Random ads and changes the taskbar style

Hello,

My computer has random advertisements pops up in my firefox. I've noticed that there is also a program called ad-aware 07 installed, even though i did not authorise the installation (as i'm the only user at home for this pc). I've noticed that a process in the task manager called AAWservice.exe takes up 100mbs and at sometimes 20% of cpu usage. I've tried removing it with Malwarebytes antimalware, it removed some files, and once i rebooted it, the problem came back again. But aawservice.exe doesn't seem to take up that much cpu and mbs after reboot. The ability to play music files has also been stopped, saying 'something is wrong with my sound device'.

This usually happens when a microsoft "Generic host process for win32 services" pop up comes out, saying it needs to close, then my screen changes dramatically. the taskbar changes to a totally different style (its like windows classic style, instead of the xp style i've selected ages ago). Right now i'm having to resort to maxthon as my internet browser as this forum page crashes firefox everytime for some reason.

I'm not sure what to do and any help will be greatly appreciated.

Here is the HJT log:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 9:55:07 PM, on 8/4/2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Sony Ericsson\Emma Core\Services\EmmaDeviceMgmt.exe
C:\Program Files\Common Files\Sony Ericsson\Emma Core\Services\EmmaUpdateMgmt.exe
C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe
C:\Program Files\Cyberlink\Shared Files\brs.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
C:\PROGRA~1\AVG\AVG9\avgtray.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Desksware\Desktop iCal\Calendar.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe
C:\Program Files\Electronic Arts\EADM\Core.exe
C:\Program Files\WordWeb\wweb32.exe
C:\Program Files\Free Download Manager\fdm.exe
C:\Program Files\NETGEAR\WG111v3\WG111v3.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\WINDOWS\system32\dwwin.exe
C:\Documents and Settings\user\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = hxxp=127.0.0.1:5555
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RemoteControl8] "C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe"
O4 - HKLM\..\Run: [PDVD8LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe"
O4 - HKLM\..\Run: [BDRegion] C:\Program Files\Cyberlink\Shared Files\brs.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [winhelper] C:\WINDOWS\system32\winhelper.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Software Informer] "C:\Program Files\Software Informer\softinfo.exe" -autorun
O4 - HKCU\..\Run: [iCalendar] C:\Program Files\Desksware\Desktop iCal\Calendar.exe
O4 - HKCU\..\Run: [Calendar] C:\Program Files\Desksware\Desktop iCal\Calendar.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon
O4 - HKCU\..\Run: [EA Core] "C:\Program Files\Electronic Arts\EADM\Core.exe" -silent
O4 - HKCU\..\Run: [WordWeb] "C:\Program Files\WordWeb\wweb32.exe" -startup
O4 - HKCU\..\Run: [Free Download Manager] "C:\Program Files\Free Download Manager\fdm.exe" -autorun
O4 - HKUS\S-1-5-18\..\Run: [kveuyugw] C:\Documents and Settings\LocalService\Local Settings\Application Data\mqjxoicml\clfkjebtssd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [kveuyugw] C:\Documents and Settings\LocalService\Local Settings\Application Data\mqjxoicml\clfkjebtssd.exe (User 'Default user')
O4 - Global Startup: NETGEAR WG111v3 Smart Wizard.lnk = C:\Program Files\NETGEAR\WG111v3\WG111v3.exe
O8 - Extra context menu item: Add to Windows &Live Favorites - hxxp://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download video with Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm
O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-au\msntabres.dll.mui/229?c800ae5be45c488bacc5566f9890f5e5
O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-au\msntabres.dll.mui/230?c800ae5be45c488bacc5566f9890f5e5
O9 - Extra button: (no name) - {39C98479-624B-4e1e-8865-F4FE46238123} - C:\Program Files\iebutton\open.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: HP Smart Select - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O16 - DPF: {0349EF81-B9C1-4B97-86F7-7B931D0E2532} (NowStarter2 Control) - hxxp://sticube.clubbox.co.kr/sticubeupdate…NowStarter2.cab
O16 - DPF: {9C23D886-43CB-43DE-B2DB-112A68D7E10A} (MySpace Uploader Control) - hxxp://lads.myspace.com/upload/MySpaceUploader2.cab
O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - hxxp://gfx1.hotmail.com/mail/w4/pr01/photo…ol/MSNPUpld.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Emma Device Management (EmmaDevMgmtSvc) - Sony Ericsson Mobile Communications - C:\Program Files\Common Files\Sony Ericsson\Emma Core\Services\EmmaDeviceMgmt.exe
O23 - Service: Emma Update Management (EmmaUpdMgmtSvc) - Sony Ericsson Mobile Communications - C:\Program Files\Common Files\Sony Ericsson\Emma Core\Services\EmmaUpdateMgmt.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: LogMeIn Hamachi 2.0 Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Sony Ericsson OMSI download service (OMSI download service) - Unknown owner - C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe

–
End of file - 11656 bytes

Here is also the initial malwarebytes scan log if it is useful.

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4387

Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180

8/4/2010 8:46:54 PM
mbam-log-2010-08-04 (20-46-54).txt

Scan type: Full scan (C:\|E:\|)
Objects scanned: 338594
Time elapsed: 1 hour(s), 9 minute(s), 46 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 6
Registry Values Infected: 3
Registry Data Items Infected: 0
Folders Infected: 1
Files Infected: 11

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{03650adb-ddc4-4f6f-bfc1-ae81e5f824f2} (Adware.PlusOn) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{109aa1f9-dcc0-4744-b82f-3a29515aaad9} (Adware.PlusOn) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{225c1d71-13d3-4452-b235-85199a3c29c2} (Adware.PlusOn) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{668f8b2e-8c37-4c38-a78e-8cb206ab0c1f} (Adware.PlusOn) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\kinple (Spyware.KinPlayer) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\KINPLE (Spyware.KinPlayer) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smartsupporter-totalvaccine (Rogue.TotalVaccine) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kinple update check (Spyware.KinPlayer) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\totalvaccine_kin (Malware.Trace) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Program Files\KinPle (Spyware.KinPlayer) -> Quarantined and deleted successfully.

Files Infected:
C:\WINDOWS\system32\smartsupporter_totalvaccine.exe (Rogue.TotalVaccine) -> Quarantined and deleted successfully.
C:\Program Files\KinPle\KinPleStart.exe (Spyware.KinPlayer) -> Quarantined and deleted successfully.
C:\Documents and Settings\user\Local Settings\Temp\dvupdater.exe (Adware.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\user\Local Settings\Temp\totalvaccinesetupr_ple.exe (Rogue.TotalVaccine) -> Quarantined and deleted successfully.
C:\Program Files\KinPle\KINPle.exe (Spyware.KinPlayer) -> Quarantined and deleted successfully.
C:\Program Files\KinPle\KPUpdate.exe (Spyware.KinPlayer) -> Quarantined and deleted successfully.
C:\Temp\dvrupdater.exe (Adware.Agent) -> Quarantined and deleted successfully.
C:\Temp\rec.exe (Adware.Kraddare.Gen) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\uninst_totalvaccine.exe (Rogue.TotalVaccine) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\KPDelete.exe (Spyware.KinPlayer) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\159.tmp (Rootkit.Dropper) -> Quarantined and deleted successfully.

*Edit* Sorry for the post modifications, but I've changed the urls from http to hxxp to avoid it being clickable working links in the logs.

Here's the MBRCheck file:
MBRCheck, version 1.2.3
© 2010, AD

Command-line:
Windows Version: Windows XP Professional
Windows Information: Service Pack 2 (build 2600)
Logical Drives Mask: 0x0000005d

Kernel Drivers (total 133):
0x804D7000 \WINDOWS\system32\ntkrnlpa.exe
0x806E2000 \WINDOWS\system32\hal.dll
0xBADA8000 \WINDOWS\system32\KDCOM.DLL
0xBACB8000 \WINDOWS\system32\BOOTVID.dll
0xBA6A7000 spve.sys
0xBADAA000 \WINDOWS\System32\Drivers\WMILIB.SYS
0xBA68F000 \WINDOWS\System32\Drivers\SCSIPORT.SYS
0xBA661000 ACPI.sys
0xBA650000 pci.sys
0xBA8A8000 ohci1394.sys
0xBA8B8000 \WINDOWS\system32\DRIVERS\1394BUS.SYS
0xBA8C8000 isapnp.sys
0xBAE70000 pciide.sys
0xBAB28000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
0xBA8D8000 MountMgr.sys
0xBA631000 ftdisk.sys
0xBADAC000 dmload.sys
0xBA60B000 dmio.sys
0xBAB30000 PartMgr.sys
0xBA8E8000 VolSnap.sys
0xBA5F3000 atapi.sys
0xBA8F8000 disk.sys
0xBA908000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xBA5D4000 fltMgr.sys
0xBA5C2000 sr.sys
0xBA918000 Lbd.sys
0xBA928000 PxHelp20.sys
0xBA5AB000 KSecDD.sys
0xBA598000 WudfPf.sys
0xBA50B000 Ntfs.sys
0xBA4DE000 NDIS.sys
0xBA4C3000 Mup.sys
0xBA998000 \SystemRoot\system32\DRIVERS\intelppm.sys
0xB91FF000 \SystemRoot\system32\DRIVERS\nv4_mini.sys
0xB91EB000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xBAC78000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0xB91C8000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xBAC80000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xB91A3000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0xB9188000 \SystemRoot\system32\DRIVERS\Rtenicxp.sys
0xBA9A8000 \SystemRoot\system32\DRIVERS\nic1394.sys
0xBAC88000 \SystemRoot\system32\DRIVERS\fdc.sys
0xBA9B8000 \SystemRoot\system32\DRIVERS\serial.sys
0xBA46F000 \SystemRoot\system32\DRIVERS\serenum.sys
0xB9174000 \SystemRoot\system32\DRIVERS\parport.sys
0xBA9C8000 \SystemRoot\system32\DRIVERS\imapi.sys
0xBA9D8000 \SystemRoot\system32\DRIVERS\cdrom.sys
0xBA9E8000 \SystemRoot\system32\DRIVERS\redbook.sys
0xB9151000 \SystemRoot\system32\DRIVERS\ks.sys
0xB911B000 \SystemRoot\System32\Drivers\abbe92ge.SYS
0xBA9F8000 \SystemRoot\system32\drivers\ScreamingBAudio.sys
0xB90F9000 \SystemRoot\system32\drivers\portcls.sys
0xBAA08000 \SystemRoot\system32\drivers\drmk.sys
0xBAE9B000 \SystemRoot\system32\DRIVERS\audstub.sys
0xBAA18000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xBA457000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xB90E2000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xBAA28000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xBAA38000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xBABB8000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xB90D1000 \SystemRoot\system32\DRIVERS\psched.sys
0xBAA48000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xBABC0000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xBABC8000 \SystemRoot\system32\DRIVERS\raspti.sys
0xBABD0000 \SystemRoot\system32\DRIVERS\hamachi.sys
0xB90A0000 \SystemRoot\system32\DRIVERS\rdpdr.sys
0xBAA58000 \SystemRoot\system32\DRIVERS\termdd.sys
0xBABD8000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xBABE0000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xBABE8000 \SystemRoot\system32\DRIVERS\seehcri.sys
0xBADD6000 \SystemRoot\system32\DRIVERS\swenum.sys
0xB906C000 \SystemRoot\system32\DRIVERS\update.sys
0xB9D34000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xBAA68000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xBAA88000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xBADDA000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xB599C000 \SystemRoot\system32\drivers\RtkHDAud.sys
0xBAC00000 \SystemRoot\system32\DRIVERS\flpydisk.sys
0xBADDE000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xBAEDF000 \SystemRoot\System32\Drivers\Null.SYS
0xBADE0000 \SystemRoot\System32\Drivers\Beep.SYS
0xBAC10000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0xBAC18000 \SystemRoot\System32\drivers\vga.sys
0xBADE4000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xBADE6000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xBAC20000 \SystemRoot\System32\Drivers\Msfs.SYS
0xBAC30000 \SystemRoot\System32\Drivers\Npfs.SYS
0xBA473000 \SystemRoot\system32\DRIVERS\rasacd.sys
0xB5905000 \SystemRoot\system32\DRIVERS\ipsec.sys
0xB58AD000 \SystemRoot\system32\DRIVERS\tcpip.sys
0xB588C000 \SystemRoot\system32\DRIVERS\ipnat.sys
0xB5852000 \SystemRoot\System32\Drivers\avgtdix.sys
0xB9839000 \SystemRoot\system32\DRIVERS\wanarp.sys
0xB9829000 \SystemRoot\system32\DRIVERS\arp1394.sys
0xB582A000 \SystemRoot\system32\DRIVERS\netbt.sys
0xB5808000 \SystemRoot\System32\drivers\afd.sys
0xB9819000 \SystemRoot\system32\DRIVERS\netbios.sys
0xB57DC000 \SystemRoot\system32\DRIVERS\rdbss.sys
0xB576D000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xB9809000 \SystemRoot\System32\Drivers\Fips.SYS
0xBAC40000 \SystemRoot\System32\Drivers\avgmfx86.sys
0xB5699000 \SystemRoot\System32\Drivers\avgldx86.sys
0xBAC48000 \SystemRoot\system32\DRIVERS\OVCD.sys
0xB575D000 \SystemRoot\system32\DRIVERS\OVCAM2.sys
0xB574D000 \SystemRoot\system32\DRIVERS\STREAM.SYS
0xB5643000 \SystemRoot\system32\DRIVERS\OVCODEK2.sys
0xBA958000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xBAC90000 \SystemRoot\System32\watchdog.sys
0xB5954000 \SystemRoot\System32\drivers\Dxapi.sys
0xBF9C1000 \SystemRoot\System32\drivers\dxg.sys
0xBAFD0000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF9D3000 \SystemRoot\System32\nv4_disp.dll
0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
0xB560B000 \SystemRoot\system32\DRIVERS\AegisP.sys
0xB4E40000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xB49B7000 \SystemRoot\system32\DRIVERS\mrxdav.sys
0xBADBA000 \SystemRoot\System32\Drivers\ParVdm.SYS
0xB475C000 \SystemRoot\system32\DRIVERS\srv.sys
0xB4877000 \SystemRoot\system32\DRIVERS\secdrv.sys
0xB4587000 \??\C:\Program Files\CyberLink\PowerDVD8\000.fcl
0xB4474000 \SystemRoot\System32\Drivers\Fastfat.SYS
0xB4288000 \SystemRoot\system32\DRIVERS\hidusb.sys
0xB4A1C000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0xB49F4000 \SystemRoot\system32\DRIVERS\mouhid.sys
0xB41BC000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0xB409F000 \SystemRoot\system32\drivers\wdmaud.sys
0xB44A7000 \SystemRoot\system32\drivers\sysaudio.sys
0xB402A000 \SystemRoot\system32\drivers\kmixer.sys
0xB3D67000 \SystemRoot\System32\Drivers\HTTP.sys
0xB306F000 \SystemRoot\system32\DRIVERS\wg111v3.sys
0x7C900000 \WINDOWS\system32\ntdll.dll
0x10000000 \Program Files\DAEMON Tools Lite\daemon.dll

Processes (total 59):
0 System Idle Process
4 System
756 C:\WINDOWS\system32\smss.exe
824 csrss.exe
848 C:\WINDOWS\system32\winlogon.exe
892 C:\WINDOWS\system32\services.exe
904 C:\WINDOWS\system32\lsass.exe
1064 C:\WINDOWS\system32\svchost.exe
1132 svchost.exe
1276 C:\WINDOWS\system32\svchost.exe
1324 C:\WINDOWS\system32\svchost.exe
1444 svchost.exe
1528 C:\Program Files\AVG\AVG9\avgchsvx.exe
1536 C:\Program Files\AVG\AVG9\avgrsx.exe
1592 svchost.exe
1664 C:\Program Files\AVG\AVG9\avgcsrvx.exe
184 C:\WINDOWS\system32\svchost.exe
272 C:\WINDOWS\system32\spoolsv.exe
476 C:\Program Files\AVG\AVG9\avgwdsvc.exe
488 C:\Program Files\Bonjour\mDNSResponder.exe
576 svchost.exe
732 C:\Program Files\Common Files\Sony Ericsson\Emma Core\Services\EmmaDeviceMgmt.exe
784 C:\Program Files\Common Files\Sony Ericsson\Emma Core\Services\EmmaUpdateMgmt.exe
968 C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
1088 C:\WINDOWS\system32\svchost.exe
1204 C:\Program Files\Java\jre6\bin\jqs.exe
2032 C:\Program Files\Common Files\LightScribe\LSSrvc.exe
1424 C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
2108 C:\WINDOWS\system32\svchost.exe
2124 C:\WINDOWS\system32\nvsvc32.exe
2168 C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe
2264 C:\WINDOWS\system32\svchost.exe
2276 C:\WINDOWS\system32\svchost.exe
2308 C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
2448 C:\WINDOWS\system32\svchost.exe
2736 C:\Program Files\AVG\AVG9\avgnsx.exe
1936 alg.exe
2692 wmiprvse.exe
3648 C:\WINDOWS\system32\wscntfy.exe
3732 C:\WINDOWS\explorer.exe
2572 C:\WINDOWS\RTHDCPL.exe
652 C:\WINDOWS\SoundMan.exe
700 C:\WINDOWS\system32\rundll32.exe
744 C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe
1192 C:\Program Files\CyberLink\Shared Files\brs.exe
1412 C:\WINDOWS\system32\rundll32.exe
2596 C:\Program Files\HP\Digital Imaging\bin\HpqSRmon.exe
1492 C:\PROGRA~1\AVG\AVG9\avgtray.exe
3720 C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe
2072 C:\Program Files\Common Files\Java\Java Update\jusched.exe
2080 C:\Program Files\Windows Live\Messenger\msnmsgr.exe
2092 C:\Program Files\Desksware\Desktop iCal\Calendar.exe
2136 C:\WINDOWS\system32\ctfmon.exe
2144 C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe
2236 C:\Program Files\WordWeb\wweb32.exe
2288 C:\Program Files\Free Download Manager\fdm.exe
2332 C:\Program Files\NETGEAR\WG111v3\WG111v3.exe
1680 C:\Program Files\Maxthon2\Maxthon.exe
1900 C:\Documents and Settings\user\Desktop\MBRCheck.exe

\\.\C: –> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)
\\.\E: –> \\.\PhysicalDrive0 at offset 0x00000049`4410e000 (NTFS)

PhysicalDrive0 Model Number: WDCWD6400AACS-00G8B1, Rev: 05.04C05

Size Device Name MBR Status
——————————————–
596 GB \\.\PhysicalDrive0 Known-bad MBR code detected (Whistler / Black Internet)!
SHA1: 680C3DFB3AF5C02B7E098CA7B25CA73D63745DC5


Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:

Done!

DDS File:

DDS (Ver_10-03-17.01) - NTFSx86
Run by [removed] at 17:03:48.51 on Thu 08/05/2010
Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_20
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.3326.2639 [GMT 10:00]

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
svchost.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
svchost.exe 4
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
svchost.exe
C:\Program Files\Common Files\Sony Ericsson\Emma Core\Services\EmmaDeviceMgmt.exe
C:\Program Files\Common Files\Sony Ericsson\Emma Core\Services\EmmaUpdateMgmt.exe
C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
C:\WINDOWS\system32\svchost.exe -k hpdevmgmt
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe
svchost.exe 4
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe
C:\Program Files\Cyberlink\Shared Files\brs.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
C:\PROGRA~1\AVG\AVG9\avgtray.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Desksware\Desktop iCal\Calendar.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe
C:\Program Files\WordWeb\wweb32.exe
C:\Program Files\Free Download Manager\fdm.exe
C:\Program Files\NETGEAR\WG111v3\WG111v3.exe
C:\Program Files\Maxthon2\Maxthon.exe
C:\Documents and Settings\user\Desktop\dds.com

============== Pseudo HJT Report ===============

uStart Page = about:blank
uInternet Settings,ProxyOverride =
uInternet Settings,ProxyServer = http=127.0.0.1:5555
BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SearchHelper.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: FDMIECookiesBHO Class: {cc59e0f9-7e43-44fa-9faa-8377850bf205} - c:\program files\free download manager\iefdm2.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
TB: &Windows; Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll
TB: {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - No File
EB: ¼îÇΰ˻ö-¿Á¼Ç¿ÀǼîÇÎ (DB): {40eb63da-1024-427f-a41c-023e0a2e26db} - c:\program files\shopping search\\dvrbar.dll
uRun: [MsnMsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
uRun: [Software Informer] "c:\program files\software informer\softinfo.exe" -autorun
uRun: [fsm]
uRun: [iCalendar] c:\program files\desksware\desktop ical\Calendar.exe
uRun: [Calendar] c:\program files\desksware\desktop ical\Calendar.exe
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [Sony Ericsson PC Suite] "c:\program files\sony ericsson\sony ericsson pc suite\SEPCSuite.exe" /systray /nologon
uRun: [EA Core] "c:\program files\electronic arts\eadm\Core.exe" -silent
uRun: [WordWeb] "c:\program files\wordweb\wweb32.exe" -startup
uRun: [Free Download Manager] "c:\program files\free download manager\fdm.exe" -autorun
mRun: [IMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
mRun: [MSPY2002] c:\windows\system32\ime\pintlgnt\ImScInst.exe /SYNC
mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC
mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [SoundMan] SOUNDMAN.EXE
mRun: [AlcWzrd] ALCWZRD.EXE
mRun: [Alcmtr] ALCMTR.EXE
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [RemoteControl8] "c:\program files\cyberlink\powerdvd8\PDVD8Serv.exe"
mRun: [PDVD8LanguageShortcut] "c:\program files\cyberlink\powerdvd8\language\Language.exe"
mRun: [BDRegion] c:\program files\cyberlink\shared files\brs.exe
mRun: [NeroFilterCheck] c:\program files\common files\nero\lib\NeroCheck.exe
mRun: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
mRun: [hpqSRMon] c:\program files\hp\digital imaging\bin\hpqSRMon.exe
mRun: [AVG9_TRAY] c:\progra~1\avg\avg9\avgtray.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [winhelper] c:\windows\system32\winhelper.exe
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
dRun: [kveuyugw] c:\documents and settings\localservice\local settings\application data\mqjxoicml\clfkjebtssd.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\netgea~1.lnk - c:\program files\netgear\wg111v3\WG111v3.exe
IE: Add to Windows &Live; Favorites - http://favorites.live.com/quickadd.aspx
IE: Download all with Free Download Manager - file://c:\program files\free download manager\dlall.htm
IE: Download selected with Free Download Manager - file://c:\program files\free download manager\dlselected.htm
IE: Download video with Free Download Manager - file://c:\program files\free download manager\dlfvideo.htm
IE: Download with Free Download Manager - file://c:\program files\free download manager\dllink.htm
IE: E&xport; to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: Open in new background tab - c:\program files\windows live toolbar\components\en-au\msntabres.dll.mui/229?c800ae5be45c488bacc5566f9890f5e5
IE: Open in new foreground tab - c:\program files\windows live toolbar\components\en-au\msntabres.dll.mui/230?c800ae5be45c488bacc5566f9890f5e5
IE: {39C98479-624B-4e1e-8865-F4FE46238123} - c:\program files\iebutton\open.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
DPF: {0349EF81-B9C1-4B97-86F7-7B931D0E2532} - hxxp://sticube.clubbox.co.kr/sticubeupdate/cab/NowStarter2.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {9C23D886-43CB-43DE-B2DB-112A68D7E10A} - hxxp://lads.myspace.com/upload/MySpaceUploader2.cab
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} - hxxp://gfx1.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll
Notify: avgrsstarter - avgrsstx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "c:\program files\common files\lightscribe\LSRunOnce.exe"
Hosts: 127.0.0.1 www.spywareinfo.com

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\galien~1\applic~1\mozilla\firefox\profiles\ygqrzirg.default\
FF - prefs.js: browser.search.selectedEngine - Wikipedia (en)
FF - prefs.js: network.proxy.type - 0
FF - component: c:\documents and settings\user\application data\mozilla\firefox\profiles\ygqrzirg.default\extensions\[removed]\components\firedownload.dll
FF - component: c:\program files\avg\avg9\firefox\components\avgssff.dll
FF - component: c:\program files\free download manager\firefox\extension\components\vmsfdmff.dll
FF - plugin: c:\documents and settings\user\application data\facebook\npfbplugin_1_0_3.dll
FF - plugin: c:\program files\google\update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

—- FIREFOX POLICIES —-
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbaam7a8h", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4ar", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–p1ai", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbayh7gpa", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-8-9 64160]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-2-16 216400]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-2-16 29584]
R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-2-16 243024]
R2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};c:\program files\cyberlink\powerdvd8\000.fcl [2008-8-8 41456]
R2 avg9wd;AVG Free WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2010-7-17 308136]
R2 EmmaDevMgmtSvc;Emma Device Management;c:\program files\common files\sony ericsson\emma core\services\EmmaDeviceMgmt.exe [2010-2-2 306296]
R2 EmmaUpdMgmtSvc;Emma Update Management;c:\program files\common files\sony ericsson\emma core\services\EmmaUpdateMgmt.exe [2010-2-2 162936]
R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;c:\program files\logmein hamachi\hamachi-2.exe [2009-10-29 1074568]
R2 OMSI download service;Sony Ericsson OMSI download service;c:\program files\sony ericsson\sony ericsson pc suite\SupServ.exe [2010-2-13 90112]
R3 RTL8187B;NETGEAR WG111v3 54Mbps Wireless USB 2.0 Adapter Vista Driver;c:\windows\system32\drivers\wg111v3.sys [2007-4-23 224896]
R3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\ScreamingBAudio.sys [2009-12-1 34384]
R3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\drivers\seehcri.sys [2009-12-10 27632]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-6-11 136176]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-7-4 1029456]
S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [2009-12-12 13224]
S3 s1018bus;Sony Ericsson Device 1018 driver (WDM);c:\windows\system32\drivers\s1018bus.sys [2009-6-23 86824]
S3 s1018mdfl;Sony Ericsson Device 1018 USB WMC Modem Filter;c:\windows\system32\drivers\s1018mdfl.sys [2009-6-23 15016]
S3 s1018mdm;Sony Ericsson Device 1018 USB WMC Modem Driver;c:\windows\system32\drivers\s1018mdm.sys [2009-6-23 114728]
S3 s1018mgmt;Sony Ericsson Device 1018 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s1018mgmt.sys [2009-6-23 106208]
S3 s1018nd5;Sony Ericsson Device 1018 USB Ethernet Emulation (NDIS);c:\windows\system32\drivers\s1018nd5.sys [2009-6-23 26024]
S3 s1018obex;Sony Ericsson Device 1018 USB WMC OBEX Interface;c:\windows\system32\drivers\s1018obex.sys [2009-6-23 104744]
S3 s1018unic;Sony Ericsson Device 1018 USB Ethernet Emulation (WDM);c:\windows\system32\drivers\s1018unic.sys [2009-6-23 109864]

=============== Created Last 30 ================

2010-07-31 03:19:53 3667426 —-a-w- c:\windows\SNSD SPAO ScreenSaver3.scr
2010-07-31 03:19:48 798311 —-a-w- c:\windows\SNSD SPAO ScreenSaver1.scr
2010-07-31 03:19:42 571044 —-a-w- c:\windows\SPAO_SNSD_ScreenSaver.scr
2010-07-21 12:59:58 0 —ha-w- c:\windows\system32\drivers\Msft_Kernel_ggflt_01007.Wdf
2010-07-17 04:49:44 12536 —-a-w- c:\windows\system32\avgrsstx.dll
2010-07-14 08:00:08 411368 —-a-w- c:\windows\system32\deployJava1.dll
2010-07-12 06:56:54 0 d—–w- c:\windows\system32\wbem\Repository
2010-07-06 15:49:59 0 d—–w- c:\windows\pss

==================== Find3M ====================

2010-07-20 06:59:04 6786252 —-a-w- c:\windows\system32\2ndrive_setup.exe
2010-07-17 04:49:45 243024 —-a-w- c:\windows\system32\drivers\avgtdix.sys
2010-07-17 04:49:15 216400 —-a-w- c:\windows\system32\drivers\avgldx86.sys
2010-07-02 05:29:58 2838528 —-a-w- c:\windows\system32\clubbox.exe
2010-05-20 08:01:46 413696 —-a-w- c:\windows\system32\wrap_oal.dll
2010-05-20 08:01:46 110592 —-a-w- c:\windows\system32\OpenAL32.dll
2010-05-20 07:28:15 20992 —-a-w- c:\windows\jestertb.dll
2007-04-23 03:21:16 269824 -c–a-w- c:\windows\inf\wg111v3\vista64\wg111v3.sys
2007-04-23 03:11:54 224896 -c–a-w- c:\windows\inf\wg111v3\wg111v3.sys
2006-12-15 00:30:36 98304 -c–a-w- c:\windows\inf\wg111v3\UScanM.exe
2006-12-15 00:30:36 66048 -c–a-w- c:\windows\inf\wg111v3\EAPPkt.sys
2006-12-15 00:30:36 315392 -c–a-w- c:\windows\inf\wg111v3\InstallDriver.exe
2006-12-15 00:30:36 28672 -c–a-w- c:\windows\inf\wg111v3\SetDrv.exe
2006-12-15 00:30:36 212992 -c–a-w- c:\windows\inf\wg111v3\CopyWHQLDriver.exe
2006-12-15 00:30:36 20480 -c–a-w- c:\windows\inf\wg111v3\RTWUPath.exe
2006-12-15 00:30:36 19968 -c–a-w- c:\windows\inf\wg111v3\RTWREFU.EXE

============= FINISH: 17:04:39.29 ===============

Attach File:

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-03-17.01)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 2/16/2009 3:53:31 PM
System Uptime: 8/5/2010 4:54:26 PM (1 hours ago)

Motherboard: Gigabyte Technology Co., Ltd. | | EP45-UD3
Processor: Intel Pentium III Xeon processor | Socket 775 | 2333/333mhz
Processor: Intel Pentium III Xeon processor | Socket 775 | 2333/333mhz
Processor: Intel Pentium III Xeon processor | Socket 775 | 2333/333mhz
Processor: Intel Pentium III Xeon processor | Socket 775 | 2333/333mhz

==== Disk Partitions =========================

A: is Removable
C: is FIXED (NTFS) - 293 GiB total, 29.972 GiB free.
D: is CDROM ()
E: is FIXED (NTFS) - 303 GiB total, 28.866 GiB free.
G: is CDROM ()

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP426: 6/15/2010 6:59:35 PM - System Checkpoint
RP427: 6/16/2010 9:01:38 PM - System Checkpoint
RP428: 6/17/2010 9:10:21 PM - System Checkpoint
RP429: 6/19/2010 4:17:58 PM - System Checkpoint
RP430: 6/20/2010 6:12:25 PM - System Checkpoint
RP431: 6/21/2010 7:44:43 PM - System Checkpoint
RP432: 6/23/2010 11:06:34 PM - System Checkpoint
RP433: 6/24/2010 11:36:45 PM - System Checkpoint
RP434: 6/25/2010 3:53:07 PM - Avg Update
RP435: 6/26/2010 4:26:32 PM - System Checkpoint
RP436: 6/27/2010 7:22:09 PM - System Checkpoint
RP437: 6/28/2010 8:44:36 PM - System Checkpoint
RP438: 6/30/2010 2:43:01 AM - System Checkpoint
RP439: 7/1/2010 1:39:56 PM - System Checkpoint
RP440: 7/2/2010 5:31:44 PM - System Checkpoint
RP441: 7/3/2010 5:56:15 PM - System Checkpoint
RP442: 7/4/2010 6:52:02 PM - System Checkpoint
RP443: 7/5/2010 7:24:12 PM - System Checkpoint
RP444: 7/6/2010 8:30:09 PM - System Checkpoint
RP445: 7/7/2010 11:14:22 PM - System Checkpoint
RP446: 7/9/2010 1:27:04 AM - System Checkpoint
RP447: 7/10/2010 2:55:37 AM - System Checkpoint
RP448: 7/11/2010 3:24:13 AM - System Checkpoint
RP449: 7/12/2010 4:56:02 PM - Restore Operation
RP450: 7/13/2010 11:46:15 PM - System Checkpoint
RP451: 7/14/2010 5:59:23 PM - Installed Java™ 6 Update 20
RP452: 7/15/2010 7:26:22 PM - System Checkpoint
RP453: 7/17/2010 2:48:27 PM - Avg Update
RP454: 7/17/2010 2:49:53 PM - Avg Update
RP455: 7/18/2010 6:27:23 PM - System Checkpoint
RP456: 7/19/2010 8:43:51 PM - System Checkpoint
RP457: 7/20/2010 11:27:47 PM - System Checkpoint
RP458: 7/21/2010 5:09:49 PM - Avg Update
RP459: 7/21/2010 10:56:53 PM - Installed Sony Ericsson Drivers
RP460: 7/22/2010 11:57:13 PM - System Checkpoint
RP461: 7/24/2010 12:06:43 AM - System Checkpoint
RP462: 7/25/2010 1:02:47 AM - System Checkpoint
RP463: 7/26/2010 1:51:19 AM - System Checkpoint
RP464: 7/27/2010 2:51:19 AM - System Checkpoint
RP465: 7/28/2010 3:51:19 AM - System Checkpoint
RP466: 7/29/2010 4:51:19 AM - System Checkpoint
RP467: 7/30/2010 4:07:22 PM - System Checkpoint
RP468: 7/31/2010 4:33:42 PM - System Checkpoint
RP469: 8/1/2010 5:29:56 PM - System Checkpoint
RP470: 8/2/2010 7:03:06 PM - System Checkpoint

==== Installed Programs ======================

¼îÇΰ˻ö-¿Á¼Ç¿ÀǼîÇÎ (DB)
µTorrent
Ŭ·´¹Ú½º ÆÄÀÏÀü¼Û°ü¸®ÀÚ
1_screensaver_1
2007 Microsoft Office Suite Service Pack 1 (SP1)
3 Mobile Broadband
32 Bit HP CIO Components Installer
7-Zip 4.65
AAC Decoder
Acrobat.com
Ad-Aware
Adobe AIR
Adobe Anchor Service CS3
Adobe Asset Services CS3
Adobe Bridge CS3
Adobe Bridge Start Meeting
Adobe Camera Raw 4.0
Adobe CMaps
Adobe Color - Photoshop Specific
Adobe Color Common Settings
Adobe Color EU Extra Settings
Adobe Color JA Extra Settings
Adobe Color NA Recommended Settings
Adobe Default Language CS3
Adobe Device Central CS3
Adobe ExtendScript Toolkit 2
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Fonts All
Adobe Help Viewer CS3
Adobe Linguistics CS3
Adobe PDF Library Files
Adobe Photoshop CS3
Adobe Reader 9.3.3
Adobe Setup
Adobe Stock Photos CS3
Adobe Type Support
Adobe Update Manager CS3
Adobe Version Cue CS3 Client
Adobe WinSoft Linguistics Plugin
Adobe XMP Panels CS3
Age of Mythology
Audacity 1.3.6 (Unicode)
AutoUpdate
Avanquest update
AVCWare Video Converter
AVG Free 9.0
BufferChm
Burnout™ Paradise The Ultimate Box
ClPhpEd(remove only)
Clubbox ÆÄÀÏÀü¼Û°ü¸®ÀÚ
Compatibility Pack for the 2007 Office system
Cooking Academy 2 Free Trial
Copy
Cram Jam 1.0
CSI-Miami
CustomerResearchQFolder
CyberLink PowerDVD 8
Desktop iCalendar Lite 1.1.0
Destination Component
DeviceDiscovery
DeviceManagementQFolder
DivX Codec
DivX Converter
DivX Player
DivX Plus DirectShow Filters
DivX Version Checker
DivX Web Player
DJ_AIO_03_F2200_ProductContext
DJ_AIO_03_F2200_Software
DJ_AIO_03_F2200_Software_Min
EA Download Manager
Electronic Piano 2.5
Emma Core
eSupportQFolder
F2200
F2200_Help
Facebook Plug-In
Free Download Manager 3.0
Free Video Flip and Rotate version 1.5
Free Video to MP3 Converter version 3.2
Freelang Dictionary (wordlist)
Freelang Dictionary 3.74 beta
FreeRIP v3.1
GOM Player
Google Update Helper
GPBaseService
H.264 Decoder
High Definition Audio Driver Package - KB888111
Hotfix for Windows XP (KB926239)
HP Customer Participation Program 10.0
HP Deskjet F2200 All-In-One Driver Software 10.0 Rel .3
HP Imaging Device Functions 10.0
HP Photosmart Essential 2.5
HP Smart Web Printing
HP Solution Center 10.0
HP Update
HPProductAssistant
HPSSupply
Japanese Fonts Support For Adobe Reader 9
Java Auto Updater
Java™ 6 Update 20
K-Lite Codec Pack 4.1.7 (Full)
LAME v3.98.2 for Audacity
LightScribe System Software 1.12.33.2
Livestation
LogMeIn Hamachi
Malwarebytes' Anti-Malware
MarketResearch
Maxthon2
Messenger Plus! Live
Microsoft .NET Framework 2.0
Microsoft Application Error Reporting
Microsoft Choice Guard
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
Microsoft Office Professional Edition 2003
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office SharePoint Designer 2007
Microsoft Office SharePoint Designer 2007 Service Pack 1 (SP1)
Microsoft Office SharePoint Designer MUI (English) 2007
Microsoft Search Enhancement Pack
Microsoft Software Update for Web Folders (English) 12
Microsoft Sync Framework Runtime Native v1.0 (x86)
Microsoft Sync Framework Services Native v1.0 (x86)
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft WSE 3.0 Runtime
Microsoft XML Parser
MIKSOFT Mobile AMR converter
MKV Splitter
MorphVOX Junior
Mozilla Firefox (3.6.8)
MSVCRT
MSXML4 Parser
Nero 8 Essentials
neroxml
NETGEAR WG111v3 wireless USB 2.0 adapter
Notepad++
NVIDIA Drivers
NVIDIA PhysX v8.09.04
OneCare Advisor (Windows Live Toolbar)
OpenAL
PDF Settings
Popup Blocker (Windows Live Toolbar)
PSSWCORE
Real Alternative 1.9.0
REALTEK GbE & FE Ethernet PCI-E NIC Driver
Realtek High Definition Audio Driver
Scan
Segoe UI
SEMC OMSI Module
Shop for HP Supplies
Smart Menus (Windows Live Toolbar)
SmartSupporter
SmartWebPrintingOC
SolutionCenter
Sony Ericsson PC Companion 1.50.52
Sony Ericsson PC Suite 6.011.00
Sony Ericsson Themes Creator [removed]
Spybot - Search & Destroy
Status
StepMania 4 alpha 4 (remove only)
SWAT 4
Tabbed Browsing (Windows Live Toolbar)
The Sims™ 3
Toolbox
TrayApp
TVAnts 1.0
UnloadSupport
Update Service
VC80CRTRedist - 8.0.50727.762
VCRedistSetup
VideoToolkit01
ViiKii Desktop Plug-in
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
VLC media player 1.0.5
Warmonger
WebFldrs XP
WebReg
Winamp
Windows ie button
Windows Installer 3.1 (KB893803)
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Favorites for Windows Live Toolbar
Windows Live Messenger
Windows Live Outlook Toolbar (Windows Live Toolbar)
Windows Live Sign-in Assistant
Windows Live Toolbar
Windows Live Toolbar Extension (Windows Live Toolbar)
Windows Live Toolbar Feed Detector (Windows Live Toolbar)
Windows Live Upload Tool
Windows Media Format 11 runtime
Windows Media Player 11
Windows XP Hotfix - KB867282
Windows XP Hotfix - KB873333
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB884020
Windows XP Hotfix - KB885250
Windows XP Hotfix - KB885523
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB885932
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB887742
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890047
Windows XP Hotfix - KB890175
Windows XP Hotfix - KB891781
WinRAR archiver
WordWeb
Xilisoft Video Converter 3
Xvid 1.2.1 final uninstall
ZillaTube 4.0

==== Event Viewer Messages From Past Week ========

8/4/2010 9:45:43 PM, error: Service Control Manager [7034] - The LogMeIn Hamachi 2.0 Tunneling Engine service terminated unexpectedly. It has done this 1 time(s).
8/4/2010 9:45:38 PM, error: Service Control Manager [7031] - The Lavasoft Ad-Aware Service service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service.
8/4/2010 9:35:51 PM, error: Service Control Manager [7023] - The Windows Firewall/Internet Connection Sharing (ICS) service terminated with the following error: Access is denied.
8/4/2010 6:08:36 PM, error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Windows Management Instrumentation service, but this action failed with the following error: An instance of the service is already running.
7/30/2010 3:50:52 PM, error: Service Control Manager [7022] - The HP CUE DeviceDiscovery Service service hung on starting.
7/30/2010 3:49:35 PM, error: Ftdisk [49] - Configuring the Page file for crash dump failed. Make sure there is a page file on the boot partition and that is large enough to contain all physical memory.
7/30/2010 3:49:35 PM, error: Ftdisk [45] - The system could not sucessfully load the crash dump driver.

==== End Of File ===========================

For the GMER file, the program takes about 6+ hours to scan and keeps crashing and freezing my computer so i've been unable to save the file. I'm scanning again and i'll try to upload the file as soon as possible.

Here's the GMER file:
GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-08-06 22:30:46
Windows 5.1.2600 Service Pack 2
Running: wu1tt66b.exe; Driver: C:\DOCUME~1\GALIEN~1\LOCALS~1\Temp\awxiikod.sys


—- System - GMER 1.0.15 —-

SSDT Lbd.sys (Boot Driver/Lavasoft AB) ZwCreateKey [0xBA91887E]
SSDT spmv.sys ZwEnumerateKey [0xBA6C6CA2]
SSDT spmv.sys ZwEnumerateValueKey [0xBA6C7030]
SSDT spmv.sys ZwOpenKey [0xBA6A80C0]
SSDT spmv.sys ZwQueryKey [0xBA6C7108]
SSDT spmv.sys ZwQueryValueKey [0xBA6C6F88]
SSDT Lbd.sys (Boot Driver/Lavasoft AB) ZwSetValueKey [0xBA918BFE]

INT 0x62 ? 8AF88BF8
INT 0x63 ? 8AD97BF8
INT 0x63 ? 8AD97BF8
INT 0x73 ? 8AF88BF8
INT 0x73 ? 8AF88BF8
INT 0x73 ? 8AF88BF8
INT 0x73 ? 8AF88BF8
INT 0x73 ? 8AD97BF8
INT 0x73 ? 8AF88BF8
INT 0x82 ? 8AF88BF8
INT 0x83 ? 8AD97BF8
INT 0xA4 ? 8AD97BF8
INT 0xA4 ? 8AD97BF8
INT 0xA4 ? 8AD97BF8
INT 0xA4 ? 8AD97BF8
INT 0xB4 ? 8AD97BF8

—- Kernel code sections - GMER 1.0.15 —-

? spmv.sys The system cannot find the file specified. !
.text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xB92C3360, 0x32E00D, 0xE8000020]
.text USBPORT.SYS!DllUnload B92A462C 5 Bytes JMP 8AD971D8
.text ait2ptzp.SYS B91DF386 35 Bytes [00, 00, 00, 00, 00, 00, 20, …]
.text ait2ptzp.SYS B91DF3AA 24 Bytes [00, 00, 00, 00, 00, 00, 00, …]
.text ait2ptzp.SYS B91DF3C4 3 Bytes [00, 70, 02] {ADD [EAX+0x2], DH}
.text ait2ptzp.SYS B91DF3C9 1 Byte [2E]
.text ait2ptzp.SYS B91DF3C9 11 Bytes [2E, 00, 00, 00, 5C, 02, 00, …] {ADD CS:[EAX], AL; ADD [EDX+EAX+0x0], BL; ADD [EAX], AL; ADD [EAX], AL}
.text …
C:\Program Files\CyberLink\PowerDVD8\000.fcl entry point in "" section [0xB5736000]
.clc C:\Program Files\CyberLink\PowerDVD8\000.fcl unknown last section [0xB5737000, 0x1000, 0x00000000]

—- User code sections - GMER 1.0.15 —-

.text C:\WINDOWS\System32\svchost.exe[1412] ntdll.dll!NtProtectVirtualMemory 7C90DEB6 5 Bytes JMP 008E000A
.text C:\WINDOWS\System32\svchost.exe[1412] ntdll.dll!NtWriteVirtualMemory 7C90EA32 5 Bytes JMP 008F000A
.text C:\WINDOWS\System32\svchost.exe[1412] ntdll.dll!KiUserExceptionDispatcher 7C90EAEC 5 Bytes JMP 008D000C
.text C:\WINDOWS\System32\svchost.exe[1412] USER32.dll!GetCursorPos 77D4C566 5 Bytes JMP 0145000A
.text C:\WINDOWS\System32\svchost.exe[1412] ole32.dll!CoCreateInstance 77500326 5 Bytes JMP 00AC000A
.text C:\WINDOWS\Explorer.EXE[3092] ntdll.dll!NtProtectVirtualMemory 7C90DEB6 5 Bytes JMP 00A1000A
.text C:\WINDOWS\Explorer.EXE[3092] ntdll.dll!NtWriteVirtualMemory 7C90EA32 5 Bytes JMP 00AF000A
.text C:\WINDOWS\Explorer.EXE[3092] ntdll.dll!KiUserExceptionDispatcher 7C90EAEC 5 Bytes JMP 00A0000C
.text C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[3484] USER32.dll!SetPropW + 11B 77D4DECE 7 Bytes JMP 1004BF70 C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software)
.text C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[3484] USER32.dll!SetWindowRgn + 2BD 77D5209D 7 Bytes JMP 1004BE30 C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software)
.text C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[3484] USER32.dll!SetClipboardData + 259 77D70169 7 Bytes JMP 1004BF50 C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software)
.text C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[3484] USER32.dll!MessageBoxA + 49 77D80554 7 Bytes JMP 1004C040 C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software)
.text C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[3484] USER32.dll!MessageBoxExW + 1F 77D80578 7 Bytes JMP 1004C090 C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software)
.text C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[3484] USER32.dll!MessageBoxTimeoutA + CA 77D960B2 7 Bytes JMP 1004BFC0 C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software)

—- Devices - GMER 1.0.15 —-

Device \FileSystem\Ntfs \Ntfs 8AF871F8
Device \FileSystem\Fastfat \FatCdrom 89B97500
Device \Driver\NetBT \Device\NetBT_Tcpip_{7FD36A1E-4483-46E8-B234-42D24531493A} 8A759500
Device \Driver\NetBT \Device\NetBT_Tcpip_{A3205CFC-D535-4F92-BDE2-18297819E998} 8A759500

AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

Device \Driver\usbuhci \Device\USBPDO-0 8AD2F1F8
Device \Driver\dmio \Device\DmControl\DmIoDaemon 8AF141F8
Device \Driver\dmio \Device\DmControl\DmConfig 8AF141F8
Device \Driver\dmio \Device\DmControl\DmPnP 8AF141F8
Device \Driver\dmio \Device\DmControl\DmInfo 8AF141F8
Device \Driver\usbuhci \Device\USBPDO-1 8AD2F1F8
Device \Driver\usbuhci \Device\USBPDO-2 8AD2F1F8
Device \Driver\usbehci \Device\USBPDO-3 8AD8E500
Device \Driver\usbuhci \Device\USBPDO-4 8AD2F1F8

AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Tcp Lbd.sys (Boot Driver/Lavasoft AB)

Device \Driver\usbuhci \Device\USBPDO-5 8AD2F1F8
Device \Driver\usbuhci \Device\USBPDO-6 8AD2F1F8
Device \Driver\Ftdisk \Device\HarddiskVolume1 8AF891F8
Device \Driver\usbehci \Device\USBPDO-7 8AD8E500
Device \Driver\Ftdisk \Device\HarddiskVolume2 8AF891F8
Device \Driver\Cdrom \Device\CdRom0 8ACD11F8
Device \Driver\Cdrom \Device\CdRom1 8ACD11F8
Device \Driver\atapi \Device\Ide\IdePort0 8AF881F8
Device \Driver\atapi \Device\Ide\IdePort1 8AF881F8
Device \Driver\atapi \Device\Ide\IdePort2 8AF881F8
Device \Driver\atapi \Device\Ide\IdePort3 8AF881F8
Device \Driver\atapi \Device\Ide\IdePort4 8AF881F8
Device \Driver\atapi \Device\Ide\IdePort5 8AF881F8
Device \Driver\atapi \Device\Ide\IdeDeviceP3T0L0-7 8AF881F8
Device \Driver\NetBT \Device\NetBt_Wins_Export 8A759500
Device \Driver\NetBT \Device\NetbiosSmb 8A759500
Device \Driver\PCI_PNP9060 \Device\0000004d spmv.sys

AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Udp Lbd.sys (Boot Driver/Lavasoft AB)
AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\RawIp Lbd.sys (Boot Driver/Lavasoft AB)

Device \Driver\usbuhci \Device\USBFDO-0 8AD2F1F8
Device \Driver\usbuhci \Device\USBFDO-1 8AD2F1F8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 8A75A500
Device \Driver\usbuhci \Device\USBFDO-2 8AD2F1F8
Device \FileSystem\MRxSmb \Device\LanmanRedirector 8A75A500
Device \Driver\usbehci \Device\USBFDO-3 8AD8E500
Device \Driver\sptd \Device\3937919060 spmv.sys
Device \Driver\usbuhci \Device\USBFDO-4 8AD2F1F8
Device \Driver\Ftdisk \Device\FtControl 8AF891F8
Device \Driver\usbuhci \Device\USBFDO-5 8AD2F1F8
Device \Driver\usbuhci \Device\USBFDO-6 8AD2F1F8
Device \Driver\usbehci \Device\USBFDO-7 8AD8E500
Device \Driver\ait2ptzp \Device\Scsi\ait2ptzp1 8ACBD1F8
Device \Driver\ait2ptzp \Device\Scsi\ait2ptzp1Port6Path0Target0Lun0 8ACBD1F8
Device \FileSystem\Fastfat \Fat 89B97500

AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

Device \FileSystem\Cdfs \Cdfs 8A12A1F8

—- Registry - GMER 1.0.15 —-

Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\000d18011c26
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\000d18011c26@0016205a557d 0x53 0x45 0x7B 0xFE …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x3E 0x68 0xEB 0x78 …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x9A 0x51 0x2F 0xE1 …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x4E 0xD6 0x72 0xE6 …
Reg HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\000d18011c26 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\000d18011c26@0016205a557d 0x53 0x45 0x7B 0xFE …
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x3E 0x68 0xEB 0x78 …
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x9A 0x51 0x2F 0xE1 …
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x4E 0xD6 0x72 0xE6 …

—- EOF - GMER 1.0.15 —-

it worked this time =)

Here's the combofix file:

ComboFix 10-08-06.01 - User 08/07/2010 23:30:12.1.4 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.3326.2747 [GMT 10:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\hpe252.dll
c:\documents and settings\All Users\Application Data\hpe429.dll
c:\windows\jestertb.dll

Infected copy of c:\windows\system32\drivers\rdpcdd.sys was found and disinfected
Restored copy from - Kitty had a snack
.
\\.\PhysicalDrive0 - Bootkit Whistler was found and disinfected
.
((((((((((((((((((((((((( Files Created from 2010-07-07 to 2010-08-07 )))))))))))))))))))))))))))))))
.

2010-07-31 03:19 . 2010-07-31 03:19 3667426 —-a-w- c:\windows\SNSD SPAO ScreenSaver3.scr
2010-07-31 03:19 . 2010-07-31 03:19 798311 —-a-w- c:\windows\SNSD SPAO ScreenSaver1.scr
2010-07-31 03:19 . 2010-07-31 03:19 571044 —-a-w- c:\windows\SPAO_SNSD_ScreenSaver.scr
2010-07-30 05:50 . 2010-08-07 13:22 ——– d—–w- c:\windows\system32\config\systemprofile\Application Data\HPAppData
2010-07-21 07:10 . 2010-07-21 07:10 1615200 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgssie.dll
2010-07-21 07:09 . 2010-07-21 07:09 1373536 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgssff.dll
2010-07-21 07:09 . 2010-07-21 07:09 4368224 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgcorex.dll
2010-07-21 07:09 . 2010-07-21 07:09 1107296 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgxpl.dll
2010-07-17 04:50 . 2010-07-17 04:50 242896 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgtdix.sys
2010-07-17 04:50 . 2010-07-17 04:50 216200 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgldx86.sys
2010-07-17 04:49 . 2010-07-17 04:49 12536 —-a-w- c:\windows\system32\avgrsstx.dll
2010-07-17 04:48 . 2010-07-17 04:48 813336 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avginet.dll
2010-07-17 04:48 . 2010-07-17 04:48 624920 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgiproxy.exe
2010-07-17 04:48 . 2010-07-17 04:48 1690464 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgupd.dll
2010-07-17 04:48 . 2010-07-17 04:48 1038688 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgupd.exe
2010-07-14 08:04 . 2010-07-14 08:04 ——– d—–w- c:\program files\Common Files\Java
2010-07-14 08:00 . 2010-04-12 07:29 411368 —-a-w- c:\windows\system32\deployJava1.dll
2010-07-12 07:44 . 2010-07-12 07:44 ——– d—–w- c:\documents and settings\LocalService\Application Data\HPAppData
2010-07-12 07:37 . 2010-07-12 08:12 ——– d—–w- c:\documents and settings\LocalService\Local Settings\Application Data\mqjxoicml
2010-07-12 06:56 . 2010-07-12 06:56 ——– d—–w- c:\windows\system32\wbem\Repository

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-07 13:26 . 2009-02-16 09:20 ——– d—–w- c:\documents and settings\User\Application Data\Free Download Manager
2010-08-07 02:40 . 2009-02-16 11:11 ——– d—–w- c:\documents and settings\User\Application Data\MxBoost
2010-08-04 11:58 . 2010-03-16 11:53 0 —-a-w- c:\documents and settings\User\Local Settings\Application Data\prvlcl.dat
2010-08-03 12:38 . 2010-03-11 10:19 28 —-a-w- c:\windows\system32\smartsupporter_totalvaccine.dat
2010-07-26 09:46 . 2010-01-14 13:55 142 —-a-w- c:\windows\system32\fscflist.ini.tmp
2010-07-26 09:46 . 2010-01-14 13:47 78 —-a-w- c:\windows\system32\fscagent.ini.tmp
2010-07-26 09:43 . 2009-03-05 09:43 ——– d—–w- c:\documents and settings\User\Application Data\HPAppData
2010-07-21 12:59 . 2010-07-21 12:59 0 —ha-w- c:\windows\system32\drivers\Msft_Kernel_ggflt_01007.Wdf
2010-07-21 12:56 . 2009-02-16 09:21 ——– d—–w- c:\program files\Sony Ericsson
2010-07-20 06:59 . 2010-03-04 01:49 6786252 —-a-w- c:\windows\system32\2ndrive_setup.exe
2010-07-18 06:25 . 2010-03-26 06:09 ——– d—–w- c:\documents and settings\User\Application Data\vlc
2010-07-17 04:49 . 2009-02-16 10:53 243024 —-a-w- c:\windows\system32\drivers\avgtdix.sys
2010-07-17 04:49 . 2009-02-16 10:53 216400 —-a-w- c:\windows\system32\drivers\avgldx86.sys
2010-07-14 07:59 . 2010-02-07 07:28 ——– d—–w- c:\program files\Java
2010-07-06 13:57 . 2009-02-16 09:20 ——– d—–w- c:\documents and settings\User\Application Data\Audacity
2010-07-05 11:46 . 2009-02-16 09:22 ——– d—–w- c:\program files\Messenger Plus! Live
2010-07-02 05:29 . 2010-03-04 01:48 2838528 —-a-w- c:\windows\system32\clubbox.exe
2010-07-01 11:18 . 2009-02-16 09:21 ——– d—–w- c:\program files\Maxthon2
2010-06-29 03:52 . 2009-02-22 06:30 ——– d—–w- c:\documents and settings\All Users\Application Data\NOS
2010-06-28 14:22 . 2010-05-13 09:36 ——– d—–w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-06-26 02:26 . 2010-06-26 02:26 ——– d—–w- c:\documents and settings\All Users\Application Data\McAfee
2010-06-26 02:26 . 2010-06-26 02:26 2568656 —-a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\install_flash_player.exe
2010-06-26 02:26 . 2010-06-26 02:26 1025992 —-a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\SecurityScan_Release.exe
2010-06-20 06:13 . 2010-06-20 06:13 ——– d—–w- c:\documents and settings\User\Application Data\ViiKiiDesktopPlugin.5E22EA0FF243470AB5EDDF282C0A5B52E9909C36.1
2010-06-20 06:13 . 2010-06-20 06:13 ——– d—–w- c:\program files\ViiKiiDesktopPlugin
2010-06-20 06:13 . 2009-02-22 06:53 ——– d—–w- c:\program files\Common Files\Adobe AIR
2010-06-20 06:12 . 2010-06-20 06:13 53632 —-a-w- c:\documents and settings\User\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-06-13 07:27 . 2010-06-13 07:27 50354 —-a-w- c:\documents and settings\User\Application Data\Facebook\uninstall.exe
2010-06-13 07:27 . 2010-06-13 07:27 ——– d—–w- c:\documents and settings\User\Application Data\Facebook
2010-06-11 03:13 . 2010-06-11 03:13 ——– d—–w- c:\program files\Google
2010-06-09 10:45 . 2010-06-09 10:45 5591040 —-a-w- c:\documents and settings\User\Application Data\Facebook\npfbplugin_1_0_3.dll
2010-06-03 07:28 . 2009-02-16 10:53 29584 —-a-w- c:\windows\system32\drivers\avgmfx86.sys
2010-05-25 11:12 . 2010-05-25 11:12 503808 —-a-w- c:\documents and settings\User\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-566f34a7-n\msvcp71.dll
2010-05-25 11:12 . 2010-05-25 11:12 499712 —-a-w- c:\documents and settings\User\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-566f34a7-n\jmc.dll
2010-05-25 11:12 . 2010-05-25 11:12 348160 —-a-w- c:\documents and settings\User\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-566f34a7-n\msvcr71.dll
2010-05-25 11:12 . 2010-05-25 11:12 61440 —-a-w- c:\documents and settings\User\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-4e3c2ff4-n\decora-sse.dll
2010-05-25 11:12 . 2010-05-25 11:12 12800 —-a-w- c:\documents and settings\User\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-4e3c2ff4-n\decora-d3d.dll
2010-05-20 08:01 . 2010-05-20 08:01 413696 —-a-w- c:\windows\system32\wrap_oal.dll
2010-05-20 08:01 . 2010-05-20 08:01 110592 —-a-w- c:\windows\system32\OpenAL32.dll
2010-05-13 09:41 . 2009-02-16 06:58 70176 —-a-w- c:\documents and settings\User\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"iCalendar"="c:\program files\Desksware\Desktop iCal\Calendar.exe" [2008-03-15 2774528]
"Calendar"="c:\program files\Desksware\Desktop iCal\Calendar.exe" [2008-03-15 2774528]
"Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" [2009-11-19 434176]
"EA Core"="c:\program files\Electronic Arts\EADM\Core.exe" [2009-03-28 3325952]
"WordWeb"="c:\program files\WordWeb\wweb32.exe" [2009-11-08 65216]
"Free Download Manager"="c:\program files\Free Download Manager\fdm.exe" [2010-04-28 3727411]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-03 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-03 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
"RTHDCPL"="RTHDCPL.EXE" [2008-07-23 16804864]
"SoundMan"="SOUNDMAN.EXE" [2008-06-18 77824]
"AlcWzrd"="ALCWZRD.EXE" [2008-06-19 2808832]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-07 13574144]
"nwiz"="nwiz.exe" [2008-10-07 1630208]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-10-07 86016]
"RemoteControl8"="c:\program files\CyberLink\PowerDVD8\PDVD8Serv.exe" [2008-03-20 83240]
"PDVD8LanguageShortcut"="c:\program files\CyberLink\PowerDVD8\Language\Language.exe" [2007-12-14 50472]
"BDRegion"="c:\program files\Cyberlink\Shared Files\brs.exe" [2008-10-16 91432]
"NeroFilterCheck"="c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2007-03-01 153136]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-03 110592]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2007-08-22 80896]
"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2010-07-17 2065760]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
NETGEAR WG111v3 Smart Wizard.lnk - c:\program files\NETGEAR\WG111v3\WG111v3.exe [2007-9-12 1527808]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2010-07-17 04:49 12536 —-a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^User^Start Menu^Programs^Startup^ViiKiiDesktopPlugin.lnk]
path=c:\documents and settings\User\Start Menu\Programs\Startup\ViiKiiDesktopPlugin.lnk
backup=c:\windows\pss\ViiKiiDesktopPlugin.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2008-12-29 10:40 687560 —-a-w- c:\program files\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2007-10-14 10:17 49152 —-a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Livestation]
2009-12-11 10:42 4431872 —-a-w- c:\program files\Livestation\Livestation.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\CyberLink\\PowerDVD8\\PowerDVD8.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Electronic Arts\\Burnout™ Paradise The Ultimate Box\\BurnoutLauncher.exe"=
"c:\\Program Files\\Electronic Arts\\Burnout™ Paradise The Ultimate Box\\BurnoutConfigTool.exe"=
"c:\\Program Files\\Electronic Arts\\Burnout™ Paradise The Ultimate Box\\BurnoutParadise.exe"=
"c:\\Program Files\\Left 4 Dead\\Left 4 Dead\\left4dead.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\Left 4 Dead\\Left 4 Dead\\left4dead - console..exe"=
"c:\\Program Files\\StepMania 4\\Program\\StepMania.exe"=
"c:\\Program Files\\Maxthon2\\Modules\\MxDownloader\\MxDownloadServer.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Electronic Arts\\EADM\\Core.exe"=
"c:\\Documents and Settings\\User\\Games\\Call of Duty - World at War\\CoDWaW.exe"=
"c:\\WINDOWS\\system32\\fscagent.exe"=
"c:\\WINDOWS\\system32\\clubbox.exe"=
"c:\\WINDOWS\\system32\\grdmgr.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\Sony Ericsson\\SEMC OMSI Module\\SEMC OMSI Module.exe"=
"c:\\Program Files\\TVAnts\\Tvants.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=
"c:\\Program Files\\Sony Ericsson\\Update Service\\Update Service.exe"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [8/9/2009 2:14 PM 64160]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2/16/2009 8:53 PM 216400]
R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2/16/2009 8:53 PM 243024]
R2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};c:\program files\CyberLink\PowerDVD8\000.fcl [8/8/2008 9:15 AM 41456]
R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [7/17/2010 2:49 PM 308136]
R2 EmmaDevMgmtSvc;Emma Device Management;c:\program files\Common Files\Sony Ericsson\Emma Core\Services\EmmaDeviceMgmt.exe [2/2/2010 12:20 PM 306296]
R2 EmmaUpdMgmtSvc;Emma Update Management;c:\program files\Common Files\Sony Ericsson\Emma Core\Services\EmmaUpdateMgmt.exe [2/2/2010 12:20 PM 162936]
R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;c:\program files\LogMeIn Hamachi\hamachi-2.exe [10/29/2009 11:27 AM 1074568]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [7/4/2009 12:49 AM 1029456]
R3 RTL8187B;NETGEAR WG111v3 54Mbps Wireless USB 2.0 Adapter Vista Driver;c:\windows\system32\drivers\wg111v3.sys [4/23/2007 1:11 PM 224896]
R3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\ScreamingBAudio.sys [12/1/2009 3:49 PM 34384]
R3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\drivers\seehcri.sys [12/10/2009 3:11 PM 27632]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [6/11/2010 1:13 PM 136176]
S2 OMSI download service;Sony Ericsson OMSI download service;c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe [2/13/2010 12:26 AM 90112]
S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [12/12/2009 7:13 PM 13224]
S3 s1018bus;Sony Ericsson Device 1018 driver (WDM);c:\windows\system32\drivers\s1018bus.sys [6/23/2009 11:21 AM 86824]
S3 s1018mdfl;Sony Ericsson Device 1018 USB WMC Modem Filter;c:\windows\system32\drivers\s1018mdfl.sys [6/23/2009 11:21 AM 15016]
S3 s1018mdm;Sony Ericsson Device 1018 USB WMC Modem Driver;c:\windows\system32\drivers\s1018mdm.sys [6/23/2009 11:21 AM 114728]
S3 s1018mgmt;Sony Ericsson Device 1018 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s1018mgmt.sys [6/23/2009 11:21 AM 106208]
S3 s1018nd5;Sony Ericsson Device 1018 USB Ethernet Emulation (NDIS);c:\windows\system32\drivers\s1018nd5.sys [6/23/2009 11:21 AM 26024]
S3 s1018obex;Sony Ericsson Device 1018 USB WMC OBEX Interface;c:\windows\system32\drivers\s1018obex.sys [6/23/2009 11:21 AM 104744]
S3 s1018unic;Sony Ericsson Device 1018 USB Ethernet Emulation (WDM);c:\windows\system32\drivers\s1018unic.sys [6/23/2009 11:21 AM 109864]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [6/28/2009 3:25 PM 717296]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-02-26 03:06 451872 —-a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder

2010-08-02 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-07-03 03:14]

2010-08-07 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-06-11 03:13]

2010-08-06 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-06-11 03:13]
.
.
——- Supplementary Scan ——-
.
uStart Page = about:blank
uInternet Settings,ProxyOverride =
uInternet Settings,ProxyServer = http=127.0.0.1:5555
IE: Add to Windows &Live; Favorites - http://favorites.live.com/quickadd.aspx
IE: Download all with Free Download Manager - file://c:\program files\Free Download Manager\dlall.htm
IE: Download selected with Free Download Manager - file://c:\program files\Free Download Manager\dlselected.htm
IE: Download video with Free Download Manager - file://c:\program files\Free Download Manager\dlfvideo.htm
IE: Download with Free Download Manager - file://c:\program files\Free Download Manager\dllink.htm
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Open in new background tab - c:\program files\Windows Live Toolbar\Components\en-au\msntabres.dll.mui/229?c800ae5be45c488bacc5566f9890f5e5
IE: Open in new foreground tab - c:\program files\Windows Live Toolbar\Components\en-au\msntabres.dll.mui/230?c800ae5be45c488bacc5566f9890f5e5
IE: {{39C98479-624B-4e1e-8865-F4FE46238123} - c:\program files\iebutton\open.exe
DPF: {0349EF81-B9C1-4B97-86F7-7B931D0E2532} - hxxp://sticube.clubbox.co.kr/sticubeupdate/cab/NowStarter2.cab
DPF: {9C23D886-43CB-43DE-B2DB-112A68D7E10A} - hxxp://lads.myspace.com/upload/MySpaceUploader2.cab
FF - ProfilePath - c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\ygqrzirg.default\
FF - prefs.js: browser.search.selectedEngine - Wikipedia (en)
FF - prefs.js: network.proxy.type - 0
FF - component: c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\ygqrzirg.default\extensions\[removed]\components\firedownload.dll
FF - component: c:\program files\AVG\AVG9\Firefox\components\avgssff.dll
FF - component: c:\program files\Free Download Manager\Firefox\Extension\components\vmsfdmff.dll
FF - plugin: c:\documents and settings\User\Application Data\Facebook\npfbplugin_1_0_3.dll
FF - plugin: c:\program files\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–p1ai", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbayh7gpa", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-Software Informer - c:\program files\Software Informer\softinfo.exe
HKCU-Run-fsm - (no file)
HKLM-Run-winhelper - c:\windows\system32\winhelper.exe
AddRemove-ClPhpEd - c:\program files\Codelobster Software\CodelobsterPHPEdition\uninst.exe
AddRemove-Cooking Academy 2 Free Trial_is1 - c:\program files\CookingAcademy2_at\unins000.exe
AddRemove-MC-TOTALVACCINE - c:\windows\system32\smartsupporter_totalvaccine.exe
AddRemove-¼îÇΰ˻ö-¿Á¼Ç¿ÀǼîÇÎ (DB) - c:\program files\Shopping Search\dvrupdater.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-08-07 23:44
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD8\000.fcl"
.
Completion time: 2010-08-07 23:46:46
ComboFix-quarantined-files.txt 2010-08-07 13:46

Pre-Run: 32,018,071,552 bytes free
Post-Run: 35,901,497,344 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - D7FECA8572CFACBA90C11FFAD147F93A

i managed to install/download the recovery console =)

Here's the Combofix log:
ComboFix 10-08-06.01 - User 08/08/2010 16:40:14.2.4 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.3326.2839 [GMT 10:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\User\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\LocalService\Local Settings\Application Data\mqjxoicml

.
((((((((((((((((((((((((( Files Created from 2010-07-08 to 2010-08-08 )))))))))))))))))))))))))))))))
.

2010-07-31 03:19 . 2010-07-31 03:19 3667426 —-a-w- c:\windows\SNSD SPAO ScreenSaver3.scr
2010-07-31 03:19 . 2010-07-31 03:19 798311 —-a-w- c:\windows\SNSD SPAO ScreenSaver1.scr
2010-07-31 03:19 . 2010-07-31 03:19 571044 —-a-w- c:\windows\SPAO_SNSD_ScreenSaver.scr
2010-07-30 05:50 . 2010-08-07 13:22 ——– d—–w- c:\windows\system32\config\systemprofile\Application Data\HPAppData
2010-07-21 07:10 . 2010-07-21 07:10 1615200 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgssie.dll
2010-07-21 07:09 . 2010-07-21 07:09 1373536 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgssff.dll
2010-07-21 07:09 . 2010-07-21 07:09 4368224 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgcorex.dll
2010-07-21 07:09 . 2010-07-21 07:09 1107296 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgxpl.dll
2010-07-17 04:50 . 2010-07-17 04:50 242896 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgtdix.sys
2010-07-17 04:50 . 2010-07-17 04:50 216200 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgldx86.sys
2010-07-17 04:49 . 2010-07-17 04:49 12536 —-a-w- c:\windows\system32\avgrsstx.dll
2010-07-17 04:48 . 2010-07-17 04:48 813336 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avginet.dll
2010-07-17 04:48 . 2010-07-17 04:48 624920 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgiproxy.exe
2010-07-17 04:48 . 2010-07-17 04:48 1690464 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgupd.dll
2010-07-17 04:48 . 2010-07-17 04:48 1038688 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgupd.exe
2010-07-14 08:04 . 2010-07-14 08:04 ——– d—–w- c:\program files\Common Files\Java
2010-07-14 08:00 . 2010-04-12 07:29 411368 —-a-w- c:\windows\system32\deployJava1.dll
2010-07-12 07:44 . 2010-07-12 07:44 ——– d—–w- c:\documents and settings\LocalService\Application Data\HPAppData
2010-07-12 06:56 . 2010-07-12 06:56 ——– d—–w- c:\windows\system32\wbem\Repository

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-08 06:35 . 2009-02-16 09:20 ——– d—–w- c:\documents and settings\User\Application Data\Free Download Manager
2010-08-08 06:32 . 2009-02-16 11:11 ——– d—–w- c:\documents and settings\User\Application Data\MxBoost
2010-08-07 13:58 . 2010-03-16 11:53 0 —-a-w- c:\documents and settings\User\Local Settings\Application Data\prvlcl.dat
2010-08-07 13:52 . 2009-08-09 04:13 ——– d—–w- c:\documents and settings\All Users\Application Data\Lavasoft
2010-08-03 12:38 . 2010-03-11 10:19 28 —-a-w- c:\windows\system32\smartsupporter_totalvaccine.dat
2010-07-26 09:46 . 2010-01-14 13:55 142 —-a-w- c:\windows\system32\fscflist.ini.tmp
2010-07-26 09:46 . 2010-01-14 13:47 78 —-a-w- c:\windows\system32\fscagent.ini.tmp
2010-07-26 09:43 . 2009-03-05 09:43 ——– d—–w- c:\documents and settings\User\Application Data\HPAppData
2010-07-21 12:59 . 2010-07-21 12:59 0 —ha-w- c:\windows\system32\drivers\Msft_Kernel_ggflt_01007.Wdf
2010-07-21 12:56 . 2009-02-16 09:21 ——– d—–w- c:\program files\Sony Ericsson
2010-07-20 06:59 . 2010-03-04 01:49 6786252 —-a-w- c:\windows\system32\2ndrive_setup.exe
2010-07-18 06:25 . 2010-03-26 06:09 ——– d—–w- c:\documents and settings\User\Application Data\vlc
2010-07-17 04:49 . 2009-02-16 10:53 243024 —-a-w- c:\windows\system32\drivers\avgtdix.sys
2010-07-17 04:49 . 2009-02-16 10:53 216400 —-a-w- c:\windows\system32\drivers\avgldx86.sys
2010-07-14 07:59 . 2010-02-07 07:28 ——– d—–w- c:\program files\Java
2010-07-06 13:57 . 2009-02-16 09:20 ——– d—–w- c:\documents and settings\User\Application Data\Audacity
2010-07-05 11:46 . 2009-02-16 09:22 ——– d—–w- c:\program files\Messenger Plus! Live
2010-07-02 05:29 . 2010-03-04 01:48 2838528 —-a-w- c:\windows\system32\clubbox.exe
2010-07-01 11:18 . 2009-02-16 09:21 ——– d—–w- c:\program files\Maxthon2
2010-06-29 03:52 . 2009-02-22 06:30 ——– d—–w- c:\documents and settings\All Users\Application Data\NOS
2010-06-28 14:22 . 2010-05-13 09:36 ——– d—–w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-06-26 02:26 . 2010-06-26 02:26 ——– d—–w- c:\documents and settings\All Users\Application Data\McAfee
2010-06-26 02:26 . 2010-06-26 02:26 2568656 —-a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\install_flash_player.exe
2010-06-26 02:26 . 2010-06-26 02:26 1025992 —-a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\SecurityScan_Release.exe
2010-06-20 06:13 . 2010-06-20 06:13 ——– d—–w- c:\documents and settings\User\Application Data\ViiKiiDesktopPlugin.5E22EA0FF243470AB5EDDF282C0A5B52E9909C36.1
2010-06-20 06:13 . 2010-06-20 06:13 ——– d—–w- c:\program files\ViiKiiDesktopPlugin
2010-06-20 06:13 . 2009-02-22 06:53 ——– d—–w- c:\program files\Common Files\Adobe AIR
2010-06-20 06:12 . 2010-06-20 06:13 53632 —-a-w- c:\documents and settings\User\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-06-13 07:27 . 2010-06-13 07:27 50354 —-a-w- c:\documents and settings\User\Application Data\Facebook\uninstall.exe
2010-06-13 07:27 . 2010-06-13 07:27 ——– d—–w- c:\documents and settings\User\Application Data\Facebook
2010-06-11 03:13 . 2010-06-11 03:13 ——– d—–w- c:\program files\Google
2010-06-09 10:45 . 2010-06-09 10:45 5591040 —-a-w- c:\documents and settings\User\Application Data\Facebook\npfbplugin_1_0_3.dll
2010-06-03 07:28 . 2009-02-16 10:53 29584 —-a-w- c:\windows\system32\drivers\avgmfx86.sys
2010-05-25 11:12 . 2010-05-25 11:12 503808 —-a-w- c:\documents and settings\User\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-566f34a7-n\msvcp71.dll
2010-05-25 11:12 . 2010-05-25 11:12 499712 —-a-w- c:\documents and settings\User\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-566f34a7-n\jmc.dll
2010-05-25 11:12 . 2010-05-25 11:12 348160 —-a-w- c:\documents and settings\User\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-566f34a7-n\msvcr71.dll
2010-05-25 11:12 . 2010-05-25 11:12 61440 —-a-w- c:\documents and settings\User\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-4e3c2ff4-n\decora-sse.dll
2010-05-25 11:12 . 2010-05-25 11:12 12800 —-a-w- c:\documents and settings\User\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-4e3c2ff4-n\decora-d3d.dll
2010-05-20 08:01 . 2010-05-20 08:01 413696 —-a-w- c:\windows\system32\wrap_oal.dll
2010-05-20 08:01 . 2010-05-20 08:01 110592 —-a-w- c:\windows\system32\OpenAL32.dll
2010-05-13 09:41 . 2009-02-16 06:58 70176 —-a-w- c:\documents and settings\User\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
.

((((((((((((((((((((((((((((( SnapShot@2010-08-07_13.44.45 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-08-08 06:37 . 2010-08-08 06:37 16384 c:\windows\Temp\Perflib_Perfdata_508.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"iCalendar"="c:\program files\Desksware\Desktop iCal\Calendar.exe" [2008-03-15 2774528]
"Calendar"="c:\program files\Desksware\Desktop iCal\Calendar.exe" [2008-03-15 2774528]
"Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" [2009-11-19 434176]
"EA Core"="c:\program files\Electronic Arts\EADM\Core.exe" [2009-03-28 3325952]
"WordWeb"="c:\program files\WordWeb\wweb32.exe" [2009-11-08 65216]
"Free Download Manager"="c:\program files\Free Download Manager\fdm.exe" [2010-04-28 3727411]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-03 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-03 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
"RTHDCPL"="RTHDCPL.EXE" [2008-07-23 16804864]
"SoundMan"="SOUNDMAN.EXE" [2008-06-18 77824]
"AlcWzrd"="ALCWZRD.EXE" [2008-06-19 2808832]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-07 13574144]
"nwiz"="nwiz.exe" [2008-10-07 1630208]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-10-07 86016]
"RemoteControl8"="c:\program files\CyberLink\PowerDVD8\PDVD8Serv.exe" [2008-03-20 83240]
"PDVD8LanguageShortcut"="c:\program files\CyberLink\PowerDVD8\Language\Language.exe" [2007-12-14 50472]
"BDRegion"="c:\program files\Cyberlink\Shared Files\brs.exe" [2008-10-16 91432]
"NeroFilterCheck"="c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2007-03-01 153136]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-03 110592]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2007-08-22 80896]
"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2010-07-17 2065760]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
NETGEAR WG111v3 Smart Wizard.lnk - c:\program files\NETGEAR\WG111v3\WG111v3.exe [2007-9-12 1527808]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2010-07-17 04:49 12536 —-a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^User^Start Menu^Programs^Startup^ViiKiiDesktopPlugin.lnk]
path=c:\documents and settings\User\Start Menu\Programs\Startup\ViiKiiDesktopPlugin.lnk
backup=c:\windows\pss\ViiKiiDesktopPlugin.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2008-12-29 10:40 687560 —-a-w- c:\program files\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2007-10-14 10:17 49152 —-a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Livestation]
2009-12-11 10:42 4431872 —-a-w- c:\program files\Livestation\Livestation.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\CyberLink\\PowerDVD8\\PowerDVD8.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Electronic Arts\\Burnout™ Paradise The Ultimate Box\\BurnoutLauncher.exe"=
"c:\\Program Files\\Electronic Arts\\Burnout™ Paradise The Ultimate Box\\BurnoutConfigTool.exe"=
"c:\\Program Files\\Electronic Arts\\Burnout™ Paradise The Ultimate Box\\BurnoutParadise.exe"=
"c:\\Program Files\\Left 4 Dead\\Left 4 Dead\\left4dead.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\Left 4 Dead\\Left 4 Dead\\left4dead - console..exe"=
"c:\\Program Files\\StepMania 4\\Program\\StepMania.exe"=
"c:\\Program Files\\Maxthon2\\Modules\\MxDownloader\\MxDownloadServer.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Electronic Arts\\EADM\\Core.exe"=
"c:\\Documents and Settings\\User\\Games\\Call of Duty - World at War\\CoDWaW.exe"=
"c:\\WINDOWS\\system32\\fscagent.exe"=
"c:\\WINDOWS\\system32\\clubbox.exe"=
"c:\\WINDOWS\\system32\\grdmgr.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\Sony Ericsson\\SEMC OMSI Module\\SEMC OMSI Module.exe"=
"c:\\Program Files\\TVAnts\\Tvants.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=
"c:\\Program Files\\Sony Ericsson\\Update Service\\Update Service.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2/16/2009 8:53 PM 216400]
R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2/16/2009 8:53 PM 243024]
R2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};c:\program files\CyberLink\PowerDVD8\000.fcl [8/8/2008 9:15 AM 41456]
R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [7/17/2010 2:49 PM 308136]
R2 EmmaDevMgmtSvc;Emma Device Management;c:\program files\Common Files\Sony Ericsson\Emma Core\Services\EmmaDeviceMgmt.exe [2/2/2010 12:20 PM 306296]
R2 EmmaUpdMgmtSvc;Emma Update Management;c:\program files\Common Files\Sony Ericsson\Emma Core\Services\EmmaUpdateMgmt.exe [2/2/2010 12:20 PM 162936]
R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;c:\program files\LogMeIn Hamachi\hamachi-2.exe [10/29/2009 11:27 AM 1074568]
R3 RTL8187B;NETGEAR WG111v3 54Mbps Wireless USB 2.0 Adapter Vista Driver;c:\windows\system32\drivers\wg111v3.sys [4/23/2007 1:11 PM 224896]
R3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\ScreamingBAudio.sys [12/1/2009 3:49 PM 34384]
R3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\drivers\seehcri.sys [12/10/2009 3:11 PM 27632]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [6/11/2010 1:13 PM 136176]
S2 OMSI download service;Sony Ericsson OMSI download service;c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe [2/13/2010 12:26 AM 90112]
S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [12/12/2009 7:13 PM 13224]
S3 s1018bus;Sony Ericsson Device 1018 driver (WDM);c:\windows\system32\drivers\s1018bus.sys [6/23/2009 11:21 AM 86824]
S3 s1018mdfl;Sony Ericsson Device 1018 USB WMC Modem Filter;c:\windows\system32\drivers\s1018mdfl.sys [6/23/2009 11:21 AM 15016]
S3 s1018mdm;Sony Ericsson Device 1018 USB WMC Modem Driver;c:\windows\system32\drivers\s1018mdm.sys [6/23/2009 11:21 AM 114728]
S3 s1018mgmt;Sony Ericsson Device 1018 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s1018mgmt.sys [6/23/2009 11:21 AM 106208]
S3 s1018nd5;Sony Ericsson Device 1018 USB Ethernet Emulation (NDIS);c:\windows\system32\drivers\s1018nd5.sys [6/23/2009 11:21 AM 26024]
S3 s1018obex;Sony Ericsson Device 1018 USB WMC OBEX Interface;c:\windows\system32\drivers\s1018obex.sys [6/23/2009 11:21 AM 104744]
S3 s1018unic;Sony Ericsson Device 1018 USB Ethernet Emulation (WDM);c:\windows\system32\drivers\s1018unic.sys [6/23/2009 11:21 AM 109864]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [6/28/2009 3:25 PM 717296]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-02-26 03:06 451872 —-a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder

2010-08-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-06-11 03:13]

2010-08-07 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-06-11 03:13]
.
.
——- Supplementary Scan ——-
.
uStart Page = about:blank
uInternet Settings,ProxyOverride =
IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
IE: Download all with Free Download Manager - file://c:\program files\Free Download Manager\dlall.htm
IE: Download selected with Free Download Manager - file://c:\program files\Free Download Manager\dlselected.htm
IE: Download video with Free Download Manager - file://c:\program files\Free Download Manager\dlfvideo.htm
IE: Download with Free Download Manager - file://c:\program files\Free Download Manager\dllink.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Open in new background tab - c:\program files\Windows Live Toolbar\Components\en-au\msntabres.dll.mui/229?c800ae5be45c488bacc5566f9890f5e5
IE: Open in new foreground tab - c:\program files\Windows Live Toolbar\Components\en-au\msntabres.dll.mui/230?c800ae5be45c488bacc5566f9890f5e5
IE: {{39C98479-624B-4e1e-8865-F4FE46238123} - c:\program files\iebutton\open.exe
DPF: {0349EF81-B9C1-4B97-86F7-7B931D0E2532} - hxxp://sticube.clubbox.co.kr/sticubeupdate/cab/NowStarter2.cab
DPF: {9C23D886-43CB-43DE-B2DB-112A68D7E10A} - hxxp://lads.myspace.com/upload/MySpaceUploader2.cab
FF - ProfilePath - c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\ygqrzirg.default\
FF - prefs.js: browser.search.selectedEngine - Wikipedia (en)
FF - prefs.js: network.proxy.type - 0
FF - component: c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\ygqrzirg.default\extensions\[removed]\components\firedownload.dll
FF - component: c:\program files\AVG\AVG9\Firefox\components\avgssff.dll
FF - component: c:\program files\Free Download Manager\Firefox\Extension\components\vmsfdmff.dll

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–p1ai", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbayh7gpa", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-08-08 16:46
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD8\000.fcl"
.
Completion time: 2010-08-08 16:48:22
ComboFix-quarantined-files.txt 2010-08-08 06:48
ComboFix2.txt 2010-08-07 13:46

Pre-Run: 36,216,672,256 bytes free
Post-Run: 36,212,068,352 bytes free

- - End Of File - - BA255D27F8C31F26CC13B02C0A4D4909

Malwarebytes:
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4405

Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180

8/8/2010 4:54:52 PM
mbam-log-2010-08-08 (16-54-52).txt

Scan type: Quick scan
Objects scanned: 130940
Time elapsed: 2 minute(s), 56 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Kaspersky:
——————————————————————————–
KASPERSKY ONLINE SCANNER 7.0: scan report
Sunday, August 8, 2010
Operating system: Microsoft Windows XP Professional Service Pack 2 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Sunday, August 08, 2010 03:18:03
Records in database: 4132384
——————————————————————————–

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
A:\
C:\
D:\
E:\

Scan statistics:
Objects scanned: 163795
Threats found: 4
Infected objects found: 10
Suspicious objects found: 0
Scan duration: 02:18:16


File name / Threat / Threats count
C:\Qoobox\Quarantine\C\WINDOWS\system32\Drivers\rdpcdd.sys.vir Infected: Rootkit.Win32.TDSS.ap 1
C:\Qoobox\Quarantine\MBR_HardDisk0.mbr Infected: Trojan-Clicker.Win32.Wistler.a 1
C:\System Volume Information\_restore{4BC6283F-6A86-472A-B541-ED16F91E64C6}\RP449\A0054456.exe Infected: Packed.Win32.Krap.hc 1
C:\System Volume Information\_restore{4BC6283F-6A86-472A-B541-ED16F91E64C6}\RP470\A0057034.exe Infected: Packed.Win32.Krap.hc 1
C:\System Volume Information\_restore{4BC6283F-6A86-472A-B541-ED16F91E64C6}\RP470\A0057035.exe Infected: Packed.Win32.Krap.hc 1
C:\System Volume Information\_restore{4BC6283F-6A86-472A-B541-ED16F91E64C6}\RP470\A0057036.exe Infected: Packed.Win32.Krap.hc 1
C:\System Volume Information\_restore{4BC6283F-6A86-472A-B541-ED16F91E64C6}\RP470\A0057037.exe Infected: Packed.Win32.Krap.hc 1
C:\System Volume Information\_restore{4BC6283F-6A86-472A-B541-ED16F91E64C6}\RP470\A0057039.exe Infected: Packed.Win32.Krap.hc 1
C:\System Volume Information\_restore{4BC6283F-6A86-472A-B541-ED16F91E64C6}\RP470\A0057070.exe Infected: not-a-virus:WebToolbar.Win32.MyWebSearch.br 1
C:\System Volume Information\_restore{4BC6283F-6A86-472A-B541-ED16F91E64C6}\RP471\A0062356.sys Infected: Rootkit.Win32.TDSS.ap 1

Selected area has been scanned.