help....unknown sypware issue

Hello zacr

Thanks for the log.

Please do the following:

• Please make all files and folders VISIBLE:
  
  
  
  • Click "Start" Go to My Computer-> Tools-> Folder Options-> View tab:
  • Choose to "Show hidden files and folders."
  • Uncheck the "Hide protected operating system files" and the "Hide extensions for know file types" boxes.
  • Close the window with "OK".
  
  
• Please scan the following files
  
  
  
  • Please visit Virus Total by clicking here.
  • Click the Browse button and search for the following file (if present): C:\WINDOWS\system32\drivers\wneeu.sys
  • Click Open.
  • Then click Send File.
  • Please be patient while the file is scanned.
  • If Virus Total tells you that the file has already been scanned, click "reanalyse now".
  • Please provide the results from the scan in your next reply.
  
  
• TDSS Killer
  
  
  
  • Download TDSSKiller and save it to your Desktop.
  • Extract the file and run it.
  • Once completed it will create a log in your C:\ drive called TDSSKiller_* (* denotes version & date)
  • Please post the contents of the TDSSKiller log.
  
  Please provide the Virus Total Scan and the TDSSKiller log in your next reply.

ok…here it is….

ComboFix 10-06-23.05 - zacr 24/06/2010 7:29.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3070.2477 [GMT -6:00]
Running from: e:\resolve\zacr.exe
Command switches used :: c:\documents and settings\zacr\Desktop\CFScript.txt
AV: AVG Anti-Virus *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

file zipped: c:\windows\Mvukecava.dat
file zipped: c:\windows\Qcunezakobo.bin
file zipped: c:\windows\system32\drivers\wneeu.sys
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\Mvukecava.dat
c:\windows\Qcunezakobo.bin
c:\windows\system32\drivers\wneeu.sys
.
—- Previous Run ——-
.
c:\documents and settings\zacr\Application Data\chrtmp
c:\documents and settings\zacr\Local Settings\Application Data\{A460926E-F5E9-41F7-9B64-F03315ECDFAF}
c:\documents and settings\zacr\Local Settings\Application Data\{A460926E-F5E9-41F7-9B64-F03315ECDFAF}\chrome.manifest
c:\documents and settings\zacr\Local Settings\Application Data\{A460926E-F5E9-41F7-9B64-F03315ECDFAF}\chrome\content\_cfg.js
c:\documents and settings\zacr\Local Settings\Application Data\{A460926E-F5E9-41F7-9B64-F03315ECDFAF}\chrome\content\overlay.xul
c:\documents and settings\zacr\Local Settings\Application Data\{A460926E-F5E9-41F7-9B64-F03315ECDFAF}\install.rdf
c:\windows\system32\Data

.
((((((((((((((((((((((((( Files Created from 2010-05-24 to 2010-06-24 )))))))))))))))))))))))))))))))
.

2010-06-24 04:18 . 2010-05-06 10:41 743424 -c—-w- c:\windows\system32\dllcache\iedvtool.dll
2010-06-22 14:38 . 2010-06-22 14:38 242896 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\avg9\update\backup\avgtdix.sys
2010-06-22 14:38 . 2010-06-22 14:38 216200 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\avg9\update\backup\avgldx86.sys
2010-06-22 14:38 . 2010-06-22 14:38 12536 —-a-w- c:\windows\system32\avgrsstx.dll
2010-06-22 14:37 . 2010-06-22 14:37 813336 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\avg9\update\backup\avginet.dll
2010-06-22 14:37 . 2010-06-22 14:37 624920 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\avg9\update\backup\avgiproxy.exe
2010-06-22 14:37 . 2010-06-22 14:37 1690464 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\avg9\update\backup\avgupd.dll
2010-06-22 14:37 . 2010-06-22 14:37 1038688 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\avg9\update\backup\avgupd.exe
2010-06-21 13:46 . 2010-06-21 13:46 ——– d—–w- C:\zacr
2010-06-21 02:12 . 2010-06-21 02:12 16 —-a-w- c:\windows\popcinfo.dat
2010-06-19 16:48 . 2010-06-23 01:29 ——– d—–w- c:\documents and settings\zacr\Application Data\CLOUDY
2010-06-19 13:58 . 2010-06-19 13:58 388096 —-a-r- c:\documents and settings\zacr\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-06-19 04:27 . 2010-06-19 04:31 ——– d—–w- c:\documents and settings\zacr\Application Data\QuickScan
2010-06-19 04:27 . 2010-05-31 22:34 702120 —-a-w- c:\documents and settings\zacr\Application Data\Mozilla\Firefox\Profiles\x7axhqgf.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll
2010-06-19 04:27 . 2010-05-31 22:34 868456 —-a-w- c:\documents and settings\zacr\Application Data\Mozilla\Firefox\Profiles\x7axhqgf.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
2010-06-16 13:53 . 2010-06-16 13:53 ——– d—–w- c:\program files\Common Files\AnswerWorks 4.0
2010-06-16 13:53 . 2010-06-16 13:53 ——– d—–w- c:\program files\Common Files\Intuit
2010-06-16 13:53 . 2010-06-17 04:16 ——– d—–w- c:\program files\QuickTax 2008
2010-06-12 02:09 . 2010-06-12 02:09 ——– d—–w- c:\program files\Lost in the City
2010-06-12 02:09 . 2010-06-12 02:09 ——– d—–w- c:\windows\Lost in the City
2010-06-08 01:31 . 2010-06-08 01:31 ——– d—–w- c:\program files\MagicISO
2010-06-05 14:26 . 2010-06-05 14:26 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\F-Secure
2010-06-05 13:42 . 2010-06-05 13:42 ——– d—–w- c:\documents and settings\NetworkService.NT AUTHORITY\Local Settings\Application Data\Adobe
2010-06-03 12:32 . 2010-04-29 21:39 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-06-03 12:32 . 2010-04-29 21:39 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-06-02 13:22 . 2010-06-02 13:22 29512 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\avg9\update\backup\avgmfx86.sys
2010-06-02 12:19 . 2010-06-02 12:19 ——– d—–w- c:\windows\system32\wbem\Repository
2010-06-02 03:45 . 2010-06-02 03:45 ——– d-sh–w- c:\documents and settings\NetworkService.NT AUTHORITY\IETldCache
2010-06-01 03:16 . 2010-06-01 03:16 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\Malwarebytes
2010-06-01 03:12 . 2010-06-01 03:12 ——– d—–w- c:\program files\Trend Micro
2010-06-01 00:20 . 2010-06-01 00:20 ——– d—–w- c:\program files\Davilex
2010-05-28 03:45 . 2010-05-28 03:45 ——– d—–w- c:\documents and settings\zacr\Application Data\Activision
2010-05-28 03:45 . 2010-05-28 03:45 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\Activision

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-06-24 12:37 . 2009-10-30 21:17 ——– d—–w- c:\documents and settings\zacr\Application Data\Azureus
2010-06-24 01:04 . 2008-04-14 12:00 96512 —-a-w- c:\windows\system32\drivers\atapi.sys
2010-06-22 14:38 . 2009-10-31 14:03 243024 —-a-w- c:\windows\system32\drivers\avgtdix.sys
2010-06-22 14:38 . 2009-10-31 14:02 216400 —-a-w- c:\windows\system32\drivers\avgldx86.sys
2010-06-22 12:06 . 2009-10-30 23:51 30048 —-a-w- c:\documents and settings\zacr\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-06-22 04:15 . 2010-03-05 02:59 ——– d—–w- c:\program files\QuickTax 2009
2010-06-16 13:54 . 2010-03-05 03:00 ——– d—–w- c:\documents and settings\zacr\Application Data\Intuit Canada
2010-06-16 13:51 . 2010-03-05 02:59 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\Intuit Canada
2010-06-06 14:10 . 2008-10-18 23:01 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-06-06 01:12 . 2009-10-30 22:26 1324 —-a-w- c:\windows\system32\d3d9caps.dat
2010-06-03 12:32 . 2009-06-05 14:41 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-06-02 13:22 . 2009-10-31 14:02 29584 —-a-w- c:\windows\system32\drivers\avgmfx86.sys
2010-06-02 12:15 . 2009-10-31 14:02 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\avg9
2010-05-23 02:15 . 2010-05-23 02:15 ——– d—–w- c:\documents and settings\zacr\Application Data\Flood Light Games
2010-05-23 02:15 . 2010-05-23 02:15 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\Flood Light Games
2010-05-22 14:23 . 2010-05-20 01:34 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\Harley-Davidson_ Race to the Rally Saves
2010-05-22 08:15 . 2009-10-30 21:17 ——– d—–w- c:\documents and settings\zacr\Application Data\Any Video Converter
2010-05-22 01:15 . 2010-05-22 01:15 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\TheRace_dev
2010-05-22 01:13 . 2010-05-22 01:13 ——– d—–w- c:\documents and settings\zacr\Application Data\MysteryStudio
2010-05-21 01:48 . 2008-11-22 15:51 ——– d—–w- c:\program files\Creative
2010-05-20 00:11 . 2010-05-20 00:11 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\InstallShield
2010-05-20 00:11 . 2010-05-20 00:11 45056 —-a-r- c:\documents and settings\zacr\Application Data\Microsoft\Installer\{E100A066-697B-419D-BC40-CDB1B00975A2}\NewShortcut5_E100A066697B419DBC40CDB1B00975A2.exe
2010-05-20 00:11 . 2010-05-20 00:11 45056 —-a-r- c:\documents and settings\zacr\Application Data\Microsoft\Installer\{E100A066-697B-419D-BC40-CDB1B00975A2}\NewShortcut311_E100A066697B419DBC40CDB1B00975A2.exe
2010-05-20 00:11 . 2010-05-20 00:11 8854 —-a-r- c:\documents and settings\zacr\Application Data\Microsoft\Installer\{E100A066-697B-419D-BC40-CDB1B00975A2}\Uninstall_Harley_Dav_E100A066697B419DBC40CDB1B00975A2.exe
2010-05-20 00:11 . 2010-05-20 00:11 65536 —-a-r- c:\documents and settings\zacr\Application Data\Microsoft\Installer\{E100A066-697B-419D-BC40-CDB1B00975A2}\Shortcut0.C3A146F5_4B48_11D5_A819_00B0D0428C0C.exe
2010-05-20 00:11 . 2010-05-20 00:11 45056 —-a-r- c:\documents and settings\zacr\Application Data\Microsoft\Installer\{E100A066-697B-419D-BC40-CDB1B00975A2}\NewShortcut31_E100A066697B419DBC40CDB1B00975A2_1.exe
2010-05-20 00:11 . 2010-05-20 00:11 4286 —-a-r- c:\documents and settings\zacr\Application Data\Microsoft\Installer\{E100A066-697B-419D-BC40-CDB1B00975A2}\ARPPRODUCTICON.exe
2010-05-20 00:06 . 2008-10-18 23:00 ——– d—–w- c:\program files\Common Files\InstallShield
2010-05-20 00:05 . 2010-05-20 00:05 ——– d—–w- c:\program files\Activision Value
2010-05-19 03:02 . 2010-05-19 03:02 ——– d—–w- c:\documents and settings\zacr\Application Data\com.zoosk.Desktop.096E6A67431258A508A2446A847B240591D2C99B.1
2010-05-19 03:02 . 2008-10-23 00:08 ——– d—–w- c:\program files\Common Files\Adobe AIR
2010-05-19 03:01 . 2009-11-06 00:09 38784 —-a-w- c:\documents and settings\zacr\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-05-14 02:43 . 2010-05-14 02:43 ——– d—–w- c:\documents and settings\zacr\Application Data\SecretIslandEng
2010-05-11 03:31 . 2008-10-19 07:09 ——– d—–w- c:\program files\Vuze
2010-05-10 02:42 . 2010-04-22 04:26 ——– d—–w- c:\documents and settings\zacr\Application Data\PlayFirst
2010-05-10 02:42 . 2010-04-22 04:26 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\PlayFirst
2010-05-07 19:27 . 2010-05-07 19:27 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\Alawar Stargaze
2010-05-07 16:48 . 2010-05-07 16:16 ——– d—–w- c:\documents and settings\zacr\Application Data\Pirateville
2010-05-06 14:37 . 2010-05-06 14:37 20105 —-a-w- c:\windows\system32\wcardspc.exe
2010-05-06 10:41 . 2008-04-14 12:00 916480 —-a-w- c:\windows\system32\wininet.dll
2010-05-06 03:53 . 2010-05-06 03:53 ——– d—–w- c:\documents and settings\zacr\Application Data\Gogii Games
2010-05-06 03:53 . 2010-05-06 03:53 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\Gogii Games
2010-05-05 23:49 . 2010-04-17 13:50 ——– d—–w- c:\program files\Common Files\Knowledge Adventure
2010-05-04 21:14 . 2010-03-12 02:29 ——– d—a-w- c:\documents and settings\All Users.WINDOWS\Application Data\TEMP
2010-05-04 00:38 . 2010-05-02 15:00 ——– d—–w- c:\program files\Star Wars Rogue Squadron 3D
2010-05-03 01:43 . 2010-05-03 01:43 ——– d—–w- c:\documents and settings\zacr\Application Data\Stereoscopic Player
2010-05-02 05:22 . 2008-04-14 12:00 1851264 —-a-w- c:\windows\system32\win32k.sys
2010-05-01 12:56 . 2010-05-01 12:56 ——– d—–w- c:\program files\Microsoft Games
2010-05-01 02:03 . 2010-05-01 02:03 ——– d—–w- c:\documents and settings\zacr\Application Data\JoyBits
2010-04-30 15:50 . 2010-04-30 15:49 ——– d—–w- c:\documents and settings\zacr\Application Data\TitanicMystery
2010-04-30 03:26 . 2010-04-30 03:26 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\Playrix Entertainment
2010-04-28 01:14 . 2010-04-28 01:14 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\Auslogics
2010-04-25 14:16 . 2010-04-24 02:17 30544 —-a-w- c:\windows\dirdib.drv
2010-04-20 05:30 . 2008-04-14 12:00 285696 —-a-w- c:\windows\system32\atmfd.dll
2010-04-11 21:25 . 2010-04-11 21:25 10134 —-a-r- c:\documents and settings\zacr\Application Data\Microsoft\Installer\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}\ARPPRODUCTICON.exe
2010-03-31 06:16 . 2010-03-31 06:16 99176 —-a-w- c:\windows\system32\PresentationHostProxy.dll
2010-03-31 06:10 . 2010-03-31 06:10 295264 —-a-w- c:\windows\system32\PresentationHost.exe
2010-03-29 14:08 . 2010-03-29 14:08 3351812 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Installations\{D8DDC00B-2881-407D-AAC2-44AEE70AF0B7}\Installer\CommonCustomActions\msxml6Exec.exe
2010-03-29 14:08 . 2010-03-29 14:08 36864 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Installations\{D8DDC00B-2881-407D-AAC2-44AEE70AF0B7}\Installer\CommonCustomActions\Sleep.exe
2010-03-29 14:08 . 2010-03-29 14:08 3203453 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Installations\{D8DDC00B-2881-407D-AAC2-44AEE70AF0B7}\Installer\CommonCustomActions\vcredistExec.exe
2010-03-29 14:08 . 2010-03-29 14:08 34646320 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Installations\{D8DDC00B-2881-407D-AAC2-44AEE70AF0B7}\NokiaSoftwareUpdaterSetup_en_us.exe
2010-03-29 13:49 . 2010-03-29 13:49 95232 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Installations\{19DC9559-9C20-4A46-A67D-7ECBA52A2788}\Installer\CommonCustomActions\pcswpcsi.exe
2010-03-29 13:49 . 2010-03-29 13:49 8192 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Installations\{19DC9559-9C20-4A46-A67D-7ECBA52A2788}\Installer\CommonCustomActions\UninstCCD.exe
2010-03-29 13:49 . 2010-03-29 13:49 61440 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Installations\{19DC9559-9C20-4A46-A67D-7ECBA52A2788}\Installer\CommonCustomActions\UninstPCSFEMsi.exe
2010-03-29 13:49 . 2010-03-29 13:49 10240 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Installations\{19DC9559-9C20-4A46-A67D-7ECBA52A2788}\Installer\CommonCustomActions\UninstPCS.exe
2010-03-29 13:48 . 2010-03-29 13:49 34442296 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Installations\{19DC9559-9C20-4A46-A67D-7ECBA52A2788}\Nokia_PC_Suite_eng_us_web.exe
.

((((((((((((((((((((((((((((( SnapShot@2010-06-24_12.57.56 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-06-24 13:06 . 2010-06-24 13:06 16384 c:\windows\Temp\Perflib_Perfdata_1f4.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2005-08-12 45056]
"AVG9_TRAY"="d:\utilit~1\AVG9\avgtray.exe" [2010-06-22 2065760]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2005-02-16 221184]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-16 81920]
"Turbo Tax Agent"="c:\windows\txagent.exe" [2010-03-05 632699]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2010-06-22 14:38 12536 —-a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^zacr^Start Menu^Programs^Startup^ZooskMessenger.lnk]
path=c:\documents and settings\zacr\Start Menu\Programs\Startup\ZooskMessenger.lnk
backup=c:\windows\pss\ZooskMessenger.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-03-24 18:17 952768 —-a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-04-04 05:42 36272 —-a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SysTrayApp]
2008-04-11 02:07 413696 —-a-w- c:\program files\IDT\WDM\sttray.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"d:\\utilities\\AVG9\\avgam.exe"=
"d:\\utilities\\AVG9\\avgdiagex.exe"=
"d:\\utilities\\AVG9\\avgupd.exe"=
"d:\\utilities\\AVG9\\avgnsx.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"d:\\utilities\\mIRC\\mirc.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Common Files\\Ahead\\Nero Web\\SetupX.exe"=
"c:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"c:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"c:\\Program Files\\Vuze\\Azureus.exe"=
"e:\\games\\Transformers - Revenge of the Fallen\\Transformers2.exe"=
"e:\\games\\Cloudy with a Chance of Meatballs\\JadeEngine_Final.exe"=

R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [31/10/2009 8:03 AM 52872]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [31/10/2009 8:02 AM 216400]
R1 AvgTdiX;AVG Network Redirector;c:\windows\system32\drivers\avgtdix.sys [31/10/2009 8:03 AM 243024]
R2 avg9wd;AVG WatchDog;d:\utilities\AVG9\avgwdsvc.exe [22/06/2010 8:38 AM 308136]
S0 cerc6;cerc6; [x]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [03/11/2009 9:45 PM 135664]
S3 LGBusEnum;Logitech GamePanel Virtual Bus Enumerator Driver;c:\windows\system32\drivers\LGBusEnum.sys [14/07/2009 3:35 PM 19720]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [29/03/2010 8:11 AM 137344]
S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [29/03/2010 8:11 AM 8320]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
.
Contents of the 'Scheduled Tasks' folder

2010-06-24 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-11-04 03:45]

2010-06-24 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-11-04 03:45]
.
.
——- Supplementary Scan ——-
.
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - d:\utilit~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-06-24 07:38
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(1356)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2010-06-24 07:42:03
ComboFix-quarantined-files.txt 2010-06-24 13:42
ComboFix2.txt 2009-06-05 13:57

Pre-Run: 26,070,675,456 bytes free
Post-Run: 26,053,275,648 bytes free

- - End Of File - - 2F6582E8B7642B6351092F1BC9026AAB
Upload was successful

ok, the results for the files were

c:\windows\system32\wcardspc.exe:

Antivirus Version Last Update Result
a-squared 5.0.0.30 2010.06.25 -
AhnLab-V3 2010.06.25.04 2010.06.25 -
AntiVir 8.2.4.2 2010.06.25 -
Antiy-AVL 2.0.3.7 2010.06.25 -
Authentium 5.2.0.5 2010.06.25 W32/Damaged_File.B.gen!Eldorado
Avast 4.8.1351.0 2010.06.25 -
Avast5 5.0.332.0 2010.06.25 -
AVG 9.0.0.836 2010.06.25 -
BitDefender 7.2 2010.06.25 -
CAT-QuickHeal 10.00 2010.06.25 -
ClamAV 0.96.0.3-git 2010.06.25 -
Comodo 5214 2010.06.25 -
DrWeb 5.0.2.03300 2010.06.25 -
eSafe 7.0.17.0 2010.06.24 -
eTrust-Vet 36.1.7666 2010.06.25 -
F-Prot 4.6.1.107 2010.06.24 W32/Damaged_File.B.gen!Eldorado
F-Secure 9.0.15370.0 2010.06.25 -
Fortinet 4.1.133.0 2010.06.25 -
GData 21 2010.06.25 -
Ikarus T3.1.1.84.0 2010.06.25 -
Jiangmin 13.0.900 2010.06.15 Trojan/Chifrax.cdr
Kaspersky 7.0.0.125 2010.06.25 -
McAfee 5.400.0.1158 2010.06.25 Corrupt-EP
McAfee-GW-Edition 2010.1 2010.06.25 -
Microsoft 1.5902 2010.06.25 -
NOD32 5228 2010.06.25 -
Norman 6.05.10 2010.06.25 -
nProtect 2010-06-25.01 2010.06.25 -
Panda 10.0.2.7 2010.06.25 -
PCTools 7.0.3.5 2010.06.25 -
Prevx 3.0 2010.06.25 -
Rising 22.53.04.05 2010.06.25 -
Sophos 4.54.0 2010.06.25 -
Sunbelt 6504 2010.06.25 -
Symantec 20101.1.0.89 2010.06.25 -
TheHacker 6.5.2.0.303 2010.06.24 W32/Behav-Heuristic-CorruptFile-EP
TrendMicro 9.120.0.1004 2010.06.25 -
TrendMicro-HouseCall 9.120.0.1004 2010.06.25 -
VBA32 3.12.12.5 2010.06.25 -
ViRobot 2010.6.21.3896 2010.06.25 -
VirusBuster 5.0.27.0 2010.06.25 -
Additional information
File size: 20105 bytes
MD5…: 1433b2a53a9a3856ebc58b83900ab820
SHA1..: 2e5817acc3d8c9039de87fe5a406d6a8bfa6bb9a
SHA256: 8524ff62530b42dfcad9083ff627df13fc0f85f803529801ff69d86da77a571e
ssdeep: 384:Mv+mEulwF89aNIEXvBnN+jDbdc/m+KNMLp0guCPj8WS68x/hW5h:NAljE5n8
/bn+Kwhlr8HnxhW5h
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x645c
timedatestamp…..: 0x41107bc1 (Wed Aug 04 06:01:37 2004)
machinetype…….: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x992c 0x9a00 6.37 e2eb1b33fca924b774757c8c861da10a
.data 0xb000 0x1be4 0x400 0.00 d41d8cd98f00b204e9800998ecf8427e
.rsrc 0xd000 0x14e2e 0x15000 0.00 d41d8cd98f00b204e9800998ecf8427e

( 0 imports )

( 0 exports )
RDS…: NSRL Reference Data Set
-
pdfid.: -
trid..: Generic Win/DOS Executable (49.9%)
DOS Executable Generic (49.8%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%)
Symantec Reputation Network: Suspicious.Insight http://www.symantec.com/security_response/…-021223-0550-99
sigcheck:
publisher….: n/a
copyright….: n/a
product……: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: n/a
comments…..: n/a
signers……: -
signing date.: -
verified…..: Unsigned

c:\windows\popcinfo.dat:

Antivirus Version Last Update Result
a-squared 5.0.0.30 2010.06.25 -
AhnLab-V3 2010.06.25.04 2010.06.25 -
AntiVir 8.2.4.2 2010.06.25 -
Antiy-AVL 2.0.3.7 2010.06.25 -
Authentium 5.2.0.5 2010.06.25 -
Avast 4.8.1351.0 2010.06.25 -
Avast5 5.0.332.0 2010.06.25 -
AVG 9.0.0.836 2010.06.25 -
BitDefender 7.2 2010.06.25 -
CAT-QuickHeal 10.00 2010.06.25 -
ClamAV 0.96.0.3-git 2010.06.25 -
Comodo 5214 2010.06.25 -
DrWeb 5.0.2.03300 2010.06.25 -
eSafe 7.0.17.0 2010.06.24 -
eTrust-Vet 36.1.7666 2010.06.25 -
F-Prot 4.6.1.107 2010.06.24 -
F-Secure 9.0.15370.0 2010.06.25 -
Fortinet 4.1.133.0 2010.06.25 -
GData 21 2010.06.25 -
Ikarus T3.1.1.84.0 2010.06.25 -
Jiangmin 13.0.900 2010.06.15 -
Kaspersky 7.0.0.125 2010.06.25 -
McAfee 5.400.0.1158 2010.06.25 -
McAfee-GW-Edition 2010.1 2010.06.25 -
Microsoft 1.5902 2010.06.25 -
NOD32 5228 2010.06.25 -
Norman 6.05.10 2010.06.25 -
nProtect 2010-06-25.01 2010.06.25 -
Panda 10.0.2.7 2010.06.25 -
PCTools 7.0.3.5 2010.06.25 -
Prevx 3.0 2010.06.25 -
Rising 22.53.04.05 2010.06.25 -
Sophos 4.54.0 2010.06.25 -
Sunbelt 6504 2010.06.25 -
Symantec 20101.1.0.89 2010.06.25 -
TheHacker 6.5.2.0.303 2010.06.24 -
TrendMicro 9.120.0.1004 2010.06.25 -
TrendMicro-HouseCall 9.120.0.1004 2010.06.25 -
VBA32 3.12.12.5 2010.06.25 -
ViRobot 2010.6.21.3896 2010.06.25 -
VirusBuster 5.0.27.0 2010.06.25 -
Additional information
File size: 16 bytes
MD5…: 477a1ac3c79e80b60d1037d9dab02b67
SHA1..: 29ff6b7181affcdf933ff09d5207e9fa49158aec
SHA256: 4d6484c5aff95fcc76cb31b286b3051e41e5a6b598483b6617b90bce0e644059
ssdeep: 3:6oYs:68
PEiD..: -
PEInfo: -
RDS…: NSRL Reference Data Set
-
pdfid.: -
trid..: Unknown!
sigcheck:
publisher….: n/a
copyright….: n/a
product……: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: n/a
comments…..: n/a
signers……: -
signing date.: -
verified…..: Unsigned

OTL logfile created on: 27/06/2010 8:19:43 AM - Run 2
OTL by OldTimer - Version 3.2.6.0 Folder = E:\resolve
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 71.00% Memory free
5.00 Gb Paging File | 4.00 Gb Available in Paging File | 84.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 55.89 Gb Total Space | 24.22 Gb Free Space | 43.34% Space Free | Partition Type: NTFS
Drive D: | 70.26 Gb Total Space | 1.56 Gb Free Space | 2.22% Space Free | Partition Type: NTFS
Drive E: | 149.05 Gb Total Space | 21.60 Gb Free Space | 14.49% Space Free | Partition Type: NTFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive J: | 3.32 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF

Computer Name: PRIMARY
Current User Name: zacr
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2010/06/27 07:09:28 | 000,014,808 | —- | M] (Mozilla Corporation) – C:\Program Files\Mozilla Firefox\plugin-container.exe
PRC - [2010/06/27 07:09:24 | 000,910,296 | —- | M] (Mozilla Corporation) – C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2010/06/22 08:38:47 | 002,065,760 | —- | M] (AVG Technologies CZ, s.r.o.) – D:\utilities\AVG9\avgtray.exe
PRC - [2010/06/22 08:38:43 | 000,620,896 | —- | M] (AVG Technologies CZ, s.r.o.) – d:\utilities\AVG9\avgnsx.exe
PRC - [2010/06/22 08:38:43 | 000,515,424 | —- | M] (AVG Technologies CZ, s.r.o.) – d:\utilities\AVG9\avgrsx.exe
PRC - [2010/06/22 08:38:40 | 000,308,136 | —- | M] (AVG Technologies CZ, s.r.o.) – d:\utilities\AVG9\avgwdsvc.exe
PRC - [2010/06/22 08:38:35 | 000,723,296 | —- | M] (AVG Technologies CZ, s.r.o.) – d:\utilities\AVG9\avgcsrvx.exe
PRC - [2010/06/22 08:38:34 | 001,101,152 | —- | M] (AVG Technologies CZ, s.r.o.) – d:\utilities\AVG9\avgchsvx.exe
PRC - [2010/06/22 08:38:33 | 000,842,592 | —- | M] (AVG Technologies CZ, s.r.o.) – d:\utilities\AVG9\avgam.exe
PRC - [2010/06/19 06:57:38 | 000,572,416 | —- | M] (OldTimer Tools) – E:\resolve\OTL.exe
PRC - [2009/10/14 04:44:33 | 005,373,952 | —- | M] (Traveller's Tales (UK) Ltd) – E:\games\LEGO Star Wars - The Complete Saga\LEGOStarWarsSaga.exe
PRC - [2008/04/14 06:00:00 | 001,033,728 | —- | M] (Microsoft Corporation) – C:\WINDOWS\explorer.exe
PRC - [2006/03/03 22:03:10 | 000,069,632 | —- | M] (HP) – C:\WINDOWS\system32\HPZipm12.exe
PRC - [2005/08/12 14:43:58 | 000,045,056 | —- | M] (ATI Technologies Inc.) – C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
PRC - [2005/02/16 08:15:20 | 000,081,920 | —- | M] (InstallShield Software Corporation) – C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe


========== Modules (SafeList) ==========

MOD - [2010/06/19 06:57:38 | 000,572,416 | —- | M] (OldTimer Tools) – E:\resolve\OTL.exe
MOD - [2008/04/14 06:00:00 | 000,110,592 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\msscript.ocx


========== Win32 Services (SafeList) ==========

SRV - [2010/06/22 08:38:40 | 000,308,136 | —- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] – d:\utilities\AVG9\avgwdsvc.exe – (avg9wd)
SRV - [2010/01/26 12:41:08 | 000,652,800 | —- | M] (Nokia) [On_Demand | Stopped] – C:\Program Files\PC Connectivity Solution\ServiceLayer.exe – (ServiceLayer)
SRV - [2009/09/23 17:37:30 | 000,051,168 | —- | M] (NOS Microsystems Ltd.) [On_Demand | Stopped] – C:\Program Files\NOS\bin\getPlus_Helper.dll – (getPlusHelper) getPlus®
SRV - [2008/04/10 20:08:44 | 000,212,992 | —- | M] (IDT, Inc.) [Auto | Stopped] – C:\WINDOWS\system32\stacsv.exe – (STacSV)
SRV - [2006/03/03 22:03:10 | 000,069,632 | —- | M] (HP) [Unknown | Running] – C:\WINDOWS\system32\HPZipm12.exe – (Pml Driver HPZ12)


========== Driver Services (SafeList) ==========

DRV - [2010/06/22 08:38:45 | 000,243,024 | —- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] – C:\WINDOWS\System32\Drivers\avgtdix.sys – (AvgTdiX)
DRV - [2010/06/22 08:38:36 | 000,216,400 | —- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] – C:\WINDOWS\System32\Drivers\avgldx86.sys – (AvgLdx86)
DRV - [2010/06/02 07:22:07 | 000,029,584 | —- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] – C:\WINDOWS\System32\Drivers\avgmfx86.sys – (AvgMfx86)
DRV - [2010/03/04 10:00:35 | 000,052,872 | —- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] – C:\WINDOWS\System32\Drivers\avgrkx86.sys – (AvgRkx86)
DRV - [2010/01/21 14:53:16 | 000,018,048 | —- | M] (Nokia) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\ccdcmb.sys – (nmwcd)
DRV - [2009/12/30 11:30:56 | 000,007,936 | —- | M] (Nokia) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys – (UsbserFilt)
DRV - [2009/12/30 11:30:48 | 000,022,016 | —- | M] (Nokia) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\ccdcmbo.sys – (nmwcdc)
DRV - [2009/12/30 11:30:48 | 000,007,936 | —- | M] (Nokia) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\usbser_lowerflt.sys – (upperdev)
DRV - [2009/12/30 11:25:12 | 000,137,344 | —- | M] (Nokia) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\nmwcdnsu.sys – (nmwcdnsu)
DRV - [2009/12/30 11:25:12 | 000,008,320 | —- | M] (Nokia) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\nmwcdnsuc.sys – (nmwcdnsuc)
DRV - [2009/07/14 15:35:30 | 000,019,720 | —- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\LGBusEnum.sys – (LGBusEnum)
DRV - [2008/08/26 09:26:12 | 000,018,816 | —- | M] (Nokia) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\pccsmcfd.sys – (pccsmcfd)
DRV - [2008/04/14 06:00:00 | 000,144,384 | —- | M] (Windows ® Server 2003 DDK provider) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\hdaudbus.sys – (HDAudBus)
DRV - [2008/04/14 01:15:30 | 000,010,624 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\gameenum.sys – (gameenum)
DRV - [2008/04/13 23:05:40 | 000,020,992 | —- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\RTL8139.sys – (rtl8139) Realtek RTL8139(A/B/C)
DRV - [2008/04/10 20:10:10 | 001,271,032 | —- | M] (IDT, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\sthda.sys – (STHDA)
DRV - [2007/08/06 18:15:07 | 000,033,052 | —- | M] (PowerISO Computing, Inc.) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\scdemu.sys – (SCDEmu)
DRV - [2005/12/01 08:49:20 | 001,412,608 | —- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\ati2mtag.sys – (ati2mtag)
DRV - [2001/08/17 15:02:32 | 000,008,576 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\hidgame.sys – (hidgame)
DRV - [2001/08/17 13:19:34 | 000,040,704 | —- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\es1371mp.sys – (es1371) Creative AudioPCI (ES1371,ES1373) (WDM)
DRV - [2001/08/17 12:19:34 | 000,036,480 | —- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\sfmanm.sys – (sfman) Creative SoundFont Manager Driver (WDM)
DRV - [2001/08/17 12:19:28 | 000,006,912 | —- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\ctlfacem.sys – (emu10k1) Creative Interface Manager Driver (WDM)
DRV - [2001/08/17 12:19:26 | 000,283,904 | —- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\emu10k1m.sys – (emu10k) Creative SB Live! (WDM)
DRV - [2001/08/17 12:19:20 | 000,003,712 | —- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\ctljystk.sys – (ctljystk)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "google.com"
FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:1
FF - prefs.js..extensions.enabledItems: 6
FF - prefs.js..extensions.enabledItems: 2
FF - prefs.js..extensions.enabledItems: 48
FF - prefs.js..extensions.enabledItems: {E9A1DEE0-C623-4439-8932-001E7D17607D}:2.1.0.5
FF - prefs.js..extensions.enabledItems: {F8CC37C3-CBEB-4A00-8CBF-26A88693F0C5}:2.2009.7.21
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {e001c731-5e37-4538-a5cb-8168736a2360}:0.9.9.23
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/06/27 07:09:35 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/06/27 07:09:35 | 000,000,000 | —D | M]

[2009/10/30 15:09:39 | 000,000,000 | —D | M] – C:\Documents and Settings\zacr\Application Data\Mozilla\Extensions
[2009/10/30 15:09:39 | 000,000,000 | —D | M] – C:\Documents and Settings\zacr\Application Data\Mozilla\Extensions\[removed]
[2009/10/30 14:36:50 | 000,000,000 | —D | M] – C:\Documents and Settings\zacr\Application Data\Mozilla\Firefox\Profiles\fkaw992v.default\extensions
[2010/06/27 06:48:28 | 000,000,000 | —D | M] – C:\Documents and Settings\zacr\Application Data\Mozilla\Firefox\Profiles\x7axhqgf.default\extensions
[2010/06/25 21:39:58 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\zacr\Application Data\Mozilla\Firefox\Profiles\x7axhqgf.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2009/10/30 15:09:39 | 000,000,000 | —D | M] (Adobe DLM (powered by getPlus®)) – C:\Documents and Settings\zacr\Application Data\Mozilla\Firefox\Profiles\x7axhqgf.default\extensions\{CF40ACC5-E1BB-4aff-AC72-04C2F616BCA7}
[2010/06/18 22:27:34 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\zacr\Application Data\Mozilla\Firefox\Profiles\x7axhqgf.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}
[2009/11/05 18:06:48 | 000,000,000 | —D | M] (Adobe DLM (powered by getPlus®)) – C:\Documents and Settings\zacr\Application Data\Mozilla\Firefox\Profiles\x7axhqgf.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
[2009/10/30 15:09:38 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\zacr\Application Data\Mozilla\Firefox\Profiles\x7axhqgf.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}
[2009/10/30 15:09:38 | 000,000,000 | —D | M] (DriverAgent Plugin for Firefox and Opera) – C:\Documents and Settings\zacr\Application Data\Mozilla\Firefox\Profiles\x7axhqgf.default\extensions\{F8CC37C3-CBEB-4A00-8CBF-26A88693F0C5}
[2009/10/30 15:09:39 | 000,000,000 | —D | M] – C:\Documents and Settings\zacr\Application Data\Mozilla\Firefox\Profiles\x7axhqgf.default\extensions\[removed]
[2009/09/01 07:34:43 | 000,002,171 | —- | M] () – C:\Documents and Settings\zacr\Application Data\Mozilla\Firefox\Profiles\x7axhqgf.default\searchplugins\bing.xml
[2010/06/27 06:48:28 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2010/06/25 23:22:42 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2008/11/11 01:38:54 | 000,663,552 | —- | M] (BitComet) – C:\Program Files\Mozilla Firefox\plugins\npBitCometAgent.dll
[2010/06/25 23:21:45 | 000,411,368 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2010/01/27 01:33:42 | 000,077,824 | —- | M] (Kaneva, LLC.) – C:\Program Files\Mozilla Firefox\plugins\npkanevapatch.dll

O1 HOSTS File: ([2010/06/24 07:38:42 | 000,000,027 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - d:\utilities\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [ATICCC] C:\Program Files\ATI Technologies\ATI.ACE\cli.exe (ATI Technologies Inc.)
O4 - HKLM..\Run: [AVG9_TRAY] d:\utilities\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [ISUSPM Startup] C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [ISUSScheduler] C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [Turbo Tax Agent] C:\WINDOWS\txagent.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: E&xport; to Microsoft Excel - D:\utilities\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\utilities\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://www.update.microsoft.com/windowsupd…b?1256943299296 (WUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\intu-qt2008 {05E53CE9-66C8-4a9e-A99F-FDB7A8E7B596} - C:\Program Files\QuickTax 2008\ic2008pp.dll (Intuit Canada, a general partnership/une société en nom collectif.)
O18 - Protocol\Handler\intu-qt2009 {03947252-2355-4e9b-B446-8CCC75C43370} - C:\Program Files\QuickTax 2009\ic2009pp.dll (Intuit Canada, a general partnership/une société en nom collectif.)
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - d:\utilities\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\avgrsstarter: DllName - avgrsstx.dll - C:\WINDOWS\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/10/18 15:08:34 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/06/26 18:02:17 | 000,000,000 | —D | C] – C:\Program Files\NDSROM Player
[2010/06/26 07:39:37 | 000,000,000 | —D | C] – C:\Documents and Settings\zacr\Application Data\dvdcss
[2010/06/25 23:22:33 | 000,411,368 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\deployJava1.dll
[2010/06/25 23:22:33 | 000,073,728 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javacpl.cpl
[2010/06/25 23:22:30 | 000,153,376 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaws.exe
[2010/06/25 23:22:30 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaw.exe
[2010/06/25 23:22:30 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\java.exe
[2010/06/24 22:18:13 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2010/06/24 06:40:05 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2010/06/24 06:40:05 | 000,161,792 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2010/06/24 06:40:05 | 000,136,704 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2010/06/24 06:40:05 | 000,031,232 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2010/06/23 22:18:26 | 000,743,424 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iedvtool.dll
[2010/06/22 08:38:43 | 000,012,536 | —- | C] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\avgrsstx.dll
[2010/06/21 07:46:11 | 000,000,000 | —D | C] – C:\zacr
[2010/06/19 10:48:25 | 000,000,000 | —D | C] – C:\Documents and Settings\zacr\Application Data\CLOUDY
[2010/06/18 22:27:45 | 000,000,000 | —D | C] – C:\Documents and Settings\zacr\Application Data\QuickScan
[2010/06/16 22:55:05 | 000,000,000 | —D | C] – C:\Documents and Settings\zacr\My Documents\QuickTax
[2010/06/16 07:53:42 | 000,000,000 | —D | C] – C:\Program Files\Common Files\AnswerWorks 4.0
[2010/06/16 07:53:34 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Intuit
[2010/06/16 07:53:31 | 000,000,000 | —D | C] – C:\Program Files\QuickTax 2008
[2010/06/11 20:09:27 | 000,000,000 | —D | C] – C:\WINDOWS\Lost in the City
[2010/06/11 20:09:27 | 000,000,000 | —D | C] – C:\Program Files\Lost in the City
[2010/06/07 19:31:24 | 000,000,000 | —D | C] – C:\Program Files\MagicISO
[2010/06/05 08:26:40 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users.WINDOWS\Application Data\F-Secure
[2010/06/03 06:32:22 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/06/03 06:32:07 | 000,020,952 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2010/05/31 21:16:26 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users.WINDOWS\Application Data\Malwarebytes
[2010/05/31 21:12:18 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2010/05/31 18:20:32 | 000,000,000 | —D | C] – C:\Program Files\Davilex
[2009/11/26 22:40:16 | 000,065,536 | —- | C] ( ) – C:\WINDOWS\System32\a3d.dll

========== Files - Modified Within 30 Days ==========

[2010/06/27 08:24:08 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/06/27 07:21:14 | 000,000,881 | —- | M] () – C:\Documents and Settings\zacr\Desktop\ds emulator.lnk
[2010/06/26 21:27:35 | 000,013,646 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/06/26 21:27:20 | 000,000,878 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/06/26 21:27:08 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/06/26 21:27:04 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/06/26 21:25:36 | 006,553,600 | —- | M] () – C:\Documents and Settings\zacr\ntuser.dat
[2010/06/26 21:25:36 | 000,000,178 | -HS- | M] () – C:\Documents and Settings\zacr\ntuser.ini
[2010/06/26 16:24:02 | 061,427,525 | —- | M] () – C:\WINDOWS\System32\drivers\Avg\incavi.avm
[2010/06/25 23:21:43 | 000,153,376 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaws.exe
[2010/06/25 23:21:42 | 000,145,184 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaw.exe
[2010/06/25 23:21:41 | 000,145,184 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\java.exe
[2010/06/25 23:21:41 | 000,073,728 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javacpl.cpl
[2010/06/25 23:21:40 | 000,411,368 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\deployJava1.dll
[2010/06/24 07:38:51 | 000,000,227 | —- | M] () – C:\WINDOWS\system.ini
[2010/06/24 07:38:42 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2010/06/24 03:41:20 | 000,139,648 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010/06/24 03:23:51 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2010/06/24 03:20:00 | 000,462,168 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/06/24 03:19:59 | 000,530,452 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2010/06/24 03:19:59 | 000,078,114 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/06/22 08:38:45 | 000,243,024 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\drivers\avgtdix.sys
[2010/06/22 08:38:43 | 000,012,536 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\avgrsstx.dll
[2010/06/22 08:38:36 | 000,216,400 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\drivers\avgldx86.sys
[2010/06/22 06:06:49 | 000,030,048 | —- | M] () – C:\Documents and Settings\zacr\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2010/06/21 22:34:43 | 000,000,000 | —- | M] () – C:\Documents and Settings\zacr\defogger_reenable
[2010/06/21 22:34:11 | 000,050,477 | —- | M] () – C:\Documents and Settings\zacr\Desktop\Defogger.exe
[2010/06/21 21:27:58 | 000,001,651 | —- | M] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\QuickTax 2009.lnk
[2010/06/21 20:51:17 | 003,182,644 | -H– | M] () – C:\Documents and Settings\zacr\Local Settings\Application Data\IconCache.db
[2010/06/19 09:05:00 | 000,000,388 | —- | M] () – C:\WINDOWS\TCII.ini
[2010/06/19 07:59:14 | 000,002,445 | —- | M] () – C:\Documents and Settings\zacr\Desktop\HiJackThis.lnk
[2010/06/19 06:59:21 | 000,003,713 | —- | M] () – C:\Documents and Settings\zacr\Desktop\Document.rtf
[2010/06/18 21:46:52 | 000,000,086 | —- | M] () – C:\Documents and Settings\zacr\default.pls
[2010/06/18 21:46:41 | 000,000,069 | —- | M] () – C:\WINDOWS\NeroDigital.ini
[2010/06/11 20:09:41 | 000,001,676 | —- | M] () – C:\Documents and Settings\zacr\Desktop\Lost in the City.lnk
[2010/06/05 19:12:13 | 000,001,324 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/06/02 07:22:07 | 000,029,584 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\drivers\avgmfx86.sys
[2010/06/02 06:55:11 | 000,000,554 | —- | M] () – C:\WINDOWS\win.ini
[2010/06/02 06:55:11 | 000,000,282 | -HS- | M] () – C:\boot.ini

========== Files Created - No Company Name ==========

[2010/06/27 07:19:35 | 000,000,881 | —- | C] () – C:\Documents and Settings\zacr\Desktop\ds emulator.lnk
[2010/06/24 06:40:05 | 000,256,512 | —- | C] () – C:\WINDOWS\PEV.exe
[2010/06/24 06:40:05 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2010/06/24 06:40:05 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2010/06/24 06:40:05 | 000,077,312 | —- | C] () – C:\WINDOWS\MBR.exe
[2010/06/24 06:40:05 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2010/06/22 22:09:16 | 000,000,000 | —- | C] () – C:\Documents and Settings\zacr\Log.txt
[2010/06/21 22:34:43 | 000,000,000 | —- | C] () – C:\Documents and Settings\zacr\defogger_reenable
[2010/06/21 22:34:11 | 000,050,477 | —- | C] () – C:\Documents and Settings\zacr\Desktop\Defogger.exe
[2010/06/21 21:27:58 | 000,001,651 | —- | C] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\QuickTax 2009.lnk
[2010/06/19 07:58:56 | 000,002,445 | —- | C] () – C:\Documents and Settings\zacr\Desktop\HiJackThis.lnk
[2010/06/19 06:59:21 | 000,003,713 | —- | C] () – C:\Documents and Settings\zacr\Desktop\Document.rtf
[2010/06/11 20:09:41 | 000,001,676 | —- | C] () – C:\Documents and Settings\zacr\Desktop\Lost in the City.lnk
[2010/05/28 23:09:29 | 006,553,600 | —- | C] () – C:\Documents and Settings\zacr\ntuser.dat
[2010/04/18 19:25:04 | 000,000,377 | —- | C] () – C:\WINDOWS\ACTIVITY.INI
[2010/04/10 19:58:16 | 000,000,256 | —- | C] () – C:\WINDOWS\KA.INI
[2010/04/10 09:08:34 | 000,001,420 | —- | C] () – C:\WINDOWS\compedia.ini
[2010/03/28 22:58:14 | 000,000,151 | —- | C] () – C:\WINDOWS\PhotoSnapViewer.INI
[2010/03/05 23:31:00 | 000,010,240 | —- | C] () – C:\WINDOWS\System32\vidx16.dll
[2010/02/19 12:10:14 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2010/01/06 21:33:53 | 000,004,767 | —- | C] () – C:\WINDOWS\Irremote.ini
[2010/01/03 10:43:36 | 000,172,032 | —- | C] () – C:\WINDOWS\System32\TTSServer.dll
[2010/01/03 10:42:31 | 000,000,000 | —- | C] () – C:\WINDOWS\Setup32.INI
[2010/01/03 10:23:16 | 000,000,208 | —- | C] () – C:\WINDOWS\TLCAPPS.INI
[2009/12/24 11:41:19 | 000,000,388 | —- | C] () – C:\WINDOWS\TCII.ini
[2009/11/26 22:41:08 | 000,000,011 | —- | C] () – C:\WINDOWS\SBWIN.INI
[2009/11/26 13:34:11 | 000,077,824 | R— | C] () – C:\WINDOWS\System32\HPZIDS01.dll
[2009/11/19 13:21:10 | 000,000,247 | —- | C] () – C:\WINDOWS\LEXSTAT.INI
[2009/11/15 10:27:28 | 000,000,068 | —- | C] () – C:\WINDOWS\TONKA_SR.INI
[2009/11/01 08:26:49 | 000,000,069 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2009/10/30 17:04:38 | 000,354,816 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2007/09/27 10:51:02 | 000,020,698 | —- | C] () – C:\WINDOWS\System32\idxcntrs.ini
[2007/09/27 10:48:48 | 000,030,628 | —- | C] () – C:\WINDOWS\System32\gsrvctr.ini
[2007/09/27 10:48:28 | 000,031,698 | —- | C] () – C:\WINDOWS\System32\gthrctr.ini
[2001/07/07 04:00:00 | 000,003,399 | —- | C] () – C:\WINDOWS\System32\hptcpmon.ini
[1999/01/12 12:39:16 | 000,032,770 | —- | C] () – C:\WINDOWS\System32\llretal.dll
[1999/01/12 12:39:16 | 000,024,578 | —- | C] () – C:\WINDOWS\System32\vepital.dll

========== Alternate Data Streams ==========

@Alternate Data Stream - 99 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:090FB735
@Alternate Data Stream - 96 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:D48500F8
@Alternate Data Stream - 129 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:F64FC07C
@Alternate Data Stream - 129 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:61B54B15
@Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:D0668210
@Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:2D7D575C
@Alternate Data Stream - 117 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:2E49D185
@Alternate Data Stream - 116 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:98DFF516
@Alternate Data Stream - 113 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:AD7183FA
@Alternate Data Stream - 113 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:7C60A173
@Alternate Data Stream - 111 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:5F95AE81
< End of report >

Hello zacr

Your log appears to be clean

Just a few cleanup and update steps and you should be good to go.

• Please open OTL
  
  
  
  • Copy and paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL.
    
    

    :OTL
    PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
    O4 - HKLM..\Run: [Turbo Tax Agent] C:\WINDOWS\txagent.exe File not found
    
    :Commands
    [purity]
    [emptytemp]
    [emptyflash]
    [start explorer]
    [Reboot]

  • Once you have pasted the information into the Custom Scans/Fixes box, click the "Run Fix" button at the top.
  • Allow the program to run unhindered.
  • Your machine will re-start itself. This is normal.
  
  
• P2P Programs:
  
  
  
  • P2P programs are a major source of Malware infections.
  • From your log I can see evidence of Vuze and BitComet.
  • You would be doing yourself a favour by removing these programs.
  • You can do so by clicking on "Start" then on "Control Panel" and then on "Add or remove programs".
  
  
• Re-enable your drivers
  
  
  
  • To re-enable your Emulation drivers, double click on DeFogger to run the tool.
  • The application window will appear.
  • Click the Re-enable button to re-enable your CD Emulation drivers.
  • Click Yes to continue
  • A 'Finished!' message will appear.
  • Click OK
  • DeFogger will now ask to reboot the machine - click OK
  IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_enable which will appear on your desktop.
  Your Emulation drivers are now re-enabled.
  
  
• Please Uninstall Combofix
  
  
  • Click on "Start" and then on "Run".
  • Now type combofix /uninstall in the run box and click "OK". Please note the space between the "x" and the "/Uninstall", it needs to be there.
  
  
• Please perform the following cleanup procedure
  
  
  
  • Double click on the OTL.exe icon on your desktop to run the program. (Note: If you are running Vista, right-click on the file and choose Run As Administrator).
  • Once OTL has opened, click on the "CleanUp!" button.
  • Follow any prompts that you receive.
  
  
• Removal of Tools
  
  
  
  • You no longer need FileLister or TDSSKiller. Please delete them from your system.
  
  
• Your Adobe is out of date
  
  
  
  • You can obtain the latest version of Adobe Reader from here, and the latest version of Flash Player from here.
  • For more information and links to Adobe updates and downloads click here.
  
  
  Once you have completed the above steps you should be good to go! If you have any further questions, please feel free to ask.
  
  
• Finally, please take the time to read through the information provided below:
  
  Enhance your System Security
  
  
  • For an excellent list of free anti virus software, free online virus scanners, free spyware detection/removal and free firewalls, click here.
  
  
  • IMPORTANT! Please make sure you only have ONE firewall and ONE real-time antivirus installed on your system. When using "on demand" scanners, first update the detection signature files, then disconnect from the internet and disable your resident security program before running the scan.
  • Once complete, remember to re-engage your resident security before going online.
  
  Web Browsers and Browser Security
  
  Firefox
  
  • Firefox is generally considered to have greater browsing security in comparison to other popular programs. You can download Firefox 3.0 from here.
  
  No-Script
  
  • If you use Firefox as your default browser, No-Script can provide additional security by preventing malicious scripts from being executed on your system.
  • You can download No-Script by clicking here.
  
  Internet Explorer
  
  • The newest version of Internet Explorer is available from here.
  
  SpywareBlaster
  
  • If you use Internet Explorer as your default browser, SpywareBlaster would be a valuable addition to your online security.
  • SpywareBlaster prevents malicious ActiveX objects from being downloaded onto your system.
  • You can download SpywareBlaster by clicking here.
  
  Web of Trust
  
  • When using search engines, Web of Trust provides you with an easy way of telling the good sites from the bad and is compatible with both Firefox and Internet Explorer.
  • Coloured symbols are displayed next to search results, giving you more confidence in the links you choose to click on: Green (To go), Yellow (Caution) and Red (Stop).
  • You can download Web of Trust by clicking here.
  
  Keep your Software Updated
  
  • Outdated software can sometimes have vulnerabilities that are exploitable by malware.
  • Check if there are available updates for your installed software with Secunia's Online Software Inspector by clicking here.
  
  Passwords
  
  • Learn how to create strong passwords by clicking here and test the strength of the passwords you already use by clicking here.
  
  General Reading
  
  • How did I get infected in the first place?
  • PC Safety and Security - What do I need?
  • How to prevent Malware (by Miekiemoes)
  
  Learn How To Combat Malware
  
  • Would you like to learn how to fight back against malware and help others? Enroll at the What The Tech (Formerly Tom Coyotes) Malware Classroom by clicking here.