Rootkit annoyance

Any assistance will be greatly appreciated.

Cheers.


Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 14:44:07, on 10/6/2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe
C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe
C:\Program Files\Microsoft LifeChat\LifeChat.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Live\Device Manager\msgrdvmn.exe
C:\Program Files\NetMeter\NetMeter.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Documents and Settings\Paul\Application Data\Dropbox\bin\Dropbox.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
c:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PSIService.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Paul\Desktop\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
R3 - URLSearchHook: (no name) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O2 - BHO: (no name) - {3C7195F6-D788-4D50-BA72-2EE212EDAC78} - (no file)
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (file missing)
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Burn4Free Toolbar Helper - {D187A56B-A33F-4CBE-9D77-459FC0BAE012} - (no file)
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: (no name) - {2C0A5F28-48D8-408B-9172-9C6121025BCE} - (no file)
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Burn4Free Toolbar - {4F11ACBB-393F-4C86-A214-FF3D0D155CC3} - (no file)
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl06a\BrStDvPt.exe
O4 - HKLM\..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Launch LgDevAgt] "C:\Program Files\Logitech\GamePanel Software\LgDevAgt.exe"
O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe"
O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" /SHOWHIDE
O4 - HKLM\..\Run: [LifeChat] "C:\Program Files\Microsoft LifeChat\LifeChat.exe"
O4 - HKLM\..\Run: [WindowsLivePhone] C:\Program Files\Windows Live\Device Manager\msgrdvmn.exe /AutoRun
O4 - HKLM\..\Run: [UpdatePDRShortCut] "C:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\PowerDirector" UpdateWithCreateOnce "Software\CyberLink\PowerDirector\6.5"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Corel Photo Downloader] C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe
O4 - HKLM\..\RunOnce: [TSC] "C:\DOCUME~1\Paul\LOCALS~1\Temp\HouseCall\tsc.exe" /HD
O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [WindowsLivePhone] "C:\Program Files\Windows Live\Device Manager\msgrdvmn.exe" /AutoRun
O4 - HKCU\..\Run: [C:\Program Files\NetMeter\NetMeter.exe] C:\Program Files\NetMeter\NetMeter.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-18\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'Default user')
O4 - S-1-5-18 Startup: Dropbox.lnk = C:\Documents and Settings\Paul\Application Data\Dropbox\bin\Dropbox.exe (User 'SYSTEM')
O4 - S-1-5-18 Startup: IMVU.lnk = C:\Documents and Settings\Paul\Application Data\IMVUClient\IMVUClient.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: Dropbox.lnk = C:\Documents and Settings\Paul\Application Data\Dropbox\bin\Dropbox.exe (User 'Default user')
O4 - .DEFAULT Startup: IMVU.lnk = C:\Documents and Settings\Paul\Application Data\IMVUClient\IMVUClient.exe (User 'Default user')
O4 - Startup: Dropbox.lnk = C:\Documents and Settings\Paul\Application Data\Dropbox\bin\Dropbox.exe
O4 - Startup: IMVU.lnk = C:\Documents and Settings\Paul\Application Data\IMVUClient\IMVUClient.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: office.lnk = C:\WINDOWS\system\sgcxcxxaspf080801.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki… - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Ïðåâåäè - {60237576-b24c-4ba9-9740-c9f3ec9db557} - C:\PROGRA~1\SkyCode\WEBTRA~1\wt2ie.dll
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) - file://C:\Program Files\Bejeweled 2\Images\stg_drm.ocx
O16 - DPF: {1B4F9DD7-2D7C-44B5-9126-73206DA0AE75} (CNavigationManager Object) - http://files.authentium.com/bigpond/bin/wizard.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {A27C56D2-3F58-4ABB-AA31-1168EDA6636F} (PCMaticVer Class) - http://utilities.pcpitstop.com/Nirvana/controls/pcmatic.cab
O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} (ArmHelper Control) - file://C:\Program Files\Bejeweled 2\Images\armhelper.ocx
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: cwjkyq.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: CSIScanner - Unknown owner - C:\Program Files\Prevx\prevx.exe (file missing)
O23 - Service: DvpApi (dvpapi) - Authentium, Inc. - c:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe
O23 - Service: Google Update Service (gupdate1c9b9c8c0035954) (gupdate1c9b9c8c0035954) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

–
End of file - 14126 bytes

Hi mowman,

Cheers for the help. I have both DDS logs but GMER crashed my system 4 times after running for an hour or so. I did copy and attach the text it displayed to that point though.

DDS (Ver_10-03-17.01) - NTFSx86
Run by [removed] at 21:23:25.29 on Wed 10/06/2010
Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_21
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1023.406 [GMT 8:00]


============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe
C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe
C:\Program Files\Microsoft LifeChat\LifeChat.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Live\Device Manager\msgrdvmn.exe
C:\Program Files\NetMeter\NetMeter.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Documents and Settings\Paul\Application Data\Dropbox\bin\Dropbox.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
svchost.exe
c:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PSIService.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\msiexec.exe
C:\Documents and Settings\Paul\Desktop\dds(2).scr

============== Pseudo HJT Report ===============

uSearch Page = hxxp://www.google.com
uDefault_Search_URL = hxxp://www.google.com/ie
uSearch Bar = hxxp://www.google.com/ie
mDefault_Search_URL = hxxp://www.google.com/ie
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll
uURLSearchHooks: H - No File
mURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: AskBar BHO: {201f27d4-3704-41d6-89c1-aa35e39143ed} - c:\program files\askbardis\bar\bin\askBar.dll
BHO: {3C7195F6-D788-4D50-BA72-2EE212EDAC78} - No File
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll
BHO: Yahoo! IE Services Button: {5bab4b5b-68bc-4b02-94d6-2fc0de4a7897} - c:\program files\yahoo!\common\yiesrvc.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SearchHelper.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: {d187a56b-a33f-4cbe-9d77-459fc0bae012} - Burn4Free Toolbar Helper
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - No File
TB: Winamp Toolbar: {ebf2ba02-9094-4c5a-858b-bb198f3d8de2} - c:\program files\winamp toolbar\winamptb.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll
TB: {2C0A5F28-48D8-408B-9172-9C6121025BCE} - No File
TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll
TB: Burn4Free Toolbar: {4f11acbb-393f-4c86-a214-ff3d0d155cc3} -
TB: Ask Toolbar: {3041d03e-fd4b-44e0-b742-2d9b88305f98} - c:\program files\askbardis\bar\bin\askBar.dll
TB: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
TB: {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - No File
TB: {A057A204-BACC-4D26-9990-79A187E2698E} - No File
uRun: [Picasa Media Detector] c:\program files\picasa2\PicasaMediaDetector.exe
uRun: [Yahoo! Pager] "c:\progra~1\yahoo!\messen~1\YAHOOM~1.EXE" -quiet
uRun: [LightScribe Control Panel] c:\program files\common files\lightscribe\LightScribeControlPanel.exe -hidden
uRun: [WindowsLivePhone] "c:\program files\windows live\device manager\msgrdvmn.exe" /AutoRun
uRun: [c:\program files\netmeter\netmeter.exe] c:\program files\netmeter\NetMeter.exe
uRun: [Skype] "c:\program files\skype\\phone\Skype.exe" /nosplash /minimized
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [SkyTel] SkyTel.EXE
mRun: [RemoteControl] "c:\program files\cyberlink\powerdvd\PDVDServ.exe"
mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\AppleSyncNotifier.exe
mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [BrMfcWnd] c:\program files\brother\brmfcmon\BrMfcWnd.exe /AUTORUN
mRun: [SetDefPrt] c:\program files\brother\brmfl06a\BrStDvPt.exe
mRun: [ControlCenter3] c:\program files\brother\controlcenter3\brctrcen.exe /autorun
mRun: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
mRun: [NeroFilterCheck] c:\program files\common files\nero\lib\NeroCheck.exe
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [Launch LgDevAgt] "c:\program files\logitech\gamepanel software\LgDevAgt.exe"
mRun: [Launch LCDMon] "c:\program files\logitech\gamepanel software\lcd manager\LCDMon.exe"
mRun: [Launch LGDCore] "c:\program files\logitech\gamepanel software\g-series software\LGDCore.exe" /SHOWHIDE
mRun: [LifeChat] "c:\program files\microsoft lifechat\LifeChat.exe"
mRun: [WindowsLivePhone] c:\program files\windows live\device manager\msgrdvmn.exe /AutoRun
mRun: [UpdatePDRShortCut] "c:\program files\cyberlink\powerdirector\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\powerdirector" updatewithcreateonce "software\cyberlink\powerdirector\6.5"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [Corel Photo Downloader] c:\program files\corel\corel snapfire plus\Corel Photo Downloader.exe
mRunOnce: [TSC] "c:\docume~1\paul\locals~1\temp\housecall\tsc.exe" /HD
dRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
StartupFolder: c:\docume~1\paul\startm~1\programs\startup\dropbox.lnk - c:\documents and settings\paul\application data\dropbox\bin\Dropbox.exe
StartupFolder: c:\docume~1\paul\startm~1\programs\startup\imvu.lnk - c:\documents and settings\paul\application data\imvuclient\IMVUClient.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\interv~1.lnk - c:\program files\intervideo\common\bin\WinCinemaMgr.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\office.lnk - c:\windows\system\sgcxcxxaspf080801.exe
IE: &Search
IE: &Winamp Search - c:\documents and settings\all users\application data\winamp toolbar\ietoolbar\resources\en-us\local\search.html
IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office12\EXCEL.EXE/3000
IE: Google Sidewiki… - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
IE: {d9288080-1baa-4bc4-9cf8-a92d743db949}
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - c:\program files\yahoo!\common\yiesrvc.dll
IE: {60237576-b24c-4ba9-9740-c9f3ec9db557} - {EAADF17C-B6EA-4511-8549-A67CFD406EAF} - c:\progra~1\skycode\webtra~1\wt2ie.dll
DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} - file://c:\program files\bejeweled 2\images\stg_drm.ocx
DPF: {1B4F9DD7-2D7C-44B5-9126-73206DA0AE75} - hxxp://files.authentium.com/bigpond/bin/wizard.exe
DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {A27C56D2-3F58-4ABB-AA31-1168EDA6636F} - hxxp://utilities.pcpitstop.com/Nirvana/controls/pcmatic.cab
DPF: {CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_04-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} - file://c:\program files\bejeweled 2\images\armhelper.ocx
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - c:\program files\belarc\advisor\system\BAVoilaX.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
AppInit_DLLs: cwjkyq.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "c:\program files\common files\lightscribe\LSRunOnce.exe"

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\paul\applic~1\mozilla\firefox\profiles\nrtiiceq.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.fastbrowsersearch.com/results/results.aspx?s=DEF&v=4&q=
FF - prefs.js: browser.search.selectedEngine - Fast Browser Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com.au
FF - prefs.js: keyword.URL - hxxp://www.fastbrowsersearch.com/results/results.aspx?s=NAUS&v=4&tid={54AEF6A5-C70C-1F41-7D34-A99DE46A49AD}&q=
FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll
FF - plugin: c:\program files\google\update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\microsoft\office live\npOLW.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npbittorrent.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\npdrmv2.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\npdsplay.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\npnul32.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\NPOFF12.DLL
FF - plugin: c:\program files\netscape\communicator\program\plugins\nppl3260.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\npqtplugin.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\npqtplugin2.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\npqtplugin3.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\npqtplugin4.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\npqtplugin5.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\npqtplugin6.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\npqtplugin7.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\nprfxins.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\nprjplug.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\nprpjplug.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\npwmsdrm.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}

—- FIREFOX POLICIES —-
pref(dom.disable_open_during_load, true);
============= SERVICES / DRIVERS ===============

R0 pxscan;pxscan;c:\windows\system32\drivers\pxscan.sys –> c:\windows\system32\drivers\pxscan.sys [?]
R1 pxrts;pxrts;c:\windows\system32\drivers\pxrts.sys –> c:\windows\system32\drivers\pxrts.sys [?]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [2009-4-27 54752]
R3 LGPBTDD;LGPBTDD.sys Display Driver;c:\windows\system32\drivers\LGPBTDD.sys [2009-10-31 23432]
R3 pxkbf;pxkbf;c:\windows\system32\drivers\pxkbf.sys –> c:\windows\system32\drivers\pxkbf.sys [?]
S2 CSIScanner;CSIScanner;"c:\program files\prevx\prevx.exe" /service –> c:\program files\prevx\prevx.exe [?]
S2 gupdate1c9b9c8c0035954;Google Update Service (gupdate1c9b9c8c0035954);c:\program files\google\update\GoogleUpdate.exe [2009-4-10 133104]
S2 solewxte;solewxte Service; [x]
S3 Alpham;Ideazon Fang Composite Keyboard Driver;c:\windows\system32\drivers\Alpham.sys [2005-12-4 34944]
S3 CAM1690;USB PC Camera;c:\windows\system32\drivers\cam1690.sys [2007-11-21 181888]
S3 fsssvc;Windows Live Family Safety Service;c:\program files\windows live\family safety\fsssvc.exe [2009-8-5 704864]
S3 PciCon;PciCon;\??\d:\pcicon.sys –> d:\PciCon.sys [?]
S3 s3017bus;Sony Ericsson Device 3017 driver (WDM);c:\windows\system32\drivers\s3017bus.sys [2009-2-6 83880]
S3 s3017mdfl;Sony Ericsson Device 3017 USB WMC Modem Filter;c:\windows\system32\drivers\s3017mdfl.sys [2009-2-6 15016]
S3 s3017mdm;Sony Ericsson Device 3017 USB WMC Modem Driver;c:\windows\system32\drivers\s3017mdm.sys [2009-2-6 110632]
S3 s3017mgmt;Sony Ericsson Device 3017 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s3017mgmt.sys [2009-2-6 104616]
S3 s3017nd5;Sony Ericsson Device 3017 USB Ethernet Emulation SEMC3017 (NDIS);c:\windows\system32\drivers\s3017nd5.sys [2009-2-6 25512]
S3 s3017obex;Sony Ericsson Device 3017 USB WMC OBEX Interface;c:\windows\system32\drivers\s3017obex.sys [2009-2-6 100648]
S3 s3017unic;Sony Ericsson Device 3017 USB Ethernet Emulation SEMC3017 (WDM);c:\windows\system32\drivers\s3017unic.sys [2009-2-6 110120]
S4 PCPitstop Scheduling;PCPitstop Scheduling;c:\program files\pcpitstop\PCPitstopScheduleService.exe [2010-5-18 90352]

=============== Created Last 30 ================

2010-10-06 05:50:37 103619 —-a-w- C:\yellow2.jpg
2010-10-06 05:41:31 109736 —-a-w- C:\yellow.jpg
2010-10-06 05:35:59 90321 —-a-w- c:\windows\system32\drivers\NDIS.SY_
2010-10-06 04:51:34 0 d—–w- C:\cars
2010-10-06 04:07:20 70192 —-a-w- c:\windows\system32\PxSecure.dll-82564140
2010-10-06 04:07:10 47 —-a-w- c:\windows\wininit.ini
2010-10-05 05:58:24 0 d—–w- c:\program files\Exterminate It!
2010-10-03 14:37:05 0 d—–w- c:\program files\iPod
2010-10-03 14:37:03 0 d—–w- c:\program files\iTunes
2010-10-03 14:32:25 629 —-a-w- c:\windows\system32\mapisvc.inf
2010-09-28 13:06:35 72184 —ha-w- c:\windows\system32\mlfcache.dat
2010-09-22 14:46:10 0 d—–w- c:\docume~1\alluse~1\applic~1\VOWSoft
2010-09-22 14:46:09 0 d—–w- c:\program files\ABC 3GP Converter
2010-09-22 14:42:46 0 d—–w- c:\program files\common files\Common Share
2010-09-19 10:34:56 0 d—–w- C:\blackberrydeleted
2010-09-18 11:54:21 0 d—–w- c:\docume~1\paul\applic~1\BoneTown Demo
2010-09-16 12:17:47 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-09-16 12:17:46 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-09-16 12:17:46 0 d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-09-13 11:39:11 0 d—–w- C:\phone list
2010-09-13 11:22:28 0 d—–w- C:\important pics
2010-09-12 11:03:14 0 d—–w- c:\docume~1\alluse~1\applic~1\Norton
2010-09-12 11:02:55 0 d—–w- c:\docume~1\alluse~1\applic~1\NortonInstaller
2010-09-12 10:57:35 0 d—–w- C:\nav
2010-09-12 06:00:46 0 d—–w- c:\program files\Convert AVI to MP4
2010-09-12 03:17:37 0 d—–w- C:\blackberrytoiphone
2010-09-11 13:02:34 33846 —-a-w- c:\windows\system32\SpoonUninstall-dBpoweramp m4a Utilities.bmp
2010-09-11 13:02:34 3175 —-a-w- c:\windows\system32\SpoonUninstall-dBpoweramp m4a Utilities.dat
2010-09-11 13:02:05 33846 —-a-w- c:\windows\system32\SpoonUninstall-dBpoweramp AAC Encoder.bmp
2010-09-11 13:02:05 3328 —-a-w- c:\windows\system32\SpoonUninstall-dBpoweramp AAC Encoder.dat
2010-09-11 13:01:29 33846 —-a-w- c:\windows\system32\SpoonUninstall-dBpoweramp m4b Audio book Encoder.bmp
2010-09-11 13:01:29 1259 —-a-w- c:\windows\system32\SpoonUninstall-dBpoweramp m4b Audio book Encoder.dat
2010-09-11 12:45:41 3621 —-a-w- c:\windows\system32\SpoonUninstall-dBpoweramp m4a Nero AAC Encoder.dat
2010-09-11 12:45:41 33846 —-a-w- c:\windows\system32\SpoonUninstall-dBpoweramp m4a Nero AAC Encoder.bmp
2010-09-11 12:44:24 33846 —-a-w- c:\windows\system32\SpoonUninstall-dBpoweramp m4a Codec.bmp
2010-09-11 12:44:24 3291 —-a-w- c:\windows\system32\SpoonUninstall-dBpoweramp m4a Codec.dat
2010-09-11 12:41:54 0 d—–w- c:\docume~1\paul\applic~1\dBpoweramp
2010-09-11 12:40:57 0 d—–w- c:\docume~1\paul\applic~1\AccurateRip
2010-09-11 12:40:54 527224 —-a-w- c:\windows\system32\SpoonUninstall.exe
2010-09-11 12:40:54 33846 —-a-w- c:\windows\system32\SpoonUninstall-dBpoweramp Music Converter.bmp
2010-09-11 12:40:54 15341 —-a-w- c:\windows\system32\SpoonUninstall-dBpoweramp Music Converter.dat
2010-09-11 12:40:50 0 d—–w- c:\program files\Illustrate
2010-09-11 11:23:06 0 d—–w- C:\New Folder (4)
2010-09-11 09:34:37 0 d—–w- c:\program files\Xilisoft
2010-09-11 09:33:57 0 d—–w- C:\ringtone
2010-09-11 09:23:02 0 d—–w- c:\windows\system32\wbem\Repository
2010-09-11 08:34:06 0 d—–w- C:\crack
2010-09-11 07:53:04 0 d—–w- c:\program files\Xilisoft(2)
2010-09-11 07:47:24 0 d—–w- C:\ringtones
2010-09-11 07:30:25 0 d—–w- c:\documents and settings\paul\.shsh
2010-09-10 19:47:10 0 d—–w- c:\program files\iPod(2)
2010-09-10 19:47:07 0 d—–w- c:\program files\iTunes(2)
2010-09-10 19:30:16 0 d—–w- c:\docume~1\alluse~1\applic~1\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2010-09-10 18:16:23 0 d—–w- c:\docume~1\paul\applic~1\iPhoneRingToneMaker
2010-09-10 14:46:32 0 d—–w- c:\program files\Tipard Studio
2010-09-10 10:34:41 0 d—–w- C:\redsnow
2010-09-09 10:32:40 0 d—–w- c:\docume~1\paul\applic~1\Dropbox
2010-09-09 09:58:21 0 d—–w- C:\filexfer
2010-09-09 08:03:40 107368 —-a-w- c:\windows\system32\GEARAspi.dll
2010-09-09 08:03:00 0 d—–w- c:\docume~1\alluse~1\applic~1\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-09-09 07:59:55 41984 —-a-w- c:\windows\system32\drivers\usbaapl.sys
2010-09-09 07:59:55 3062048 —-a-w- c:\windows\system32\usbaaplrc.dll
2010-09-08 03:17:46 94208 —-a-w- c:\windows\system32\QuickTimeVR.qtx
2010-09-08 03:17:46 69632 —-a-w- c:\windows\system32\QuickTime.qts

==================== Find3M ====================

2010-08-21 10:57:27 711168 —-a-w- c:\windows\is-N7R98.exe
2010-07-16 21:00:04 423656 —-a-w- c:\windows\system32\deployJava1.dll
2008-07-26 14:16:22 44814336 —-a-w- c:\program files\common files\Photoshop.exe
2006-06-23 06:48:54 32768 —-a-r- c:\windows\inf\UpdateUSB.exe
2010-01-01 11:14:15 88 –sh–r- c:\windows\system32\C351079BE0.sys
2010-01-01 11:14:32 5018 –sha-w- c:\windows\system32\KGyGaAvL.sys

============= FINISH: 21:24:09.23 ===============

Please do not attach logs,use copy/paste

Question,do you have your windows xp cd?



Please download TDSSKiller.zip

* Extract it to your desktop
* Double click TDSSKiller.exe
* Press Start Scan
o Only if Malicious objects are found then ensure Cure is selected
o Then click Continue > Reboot now
* Copy and paste the log in your next reply
o A copy of the log will be saved automatically to the root of the drive (typically C:\)






Please scan the following files

• Please visit Virus Total by clicking here.
• Click the Browse button and search for the following file: c:\program files\rlcqc2\rlcqc21.exe
• Click Open.
• Then click Send File.
• Please be patient while the file is scanned.
• If Virus Total tells you that the file has already been scanned, click "reanalyse now".

• Once the scan results appear, copy and paste them into Notepad and repeat the procedure for the following file(s):
  
  
• c:\windows\is-N7R98.exe
  
• Please provide the results from the scans in your next reply.

Cut and pasted Combo log as requested.

ComboFix 10-10-06.02 - Paul 10/07/2010 21:25:05.3.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1023.743 [GMT 8:00]
Running from: c:\documents and settings\[removed]\Desktop\abd.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Paul\Recent\Thumbs.db
C:\Thumbs.db
c:\windows\system32\inf
c:\windows\system32\skinboxer43.dll
c:\windows\system32\Thumbs.db

c:\windows\system32\drivers\ndis.sys . . . is infected!!

.
((((((((((((((((((((((((( Files Created from 2010-09-07 to 2010-10-07 )))))))))))))))))))))))))))))))
.

2010-10-06 13:28 . 2010-10-06 13:28 ——– d—–w- C:\gmer
2010-10-06 04:51 . 2010-10-06 10:05 ——– d—–w- C:\cars
2010-10-05 05:58 . 2010-10-06 05:15 ——– d—–w- c:\program files\Exterminate It!
2010-10-03 14:37 . 2010-10-03 14:37 ——– d—–w- c:\program files\iPod
2010-10-03 14:37 . 2010-10-03 14:37 ——– d—–w- c:\program files\iTunes
2010-10-03 14:33 . 2010-10-03 14:33 73000 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 10.0.1.22\SetupAdmin.exe
2010-10-03 14:30 . 2010-10-03 14:30 72488 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\Safari 5.33.18.5\SetupAdmin.exe
2010-09-28 13:06 . 2010-09-28 13:06 72184 —ha-w- c:\windows\system32\mlfcache.dat
2010-09-22 14:46 . 2010-09-22 14:46 ——– d—–w- c:\documents and settings\All Users\Application Data\VOWSoft
2010-09-22 14:46 . 2010-09-22 14:46 ——– d—–w- c:\program files\ABC 3GP Converter
2010-09-22 14:42 . 2010-09-22 14:56 ——– d—–w- c:\program files\Common Files\Common Share
2010-09-19 10:34 . 2010-10-03 14:27 ——– d—–w- C:\blackberrydeleted
2010-09-18 11:54 . 2010-09-18 11:55 ——– d—–w- c:\documents and settings\Paul\Application Data\BoneTown Demo
2010-09-16 12:17 . 2010-04-29 07:39 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-09-16 12:17 . 2010-09-16 12:29 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-09-16 12:17 . 2010-04-29 07:39 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-09-13 11:39 . 2010-09-19 10:10 ——– d—–w- C:\phone list
2010-09-13 11:22 . 2010-09-13 11:30 ——– d—–w- C:\important pics
2010-09-12 11:03 . 2010-09-12 11:03 ——– d—–w- c:\program files\Windows Sidebar
2010-09-12 11:03 . 2010-09-12 14:03 ——– d—–w- c:\documents and settings\All Users\Application Data\Norton
2010-09-12 11:02 . 2010-09-12 11:03 ——– d—–w- c:\documents and settings\All Users\Application Data\NortonInstaller
2010-09-12 10:57 . 2010-09-12 10:57 ——– d—–w- C:\nav
2010-09-12 06:00 . 2010-09-12 06:00 ——– d—–w- c:\program files\Convert AVI to MP4
2010-09-12 03:17 . 2010-10-07 11:29 ——– d—–w- C:\blackberrytoiphone
2010-09-11 13:02 . 2010-09-11 13:02 3175 —-a-w- c:\windows\system32\SpoonUninstall-dBpoweramp m4a Utilities.dat
2010-09-11 13:02 . 2010-09-11 13:02 3328 —-a-w- c:\windows\system32\SpoonUninstall-dBpoweramp AAC Encoder.dat
2010-09-11 13:01 . 2010-09-11 13:01 1259 —-a-w- c:\windows\system32\SpoonUninstall-dBpoweramp m4b Audio book Encoder.dat
2010-09-11 12:45 . 2010-09-11 12:45 3621 —-a-w- c:\windows\system32\SpoonUninstall-dBpoweramp m4a Nero AAC Encoder.dat
2010-09-11 12:44 . 2010-09-11 12:44 3291 —-a-w- c:\windows\system32\SpoonUninstall-dBpoweramp m4a Codec.dat
2010-09-11 12:41 . 2010-09-11 12:41 ——– d—–w- c:\documents and settings\Paul\Application Data\dBpoweramp
2010-09-11 12:40 . 2010-09-11 12:40 ——– d—–w- c:\documents and settings\Paul\Application Data\AccurateRip
2010-09-11 12:40 . 2010-09-11 13:02 527224 —-a-w- c:\windows\system32\SpoonUninstall.exe
2010-09-11 12:40 . 2010-09-11 12:40 15341 —-a-w- c:\windows\system32\SpoonUninstall-dBpoweramp Music Converter.dat
2010-09-11 12:40 . 2010-09-11 12:40 ——– d—–w- c:\program files\Illustrate
2010-09-11 11:23 . 2010-09-11 11:23 ——– d—–w- C:\New Folder (4)
2010-09-11 09:34 . 2010-09-11 09:34 ——– d—–w- c:\program files\Xilisoft
2010-09-11 09:33 . 2010-09-11 09:33 ——– d—–w- C:\ringtone
2010-09-11 09:23 . 2010-09-11 09:23 ——– d—–w- c:\windows\system32\wbem\Repository
2010-09-11 08:34 . 2010-09-11 09:20 ——– d—–w- C:\crack
2010-09-11 07:53 . 2010-09-11 09:20 ——– d—–w- c:\program files\Xilisoft(2)
2010-09-11 07:47 . 2010-09-11 11:35 ——– d—–w- C:\ringtones
2010-09-11 07:30 . 2010-09-11 07:30 ——– d—–w- c:\documents and settings\Paul\.shsh
2010-09-10 19:47 . 2010-09-11 09:21 ——– d—–w- c:\program files\iPod(2)
2010-09-10 19:47 . 2010-09-11 09:21 ——– d—–w- c:\program files\iTunes(2)
2010-09-10 19:30 . 2010-09-10 19:30 ——– d—–w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2010-09-10 18:16 . 2010-09-11 09:22 ——– d—–w- c:\documents and settings\Paul\Application Data\iPhoneRingToneMaker
2010-09-10 14:46 . 2010-09-10 14:46 ——– d—–w- c:\program files\Tipard Studio
2010-09-10 10:34 . 2010-09-10 10:34 ——– d—–w- C:\redsnow
2010-09-09 10:32 . 2010-09-09 10:32 89831 —-a-w- c:\documents and settings\Paul\Application Data\Dropbox\bin\Uninstall.exe
2010-09-09 10:32 . 2010-10-07 13:34 ——– d—–w- c:\documents and settings\Paul\Application Data\Dropbox
2010-09-09 09:58 . 2010-09-09 09:59 ——– d—–w- C:\filexfer
2010-09-09 08:03 . 2008-04-17 04:12 107368 —-a-w- c:\windows\system32\GEARAspi.dll
2010-09-09 08:03 . 2010-09-09 08:03 ——– d—–w- c:\documents and settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-09-09 08:01 . 2010-09-09 08:01 ——– d—–w- c:\program files\Apple Software Update
2010-09-09 07:59 . 2010-04-19 12:47 3062048 —-a-w- c:\windows\system32\usbaaplrc.dll
2010-09-09 07:59 . 2010-04-19 12:47 41984 —-a-w- c:\windows\system32\drivers\usbaapl.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-07 13:35 . 2008-06-06 11:11 ——– d—–w- c:\documents and settings\Paul\Application Data\Skype
2010-10-07 10:10 . 2008-06-01 11:49 ——– d—–w- c:\program files\Mozilla Thunderbird
2010-10-07 08:17 . 2008-06-06 11:14 ——– d—–w- c:\documents and settings\Paul\Application Data\skypePM
2010-10-06 14:18 . 2009-05-14 06:42 ——– d—–w- c:\documents and settings\Paul\Application Data\SpinTop
2010-10-03 14:37 . 2008-08-28 11:34 ——– d—–w- c:\program files\Common Files\Apple
2010-10-03 14:34 . 2008-10-16 13:11 ——– d—–w- c:\program files\QuickTime
2010-10-03 14:31 . 2008-08-28 11:32 ——– d—–w- c:\program files\Safari
2010-09-30 12:19 . 2010-07-02 16:44 ——– d—–w- c:\program files\BattlePing
2010-09-29 11:13 . 2008-06-03 13:32 ——– d—–w- c:\documents and settings\Paul\Application Data\Winamp
2010-09-28 14:16 . 2009-05-16 04:06 ——– d—–w- c:\program files\Burn4Free
2010-09-26 06:10 . 2008-06-02 04:59 ——– d—–w- c:\documents and settings\Paul\Application Data\BitTorrent
2010-09-22 15:31 . 2008-06-01 13:41 ——– d—–w- c:\program files\World of Warcraft
2010-09-21 10:36 . 2008-06-01 13:41 ——– d—–w- c:\program files\Common Files\Blizzard Entertainment
2010-09-17 08:53 . 2010-08-04 08:52 452104 —-a-w- c:\documents and settings\Paul\Application Data\Real\Update\setup3.12\setup.exe
2010-09-13 11:10 . 2010-07-29 03:42 ——– d—–r- c:\program files\Skype
2010-09-12 13:15 . 2010-08-07 13:25 ——– d—–w- c:\program files\Dvd-cloner
2010-09-09 09:53 . 2008-08-23 12:20 ——– d—–w- c:\documents and settings\Paul\Application Data\Apple Computer
2010-09-09 08:00 . 2008-06-10 09:55 ——– d—–w- c:\documents and settings\All Users\Application Data\Apple
2010-09-05 14:05 . 2010-09-05 14:05 ——– d—–w- c:\program files\Belarc
2010-08-21 10:57 . 2010-08-21 10:57 711168 —-a-w- c:\windows\is-N7R98.exe
2010-08-20 07:57 . 2010-08-20 05:46 ——– d—–w- c:\documents and settings\All Users\Application Data\avg9
2010-08-20 05:31 . 2009-02-06 10:21 ——– d—–w- c:\documents and settings\Paul\Application Data\InstallShield
2010-08-20 05:31 . 2009-02-06 10:22 ——– d—–w- c:\program files\Sony Ericsson
2010-08-20 05:31 . 2008-06-01 11:29 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-08-18 14:22 . 2010-08-18 14:22 664 —-a-w- c:\windows\system32\d3d9caps.dat
2010-08-18 09:44 . 2010-08-18 09:44 ——– d—–w- c:\program files\Convert VOB to AVI
2010-08-07 15:46 . 2010-08-07 15:46 503808 —-a-w- c:\documents and settings\Paul\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-6877070c-n\msvcp71.dll
2010-08-07 15:46 . 2010-08-07 15:46 499712 —-a-w- c:\documents and settings\Paul\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-6877070c-n\jmc.dll
2010-08-07 15:46 . 2010-08-07 15:46 348160 —-a-w- c:\documents and settings\Paul\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-6877070c-n\msvcr71.dll
2010-08-07 15:46 . 2010-08-07 15:46 61440 —-a-w- c:\documents and settings\Paul\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-42fe1925-n\decora-sse.dll
2010-08-07 15:46 . 2010-08-07 15:46 12800 —-a-w- c:\documents and settings\Paul\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-42fe1925-n\decora-d3d.dll
2010-08-07 15:39 . 2010-07-26 07:50 27630760 —-a-w- c:\documents and settings\All Users\Application Data\Yahoo!\YUPDATER\msgup1000_1270_us_u1.exe
2010-07-16 21:00 . 2010-08-07 15:46 423656 —-a-w- c:\windows\system32\deployJava1.dll
2008-07-26 14:16 . 2008-08-03 06:56 44814336 —-a-w- c:\program files\Common Files\Photoshop.exe
2008-03-11 08:46 . 2008-06-03 15:27 8784 —-a-w- c:\program files\mozilla firefox\plugins\ractrlkeyhook.dll
2010-01-01 11:14 . 2008-06-01 15:50 88 –sh–r- c:\windows\system32\C351079BE0.sys
2010-01-01 11:14 . 2008-06-01 15:50 5018 –sha-w- c:\windows\system32\KGyGaAvL.sys
.

——- Sigcheck ——-

[-] 2010-03-07 . 558635D3AF1C7546D26067D5D9B6959E . 212736 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ndis.sys
[-] 2010-03-07 . 558635D3AF1C7546D26067D5D9B6959E . 212736 . . [5.1.2600.2180] . . c:\windows\system32\drivers\ndis.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2008-07-17 09:20 279944 —-a-w- c:\program files\AskBarDis\bar\bin\askBar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-07-17 279944]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-07-17 279944]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19 94208 —-a-w- c:\documents and settings\Paul\Application Data\Dropbox\bin\DropboxExt.13.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19 94208 —-a-w- c:\documents and settings\Paul\Application Data\Dropbox\bin\DropboxExt.13.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19 94208 —-a-w- c:\documents and settings\Paul\Application Data\Dropbox\bin\DropboxExt.13.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaDetector.exe" [2008-02-26 443968]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-09-19 455968]
"WindowsLivePhone"="c:\program files\Windows Live\Device Manager\msgrdvmn.exe" [2008-12-22 787816]
"c:\program files\NetMeter\NetMeter.exe"="c:\program files\NetMeter\NetMeter.exe" [2009-08-09 293888]
"Skype"="c:\program files\Skype\\Phone\Skype.exe" [2010-05-13 26192168]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-06-28 8466432]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-06-28 81920]
"SkyTel"="SkyTel.EXE" [2006-05-16 2879488]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 32768]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-09-21 47904]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-14 39792]
"BrMfcWnd"="c:\program files\Brother\Brmfcmon\BrMfcWnd.exe" [2006-03-28 622592]
"SetDefPrt"="c:\program files\Brother\Brmfl06a\BrStDvPt.exe" [2005-01-26 49152]
"ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2006-04-10 61440]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-03 110592]
"NeroFilterCheck"="c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2007-03-01 153136]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-07-04 185896]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"Launch LgDevAgt"="c:\program files\Logitech\GamePanel Software\LgDevAgt.exe" [2008-11-06 358920]
"Launch LCDMon"="c:\program files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe" [2008-11-06 1548296]
"Launch LGDCore"="c:\program files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" [2008-11-06 2816520]
"LifeChat"="c:\program files\Microsoft LifeChat\LifeChat.exe" [2008-08-21 267296]
"WindowsLivePhone"="c:\program files\Windows Live\Device Manager\msgrdvmn.exe" [2008-12-22 787816]
"UpdatePDRShortCut"="c:\program files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" [2008-01-04 222504]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-09-08 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-09-23 421160]
"Corel Photo Downloader"="c:\program files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe" [2007-02-06 478800]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]

c:\documents and settings\Paul\Start Menu\Programs\Startup\
Dropbox.lnk - c:\documents and settings\Paul\Application Data\Dropbox\bin\Dropbox.exe [2010-2-26 21979992]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
InterVideo WinCinema Manager.lnk - c:\program files\InterVideo\Common\Bin\WinCinemaMgr.exe [2008-6-1 303104]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\Orb.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\Sony Ericsson\\Sony Ericsson Media Manager\\MediaManager.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=
"c:\\Program Files\\CyberLink\\PowerDirector\\PDR.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
"AllowOutboundDestinationUnreachable"= 1 (0x1)
"AllowOutboundTimeExceeded"= 1 (0x1)

R3 LGPBTDD;LGPBTDD.sys Display Driver;c:\windows\system32\drivers\LGPBTDD.sys [10/31/2009 15:57 23432]
S2 gupdate1c9b9c8c0035954;Google Update Service (gupdate1c9b9c8c0035954);c:\program files\Google\Update\GoogleUpdate.exe [4/10/2009 18:40 133104]
S2 solewxte;solewxte Service; [x]
S3 Alpham;Ideazon Fang Composite Keyboard Driver;c:\windows\system32\drivers\Alpham.sys [12/4/2005 13:55 34944]
S3 CAM1690;USB PC Camera;c:\windows\system32\drivers\cam1690.sys [11/21/2007 17:37 181888]
S3 PciCon;PciCon;\??\d:\pcicon.sys –> d:\PciCon.sys [?]
S3 s3017bus;Sony Ericsson Device 3017 driver (WDM);c:\windows\system32\drivers\s3017bus.sys [2/6/2009 18:22 83880]
S3 s3017mdfl;Sony Ericsson Device 3017 USB WMC Modem Filter;c:\windows\system32\drivers\s3017mdfl.sys [2/6/2009 18:22 15016]
S3 s3017mdm;Sony Ericsson Device 3017 USB WMC Modem Driver;c:\windows\system32\drivers\s3017mdm.sys [2/6/2009 18:22 110632]
S3 s3017mgmt;Sony Ericsson Device 3017 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s3017mgmt.sys [2/6/2009 18:22 104616]
S3 s3017nd5;Sony Ericsson Device 3017 USB Ethernet Emulation SEMC3017 (NDIS);c:\windows\system32\drivers\s3017nd5.sys [2/6/2009 18:22 25512]
S3 s3017obex;Sony Ericsson Device 3017 USB WMC OBEX Interface;c:\windows\system32\drivers\s3017obex.sys [2/6/2009 18:22 100648]
S3 s3017unic;Sony Ericsson Device 3017 USB Ethernet Emulation SEMC3017 (WDM);c:\windows\system32\drivers\s3017unic.sys [2/6/2009 18:22 110120]
S4 PCPitstop Scheduling;PCPitstop Scheduling;c:\program files\PCPitstop\PCPitstopScheduleService.exe [5/18/2010 21:03 90352]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2007-09-19 13:46 451872 —-a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder

2010-10-07 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 03:50]

2009-11-07 c:\windows\Tasks\LifeChatTask.job
- c:\program files\Microsoft LifeChat\LifeChat.exe [2008-08-21 03:16]

2010-10-06 c:\windows\Tasks\rlcqc21.job
- c:\program files\rlcqc2\rlcqc21.exe [2008-08-05 14:39]
.
.
——- Supplementary Scan ——-
.
uDefault_Search_URL = hxxp://www.google.com/ie
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Winamp Search - c:\documents and settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949}
IE: {{60237576-b24c-4ba9-9740-c9f3ec9db557} - {EAADF17C-B6EA-4511-8549-A67CFD406EAF} - c:\progra~1\SkyCode\WEBTRA~1\wt2ie.dll
DPF: {1B4F9DD7-2D7C-44B5-9126-73206DA0AE75} - hxxp://files.authentium.com/bigpond/bin/wizard.exe
DPF: {A27C56D2-3F58-4ABB-AA31-1168EDA6636F} - hxxp://utilities.pcpitstop.com/Nirvana/controls/pcmatic.cab
FF - ProfilePath - c:\documents and settings\Paul\Application Data\Mozilla\Firefox\Profiles\nrtiiceq.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.fastbrowsersearch.com/results/results.aspx?s=DEF&v=4&q=
FF - prefs.js: browser.search.selectedEngine - Fast Browser Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com.au
FF - prefs.js: keyword.URL - hxxp://www.fastbrowsersearch.com/results/results.aspx?s=NAUS&v=4&tid={54AEF6A5-C70C-1F41-7D34-A99DE46A49AD}&q=
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npdrmv2.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npdsplay.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npnul32.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\nppl3260.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npqtplugin.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npqtplugin2.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npqtplugin3.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npqtplugin4.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npqtplugin5.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npqtplugin6.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npqtplugin7.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\nprfxins.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\nprjplug.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\nprpjplug.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npwmsdrm.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll

—- FIREFOX POLICIES —-
pref(dom.disable_open_during_load, true);.
- - - - ORPHANS REMOVED - - - -

URLSearchHooks-{A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)
BHO-{D187A56B-A33F-4CBE-9D77-459FC0BAE012} - (no file)
Toolbar-{4F11ACBB-393F-4C86-A214-FF3D0D155CC3} - (no file)
Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{4F11ACBB-393F-4C86-A214-FF3D0D155CC3} - (no file)
AddRemove-Winamp Toolbar for Firefox - c:\documents and settings\Paul\Application Data\Mozilla\Firefox\Profiles\nrtiiceq.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}\uninstall.exe



Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe >>UNKNOWN [0x876B9580]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf7500fc3
\Driver\ACPI -> ACPI.sys @ 0xf7373cb8
\Driver\atapi -> atapi.sys @ 0xf732b7b4
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x8058236c
ParseProcedure -> ntkrnlpa.exe @ 0x8058146a
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x8058236c
ParseProcedure -> ntkrnlpa.exe @ 0x8058146a
NDIS: Marvell Yukon 88E8056 PCI-E Gigabit Ethernet Controller -> SendCompleteHandler -> NDIS.sys @ 0x876a0ba0
PacketIndicateHandler -> NDIS.sys @ 0x876adb21
SendHandler -> NDIS.sys @ 0x8768b87b
user & kernel MBR OK

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'explorer.exe'(1176)
c:\documents and settings\Paul\Application Data\Dropbox\bin\DropboxExt.13.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\windows\system32\RUNDLL32.EXE
c:\program files\Common Files\Authentium\AntiVirus\dvpapi.exe
c:\windows\system32\rundll32.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\PSIService.exe
c:\program files\CyberLink\Shared Files\RichVideo.exe
c:\program files\Canon\CAL\CALMAIN.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2010-10-07 21:39:41 - machine was rebooted
ComboFix-quarantined-files.txt 2010-10-07 13:39

Pre-Run: 271,326,507,008 bytes free
Post-Run: 276,349,071,360 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

- - End Of File - - 39B21FCBE82F7E3D4B5FC60F67B81772

Ok…found XP CD. Logs for VIRSCAN and SYSTEMLOOK below.


netVirSCAN.org Scanned Report :
Scanned time : 2010/10/08 20:52:00 (EST)
Scanner results: Scanners did not find malware!
File Name : rlcqc21.exe
File Size : 286720 byte
File Type : PE32 executable for MS Windows (GUI) Intel 80386 32-bit
MD5 : 8508683dfc875f09435a736ae6536ac5
SHA1 : 787bf69b4ce229796ef773d95954779c002628bb
Online report : http://virscan.org/report/5baa453ccfbb0513…2df8dd7e98.html

Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 5.0.0.20 20101008020253 2010-10-08 5.34 -
AhnLab V3 2010.10.04.01 2010.10.04 2010-10-04 2.01 -
AntiVir 8.2.4.72 7.10.12.163 2010-10-08 0.30 -
Antiy 2.0.18 20101008.5300009 2010-10-08 0.13 -
Authentium 5.1.1 201010080229 2010-10-08 2.21 -
AVAST! 4.7.4 101007-2 2010-10-07 0.03 -
AVG 8.5.850 271.1.1/3183 2010-10-08 0.29 -
BitDefender 7.90123.6293277 7.34191 2010-10-08 4.73 -
ClamAV 0.96.1 12105 2010-10-08 0.07 -
Comodo 4.0 6317 2010-10-07 2.20 -
CP Secure 1.3.0.5 2010.10.08 2010-10-08 0.06 -
Dr.Web 5.0.2.3300 2010.10.08 2010-10-08 9.54 -
F-Prot 4.4.4.56 20101007 2010-10-07 2.13 -
F-Secure 7.02.73807 2010.10.08.08 2010-10-08 0.20 -
Fortinet 4.2.249 12.431 2010-10-07 0.58 -
GData 21.948/21.389 20101008 2010-10-08 9.21 -
ViRobot 20101007 2010.10.07 2010-10-07 0.88 -
Ikarus T3.1.32.15.0 2010.10.08.76900 2010-10-08 5.04 -
JiangMin 13.0.900 2010.10.07 2010-10-07 1.37 -
Kaspersky 5.5.10 2010.09.28 2010-09-28 0.14 -
KingSoft 2009.2.5.15 2010.10.7.7 2010-10-07 0.67 -
McAfee 5400.1158 6129 2010-10-07 19.04 -
Microsoft 1.6201 2010.10.08 2010-10-08 8.14 -
Norman 6.05.11 6.05.00 2010-09-02 8.01 -
Panda 9.05.01 2010.10.05 2010-10-05 5.30 -
Trend Micro 9.120-1004 7.524.06 2010-10-08 0.00 -
Quick Heal 11.00 2010.10.08 2010-10-08 2.67 -
Rising 20.0 22.67.02.07 2010-09-29 2.93 -
Sophos 3.12.1 4.58 2010-10-08 4.13 -
Sunbelt 3.9.2453.2 7010 2010-10-07 20.87 -
Symantec 1.3.0.24 20101007.002 2010-10-07 0.11 -
nProtect 20101001.02 9012073 2010-10-01 10.10 -
The Hacker 6.7.0.1 v00052 2010-10-07 0.91 -
VBA32 3.12.14.1 20101007.0942 2010-10-07 3.49 -
VirusBuster 4.5.11.10 10.129.8/2003667 2010-10-08 2.90 -

—————————————————————————————————————————————————————————–


SystemLook 04.09.10 by jpshortstuff
Log created at 19:12 on 08/10/2010 by Paul
Administrator - Elevation successful

========== filefind ==========

Searching for "*ndis*"
C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\ui\button_movedowndisabled.gif –a—- 455 bytes [20:24 07/09/2006] [20:24 07/09/2006] EC7709421B11760DD7BCA67260B05E3D
C:\Documents and Settings\Paul\Cookies\paul@christiandiscussionboards[1].txt –a—- 317 bytes [10:33 25/06/2009] [10:33 25/06/2009] 83866CD7CC119D18EFD9532497189C24
C:\Program Files\Utherverse Digital Inc\Utherverse 3D Client\resources\msh\merchandise_cap.gml –a—- 237 bytes [13:27 11/07/2008] [12:39 14/09/2007] 276EC7716E472E9F32A6B81718B957C2
C:\Program Files\Utherverse Digital Inc\Utherverse 3D Client\resources\msh\merchandise_condoms.gml –a—- 249 bytes [13:27 11/07/2008] [12:39 14/09/2007] B0EF3B88D26AD7E10B08C08DEA88C4ED
C:\Program Files\Utherverse Digital Inc\Utherverse 3D Client\resources\msh\merchandise_mouse_pad.gml –a—- 253 bytes [13:27 11/07/2008] [12:39 14/09/2007] EC0FF7822D7DD911D8DD0BE86F5D1A32
C:\Program Files\Utherverse Digital Inc\Utherverse 3D Client\resources\msh\merchandise_mug01.gml –a—- 239 bytes [13:27 11/07/2008] [12:39 14/09/2007] 52CF34D23D84122899B127C1172C331D
C:\Program Files\Utherverse Digital Inc\Utherverse 3D Client\resources\msh\merchandise_mug02.gml –a—- 237 bytes [13:27 11/07/2008] [12:39 14/09/2007] B8E92FDFDA29B21BA595202E44C9F94F
C:\Program Files\Utherverse Digital Inc\Utherverse 3D Client\resources\msh\merchandise_scarf.gml –a—- 243 bytes [13:27 11/07/2008] [13:24 26/09/2007] 85AC6FDFC44977C5ABD47982F668BFDC
C:\Program Files\Utherverse Digital Inc\Utherverse 3D Client\resources\msh\merchandise_ski_hat.gml –a—- 249 bytes [13:27 11/07/2008] [12:39 14/09/2007] A632DEAEF94D796686E561C4AA6846FA
C:\Program Files\Utherverse Digital Inc\Utherverse 3D Client\resources\Prop\merchandise_cap.gr2 –a—- 10494 bytes [13:27 11/07/2008] [12:35 14/09/2007] 658E2BD0D20740A1BFD257D28C65871A
C:\Program Files\Utherverse Digital Inc\Utherverse 3D Client\resources\Prop\merchandise_condoms.gr2 –a—- 11861 bytes [13:27 11/07/2008] [12:35 14/09/2007] 2173C5ADA7B665FA7A13082BF4BA965D
C:\Program Files\Utherverse Digital Inc\Utherverse 3D Client\resources\Prop\merchandise_mouse_pad.gr2 –a—- 20198 bytes [13:27 11/07/2008] [12:35 14/09/2007] 01B5B5B9D0F5BD9E1C6F1C09632CD9A9
C:\Program Files\Utherverse Digital Inc\Utherverse 3D Client\resources\Prop\merchandise_mug01.gr2 –a—- 18873 bytes [13:27 11/07/2008] [16:01 02/10/2007] 8C85742C8A067FD7E7CB505DA8D451CD
C:\Program Files\Utherverse Digital Inc\Utherverse 3D Client\resources\Prop\merchandise_mug02.gr2 –a—- 13826 bytes [13:27 11/07/2008] [16:01 02/10/2007] BA6B9F86B7629DFE43BDFE2576003D02
C:\Program Files\Utherverse Digital Inc\Utherverse 3D Client\resources\Prop\merchandise_scarf.gr2 –a—- 8525 bytes [13:27 11/07/2008] [13:24 26/09/2007] CDA3C8997213CF909002D21FF6998E93
C:\Program Files\Utherverse Digital Inc\Utherverse 3D Client\resources\Prop\merchandise_ski_hat.gr2 –a—- 13530 bytes [13:27 11/07/2008] [12:39 14/09/2007] CF0A09669BAC3471D6400D29C3E28ECA
C:\Program Files\Utherverse Digital Inc\Utherverse 3D Client QA\resources\msh\merchandise_cap.gml –a—- 237 bytes [15:17 29/07/2008] [12:39 14/09/2007] 276EC7716E472E9F32A6B81718B957C2
C:\Program Files\Utherverse Digital Inc\Utherverse 3D Client QA\resources\msh\merchandise_condoms.gml –a—- 249 bytes [15:17 29/07/2008] [12:39 14/09/2007] B0EF3B88D26AD7E10B08C08DEA88C4ED
C:\Program Files\Utherverse Digital Inc\Utherverse 3D Client QA\resources\msh\merchandise_mouse_pad.gml –a—- 253 bytes [15:17 29/07/2008] [12:39 14/09/2007] EC0FF7822D7DD911D8DD0BE86F5D1A32
C:\Program Files\Utherverse Digital Inc\Utherverse 3D Client QA\resources\msh\merchandise_mug01.gml –a—- 239 bytes [15:17 29/07/2008] [12:39 14/09/2007] 52CF34D23D84122899B127C1172C331D
C:\Program Files\Utherverse Digital Inc\Utherverse 3D Client QA\resources\msh\merchandise_mug02.gml –a—- 237 bytes [15:17 29/07/2008] [12:39 14/09/2007] B8E92FDFDA29B21BA595202E44C9F94F
C:\Program Files\Utherverse Digital Inc\Utherverse 3D Client QA\resources\msh\merchandise_scarf.gml –a—- 243 bytes [15:17 29/07/2008] [13:24 26/09/2007] 85AC6FDFC44977C5ABD47982F668BFDC
C:\Program Files\Utherverse Digital Inc\Utherverse 3D Client QA\resources\msh\merchandise_ski_hat.gml –a—- 249 bytes [15:17 29/07/2008] [12:39 14/09/2007] A632DEAEF94D796686E561C4AA6846FA
C:\Program Files\Utherverse Digital Inc\Utherverse 3D Client QA\resources\Prop\merchandise_cap.gr2 –a—- 10494 bytes [15:18 29/07/2008] [12:35 14/09/2007] 658E2BD0D20740A1BFD257D28C65871A
C:\Program Files\Utherverse Digital Inc\Utherverse 3D Client QA\resources\Prop\merchandise_condoms.gr2 –a—- 11861 bytes [15:18 29/07/2008] [12:35 14/09/2007] 2173C5ADA7B665FA7A13082BF4BA965D
C:\Program Files\Utherverse Digital Inc\Utherverse 3D Client QA\resources\Prop\merchandise_mouse_pad.gr2 –a—- 20198 bytes [15:18 29/07/2008] [12:35 14/09/2007] 01B5B5B9D0F5BD9E1C6F1C09632CD9A9
C:\Program Files\Utherverse Digital Inc\Utherverse 3D Client QA\resources\Prop\merchandise_mug01.gr2 –a—- 18873 bytes [15:18 29/07/2008] [16:01 02/10/2007] 8C85742C8A067FD7E7CB505DA8D451CD
C:\Program Files\Utherverse Digital Inc\Utherverse 3D Client QA\resources\Prop\merchandise_mug02.gr2 –a—- 13826 bytes [15:18 29/07/2008] [16:01 02/10/2007] BA6B9F86B7629DFE43BDFE2576003D02
C:\Program Files\Utherverse Digital Inc\Utherverse 3D Client QA\resources\Prop\merchandise_scarf.gr2 –a—- 8525 bytes [15:18 29/07/2008] [13:24 26/09/2007] CDA3C8997213CF909002D21FF6998E93
C:\Program Files\Utherverse Digital Inc\Utherverse 3D Client QA\resources\Prop\merchandise_ski_hat.gr2 –a—- 13530 bytes [15:18 29/07/2008] [12:39 14/09/2007] CF0A09669BAC3471D6400D29C3E28ECA
C:\Program Files\World of Warcraft\Interface\AddOns\Enchantrix\Data\EnxNonDisenchant.lua ——- 52481 bytes [10:52 25/08/2010] [16:06 02/05/2010] 582C2EEED5C4DBC19AAFB868CF2E486D
C:\Qoobox\Quarantine\C\WINDOWS\system32\Drivers\ndis.sys.vir –a—- 212736 bytes [13:31 07/10/2010] [07:23 07/03/2010] A4BCBA984FBCA5604BF484B53C39293E
C:\WINDOWS\inf\ndisip.inf –a—- 6742 bytes [12:00 28/02/2006] [12:00 28/02/2006] C47E77CCCC177A153388D3042AE0A0C9
C:\WINDOWS\inf\ndisip.PNF –a—- 9096 bytes [17:45 01/06/2008] [12:44 04/06/2008] FAA8DC65C2AD5BC27D934D11F991EA44
C:\WINDOWS\inf\ndisuio.inf –a—- 2447 bytes [12:00 28/02/2006] [12:00 28/02/2006] AB24196C257A6179B36D7E01827B7BB1
C:\WINDOWS\inf\ndisuio.PNF –a—- 5792 bytes [17:45 01/06/2008] [11:07 01/06/2008] 57EA3AC9184AD06C9BDA420EA180255F
C:\WINDOWS\inf\netrndis.inf –a—- 2938 bytes [12:00 28/02/2006] [12:00 28/02/2006] F7F04D33AB0011DED257BA6AAF50D791
C:\WINDOWS\inf\netrndis.PNF –a—- 6800 bytes [17:45 01/06/2008] [17:45 01/06/2008] 8B3A833769658CE053975CF98C838667
C:\WINDOWS\system32\dllcache\ndis.sys –a–c- 182912 bytes [12:00 28/02/2006] [07:23 07/03/2010] 558635D3AF1C7546D26067D5D9B6959E
C:\WINDOWS\system32\dllcache\ndisip.sys –a–c- 10880 bytes [12:44 04/06/2008] [15:10 03/08/2004] 520CE427A8B298F54112857BCF6BDE15
C:\WINDOWS\system32\dllcache\ndisnpp.dll –a–c- 57344 bytes [12:00 28/02/2006] [12:00 28/02/2006] 71552250601F683B7A1A6C618A0862B6
C:\WINDOWS\system32\dllcache\ndistapi.sys –a–c- 9600 bytes [12:00 28/02/2006] [12:00 28/02/2006] 08D43BBDACDF23F34D79E44ED35C1B4C
C:\WINDOWS\system32\dllcache\ndiswan.sys –a–c- 91776 bytes [12:00 28/02/2006] [12:00 28/02/2006] 0B90E255A9490166AB368CD55A529893
C:\WINDOWS\system32\dllcache\rndismp.sys –a–c- 30080 bytes [12:00 28/02/2006] [12:00 28/02/2006] 7CE8B277F3207EA82D7D22AD348BEFC6
C:\WINDOWS\system32\drivers\ndis.sys –a—- 182912 bytes [12:00 28/02/2006] [07:23 07/03/2010] 558635D3AF1C7546D26067D5D9B6959E
C:\WINDOWS\system32\drivers\NDIS.SY_ –a—- 90321 bytes [05:35 06/10/2010] [21:00 03/08/2004] 6C301B042682240589D9DFCB0F07D444
C:\WINDOWS\system32\drivers\NdisIP.sys –a—- 10880 bytes [12:44 04/06/2008] [15:10 03/08/2004] 520CE427A8B298F54112857BCF6BDE15
C:\WINDOWS\system32\drivers\ndistapi.sys –a—- 9600 bytes [12:00 28/02/2006] [12:00 28/02/2006] 08D43BBDACDF23F34D79E44ED35C1B4C
C:\WINDOWS\system32\drivers\ndisuio.sys –a—- 12928 bytes [23:03 03/08/2004] [12:00 28/02/2006] 34D6CD56409DA9A7ED573E1C90A308BF
C:\WINDOWS\system32\drivers\ndiswan.sys –a—- 91776 bytes [12:00 28/02/2006] [12:00 28/02/2006] 0B90E255A9490166AB368CD55A529893
C:\WINDOWS\system32\drivers\rndismp.sys –a—- 30080 bytes [12:00 28/02/2006] [12:00 28/02/2006] 7CE8B277F3207EA82D7D22AD348BEFC6
C:\WINDOWS\system32\npp\ndisnpp.dll –a—- 57344 bytes [12:00 28/02/2006] [12:00 28/02/2006] 71552250601F683B7A1A6C618A0862B6

-= EOF =-

VirSCAN.org Scanned Report :
Scanned time : 2010/10/08 23:40:59 (EST)
Scanner results: Scanners did not find malware!
File Name : is-N7R98.exe
File Size : 711168 byte
File Type : PE32 executable for MS Windows (GUI) Intel 80386 32-bit
MD5 : 296a2fac6a99515a8a57d6af147890e6
SHA1 : 44e5e5bedf8527fd15a25ff0fab1cd8cd34b82a8
Online report : http://virscan.org/report/96c4b2504866dc5f…75a08af693.html

Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 5.0.0.20 20101008020253 2010-10-08 40.09 -
AhnLab V3 2010.10.04.01 2010.10.04 2010-10-04 40.09 -
AntiVir 8.2.4.72 7.10.12.165 2010-10-08 0.30 -
Antiy 2.0.18 20101008.5300009 2010-10-08 0.13 -
Authentium 5.1.1 201010080949 2010-10-08 5.93 -
AVAST! 4.7.4 101008-0 2010-10-08 0.06 -
AVG 8.5.850 271.1.1/3183 2010-10-08 0.28 -
BitDefender 7.90123.6293931 7.34192 2010-10-08 4.81 -
ClamAV 0.96.1 12106 2010-10-08 0.01 -
Comodo 4.0 6317 2010-10-07 40.09 -
CP Secure 1.3.0.5 2010.10.08 2010-10-08 0.12 -
Dr.Web 5.0.2.3300 2010.10.08 2010-10-08 10.77 -
F-Prot 4.4.4.56 20101008 2010-10-08 5.24 -
F-Secure 7.02.73807 2010.10.08.09 2010-10-08 0.22 -
Fortinet 4.2.249 12.431 2010-10-07 40.09 -
GData 21.948/21.389 20101008 2010-10-08 40.09 -
ViRobot 20101007 2010.10.07 2010-10-07 40.09 -
Ikarus T3.1.32.15.0 2010.10.08.76901 2010-10-08 5.13 -
JiangMin 13.0.900 2010.10.07 2010-10-07 40.09 -
Kaspersky 5.5.10 2010.09.28 2010-09-28 0.10 -
KingSoft 2009.2.5.15 2010.10.8.18 2010-10-08 40.12 -
McAfee 5400.1158 6129 2010-10-07 19.50 -
Microsoft 1.6201 2010.10.08 2010-10-08 40.09 -
Norman 6.05.11 6.05.00 2010-09-02 10.01 -
Panda 9.05.01 2010.10.05 2010-10-05 40.09 -
Trend Micro 9.120-1004 7.524.11 2010-10-08 0.00 -
Quick Heal 11.00 2010.10.08 2010-10-08 40.09 -
Rising 20.0 22.67.02.07 2010-09-29 40.09 -
Sophos 3.12.1 4.58 2010-10-08 4.23 -
Sunbelt 3.9.2453.2 7010 2010-10-07 40.09 -
Symantec 1.3.0.24 20101007.002 2010-10-07 0.06 -
nProtect 20101008.01 9080532 2010-10-08 40.09 -
The Hacker 6.7.0.1 v00052 2010-10-07 40.09 -
VBA32 3.12.14.1 20101007.0942 2010-10-07 4.50 -
VirusBuster 4.5.11.10 10.129.8/2003667 2010-10-08 6.89 -

—————————————————————————————————————————————————————————

ComboFix 10-10-07.02 - Paul 10/08/2010 22:00:13.5.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1023.482 [GMT 8:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\drivers\ndis.sys . . . is infected!!

.
((((((((((((((((((((((((( Files Created from 2010-09-08 to 2010-10-08 )))))))))))))))))))))))))))))))
.

2010-10-08 08:12 . 2010-10-08 08:13 ——– d—–w- C:\tdss
2010-10-06 13:28 . 2010-10-06 13:28 ——– d—–w- C:\gmer
2010-10-06 04:51 . 2010-10-06 10:05 ——– d—–w- C:\cars
2010-10-05 05:58 . 2010-10-06 05:15 ——– d—–w- c:\program files\Exterminate It!
2010-10-03 14:37 . 2010-10-03 14:37 ——– d—–w- c:\program files\iPod
2010-10-03 14:37 . 2010-10-03 14:37 ——– d—–w- c:\program files\iTunes
2010-10-03 14:33 . 2010-10-03 14:33 73000 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 10.0.1.22\SetupAdmin.exe
2010-10-03 14:30 . 2010-10-03 14:30 72488 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\Safari 5.33.18.5\SetupAdmin.exe
2010-09-28 13:06 . 2010-09-28 13:06 72184 —ha-w- c:\windows\system32\mlfcache.dat
2010-09-22 14:46 . 2010-09-22 14:46 ——– d—–w- c:\documents and settings\All Users\Application Data\VOWSoft
2010-09-22 14:46 . 2010-09-22 14:46 ——– d—–w- c:\program files\ABC 3GP Converter
2010-09-22 14:42 . 2010-09-22 14:56 ——– d—–w- c:\program files\Common Files\Common Share
2010-09-19 10:34 . 2010-10-03 14:27 ——– d—–w- C:\blackberrydeleted
2010-09-18 11:54 . 2010-09-18 11:55 ——– d—–w- c:\documents and settings\Paul\Application Data\BoneTown Demo
2010-09-16 12:17 . 2010-04-29 07:39 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-09-16 12:17 . 2010-09-16 12:29 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-09-16 12:17 . 2010-04-29 07:39 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-09-13 11:39 . 2010-09-19 10:10 ——– d—–w- C:\phone list
2010-09-13 11:22 . 2010-09-13 11:30 ——– d—–w- C:\important pics
2010-09-12 11:03 . 2010-09-12 11:03 ——– d—–w- c:\program files\Windows Sidebar
2010-09-12 11:03 . 2010-09-12 14:03 ——– d—–w- c:\documents and settings\All Users\Application Data\Norton
2010-09-12 11:02 . 2010-09-12 11:03 ——– d—–w- c:\documents and settings\All Users\Application Data\NortonInstaller
2010-09-12 10:57 . 2010-09-12 10:57 ——– d—–w- C:\nav
2010-09-12 06:00 . 2010-09-12 06:00 ——– d—–w- c:\program files\Convert AVI to MP4
2010-09-12 03:17 . 2010-10-07 14:52 ——– d—–w- C:\blackberrytoiphone
2010-09-11 13:02 . 2010-09-11 13:02 3175 —-a-w- c:\windows\system32\SpoonUninstall-dBpoweramp m4a Utilities.dat
2010-09-11 13:02 . 2010-09-11 13:02 3328 —-a-w- c:\windows\system32\SpoonUninstall-dBpoweramp AAC Encoder.dat
2010-09-11 13:01 . 2010-09-11 13:01 1259 —-a-w- c:\windows\system32\SpoonUninstall-dBpoweramp m4b Audio book Encoder.dat
2010-09-11 12:45 . 2010-09-11 12:45 3621 —-a-w- c:\windows\system32\SpoonUninstall-dBpoweramp m4a Nero AAC Encoder.dat
2010-09-11 12:44 . 2010-09-11 12:44 3291 —-a-w- c:\windows\system32\SpoonUninstall-dBpoweramp m4a Codec.dat
2010-09-11 12:41 . 2010-09-11 12:41 ——– d—–w- c:\documents and settings\Paul\Application Data\dBpoweramp
2010-09-11 12:40 . 2010-09-11 12:40 ——– d—–w- c:\documents and settings\Paul\Application Data\AccurateRip
2010-09-11 12:40 . 2010-09-11 13:02 527224 —-a-w- c:\windows\system32\SpoonUninstall.exe
2010-09-11 12:40 . 2010-09-11 12:40 15341 —-a-w- c:\windows\system32\SpoonUninstall-dBpoweramp Music Converter.dat
2010-09-11 12:40 . 2010-09-11 12:40 ——– d—–w- c:\program files\Illustrate
2010-09-11 11:23 . 2010-09-11 11:23 ——– d—–w- C:\New Folder (4)
2010-09-11 09:34 . 2010-09-11 09:34 ——– d—–w- c:\program files\Xilisoft
2010-09-11 09:33 . 2010-09-11 09:33 ——– d—–w- C:\ringtone
2010-09-11 09:23 . 2010-09-11 09:23 ——– d—–w- c:\windows\system32\wbem\Repository
2010-09-11 08:34 . 2010-09-11 09:20 ——– d—–w- C:\crack
2010-09-11 07:53 . 2010-09-11 09:20 ——– d—–w- c:\program files\Xilisoft(2)
2010-09-11 07:47 . 2010-09-11 11:35 ——– d—–w- C:\ringtones
2010-09-11 07:30 . 2010-09-11 07:30 ——– d—–w- c:\documents and settings\Paul\.shsh
2010-09-10 19:47 . 2010-09-11 09:21 ——– d—–w- c:\program files\iPod(2)
2010-09-10 19:47 . 2010-09-11 09:21 ——– d—–w- c:\program files\iTunes(2)
2010-09-10 19:30 . 2010-09-10 19:30 ——– d—–w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2010-09-10 18:16 . 2010-09-11 09:22 ——– d—–w- c:\documents and settings\Paul\Application Data\iPhoneRingToneMaker
2010-09-10 14:46 . 2010-09-10 14:46 ——– d—–w- c:\program files\Tipard Studio
2010-09-10 10:34 . 2010-09-10 10:34 ——– d—–w- C:\redsnow
2010-09-09 10:32 . 2010-09-09 10:32 89831 —-a-w- c:\documents and settings\Paul\Application Data\Dropbox\bin\Uninstall.exe
2010-09-09 10:32 . 2010-10-07 13:34 ——– d—–w- c:\documents and settings\Paul\Application Data\Dropbox
2010-09-09 09:58 . 2010-09-09 09:59 ——– d—–w- C:\filexfer
2010-09-09 08:03 . 2008-04-17 04:12 107368 —-a-w- c:\windows\system32\GEARAspi.dll
2010-09-09 08:03 . 2010-09-09 08:03 ——– d—–w- c:\documents and settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-09-09 08:01 . 2010-09-09 08:01 ——– d—–w- c:\program files\Apple Software Update
2010-09-09 07:59 . 2010-04-19 12:47 3062048 —-a-w- c:\windows\system32\usbaaplrc.dll
2010-09-09 07:59 . 2010-04-19 12:47 41984 —-a-w- c:\windows\system32\drivers\usbaapl.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-08 08:53 . 2008-06-01 11:49 ——– d—–w- c:\program files\Mozilla Thunderbird
2010-10-07 13:35 . 2008-06-06 11:11 ——– d—–w- c:\documents and settings\Paul\Application Data\Skype
2010-10-07 08:17 . 2008-06-06 11:14 ——– d—–w- c:\documents and settings\Paul\Application Data\skypePM
2010-10-06 14:18 . 2009-05-14 06:42 ——– d—–w- c:\documents and settings\Paul\Application Data\SpinTop
2010-10-03 14:37 . 2008-08-28 11:34 ——– d—–w- c:\program files\Common Files\Apple
2010-10-03 14:34 . 2008-10-16 13:11 ——– d—–w- c:\program files\QuickTime
2010-10-03 14:31 . 2008-08-28 11:32 ——– d—–w- c:\program files\Safari
2010-09-30 12:19 . 2010-07-02 16:44 ——– d—–w- c:\program files\BattlePing
2010-09-29 11:13 . 2008-06-03 13:32 ——– d—–w- c:\documents and settings\Paul\Application Data\Winamp
2010-09-28 14:16 . 2009-05-16 04:06 ——– d—–w- c:\program files\Burn4Free
2010-09-26 06:10 . 2008-06-02 04:59 ——– d—–w- c:\documents and settings\Paul\Application Data\BitTorrent
2010-09-22 15:31 . 2008-06-01 13:41 ——– d—–w- c:\program files\World of Warcraft
2010-09-21 10:36 . 2008-06-01 13:41 ——– d—–w- c:\program files\Common Files\Blizzard Entertainment
2010-09-17 08:53 . 2010-08-04 08:52 452104 —-a-w- c:\documents and settings\Paul\Application Data\Real\Update\setup3.12\setup.exe
2010-09-13 11:10 . 2010-07-29 03:42 ——– d—–r- c:\program files\Skype
2010-09-12 13:15 . 2010-08-07 13:25 ——– d—–w- c:\program files\Dvd-cloner
2010-09-09 09:53 . 2008-08-23 12:20 ——– d—–w- c:\documents and settings\Paul\Application Data\Apple Computer
2010-09-09 08:00 . 2008-06-10 09:55 ——– d—–w- c:\documents and settings\All Users\Application Data\Apple
2010-09-05 14:05 . 2010-09-05 14:05 ——– d—–w- c:\program files\Belarc
2010-08-21 10:57 . 2010-08-21 10:57 711168 —-a-w- c:\windows\is-N7R98.exe
2010-08-20 07:57 . 2010-08-20 05:46 ——– d—–w- c:\documents and settings\All Users\Application Data\avg9
2010-08-20 05:31 . 2009-02-06 10:21 ——– d—–w- c:\documents and settings\Paul\Application Data\InstallShield
2010-08-20 05:31 . 2009-02-06 10:22 ——– d—–w- c:\program files\Sony Ericsson
2010-08-20 05:31 . 2008-06-01 11:29 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-08-18 14:22 . 2010-08-18 14:22 664 —-a-w- c:\windows\system32\d3d9caps.dat
2010-08-18 09:44 . 2010-08-18 09:44 ——– d—–w- c:\program files\Convert VOB to AVI
2010-08-07 15:46 . 2010-08-07 15:46 503808 —-a-w- c:\documents and settings\Paul\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-6877070c-n\msvcp71.dll
2010-08-07 15:46 . 2010-08-07 15:46 499712 —-a-w- c:\documents and settings\Paul\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-6877070c-n\jmc.dll
2010-08-07 15:46 . 2010-08-07 15:46 348160 —-a-w- c:\documents and settings\Paul\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-6877070c-n\msvcr71.dll
2010-08-07 15:46 . 2010-08-07 15:46 61440 —-a-w- c:\documents and settings\Paul\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-42fe1925-n\decora-sse.dll
2010-08-07 15:46 . 2010-08-07 15:46 12800 —-a-w- c:\documents and settings\Paul\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-42fe1925-n\decora-d3d.dll
2010-08-07 15:39 . 2010-07-26 07:50 27630760 —-a-w- c:\documents and settings\All Users\Application Data\Yahoo!\YUPDATER\msgup1000_1270_us_u1.exe
2010-07-16 21:00 . 2010-08-07 15:46 423656 —-a-w- c:\windows\system32\deployJava1.dll
2008-07-26 14:16 . 2008-08-03 06:56 44814336 —-a-w- c:\program files\Common Files\Photoshop.exe
2008-03-11 08:46 . 2008-06-03 15:27 8784 —-a-w- c:\program files\mozilla firefox\plugins\ractrlkeyhook.dll
2010-01-01 11:14 . 2008-06-01 15:50 88 –sh–r- c:\windows\system32\C351079BE0.sys
2010-01-01 11:14 . 2008-06-01 15:50 5018 –sha-w- c:\windows\system32\KGyGaAvL.sys
.

——- Sigcheck ——-

[-] 2010-03-07 07:23 . A4BCBA984FBCA5604BF484B53C39293E . 212736 . . [——] . . c:\windows\system32\dllcache\ndis.sys
[-] 2010-03-07 07:23 . A4BCBA984FBCA5604BF484B53C39293E . 212736 . . [——] . . c:\windows\system32\drivers\ndis.sys
.
((((((((((((((((((((((((((((( SnapShot@2010-10-07_13.34.17 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-10-08 13:23 . 2010-10-08 13:23 16384 c:\windows\temp\Perflib_Perfdata_704.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2008-07-17 09:20 279944 —-a-w- c:\program files\AskBarDis\bar\bin\askBar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-07-17 279944]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-07-17 279944]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19 94208 —-a-w- c:\documents and settings\Paul\Application Data\Dropbox\bin\DropboxExt.13.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19 94208 —-a-w- c:\documents and settings\Paul\Application Data\Dropbox\bin\DropboxExt.13.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19 94208 —-a-w- c:\documents and settings\Paul\Application Data\Dropbox\bin\DropboxExt.13.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaDetector.exe" [2008-02-26 443968]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-09-19 455968]
"WindowsLivePhone"="c:\program files\Windows Live\Device Manager\msgrdvmn.exe" [2008-12-22 787816]
"c:\program files\NetMeter\NetMeter.exe"="c:\program files\NetMeter\NetMeter.exe" [2009-08-09 293888]
"Skype"="c:\program files\Skype\\Phone\Skype.exe" [2010-05-13 26192168]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-06-28 8466432]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-06-28 81920]
"SkyTel"="SkyTel.EXE" [2006-05-16 2879488]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 32768]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-09-21 47904]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-14 39792]
"BrMfcWnd"="c:\program files\Brother\Brmfcmon\BrMfcWnd.exe" [2006-03-28 622592]
"SetDefPrt"="c:\program files\Brother\Brmfl06a\BrStDvPt.exe" [2005-01-26 49152]
"ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2006-04-10 61440]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-03 110592]
"NeroFilterCheck"="c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2007-03-01 153136]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-07-04 185896]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"Launch LgDevAgt"="c:\program files\Logitech\GamePanel Software\LgDevAgt.exe" [2008-11-06 358920]
"Launch LCDMon"="c:\program files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe" [2008-11-06 1548296]
"Launch LGDCore"="c:\program files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" [2008-11-06 2816520]
"LifeChat"="c:\program files\Microsoft LifeChat\LifeChat.exe" [2008-08-21 267296]
"WindowsLivePhone"="c:\program files\Windows Live\Device Manager\msgrdvmn.exe" [2008-12-22 787816]
"UpdatePDRShortCut"="c:\program files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" [2008-01-04 222504]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-09-08 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-09-23 421160]
"Corel Photo Downloader"="c:\program files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe" [2007-02-06 478800]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]

c:\documents and settings\Paul\Start Menu\Programs\Startup\
Dropbox.lnk - c:\documents and settings\Paul\Application Data\Dropbox\bin\Dropbox.exe [2010-2-26 21979992]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
InterVideo WinCinema Manager.lnk - c:\program files\InterVideo\Common\Bin\WinCinemaMgr.exe [2008-6-1 303104]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableNotifications"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\Orb.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\Sony Ericsson\\Sony Ericsson Media Manager\\MediaManager.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=
"c:\\Program Files\\CyberLink\\PowerDirector\\PDR.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
"AllowOutboundDestinationUnreachable"= 1 (0x1)
"AllowOutboundTimeExceeded"= 1 (0x1)

R3 LGPBTDD;LGPBTDD.sys Display Driver;c:\windows\system32\drivers\LGPBTDD.sys [10/31/2009 15:57 23432]
S2 gupdate1c9b9c8c0035954;Google Update Service (gupdate1c9b9c8c0035954);c:\program files\Google\Update\GoogleUpdate.exe [4/10/2009 18:40 133104]
S2 solewxte;solewxte Service; [x]
S3 Alpham;Ideazon Fang Composite Keyboard Driver;c:\windows\system32\drivers\Alpham.sys [12/4/2005 13:55 34944]
S3 CAM1690;USB PC Camera;c:\windows\system32\drivers\cam1690.sys [11/21/2007 17:37 181888]
S3 PciCon;PciCon;\??\d:\pcicon.sys –> d:\PciCon.sys [?]
S3 s3017bus;Sony Ericsson Device 3017 driver (WDM);c:\windows\system32\drivers\s3017bus.sys [2/6/2009 18:22 83880]
S3 s3017mdfl;Sony Ericsson Device 3017 USB WMC Modem Filter;c:\windows\system32\drivers\s3017mdfl.sys [2/6/2009 18:22 15016]
S3 s3017mdm;Sony Ericsson Device 3017 USB WMC Modem Driver;c:\windows\system32\drivers\s3017mdm.sys [2/6/2009 18:22 110632]
S3 s3017mgmt;Sony Ericsson Device 3017 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s3017mgmt.sys [2/6/2009 18:22 104616]
S3 s3017nd5;Sony Ericsson Device 3017 USB Ethernet Emulation SEMC3017 (NDIS);c:\windows\system32\drivers\s3017nd5.sys [2/6/2009 18:22 25512]
S3 s3017obex;Sony Ericsson Device 3017 USB WMC OBEX Interface;c:\windows\system32\drivers\s3017obex.sys [2/6/2009 18:22 100648]
S3 s3017unic;Sony Ericsson Device 3017 USB Ethernet Emulation SEMC3017 (WDM);c:\windows\system32\drivers\s3017unic.sys [2/6/2009 18:22 110120]
S4 PCPitstop Scheduling;PCPitstop Scheduling;c:\program files\PCPitstop\PCPitstopScheduleService.exe [5/18/2010 21:03 90352]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2007-09-19 13:46 451872 —-a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder

2010-10-07 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 03:50]

2009-11-07 c:\windows\Tasks\LifeChatTask.job
- c:\program files\Microsoft LifeChat\LifeChat.exe [2008-08-21 03:16]

2010-10-08 c:\windows\Tasks\rlcqc21.job
- c:\program files\rlcqc2\rlcqc21.exe [2008-08-05 14:39]
.
.
——- Supplementary Scan ——-
.
uDefault_Search_URL = hxxp://www.google.com/ie
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Winamp Search - c:\documents and settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949}
IE: {{60237576-b24c-4ba9-9740-c9f3ec9db557} - {EAADF17C-B6EA-4511-8549-A67CFD406EAF} - c:\progra~1\SkyCode\WEBTRA~1\wt2ie.dll
DPF: {1B4F9DD7-2D7C-44B5-9126-73206DA0AE75} - hxxp://files.authentium.com/bigpond/bin/wizard.exe
DPF: {A27C56D2-3F58-4ABB-AA31-1168EDA6636F} - hxxp://utilities.pcpitstop.com/Nirvana/controls/pcmatic.cab
FF - ProfilePath - c:\documents and settings\Paul\Application Data\Mozilla\Firefox\Profiles\nrtiiceq.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.fastbrowsersearch.com/results/results.aspx?s=DEF&v=4&q=
FF - prefs.js: browser.search.selectedEngine - Fast Browser Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com.au
FF - prefs.js: keyword.URL - hxxp://www.fastbrowsersearch.com/results/results.aspx?s=NAUS&v=4&tid={54AEF6A5-C70C-1F41-7D34-A99DE46A49AD}&q=
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npdrmv2.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npdsplay.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npnul32.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\nppl3260.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npqtplugin.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npqtplugin2.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npqtplugin3.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npqtplugin4.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npqtplugin5.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npqtplugin6.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npqtplugin7.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\nprfxins.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\nprjplug.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\nprpjplug.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npwmsdrm.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll

—- FIREFOX POLICIES —-
pref(dom.disable_open_during_load, true);.
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'explorer.exe'(1112)
c:\documents and settings\Paul\Application Data\Dropbox\bin\DropboxExt.13.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2010-10-08 22:08:58
ComboFix-quarantined-files.txt 2010-10-08 14:08
ComboFix2.txt 2010-10-08 13:34
ComboFix3.txt 2010-10-07 13:39

Pre-Run: 276,395,675,648 bytes free
Post-Run: 276,369,547,264 bytes free

- - End Of File - - 9CD5B6E2BBFA2F53E4C0B6436CEFDAE3

I did as you requested and DLed a new Combofix and ran it. This is what the result was.

ComboFix 10-10-07.02 - Paul 10/09/2010 1:47.7.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1023.510 [GMT 8:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
.

((((((((((((((((((((((((( Files Created from 2010-09-08 to 2010-10-08 )))))))))))))))))))))))))))))))
.

2010-10-08 08:12 . 2010-10-08 08:13 ——– d—–w- C:\tdss
2010-10-06 13:28 . 2010-10-06 13:28 ——– d—–w- C:\gmer
2010-10-06 04:51 . 2010-10-08 15:38 ——– d—–w- C:\cars
2010-10-05 05:58 . 2010-10-06 05:15 ——– d—–w- c:\program files\Exterminate It!
2010-10-03 14:37 . 2010-10-03 14:37 ——– d—–w- c:\program files\iPod
2010-10-03 14:37 . 2010-10-03 14:37 ——– d—–w- c:\program files\iTunes
2010-10-03 14:33 . 2010-10-03 14:33 73000 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 10.0.1.22\SetupAdmin.exe
2010-10-03 14:30 . 2010-10-03 14:30 72488 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\Safari 5.33.18.5\SetupAdmin.exe
2010-09-28 13:06 . 2010-09-28 13:06 72184 —ha-w- c:\windows\system32\mlfcache.dat
2010-09-22 14:46 . 2010-09-22 14:46 ——– d—–w- c:\documents and settings\All Users\Application Data\VOWSoft
2010-09-22 14:46 . 2010-09-22 14:46 ——– d—–w- c:\program files\ABC 3GP Converter
2010-09-22 14:42 . 2010-09-22 14:56 ——– d—–w- c:\program files\Common Files\Common Share
2010-09-19 10:34 . 2010-10-03 14:27 ——– d—–w- C:\blackberrydeleted
2010-09-18 11:54 . 2010-09-18 11:55 ——– d—–w- c:\documents and settings\Paul\Application Data\BoneTown Demo
2010-09-16 12:17 . 2010-04-29 07:39 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-09-16 12:17 . 2010-09-16 12:29 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-09-16 12:17 . 2010-04-29 07:39 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-09-13 11:39 . 2010-09-19 10:10 ——– d—–w- C:\phone list
2010-09-13 11:22 . 2010-09-13 11:30 ——– d—–w- C:\important pics
2010-09-12 11:03 . 2010-09-12 11:03 ——– d—–w- c:\program files\Windows Sidebar
2010-09-12 11:03 . 2010-09-12 14:03 ——– d—–w- c:\documents and settings\All Users\Application Data\Norton
2010-09-12 11:02 . 2010-09-12 11:03 ——– d—–w- c:\documents and settings\All Users\Application Data\NortonInstaller
2010-09-12 10:57 . 2010-09-12 10:57 ——– d—–w- C:\nav
2010-09-12 06:00 . 2010-09-12 06:00 ——– d—–w- c:\program files\Convert AVI to MP4
2010-09-12 03:17 . 2010-10-07 14:52 ——– d—–w- C:\blackberrytoiphone
2010-09-11 13:02 . 2010-09-11 13:02 3175 —-a-w- c:\windows\system32\SpoonUninstall-dBpoweramp m4a Utilities.dat
2010-09-11 13:02 . 2010-09-11 13:02 3328 —-a-w- c:\windows\system32\SpoonUninstall-dBpoweramp AAC Encoder.dat
2010-09-11 13:01 . 2010-09-11 13:01 1259 —-a-w- c:\windows\system32\SpoonUninstall-dBpoweramp m4b Audio book Encoder.dat
2010-09-11 12:45 . 2010-09-11 12:45 3621 —-a-w- c:\windows\system32\SpoonUninstall-dBpoweramp m4a Nero AAC Encoder.dat
2010-09-11 12:44 . 2010-09-11 12:44 3291 —-a-w- c:\windows\system32\SpoonUninstall-dBpoweramp m4a Codec.dat
2010-09-11 12:41 . 2010-09-11 12:41 ——– d—–w- c:\documents and settings\Paul\Application Data\dBpoweramp
2010-09-11 12:40 . 2010-09-11 12:40 ——– d—–w- c:\documents and settings\Paul\Application Data\AccurateRip
2010-09-11 12:40 . 2010-09-11 13:02 527224 —-a-w- c:\windows\system32\SpoonUninstall.exe
2010-09-11 12:40 . 2010-09-11 12:40 15341 —-a-w- c:\windows\system32\SpoonUninstall-dBpoweramp Music Converter.dat
2010-09-11 12:40 . 2010-09-11 12:40 ——– d—–w- c:\program files\Illustrate
2010-09-11 09:34 . 2010-09-11 09:34 ——– d—–w- c:\program files\Xilisoft
2010-09-11 09:33 . 2010-09-11 09:33 ——– d—–w- C:\ringtone
2010-09-11 09:23 . 2010-09-11 09:23 ——– d—–w- c:\windows\system32\wbem\Repository
2010-09-11 08:34 . 2010-09-11 09:20 ——– d—–w- C:\crack
2010-09-11 07:53 . 2010-09-11 09:20 ——– d—–w- c:\program files\Xilisoft(2)
2010-09-11 07:47 . 2010-09-11 11:35 ——– d—–w- C:\ringtones
2010-09-11 07:30 . 2010-09-11 07:30 ——– d—–w- c:\documents and settings\Paul\.shsh
2010-09-10 19:47 . 2010-09-11 09:21 ——– d—–w- c:\program files\iPod(2)
2010-09-10 19:47 . 2010-09-11 09:21 ——– d—–w- c:\program files\iTunes(2)
2010-09-10 19:30 . 2010-09-10 19:30 ——– d—–w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2010-09-10 18:16 . 2010-09-11 09:22 ——– d—–w- c:\documents and settings\Paul\Application Data\iPhoneRingToneMaker
2010-09-10 14:46 . 2010-09-10 14:46 ——– d—–w- c:\program files\Tipard Studio
2010-09-10 10:34 . 2010-09-10 10:34 ——– d—–w- C:\redsnow
2010-09-09 10:32 . 2010-09-09 10:32 89831 —-a-w- c:\documents and settings\Paul\Application Data\Dropbox\bin\Uninstall.exe
2010-09-09 10:32 . 2010-10-08 17:41 ——– d—–w- c:\documents and settings\Paul\Application Data\Dropbox
2010-09-09 09:58 . 2010-09-09 09:59 ——– d—–w- C:\filexfer
2010-09-09 08:03 . 2008-04-17 04:12 107368 —-a-w- c:\windows\system32\GEARAspi.dll
2010-09-09 08:03 . 2010-09-09 08:03 ——– d—–w- c:\documents and settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-09-09 08:01 . 2010-09-09 08:01 ——– d—–w- c:\program files\Apple Software Update
2010-09-09 07:59 . 2010-04-19 12:47 3062048 —-a-w- c:\windows\system32\usbaaplrc.dll
2010-09-09 07:59 . 2010-04-19 12:47 41984 —-a-w- c:\windows\system32\drivers\usbaapl.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-08 17:41 . 2008-06-06 11:11 ——– d—–w- c:\documents and settings\Paul\Application Data\Skype
2010-10-08 17:41 . 2008-06-06 11:14 ——– d—–w- c:\documents and settings\Paul\Application Data\skypePM
2010-10-08 08:53 . 2008-06-01 11:49 ——– d—–w- c:\program files\Mozilla Thunderbird
2010-10-06 14:18 . 2009-05-14 06:42 ——– d—–w- c:\documents and settings\Paul\Application Data\SpinTop
2010-10-03 14:37 . 2008-08-28 11:34 ——– d—–w- c:\program files\Common Files\Apple
2010-10-03 14:34 . 2008-10-16 13:11 ——– d—–w- c:\program files\QuickTime
2010-10-03 14:31 . 2008-08-28 11:32 ——– d—–w- c:\program files\Safari
2010-09-30 12:19 . 2010-07-02 16:44 ——– d—–w- c:\program files\BattlePing
2010-09-29 11:13 . 2008-06-03 13:32 ——– d—–w- c:\documents and settings\Paul\Application Data\Winamp
2010-09-28 14:16 . 2009-05-16 04:06 ——– d—–w- c:\program files\Burn4Free
2010-09-26 06:10 . 2008-06-02 04:59 ——– d—–w- c:\documents and settings\Paul\Application Data\BitTorrent
2010-09-22 15:31 . 2008-06-01 13:41 ——– d—–w- c:\program files\World of Warcraft
2010-09-21 10:36 . 2008-06-01 13:41 ——– d—–w- c:\program files\Common Files\Blizzard Entertainment
2010-09-17 08:53 . 2010-08-04 08:52 452104 —-a-w- c:\documents and settings\Paul\Application Data\Real\Update\setup3.12\setup.exe
2010-09-13 11:10 . 2010-07-29 03:42 ——– d—–r- c:\program files\Skype
2010-09-12 13:15 . 2010-08-07 13:25 ——– d—–w- c:\program files\Dvd-cloner
2010-09-09 09:53 . 2008-08-23 12:20 ——– d—–w- c:\documents and settings\Paul\Application Data\Apple Computer
2010-09-09 08:00 . 2008-06-10 09:55 ——– d—–w- c:\documents and settings\All Users\Application Data\Apple
2010-09-05 14:05 . 2010-09-05 14:05 ——– d—–w- c:\program files\Belarc
2010-08-21 10:57 . 2010-08-21 10:57 711168 —-a-w- c:\windows\is-N7R98.exe
2010-08-20 07:57 . 2010-08-20 05:46 ——– d—–w- c:\documents and settings\All Users\Application Data\avg9
2010-08-20 05:31 . 2009-02-06 10:21 ——– d—–w- c:\documents and settings\Paul\Application Data\InstallShield
2010-08-20 05:31 . 2009-02-06 10:22 ——– d—–w- c:\program files\Sony Ericsson
2010-08-20 05:31 . 2008-06-01 11:29 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-08-18 14:22 . 2010-08-18 14:22 664 —-a-w- c:\windows\system32\d3d9caps.dat
2010-08-18 09:44 . 2010-08-18 09:44 ——– d—–w- c:\program files\Convert VOB to AVI
2010-08-07 15:46 . 2010-08-07 15:46 503808 —-a-w- c:\documents and settings\Paul\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-6877070c-n\msvcp71.dll
2010-08-07 15:46 . 2010-08-07 15:46 499712 —-a-w- c:\documents and settings\Paul\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-6877070c-n\jmc.dll
2010-08-07 15:46 . 2010-08-07 15:46 348160 —-a-w- c:\documents and settings\Paul\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-6877070c-n\msvcr71.dll
2010-08-07 15:46 . 2010-08-07 15:46 61440 —-a-w- c:\documents and settings\Paul\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-42fe1925-n\decora-sse.dll
2010-08-07 15:46 . 2010-08-07 15:46 12800 —-a-w- c:\documents and settings\Paul\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-42fe1925-n\decora-d3d.dll
2010-08-07 15:39 . 2010-07-26 07:50 27630760 —-a-w- c:\documents and settings\All Users\Application Data\Yahoo!\YUPDATER\msgup1000_1270_us_u1.exe
2010-07-16 21:00 . 2010-08-07 15:46 423656 —-a-w- c:\windows\system32\deployJava1.dll
2008-07-26 14:16 . 2008-08-03 06:56 44814336 —-a-w- c:\program files\Common Files\Photoshop.exe
2008-03-11 08:46 . 2008-06-03 15:27 8784 —-a-w- c:\program files\mozilla firefox\plugins\ractrlkeyhook.dll
2010-01-01 11:14 . 2008-06-01 15:50 88 –sh–r- c:\windows\system32\C351079BE0.sys
2010-01-01 11:14 . 2008-06-01 15:50 5018 –sha-w- c:\windows\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((( SnapShot@2010-10-07_13.34.17 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-10-08 17:41 . 2010-10-08 17:41 16384 c:\windows\temp\Perflib_Perfdata_6ec.dat
+ 2004-08-03 22:14 . 2004-08-03 22:14 182912 c:\windows\system32\drivers\ndis.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2008-07-17 09:20 279944 —-a-w- c:\program files\AskBarDis\bar\bin\askBar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-07-17 279944]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-07-17 279944]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19 94208 —-a-w- c:\documents and settings\Paul\Application Data\Dropbox\bin\DropboxExt.13.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19 94208 —-a-w- c:\documents and settings\Paul\Application Data\Dropbox\bin\DropboxExt.13.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19 94208 —-a-w- c:\documents and settings\Paul\Application Data\Dropbox\bin\DropboxExt.13.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaDetector.exe" [2008-02-26 443968]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-09-19 455968]
"WindowsLivePhone"="c:\program files\Windows Live\Device Manager\msgrdvmn.exe" [2008-12-22 787816]
"c:\program files\NetMeter\NetMeter.exe"="c:\program files\NetMeter\NetMeter.exe" [2009-08-09 293888]
"Skype"="c:\program files\Skype\\Phone\Skype.exe" [2010-05-13 26192168]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-06-28 8466432]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-06-28 81920]
"SkyTel"="SkyTel.EXE" [2006-05-16 2879488]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 32768]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-09-21 47904]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-14 39792]
"BrMfcWnd"="c:\program files\Brother\Brmfcmon\BrMfcWnd.exe" [2006-03-28 622592]
"SetDefPrt"="c:\program files\Brother\Brmfl06a\BrStDvPt.exe" [2005-01-26 49152]
"ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2006-04-10 61440]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-03 110592]
"NeroFilterCheck"="c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2007-03-01 153136]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-07-04 185896]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"Launch LgDevAgt"="c:\program files\Logitech\GamePanel Software\LgDevAgt.exe" [2008-11-06 358920]
"Launch LCDMon"="c:\program files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe" [2008-11-06 1548296]
"Launch LGDCore"="c:\program files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" [2008-11-06 2816520]
"LifeChat"="c:\program files\Microsoft LifeChat\LifeChat.exe" [2008-08-21 267296]
"WindowsLivePhone"="c:\program files\Windows Live\Device Manager\msgrdvmn.exe" [2008-12-22 787816]
"UpdatePDRShortCut"="c:\program files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" [2008-01-04 222504]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-09-08 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-09-23 421160]
"Corel Photo Downloader"="c:\program files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe" [2007-02-06 478800]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]

c:\documents and settings\Paul\Start Menu\Programs\Startup\
Dropbox.lnk - c:\documents and settings\Paul\Application Data\Dropbox\bin\Dropbox.exe [2010-2-26 21979992]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
InterVideo WinCinema Manager.lnk - c:\program files\InterVideo\Common\Bin\WinCinemaMgr.exe [2008-6-1 303104]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableNotifications"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\Orb.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\Sony Ericsson\\Sony Ericsson Media Manager\\MediaManager.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=
"c:\\Program Files\\CyberLink\\PowerDirector\\PDR.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
"AllowOutboundDestinationUnreachable"= 1 (0x1)
"AllowOutboundTimeExceeded"= 1 (0x1)

R3 LGPBTDD;LGPBTDD.sys Display Driver;c:\windows\system32\drivers\LGPBTDD.sys [10/31/2009 15:57 23432]
S2 gupdate1c9b9c8c0035954;Google Update Service (gupdate1c9b9c8c0035954);c:\program files\Google\Update\GoogleUpdate.exe [4/10/2009 18:40 133104]
S2 solewxte;solewxte Service; [x]
S3 Alpham;Ideazon Fang Composite Keyboard Driver;c:\windows\system32\drivers\Alpham.sys [12/4/2005 13:55 34944]
S3 CAM1690;USB PC Camera;c:\windows\system32\drivers\cam1690.sys [11/21/2007 17:37 181888]
S3 PciCon;PciCon;\??\d:\pcicon.sys –> d:\PciCon.sys [?]
S3 s3017bus;Sony Ericsson Device 3017 driver (WDM);c:\windows\system32\drivers\s3017bus.sys [2/6/2009 18:22 83880]
S3 s3017mdfl;Sony Ericsson Device 3017 USB WMC Modem Filter;c:\windows\system32\drivers\s3017mdfl.sys [2/6/2009 18:22 15016]
S3 s3017mdm;Sony Ericsson Device 3017 USB WMC Modem Driver;c:\windows\system32\drivers\s3017mdm.sys [2/6/2009 18:22 110632]
S3 s3017mgmt;Sony Ericsson Device 3017 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s3017mgmt.sys [2/6/2009 18:22 104616]
S3 s3017nd5;Sony Ericsson Device 3017 USB Ethernet Emulation SEMC3017 (NDIS);c:\windows\system32\drivers\s3017nd5.sys [2/6/2009 18:22 25512]
S3 s3017obex;Sony Ericsson Device 3017 USB WMC OBEX Interface;c:\windows\system32\drivers\s3017obex.sys [2/6/2009 18:22 100648]
S3 s3017unic;Sony Ericsson Device 3017 USB Ethernet Emulation SEMC3017 (WDM);c:\windows\system32\drivers\s3017unic.sys [2/6/2009 18:22 110120]
S4 PCPitstop Scheduling;PCPitstop Scheduling;c:\program files\PCPitstop\PCPitstopScheduleService.exe [5/18/2010 21:03 90352]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2007-09-19 13:46 451872 —-a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder

2010-10-07 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 03:50]

2009-11-07 c:\windows\Tasks\LifeChatTask.job
- c:\program files\Microsoft LifeChat\LifeChat.exe [2008-08-21 03:16]

2010-10-08 c:\windows\Tasks\rlcqc21.job
- c:\program files\rlcqc2\rlcqc21.exe [2008-08-05 14:39]
.
.
——- Supplementary Scan ——-
.
uDefault_Search_URL = hxxp://www.google.com/ie
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Winamp Search - c:\documents and settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949}
IE: {{60237576-b24c-4ba9-9740-c9f3ec9db557} - {EAADF17C-B6EA-4511-8549-A67CFD406EAF} - c:\progra~1\SkyCode\WEBTRA~1\wt2ie.dll
DPF: {1B4F9DD7-2D7C-44B5-9126-73206DA0AE75} - hxxp://files.authentium.com/bigpond/bin/wizard.exe
DPF: {A27C56D2-3F58-4ABB-AA31-1168EDA6636F} - hxxp://utilities.pcpitstop.com/Nirvana/controls/pcmatic.cab
FF - ProfilePath - c:\documents and settings\Paul\Application Data\Mozilla\Firefox\Profiles\nrtiiceq.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.fastbrowsersearch.com/results/results.aspx?s=DEF&v=4&q=
FF - prefs.js: browser.search.selectedEngine - Fast Browser Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com.au
FF - prefs.js: keyword.URL - hxxp://www.fastbrowsersearch.com/results/results.aspx?s=NAUS&v=4&tid={54AEF6A5-C70C-1F41-7D34-A99DE46A49AD}&q=
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npdrmv2.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npdsplay.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npnul32.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\nppl3260.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npqtplugin.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npqtplugin2.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npqtplugin3.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npqtplugin4.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npqtplugin5.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npqtplugin6.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npqtplugin7.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\nprfxins.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\nprjplug.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\nprpjplug.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npwmsdrm.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll

—- FIREFOX POLICIES —-
pref(dom.disable_open_during_load, true);.
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'explorer.exe'(492)
c:\documents and settings\Paul\Application Data\Dropbox\bin\DropboxExt.13.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2010-10-09 01:56:44
ComboFix-quarantined-files.txt 2010-10-08 17:56
ComboFix2.txt 2010-10-08 14:40
ComboFix3.txt 2010-10-08 14:08
ComboFix4.txt 2010-10-08 13:34
ComboFix5.txt 2010-10-08 17:46

Pre-Run: 276,373,188,608 bytes free
Post-Run: 276,347,629,568 bytes free

- - End Of File - - 4DC56D7E0092E345C38A746E715EDE84