"spyware protection" amongst others

yesterday whilst playing a game a program called spyware protection flagged it up as a worm of some sort and denied all access to the program. It also denied all access to websites /my antivirus etc - i rebooted, ran malware anti malbyte and deleted several files (didnt have time for a full scan) - today i ran eset online and wiped out several trojans and various other infections, after the reboot im now running M
3/4 of the "infections" is Spyware.PWS 1 of which is in a program in a .dll i installed as part of a game (one of them, other 2 in system restore) 4th is Rogue.securitycentral

eset picked up:
C:\Documents and Settings\Alex K\Application Data\AVG\Rescue\PC Tuneup 2011\101018145620703.rsc multiple threats deleted - quarantined
C:\Documents and Settings\Alex K\Application Data\Sun\Java\Deployment\cache\6.0\26\1bc86b5a-3b70ac65 multiple threats deleted - quarantined
C:\Documents and Settings\Alex K\Local Settings\temp\jar_cache1145802990989616776.tmp a variant of Java/TrojanDownloader.OpenStream.NAX trojan deleted - quarantined
C:\Documents and Settings\Alex K\Local Settings\temp\jar_cache3935210607245425301.tmp a variant of Java/TrojanDownloader.OpenStream.NAX trojan deleted - quarantined
C:\Documents and Settings\All Users\Application Data\ReviverSoft\Registry Reviver\InstallCache\{05B64610-ED45-40AC-89A3-507F6B6A25B9}\Registry Reviver.msi a variant of Win32/SlowPCfighter application deleted - quarantined
C:\Other\MaDmIRC1\download\daemon288.zip probably a variant of Win32/Agent.CCLFVGJ trojan deleted - quarantined


now for the actual current OTL:

OTL logfile created on: 19/01/2011 21:43:08 - Run 1
OTL by OldTimer - Version 3.2.20.2 Folder = C:\Documents and Settings\Alex K\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 79.00% Memory free
5.00 Gb Paging File | 4.00 Gb Available in Paging File | 91.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 465.75 Gb Total Space | 76.92 Gb Free Space | 16.51% Space Free | Partition Type: NTFS

Computer Name: ALEX | User Name: Alex K | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/01/19 21:21:34 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Alex K\Desktop\OTL.exe
PRC - [2010/12/09 19:28:24 | 001,226,608 | —- | M] () – C:\Program Files\DivX\DivX Update\DivXUpdate.exe
PRC - [2010/12/08 21:15:44 | 000,063,360 | —- | M] (DivX, LLC) – C:\Program Files\DivX\DivX Plus Web Player\DDMService.exe
PRC - [2010/12/05 16:26:40 | 000,654,176 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG10\avgrsx.exe
PRC - [2010/12/05 16:26:12 | 000,650,592 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG10\avgchsvx.exe
PRC - [2010/12/01 04:14:46 | 001,084,256 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG10\avgnsx.exe
PRC - [2010/11/23 13:34:16 | 000,724,048 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe
PRC - [2010/11/23 13:34:14 | 006,128,208 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
PRC - [2010/10/22 04:58:18 | 000,265,400 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG10\avgwdsvc.exe
PRC - [2010/10/22 04:57:54 | 002,745,696 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG10\avgtray.exe
PRC - [2010/06/10 20:03:08 | 000,144,176 | —- | M] (Apple Inc.) – C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
PRC - [2010/05/14 10:00:26 | 000,249,136 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
PRC - [2009/07/02 13:20:26 | 000,148,856 | R— | M] (BUFFALO INC.) – C:\Program Files\BUFFALO\SLManagerEasy\Inputps.exe
PRC - [2009/06/16 16:20:26 | 000,095,536 | R— | M] (BUFFALO INC.) – C:\Program Files\BUFFALO\SLManagerEasy\Bufssvr.exe
PRC - [2008/12/17 13:06:06 | 000,079,360 | —- | M] (Autodesk) – C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
PRC - [2008/04/14 12:00:00 | 001,033,728 | —- | M] (Microsoft Corporation) – C:\WINDOWS\explorer.exe
PRC - [2008/03/10 00:04:52 | 000,065,536 | —- | M] () – C:\Program Files\Autodesk\3ds Max 2009\mentalray\satellite\raysat_3dsMax2009_32server.exe
PRC - [2007/09/12 10:52:18 | 000,172,032 | —- | M] () – C:\Program Files\Razer\Lachesis\razerhid.exe
PRC - [2007/06/05 09:37:12 | 000,163,840 | —- | M] (Razer Inc.) – C:\Program Files\Razer\Lachesis\razerofa.exe
PRC - [2006/12/18 13:34:36 | 000,868,352 | R— | M] (Analog Devices, Inc.) – C:\Program Files\Analog Devices\Core\smax4pnp.exe


========== Modules (SafeList) ==========

MOD - [2011/01/19 21:21:34 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Alex K\Desktop\OTL.exe
MOD - [2010/08/23 16:12:02 | 001,054,208 | —- | M] (Microsoft Corporation) – C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV - [2010/11/23 13:34:14 | 006,128,208 | —- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] – C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe – (AVGIDSAgent)
SRV - [2010/10/22 04:58:18 | 000,265,400 | —- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] – C:\Program Files\AVG\AVG10\avgwdsvc.exe – (avgwd)
SRV - [2010/10/06 10:31:48 | 000,517,448 | —- | M] () [On_Demand | Stopped] – C:\Program Files\AVG\AVG10\Toolbar\ToolbarBroker.exe – (AVG Security Toolbar Service)
SRV - [2010/06/10 20:03:08 | 000,144,176 | —- | M] (Apple Inc.) [Auto | Running] – C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe – (Apple Mobile Device)
SRV - [2010/06/10 13:36:33 | 000,654,848 | —- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] – C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe – (FLEXnet Licensing Service)
SRV - [2010/05/14 10:00:26 | 000,249,136 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe – (SeaPort)
SRV - [2009/06/16 16:20:26 | 000,095,536 | R— | M] (BUFFALO INC.) [Auto | Running] – C:\Program Files\BUFFALO\SLManagerEasy\Bufssvr.exe – (Bufssvr)
SRV - [2009/06/03 17:35:00 | 003,112,284 | —- | M] (INCA Internet Co., Ltd.) [On_Demand | Stopped] – C:\WINDOWS\System32\GameMon.des – (npggsvc)
SRV - [2008/12/17 13:06:06 | 000,079,360 | —- | M] (Autodesk) [Auto | Running] – C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe – (Autodesk Licensing Service)
SRV - [2008/03/10 00:04:52 | 000,065,536 | —- | M] () [Auto | Running] – C:\Program Files\Autodesk\3ds Max 2009\mentalray\satellite\raysat_3dsMax2009_32server.exe – (mi-raysat_3dsMax2009_32)


========== Driver Services (SafeList) ==========

DRV - [2010/12/08 04:12:38 | 000,251,728 | —- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\avgldx86.sys – (Avgldx86)
DRV - [2010/11/12 13:19:38 | 000,299,984 | —- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\avgtdix.sys – (Avgtdix)
DRV - [2010/10/16 18:55:00 | 009,623,680 | —- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\nv4_mini.sys – (nv)
DRV - [2010/09/13 15:27:24 | 000,025,680 | —- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\AVGIDSEH.Sys – (AVGIDSEH)
DRV - [2010/09/07 02:48:56 | 000,034,384 | —- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] – C:\WINDOWS\system32\drivers\avgmfx86.sys – (Avgmfx86)
DRV - [2010/09/07 02:48:50 | 000,026,064 | —- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] – C:\WINDOWS\system32\DRIVERS\avgrkx86.sys – (Avgrkx86)
DRV - [2010/08/19 20:42:38 | 000,030,288 | —- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\AVGIDSFilter.sys – (AVGIDSFilter)
DRV - [2010/08/19 20:42:36 | 000,123,472 | —- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\AVGIDSDriver.sys – (AVGIDSDriver)
DRV - [2010/08/19 20:42:34 | 000,026,192 | —- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\AVGIDSShim.sys – (AVGIDSShim)
DRV - [2008/08/18 17:54:00 | 000,145,952 | —- | M] (NVIDIA Corporation) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\nvgts.sys – (nvgts)
DRV - [2008/08/01 10:36:00 | 000,054,784 | —- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\NVENETFD.sys – (NVENETFD)
DRV - [2008/08/01 10:36:00 | 000,022,016 | —- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\nvnetbus.sys – (nvnetbus)
DRV - [2008/07/23 05:10:40 | 000,017,280 | —- | M] (BUFFALO INC.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\bfturboh.sys – (bfturboh)
DRV - [2008/07/14 18:15:30 | 000,716,272 | —- | M] () [Kernel | Boot | Running] – C:\WINDOWS\System32\Drivers\sptd.sys – (sptd)
DRV - [2008/06/19 16:24:30 | 000,028,544 | —- | M] (Panda Security, S.L.) [File_System | Boot | Running] – C:\WINDOWS\system32\drivers\pavboot.sys – (pavboot)
DRV - [2008/04/14 12:00:00 | 000,144,384 | —- | M] (Windows ® Server 2003 DDK provider) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\hdaudbus.sys – (HDAudBus)
DRV - [2008/02/01 06:15:36 | 000,560,896 | R— | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\rt2870.sys – (rt2870)
DRV - [2007/08/08 10:04:16 | 000,012,032 | —- | M] (Razer (Asia-Pacific) Pte Ltd) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\Lachesis.sys – (LachesisFltr)
DRV - [2007/06/15 07:52:18 | 000,143,256 | R— | M] (Marvell Semiconductor, Inc.) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\mv61xx.sys – (mv61xx)
DRV - [2007/04/23 12:54:50 | 000,100,488 | —- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\s115mgmt.sys – (s115mgmt) Sony Ericsson Device 115 USB WMC Device Management Drivers (WDM)
DRV - [2007/04/23 12:54:50 | 000,098,568 | —- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\s115obex.sys – (s115obex)
DRV - [2007/04/23 12:54:48 | 000,108,680 | —- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\s115mdm.sys – (s115mdm)
DRV - [2007/04/23 12:54:48 | 000,015,112 | —- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\s115mdfl.sys – (s115mdfl)
DRV - [2007/04/23 12:54:46 | 000,083,208 | —- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\s115bus.sys – (s115bus) Sony Ericsson Device 115 driver (WDM)
DRV - [2007/01/16 01:09:06 | 000,293,888 | R— | M] (Analog Devices, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\ADIHdAud.sys – (ADIHdAudAddService)
DRV - [2006/12/08 09:06:00 | 000,139,776 | R— | M] (Analog Devices, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\adidts.sys – (ADIDTSFiltService)
DRV - [2004/08/13 02:56:20 | 000,005,810 | R— | M] () [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\ASACPI.sys – (MTsensor)
DRV - [2004/07/05 21:38:06 | 000,233,472 | —- | M] (ZyDAS Technology Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\ZD1211U.sys – (ZD1211U(Sitecom)) Sitecom Wireless Network USB Adapter 54G WL-117(Sitecom)
DRV - [2004/01/14 09:30:00 | 000,017,151 | —- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\ZDPNDIS5.SYS – (ZDPNDIS5)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG10\Firefox\ [2010/12/28 12:07:59 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\avg@igeared: C:\Program Files\AVG\AVG10\Toolbar\Firefox\avg@igeared [2010/10/25 15:47:16 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video [2011/01/04 07:27:53 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa [2011/01/04 07:27:53 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/07/07 20:17:09 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/09/14 10:16:03 | 000,000,000 | —D | M]

[2009/04/24 21:41:51 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Alex K\Application Data\Mozilla\Extensions
[2010/11/27 00:07:17 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Alex K\Application Data\Mozilla\Firefox\Profiles\zfw2nx4v.default\extensions
[2009/08/13 09:06:41 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Alex K\Application Data\Mozilla\Firefox\Profiles\zfw2nx4v.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/04/30 09:11:37 | 000,000,000 | —D | M] (Google Toolbar for Firefox) – C:\Documents and Settings\Alex K\Application Data\Mozilla\Firefox\Profiles\zfw2nx4v.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2008/07/09 19:01:33 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Documents and Settings\Alex K\Application Data\Mozilla\Firefox\Profiles\zfw2nx4v.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2009/06/20 14:03:06 | 000,000,000 | —D | M] (ChromEdit Plus) – C:\Documents and Settings\Alex K\Application Data\Mozilla\Firefox\Profiles\zfw2nx4v.default\extensions\[removed]
[2011/01/04 07:26:03 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2008/07/07 01:02:02 | 000,000,000 | —D | M] (Google Toolbar for Firefox) – C:\Program Files\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2011/01/08 20:10:47 | 000,000,000 | —D | M] (Skype extension) – C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2010/09/14 10:16:04 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2011/01/04 07:26:03 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
[2010/11/12 18:53:06 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2010/03/22 23:31:50 | 000,001,538 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\amazon-en-GB.xml
[2010/03/22 23:31:50 | 000,000,947 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\chambers-en-GB.xml
[2010/03/22 23:31:50 | 000,000,769 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\eBay-en-GB.xml
[2010/03/22 23:31:50 | 000,001,135 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2009/07/24 15:37:40 | 000,916,030 | R— | M]) - C:\WINDOWS\system32\drivers\etc\HOSTS
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 ad.a8.net
O1 - Hosts: 127.0.0.1 asy.a8ww.net
O1 - Hosts: 127.0.0.1 a9rhiwa.cn #[Google.Warning]
O1 - Hosts: 127.0.0.1 www.a9rhiwa.cn
O1 - Hosts: 127.0.0.1 acezip.net #[SiteAdvisor.acezip.net]
O1 - Hosts: 127.0.0.1 www.acezip.net #[Win32/Adware.180Solutions]
O1 - Hosts: 127.0.0.1 phpadsnew.abac.com
O1 - Hosts: 127.0.0.1 a.abnad.net
O1 - Hosts: 127.0.0.1 b.abnad.net
O1 - Hosts: 127.0.0.1 c.abnad.net #[eTrust.Tracking.Cookie]
O1 - Hosts: 127.0.0.1 d.abnad.net
O1 - Hosts: 127.0.0.1 e.abnad.net
O1 - Hosts: 127.0.0.1 t.abnad.net
O1 - Hosts: 127.0.0.1 z.abnad.net
O1 - Hosts: 127.0.0.1 banners.absolpublisher.com
O1 - Hosts: 127.0.0.1 tracking.absolstats.com
O1 - Hosts: 127.0.0.1 adv.abv.bg
O1 - Hosts: 127.0.0.1 bimg.abv.bg
O1 - Hosts: 127.0.0.1 www2.a-counter.kiev.ua
O1 - Hosts: 127.0.0.1 track.acclaimnetwork.com
O1 - Hosts: 127.0.0.1 accuserveadsystem.com
O1 - Hosts: 127.0.0.1 www.accuserveadsystem.com
O1 - Hosts: 127.0.0.1 gtb5.acecounter.com
O1 - Hosts: 127.0.0.1 gtcc1.acecounter.com
O1 - Hosts: 26566 more lines…
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (DivX Plus Web Player HTML5 ) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
O2 - BHO: (AVG Security Toolbar BHO) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Windows Live Toolbar Helper) - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [DivX Download Manager] C:\Program Files\DivX\DivX Plus Web Player\DDmService.exe (DivX, LLC)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [KernelFaultCheck] File not found
O4 - HKLM..\Run: [Lachesis] C:\Program Files\Razer\Lachesis\razerhid.exe ()
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe ()
O4 - HKLM..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe (Analog Devices, Inc.)
O4 - HKCU..\Run: [igndlm.exe] C:\Program Files\Download Manager\DLM.exe (IGN Entertainment)
O4 - HKCU..\RunOnce: [Shockwave Updater] File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 227
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLegacyLogonScripts = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLogoffScripts = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunLogonScriptSync = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunStartupScriptSync = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideStartupScripts = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLegacyLogonScripts = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLogoffScripts = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunLogonScriptSync = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunStartupScriptSync = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideStartupScripts = 0
O9 - Extra Button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {001EE746-A1F9-460E-80AD-269E088D6A01} http://site.ebrary.com/lib/portsmouth/supp…s/ebraryRdr.cab (Reg Error: Key error.)
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebook.com/controls/2008.1…toUploader5.cab (Reg Error: Key error.)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} http://www.nvidia.com/content/DriverDownlo…sreqlab_nvd.cab (System Requirements Lab Class)
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab (Reg Error: Key error.)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\yinsthelper.dll (YInstStarter Class)
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.10.115.cab (CDownloadCtrl Object)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://www.update.microsoft.com/windowsupd…b?1223602043015 (WUWebControl Class)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.0…oUploader55.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_23)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O18 - Protocol\Handler\avgsecuritytoolbar {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Alex K\Application Data\Microsoft\Windows Live Photo Gallery\Windows Live Photo Gallery Wallpaper.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Alex K\Application Data\Microsoft\Windows Live Photo Gallery\Windows Live Photo Gallery Wallpaper.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/06/28 03:56:58 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O33 - MountPoints2\{4513e8ac-46a1-11dd-a40b-001fc6010ba1}\Shell - "" = AutoRun
O33 - MountPoints2\{4513e8ac-46a1-11dd-a40b-001fc6010ba1}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{4513e8ac-46a1-11dd-a40b-001fc6010ba1}\Shell\AutoRun\command - "" = E:\Setup.exe
O33 - MountPoints2\{8d7ef5ba-60e2-11df-ad2f-001fc6010ba1}\Shell\AutoRun\command - "" = E:\WDSetup.exe
O33 - MountPoints2\{9edae297-35dd-11df-acdb-001fc6010ba1}\Shell - "" = AutoRun
O33 - MountPoints2\{9edae297-35dd-11df-acdb-001fc6010ba1}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{9edae297-35dd-11df-acdb-001fc6010ba1}\Shell\AutoRun\command - "" = E:\Windows\CHECK\DriveNavigator.exe
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgchsvx.exe /sync) - C:\Program Files\AVG\AVG10\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgrsx.exe /sync /restart) - C:\Program Files\AVG\AVG10\avgrsx.exe (AVG Technologies CZ, s.r.o.)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/01/19 21:21:34 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Alex K\Desktop\OTL.exe
[2011/01/19 21:02:44 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Alex K\Recent
[2011/01/19 20:38:32 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\CCleaner
[2011/01/18 18:43:36 | 000,647,680 | —- | C] (Sunisoft) – C:\Documents and Settings\Alex K\Desktop\Lineage2Dex.EXE
[2011/01/16 10:52:46 | 000,000,000 | —D | C] – C:\Documents and Settings\Alex K\Desktop\L2Freya
[2011/01/12 19:11:57 | 014,532,608 | —- | C] (NVIDIA Corporation) – C:\WINDOWS\System32\nvoglnt.dll
[2011/01/12 19:11:57 | 000,813,672 | —- | C] (NVIDIA Corporation) – C:\WINDOWS\System32\nvgenco32.dll
[2011/01/12 19:11:57 | 000,061,440 | —- | C] (Khronos Group) – C:\WINDOWS\System32\OpenCL.dll
[2011/01/12 19:11:56 | 004,882,432 | —- | C] (NVIDIA Corporation) – C:\WINDOWS\System32\nvcuda.dll
[2011/01/12 19:11:56 | 002,932,840 | —- | C] (NVIDIA Corporation) – C:\WINDOWS\System32\nvcuvid.dll
[2011/01/12 19:11:56 | 002,666,600 | —- | C] (NVIDIA Corporation) – C:\WINDOWS\System32\nvcuvenc.dll
[2011/01/12 19:11:56 | 000,888,424 | —- | C] (NVIDIA Corporation) – C:\WINDOWS\System32\nvdispco32.dll
[2011/01/12 19:11:54 | 013,012,992 | —- | C] (NVIDIA Corporation) – C:\WINDOWS\System32\nvcompiler.dll
[2011/01/12 19:11:54 | 001,462,272 | —- | C] (NVIDIA Corporation) – C:\WINDOWS\System32\nvapi.dll
[2011/01/12 19:07:47 | 084,317,576 | —- | C] (NVIDIA Corporation) – C:\Documents and Settings\Alex K\Desktop\260.99_desktop_winxp_32bit_english_whql.exe
[2011/01/09 22:26:27 | 000,000,000 | —D | C] – C:\Documents and Settings\Alex K\Desktop\tps char
[2011/01/09 22:10:20 | 000,000,000 | —D | C] – C:\Documents and Settings\Alex K\Desktop\music
[2011/01/08 20:10:08 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Skype
[2011/01/08 20:10:08 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Skype
[2011/01/08 13:41:00 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2011/01/04 07:27:57 | 000,000,000 | —D | C] – C:\Documents and Settings\Alex K\Application Data\Local
[2011/01/04 07:26:00 | 000,157,472 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaws.exe
[2011/01/04 07:26:00 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaw.exe
[2011/01/04 07:26:00 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\java.exe
[2010/12/26 00:36:40 | 000,000,000 | —D | C] – C:\Documents and Settings\Alex K\Local Settings\Application Data\Hpcrtlog
[4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/01/19 21:41:48 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/01/19 21:21:34 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Alex K\Desktop\OTL.exe
[2011/01/19 20:38:32 | 000,000,682 | —- | M] () – C:\Documents and Settings\All Users\Desktop\CCleaner.lnk
[2011/01/19 18:33:26 | 000,064,512 | —- | M] () – C:\Documents and Settings\Alex K\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/01/19 18:29:23 | 104,559,851 | —- | M] () – C:\WINDOWS\System32\drivers\AVG\incavi.avm
[2011/01/18 21:56:30 | 000,000,754 | —- | M] () – C:\Documents and Settings\Alex K\Desktop\Shortcut to l2.exe.lnk
[2011/01/18 18:43:12 | 000,647,931 | —- | M] () – C:\Documents and Settings\Alex K\Desktop\Lineage2Dex-Freya.rar
[2011/01/18 18:35:42 | 000,001,678 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Lineage II.lnk
[2011/01/16 18:06:38 | 000,062,920 | —- | M] () – C:\Documents and Settings\Alex K\Desktop\may2.jpg
[2011/01/16 18:04:03 | 000,048,562 | —- | M] () – C:\Documents and Settings\Alex K\Desktop\may.jpg
[2011/01/16 10:18:19 | 000,013,696 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/01/16 00:10:09 | 000,045,568 | —- | M] () – C:\Documents and Settings\Alex K\Desktop\zakenjan1.xls
[2011/01/15 15:59:05 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/01/12 22:23:52 | 000,020,108 | —- | M] () – C:\Documents and Settings\Alex K\Desktop\zakenjan.xlsx
[2011/01/12 22:07:50 | 000,066,162 | —- | M] () – C:\Documents and Settings\Alex K\Desktop\cal5.jpg
[2011/01/12 22:06:27 | 000,067,125 | —- | M] () – C:\Documents and Settings\Alex K\Desktop\equest.jpg
[2011/01/12 19:12:14 | 000,240,592 | —- | M] () – C:\WINDOWS\System32\nvdrsdb0.bin
[2011/01/12 19:12:14 | 000,000,001 | —- | M] () – C:\WINDOWS\System32\nvdrssel.bin
[2011/01/12 19:12:09 | 000,240,592 | —- | M] () – C:\WINDOWS\System32\nvdrsdb1.bin
[2011/01/12 19:12:09 | 000,000,000 | —- | M] () – C:\WINDOWS\System32\nvdrswr.lk
[2011/01/12 19:07:54 | 084,317,576 | —- | M] (NVIDIA Corporation) – C:\Documents and Settings\Alex K\Desktop\260.99_desktop_winxp_32bit_english_whql.exe
[2011/01/12 18:28:58 | 000,050,688 | —- | M] () – C:\Documents and Settings\Alex K\Desktop\zakende.xls
[2011/01/12 18:27:26 | 000,046,080 | —- | M] () – C:\Documents and Settings\Alex K\Desktop\zakenjan.xls
[2011/01/09 22:31:38 | 000,001,572 | —- | M] () – C:\Documents and Settings\Alex K\Desktop\Disk Defragmenter.lnk
[2011/01/09 21:14:00 | 001,555,800 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2011/01/09 17:55:07 | 000,071,459 | —- | M] () – C:\WINDOWS\System32\drivers\AVG\iavichjg.avm
[2011/01/08 20:10:09 | 000,001,878 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Skype.lnk
[2011/01/08 10:16:41 | 000,000,802 | —- | M] () – C:\Documents and Settings\Alex K\Application Data\Microsoft\Internet Explorer\Quick Launch\Malwarebytes' Anti-Malware.lnk
[2011/01/04 07:27:38 | 000,000,777 | —- | M] () – C:\Documents and Settings\All Users\Desktop\DivX Plus Player.lnk
[2010/12/28 12:08:13 | 000,000,690 | —- | M] () – C:\Documents and Settings\All Users\Desktop\AVG 2011.lnk
[4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/01/19 20:38:32 | 000,000,682 | —- | C] () – C:\Documents and Settings\All Users\Desktop\CCleaner.lnk
[2011/01/18 18:43:36 | 000,016,512 | —- | C] () – C:\Documents and Settings\Alex K\Desktop\Lineage2Dex.URS
[2011/01/18 18:43:11 | 000,647,931 | —- | C] () – C:\Documents and Settings\Alex K\Desktop\Lineage2Dex-Freya.rar
[2011/01/18 18:35:42 | 000,001,678 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Lineage II.lnk
[2011/01/16 18:16:03 | 000,062,920 | —- | C] () – C:\Documents and Settings\Alex K\Desktop\may2.jpg
[2011/01/16 18:15:53 | 000,048,562 | —- | C] () – C:\Documents and Settings\Alex K\Desktop\may.jpg
[2011/01/13 19:40:17 | 000,045,568 | —- | C] () – C:\Documents and Settings\Alex K\Desktop\zakenjan1.xls
[2011/01/12 22:08:02 | 000,066,162 | —- | C] () – C:\Documents and Settings\Alex K\Desktop\cal5.jpg
[2011/01/12 22:06:45 | 000,067,125 | —- | C] () – C:\Documents and Settings\Alex K\Desktop\equest.jpg
[2011/01/12 19:12:14 | 000,240,592 | —- | C] () – C:\WINDOWS\System32\nvdrsdb0.bin
[2011/01/12 19:12:09 | 000,240,592 | —- | C] () – C:\WINDOWS\System32\nvdrsdb1.bin
[2011/01/12 19:12:09 | 000,000,001 | —- | C] () – C:\WINDOWS\System32\nvdrssel.bin
[2011/01/12 19:12:09 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\nvdrswr.lk
[2011/01/12 19:11:56 | 002,293,194 | —- | C] () – C:\WINDOWS\System32\nvdata.bin
[2011/01/12 18:26:55 | 000,020,108 | —- | C] () – C:\Documents and Settings\Alex K\Desktop\zakenjan.xlsx
[2011/01/12 18:19:02 | 000,046,080 | —- | C] () – C:\Documents and Settings\Alex K\Desktop\zakenjan.xls
[2011/01/12 17:57:59 | 000,050,688 | —- | C] () – C:\Documents and Settings\Alex K\Desktop\zakende.xls
[2011/01/09 22:31:38 | 000,001,572 | —- | C] () – C:\Documents and Settings\Alex K\Desktop\Disk Defragmenter.lnk
[2011/01/04 07:27:38 | 000,000,777 | —- | C] () – C:\Documents and Settings\All Users\Desktop\DivX Plus Player.lnk
[2010/10/29 13:12:05 | 000,000,262 | —- | C] () – C:\WINDOWS\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
[2010/04/17 11:09:29 | 000,000,036 | —- | C] () – C:\Documents and Settings\Alex K\Local Settings\Application Data\housecall.guid.cache
[2010/04/03 12:48:42 | 000,000,034 | —- | C] () – C:\WINDOWS\ebraryRdr.ini
[2010/03/29 22:54:43 | 000,009,201 | R— | C] () – C:\WINDOWS\UN090430.INI
[2010/03/29 22:52:33 | 000,009,500 | R— | C] () – C:\WINDOWS\UN070618.INI
[2009/11/06 10:58:04 | 000,178,975 | —- | C] () – C:\WINDOWS\System32\xlive.dll.cat
[2009/07/04 14:15:04 | 000,000,027 | —- | C] () – C:\WINDOWS\BRPP2KA.INI
[2009/07/04 14:15:03 | 000,000,419 | —- | C] () – C:\WINDOWS\BRWMARK.INI
[2009/07/04 14:14:54 | 000,000,000 | —- | C] () – C:\Program Files\error.dat
[2009/07/04 14:14:54 | 000,000,000 | —- | C] () – C:\WINDOWS\brmx2001.ini
[2009/07/04 14:14:20 | 000,000,074 | —- | C] () – C:\WINDOWS\Brownie.ini
[2009/04/27 23:29:59 | 000,354,816 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2008/07/14 18:15:30 | 000,716,272 | —- | C] () – C:\WINDOWS\System32\drivers\sptd.sys
[2008/07/07 03:12:30 | 000,000,553 | —- | C] () – C:\WINDOWS\wininit.ini
[2008/07/01 19:01:34 | 000,028,672 | —- | C] () – C:\WINDOWS\System32\InsDrvZD.dll
[2008/06/29 22:36:53 | 000,064,512 | —- | C] () – C:\Documents and Settings\Alex K\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/06/28 04:47:45 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2008/06/28 04:03:51 | 000,028,216 | —- | C] () – C:\WINDOWS\Ascd_log.ini
[2008/06/28 04:03:29 | 000,005,810 | R— | C] () – C:\WINDOWS\System32\drivers\ASACPI.sys
[2008/06/28 04:03:27 | 000,027,962 | —- | C] () – C:\WINDOWS\Ascd_tmp.ini
[2008/06/28 04:03:20 | 000,012,536 | —- | C] () – C:\WINDOWS\System32\drivers\ASUSHWIO.SYS

========== Alternate Data Streams ==========

@Alternate Data Stream - 151 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:0B4227B4
@Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34
@Alternate Data Stream - 119 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A9662AE0

< End of report >


thanks for any assistance ><

Hey, sorry for slow reply was away for a few days. I couldnt seemn to run the GMER.exe as when i ran it with other apps it crashed and used all PC resources (or looked like) and then whilst running it alone this morning for 15-20mins it did the same thing :/. DDS (Ver_10-12-12.02) - NTFSx86 Run by [removed] at 17:54:55.17 on 23/01/2011 Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_23 Microsoft Windows XP Home Edition 5.1.2600.3.1252.44.1033.18.3070.2281 [GMT 0:00] AV: AVG Anti-Virus Free Edition 2011 *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF} ============== Running Processes =============== C:\PROGRA~1\AVG\AVG10\avgchsvx.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Razer\Lachesis\razerhid.exe C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Program Files\AVG\AVG10\avgtray.exe C:\Program Files\DivX\DivX Update\DivXUpdate.exe C:\Program Files\DivX\DivX Plus Web Player\DDmService.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe svchost.exe C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe C:\Program Files\AVG\AVG10\avgwdsvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\BUFFALO\SLManagerEasy\Bufssvr.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\BUFFALO\SLManagerEasy\Inputps.exe C:\Program Files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe C:\Program Files\Autodesk\3ds Max 2009\mentalray\satellite\raysat_3dsMax2009_32server.exe C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe C:\Program Files\Razer\Lachesis\razerofa.exe C:\Program Files\AVG\AVG10\avgnsx.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Microsoft\Search Enhancement Pack\SCServer\SCServer.exe C:\Program Files\Internet Explorer\iexplore.exe C:\PROGRA~1\AVG\AVG10\avgrsx.exe C:\Program Files\AVG\AVG10\avgcsrvx.exe C:\Documents and Settings\Alex K\Desktop\dds.com ============== Pseudo HJT Report =============== uStart Page = hxxp://www.google.co.uk/ uSearch Bar = uInternet Settings,ProxyOverride = *.local uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll mURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg10\toolbar\IEToolbar.dll BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll BHO: DivX Plus Web Player HTML5 : {326e768d-4182-46fd-9c16-1449a49795f4} - c:\program files\divx\divx plus web player\npdivx32.dll BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg10\avgssie.dll BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll BHO: DivX HiQ: {593ddec6-7468-4cdd-90e1-42dadaa222e9} - c:\program files\divx\divx plus web player\npdivx32.dll BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg10\toolbar\IEToolbar.dll BHO: Skype Plug-In: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn0\YTSingleInstance.dll TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg10\toolbar\IEToolbar.dll TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background uRun: [igndlm.exe] c:\program files\download manager\DLM.exe /windowsstart /startifwork uRunOnce: [Shockwave Updater] c:\windows\system32\adobe\shockwave 11\SwHelper_1150595.exe -Update -1150595 -"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.648; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2)" -"http://www.xperteleven.com/gameviewer.aspx?Cup=1&gameid=1103048&games=1101620,1101406,1101408,1101410,1101412,1101414&sound=1&vip=1&dh=1" mRun: [Lachesis] c:\program files\razer\lachesis\razerhid.exe mRun: [SoundMAXPnP] c:\program files\analog devices\core\smax4pnp.exe mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe" mRun: [AVG_TRAY] c:\program files\avg\avg10\avgtray.exe mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k mRun: [DivXUpdate] "c:\program files\divx\divx update\DivXUpdate.exe" /CHECKNOW mRun: [DivX Download Manager] "c:\program files\divx\divx plus web player\DDmService.exe" start mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [nwiz] c:\program files\nvidia corporation\nview\nwiz.exe /installquiet IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000 IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll DPF: {001EE746-A1F9-460E-80AD-269E088D6A01} - hxxp://site.ebrary.com/lib/portsmouth/support/plugins/ebraryRdr.cab DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} - hxxp://acs.pandasoftware.com/activescan/cabs/as2stubie.cab DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\yinsthelper.dll DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - hxxp://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.10.115.cab DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1223602043015 DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - c:\program files\avg\avg10\toolbar\IEToolbar.dll Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg10\avgpp.dll Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll Hosts: 127.0.0.1 www.spywareinfo.com ================= FIREFOX =================== FF - ProfilePath - ============= SERVICES / DRIVERS =============== R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [2010-9-13 25680] R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [2010-9-7 26064] R0 mv61xx;mv61xx;c:\windows\system32\drivers\mv61xx.sys [2008-6-29 143256] R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2009-8-31 28544] R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2010-9-7 251728] R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2010-9-7 34384] R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2010-9-7 299984] R2 AVGIDSAgent;AVGIDSAgent;c:\program files\avg\avg10\identity protection\agent\bin\AVGIDSAgent.exe [2010-11-23 6128208] R2 avgwd;AVG WatchDog;c:\program files\avg\avg10\avgwdsvc.exe [2010-10-22 265400] R2 Bufssvr;Bufssvr;c:\program files\buffalo\slmanagereasy\Bufssvr.exe [2009-6-16 95536] R2 mi-raysat_3dsMax2009_32;mental ray 3.6 Satellite for Autodesk 3ds Max 2009 32-bit 32-bit;c:\program files\autodesk\3ds max 2009\mentalray\satellite\raysat_3dsMax2009_32server.exe [2008-3-10 65536] R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [2010-8-19 123472] R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [2010-8-19 30288] R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [2010-8-19 26192] S3 Asushwio;Asushwio;\??\d:\bin\asushwio.sys –> d:\bin\Asushwio.sys [?] S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\avg\avg10\toolbar\ToolbarBroker.exe [2010-10-6 517448] S3 bfturboh;BUFFALO TurboUSB for HD Filter;c:\windows\system32\drivers\bfturboh.sys [2010-3-29 17280] S3 LachesisFltr;Lachesis Mouse Driver;c:\windows\system32\drivers\Lachesis.sys [2008-6-28 12032] S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\gamemon.des -service –> c:\windows\system32\GameMon.des -service [?] S3 rt2870;Ralink 802.11n USB Wireless LAN Card Driver;c:\windows\system32\drivers\rt2870.sys [2009-9-5 560896] S3 s115bus;Sony Ericsson Device 115 driver (WDM);c:\windows\system32\drivers\s115bus.sys [2007-4-23 83208] S3 s115mdfl;Sony Ericsson Device 115 USB WMC Modem Filter;c:\windows\system32\drivers\s115mdfl.sys [2007-4-23 15112] S3 s115mdm;Sony Ericsson Device 115 USB WMC Modem Driver;c:\windows\system32\drivers\s115mdm.sys [2007-4-23 108680] S3 s115mgmt;Sony Ericsson Device 115 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s115mgmt.sys [2007-4-23 100488] S3 s115obex;Sony Ericsson Device 115 USB WMC OBEX Interface;c:\windows\system32\drivers\s115obex.sys [2007-4-23 98568] S3 ZD1211U(Sitecom);Sitecom Wireless Network USB Adapter 54G WL-117(Sitecom);c:\windows\system32\drivers\ZD1211U.sys [2008-7-1 233472] =============== Created Last 30 ================ 2011-01-20 19:30:20 ——– d—–w- c:\program files\Ventrilo 2011-01-20 19:30:06 ——– d—–w- c:\program files\common files\Wise Installation Wizard 2011-01-12 19:12:14 240592 —-a-w- c:\windows\system32\nvdrsdb0.bin 2011-01-12 19:12:09 240592 —-a-w- c:\windows\system32\nvdrsdb1.bin 2011-01-12 19:12:09 1 —-a-w- c:\windows\system32\nvdrssel.bin 2011-01-12 19:11:57 813672 —-a-w- c:\windows\system32\nvgenco32.dll 2011-01-12 19:11:57 61440 —-a-w- c:\windows\system32\OpenCL.dll 2011-01-12 19:11:57 14532608 —-a-w- c:\windows\system32\nvoglnt.dll 2011-01-12 19:11:56 888424 —-a-w- c:\windows\system32\nvdispco32.dll 2011-01-12 19:11:56 4882432 —-a-w- c:\windows\system32\nvcuda.dll 2011-01-12 19:11:56 2932840 —-a-w- c:\windows\system32\nvcuvid.dll 2011-01-12 19:11:56 2666600 —-a-w- c:\windows\system32\nvcuvenc.dll 2011-01-12 19:11:56 2293194 —-a-w- c:\windows\system32\nvdata.bin 2011-01-12 19:11:54 1462272 —-a-w- c:\windows\system32\nvapi.dll 2011-01-12 19:11:54 13012992 —-a-w- c:\windows\system32\nvcompiler.dll 2011-01-08 13:41:00 ——– d—–w- c:\program files\ESET 2011-01-04 07:27:57 ——– d—–w- c:\docume~1\alexk~1\applic~1\Local 2010-12-26 00:36:40 ——– d—–w- c:\docume~1\alexk~1\locals~1\applic~1\Hpcrtlog ==================== Find3M ==================== 2010-11-18 18:12:44 81920 —-a-w- c:\windows\system32\isign32.dll 2010-11-12 18:53:06 472808 —-a-w- c:\windows\system32\deployJava1.dll 2010-11-12 16:34:10 73728 —-a-w- c:\windows\system32\javacpl.cpl 2010-11-12 00:44:54 94208 —-a-w- c:\windows\system32\dpl100.dll 2010-11-09 14:52:35 249856 —-a-w- c:\windows\system32\odbc32.dll 2010-11-08 22:57:04 353592 —-a-w- c:\windows\system32\DivXControlPanelApplet.cpl 2010-11-06 00:26:58 916480 —-a-w- c:\windows\system32\wininet.dll 2010-11-06 00:26:58 43520 —-a-w- c:\windows\system32\licmgr10.dll 2010-11-06 00:26:58 1469440 —-a-w- c:\windows\system32\inetcpl.cpl 2010-11-03 12:25:54 385024 —-a-w- c:\windows\system32\html.iec 2010-10-28 13:13:22 290048 —-a-w- c:\windows\system32\atmfd.dll 2010-10-26 13:25:00 1853312 —-a-w- c:\windows\system32\win32k.sys ============= FINISH: 17:55:14.75 ===============

ComboFix 11-01-28.01 - Alex K 28/01/2011 22:58:31.5.4 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.44.1033.18.3070.2455 [GMT 0:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Alex K\Application Data\Local
c:\windows\Help\nvcpar.hlp-nv16576
c:\windows\Help\nvcpcs.hlp-nv16576
c:\windows\Help\nvcpda.hlp-nv16576
c:\windows\Help\nvcpde.hlp-nv16576
c:\windows\Help\nvcpel.hlp-nv16576
c:\windows\Help\nvcpeng.hlp-nv16576
c:\windows\Help\nvcpes.hlp-nv16576
c:\windows\Help\nvcpesm.hlp-nv16579
c:\windows\Help\nvcpfi.hlp-nv16579
c:\windows\Help\nvcpfr.hlp-nv16579
c:\windows\Help\nvcphe.hlp-nv16579
c:\windows\Help\nvcphu.hlp-nv16579
c:\windows\Help\nvcpit.hlp-nv16579
c:\windows\Help\nvcpja.hlp-nv16579
c:\windows\Help\nvcpko.hlp-nv16579
c:\windows\Help\nvcpl.hlp-nv16579
c:\windows\Help\nvcpnl.hlp-nv16583
c:\windows\Help\nvcpno.hlp-nv16583
c:\windows\Help\nvcppl.hlp-nv16583
c:\windows\Help\nvcppt.hlp-nv16583
c:\windows\Help\nvcpptb.hlp-nv16583
c:\windows\Help\nvcpru.hlp-nv16583
c:\windows\Help\nvcpsk.hlp-nv16583
c:\windows\Help\nvcpsl.hlp-nv16583
c:\windows\Help\nvcpsv.hlp-nv16586
c:\windows\Help\nvcpth.hlp-nv16586
c:\windows\Help\nvcptr.hlp-nv16586
c:\windows\Help\nvcpzhc.hlp-nv16586
c:\windows\Help\nvcpzht.hlp-nv16586
c:\windows\system32\twunk_32.exe

.
((((((((((((((((((((((((( Files Created from 2010-12-28 to 2011-01-28 )))))))))))))))))))))))))))))))
.

2011-01-20 19:30 . 2011-01-20 19:30 ——– d—–w- c:\program files\Ventrilo
2011-01-20 19:30 . 2011-01-20 19:30 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard
2011-01-12 19:12 . 2011-01-12 19:12 240592 —-a-w- c:\windows\system32\nvdrsdb0.bin
2011-01-12 19:12 . 2011-01-12 19:12 1 —-a-w- c:\windows\system32\nvdrssel.bin
2011-01-12 19:12 . 2011-01-12 19:12 240592 —-a-w- c:\windows\system32\nvdrsdb1.bin
2011-01-12 19:11 . 2010-10-16 18:55 813672 —-a-w- c:\windows\system32\nvgenco32.dll
2011-01-12 19:11 . 2010-10-16 18:55 61440 —-a-w- c:\windows\system32\OpenCL.dll
2011-01-12 19:11 . 2010-10-16 18:55 14532608 —-a-w- c:\windows\system32\nvoglnt.dll
2011-01-12 19:11 . 2010-10-16 18:55 888424 —-a-w- c:\windows\system32\nvdispco32.dll
2011-01-12 19:11 . 2010-10-16 18:55 4882432 —-a-w- c:\windows\system32\nvcuda.dll
2011-01-12 19:11 . 2010-10-16 18:55 2932840 —-a-w- c:\windows\system32\nvcuvid.dll
2011-01-12 19:11 . 2010-10-16 18:55 2666600 —-a-w- c:\windows\system32\nvcuvenc.dll
2011-01-12 19:11 . 2010-10-16 18:55 2293194 —-a-w- c:\windows\system32\nvdata.bin
2011-01-12 19:11 . 2010-10-16 18:55 1462272 —-a-w- c:\windows\system32\nvapi.dll
2011-01-12 19:11 . 2010-10-16 18:55 13012992 —-a-w- c:\windows\system32\nvcompiler.dll
2011-01-08 20:10 . 2011-01-08 20:10 ——– d—–w- c:\program files\Common Files\Skype
2011-01-08 13:41 . 2011-01-08 13:41 ——– d—–w- c:\program files\ESET

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-12-20 18:09 . 2008-07-22 00:59 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-12-20 18:08 . 2008-07-09 14:20 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-11-18 18:12 . 2008-06-28 03:54 81920 —-a-w- c:\windows\system32\isign32.dll
2010-11-12 18:53 . 2010-09-14 10:16 472808 —-a-w- c:\windows\system32\deployJava1.dll
2010-11-12 16:34 . 2009-09-07 02:53 73728 —-a-w- c:\windows\system32\javacpl.cpl
2010-11-12 00:44 . 2010-11-12 00:44 94208 —-a-w- c:\windows\system32\dpl100.dll
2010-11-09 14:52 . 2008-04-14 12:00 249856 —-a-w- c:\windows\system32\odbc32.dll
2010-11-08 22:57 . 2010-11-08 22:57 353592 —-a-w- c:\windows\system32\DivXControlPanelApplet.cpl
2010-11-06 00:26 . 2008-04-14 12:00 916480 —-a-w- c:\windows\system32\wininet.dll
2010-11-06 00:26 . 2008-04-14 12:00 43520 —-a-w- c:\windows\system32\licmgr10.dll
2010-11-06 00:26 . 2008-04-14 12:00 1469440 —-a-w- c:\windows\system32\inetcpl.cpl
2010-11-03 12:25 . 2008-04-14 12:00 385024 —-a-w- c:\windows\system32\html.iec
2010-11-02 15:17 . 2008-04-14 12:00 40960 —-a-w- c:\windows\system32\drivers\ndproxy.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2010-04-16 3872080]
"igndlm.exe"="c:\program files\Download Manager\DLM.exe" [2009-10-27 1103216]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Lachesis"="c:\program files\Razer\Lachesis\razerhid.exe" [2007-09-12 172032]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2006-12-18 868352]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-03-18 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-06-15 141624]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-12-09 1226608]
"DivX Download Manager"="c:\program files\DivX\DivX Plus Web Player\DDmService.exe" [2010-12-08 63360]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-10-16 110696]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-10-16 13851752]
"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2010-08-26 1753192]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2010-11-30 997408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"AvgUninstallURL"="start http:" [X]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^Alex K^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
path=c:\documents and settings\Alex K\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EA Core]
2009-09-03 21:17 3342336 —-a-w- c:\program files\Electronic Arts\EADM\Core.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2008-10-25 10:44 31072 —-a-w- c:\program files\Microsoft Office\Office12\GrooveMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-06-15 15:33 141624 —-a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2010-10-16 12:04 13851752 —-a-w- c:\windows\system32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2010-10-16 12:04 110696 —-a-w- c:\windows\system32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2010-08-26 00:12 1753192 —-a-w- c:\program files\NVIDIA Corporation\nView\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-03-18 21:16 421888 —-a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2010-06-13 02:28 1238352 —-a-w- c:\games\steam\steam.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"SpybotSD TeaTimer"=c:\program files\Spybot - Search & Destroy\TeaTimer.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\THQ\\Company of Heroes\\BugReport\\BugReport.exe"=
"c:\\Games\\Supreme Commander\\Supreme Commander\\bin\\SupremeCommander.exe"=
"c:\\Games\\Supreme Commander\\GPGNet\\GPG.Multiplayer.Client.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Other\\MaDmIRC1\\MaDmIRC.exe"=
"c:\\Program Files\\Electronic Arts\\EADM\\Core.exe"=
"c:\\Program Files\\Autodesk\\Backburner\\monitor.exe"=
"c:\\Program Files\\Autodesk\\Backburner\\manager.exe"=
"c:\\Program Files\\Autodesk\\Backburner\\server.exe"=
"c:\\Program Files\\Autodesk\\3ds Max 2009\\3dsmax.exe"=
"c:\\Other\\uTorrent\\uTorrent.exe"=
"c:\\Other\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Games\\Warhammer Mark of Chaos\\Warhammer.exe"=
"c:\\Program Files\\Dragon Age Origins Character Creator\\bin_ship\\DAOCharacterCreator.exe"=
"c:\\Program Files\\Dragon Age Origins Character Creator\\DAOriginsLauncher.exe"=
"c:\\Program Files\\Electronic Arts\\Command & Conquer 4 Tiberian Twilight\\Data\\CNC4.game"=
"c:\\Games\\steam\\SteamApps\\common\\supreme commander 2\\bin\\SupremeCommander2.exe"=
"c:\\Games\\steam\\SteamApps\\common\\dawn of war 2\\DOW2.exe"=
"c:\\Other\\Spotify\\spotify.exe"=
"c:\\Games\\steam\\steam.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Games\\steam\\SteamApps\\hamster53\\counter-strike\\hl.exe"=
"c:\\Games\\StarCraft II\\StarCraft II.exe"=
"c:\\Games\\StarCraft II\\Versions\\Base16605\\SC2.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Games\\StarCraft II\\Versions\\Base16755\\SC2.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=

R0 mv61xx;mv61xx;c:\windows\system32\drivers\mv61xx.sys [29/06/2008 00:25 143256]
R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [31/08/2009 13:08 28544]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [14/07/2008 18:15 716272]
R1 MpKsl75b34a87;MpKsl75b34a87;c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{91D0FF31-0D54-4D38-814F-206F4FF089FB}\MpKsl75b34a87.sys [28/01/2011 22:52 28752]
R2 Bufssvr;Bufssvr;c:\program files\BUFFALO\SLManagerEasy\Bufssvr.exe [16/06/2009 16:20 95536]
S2 mi-raysat_3dsMax2009_32;mental ray 3.6 Satellite for Autodesk 3ds Max 2009 32-bit 32-bit;c:\program files\Autodesk\3ds Max 2009\mentalray\satellite\raysat_3dsMax2009_32server.exe [10/03/2008 00:04 65536]
S3 Asushwio;Asushwio;\??\d:\bin\Asushwio.sys –> d:\bin\Asushwio.sys [?]
S3 bfturboh;BUFFALO TurboUSB for HD Filter;c:\windows\system32\drivers\bfturboh.sys [29/03/2010 22:52 17280]
S3 LachesisFltr;Lachesis Mouse Driver;c:\windows\system32\drivers\Lachesis.sys [28/06/2008 18:53 12032]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service –> c:\windows\system32\GameMon.des -service [?]
S3 s115bus;Sony Ericsson Device 115 driver (WDM);c:\windows\system32\drivers\s115bus.sys [23/04/2007 12:54 83208]
S3 s115mdfl;Sony Ericsson Device 115 USB WMC Modem Filter;c:\windows\system32\drivers\s115mdfl.sys [23/04/2007 12:54 15112]
S3 s115mdm;Sony Ericsson Device 115 USB WMC Modem Driver;c:\windows\system32\drivers\s115mdm.sys [23/04/2007 12:54 108680]
S3 s115mgmt;Sony Ericsson Device 115 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s115mgmt.sys [23/04/2007 12:54 100488]
S3 s115obex;Sony Ericsson Device 115 USB WMC OBEX Interface;c:\windows\system32\drivers\s115obex.sys [23/04/2007 12:54 98568]
S3 ZD1211U(Sitecom);Sitecom Wireless Network USB Adapter 54G WL-117(Sitecom);c:\windows\system32\drivers\ZD1211U.sys [01/07/2008 19:01 233472]

— Other Services/Drivers In Memory —

*NewlyCreated* - MPFILTER
*NewlyCreated* - MPKSL75B34A87
*NewlyCreated* - MSMPSVC
.
Contents of the 'Scheduled Tasks' folder

2011-01-15 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2011-01-28 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Microsoft Security Client\Antimalware\MpCmdRun.exe [2010-11-11 12:26]

2011-01-28 c:\windows\Tasks\MpIdleTask.job
- c:\program files\Microsoft Security Client\Antimalware\MpCmdRun.exe [2010-11-11 12:26]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.co.uk/
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath -
.
- - - - ORPHANS REMOVED - - - -

Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
MSConfigStartUp-SunJavaUpdateSched - c:\program files\Java\jre6\bin\jusched.exe
AddRemove-NVIDIA Drivers - c:\windows\system32\nvuninst.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-01-28 23:01
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-1229272821-1659004503-682003330-1004\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_USERS\S-1-5-21-1229272821-1659004503-682003330-1004\Software\SecuROM\License information*]
"datasecu"=hex:a0,14,b2,2c,12,26,ec,17,62,cf,4a,8a,fc,84,3a,4e,f3,85,b7,35,5c,
a9,b0,76,9c,68,81,09,8f,61,a0,31,d2,50,5c,89,b6,c5,ac,a6,62,d4,23,e8,e3,ab,\
"rkeysecu"=hex:ce,ea,0e,6b,64,fc,9d,aa,24,82,f3,31,36,9a,05,31

[HKEY_LOCAL_MACHINE\software\swearware\backup\winsock2]
@DACL=(02 0000)
@SACL=
.
Completion time: 2011-01-28 23:03:16
ComboFix-quarantined-files.txt 2011-01-28 23:03

Pre-Run: 82,117,521,408 bytes free
Post-Run: 82,510,336,000 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

- - End Of File - - 8B1E3DE4C180415E67F24E529370FB9C


Just finished the scan, no real time to judge a noticable difference yet / nothing different

DDS (Ver_10-10-31.01) - NTFSx86
Run by [removed] at 16:37:00.14 on 29/01/2011
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_23
Microsoft Windows XP Home Edition 5.1.2600.3.1252.44.1033.18.3070.2452 [GMT 0:00]

AV: Microsoft Security Essentials *On-access scanning enabled* (Updated) {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}

============== Running Processes ===============

C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\BUFFALO\SLManagerEasy\Bufssvr.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Autodesk\3ds Max 2009\mentalray\satellite\raysat_3dsMax2009_32server.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files\BUFFALO\SLManagerEasy\Inputps.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Razer\Lachesis\razerhid.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\DivX\DivX Update\DivXUpdate.exe
C:\Program Files\DivX\DivX Plus Web Player\DDmService.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\Program Files\Razer\Lachesis\razerofa.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Documents and Settings\Alex K\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.co.uk/
uInternet Settings,ProxyOverride = *.local
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: DivX Plus Web Player HTML5 : {326e768d-4182-46fd-9c16-1449a49795f4} - c:\program files\divx\divx plus web player\npdivx32.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: DivX HiQ: {593ddec6-7468-4cdd-90e1-42dadaa222e9} - c:\program files\divx\divx plus web player\npdivx32.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Skype Plug-In: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn0\YTSingleInstance.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll
TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll
uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
uRun: [igndlm.exe] c:\program files\download manager\DLM.exe /windowsstart /startifwork
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [Lachesis] c:\program files\razer\lachesis\razerhid.exe
mRun: [SoundMAXPnP] c:\program files\analog devices\core\smax4pnp.exe
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [DivXUpdate] "c:\program files\divx\divx update\DivXUpdate.exe" /CHECKNOW
mRun: [DivX Download Manager] "c:\program files\divx\divx plus web player\DDmService.exe" start
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] c:\program files\nvidia corporation\nview\nwiz.exe /installquiet
mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRunOnce: [AvgUninstallURL] cmd.exe /c start http://www.avg.com/ww.special-uninstallati…t;ver=10.0.1204
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {001EE746-A1F9-460E-80AD-269E088D6A01} - hxxp://site.ebrary.com/lib/portsmouth/support/plugins/ebraryRdr.cab
DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} - hxxp://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\yinsthelper.dll
DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - hxxp://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.10.115.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1223602043015
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll

================= FIREFOX ===================

FF - ProfilePath -
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}

—- FIREFOX POLICIES —-
c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);

============= SERVICES / DRIVERS ===============

R0 mv61xx;mv61xx;c:\windows\system32\drivers\mv61xx.sys [2008-6-29 143256]
R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2009-8-31 28544]
R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2010-10-24 165264]
R1 MpKsl60dcf1d6;MpKsl60dcf1d6;c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{34702784-0eb5-4503-a7d1-b2ce2d572520}\MpKsl60dcf1d6.sys [2011-1-29 28752]
R2 Bufssvr;Bufssvr;c:\program files\buffalo\slmanagereasy\Bufssvr.exe [2009-6-16 95536]
R2 mi-raysat_3dsMax2009_32;mental ray 3.6 Satellite for Autodesk 3ds Max 2009 32-bit 32-bit;c:\program files\autodesk\3ds max 2009\mentalray\satellite\raysat_3dsMax2009_32server.exe [2008-3-10 65536]
S3 Asushwio;Asushwio;\??\d:\bin\asushwio.sys –> d:\bin\Asushwio.sys [?]
S3 bfturboh;BUFFALO TurboUSB for HD Filter;c:\windows\system32\drivers\bfturboh.sys [2010-3-29 17280]
S3 LachesisFltr;Lachesis Mouse Driver;c:\windows\system32\drivers\Lachesis.sys [2008-6-28 12032]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\gamemon.des -service –> c:\windows\system32\GameMon.des -service [?]
S3 rt2870;Ralink 802.11n USB Wireless LAN Card Driver;c:\windows\system32\drivers\rt2870.sys [2009-9-5 560896]
S3 s115bus;Sony Ericsson Device 115 driver (WDM);c:\windows\system32\drivers\s115bus.sys [2007-4-23 83208]
S3 s115mdfl;Sony Ericsson Device 115 USB WMC Modem Filter;c:\windows\system32\drivers\s115mdfl.sys [2007-4-23 15112]
S3 s115mdm;Sony Ericsson Device 115 USB WMC Modem Driver;c:\windows\system32\drivers\s115mdm.sys [2007-4-23 108680]
S3 s115mgmt;Sony Ericsson Device 115 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s115mgmt.sys [2007-4-23 100488]
S3 s115obex;Sony Ericsson Device 115 USB WMC OBEX Interface;c:\windows\system32\drivers\s115obex.sys [2007-4-23 98568]
S3 ZD1211U(Sitecom);Sitecom Wireless Network USB Adapter 54G WL-117(Sitecom);c:\windows\system32\drivers\ZD1211U.sys [2008-7-1 233472]

=============== Created Last 30 ================

2011-01-29 16:34:58 28752 —-a-w- c:\docume~1\alluse~1\applic~1\microsoft\microsoft antimalware\definition updates\{34702784-0eb5-4503-a7d1-b2ce2d572520}\MpKsl60dcf1d6.sys
2011-01-29 13:43:52 5890896 —-a-w- c:\docume~1\alluse~1\applic~1\microsoft\microsoft antimalware\definition updates\backup\mpengine.dll
2011-01-29 13:43:40 5890896 —-a-w- c:\docume~1\alluse~1\applic~1\microsoft\microsoft antimalware\definition updates\{34702784-0eb5-4503-a7d1-b2ce2d572520}\mpengine.dll
2011-01-28 22:57:28 ——– d-sha-r- C:\cmdcons
2011-01-28 22:55:32 98816 —-a-w- c:\windows\sed.exe
2011-01-28 22:55:32 89088 —-a-w- c:\windows\MBR.exe
2011-01-28 22:55:32 256512 —-a-w- c:\windows\PEV.exe
2011-01-28 22:55:32 161792 —-a-w- c:\windows\SWREG.exe
2011-01-28 22:36:15 222080 ——w- c:\windows\system32\MpSigStub.exe
2011-01-28 22:30:31 ——– d—–w- c:\program files\Microsoft Security Client
2011-01-20 19:30:20 ——– d—–w- c:\program files\Ventrilo
2011-01-20 19:30:06 ——– d—–w- c:\program files\common files\Wise Installation Wizard
2011-01-12 19:12:14 240592 —-a-w- c:\windows\system32\nvdrsdb0.bin
2011-01-12 19:12:09 240592 —-a-w- c:\windows\system32\nvdrsdb1.bin
2011-01-12 19:12:09 1 —-a-w- c:\windows\system32\nvdrssel.bin
2011-01-12 19:11:57 813672 —-a-w- c:\windows\system32\nvgenco32.dll
2011-01-12 19:11:57 61440 —-a-w- c:\windows\system32\OpenCL.dll
2011-01-12 19:11:57 14532608 —-a-w- c:\windows\system32\nvoglnt.dll
2011-01-12 19:11:56 888424 —-a-w- c:\windows\system32\nvdispco32.dll
2011-01-12 19:11:56 4882432 —-a-w- c:\windows\system32\nvcuda.dll
2011-01-12 19:11:56 2932840 —-a-w- c:\windows\system32\nvcuvid.dll
2011-01-12 19:11:56 2666600 —-a-w- c:\windows\system32\nvcuvenc.dll
2011-01-12 19:11:56 2293194 —-a-w- c:\windows\system32\nvdata.bin
2011-01-12 19:11:54 1462272 —-a-w- c:\windows\system32\nvapi.dll
2011-01-12 19:11:54 13012992 —-a-w- c:\windows\system32\nvcompiler.dll
2011-01-08 13:41:00 ——– d—–w- c:\program files\ESET

==================== Find3M ====================

2010-11-18 18:12:44 81920 —-a-w- c:\windows\system32\isign32.dll
2010-11-12 18:53:06 472808 —-a-w- c:\windows\system32\deployJava1.dll
2010-11-12 16:34:10 73728 —-a-w- c:\windows\system32\javacpl.cpl
2010-11-12 00:44:54 94208 —-a-w- c:\windows\system32\dpl100.dll
2010-11-09 14:52:35 249856 —-a-w- c:\windows\system32\odbc32.dll
2010-11-08 22:57:04 353592 —-a-w- c:\windows\system32\DivXControlPanelApplet.cpl
2010-11-06 00:26:58 916480 —-a-w- c:\windows\system32\wininet.dll
2010-11-06 00:26:58 43520 —-a-w- c:\windows\system32\licmgr10.dll
2010-11-06 00:26:58 1469440 —-a-w- c:\windows\system32\inetcpl.cpl
2010-11-03 12:25:54 385024 —-a-w- c:\windows\system32\html.iec

============= FINISH: 16:37:42.73 ===============

havent noticed any change in the PC whatsoever since the original program trying to run, but i dunno what to look for either :x