Nikki\Local Settings\Application Data\VS Revo Group
2010-02-07 08:43 . 2009-12-30 01:20 27064 —-a-w- c:\windows\system32\drivers\revoflt.sys
2010-02-07 08:35 . 2010-02-07 08:35 ——– d—–w- c:\windows\system32\wbem\Repository

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-19 15:42 . 2010-01-15 06:31 1303344 —-a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2010-02-15 14:13 . 2010-02-15 14:13 64099864 —-a-w- c:\documents and settings\Nikki\Application Data\Nokia\Ovi Suite\Software Updater\NokiaOviSuite2Installer.exe
2010-02-14 12:31 . 2009-05-11 09:11 ——– d—–w- c:\documents and settings\Nikki\Application Data\ZoomBrowser EX
2010-02-14 06:55 . 2009-05-11 09:13 ——– d—–w- c:\documents and settings\Nikki\Application Data\CameraWindowDC
2010-02-07 09:52 . 2009-05-20 09:25 56816 —-a-w- c:\windows\system32\drivers\avgntflt.sys
2010-02-07 08:43 . 2008-06-08 12:26 ——– d—–w- c:\program files\VS Revo Group
2010-02-07 07:39 . 2006-11-30 23:12 ——– d—–w- c:\program files\PokerStars
2010-01-29 00:39 . 2008-06-09 10:26 ——– d—–w- c:\program files\Common Files\Java
2010-01-29 00:38 . 2010-01-29 00:38 61440 —-a-w- c:\documents and settings\Nikki\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-28ab2979-n\decora-sse.dll
2010-01-29 00:38 . 2010-01-29 00:38 503808 —-a-w- c:\documents and settings\Nikki\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-71d89912-n\msvcp71.dll
2010-01-29 00:38 . 2010-01-29 00:38 499712 —-a-w- c:\documents and settings\Nikki\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-71d89912-n\jmc.dll
2010-01-29 00:38 . 2010-01-29 00:38 348160 —-a-w- c:\documents and settings\Nikki\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-71d89912-n\msvcr71.dll
2010-01-29 00:38 . 2010-01-29 00:38 12800 —-a-w- c:\documents and settings\Nikki\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-28ab2979-n\decora-d3d.dll
2010-01-29 00:38 . 2007-05-07 03:27 ——– d—–w- c:\program files\Java
2010-01-27 10:21 . 2005-08-31 02:58 ——– d—–w- c:\program files\Common Files\Adobe
2010-01-27 02:28 . 2009-05-26 11:41 ——– d—–w- c:\documents and settings\Nikki\Application Data\FileZilla
2010-01-27 02:27 . 2009-05-26 11:41 ——– d—–w- c:\program files\FileZilla FTP Client
2010-01-25 09:27 . 2009-04-03 07:09 ——– d—–w- c:\program files\Microsoft Silverlight
2010-01-21 08:35 . 2010-01-27 02:33 52224 —-a-w- c:\documents and settings\Nikki\Application Data\Mozilla\Firefox\Profiles\t87f21mq.default\extensions\{13e0b548-6fc9-47e9-9874-470915f46548}\components\FFExternalAlert.dll
2010-01-21 08:35 . 2010-01-27 02:33 101376 —-a-w- c:\documents and settings\Nikki\Application Data\Mozilla\Firefox\Profiles\t87f21mq.default\extensions\{13e0b548-6fc9-47e9-9874-470915f46548}\components\RadioWMPCore.dll
2010-01-18 04:23 . 2008-04-27 08:45 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-01-16 23:31 . 2010-01-16 23:31 152576 —-a-w- c:\documents and settings\Nikki\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2010-01-16 23:31 . 2009-11-20 17:41 79488 —-a-w- c:\documents and settings\Nikki\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2010-01-16 08:21 . 2007-03-13 00:01 ——– d—–w- c:\documents and settings\All Users\Application Data\WinZip
2010-01-16 05:37 . 2005-08-31 02:53 158624 -c–a-w- c:\documents and settings\Nikki\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-01-16 01:50 . 2008-11-05 23:37 ——– d—–w- c:\program files\Nokia
2010-01-16 01:46 . 2010-01-16 01:46 ——– d—–w- c:\program files\Common Files\muvee Technologies
2010-01-16 01:46 . 2010-01-16 00:50 ——– d—–w- c:\program files\Common Files\Nokia
2010-01-16 01:40 . 2010-01-16 01:40 ——– d—–w- c:\program files\PC Connectivity Solution
2010-01-16 01:38 . 2010-01-15 05:53 12212040 —-a-w- c:\documents and settings\All Users\Application Data\OviInstallerCache\{B6164ADA-55DA-4FA9-B78B-A7EB741742A1}\Installer\CommonCustomActions\WMFDist11-WindowsXP-X86-ENU.exe
2010-01-16 01:38 . 2010-01-15 05:53 13930312 —-a-w- c:\documents and settings\All Users\Application Data\OviInstallerCache\{B6164ADA-55DA-4FA9-B78B-A7EB741742A1}\Installer\CommonCustomActions\WMFDist11-WindowsXP-X64-ENU.exe
2010-01-16 01:38 . 2010-01-15 05:52 77824 —-a-w- c:\documents and settings\All Users\Application Data\OviInstallerCache\{B6164ADA-55DA-4FA9-B78B-A7EB741742A1}\Installer\CommonCustomActions\Run_XML6_SP1.exe
2010-01-16 01:38 . 2010-01-15 05:52 61440 —-a-w- c:\documents and settings\All Users\Application Data\OviInstallerCache\{B6164ADA-55DA-4FA9-B78B-A7EB741742A1}\Installer\CommonCustomActions\WMF11Runx86.exe
2010-01-16 01:38 . 2010-01-15 05:52 58880 —-a-w- c:\documents and settings\All Users\Application Data\OviInstallerCache\{B6164ADA-55DA-4FA9-B78B-A7EB741742A1}\Installer\CommonCustomActions\WMF11Runx64.exe
2010-01-16 01:38 . 2010-01-15 05:52 50000 —-a-w- c:\documents and settings\All Users\Application Data\OviInstallerCache\{B6164ADA-55DA-4FA9-B78B-A7EB741742A1}\Installer\CommonCustomActions\pcswpc.exe
2010-01-16 00:53 . 2010-01-16 00:53 0 —ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
2010-01-16 00:50 . 2010-01-16 00:50 ——– d—–w- c:\program files\Common Files\PCSuite
2010-01-16 00:48 . 2010-01-16 00:49 34429264 —-a-w- c:\documents and settings\All Users\Application Data\Installations\{9249D7E7-33E7-4CC8-BB0B-3DF3C3CB2568}\Nokia_PC_Suite_7_1_40_1_eng_web.exe
2010-01-16 00:30 . 2008-09-12 09:49 ——– d—–w- c:\documents and settings\All Users\Application Data\Installations
2010-01-15 10:49 . 2010-01-15 10:49 ——– d—–w- c:\documents and settings\All Users\Application Data\Nokia
2010-01-15 10:43 . 2010-01-15 10:43 0 —ha-w- c:\windows\system32\drivers\Msft_User_PCCSWpdDriver_01_07_00.Wdf
2010-01-15 10:42 . 2010-01-15 10:42 0 —ha-w- c:\windows\system32\drivers\MsftWdf_user_01_07_00.Wdf
2010-01-15 10:42 . 2010-01-15 10:42 95232 —-a-w- c:\documents and settings\All Users\Application Data\Installations\{9249D7E7-33E7-4CC8-BB0B-3DF3C3CB2568}\Installer\CommonCustomActions\pcswpcsi.exe
2010-01-15 10:42 . 2010-01-15 10:42 61440 —-a-w- c:\documents and settings\All Users\Application Data\Installations\{9249D7E7-33E7-4CC8-BB0B-3DF3C3CB2568}\Installer\CommonCustomActions\UninstPCSFEMsi.exe
2010-01-15 10:42 . 2010-01-15 10:42 10240 —-a-w- c:\documents and settings\All Users\Application Data\Installations\{9249D7E7-33E7-4CC8-BB0B-3DF3C3CB2568}\Installer\CommonCustomActions\UninstPCS.exe
2010-01-15 10:42 . 2010-01-15 10:42 8192 —-a-w- c:\documents and settings\All Users\Application Data\Installations\{9249D7E7-33E7-4CC8-BB0B-3DF3C3CB2568}\Installer\CommonCustomActions\UninstCCD.exe
2010-01-15 10:42 . 2010-01-15 10:43 34429264 —-a-w- c:\documents and settings\All Users\Application Data\Installations\{9249D7E7-33E7-4CC8-BB0B-3DF3C3CB2568}\Nokia_PC_Suite_7_1_40_1_eng.exe
2010-01-15 07:03 . 2008-06-05 22:50 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-01-15 07:03 . 2008-11-02 09:38 5115824 —-a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-01-15 06:16 . 2010-01-15 06:16 ——– d—–w- c:\documents and settings\Nikki\Application Data\Nokia Ovi Suite
2010-01-15 06:16 . 2006-09-23 01:18 ——– d—–w- c:\documents and settings\Nikki\Application Data\Nokia
2010-01-15 06:14 . 2006-09-23 01:11 ——– d—–w- c:\documents and settings\Nikki\Application Data\PC Suite
2010-01-15 06:10 . 2010-01-15 06:10 0 —ha-w- c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01007.Wdf
2010-01-15 05:52 . 2010-01-15 05:52 ——– d—–w- c:\documents and settings\All Users\Application Data\OviInstallerCache
2010-01-15 05:52 . 2010-01-15 05:52 95992424 —-a-w- c:\documents and settings\All Users\Application Data\OviInstallerCache\{B6164ADA-55DA-4FA9-B78B-A7EB741742A1}\Nokia_Ovi_Suite_11_update.exe
2010-01-15 05:22 . 2007-11-05 10:08 ——– d—–w- c:\program files\Motorola Phone Tools
2010-01-15 05:19 . 2009-09-05 02:21 ——– d—–w- c:\program files\Motorola
2010-01-15 05:17 . 2007-11-05 10:09 ——– d—–w- c:\program files\Avanquest update
2010-01-08 14:29 . 2010-01-08 10:02 ——– d—–w- c:\documents and settings\All Users\Application Data\FarmFrenzy3_America
2010-01-08 10:00 . 2010-01-08 10:00 ——– d—–w- c:\program files\Farm Frenzy 3 - American Pie
2010-01-08 09:58 . 2008-04-28 06:57 ——– d—–w- c:\program files\bfgclient
2010-01-08 09:57 . 2008-04-28 06:56 ——– d—–w- c:\documents and settings\All Users\Application Data\BigFishGamesCache
2010-01-07 06:07 . 2008-11-02 09:38 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 06:07 . 2008-06-05 22:50 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-01-05 06:18 . 2006-10-17 23:18 ——– d—–w- c:\program files\DIFX
2010-01-05 06:18 . 2010-01-05 06:17 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard
2010-01-05 06:17 . 2008-12-29 00:23 ——– d—–w- c:\program files\LeapFrog
2010-01-05 06:16 . 2010-01-05 06:16 28696928 —-a-w- c:\documents and settings\All Users\Application Data\Leapfrog\LeapFrog Connect\Updates\UPCInstaller.exe
2010-01-05 06:13 . 2010-01-05 06:13 6106960 —-a-w- c:\documents and settings\All Users\Application Data\Leapfrog\LeapFrog Connect\Updates\TagPlugin.exe
2010-01-05 06:13 . 2010-01-05 06:13 ——– d—–w- c:\documents and settings\All Users\Application Data\Leapfrog
2010-01-03 11:25 . 2010-01-03 11:25 ——– d—–w- c:\program files\Tory's Shop N Rush
2009-12-31 16:50 . 2003-07-16 20:46 353792 —-a-w- c:\windows\system32\drivers\srv.sys
2009-12-24 21:55 . 2008-12-24 20:14 1518 —-a-r- c:\documents and settings\Nikki\Application Data\Microsoft\Installer\{8B9852AF-B0B0-47B7-9BC5-89A95D77B6C9}\_64CF0F5A56F714996FE0BF.exe
2009-12-24 21:55 . 2008-12-24 20:14 1078 —-a-r- c:\documents and settings\Nikki\Application Data\Microsoft\Installer\{8B9852AF-B0B0-47B7-9BC5-89A95D77B6C9}\_D32E910E796D9B1992CC0A.exe
2009-12-24 21:55 . 2008-12-24 20:14 766 —-a-r- c:\documents and settings\Nikki\Application Data\Microsoft\Installer\{8B9852AF-B0B0-47B7-9BC5-89A95D77B6C9}\_6FEFF9B68218417F98F549.exe
2009-12-24 21:55 . 2008-12-24 20:14 2550 —-a-r- c:\documents and settings\Nikki\Application Data\Microsoft\Installer\{8B9852AF-B0B0-47B7-9BC5-89A95D77B6C9}\_0727E5AC67F43141071FB8.exe
2009-12-24 21:55 . 2008-12-24 20:14 1078 —-a-r- c:\documents and settings\Nikki\Application Data\Microsoft\Installer\{8B9852AF-B0B0-47B7-9BC5-89A95D77B6C9}\_1661033BF80E250A89F8FC.exe
2009-12-24 21:55 . 2008-12-24 20:14 10134 —-a-r- c:\documents and settings\Nikki\Application Data\Microsoft\Installer\{8B9852AF-B0B0-47B7-9BC5-89A95D77B6C9}\_84851EE9B80B38F45D2097.exe
2009-12-21 19:14 . 2003-07-16 20:51 916480 —-a-w- c:\windows\system32\wininet.dll
2009-12-17 07:14 . 2009-01-04 09:29 411368 —-a-w- c:\windows\system32\deploytk.dll
2009-12-16 18:43 . 2005-08-25 12:27 343040 —-a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:08 . 2003-07-16 20:26 33280 —-a-w- c:\windows\system32\csrsrv.dll
2009-12-08 19:27 . 2003-07-16 20:39 2189184 —-a-w- c:\windows\system32\ntoskrnl.exe
2009-12-08 18:43 . 2002-08-29 01:04 2066048 —-a-w- c:\windows\system32\ntkrnlpa.exe
2009-12-04 18:22 . 2003-07-16 20:34 455424 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2008-04-27 08:43 . 2008-04-27 08:43 0 —-a-w- c:\program files\temp01
2006-08-12 00:56 . 2006-08-12 00:56 3563166 -c–a-w- c:\program files\Propackcodec203b.exe
2004-10-01 05:00 . 2006-08-13 02:41 40960 —-a-w- c:\program files\Uninstall_CDS.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NBJ"="c:\program files\Ahead\Nero BackItUp\NBJ.exe" [2005-10-11 1961984]
"ccleaner"="c:\program files\CCleaner\CCleaner.exe" [2009-12-21 1803064]
"NokiaOviSuite2"="c:\program files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe" [2009-12-10 401728]
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2009-11-11 1451520]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NokiaMServer"="c:\program files\Common Files\Nokia\MPlatform\NokiaMServer" [X]
"nwiz"="nwiz.exe" [2006-10-22 1622016]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-10 90112]
"LifeCam"="c:\program files\Microsoft LifeCam\LifeExp.exe" [2007-05-17 279912]
"VX1000"="c:\windows\vVX1000.exe" [2007-04-10 709992]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-22 86016]
"Easy-PrintToolBox"="c:\program files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE" [2004-01-14 409600]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-09-06 413696]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480]
"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 57344]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-02-28 76304]
"Monitor"="c:\program files\LeapFrog\LeapFrog Connect\Monitor.exe" [2009-11-10 443728]
"NokiaMusic FastStart"="c:\program files\Nokia\Ovi Player\NokiaOviPlayer.exe" [2009-11-06 2090272]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-01-11 246504]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-21 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-02-07 209153]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-13 15360]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Hiro-Media Client.lnk - c:\program files\Hiro-Media\HiroClient\HiroClient.exe [2009-1-22 2860312]
Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2009-6-30 67128]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2009-6-30 805392]
WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2009-11-18 495432]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2008-05-01 16:42 72208 —-a-w- c:\program files\Common Files\Logitech\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Motorola Phone Tools\\mPhonetools.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"=
"c:\\WINDOWS\\system32\\ftp.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Malwarebytes' Anti-Malware\\mbam.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\FileZilla FTP Client\\filezilla.exe"=
"c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"c:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"c:\\Program Files\\Nokia\\Nokia Home Media Server\\Media Server\\twonkymedia.exe"=
"c:\\Program Files\\Nokia\\Nokia Home Media Server\\Media Server\\twonkymediaserver.exe"=

R1 avfwot;avfwot;c:\windows\system32\drivers\avfwot.sys [7/02/2010 7:56 PM 97608]
R2 AntiVirFirewallService;Avira Firewall;c:\program files\Avira\AntiVir Desktop\avfwsvc.exe [7/02/2010 7:56 PM 388865]
R2 AntiVirMailService;Avira AntiVir MailGuard;c:\program files\Avira\AntiVir Desktop\avmailc.exe [7/02/2010 7:56 PM 194817]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [7/02/2010 7:56 PM 108289]
R2 AntiVirWebService;Avira AntiVir WebGuard;c:\program files\Avira\AntiVir Desktop\avwebgrd.exe [7/02/2010 7:56 PM 434945]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [3/04/2009 5:09 PM 54752]
R2 MotoConnect Service;MotoConnect Service;c:\program files\Motorola\MotoConnectService\MotoConnectService.exe [15/01/2010 3:19 PM 91392]
R2 pgsql-8.3;PostgreSQL Database Server 8.3;c:\program files\PostgreSQL\8.3\bin\pg_ctl.exe [19/09/2008 3:03 AM 65536]
R3 avfwim;AvFw Packet Filter Miniport;c:\windows\system32\drivers\avfwim.sys [7/02/2010 7:56 PM 69632]
S2 AntiVirUpgradeService;Avira Upgrade Service;"c:\docume~1\Nikki\LOCALS~1\Temp\AVSETUP_4a13c9ff\basic\avupgsvc.exe" /TEMPSTART:""c:\docume~1\Nikki\LOCALS~1\Temp\AVSETUP_4a13c9ff\basic\setup.exe" /NOTEMPCLEANUP /CROSSUPGRADE" –> c:\docume~1\Nikki\LOCALS~1\Temp\AVSETUP_4a13c9ff\basic\avupgsvc.exe [?]
S2 TwonkyMedia;TwonkyMedia;c:\program files\Nokia\Nokia Home Media Server\Media Server\TwonkyMedia.exe -serviceversion 0 –> c:\program files\Nokia\Nokia Home Media Server\Media Server\TwonkyMedia.exe -serviceversion 0 [?]
S3 ADM8511;ADMtek ADM8511/AN986 USB To Fast Ethernet Converter;c:\windows\system32\drivers\ADM8511.SYS [31/08/2005 10:31 AM 20160]
S3 fsssvc;Windows Live Family Safety Service;c:\program files\Windows Live\Family Safety\fsssvc.exe [5/08/2009 10:48 PM 704864]
S3 Revoflt;Revoflt;c:\windows\system32\drivers\revoflt.sys [7/02/2010 6:43 PM 27064]
S3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;c:\windows\system32\drivers\wg111v2.sys [8/04/2008 9:28 PM 272128]
.
Contents of the 'Scheduled Tasks' folder

2010-02-23 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 02:34]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com.au/
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: Add to AMV Converter… - c:\program files\MP3 Player Utilities 4.18\AMVConverter\grab.html
IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
LSP: c:\program files\Avira\AntiVir Desktop\avsda.dll
Trusted Zone: afgonline.com.au
Trusted Zone: afgonline.com.au\flex
Trusted Zone: MUZNIKTIF
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
Handler: hiro - {50BA1131-168F-4c08-A69B-4012273F222E} - c:\program files\Hiro-Media\HiroClient\OldHiroProtocolHandler.dll
Handler: hirodownload - {77F2FF4C-CEDD-4c71-8ABF-DF7CC05EFC63} - c:\program files\Hiro-Media\HiroClient\HiroProtocolHandler.dll
DPF: CabBuilder - hxxp://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
DPF: {7A0D1738-10EA-47FF-92BE-4E137B5BE1A4} - hxxps://mpsnare.iesnare.com/StmOCX.cab
DPF: {8C244272-1DC1-4CE7-9C6C-FABCA09EB543} - hxxps://flex.afgonline.com.au/fins_enu/20420/applets/SiebelAx_Desktop_Integration.cab
DPF: {B2B2C3F9-CFB2-49CC-942D-103E68E09B74} - hxxps://flex.afgonline.com.au/fins_enu/20420/applets/SiebelAx_OutBound_mail.cab
DPF: {CD9C0F1B-D8F9-4229-B76C-5EF6B14372E4} - hxxps://flex.afgonline.com.au/fins_enu/20420/applets/SiebelAx_HI_Client.cab
FF - ProfilePath - c:\documents and settings\Nikki\Application Data\Mozilla\Firefox\Profiles\t87f21mq.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - component: c:\documents and settings\Nikki\Application Data\Mozilla\Firefox\Profiles\t87f21mq.default\extensions\{13e0b548-6fc9-47e9-9874-470915f46548}\components\FFExternalAlert.dll
FF - component: c:\documents and settings\Nikki\Application Data\Mozilla\Firefox\Profiles\t87f21mq.default\extensions\{13e0b548-6fc9-47e9-9874-470915f46548}\components\RadioWMPCore.dll
FF - component: c:\program files\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\components\FirefoxExtension.dll
FF - component: c:\program files\Nokia\Nokia PC Suite 7\bkmrksync\components\BkMrkExt.dll
FF - plugin: c:\program files\Common-Use Signing Interface\bin\npCsiPlugin.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\nppopcaploader.dll
FF - plugin: c:\program files\Virtools\3D Life Player\npvirtools.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-AdobeBridge - (no file)
SafeBoot-AVG Anti-Spyware Driver
SafeBoot-AVG Anti-Spyware Guard



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-26 21:29
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-1214440339-329068152-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{64B09380-C9F1-4E9F-1A3C-8067E59C46B9}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"ealnpfhnok"=hex:66,61,66,6f,6b,64,6e,64,70,61,6f,6e,00,fc
"daapcbld"=hex:64,62,6e,70,61,6a,69,6e,6d,6a,70,61,64,6e,64,64,62,69,6e,69,6c,
6a,67,62,6f,65,63,6a,67,61,68,6c,6f,6d,65,6e,61,61,6c,67,00,00
"iadbomgnjmimobjbdi"=hex:6b,61,6b,6a,68,6c,6f,66,70,6c,68,6a,61,66,6e,62,65,64,
64,63,65,6c,00,00
"hanpalbphbplimoa"=hex:69,61,67,6b,6b,6f,67,6f,6b,63,6e,68,6b,6b,69,62,64,64,
00,7c
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(928)
c:\program files\common files\logitech\bluetooth\LBTWlgn.dll
c:\program files\common files\logitech\bluetooth\LBTServ.dll

- - - - - - - > 'lsass.exe'(984)
c:\program files\Avira\AntiVir Desktop\avsda.dll

- - - - - - - > 'explorer.exe'(3128)
c:\windows\system32\WININET.dll
c:\program files\Logitech\SetPoint\lgscroll.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\Avira\AntiVir Desktop\avsda.dll
c:\program files\Nokia\Nokia PC Suite 7\PhoneBrowser.dll
c:\program files\Nokia\Nokia PC Suite 7\NGSCM.DLL
c:\program files\Nokia\Nokia PC Suite 7\Lang\PhoneBrowser_eng.nlr
c:\program files\Nokia\Nokia PC Suite 7\Resource\PhoneBrowser_Nokia.ngr
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\LeapFrog\LeapFrog Connect\CommandService.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Microsoft LifeCam\MSCamS32.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\PostgreSQL\8.3\bin\postgres.exe
c:\program files\PostgreSQL\8.3\bin\postgres.exe
c:\program files\Canon\CAL\CALMAIN.exe
c:\program files\PostgreSQL\8.3\bin\postgres.exe
c:\program files\PostgreSQL\8.3\bin\postgres.exe
c:\program files\PostgreSQL\8.3\bin\postgres.exe
c:\program files\PostgreSQL\8.3\bin\postgres.exe
c:\windows\system32\wscntfy.exe
c:\program files\Motorola\MotoConnectService\MotoConnect.exe
c:\program files\Common Files\Nokia\MPlatform\NokiaMServer.exe
c:\program files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
c:\program files\PC Connectivity Solution\ServiceLayer.exe
c:\program files\PC Connectivity Solution\Transports\NclUSBSrv.exe
c:\program files\PC Connectivity Solution\Transports\NclRSSrv.exe
c:\program files\Common Files\Nokia\NoA\nokiaaserver.exe
.
**************************************************************************
.
Completion time: 2010-02-26 21:39:58 - machine was rebooted
ComboFix-quarantined-files.txt 2010-02-26 11:39

Pre-Run: 25,903,910,912 bytes free
Post-Run: 25,871,196,160 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

- - End Of File - - 79299D79B950EC4B0ECDA7DB46C7BB17

Hi, Ok I deleted those Javas. Can you tell me why? Should I only have latest update installed? Computer still slow at times, Freezes quite often. Kaspersky is very unstable on my machine. With the item being found in my archive outlook, is it safe to delete all the dbx files from outlook archive? I am unable to open the files and delete some as I am not sure what I have archived. Do you guys still recommend Avira as good antivirus software? I am thinking of purchasing the Avira Premium Security Suite, Would you recommend that or should I purchase something else or stay with free Avira? I have attached the attach file as it says everywhere to attach it. Can you tell me if any of my running processe are not required all the time and how to disable them not to automatically start up, I was wondering if some are not required and I dont know what half of them even are. Thanks for your help so far. DDS (Ver_09-12-01.01) - NTFSx86 Run by [removed] at 22:07:56.54 on Mon 01/03/2010 Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_18 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1023.633 [GMT 10:00] AV: AntiVir Desktop *On-access scanning enabled* (Updated) {11638345-E4FC-4BEE-BB73-EC754659C5F6} FW: Avira Firewall *enabled* {11638345-E4FC-4BEE-BB73-EC754659C5F6} ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup svchost.exe svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Avira\AntiVir Desktop\sched.exe C:\Program Files\Avira\AntiVir Desktop\avguard.exe svchost.exe C:\Program Files\Avira\AntiVir Desktop\avmailc.exe C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\LeapFrog\LeapFrog Connect\CommandService.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Microsoft LifeCam\MSCamS32.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe C:\WINDOWS\System32\svchost.exe -k imgsvc C:\Program Files\Canon\CAL\CALMAIN.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\vVX1000.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe C:\Program Files\LeapFrog\LeapFrog Connect\Monitor.exe C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Hiro-Media\HiroClient\HiroClient.exe C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe C:\Program Files\Logitech\SetPoint\SetPoint.exe C:\Program Files\WinZip\WZQKPICK.EXE C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe C:\Program Files\Common Files\Nokia\NoA\nokiaaserver.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Motorola\MotoConnectService\MotoConnectService.exe C:\Program Files\Motorola\MotoConnectService\MotoConnect.exe C:\WINDOWS\system32\taskmgr.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Nikki\My Documents\Downloads\dds(3).com ============== Pseudo HJT Report =============== uStart Page = hxxp://www.google.com.au/ uInternet Settings,ProxyOverride = *.local uSearchURL,(Default) = hxxp://www.google.com/keyword/%s BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: Easy-WebPrint: {327c2873-e90d-4c37-aa9d-10ac9baba46c} - c:\program files\canon\easy-webprint\Toolband.dll TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - TB: {BC4FFE41-DE9F-46FA-B455-AAD49B9F9938} - No File TB: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File uRun: [NBJ] "c:\program files\ahead\nero backitup\NBJ.exe" uRun: [ccleaner] "c:\program files\ccleaner\CCleaner.exe" /AUTO uRun: [NokiaOviSuite2] c:\program files\nokia\nokia ovi suite\NokiaOviSuite.exe -tray uRun: [PC Suite Tray] "c:\program files\nokia\nokia pc suite 7\PCSuite.exe" -onlytray uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe mRun: [nwiz] nwiz.exe /install mRun: [UpdReg] c:\windows\UpdReg.EXE mRun: [LifeCam] "c:\program files\microsoft lifecam\LifeExp.exe" mRun: [VX1000] c:\windows\vVX1000.exe mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit mRun: [Easy-PrintToolBox] c:\program files\canon\easy-printtoolbox\BJPSMAIN.EXE /logon mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [Adobe Photo Downloader] "c:\program files\adobe\photoshop album starter edition\3.0\apps\apdproxy.exe" mRun: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE mRun: [Monitor] "c:\program files\leapfrog\leapfrog connect\Monitor.exe" mRun: [NokiaMServer] c:\program files\common files\nokia\mplatform\NokiaMServer /watchfiles startup mRun: [NokiaMusic FastStart] "c:\program files\nokia\ovi player\NokiaOviPlayer.exe" /command:faststart mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe" mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe" mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min mRun: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe" dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hiro-m~1.lnk - c:\program files\hiro-media\hiroclient\HiroClient.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\logite~2.lnk - c:\program files\logitech\desktop messenger\8876480\program\LogitechDesktopMessenger.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\logite~1.lnk - c:\program files\logitech\setpoint\SetPoint.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\winzip~1.lnk - c:\program files\winzip\WZQKPICK.EXE IE: Add to AMV Converter… - c:\program files\mp3 player utilities 4.18\amvconverter\grab.html IE: Append Link Target to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppendSelLinks.html IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000 IE: {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - c:\program files\pokerstars\PokerStarsUpdate.exe IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBC} - c:\program files\java\jre6\bin\ssv.dll IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll LSP: c:\program files\avira\antivir desktop\avsda.dll Trusted Zone: afgonline.com.au Trusted Zone: afgonline.com.au\flex Trusted Zone: MUZNIKTIF DPF: CabBuilder - hxxp://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab DPF: {0BE35204-8F91-11CE-9DE3-00AA004BB851} - hxxp://wwwau.kodak.com/AU/en/consumer/printOnline/OPW_25900.cab DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} - hxxp://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {25365FF3-2746-4230-9DA7-163CCA318309} - hxxp://inst.c-wss.com/vwhpro/EN/install/gtdownlr.cab DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\yinsthelper.dll DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} - hxxp://www.cult3d.com/download/cult.cab DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} - hxxp://www4.snapfish.com.au/SnapfishActivia.cab DPF: {459E93B6-150E-45D5-8D4B-45C66FC035FE} - hxxp://apps.corel.com/nos_dl_manager_dev/plugin/IEGetPlugin.ocx DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} - hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.4.1.cab DPF: {48DD0448-9209-4F81-9F6D-D83562940134} - hxxp://lads.myspace.com/upload/MySpaceUploader1006.cab DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1134597093746 DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} - hxxp://www.nick.com/common/groove/gx/GrooveAX27.cab DPF: {7A0D1738-10EA-47FF-92BE-4E137B5BE1A4} - hxxps://mpsnare.iesnare.com/StmOCX.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab DPF: {8C244272-1DC1-4CE7-9C6C-FABCA09EB543} - hxxps://flex.afgonline.com.au/fins_enu/20420/applets/SiebelAx_Desktop_Integration.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab DPF: {B2B2C3F9-CFB2-49CC-942D-103E68E09B74} - hxxps://flex.afgonline.com.au/fins_enu/20420/applets/SiebelAx_OutBound_mail.cab DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} - hxxp://messenger.msn.com/download/MsnMessengerSetupDownloader.cab DPF: {BB383206-6DA1-4E80-B62A-3DF950FCC697} - hxxp://www.imgag.com/cp/install/AxCtp2.cab DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} - hxxp://a532.g.akamai.net/f/532/6712/4h/player.virtools.com/downloads/player/Install3.0/Installer.exe DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab DPF: {CD9C0F1B-D8F9-4229-B76C-5EF6B14372E4} - hxxps://flex.afgonline.com.au/fins_enu/20420/applets/SiebelAx_HI_Client.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} - hxxp://a532.g.akamai.net/f/532/6712/5m/virtools.download.akamai.com/6712/player/install/installer.exe DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} - hxxp://driveragent.com/files/driveragent.cab Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\logitech\desktop messenger\8876480\program\GAPlugProtocol-8876480.dll Handler: hiro - {50BA1131-168F-4c08-A69B-4012273F222E} - c:\program files\hiro-media\hiroclient\OldHiroProtocolHandler.dll Handler: hirodownload - {77F2FF4C-CEDD-4c71-8ABF-DF7CC05EFC63} - c:\program files\hiro-media\hiroclient\HiroProtocolHandler.dll Notify: LBTWlgn - c:\program files\common files\logitech\bluetooth\LBTWlgn.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\nikki\applic~1\mozilla\firefox\profiles\t87f21mq.default\ FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q= FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ FF - component: c:\documents and settings\nikki\application data\mozilla\firefox\profiles\t87f21mq.default\extensions\{13e0b548-6fc9-47e9-9874-470915f46548}\components\FFExternalAlert.dll FF - component: c:\documents and settings\nikki\application data\mozilla\firefox\profiles\t87f21mq.default\extensions\{13e0b548-6fc9-47e9-9874-470915f46548}\components\RadioWMPCore.dll FF - component: c:\program files\nokia\nokia ovi suite\connectors\bookmarks connector\firefoxextension\components\FirefoxExtension.dll FF - component: c:\program files\nokia\nokia pc suite 7\bkmrksync\components\BkMrkExt.dll FF - plugin: c:\program files\common-use signing interface\bin\npCsiPlugin.dll FF - plugin: c:\program files\microsoft\office live\npOLW.dll FF - plugin: c:\program files\mozilla firefox\plugins\nppopcaploader.dll FF - plugin: c:\program files\virtools\3d life player\npvirtools.dll FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\ FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} —- FIREFOX POLICIES —- c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true); ============= SERVICES / DRIVERS =============== R1 avfwot;avfwot;c:\windows\system32\drivers\avfwot.sys [2010-2-7 97608] R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2010-2-7 11608] R2 AntiVirFirewallService;Avira Firewall;c:\program files\avira\antivir desktop\avfwsvc.exe [2010-2-7 388865] R2 AntiVirMailService;Avira AntiVir MailGuard;c:\program files\avira\antivir desktop\avmailc.exe [2010-2-7 194817] R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2010-2-7 108289] R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2010-2-7 185089] R2 AntiVirWebService;Avira AntiVir WebGuard;c:\program files\avira\antivir desktop\avwebgrd.exe [2010-2-7 434945] R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2009-5-20 56816] R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [2009-4-3 54752] R2 MotoConnect Service;MotoConnect Service;c:\program files\motorola\motoconnectservice\MotoConnectService.exe [2010-1-15 91392] R3 avfwim;AvFw Packet Filter Miniport;c:\windows\system32\drivers\avfwim.sys [2010-2-7 69632] S2 AntiVirUpgradeService;Avira Upgrade Service;"c:\docume~1\nikki\locals~1\temp\avsetup_4a13c9ff\basic\avupgsvc.exe" /tempstart:""c:\docume~1\nikki\locals~1\temp\avsetup_4a13c9ff\basic\setup.exe" /notempcleanup /crossupgrade" –> c:\docume~1\nikki\locals~1\temp\avsetup_4a13c9ff\basic\avupgsvc.exe [?] S2 pgsql-8.3;PostgreSQL Database Server 8.3;c:\program files\postgresql\8.3\bin\pg_ctl.exe [2008-9-19 65536] S2 TwonkyMedia;TwonkyMedia;c:\program files\nokia\nokia home media server\media server\twonkymedia.exe -serviceversion 0 –> c:\program files\nokia\nokia home media server\media server\TwonkyMedia.exe -serviceversion 0 [?] S3 ADM8511;ADMtek ADM8511/AN986 USB To Fast Ethernet Converter;c:\windows\system32\drivers\ADM8511.SYS [2005-8-31 20160] S3 fsssvc;Windows Live Family Safety Service;c:\program files\windows live\family safety\fsssvc.exe [2009-8-5 704864] S3 Revoflt;Revoflt;c:\windows\system32\drivers\revoflt.sys [2010-2-7 27064] S3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;c:\windows\system32\drivers\wg111v2.sys [2008-4-8 272128] =============== Created Last 30 ================ 2010-03-01 12:04:55 0 d—–w- c:\docume~1\nikki\applic~1\wsInspector 2010-03-01 11:54:27 0 d—–w- c:\program files\Startup Inspector for Windows 2010-02-26 11:16:26 0 d-sha-r- C:\cmdcons 2010-02-26 11:15:23 98816 —-a-w- c:\windows\sed.exe 2010-02-26 11:15:23 77312 —-a-w- c:\windows\MBR.exe 2010-02-26 11:15:23 261632 —-a-w- c:\windows\PEV.exe 2010-02-26 11:15:23 161792 —-a-w- c:\windows\SWREG.exe 2010-02-07 10:19:10 0 d—–w- c:\docume~1\nikki\applic~1\Avira 2010-02-07 09:56:42 97608 —-a-w- c:\windows\system32\drivers\avfwot.sys 2010-02-07 09:56:42 69632 —-a-w- c:\windows\system32\drivers\avfwim.sys 2010-02-07 09:56:28 0 d—–w- c:\program files\Avira 2010-02-07 09:56:28 0 d—–w- c:\docume~1\alluse~1\applic~1\Avira 2010-02-07 08:43:33 27064 —-a-w- c:\windows\system32\drivers\revoflt.sys 2010-02-07 08:35:42 0 d—–w- c:\windows\system32\wbem\Repository ==================== Find3M ==================== 2010-02-07 09:52:56 56816 —-a-w- c:\windows\system32\drivers\avgntflt.sys 2010-01-16 00:53:07 0 —ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf 2010-01-15 10:43:00 0 —ha-w- c:\windows\system32\drivers\Msft_User_PCCSWpdDriver_01_07_00.Wdf 2010-01-15 10:42:52 0 —ha-w- c:\windows\system32\drivers\MsftWdf_user_01_07_00.Wdf 2010-01-15 06:10:56 0 —ha-w- c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01007.Wdf 2010-01-07 06:07:14 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-01-07 06:07:04 19160 —-a-w- c:\windows\system32\drivers\mbam.sys 2009-12-31 16:50:03 353792 —-a-w- c:\windows\system32\drivers\srv.sys 2009-12-21 19:14:05 916480 ——w- c:\windows\system32\wininet.dll 2009-12-17 07:14:00 411368 —-a-w- c:\windows\system32\deploytk.dll 2009-12-16 18:43:27 343040 —-a-w- c:\windows\system32\mspaint.exe 2009-12-14 07:08:23 33280 —-a-w- c:\windows\system32\csrsrv.dll 2009-12-08 19:27:51 2189184 ——w- c:\windows\system32\ntoskrnl.exe 2009-12-08 18:43:50 2066048 ——w- c:\windows\system32\ntkrnlpa.exe 2008-04-27 08:43:40 0 —-a-w- c:\program files\temp01 2006-08-12 00:56:20 3563166 -c–a-w- c:\program files\Propackcodec203b.exe 2004-10-01 05:00:16 40960 —-a-w- c:\program files\Uninstall_CDS.exe 2008-06-06 05:17:35 32768 –sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008060620080607\index.dat ============= FINISH: 22:08:47.85 ===============