[Resolved] Baseline: Google Redirect, many other issues

Hi,

Please help! My computer is a disaster area. I'm having constant Javascript errors, can't hibernate anymore, Google Redirects… to name a few.

My HiJack this log is below

One note though: I have both AVG and McAfee running, which I know can be problematic. I'd really like to uninstall or disable McAfee, but haven't been able to. I looked at your topic on how to do it, but I couldn't get an results (I'm using Security Center 9).

Anyway, I'd really really appreciate some help!

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 5:52:54 PM, on 29/04/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\MPS\mps.exe
C:\Program Files\McAfee\MSK\MskSrver.exe
C:\Program Files\McAfee\MPS\mpsevh.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\Program Files\AVG\AVG9\avgemc.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe
C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\Program Files\McAfee\MSK\MskAgent.exe
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe
C:\WINDOWS\PixArt\PAC207\Monitor.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\PROGRA~1\AVG\AVG9\avgtray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe
C:\Documents and Settings\Steve Morales\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe
C:\Program Files\Shrink Pic\shrink_pic.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\SYSTEM32\NOTEPAD.EXE
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Trend Micro\HijackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.ca/ig/dell?hl=en&client=dell-row&channel=ca&ibd=5080218
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cbc.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.ca/ig/dell?hl=en&client=dell-row&channel=ca&ibd=5080218
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://127.0.0.1:4664/first_usage&s=G9…rF9iyHhC91WVlo0
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe"
O4 - HKLM\..\Run: [PDVDDXSrv] "C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
O4 - HKLM\..\Run: [MskAgentexe] C:\Program Files\McAfee\MSK\MskAgent.exe
O4 - HKLM\..\Run: [ECenter] C:\Dell\E-Center\EULALauncher.exe
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [Media Codec Update Service] C:\Program Files\Essentials Codec Pack\update.exe -silent
O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe"
O4 - HKLM\..\Run: [PAC207_Monitor] C:\WINDOWS\PixArt\PAC207\Monitor.exe
O4 - HKLM\..\Run: [Monitor] C:\WINDOWS\PixArt\PAC207\Monitor.exe
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [Advanced SystemCare 3] "C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe" /startup
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Steve Morales\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-18\..\RunOnce: [RealUpgradeHelper] "c:\program files\real\realplayer\converter\Update\upgrdhlp.exe" "RealNetworks|RealConverter|1.0" (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RealUpgradeHelper] "c:\program files\real\realplayer\converter\Update\upgrdhlp.exe" "RealNetworks|RealConverter|1.0" (User 'Default user')
O4 - Startup: Shrink Pic.lnk = C:\Program Files\Shrink Pic\shrink_pic.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: McAfee Security Scan Plus.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)
O20 - Winlogon Notify: g_lock - g_lock.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: AVG Free E-mail Scanner (avg9emc) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgemc.exe
O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\PROGRA~1\McAfee\MPS\mps.exe
O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe

–
End of file - 14092 bytes

Hi McMurphy,

Done, done, done. Thanks for your advice on removing McAfee. If I can help you deal with Nurse Ratched or anything else, let me know!

Here's the info you asked for:

DDS.txt (The program told me to zip and attach, but you just said attach, so I did. Hope that's okay)


DDS (Ver_10-03-17.01) - NTFSx86
Run by [removed] at 23:11:45.23 on 29/04/2010
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_20
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2037.1182 [GMT -4:00]


============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
svchost.exe
svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\Program Files\AVG\AVG9\avgemc.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe
C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe
C:\WINDOWS\PixArt\PAC207\Monitor.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\PROGRA~1\AVG\AVG9\avgtray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe
C:\Documents and Settings\Steve Morales\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe
C:\Program Files\Shrink Pic\shrink_pic.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Steve Morales\My Documents\Downloads\dds(2).scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.cbc.ca/
uDefault_Page_URL = www.google.ca/ig/dell?hl=en&client=dell-row&channel=ca&ibd=5080218
uSearch Bar =
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = hxxp://127.0.0.1:4664/first_usage&s=G9n3MPPA3HPOrF9iyHhC91WVlo0
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\googletoolbar1.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.4.4525.1752\swg.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar1.dll
uRun: [DellSupportCenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P DellSupportCenter
uRun: [MsnMsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRun: [BitTorrent DNA] "c:\program files\dna\btdna.exe"
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRun: [Advanced SystemCare 3] "c:\program files\iobit\advanced systemcare 3\AWC.exe" /startup
uRun: [Google Update] "c:\documents and settings\steve morales\local settings\application data\google\update\GoogleUpdate.exe" /c
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [Alcmtr] ALCMTR.EXE
mRun: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\ISUSPM.exe -startup
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [RoxioDragToDisc] "c:\program files\roxio\drag-to-disc\DrgToDsc.exe"
mRun: [PDVDDXSrv] "c:\program files\cyberlink\powerdvd dx\PDVDDXSrv.exe"
mRun: [ECenter] c:\dell\e-center\EULALauncher.exe
mRun: [dscactivate] "c:\program files\dell support center\gs_agent\custom\dsca.exe"
mRun: [Media Codec Update Service] c:\program files\essentials codec pack\update.exe -silent
mRun: [DellSupportCenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P DellSupportCenter
mRun: [SSBkgdUpdate] "c:\program files\common files\scansoft shared\ssbkgdupdate\SSBkgdupdate.exe" -Embedding -boot
mRun: [OpwareSE4] "c:\program files\scansoft\omnipagese4\OpwareSE4.exe"
mRun: [PAC207_Monitor] c:\windows\pixart\pac207\Monitor.exe
mRun: [Monitor] c:\windows\pixart\pac207\Monitor.exe
mRun: [Ad-Watch] c:\program files\lavasoft\ad-aware\AAWTray.exe
mRun: [AdobeCS4ServiceManager] "c:\program files\common files\adobe\cs4servicemanager\CS4ServiceManager.exe" -launchedbylogin
mRun: [AVG9_TRAY] c:\progra~1\avg\avg9\avgtray.exe
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
dRunOnce: [RealUpgradeHelper] "c:\program files\real\realplayer\converter\update\upgrdhlp.exe" "RealNetworks|RealConverter|1.0"
StartupFolder: c:\docume~1\stevem~1\startm~1\programs\startup\shrink~1.lnk - c:\program files\shrink pic\shrink_pic.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\mcafee~1.lnk - c:\program files\mcafee security scan\2.0.181\SSScheduler.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE
uPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office10\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBC} - c:\program files\java\jre6\bin\jp2iexp.dll
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll
Notify: avgrsstarter - avgrsstx.dll
Notify: g_lock - g_lock.dll
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\stevem~1\applic~1\mozilla\firefox\profiles\mi8umkzd.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://cbc.ca/news
FF - component: c:\documents and settings\steve morales\application data\mozilla\firefox\profiles\mi8umkzd.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - component: c:\program files\avg\avg9\firefox\components\avgssff.dll
FF - plugin: c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\mozillaplugins\nprphtml5videoshim.dll
FF - plugin: c:\documents and settings\steve morales\local settings\application data\google\update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\google\google updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\microsoft\office live\npOLW.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npbittorrent.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

—- FIREFOX POLICIES —-
FF - user.js: dom.disable_open_during_load - false // Popupblocker control handled by McAfee Privacy Service
FF - user.js: google.toolbar.linkdoctor.enabled - false
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-4-25 64160]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-5-19 216200]
R1 AvgMfx86;AVG On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2008-5-19 29512]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-5-19 242896]
R2 avg9emc;AVG Free E-mail Scanner;c:\program files\avg\avg9\avgemc.exe [2010-3-16 916760]
R2 avg9wd;AVG Free WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2010-3-16 308064]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-3-9 1029456]
S3 IKFileSec;File Security Driver;c:\windows\system32\drivers\ikfilesec.sys [2008-3-1 42376]
S3 IKSysFlt;System Filter Driver;c:\windows\system32\drivers\iksysflt.sys [2008-3-1 66952]
S3 IKSysSec;System Security Driver;c:\windows\system32\drivers\iksyssec.sys [2008-3-1 81288]
S3 jnv4_mib;jnv4_mib;\??\c:\docume~1\stevem~1\locals~1\temp\jnv4_mib.sys –> c:\docume~1\stevem~1\locals~1\temp\jnv4_mib.sys [?]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\mcafee security scan\2.0.181\McCHSvc.exe [2010-1-15 227232]
S3 PAC207;PC Camer@;c:\windows\system32\drivers\PFC027.SYS [2009-4-13 618112]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\spyware doctor\pctsAuxs.exe [2008-3-1 747912]
S3 sdCoreService;PC Tools Security Service;c:\program files\spyware doctor\pctsSvc.exe [2008-3-1 948616]

=============== Created Last 30 ================

2010-04-29 19:26:50 0 d—–w- c:\program files\iPod
2010-04-29 19:26:20 0 d—–w- c:\program files\iTunes
2010-04-29 19:09:00 0 d—–w- c:\program files\Bonjour
2010-04-28 04:01:17 0 d—–w- c:\documents and settings\all users\AdobeTemp
2010-04-27 14:46:01 0 d—–w- c:\docume~1\stevem~1\applic~1\Malwarebytes
2010-04-27 14:45:40 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-27 14:45:37 20824 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-04-27 14:45:37 0 d—–w- c:\docume~1\alluse~1\applic~1\Malwarebytes
2010-04-27 14:45:36 0 d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-04-27 13:31:11 0 d—–w- c:\program files\Trend Micro
2010-04-25 01:23:13 0 d—–w- c:\docume~1\alluse~1\applic~1\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-04-24 00:30:58 411368 —-a-w- c:\windows\system32\deployJava1.dll
2010-04-23 17:56:25 0 d—–w- c:\docume~1\alluse~1\applic~1\McAfee Security Scan
2010-04-23 17:56:02 0 d—–w- c:\program files\McAfee Security Scan
2010-04-19 19:45:40 0 d—–w- c:\program files\TrendMicro
2010-04-18 01:28:29 116224 —-a-w- c:\windows\system32\dllcache\xrxwiadr.dll
2010-04-18 01:28:24 23040 —-a-w- c:\windows\system32\dllcache\xrxwbtmp.dll
2010-04-18 01:28:23 18944 —-a-w- c:\windows\system32\dllcache\xrxscnui.dll
2010-04-18 01:28:18 27648 —-a-w- c:\windows\system32\dllcache\xrxftplt.exe
2010-04-18 01:28:13 4608 —-a-w- c:\windows\system32\dllcache\xrxflnch.exe
2010-04-18 01:28:05 99865 —-a-w- c:\windows\system32\dllcache\xlog.exe
2010-04-18 01:28:05 28288 —-a-w- c:\windows\system32\dllcache\xjis.nls
2010-04-18 01:28:00 16970 —-a-w- c:\windows\system32\dllcache\xem336n5.sys
2010-04-18 01:27:58 19455 —-a-w- c:\windows\system32\dllcache\wvchntxx.sys
2010-04-18 01:27:53 12063 —-a-w- c:\windows\system32\dllcache\wsiintxx.sys
2010-04-18 01:27:50 8192 —-a-w- c:\windows\system32\dllcache\wshirda.dll
2010-04-18 01:27:33 8832 —-a-w- c:\windows\system32\dllcache\wmiacpi.sys
2010-04-18 01:27:29 154624 —-a-w- c:\windows\system32\dllcache\wlluc48.sys
2010-04-18 01:27:24 34890 —-a-w- c:\windows\system32\dllcache\wlandrv2.sys
2010-04-18 01:27:13 771581 —-a-w- c:\windows\system32\dllcache\winacisa.sys
2010-04-18 01:27:06 53760 —-a-w- c:\windows\system32\dllcache\wiamsmud.dll
2010-04-18 01:27:00 87040 —-a-w- c:\windows\system32\dllcache\wiafbdrv.dll
2010-04-18 01:25:59 604253 —-a-w- c:\windows\system32\dllcache\vmodem.sys
2010-04-18 01:25:54 249402 —-a-w- c:\windows\system32\dllcache\vinwm.sys
2010-04-18 01:25:48 24576 —-a-w- c:\windows\system32\dllcache\viairda.sys
2010-04-18 01:25:38 687999 —-a-w- c:\windows\system32\dllcache\usrwdxjs.sys
2010-04-18 01:25:32 765884 —-a-w- c:\windows\system32\dllcache\usrti.sys
2010-04-18 01:25:25 113762 —-a-w- c:\windows\system32\dllcache\usrpda.sys
2010-04-18 01:25:20 7556 —-a-w- c:\windows\system32\dllcache\usroslba.sys
2010-04-18 01:25:15 224802 —-a-w- c:\windows\system32\dllcache\usr1807a.sys
2010-04-18 01:25:10 794399 —-a-w- c:\windows\system32\dllcache\usr1806v.sys
2010-04-18 01:25:05 793598 —-a-w- c:\windows\system32\dllcache\usr1806.sys
2010-04-18 01:25:00 794654 —-a-w- c:\windows\system32\dllcache\usr1801.sys
2010-04-18 01:23:58 216064 —-a-w- c:\windows\system32\dllcache\um34scan.dll
2010-04-18 01:23:52 11520 —-a-w- c:\windows\system32\dllcache\twotrack.sys
2010-04-18 01:23:51 14336 —-a-w- c:\windows\system32\dllcache\tsprof.exe
2010-04-18 01:23:44 166784 —-a-w- c:\windows\system32\dllcache\tridxpm.sys
2010-04-18 01:23:39 525568 —-a-w- c:\windows\system32\dllcache\tridxp.dll
2010-04-18 01:23:34 159232 —-a-w- c:\windows\system32\dllcache\tridkbm.sys
2010-04-18 01:23:30 440576 —-a-w- c:\windows\system32\dllcache\tridkb.dll
2010-04-18 01:23:25 222336 —-a-w- c:\windows\system32\dllcache\trid3dm.sys
2010-04-18 01:23:20 315520 —-a-w- c:\windows\system32\dllcache\trid3d.dll
2010-04-18 01:23:14 34375 —-a-w- c:\windows\system32\dllcache\tpro4.sys
2010-04-18 01:23:09 42496 —-a-w- c:\windows\system32\dllcache\tp4res.dll
2010-04-18 01:23:08 82944 —-a-w- c:\windows\system32\dllcache\tp4mon.exe
2010-04-18 01:23:03 31744 —-a-w- c:\windows\system32\dllcache\tp4.dll
2010-04-18 01:21:58 172768 —-a-w- c:\windows\system32\dllcache\t2r4disp.dll
2010-04-18 01:21:49 94293 —-a-w- c:\windows\system32\dllcache\sxports.dll
2010-04-18 01:21:45 103936 —-a-w- c:\windows\system32\dllcache\sx.sys
2010-04-18 01:21:40 3968 —-a-w- c:\windows\system32\dllcache\swusbflt.sys
2010-04-18 01:21:37 10240 —-a-w- c:\windows\system32\dllcache\swpidflt.dll
2010-04-18 01:21:32 10240 —-a-w- c:\windows\system32\dllcache\swpdflt2.dll
2010-04-18 01:21:28 53760 —-a-w- c:\windows\system32\dllcache\sw_wheel.dll
2010-04-18 01:21:23 41472 —-a-w- c:\windows\system32\dllcache\sw_effct.dll
2010-04-18 01:21:17 155648 —-a-w- c:\windows\system32\dllcache\stlnprop.dll
2010-04-18 01:21:13 53248 —-a-w- c:\windows\system32\dllcache\stlncoin.dll
2010-04-18 01:21:08 285760 —-a-w- c:\windows\system32\dllcache\stlnata.sys
2010-04-18 01:21:03 16896 —-a-w- c:\windows\system32\dllcache\stcusb.sys
2010-04-18 01:19:57 7040 —-a-w- c:\windows\system32\dllcache\snyaitmc.sys
2010-04-18 01:18:59 28160 —-a-w- c:\windows\system32\dllcache\sm91w.dll
2010-04-18 01:17:49 161568 —-a-w- c:\windows\system32\dllcache\sgsmusb.sys
2010-04-18 01:17:45 18400 —-a-w- c:\windows\system32\dllcache\sgsmld.sys
2010-04-18 01:17:40 98080 —-a-w- c:\windows\system32\dllcache\sgiulnt5.sys
2010-04-18 01:17:36 386560 —-a-w- c:\windows\system32\dllcache\sgiul50.dll
2010-04-18 01:17:32 36480 —-a-w- c:\windows\system32\dllcache\sfmanm.sys
2010-04-18 01:17:23 6784 —-a-w- c:\windows\system32\dllcache\serscan.sys
2010-04-18 01:17:19 17664 —-a-w- c:\windows\system32\dllcache\sermouse.sys
2010-04-18 01:17:18 26112 —-a-w- c:\windows\system32\dllcache\EXCH_seos.dll
2010-04-18 01:17:12 6912 —-a-w- c:\windows\system32\dllcache\seaddsmc.sys
2010-04-18 01:17:11 11520 —-a-w- c:\windows\system32\dllcache\scsiscan.sys
2010-04-18 01:17:06 11648 —-a-w- c:\windows\system32\dllcache\scsiprnt.sys
2010-04-18 01:17:05 57856 —-a-w- c:\windows\system32\dllcache\EXCH_scripto.dll
2010-04-18 01:17:00 17280 —-a-w- c:\windows\system32\dllcache\scr111.sys
2010-04-18 01:16:56 16640 —-a-w- c:\windows\system32\dllcache\scmstcs.sys
2010-04-18 01:16:50 23936 —-a-w- c:\windows\system32\dllcache\sccmusbm.sys
2010-04-18 01:16:45 23936 —-a-w- c:\windows\system32\dllcache\sccmn50m.sys
2010-04-18 01:16:43 43904 —-a-w- c:\windows\system32\dllcache\sbp2port.sys
2010-04-18 01:16:38 495616 —-a-w- c:\windows\system32\dllcache\sblfx.dll
2010-04-18 01:16:29 75392 —-a-w- c:\windows\system32\dllcache\s3savmxm.sys
2010-04-18 01:16:25 245632 —-a-w- c:\windows\system32\dllcache\s3savmx.dll
2010-04-18 01:16:21 77824 —-a-w- c:\windows\system32\dllcache\s3sav4m.sys
2010-04-18 01:16:17 198400 —-a-w- c:\windows\system32\dllcache\s3sav4.dll
2010-04-18 01:16:12 61504 —-a-w- c:\windows\system32\dllcache\s3sav3dm.sys
2010-04-18 01:16:09 179264 —-a-w- c:\windows\system32\dllcache\s3sav3d.dll
2010-04-18 01:16:05 210496 —-a-w- c:\windows\system32\dllcache\s3mvirge.dll
2010-04-18 01:14:57 79104 —-a-w- c:\windows\system32\dllcache\rocket.sys
2010-04-18 01:14:51 37563 —-a-w- c:\windows\system32\dllcache\rlnet5.sys
2010-04-18 01:14:45 86097 —-a-w- c:\windows\system32\dllcache\reslog32.dll
2010-04-18 01:14:44 23040 —-a-w- c:\windows\system32\dllcache\EXCH_regtrace.exe
2010-04-18 01:14:44 14848 —-a-w- c:\windows\system32\dllcache\register.exe
2010-04-18 01:14:25 19584 —-a-w- c:\windows\system32\dllcache\rasirda.sys
2010-04-18 01:14:12 714762 —-a-w- c:\windows\system32\dllcache\r2mdmkxx.sys
2010-04-18 01:14:08 899146 —-a-w- c:\windows\system32\dllcache\r2mdkxga.sys
2010-04-18 01:14:03 41472 —-a-w- c:\windows\system32\dllcache\qvusd.dll
2010-04-18 01:12:59 8832 —-a-w- c:\windows\system32\dllcache\powerfil.sys
2010-04-18 01:11:58 86016 —-a-w- c:\windows\system32\dllcache\pctspk.exe
2010-04-18 01:10:59 116736 —-a-w- c:\windows\system32\dllcache\ovcodec2.dll
2010-04-18 01:10:55 31872 —-a-w- c:\windows\system32\dllcache\ovce.sys
2010-04-18 01:10:50 28032 —-a-w- c:\windows\system32\dllcache\ovcd.sys
2010-04-18 01:10:46 48000 —-a-w- c:\windows\system32\dllcache\ovcam2.sys
2010-04-18 01:10:42 25088 —-a-w- c:\windows\system32\dllcache\ovca.sys
2010-04-18 01:10:37 54186 —-a-w- c:\windows\system32\dllcache\otcsercb.sys
2010-04-18 01:10:33 43689 —-a-w- c:\windows\system32\dllcache\otceth5.sys
2010-04-18 01:10:30 27209 —-a-w- c:\windows\system32\dllcache\otc06x5.sys
2010-04-18 01:10:24 54528 —-a-w- c:\windows\system32\dllcache\opl3sax.sys
2010-04-18 01:10:20 61696 —-a-w- c:\windows\system32\dllcache\ohci1394.sys
2010-04-18 01:10:11 198144 —-a-w- c:\windows\system32\dllcache\nv3.sys
2010-04-18 01:10:07 123776 —-a-w- c:\windows\system32\dllcache\nv3.dll
2010-04-18 01:08:59 27936 —-a-w- c:\windows\system32\dllcache\n9i3d.sys
2010-04-18 01:07:59 49024 —-a-w- c:\windows\system32\dllcache\mstape.sys
2010-04-18 01:07:52 12416 —-a-w- c:\windows\system32\dllcache\msriffwv.sys
2010-04-18 01:07:41 2944 —-a-w- c:\windows\system32\dllcache\msmpu401.sys
2010-04-18 01:07:39 22016 —-a-w- c:\windows\system32\dllcache\msircomm.sys
2010-04-18 01:07:38 98304 —-a-w- c:\windows\system32\dllcache\msir3jp.dll
2010-04-18 01:07:38 1875968 —-a-w- c:\windows\system32\dllcache\msir3jp.lex
2010-04-18 01:07:27 35200 —-a-w- c:\windows\system32\dllcache\msgame.sys
2010-04-18 01:07:22 6016 —-a-w- c:\windows\system32\dllcache\msfsio.sys
2010-04-18 01:07:22 56832 —-a-w- c:\windows\system32\dllcache\msdvbnp.ax
2010-04-18 01:07:21 51200 —-a-w- c:\windows\system32\dllcache\msdv.sys
2010-04-18 01:07:13 15232 —-a-w- c:\windows\system32\dllcache\mpe.sys
2010-04-18 01:07:02 16128 —-a-w- c:\windows\system32\dllcache\modemcsa.sys
2010-04-18 01:05:58 802683 —-a-w- c:\windows\system32\dllcache\ltsm.sys
2010-04-18 01:04:59 5632 —-a-w- c:\windows\system32\dllcache\kbdusa.dll
2010-04-18 01:03:51 45632 —-a-w- c:\windows\system32\dllcache\ip5515.sys
2010-04-18 01:02:57 91136 —-a-w- c:\windows\system32\dllcache\icam4com.dll
2010-04-18 01:01:57 44863 —-a-w- c:\windows\system32\dllcache\hsf_soar.sys
2010-04-18 01:00:58 165888 —-a-w- c:\windows\system32\dllcache\hpgt53.dll
2010-04-18 00:59:58 59136 —-a-w- c:\windows\system32\dllcache\gckernel.sys
2010-04-18 00:58:59 71680 —-a-w- c:\windows\system32\dllcache\fnfilter.dll
2010-04-18 00:57:57 63360 —-a-w- c:\windows\system32\dllcache\ess.sys
2010-04-18 00:56:58 70174 —-a-w- c:\windows\system32\dllcache\el98xn5.sys
2010-04-18 00:55:59 952007 —-a-w- c:\windows\system32\dllcache\diwan.sys
2010-04-18 00:54:59 25600 —-a-w- c:\windows\system32\dllcache\dc210_32.dll
2010-04-18 00:53:59 272640 —-a-w- c:\windows\system32\dllcache\cinemclc.sys
2010-04-18 00:52:59 66082 —-a-w- c:\windows\system32\dllcache\c_1147.nls
2010-04-18 00:51:59 75136 —-a-w- c:\windows\system32\dllcache\atimpae.sys
2010-04-18 00:50:32 66048 —-a-w- c:\windows\system32\dllcache\s3legacy.dll
2010-04-18 00:28:54 0 d—–w- c:\docume~1\alluse~1\applic~1\IObit
2010-04-12 18:23:27 53056 —-a-w- c:\docume~1\stevem~1\applic~1\GDIPFONTCACHEV1.DAT
2010-04-12 18:20:40 0 d—–w- c:\program files\MSECache
2010-04-08 17:20:02 91424 —-a-w- c:\windows\system32\dnssd.dll
2010-04-08 17:20:02 107808 —-a-w- c:\windows\system32\dns-sd.exe
2010-04-07 04:20:27 552 —-a-w- c:\windows\system32\d3d8caps.dat
2010-04-07 04:01:04 0 d—–w- C:\My Music
2010-04-06 20:08:22 96704 —-a-w- c:\windows\system32\e7d25e28.exe

==================== Find3M ====================

2010-04-21 15:15:54 242896 —-a-w- c:\windows\system32\drivers\avgtdix.sys
2010-04-06 20:33:37 39912 —ha-w- c:\windows\system32\mlfcache.dat
2010-04-06 20:06:09 96512 —-a-w- c:\windows\system32\drivers\atapi.sys
2010-04-06 20:06:09 96512 —-a-w- c:\windows\system32\dllcache\atapi.sys
2010-03-17 02:43:36 12464 —-a-w- c:\windows\system32\avgrsstx.dll
2010-03-17 02:39:38 216200 —-a-w- c:\windows\system32\drivers\avgldx86.sys
2010-03-13 23:25:16 15688 —-a-w- c:\windows\system32\lsdelete.exe

============= FINISH: 23:14:15.18 ===============

Heya,

I wasn't sure if you meant I should attach the combofix log or just post it, do I'm doing the latter.

As to your question, it's running way better! I can hibernate, I'm not having that annoying Javascript error and no more google redirects. What a relief. I thought my PC might be well and truly f@#ked up.

I find it so stupid and irritating that there are people out there creating carp** like this just to inconvenience or scam people, so it's nice to know there are some good people fighting back. Thanks for your help.




ComboFix 10-04-30.01 - Steve 30/04/2010 19:15:52.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2037.1465 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\dantes.com.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Start Menu\Programs\PC Camer@
c:\documents and settings\All Users\Start Menu\Programs\PC Camer@ \Amcap.lnk
c:\documents and settings\All Users\Start Menu\Programs\PC Camer@ \Uninstall.lnk
c:\documents and settings\Steve\Application Data\inst.exe
c:\program files\IEToolbar
c:\windows\desktop
c:\windows\desktop\Play Rogue Squadron.lnk
c:\windows\system32\logs
c:\windows\system32\logs\Settings.dat

Infected copy of c:\windows\system32\drivers\atapi.sys was found and disinfected
Restored copy from - Kitty had a snack
.
original MBR restored successfully !
.
((((((((((((((((((((((((( Files Created from 2010-03-28 to 2010-04-30 )))))))))))))))))))))))))))))))
.

2010-04-29 21:52 . 2010-04-29 21:52 388096 —-a-r- c:\documents and settings\Steve\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-04-29 20:53 . 2010-04-29 20:53 ——– d—–w- c:\program files\ERUNT
2010-04-29 19:26 . 2010-04-29 19:26 ——– d—–w- c:\program files\iPod
2010-04-29 19:26 . 2010-04-29 19:28 ——– d—–w- c:\program files\iTunes
2010-04-29 19:09 . 2010-04-29 19:09 ——– d—–w- c:\program files\Bonjour
2010-04-29 19:05 . 2010-04-29 19:05 73000 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.1.1.12\SetupAdmin.exe
2010-04-28 04:01 . 2010-04-28 04:02 ——– d—–w- c:\documents and settings\All Users\AdobeTemp
2010-04-27 14:46 . 2010-04-27 14:46 ——– d—–w- c:\documents and settings\Steve\Application Data\Malwarebytes
2010-04-27 14:45 . 2010-03-30 04:46 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-27 14:45 . 2010-04-27 14:45 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-04-27 14:45 . 2010-03-30 04:45 20824 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-04-27 14:45 . 2010-04-27 14:45 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-04-27 13:31 . 2010-04-27 13:31 ——– d—–w- c:\program files\Trend Micro
2010-04-25 01:23 . 2010-04-25 01:24 ——– d—–w- c:\documents and settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-04-25 01:16 . 2010-04-25 01:17 ——– d—–w- c:\program files\QuickTime
2010-04-24 00:30 . 2010-04-12 21:29 411368 —-a-w- c:\windows\system32\deployJava1.dll
2010-04-23 17:56 . 2010-04-23 17:56 ——– d—–w- c:\documents and settings\All Users\Application Data\McAfee Security Scan
2010-04-23 17:56 . 2010-04-26 18:52 ——– d—–w- c:\program files\McAfee Security Scan
2010-04-21 15:16 . 2010-04-21 15:16 242696 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgtdix.sys
2010-04-21 15:10 . 2010-04-21 15:10 1689952 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgupd.dll
2010-04-20 14:17 . 2010-04-29 01:29 ——– d—–w- c:\documents and settings\Steve\Local Settings\Application Data\Temp
2010-04-19 19:45 . 2010-04-19 19:45 ——– d—–w- c:\program files\TrendMicro
2010-04-18 01:28 . 2008-04-14 00:12 116224 —-a-w- c:\windows\system32\dllcache\xrxwiadr.dll
2010-04-18 01:28 . 2001-08-18 02:36 23040 —-a-w- c:\windows\system32\dllcache\xrxwbtmp.dll
2010-04-18 01:28 . 2008-04-14 00:12 18944 —-a-w- c:\windows\system32\dllcache\xrxscnui.dll
2010-04-18 01:28 . 2001-08-18 02:37 27648 —-a-w- c:\windows\system32\dllcache\xrxftplt.exe
2010-04-18 01:28 . 2001-08-18 02:37 4608 —-a-w- c:\windows\system32\dllcache\xrxflnch.exe
2010-04-18 01:28 . 2001-08-18 02:37 99865 —-a-w- c:\windows\system32\dllcache\xlog.exe
2010-04-18 01:28 . 2001-08-17 16:11 16970 —-a-w- c:\windows\system32\dllcache\xem336n5.sys
2010-04-18 01:27 . 2004-08-04 02:29 19455 —-a-w- c:\windows\system32\dllcache\wvchntxx.sys
2010-04-18 01:27 . 2004-08-04 02:29 12063 —-a-w- c:\windows\system32\dllcache\wsiintxx.sys
2010-04-18 01:27 . 2008-04-14 00:12 8192 —-a-w- c:\windows\system32\dllcache\wshirda.dll
2010-04-18 01:27 . 2008-04-13 18:36 8832 —-a-w- c:\windows\system32\dllcache\wmiacpi.sys
2010-04-18 01:27 . 2004-08-04 02:31 154624 —-a-w- c:\windows\system32\dllcache\wlluc48.sys
2010-04-18 01:27 . 2001-08-17 16:12 34890 —-a-w- c:\windows\system32\dllcache\wlandrv2.sys
2010-04-18 01:27 . 2001-08-17 17:28 771581 —-a-w- c:\windows\system32\dllcache\winacisa.sys
2010-04-18 01:27 . 2001-08-18 02:36 53760 —-a-w- c:\windows\system32\dllcache\wiamsmud.dll
2010-04-18 01:27 . 2001-08-18 02:36 87040 —-a-w- c:\windows\system32\dllcache\wiafbdrv.dll
2010-04-18 01:25 . 2001-08-17 17:28 604253 —-a-w- c:\windows\system32\dllcache\vmodem.sys
2010-04-18 01:25 . 2001-08-17 16:14 249402 —-a-w- c:\windows\system32\dllcache\vinwm.sys
2010-04-18 01:25 . 2001-08-17 17:49 24576 —-a-w- c:\windows\system32\dllcache\viairda.sys
2010-04-18 01:25 . 2001-08-17 17:28 687999 —-a-w- c:\windows\system32\dllcache\usrwdxjs.sys
2010-04-18 01:25 . 2001-08-17 17:28 765884 —-a-w- c:\windows\system32\dllcache\usrti.sys
2010-04-18 01:25 . 2001-08-17 17:28 113762 —-a-w- c:\windows\system32\dllcache\usrpda.sys
2010-04-18 01:25 . 2001-08-17 17:28 7556 —-a-w- c:\windows\system32\dllcache\usroslba.sys
2010-04-18 01:25 . 2001-08-17 17:28 224802 —-a-w- c:\windows\system32\dllcache\usr1807a.sys
2010-04-18 01:25 . 2001-08-17 17:28 794399 —-a-w- c:\windows\system32\dllcache\usr1806v.sys
2010-04-18 01:25 . 2001-08-17 17:28 793598 —-a-w- c:\windows\system32\dllcache\usr1806.sys
2010-04-18 01:25 . 2001-08-17 17:28 794654 —-a-w- c:\windows\system32\dllcache\usr1801.sys
2010-04-18 01:23 . 2001-08-18 02:36 216064 —-a-w- c:\windows\system32\dllcache\um34scan.dll
2010-04-18 01:23 . 2001-08-17 17:48 11520 —-a-w- c:\windows\system32\dllcache\twotrack.sys
2010-04-18 01:23 . 2004-08-04 11:00 14336 —-a-w- c:\windows\system32\dllcache\tsprof.exe
2010-04-18 01:23 . 2001-08-17 16:51 166784 —-a-w- c:\windows\system32\dllcache\tridxpm.sys
2010-04-18 01:23 . 2001-08-18 02:36 525568 —-a-w- c:\windows\system32\dllcache\tridxp.dll
2010-04-18 01:23 . 2001-08-17 16:51 159232 —-a-w- c:\windows\system32\dllcache\tridkbm.sys
2010-04-18 01:23 . 2001-08-17 18:56 440576 —-a-w- c:\windows\system32\dllcache\tridkb.dll
2010-04-18 01:23 . 2001-08-17 16:51 222336 —-a-w- c:\windows\system32\dllcache\trid3dm.sys
2010-04-18 01:23 . 2001-08-17 18:56 315520 —-a-w- c:\windows\system32\dllcache\trid3d.dll
2010-04-18 01:23 . 2001-08-17 16:12 34375 —-a-w- c:\windows\system32\dllcache\tpro4.sys
2010-04-18 01:23 . 2001-08-18 02:35 42496 —-a-w- c:\windows\system32\dllcache\tp4res.dll
2010-04-18 01:23 . 2008-04-14 00:12 82944 —-a-w- c:\windows\system32\dllcache\tp4mon.exe
2010-04-18 01:23 . 2001-08-18 02:36 31744 —-a-w- c:\windows\system32\dllcache\tp4.dll
2010-04-18 01:21 . 2001-08-17 18:56 172768 —-a-w- c:\windows\system32\dllcache\t2r4disp.dll
2010-04-18 01:21 . 2001-08-18 02:36 94293 —-a-w- c:\windows\system32\dllcache\sxports.dll
2010-04-18 01:21 . 2001-08-17 17:50 103936 —-a-w- c:\windows\system32\dllcache\sx.sys
2010-04-18 01:21 . 2001-08-17 18:02 3968 —-a-w- c:\windows\system32\dllcache\swusbflt.sys
2010-04-18 01:21 . 2001-08-18 02:36 10240 —-a-w- c:\windows\system32\dllcache\swpidflt.dll
2010-04-18 01:21 . 2001-08-18 02:36 10240 —-a-w- c:\windows\system32\dllcache\swpdflt2.dll
2010-04-18 01:21 . 2001-08-18 02:36 53760 —-a-w- c:\windows\system32\dllcache\sw_wheel.dll
2010-04-18 01:21 . 2001-08-18 02:36 41472 —-a-w- c:\windows\system32\dllcache\sw_effct.dll
2010-04-18 01:21 . 2001-08-18 02:36 155648 —-a-w- c:\windows\system32\dllcache\stlnprop.dll
2010-04-18 01:21 . 2001-08-18 02:36 53248 —-a-w- c:\windows\system32\dllcache\stlncoin.dll
2010-04-18 01:21 . 2001-08-17 16:18 285760 —-a-w- c:\windows\system32\dllcache\stlnata.sys
2010-04-18 01:21 . 2001-08-17 17:51 16896 —-a-w- c:\windows\system32\dllcache\stcusb.sys
2010-04-18 01:19 . 2001-08-17 17:53 7040 —-a-w- c:\windows\system32\dllcache\snyaitmc.sys
2010-04-18 01:18 . 2001-08-18 02:36 28160 —-a-w- c:\windows\system32\dllcache\sm91w.dll
2010-04-18 01:17 . 2001-07-21 18:29 161568 —-a-w- c:\windows\system32\dllcache\sgsmusb.sys
2010-04-18 01:17 . 2001-07-21 18:29 18400 —-a-w- c:\windows\system32\dllcache\sgsmld.sys
2010-04-18 01:17 . 2001-08-17 16:51 98080 —-a-w- c:\windows\system32\dllcache\sgiulnt5.sys
2010-04-18 01:17 . 2001-08-18 02:36 386560 —-a-w- c:\windows\system32\dllcache\sgiul50.dll
2010-04-18 01:17 . 2001-08-17 16:19 36480 —-a-w- c:\windows\system32\dllcache\sfmanm.sys
2010-04-18 01:17 . 2001-08-17 17:53 6784 —-a-w- c:\windows\system32\dllcache\serscan.sys
2010-04-18 01:17 . 2001-08-17 17:48 17664 —-a-w- c:\windows\system32\dllcache\sermouse.sys
2010-04-18 01:17 . 2001-08-18 02:36 26112 —-a-w- c:\windows\system32\dllcache\EXCH_seos.dll
2010-04-18 01:17 . 2001-08-17 17:53 6912 —-a-w- c:\windows\system32\dllcache\seaddsmc.sys
2010-04-18 01:17 . 2008-04-13 18:45 11520 —-a-w- c:\windows\system32\dllcache\scsiscan.sys
2010-04-18 01:17 . 2001-08-17 17:52 11648 —-a-w- c:\windows\system32\dllcache\scsiprnt.sys
2010-04-18 01:17 . 2001-08-18 02:36 57856 —-a-w- c:\windows\system32\dllcache\EXCH_scripto.dll
2010-04-18 01:17 . 2001-08-17 17:51 17280 —-a-w- c:\windows\system32\dllcache\scr111.sys
2010-04-18 01:16 . 2001-08-17 17:51 16640 —-a-w- c:\windows\system32\dllcache\scmstcs.sys
2010-04-18 01:16 . 2001-08-17 17:51 23936 —-a-w- c:\windows\system32\dllcache\sccmusbm.sys
2010-04-18 01:16 . 2001-08-17 17:51 23936 —-a-w- c:\windows\system32\dllcache\sccmn50m.sys
2010-04-18 01:16 . 2008-04-13 18:40 43904 —-a-w- c:\windows\system32\dllcache\sbp2port.sys
2010-04-18 01:16 . 2001-08-18 02:36 495616 —-a-w- c:\windows\system32\dllcache\sblfx.dll
2010-04-18 01:16 . 2001-08-17 16:50 75392 —-a-w- c:\windows\system32\dllcache\s3savmxm.sys
2010-04-18 01:16 . 2001-08-17 18:56 245632 —-a-w- c:\windows\system32\dllcache\s3savmx.dll
2010-04-18 01:16 . 2001-08-17 16:50 77824 —-a-w- c:\windows\system32\dllcache\s3sav4m.sys
2010-04-18 01:16 . 2001-08-17 18:56 198400 —-a-w- c:\windows\system32\dllcache\s3sav4.dll
2010-04-18 01:16 . 2001-08-17 16:50 61504 —-a-w- c:\windows\system32\dllcache\s3sav3dm.sys
2010-04-18 01:16 . 2001-08-17 18:56 179264 —-a-w- c:\windows\system32\dllcache\s3sav3d.dll
2010-04-18 01:16 . 2001-08-17 18:56 210496 —-a-w- c:\windows\system32\dllcache\s3mvirge.dll
2010-04-18 01:14 . 2008-04-13 18:40 79104 —-a-w- c:\windows\system32\dllcache\rocket.sys
2010-04-18 01:14 . 2001-08-17 16:12 37563 —-a-w- c:\windows\system32\dllcache\rlnet5.sys
2010-04-18 01:14 . 2001-08-18 02:36 86097 —-a-w- c:\windows\system32\dllcache\reslog32.dll
2010-04-18 01:14 . 2004-08-04 11:00 14848 —-a-w- c:\windows\system32\dllcache\register.exe
2010-04-18 01:14 . 2001-08-18 02:36 23040 —-a-w- c:\windows\system32\dllcache\EXCH_regtrace.exe
2010-04-18 01:14 . 2001-08-17 17:51 19584 —-a-w- c:\windows\system32\dllcache\rasirda.sys
2010-04-18 01:14 . 2001-08-17 17:28 714762 —-a-w- c:\windows\system32\dllcache\r2mdmkxx.sys
2010-04-18 01:14 . 2001-08-17 17:28 899146 —-a-w- c:\windows\system32\dllcache\r2mdkxga.sys
2010-04-18 01:14 . 2001-08-18 02:36 41472 —-a-w- c:\windows\system32\dllcache\qvusd.dll
2010-04-18 01:12 . 2008-04-13 18:40 8832 —-a-w- c:\windows\system32\dllcache\powerfil.sys
2010-04-18 01:11 . 2001-08-18 02:36 86016 —-a-w- c:\windows\system32\dllcache\pctspk.exe
2010-04-18 01:10 . 2001-08-18 02:36 116736 —-a-w- c:\windows\system32\dllcache\ovcodec2.dll
2010-04-18 01:10 . 2001-08-17 18:05 31872 —-a-w- c:\windows\system32\dllcache\ovce.sys
2010-04-18 01:10 . 2001-08-17 18:05 28032 —-a-w- c:\windows\system32\dllcache\ovcd.sys
2010-04-18 01:10 . 2001-08-17 18:05 48000 —-a-w- c:\windows\system32\dllcache\ovcam2.sys
2010-04-18 01:10 . 2001-08-17 18:05 25088 —-a-w- c:\windows\system32\dllcache\ovca.sys
2010-04-18 01:10 . 2001-08-17 17:28 54186 —-a-w- c:\windows\system32\dllcache\otcsercb.sys
2010-04-18 01:10 . 2001-08-17 16:12 43689 —-a-w- c:\windows\system32\dllcache\otceth5.sys
2010-04-18 01:10 . 2001-08-17 16:12 27209 —-a-w- c:\windows\system32\dllcache\otc06x5.sys
2010-04-18 01:10 . 2001-08-17 16:20 54528 —-a-w- c:\windows\system32\dllcache\opl3sax.sys
2010-04-18 01:10 . 2008-04-13 18:46 61696 —-a-w- c:\windows\system32\dllcache\ohci1394.sys
2010-04-18 01:10 . 2001-08-17 16:50 198144 —-a-w- c:\windows\system32\dllcache\nv3.sys
2010-04-18 01:10 . 2001-08-18 02:36 123776 —-a-w- c:\windows\system32\dllcache\nv3.dll
2010-04-18 01:08 . 2001-08-17 16:50 27936 —-a-w- c:\windows\system32\dllcache\n9i3d.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-30 23:14 . 2008-10-11 00:36 ——– d—–w- c:\documents and settings\Steve\Application Data\shrink_pic
2010-04-30 23:13 . 2009-04-25 22:34 ——– d—–w- c:\documents and settings\Steve\Application Data\DNA
2010-04-30 22:09 . 2009-04-25 22:34 ——– d—–w- c:\program files\DNA
2010-04-30 22:07 . 2008-03-02 03:24 ——– d—–w- c:\documents and settings\All Users\Application Data\Google Updater
2010-04-30 18:45 . 2008-03-02 03:55 ——– d—–w- c:\documents and settings\Steve\Application Data\LimeWire
2010-04-29 19:26 . 2008-12-06 18:14 ——– d—–w- c:\program files\Common Files\Apple
2010-04-28 16:59 . 2008-02-18 16:20 ——– d—–w- c:\program files\Common Files\Adobe
2010-04-27 13:32 . 2008-03-02 03:41 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-04-27 05:32 . 2009-04-25 22:39 ——– d—–w- c:\documents and settings\Steve\Application Data\BitTorrent
2010-04-26 14:49 . 2008-12-06 18:16 ——– d—–w- c:\documents and settings\Steve\Application Data\Apple Computer
2010-04-24 23:47 . 2008-02-18 16:11 ——– d—–w- c:\program files\Java
2010-04-21 15:48 . 2008-03-02 03:40 ——– d—–w- c:\program files\Spyware Doctor
2010-04-21 15:15 . 2008-05-19 23:22 242896 —-a-w- c:\windows\system32\drivers\avgtdix.sys
2010-04-18 00:42 . 2010-01-31 01:26 ——– d—–w- c:\documents and settings\Steve\Application Data\IObit
2010-04-16 04:15 . 2009-02-03 18:25 1324 —-a-w- c:\windows\system32\d3d9caps.dat
2010-04-13 01:57 . 2008-02-25 17:54 53056 —-a-w- c:\documents and settings\Steve\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-04-07 23:32 . 2008-02-18 16:11 ——– d—–w- c:\program files\Common Files\Java
2010-04-07 20:39 . 2009-07-30 18:40 ——– d—–w- c:\documents and settings\All Users\Application Data\FLEXnet
2010-04-07 20:39 . 2009-07-30 03:39 ——– d—–w- c:\program files\MagicDVDCopier
2010-04-07 20:39 . 2008-03-02 03:55 ——– d—–w- c:\program files\LimeWire
2010-04-06 20:33 . 2010-03-14 18:42 39912 —ha-w- c:\windows\system32\mlfcache.dat
2010-04-06 20:06 . 2004-08-04 04:59 96512 —-a-w- c:\windows\system32\drivers\atapi.sys
2010-03-27 04:06 . 2010-03-22 00:49 ——– d—–w- c:\program files\EMDB
2010-03-21 21:03 . 2010-03-21 21:03 ——– d—–w- c:\program files\Free M4a to MP3 Converter
2010-03-20 16:20 . 2010-03-20 16:20 45056 —-a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimwmp.dll
2010-03-20 16:20 . 2010-03-20 16:20 45056 —-a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimswf.dll
2010-03-20 16:20 . 2010-03-20 16:20 45056 —-a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimrp.dll
2010-03-20 16:20 . 2010-03-20 16:20 45056 —-a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimqt.dll
2010-03-20 16:20 . 2010-03-20 16:20 49152 —-a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext\Components\nprpffbrowserrecordext.dll
2010-03-20 16:20 . 2010-03-20 16:20 40960 —-a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Chrome\Hook\rpchromebrowserrecordhelper.dll
2010-03-20 16:20 . 2010-03-20 16:20 308808 —-a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Common\rpmainbrowserrecordplugin.dll
2010-03-20 16:20 . 2010-03-20 16:20 14848 —-a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
2010-03-20 16:20 . 2010-03-20 16:20 341600 —-a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
2010-03-20 16:20 . 2008-03-02 03:49 ——– d—–w- c:\program files\Common Files\Real
2010-03-20 16:19 . 2008-03-02 03:49 ——– d—–w- c:\program files\Real
2010-03-20 16:18 . 2010-03-20 16:18 ——– d—–w- c:\program files\Common Files\xing shared
2010-03-20 15:26 . 2010-03-14 22:32 ——– d—–w- c:\documents and settings\All Users\Application Data\avg9
2010-03-17 02:43 . 2010-03-17 02:43 12464 —-a-w- c:\windows\system32\avgrsstx.dll
2010-03-17 02:43 . 2008-05-19 23:22 29512 —-a-w- c:\windows\system32\drivers\avgmfx86.sys
2010-03-17 02:39 . 2008-05-19 23:22 216200 —-a-w- c:\windows\system32\drivers\avgldx86.sys
2010-03-14 22:32 . 2008-05-19 23:22 ——– d—–w- c:\program files\AVG
2010-03-14 03:25 . 2010-03-14 03:24 ——– d—–w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2010-03-13 23:25 . 2009-07-06 22:23 315736 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\threatwork.exe
2010-03-13 23:25 . 2009-07-11 22:31 25440 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\savapibridge.dll
2010-03-13 23:25 . 2009-07-06 22:23 173408 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lavamessage.dll
2010-03-13 23:25 . 2009-06-06 22:39 15688 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lsdelete.exe
2010-03-13 23:25 . 2009-04-26 15:13 15688 —-a-w- c:\windows\system32\lsdelete.exe
2010-03-13 23:25 . 2009-07-06 22:23 350544 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lavalicense.dll
2010-03-13 23:25 . 2009-07-06 22:23 303456 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\UpdateManager.dll
2010-03-13 23:25 . 2009-07-06 22:23 89952 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\ShellExt.dll
2010-03-13 23:25 . 2009-07-06 22:23 1630560 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Resources.dll
2010-03-13 23:24 . 2009-07-06 22:23 254832 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\RPAPI.dll
2010-03-13 23:24 . 2009-07-06 22:23 45408 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\PrivacyClean.dll
2010-03-13 23:24 . 2009-07-06 22:23 671592 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\CEAPI.dll
2010-03-13 23:24 . 2009-09-26 22:20 3701760 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AutoLaunch.exe
2010-03-13 23:24 . 2009-07-06 22:23 566648 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareCommand.exe
2010-03-13 23:24 . 2009-07-06 22:23 567144 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareAdmin.exe
2010-03-13 23:24 . 2009-07-06 22:22 2357064 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-Aware.exe
2010-03-13 23:24 . 2009-07-06 22:22 524632 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWTray.exe
2010-03-13 23:24 . 2009-07-06 22:22 1029456 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWService.exe
2009-09-25 16:41 . 2009-09-25 16:41 1044480 —-a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-09-25 16:41 . 2009-09-25 16:41 200704 —-a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2009-05-21 206064]
"MsnMsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2009-11-12 323392]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-02-18 68856]
"Google Update"="c:\documents and settings\Steve\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2010-04-20 136176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-07-17 142104]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-07-17 162584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-07-17 138008]
"RTHDCPL"="RTHDCPL.EXE" [2007-07-17 16132608]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2006-10-03 221184]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-16 81920]
"RoxioDragToDisc"="c:\program files\Roxio\Drag-to-Disc\DrgToDsc.exe" [2006-08-17 1116920]
"PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2006-10-20 118784]
"ECenter"="c:\dell\E-Center\EULALauncher.exe" [2007-05-24 17920]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384]
"Media Codec Update Service"="c:\program files\Essentials Codec Pack\update.exe" [2007-04-08 303104]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2009-05-21 206064]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
"OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4\OpwareSE4.exe" [2007-02-04 79400]
"PAC207_Monitor"="c:\windows\PixArt\PAC207\Monitor.exe" [2007-12-10 323584]
"Monitor"="c:\windows\PixArt\PAC207\Monitor.exe" [2007-12-10 323584]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2010-03-13 524632]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-03-20 202256]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-03-18 421888]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-04-28 142120]

c:\documents and settings\Steve\Start Menu\Programs\Startup\
Shrink Pic.lnk - c:\program files\Shrink Pic\shrink_pic.exe [2008-9-2 3067979]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-2-26 113664]
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2010-03-17 02:43 12464 —-a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dvd43]
2008-04-09 14:00 826880 —-a-w- c:\program files\dvd43\DVD43_Tray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxWatchTray]
2006-11-05 17:22 221184 —-a-w- c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2008-02-18 16:21 68856 —-a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableNotifications"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\EA GAMES\\Medal of Honor Pacific Assault™\\mohpa.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4
"65533:TCP"= 65533:TCP:Services
"52344:TCP"= 52344:TCP:Services
"3498:TCP"= 3498:TCP:Services
"5496:TCP"= 5496:TCP:Services
"3389:TCP"= 3389:TCP:Remote Desktop

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [25/04/2009 6:20 PM 64160]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [19/05/2008 7:22 PM 216200]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [19/05/2008 7:22 PM 242896]
R2 avg9emc;AVG Free E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [16/03/2010 10:39 PM 916760]
R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [16/03/2010 10:43 PM 308064]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [09/03/2009 3:06 PM 1029456]
S3 jnv4_mib;jnv4_mib;\??\c:\docume~1\STEVEM~1\LOCALS~1\Temp\jnv4_mib.sys –> c:\docume~1\STEVEM~1\LOCALS~1\Temp\jnv4_mib.sys [?]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [15/01/2010 8:49 AM 227232]
S3 PAC207;PC Camer@;c:\windows\system32\drivers\PFC027.SYS [13/04/2009 8:05 PM 618112]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [01/03/2008 11:40 PM 747912]
.
Contents of the 'Scheduled Tasks' folder

2010-04-26 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-09 23:24]

2010-04-25 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]

2010-04-30 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-02-18 01:28]

2010-04-30 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2069501699-2217659575-3341200733-1006Core.job
- c:\documents and settings\Steve\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-04-20 14:16]

2010-04-30 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-2069501699-2217659575-3341200733-1006.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 02:09]

2010-04-30 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-2069501699-2217659575-3341200733-1006.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 02:09]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.cbc.ca/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid;=ie7&rls;=com.microsoft:en-US&ie;=utf8&oe;=utf8
uInternet Connection Wizard,ShellNext = hxxp://127.0.0.1:4664/first_usage&s;=G9n3MPPA3HPOrF9iyHhC91WVlo0
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport; to Microsoft Excel - c:\progra~1\MI1933~1\Office10\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Steve\Application Data\Mozilla\Firefox\Profiles\mi8umkzd.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie;=UTF-8&oe;=UTF-8&q;=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://cbc.ca/news
FF - component: c:\documents and settings\Steve\Application Data\Mozilla\Firefox\Profiles\mi8umkzd.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - component: c:\program files\AVG\AVG9\Firefox\components\avgssff.dll
FF - plugin: c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
FF - plugin: c:\documents and settings\Steve\Local Settings\Application Data\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

—- FIREFOX POLICIES —-
FF - user.js: dom.disable_open_during_load - false // Popupblocker control handled by McAfee Privacy Service
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-SunJavaUpdateSched - c:\program files\Java\jre6\bin\jusched.exe
HKU-Default-RunOnce-RealUpgradeHelper - c:\program files\real\realplayer\converter\Update\upgrdhlp.exe
SafeBoot-MCODS



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-30 19:28
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-2069501699-2217659575-3341200733-1006\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:44,94,dc,9c,23,e4,6f,f3,73,a0,8d,34,35,f1,97,bc,67,f0,56,2e,91,6a,fd,
a7,3d,d9,41,51,83,47,6c,80,4e,45,5f,03,96,aa,df,ec,c9,40,ee,9e,2e,4c,4c,5c,\
"??"=hex:31,3a,cf,b2,17,e9,de,72,4c,29,c4,14,af,6d,f3,cf

[HKEY_USERS\S-1-5-21-2069501699-2217659575-3341200733-1006\Software\SecuROM\License information*]
"datasecu"=hex:48,86,96,56,a8,9e,aa,cc,6f,54,87,d8,4f,8d,ca,34,41,1a,f3,93,6c,
22,4b,1a,18,b2,7b,46,bc,06,1a,4f,6f,f4,64,44,94,bb,de,06,4c,71,22,61,85,09,\
"rkeysecu"=hex:2f,0f,d5,3e,02,2b,06,63,b1,0b,dd,b6,71,e2,54,98
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(724)
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
.
Completion time: 2010-04-30 19:32:20
ComboFix-quarantined-files.txt 2010-04-30 23:32

Pre-Run: 51,928,555,520 bytes free
Post-Run: 51,987,800,064 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=AlwaysOff

- - End Of File - - EC5C6E326622F115AF0DB6AA331B7F37

Sorry,

I don't understand how that happened. Second try:

ComboFix 10-04-30.01 - Steve 30/04/2010 20:59:11.2.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2037.1293 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\dantes.com.exe
Command switches used :: c:\documents and settings\Steve\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_JNV4_MIB
——-\Service_jnv4_mib


((((((((((((((((((((((((( Files Created from 2010-04-01 to 2010-05-01 )))))))))))))))))))))))))))))))
.

2010-04-29 20:53 . 2010-04-29 20:53 ——– d—–w- c:\program files\ERUNT
2010-04-29 19:26 . 2010-04-29 19:26 ——– d—–w- c:\program files\iPod
2010-04-29 19:26 . 2010-04-29 19:28 ——– d—–w- c:\program files\iTunes
2010-04-29 19:09 . 2010-04-29 19:09 ——– d—–w- c:\program files\Bonjour
2010-04-28 04:01 . 2010-04-28 04:02 ——– d—–w- c:\documents and settings\All Users\AdobeTemp
2010-04-27 14:46 . 2010-04-27 14:46 ——– d—–w- c:\documents and settings\Steve\Application Data\Malwarebytes
2010-04-27 14:45 . 2010-03-30 04:46 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-27 14:45 . 2010-04-27 14:45 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-04-27 14:45 . 2010-03-30 04:45 20824 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-04-27 14:45 . 2010-04-27 14:45 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-04-27 13:31 . 2010-04-27 13:31 ——– d—–w- c:\program files\Trend Micro
2010-04-25 01:23 . 2010-04-25 01:24 ——– d—–w- c:\documents and settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-04-25 01:16 . 2010-04-25 01:17 ——– d—–w- c:\program files\QuickTime
2010-04-24 00:30 . 2010-04-12 21:29 411368 —-a-w- c:\windows\system32\deployJava1.dll
2010-04-23 17:56 . 2010-04-23 17:56 ——– d—–w- c:\documents and settings\All Users\Application Data\McAfee Security Scan
2010-04-23 17:56 . 2010-04-26 18:52 ——– d—–w- c:\program files\McAfee Security Scan
2010-04-20 14:17 . 2010-04-29 01:29 ——– d—–w- c:\documents and settings\Steve\Local Settings\Application Data\Temp
2010-04-19 19:45 . 2010-04-19 19:45 ——– d—–w- c:\program files\TrendMicro
2010-04-18 01:28 . 2008-04-14 00:12 116224 —-a-w- c:\windows\system32\dllcache\xrxwiadr.dll
2010-04-18 01:28 . 2001-08-18 02:36 23040 —-a-w- c:\windows\system32\dllcache\xrxwbtmp.dll
2010-04-18 01:28 . 2008-04-14 00:12 18944 —-a-w- c:\windows\system32\dllcache\xrxscnui.dll
2010-04-18 01:28 . 2001-08-18 02:37 27648 —-a-w- c:\windows\system32\dllcache\xrxftplt.exe
2010-04-18 01:28 . 2001-08-18 02:37 4608 —-a-w- c:\windows\system32\dllcache\xrxflnch.exe
2010-04-18 01:28 . 2001-08-18 02:37 99865 —-a-w- c:\windows\system32\dllcache\xlog.exe
2010-04-18 01:28 . 2001-08-17 16:11 16970 —-a-w- c:\windows\system32\dllcache\xem336n5.sys
2010-04-18 01:27 . 2004-08-04 02:29 19455 —-a-w- c:\windows\system32\dllcache\wvchntxx.sys
2010-04-18 01:27 . 2004-08-04 02:29 12063 —-a-w- c:\windows\system32\dllcache\wsiintxx.sys
2010-04-18 01:27 . 2008-04-14 00:12 8192 —-a-w- c:\windows\system32\dllcache\wshirda.dll
2010-04-18 01:27 . 2008-04-13 18:36 8832 —-a-w- c:\windows\system32\dllcache\wmiacpi.sys
2010-04-18 01:27 . 2004-08-04 02:31 154624 —-a-w- c:\windows\system32\dllcache\wlluc48.sys
2010-04-18 01:27 . 2001-08-17 16:12 34890 —-a-w- c:\windows\system32\dllcache\wlandrv2.sys
2010-04-18 01:27 . 2001-08-17 17:28 771581 —-a-w- c:\windows\system32\dllcache\winacisa.sys
2010-04-18 01:27 . 2001-08-18 02:36 53760 —-a-w- c:\windows\system32\dllcache\wiamsmud.dll
2010-04-18 01:27 . 2001-08-18 02:36 87040 —-a-w- c:\windows\system32\dllcache\wiafbdrv.dll
2010-04-18 01:25 . 2001-08-17 17:28 604253 —-a-w- c:\windows\system32\dllcache\vmodem.sys
2010-04-18 01:25 . 2001-08-17 16:14 249402 —-a-w- c:\windows\system32\dllcache\vinwm.sys
2010-04-18 01:25 . 2001-08-17 17:49 24576 —-a-w- c:\windows\system32\dllcache\viairda.sys
2010-04-18 01:25 . 2001-08-17 17:28 687999 —-a-w- c:\windows\system32\dllcache\usrwdxjs.sys
2010-04-18 01:25 . 2001-08-17 17:28 765884 —-a-w- c:\windows\system32\dllcache\usrti.sys
2010-04-18 01:25 . 2001-08-17 17:28 113762 —-a-w- c:\windows\system32\dllcache\usrpda.sys
2010-04-18 01:25 . 2001-08-17 17:28 7556 —-a-w- c:\windows\system32\dllcache\usroslba.sys
2010-04-18 01:25 . 2001-08-17 17:28 224802 —-a-w- c:\windows\system32\dllcache\usr1807a.sys
2010-04-18 01:25 . 2001-08-17 17:28 794399 —-a-w- c:\windows\system32\dllcache\usr1806v.sys
2010-04-18 01:25 . 2001-08-17 17:28 793598 —-a-w- c:\windows\system32\dllcache\usr1806.sys
2010-04-18 01:25 . 2001-08-17 17:28 794654 —-a-w- c:\windows\system32\dllcache\usr1801.sys
2010-04-18 01:23 . 2001-08-18 02:36 216064 —-a-w- c:\windows\system32\dllcache\um34scan.dll
2010-04-18 01:23 . 2001-08-17 17:48 11520 —-a-w- c:\windows\system32\dllcache\twotrack.sys
2010-04-18 01:23 . 2004-08-04 11:00 14336 —-a-w- c:\windows\system32\dllcache\tsprof.exe
2010-04-18 01:23 . 2001-08-17 16:51 166784 —-a-w- c:\windows\system32\dllcache\tridxpm.sys
2010-04-18 01:23 . 2001-08-18 02:36 525568 —-a-w- c:\windows\system32\dllcache\tridxp.dll
2010-04-18 01:23 . 2001-08-17 16:51 159232 —-a-w- c:\windows\system32\dllcache\tridkbm.sys
2010-04-18 01:23 . 2001-08-17 18:56 440576 —-a-w- c:\windows\system32\dllcache\tridkb.dll
2010-04-18 01:23 . 2001-08-17 16:51 222336 —-a-w- c:\windows\system32\dllcache\trid3dm.sys
2010-04-18 01:23 . 2001-08-17 18:56 315520 —-a-w- c:\windows\system32\dllcache\trid3d.dll
2010-04-18 01:23 . 2001-08-17 16:12 34375 —-a-w- c:\windows\system32\dllcache\tpro4.sys
2010-04-18 01:23 . 2001-08-18 02:35 42496 —-a-w- c:\windows\system32\dllcache\tp4res.dll
2010-04-18 01:23 . 2008-04-14 00:12 82944 —-a-w- c:\windows\system32\dllcache\tp4mon.exe
2010-04-18 01:23 . 2001-08-18 02:36 31744 —-a-w- c:\windows\system32\dllcache\tp4.dll
2010-04-18 01:21 . 2001-08-17 18:56 172768 —-a-w- c:\windows\system32\dllcache\t2r4disp.dll
2010-04-18 01:21 . 2001-08-18 02:36 94293 —-a-w- c:\windows\system32\dllcache\sxports.dll
2010-04-18 01:21 . 2001-08-17 17:50 103936 —-a-w- c:\windows\system32\dllcache\sx.sys
2010-04-18 01:21 . 2001-08-17 18:02 3968 —-a-w- c:\windows\system32\dllcache\swusbflt.sys
2010-04-18 01:21 . 2001-08-18 02:36 10240 —-a-w- c:\windows\system32\dllcache\swpidflt.dll
2010-04-18 01:21 . 2001-08-18 02:36 10240 —-a-w- c:\windows\system32\dllcache\swpdflt2.dll
2010-04-18 01:21 . 2001-08-18 02:36 53760 —-a-w- c:\windows\system32\dllcache\sw_wheel.dll
2010-04-18 01:21 . 2001-08-18 02:36 41472 —-a-w- c:\windows\system32\dllcache\sw_effct.dll
2010-04-18 01:21 . 2001-08-18 02:36 155648 —-a-w- c:\windows\system32\dllcache\stlnprop.dll
2010-04-18 01:21 . 2001-08-18 02:36 53248 —-a-w- c:\windows\system32\dllcache\stlncoin.dll
2010-04-18 01:21 . 2001-08-17 16:18 285760 —-a-w- c:\windows\system32\dllcache\stlnata.sys
2010-04-18 01:21 . 2001-08-17 17:51 16896 —-a-w- c:\windows\system32\dllcache\stcusb.sys
2010-04-18 01:19 . 2001-08-17 17:53 7040 —-a-w- c:\windows\system32\dllcache\snyaitmc.sys
2010-04-18 01:18 . 2001-08-18 02:36 28160 —-a-w- c:\windows\system32\dllcache\sm91w.dll
2010-04-18 01:17 . 2001-07-21 18:29 161568 —-a-w- c:\windows\system32\dllcache\sgsmusb.sys
2010-04-18 01:17 . 2001-07-21 18:29 18400 —-a-w- c:\windows\system32\dllcache\sgsmld.sys
2010-04-18 01:17 . 2001-08-17 16:51 98080 —-a-w- c:\windows\system32\dllcache\sgiulnt5.sys
2010-04-18 01:17 . 2001-08-18 02:36 386560 —-a-w- c:\windows\system32\dllcache\sgiul50.dll
2010-04-18 01:17 . 2001-08-17 16:19 36480 —-a-w- c:\windows\system32\dllcache\sfmanm.sys
2010-04-18 01:17 . 2001-08-17 17:53 6784 —-a-w- c:\windows\system32\dllcache\serscan.sys
2010-04-18 01:17 . 2001-08-17 17:48 17664 —-a-w- c:\windows\system32\dllcache\sermouse.sys
2010-04-18 01:17 . 2001-08-18 02:36 26112 —-a-w- c:\windows\system32\dllcache\EXCH_seos.dll
2010-04-18 01:17 . 2001-08-17 17:53 6912 —-a-w- c:\windows\system32\dllcache\seaddsmc.sys
2010-04-18 01:17 . 2008-04-13 18:45 11520 —-a-w- c:\windows\system32\dllcache\scsiscan.sys
2010-04-18 01:17 . 2001-08-17 17:52 11648 —-a-w- c:\windows\system32\dllcache\scsiprnt.sys
2010-04-18 01:17 . 2001-08-18 02:36 57856 —-a-w- c:\windows\system32\dllcache\EXCH_scripto.dll
2010-04-18 01:17 . 2001-08-17 17:51 17280 —-a-w- c:\windows\system32\dllcache\scr111.sys
2010-04-18 01:16 . 2001-08-17 17:51 16640 —-a-w- c:\windows\system32\dllcache\scmstcs.sys
2010-04-18 01:16 . 2001-08-17 17:51 23936 —-a-w- c:\windows\system32\dllcache\sccmusbm.sys
2010-04-18 01:16 . 2001-08-17 17:51 23936 —-a-w- c:\windows\system32\dllcache\sccmn50m.sys
2010-04-18 01:16 . 2008-04-13 18:40 43904 —-a-w- c:\windows\system32\dllcache\sbp2port.sys
2010-04-18 01:16 . 2001-08-18 02:36 495616 —-a-w- c:\windows\system32\dllcache\sblfx.dll
2010-04-18 01:16 . 2001-08-17 16:50 75392 —-a-w- c:\windows\system32\dllcache\s3savmxm.sys
2010-04-18 01:16 . 2001-08-17 18:56 245632 —-a-w- c:\windows\system32\dllcache\s3savmx.dll
2010-04-18 01:16 . 2001-08-17 16:50 77824 —-a-w- c:\windows\system32\dllcache\s3sav4m.sys
2010-04-18 01:16 . 2001-08-17 18:56 198400 —-a-w- c:\windows\system32\dllcache\s3sav4.dll
2010-04-18 01:16 . 2001-08-17 16:50 61504 —-a-w- c:\windows\system32\dllcache\s3sav3dm.sys
2010-04-18 01:16 . 2001-08-17 18:56 179264 —-a-w- c:\windows\system32\dllcache\s3sav3d.dll
2010-04-18 01:16 . 2001-08-17 18:56 210496 —-a-w- c:\windows\system32\dllcache\s3mvirge.dll
2010-04-18 01:14 . 2008-04-13 18:40 79104 —-a-w- c:\windows\system32\dllcache\rocket.sys
2010-04-18 01:14 . 2001-08-17 16:12 37563 —-a-w- c:\windows\system32\dllcache\rlnet5.sys
2010-04-18 01:14 . 2001-08-18 02:36 86097 —-a-w- c:\windows\system32\dllcache\reslog32.dll
2010-04-18 01:14 . 2004-08-04 11:00 14848 —-a-w- c:\windows\system32\dllcache\register.exe
2010-04-18 01:14 . 2001-08-18 02:36 23040 —-a-w- c:\windows\system32\dllcache\EXCH_regtrace.exe
2010-04-18 01:14 . 2001-08-17 17:51 19584 —-a-w- c:\windows\system32\dllcache\rasirda.sys
2010-04-18 01:14 . 2001-08-17 17:28 714762 —-a-w- c:\windows\system32\dllcache\r2mdmkxx.sys
2010-04-18 01:14 . 2001-08-17 17:28 899146 —-a-w- c:\windows\system32\dllcache\r2mdkxga.sys
2010-04-18 01:14 . 2001-08-18 02:36 41472 —-a-w- c:\windows\system32\dllcache\qvusd.dll
2010-04-18 01:12 . 2008-04-13 18:40 8832 —-a-w- c:\windows\system32\dllcache\powerfil.sys
2010-04-18 01:11 . 2001-08-18 02:36 86016 —-a-w- c:\windows\system32\dllcache\pctspk.exe
2010-04-18 01:10 . 2001-08-18 02:36 116736 —-a-w- c:\windows\system32\dllcache\ovcodec2.dll
2010-04-18 01:10 . 2001-08-17 18:05 31872 —-a-w- c:\windows\system32\dllcache\ovce.sys
2010-04-18 01:10 . 2001-08-17 18:05 28032 —-a-w- c:\windows\system32\dllcache\ovcd.sys
2010-04-18 01:10 . 2001-08-17 18:05 48000 —-a-w- c:\windows\system32\dllcache\ovcam2.sys
2010-04-18 01:10 . 2001-08-17 18:05 25088 —-a-w- c:\windows\system32\dllcache\ovca.sys
2010-04-18 01:10 . 2001-08-17 17:28 54186 —-a-w- c:\windows\system32\dllcache\otcsercb.sys
2010-04-18 01:10 . 2001-08-17 16:12 43689 —-a-w- c:\windows\system32\dllcache\otceth5.sys
2010-04-18 01:10 . 2001-08-17 16:12 27209 —-a-w- c:\windows\system32\dllcache\otc06x5.sys
2010-04-18 01:10 . 2001-08-17 16:20 54528 —-a-w- c:\windows\system32\dllcache\opl3sax.sys
2010-04-18 01:10 . 2008-04-13 18:46 61696 —-a-w- c:\windows\system32\dllcache\ohci1394.sys
2010-04-18 01:10 . 2001-08-17 16:50 198144 —-a-w- c:\windows\system32\dllcache\nv3.sys
2010-04-18 01:10 . 2001-08-18 02:36 123776 —-a-w- c:\windows\system32\dllcache\nv3.dll
2010-04-18 01:08 . 2001-08-17 16:50 27936 —-a-w- c:\windows\system32\dllcache\n9i3d.sys
2010-04-18 01:07 . 2008-04-13 18:46 49024 —-a-w- c:\windows\system32\dllcache\mstape.sys
2010-04-18 01:07 . 2001-08-17 17:48 12416 —-a-w- c:\windows\system32\dllcache\msriffwv.sys
2010-04-18 01:07 . 2001-08-17 18:00 2944 —-a-w- c:\windows\system32\dllcache\msmpu401.sys
2010-04-18 01:07 . 2008-04-13 18:54 22016 —-a-w- c:\windows\system32\dllcache\msircomm.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-01 01:09 . 2009-04-25 22:34 ——– d—–w- c:\program files\DNA
2010-05-01 01:09 . 2009-04-25 22:34 ——– d—–w- c:\documents and settings\Steve\Application Data\DNA
2010-04-30 23:14 . 2008-10-11 00:36 ——– d—–w- c:\documents and settings\Steve\Application Data\shrink_pic
2010-04-30 22:07 . 2008-03-02 03:24 ——– d—–w- c:\documents and settings\All Users\Application Data\Google Updater
2010-04-30 18:45 . 2008-03-02 03:55 ——– d—–w- c:\documents and settings\Steve\Application Data\LimeWire
2010-04-29 21:52 . 2010-04-29 21:52 388096 —-a-r- c:\documents and settings\Steve\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-04-29 19:26 . 2008-12-06 18:14 ——– d—–w- c:\program files\Common Files\Apple
2010-04-29 19:05 . 2010-04-29 19:05 73000 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.1.1.12\SetupAdmin.exe
2010-04-28 16:59 . 2008-02-18 16:20 ——– d—–w- c:\program files\Common Files\Adobe
2010-04-27 13:32 . 2008-03-02 03:41 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-04-27 05:32 . 2009-04-25 22:39 ——– d—–w- c:\documents and settings\Steve\Application Data\BitTorrent
2010-04-26 14:49 . 2008-12-06 18:16 ——– d—–w- c:\documents and settings\Steve\Application Data\Apple Computer
2010-04-24 23:47 . 2008-02-18 16:11 ——– d—–w- c:\program files\Java
2010-04-21 15:48 . 2008-03-02 03:40 ——– d—–w- c:\program files\Spyware Doctor
2010-04-21 15:16 . 2010-04-21 15:16 242696 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgtdix.sys
2010-04-21 15:15 . 2008-05-19 23:22 242896 —-a-w- c:\windows\system32\drivers\avgtdix.sys
2010-04-21 15:10 . 2010-04-21 15:10 1689952 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgupd.dll
2010-04-18 00:42 . 2010-01-31 01:26 ——– d—–w- c:\documents and settings\Steve\Application Data\IObit
2010-04-16 04:15 . 2009-02-03 18:25 1324 —-a-w- c:\windows\system32\d3d9caps.dat
2010-04-13 01:57 . 2008-02-25 17:54 53056 —-a-w- c:\documents and settings\Steve\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-04-07 23:32 . 2008-02-18 16:11 ——– d—–w- c:\program files\Common Files\Java
2010-04-07 23:31 . 2010-04-07 23:31 503808 —-a-w- c:\documents and settings\Steve\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-62b0b70f-n\msvcp71.dll
2010-04-07 23:31 . 2010-04-07 23:31 499712 —-a-w- c:\documents and settings\Steve\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-62b0b70f-n\jmc.dll
2010-04-07 23:31 . 2010-04-07 23:31 348160 —-a-w- c:\documents and settings\Steve\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-62b0b70f-n\msvcr71.dll
2010-04-07 23:31 . 2010-04-07 23:31 61440 —-a-w- c:\documents and settings\Steve\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-4b88e58a-n\decora-sse.dll
2010-04-07 23:31 . 2010-04-07 23:31 12800 —-a-w- c:\documents and settings\Steve\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-4b88e58a-n\decora-d3d.dll
2010-04-07 20:39 . 2009-07-30 18:40 ——– d—–w- c:\documents and settings\All Users\Application Data\FLEXnet
2010-04-07 20:39 . 2009-07-30 03:39 ——– d—–w- c:\program files\MagicDVDCopier
2010-04-07 20:39 . 2008-03-02 03:55 ——– d—–w- c:\program files\LimeWire
2010-04-07 16:11 . 2010-04-07 16:11 4255072 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgcorex.dll
2010-04-06 20:33 . 2010-03-14 18:42 39912 —ha-w- c:\windows\system32\mlfcache.dat
2010-04-06 20:06 . 2004-08-04 04:59 96512 —-a-w- c:\windows\system32\drivers\atapi.sys
2010-04-02 14:02 . 2010-04-02 14:02 4076824 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgui.exe
2010-04-02 14:02 . 2010-04-02 14:02 2059544 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgtray.exe
2010-04-02 14:02 . 2010-04-02 14:02 1598744 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgssie.dll
2010-04-02 14:02 . 2010-04-02 14:02 1274136 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgfrw.exe
2010-04-02 14:02 . 2010-04-02 14:02 598296 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgsrmx.dll
2010-04-02 14:02 . 2010-04-02 14:02 313112 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avglogx.dll
2010-04-02 14:02 . 2010-04-02 14:02 1515224 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgwd.dll
2010-04-02 14:02 . 2010-04-02 14:02 556824 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgchjwx.dll
2010-04-02 14:02 . 2010-04-02 14:02 459544 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgcclix.dll
2010-04-02 14:02 . 2010-04-02 14:02 301336 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgchclx.dll
2010-04-02 14:02 . 2010-04-02 14:02 1086744 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgchsvx.exe
2010-04-01 17:59 . 2010-04-01 17:59 1035032 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgupd.exe
2010-03-27 04:06 . 2010-03-22 00:49 ——– d—–w- c:\program files\EMDB
2010-03-26 14:33 . 2010-04-07 04:12 1496064 —-a-w- c:\documents and settings\Steve\Application Data\Mozilla\Firefox\Profiles\mi8umkzd.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
2010-03-26 14:33 . 2010-04-07 04:12 43008 —-a-w- c:\documents and settings\Steve\Application Data\Mozilla\Firefox\Profiles\mi8umkzd.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbarloader.dll
2010-03-26 14:33 . 2010-04-07 04:12 339456 —-a-w- c:\documents and settings\Steve\Application Data\Mozilla\Firefox\Profiles\mi8umkzd.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff2.dll
2010-03-26 14:32 . 2010-04-07 04:12 346112 —-a-w- c:\documents and settings\Steve\Application Data\Mozilla\Firefox\Profiles\mi8umkzd.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff3.dll
2010-03-21 21:03 . 2010-03-21 21:03 ——– d—–w- c:\program files\Free M4a to MP3 Converter
2010-03-20 16:20 . 2010-03-20 16:20 45056 —-a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimwmp.dll
2010-03-20 16:20 . 2010-03-20 16:20 45056 —-a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimswf.dll
2010-03-20 16:20 . 2010-03-20 16:20 45056 —-a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimrp.dll
2010-03-20 16:20 . 2010-03-20 16:20 45056 —-a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimqt.dll
2010-03-20 16:20 . 2010-03-20 16:20 49152 —-a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext\Components\nprpffbrowserrecordext.dll
2010-03-20 16:20 . 2010-03-20 16:20 40960 —-a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Chrome\Hook\rpchromebrowserrecordhelper.dll
2010-03-20 16:20 . 2010-03-20 16:20 308808 —-a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Common\rpmainbrowserrecordplugin.dll
2010-03-20 16:20 . 2010-03-20 16:20 14848 —-a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
2010-03-20 16:20 . 2010-03-20 16:20 341600 —-a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
2010-03-20 16:20 . 2008-03-02 03:49 ——– d—–w- c:\program files\Common Files\Real
2010-03-20 16:19 . 2008-03-02 03:49 ——– d—–w- c:\program files\Real
2010-03-20 16:18 . 2010-03-20 16:18 ——– d—–w- c:\program files\Common Files\xing shared
2010-03-20 15:26 . 2010-03-14 22:32 ——– d—–w- c:\documents and settings\All Users\Application Data\avg9
2010-03-17 02:43 . 2010-03-17 02:43 12464 —-a-w- c:\windows\system32\avgrsstx.dll
2010-03-17 02:43 . 2008-05-19 23:22 29512 —-a-w- c:\windows\system32\drivers\avgmfx86.sys
2010-03-17 02:39 . 2008-05-19 23:22 216200 —-a-w- c:\windows\system32\drivers\avgldx86.sys
2010-03-14 22:32 . 2008-05-19 23:22 ——– d—–w- c:\program files\AVG
2010-03-14 03:25 . 2010-03-14 03:24 ——– d—–w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2010-03-13 23:25 . 2009-07-06 22:23 315736 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\threatwork.exe
2010-03-13 23:25 . 2009-07-11 22:31 25440 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\savapibridge.dll
2010-03-13 23:25 . 2009-07-06 22:23 173408 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lavamessage.dll
2010-03-13 23:25 . 2009-06-06 22:39 15688 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lsdelete.exe
2010-03-13 23:25 . 2009-04-26 15:13 15688 —-a-w- c:\windows\system32\lsdelete.exe
2010-03-13 23:25 . 2009-07-06 22:23 350544 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lavalicense.dll
2010-03-13 23:25 . 2009-07-06 22:23 303456 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\UpdateManager.dll
2010-03-13 23:25 . 2009-07-06 22:23 89952 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\ShellExt.dll
2010-03-13 23:25 . 2009-07-06 22:23 1630560 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Resources.dll
2010-03-13 23:24 . 2009-07-06 22:23 254832 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\RPAPI.dll
2010-03-13 23:24 . 2009-07-06 22:23 45408 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\PrivacyClean.dll
2010-03-13 23:24 . 2009-07-06 22:23 671592 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\CEAPI.dll
2010-03-13 23:24 . 2009-09-26 22:20 3701760 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AutoLaunch.exe
2010-03-13 23:24 . 2009-07-06 22:23 566648 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareCommand.exe
2010-03-13 23:24 . 2009-07-06 22:23 567144 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareAdmin.exe
2010-03-13 23:24 . 2009-07-06 22:22 2357064 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-Aware.exe
2010-03-13 23:24 . 2009-07-06 22:22 524632 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWTray.exe
2010-03-13 23:24 . 2009-07-06 22:22 1029456 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWService.exe
2009-09-25 16:41 . 2009-09-25 16:41 1044480 —-a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-09-25 16:41 . 2009-09-25 16:41 200704 —-a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2009-05-21 206064]
"MsnMsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2009-11-12 323392]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-02-18 68856]
"Google Update"="c:\documents and settings\Steve\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2010-04-20 136176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-07-17 142104]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-07-17 162584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-07-17 138008]
"RTHDCPL"="RTHDCPL.EXE" [2007-07-17 16132608]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2006-10-03 221184]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-16 81920]
"RoxioDragToDisc"="c:\program files\Roxio\Drag-to-Disc\DrgToDsc.exe" [2006-08-17 1116920]
"PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2006-10-20 118784]
"ECenter"="c:\dell\E-Center\EULALauncher.exe" [2007-05-24 17920]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384]
"Media Codec Update Service"="c:\program files\Essentials Codec Pack\update.exe" [2007-04-08 303104]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2009-05-21 206064]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
"OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4\OpwareSE4.exe" [2007-02-04 79400]
"PAC207_Monitor"="c:\windows\PixArt\PAC207\Monitor.exe" [2007-12-10 323584]
"Monitor"="c:\windows\PixArt\PAC207\Monitor.exe" [2007-12-10 323584]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2010-03-13 524632]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-03-20 202256]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-03-18 421888]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-04-28 142120]

c:\documents and settings\Steve\Start Menu\Programs\Startup\
Shrink Pic.lnk - c:\program files\Shrink Pic\shrink_pic.exe [2008-9-2 3067979]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-2-26 113664]
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2010-03-17 02:43 12464 —-a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dvd43]
2008-04-09 14:00 826880 —-a-w- c:\program files\dvd43\DVD43_Tray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxWatchTray]
2006-11-05 17:22 221184 —-a-w- c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2008-02-18 16:21 68856 —-a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableNotifications"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\EA GAMES\\Medal of Honor Pacific Assault™\\mohpa.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4
"65533:TCP"= 65533:TCP:Services
"52344:TCP"= 52344:TCP:Services
"3498:TCP"= 3498:TCP:Services
"5496:TCP"= 5496:TCP:Services
"3389:TCP"= 3389:TCP:Remote Desktop

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [25/04/2009 6:20 PM 64160]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [19/05/2008 7:22 PM 216200]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [19/05/2008 7:22 PM 242896]
R2 avg9emc;AVG Free E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [16/03/2010 10:39 PM 916760]
R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [16/03/2010 10:43 PM 308064]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [09/03/2009 3:06 PM 1029456]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [15/01/2010 8:49 AM 227232]
S3 PAC207;PC Camer@;c:\windows\system32\drivers\PFC027.SYS [13/04/2009 8:05 PM 618112]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [01/03/2008 11:40 PM 747912]
.
Contents of the 'Scheduled Tasks' folder

2010-04-26 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-09 23:24]

2010-04-25 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]

2010-05-01 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-02-18 01:28]

2010-04-30 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2069501699-2217659575-3341200733-1006Core.job
- c:\documents and settings\Steve\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-04-20 14:16]

2010-05-01 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-2069501699-2217659575-3341200733-1006.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 02:09]

2010-04-30 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-2069501699-2217659575-3341200733-1006.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 02:09]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.cbc.ca/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = hxxp://127.0.0.1:4664/first_usage&s=G9n3MPPA3HPOrF9iyHhC91WVlo0
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\Office10\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Steve\Application Data\Mozilla\Firefox\Profiles\mi8umkzd.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://cbc.ca/news
FF - component: c:\documents and settings\Steve\Application Data\Mozilla\Firefox\Profiles\mi8umkzd.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - component: c:\program files\AVG\AVG9\Firefox\components\avgssff.dll
FF - plugin: c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
FF - plugin: c:\documents and settings\Steve\Local Settings\Application Data\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

—- FIREFOX POLICIES —-
FF - user.js: dom.disable_open_during_load - false // Popupblocker control handled by McAfee Privacy Service
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-30 21:08
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-2069501699-2217659575-3341200733-1006\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:44,94,dc,9c,23,e4,6f,f3,73,a0,8d,34,35,f1,97,bc,67,f0,56,2e,91,6a,fd,
a7,3d,d9,41,51,83,47,6c,80,4e,45,5f,03,96,aa,df,ec,c9,40,ee,9e,2e,4c,4c,5c,\
"??"=hex:31,3a,cf,b2,17,e9,de,72,4c,29,c4,14,af,6d,f3,cf

[HKEY_USERS\S-1-5-21-2069501699-2217659575-3341200733-1006\Software\SecuROM\License information*]
"datasecu"=hex:48,86,96,56,a8,9e,aa,cc,6f,54,87,d8,4f,8d,ca,34,41,1a,f3,93,6c,
22,4b,1a,18,b2,7b,46,bc,06,1a,4f,6f,f4,64,44,94,bb,de,06,4c,71,22,61,85,09,\
"rkeysecu"=hex:2f,0f,d5,3e,02,2b,06,63,b1,0b,dd,b6,71,e2,54,98
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(728)
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll

- - - - - - - > 'explorer.exe'(2044)
c:\windows\system32\WININET.dll
c:\program files\Shrink Pic\shrinkpici.dll
c:\program files\ScanSoft\OmniPageSE4\OpHookSE4.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\Roxio\Drag-to-Disc\Shellex.dll
c:\windows\system32\DLAAPI_W.DLL
c:\windows\system32\CDRTC.DLL
c:\program files\Roxio\Drag-to-Disc\ShellRes.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\program files\AVG\AVG9\avgchsvx.exe
c:\program files\AVG\AVG9\avgrsx.exe
c:\program files\AVG\AVG9\avgcsrvx.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Dell Support Center\bin\sprtsvc.exe
c:\program files\AVG\AVG9\avgnsx.exe
c:\program files\AVG\AVG9\avgcsrvx.exe
c:\windows\system32\wbem\unsecapp.exe
c:\windows\system32\igfxsrvc.exe
c:\windows\RTHDCPL.EXE
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2010-04-30 21:22:27 - machine was rebooted
ComboFix-quarantined-files.txt 2010-05-01 01:22
ComboFix2.txt 2010-04-30 23:32

Pre-Run: 51,971,465,216 bytes free
Post-Run: 51,820,158,976 bytes free

- - End Of File - - DAC0D6D95B13FC5D503FD1E9E6D1818D