[Closed] IEXPLORE.exe trogan , windows wont reboot, popups

Hi there, Having a major problem with a trogan malware, avast managed to locate it when it opened but was unable to stop it, system was fine for a few hours but then the popups began! It has installed a yellow flashing exclamation mark similar to windows security update in the bottom right of the screen and has put IEXPLORE.exe in the task manger, i use firefox as the browser. I tried a windows restore but did not work, the malware even starts in safe mode, windows freezes on start up just after the black windows startup screen but wont go to the blue login screen. I did an adaware search, it found culprits tried to delete them but replicates itself on startup. I tried to reinstall windows but that didnt work either. I currently have adwatch running in the backgroung but that does nothing, ive installed spydoctor but that does not fix it. The system is really slow. I get constant Alerts for malware threats, ie win32@mx, psw.x-vir, I get a system error messages on startup ie "null" folder, i think this is avast chest folder as well as a few others. Ive managed to come online via the safe boot networking. I have tried everything i can think of to no avail. the most common pop up link is ww.savetheinformation.com, im at my teather and need your admorable urgent help as i have a vast amount of recorded music files i have to edit for schedualed cd release at the end of this month, I hope you can help! I have read your welcome message and downloaded hijack this and here is the log file, Many thanx, Mark Logfile of HijackThis v1.99.1 Scan saved at 8:36:38 p.m., on 11/11/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\taskmgr.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Lavasoft\Ad-Aware 2007\Ad-Watch2007.exe C:\Program Files\Alwil Software\Avast4\ashEnhcd.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll O3 - Toolbar: Security Toolbar - {11A69AE4-FBED-4832-A2BF-45AF82825583} - C:\WINDOWS\system32\uhtlbgit.dll O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" O4 - HKLM\..\Run: [Red Swoosh] C:\Program Files\RSSoft\RedSwoosh.exe /S O4 - HKLM\..\Run: [EPSON Stylus Photo R350 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAJP.EXE /P30 "EPSON Stylus Photo R350 Series" /O6 "USB001" /M "Stylus Photo R350" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime Alternative\qttask.exe" -atboottime O4 - HKLM\..\Run: [mouseElf] C:\PROGRA~1\GENIUS~1\mouseElf.exe O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\LogMeInSystray.exe" O4 - HKLM\..\Run: [MAFWTaskbarApp] C:\WINDOWS\system32\MAFWTray.exe O4 - HKLM\..\Run: [RegistrySmart] "C:\Program Files\RegistrySmart\RegistrySmart.exe" -boot O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [runner1] C:\WINDOWS\mrofinu1188.exe 61A847B5BBF72813339330466188719AB689201522886B092CBD44BD8689220221DD3257 O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\RunOnce: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /RM /FS /X O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\BitTorrent_DNA\dna.exe" O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Startup: BOINC Manager.lnk = C:\Program Files\BOINC\boincmgr.exe O4 - Startup: OpenOffice.org 2.1.lnk = C:\Program Files\OpenOffice.org 2.1\program\quickstart.exe O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ? O4 - Global Startup: Adobe Acrobat Synchronizer.lnk = C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe O4 - Global Startup: Image Transfer.lnk = ? O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll O11 - Options group: [INTERNATIONAL] International* O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe

Hi, I am sorry, i didnt realise you guys were so efficiant on this forum, i did try to remove it since i posted the first message, so have created another hijakthis log file. i wont. do anything this time round as you guys are quick off the mark, but did notice something when using a-squared malware program that was quite interesting, when it got the the WINDOWS FONTS it was taking forever to get through. At closer inspection the fonts file was over 2.5 gigs i do have quite a few for my graphics design work but not to that avail and also noticed when scanning that it showed a constant stream of exe and zip files related to films, programs and software, but is hidden in the folder so i can see them, i fear my system has been hijacked as a server of somesorts. i hope this sheds a little light!?, anyway here goes round two. again no alterations will be made from now on unless to your instruction. also removed trojan win32.agent.erf in windows\b122.exe Many thanks. Mark Logfile of HijackThis v1.99.1 Scan saved at 3:10:40 a.m., on 12/11/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\a-squared Anti-Malware\a2guard.exe C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe C:\Program Files\a-squared Anti-Malware\a2start.exe C:\Program Files\Hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll O3 - Toolbar: Security Toolbar - {11A69AE4-FBED-4832-A2BF-45AF82825583} - C:\WINDOWS\system32\uhtlbgit.dll O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [Red Swoosh] C:\Program Files\RSSoft\RedSwoosh.exe /S O4 - HKLM\..\Run: [EPSON Stylus Photo R350 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAJP.EXE /P30 "EPSON Stylus Photo R350 Series" /O6 "USB001" /M "Stylus Photo R350" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime Alternative\qttask.exe" -atboottime O4 - HKLM\..\Run: [mouseElf] C:\PROGRA~1\GENIUS~1\mouseElf.exe O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\LogMeInSystray.exe" O4 - HKLM\..\Run: [MAFWTaskbarApp] C:\WINDOWS\system32\MAFWTray.exe O4 - HKLM\..\Run: [RegistrySmart] "C:\Program Files\RegistrySmart\RegistrySmart.exe" -boot O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [2c760616] rundll32.exe "C:\WINDOWS\system32\mrdkbhmt.dll",b O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [a-squared] "C:\Program Files\a-squared Anti-Malware\a2guard.exe" O4 - HKLM\..\Run: [runner1] C:\WINDOWS\mrofinu1188.exe 61A847B5BBF72813339330466188719AB689201522886B092CBD44BD8689220221DD3257 O4 - HKLM\..\RunOnce: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /RM /FS /X O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\BitTorrent_DNA\dna.exe" O4 - HKCU\..\Run: [DDC] C:\WINDOWS\system32\sgxsrhyn.exe O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Startup: OpenOffice.org 2.1.lnk = C:\Program Files\OpenOffice.org 2.1\program\quickstart.exe O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ? O4 - Global Startup: Adobe Acrobat Synchronizer.lnk = C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe O4 - Global Startup: Image Transfer.lnk = ? O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll O11 - Options group: [INTERNATIONAL] International* O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Emsi Software GmbH - C:\Program Files\a-squared Anti-Malware\a2service.exe O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\sgxsrhyn.exe (file missing) O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe

Hi again, i did the test run, seemed to go ok but when rebooted it did not load so had to boot in safe mode with networking, the test also deleted my mozilla fire fox amplet fromthe start menu other words when clicking on it it couldnt find it, so managed to load it another way,,the test also made ie explorer my default, which i do not use, managed to revert back to firefox as ie doesnt work anyway, the yellow icon seems to have gone in the lower right toolbar but i still get the malware popups in safe boot. Here are the 2 logs you requested.

Logfile of HijackThis v1.99.1
Scan saved at 8:54:16 a.m., on 12/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Security Toolbar - {11A69AE4-FBED-4832-A2BF-45AF82825583} - C:\WINDOWS\system32\uhtlbgit.dll
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [Red Swoosh] C:\Program Files\RSSoft\RedSwoosh.exe /S
O4 - HKLM\..\Run: [EPSON Stylus Photo R350 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAJP.EXE /P30 "EPSON Stylus Photo R350 Series" /O6 "USB001" /M "Stylus Photo R350"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime Alternative\qttask.exe" -atboottime
O4 - HKLM\..\Run: [mouseElf] C:\PROGRA~1\GENIUS~1\mouseElf.exe
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\LogMeInSystray.exe"
O4 - HKLM\..\Run: [MAFWTaskbarApp] C:\WINDOWS\system32\MAFWTray.exe
O4 - HKLM\..\Run: [RegistrySmart] "C:\Program Files\RegistrySmart\RegistrySmart.exe" -boot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [2c760616] rundll32.exe "C:\WINDOWS\system32\mrdkbhmt.dll",b
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [a-squared] "C:\Program Files\a-squared Anti-Malware\a2guard.exe"
O4 - HKLM\..\RunOnce: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /RM /FS /X
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\BitTorrent_DNA\dna.exe"
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: OpenOffice.org 2.1.lnk = C:\Program Files\OpenOffice.org 2.1\program\quickstart.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Adobe Acrobat Synchronizer.lnk = C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Image Transfer.lnk = ?
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Emsi Software GmbH - C:\Program Files\a-squared Anti-Malware\a2service.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe


ComboFix 07-11-08.1 - PC USER 2007-11-12 8:21:51.1 - NTFSx86 NETWORK
Running from: C:\Documents and Settings\[removed]\Desktop\Downloads\ComboFix.exe
.

Unable to gain System Privileges

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Administrator.MARK-C9D0B9D2AC.001\Desktop\Live Safety Center.lnk
C:\Documents and Settings\Administrator.MARK-C9D0B9D2AC.001\Desktop\Online Security Guide.lnk
C:\Documents and Settings\Administrator.MARK-C9D0B9D2AC.001\Favorites\Online Security Guide.lnk
C:\Documents and Settings\All Users\Start Menu\Live Safety Center.lnk
C:\Documents and Settings\All Users\Start Menu\Online Security Guide.lnk
C:\Documents and Settings\PC USER\Application Data\macromedia\Flash Player\#SharedObjects\R4EQZH7Y\iforex.com
C:\Documents and Settings\PC USER\Application Data\macromedia\Flash Player\#SharedObjects\R4EQZH7Y\iforex.com\Emerp\Events\flash_object.swf\user_data.sol
C:\Documents and Settings\PC USER\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com
C:\Documents and Settings\PC USER\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com\settings.sol
C:\Documents and Settings\PC USER\Desktop\Live Safety Center.lnk
C:\Documents and Settings\PC USER\Desktop\Online Security Guide.lnk
C:\Documents and Settings\PC USER\Favorites\Online Security Guide.lnk
C:\Program Files\Temporary
C:\Program Files\Temporary\wininstall.exe
C:\WINDOWS\system32\dcbeg.bak2
C:\WINDOWS\system32\dcbeg.ini
C:\WINDOWS\system32\gebcd.dll
C:\WINDOWS\system32\uhtlbgit.dllbox

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
——-\LEGACY_DOMAINSERVICE
——-\DomainService


((((((((((((((((((((((((( Files Created from 2007-10-11 to 2007-11-11 )))))))))))))))))))))))))))))))
.

2007-11-12 08:18 51,200 –a—— C:\WINDOWS\NirCmd.exe
2007-11-12 02:55 d——– C:\WINDOWS\Fonts2
2007-11-12 01:06 d——– C:\Program Files\a-squared Anti-Malware
2007-11-11 23:18 d——– C:\Documents and Settings\All Users\Application Data\Prevx
2007-11-11 22:44 664 –a—— C:\WINDOWS\system32\d3d9caps.dat
2007-11-11 21:19 d——– C:\Program Files\WhatsRunning
2007-11-11 21:10 88,128 –a—— C:\WINDOWS\system32\mrdkbhmt.dll
2007-11-11 21:07 79,936 –a—— C:\WINDOWS\system32\xnuknkkv.dll
2007-11-11 17:55 552 –a—— C:\WINDOWS\system32\d3d8caps.dat
2007-11-11 17:23 d——– C:\WINDOWS\LastGood
2007-11-11 17:13 20,992 –a—— C:\WINDOWS\system32\drivers\RTL8139.sys
2007-11-11 17:07 24,661 –a—— C:\WINDOWS\system32\spxcoins.dll
2007-11-11 17:07 24,661 –a–c— C:\WINDOWS\system32\dllcache\spxcoins.dll
2007-11-11 17:07 13,312 –a—— C:\WINDOWS\system32\irclass.dll
2007-11-11 17:07 13,312 –a–c— C:\WINDOWS\system32\dllcache\irclass.dll
2007-11-11 16:12 331,776 –a—— C:\WINDOWS\system32\wpdmtpdr.dll
2007-11-11 16:12 331,264 –a—— C:\WINDOWS\system32\wpdsp.dll
2007-11-11 16:12 114,176 –a—— C:\WINDOWS\system32\wpdmtp.dll
2007-11-11 16:12 66,560 –a—— C:\WINDOWS\system32\wpdmtpus.dll
2007-11-11 16:12 18,944 –a—— C:\WINDOWS\system32\drivers\wpdusb.sys
2007-11-11 16:12 10,752 –a—— C:\WINDOWS\system32\wpdtrace.dll
2007-11-11 15:24 d——– C:\Documents and Settings\Administrator.MARK-C9D0B9D2AC.001\Application Data\PC Tools
2007-11-11 12:42 d——– C:\Program Files\Spyware Doctor
2007-11-11 12:42 d——– C:\Documents and Settings\PC USER\Application Data\PC Tools
2007-11-11 12:42 51,072 –a—— C:\WINDOWS\system32\drivers\ikhlayer.sys
2007-11-11 12:42 30,592 –a—— C:\WINDOWS\system32\drivers\ikhfile.sys
2007-11-11 12:29 626,688 –a—— C:\WINDOWS\system32\msvcr80.dll
2007-11-11 12:16 36,352 –a—— C:\WINDOWS\system32\pmnnkll.dll
2007-11-11 04:19 d——– C:\WINDOWS\pss
2007-11-11 03:35 85,056 –a—— C:\WINDOWS\system32\mgwbytuc.dll
2007-11-11 03:32 81,472 –a—— C:\WINDOWS\system32\fgnfyfqn.dll
2007-11-11 03:26 145,984 –a—— C:\WINDOWS\system32\whccsiyp.dll
2007-11-11 03:26 145,984 –a—— C:\WINDOWS\system32\uhtlbgit.dll
2007-11-10 16:59 d——– C:\Documents and Settings\All Users\Application Data\nView_Profiles
2007-11-10 15:20 d——– C:\Program Files\Lavasoft
2007-11-10 15:20 d——– C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-11-10 15:04 d——– C:\Program Files\Common Files\Wise Installation Wizard
2007-11-10 14:28 36,352 –a—— C:\WINDOWS\system32\awtqpom.dll
2007-11-10 13:08 d——– C:\Copy (2) of WINDOWS
2007-11-10 12:40 d——– C:\Documents and Settings\Administrator.MARK-C9D0B9D2AC.001\Application Data\iolo
2007-11-10 11:48 d——– C:\Documents and Settings\Administrator.MARK-C9D0B9D2AC.001\Application Data\Allume Systems
2007-11-09 23:58 147,456 –a—— C:\WINDOWS\system32\vbzip10.dll
2007-11-09 23:55 35,328 –a—— C:\WINDOWS\system32\iifgdca.dll
2007-11-09 23:55 134 –a—— C:\n.bat
2007-11-09 23:55 0 –a—— C:\x.dat
2007-11-09 23:54 172,032 –a—— C:\winlogon.exe
2007-11-09 23:54 0 –a—— C:\z.dat
2007-11-07 15:20 22,328 –a—— C:\WINDOWS\system32\drivers\PnkBstrK.sys
2007-11-07 15:19 107,832 –a—— C:\WINDOWS\system32\PnkBstrB.exe
2007-11-07 15:19 66,872 –a—— C:\WINDOWS\system32\PnkBstrA.exe
2007-10-20 13:56 1,044,480 –a—— C:\WINDOWS\system32\libdivx.dll
2007-10-20 13:56 524,288 –a—— C:\WINDOWS\system32\DivXsm.exe
2007-10-20 13:56 200,704 –a—— C:\WINDOWS\system32\ssldivx.dll
2007-10-20 13:54 823,296 –a—— C:\WINDOWS\system32\divx_xx0c.dll
2007-10-20 13:54 823,296 –a—— C:\WINDOWS\system32\divx_xx07.dll
2007-10-20 13:54 802,816 –a—— C:\WINDOWS\system32\divx_xx11.dll
2007-10-20 13:54 739,840 –a—— C:\WINDOWS\system32\DivX.dll
2007-10-18 22:06 156,992 –a—— C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2007-10-18 22:03 344,064 –a—— C:\WINDOWS\system32\dpus11.dll
2007-10-18 22:03 294,912 –a—— C:\WINDOWS\system32\dpu11.dll
2007-10-18 22:03 294,912 –a—— C:\WINDOWS\system32\dpu10.dll
2007-10-18 22:03 57,344 –a—— C:\WINDOWS\system32\dpv11.dll
2007-10-18 22:03 53,248 –a—— C:\WINDOWS\system32\dpuGUI10.dll
2007-10-18 22:02 12,288 –a—— C:\WINDOWS\system32\DivXWMPExtType.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-04-28 02:32 ——— d—–w C:\Program Files\Java
2013-04-28 02:03 ——— d—–w C:\Documents and Settings\PC USER\Application Data\iolo
2013-04-28 01:59 ——— d—–w C:\Documents and Settings\LocalService\Application Data\iolo
2007-11-11 19:20 ——— d—–w C:\Program Files\Mozilla Firefox2
2007-11-11 09:00 ——— d—–w C:\Program Files\RegistrySmart
2007-11-11 00:06 ——— d—–w C:\Program Files\BOINC
2007-11-11 00:04 ——— d—–w C:\Documents and Settings\PC USER\Application Data\BitTorrent DNA
2007-11-10 23:40 ——— d—a-w C:\Documents and Settings\All Users\Application Data\TEMP
2007-11-10 23:20 ——— d—–w C:\Documents and Settings\PC USER\Application Data\OpenOffice.org2
2007-11-10 23:16 ——— d—–w C:\Documents and Settings\PC USER\Application Data\Podbridge Service
2007-11-10 23:15 ——— d—–w C:\Program Files\RSSoft
2007-11-10 23:14 ——— d—–w C:\Program Files\Steam
2007-11-10 02:15 ——— d—–w C:\Program Files\LimeWire
2007-11-10 01:22 ——— d—–w C:\Program Files\iolo
2007-11-10 00:02 ——— d—–w C:\Documents and Settings\All Users\Application Data\iolo
2007-11-09 22:32 ——— d—–w C:\Documents and Settings\PC USER\Application Data\BitTorrent
2007-11-09 12:06 ——— d—–w C:\Program Files\Image-Line
2007-11-09 12:03 ——— d—–w C:\Program Files\VSTplugins
2007-11-09 10:58 278,538 —-a-w C:\WINDOWS\Fonts\Setup.exe
2007-11-09 04:42 ——— d—–w C:\Program Files\DivX
2007-10-25 16:05 94,416 —-a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-10-25 16:05 93,264 -c–a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-10-25 16:03 23,152 —-a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-10-25 16:01 42,912 —-a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-10-25 15:58 26,624 —-a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2007-08-01 14:03 6,049 —-a-w C:\Program Files\musicmaker.ini
2007-08-01 14:03 582 —-a-w C:\Program Files\crm.dat
2007-03-29 12:55 20,163 —ha-w C:\Program Files\MusicMaker.GID
2007-03-29 12:51 901 —-a-w C:\Program Files\reinstall3rdParty.ini
2007-03-29 12:51 674 —-a-w C:\Program Files\unwise.ini
2007-03-29 12:51 344,829 -c–a-w C:\Program Files\INSTALL.LOG
2007-03-29 12:51 202 —-a-w C:\Program Files\Validation.ini
2007-03-29 12:51 12,812 -c–a-w C:\Program Files\register.rtf
2007-03-29 12:25 10,874,880 —-a-w C:\Program Files\musicmaker.exe.CiM
2007-03-29 12:25 10,874,880 —-a-w C:\Program Files\musicmaker.exe
2007-03-29 12:15 19,651 -c–a-w C:\Program Files\license.txt
2006-06-15 03:56 4,272 —-a-w C:\Program Files\e-mode.ini
2006-06-13 09:57 17,408 —-a-w C:\Program Files\keygen.exe
2006-05-12 00:32 269,159 —-a-w C:\Program Files\addoninstall.exe
2006-04-24 23:08 8,637 -c–a-w C:\Program Files\order.rtf
2006-03-22 04:23 176,128 —-a-w C:\Program Files\unwise.exe
2006-02-26 22:43 24,576 —-a-w C:\Program Files\Validation.exe
2005-11-14 01:59 4,839 —-a-w C:\Program Files\uninstall.ini
2005-11-07 01:04 10,874,880 —-a-w C:\Program Files\musicmaker.exe.BAK
2005-11-02 07:56 3,822 -c–a-w C:\Program Files\e-mode-upgradedlg-exit.rtf
2005-11-02 07:56 3,822 -c–a-w C:\Program Files\e-mode-upgradedialog.rtf
2005-11-01 07:17 15,032 —-a-w C:\Program Files\crack.exe
2005-10-24 00:19 418 —-a-w C:\Program Files\Install.cfg
2005-10-24 00:17 2,138 -c–a-w C:\Program Files\mp3encoder_upgrade.rtf
2005-10-11 02:39 4,609 —-a-w C:\Program Files\musicmaker.cnt
2005-10-11 02:39 4,018,365 —-a-w C:\Program Files\musicmaker.hlp
2005-09-28 23:22 3,358 -c–a-w C:\Program Files\support.rtf
2005-09-01 21:57 81,920 -c–a-w C:\Program Files\MagixOFA-uk.dll
2005-09-01 21:56 618,496 —-a-w C:\Program Files\MagixOFA.dll
2005-08-31 02:59 471,040 —-a-w C:\Program Files\Mxtlc.dll
2005-08-22 05:40 81,920 —-a-w C:\Program Files\unwise.adf
2005-08-22 05:26 176,128 —-a-w C:\Program Files\instslct.exe
2005-08-15 03:30 237,568 —-a-w C:\Program Files\Mxautoupdate.dll
2005-08-01 03:40 442,368 —-a-w C:\Program Files\Mfl.dll
2005-06-22 03:42 128,512 —-a-w C:\Program Files\uninstall.exe
2005-06-19 20:30 225,327 —-a-w C:\Program Files\Tts.dll
2005-05-20 02:10 192,512 —-a-w C:\Program Files\reinstall3rdParty.exe
2004-10-22 04:41 118,784 —-a-w C:\Program Files\Zipdll.dll
2004-10-18 05:15 212,992 —-a-w C:\Program Files\eModeUpgradeDlg.dll
2004-04-15 03:48 32,768 -c–a-w C:\Program Files\MagixUpdater.exe
2003-10-19 23:29 49,152 —-a-w C:\Program Files\Mdll32.dll
2003-04-02 23:09 49,152 —-a-w C:\Program Files\Cpuinf32.dll
2003-02-19 20:51 28,672 —-a-w C:\Program Files\Hhwmprxy.dll
2002-12-10 22:58 60,416 —-a-w C:\Program Files\Dsetup.dll
2002-09-11 21:39 392,704 —-a-w C:\Program Files\LFCMP13n.DLL
2002-09-11 21:36 445,952 —-a-w C:\Program Files\Ltimg13n.dll
2002-09-11 21:36 265,728 —-a-w C:\Program Files\Ltdis13n.dll
2002-09-11 21:36 205,312 —-a-w C:\Program Files\Ltefx13n.dll
2002-09-11 21:36 139,264 —-a-w C:\Program Files\Ltfil13n.dll
2002-09-11 21:35 445,440 —-a-w C:\Program Files\Ltkrn13n.dll
2002-08-21 22:30 10,593 -c–a-w C:\Program Files\Soundpools.dat
2002-06-24 00:00 86,016 —-a-w C:\Program Files\Samsig.dll
2001-08-30 05:29 122,880 —-a-w C:\Program Files\Hhwmprxy7.dll
2001-06-13 23:16 667,648 —-a-w C:\Program Files\Mumaipl.dll
2001-05-10 05:26 638,976 —-a-w C:\Program Files\Playriplpx.dll
2001-05-10 05:26 20,480 —-a-w C:\Program Files\Playripl.dll
2000-08-17 22:57 28,672 —-a-w C:\Program Files\Hhrashlp.dll
2000-08-10 07:28 93,937 —-a-w C:\Program Files\Mp3util.dll
2000-05-01 23:00 508,928 —-a-w C:\Program Files\Rmbe3260.dll
2000-05-01 23:00 379,904 —-a-w C:\Program Files\Pngu3264.dll
2000-04-11 03:53 90,112 —-a-w C:\Program Files\Dac37.dll
1999-12-10 01:00 431,376 —-a-w C:\Program Files\riched20.dll
1999-02-08 22:46 137,728 —-a-w C:\Program Files\Ijl10.dll
1999-01-04 12:00 401,484 —-a-w C:\Program Files\Msvcrtd.dll
1998-11-05 15:07 102,400 —-a-w C:\Program Files\Rn5c3260.dll
1998-09-24 12:00 929,844 -c–a-w C:\Program Files\Mfc42d.dll
1998-03-26 01:00 229,888 —-a-w C:\Program Files\Qtmlclient.dll
1997-12-21 13:30 94,208 —-a-w C:\Program Files\Unzdll.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7EB895EC-664D-411E-BDC1-D7EB36600C7C}]
C:\WINDOWS\system32\ddayy.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A95B2816-1D7E-4561-A202-68C0DE02353A}]
2007-11-11 03:26 145984 –a—— C:\WINDOWS\system32\uhtlbgit.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BCC73622-F72D-4277-803C-D65565A0947F}]
2007-11-09 23:55 35328 –a—— C:\WINDOWS\system32\iifgdca.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c870c967-df4b-4ce4-9721-ebc57b7fc0b0}]
2007-11-11 21:07 79936 –a—— C:\WINDOWS\system32\xnuknkkv.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{11A69AE4-FBED-4832-A2BF-45AF82825583}"= C:\WINDOWS\system32\uhtlbgit.dll [2007-11-11 03:26 145984]

[HKEY_CLASSES_ROOT\CLSID\{11A69AE4-FBED-4832-A2BF-45AF82825583}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SiSUSBRG"="C:\WINDOWS\SiSUSBrg.exe" [2002-07-12 23:15]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-10-26 04:20]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 04:43]
"Red Swoosh"="C:\Program Files\RSSoft\RedSwoosh.exe" [2007-02-22 15:13]
"EPSON Stylus Photo R350 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAJP.exe" [2005-05-12 17:00]
"QuickTime Task"="C:\Program Files\QuickTime Alternative\qttask.exe" [2007-02-16 11:54]
"mouseElf"="C:\PROGRA~1\GENIUS~1\mouseElf.exe" [2004-02-24 18:47]
"LogMeIn GUI"="C:\Program Files\LogMeIn\LogMeInSystray.exe" [2006-10-06 20:55]
"MAFWTaskbarApp"="C:\WINDOWS\system32\MAFWTray.exe" [2004-09-27 17:44]
"RegistrySmart"="C:\Program Files\RegistrySmart\RegistrySmart.exe" [2006-08-25 14:01]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50]
"MSConfig"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2006-03-01 01:00]
"SoundMan"="SOUNDMAN.EXE" [2004-11-15 23:20 C:\WINDOWS\SOUNDMAN.EXE]
"2c760616"="C:\WINDOWS\system32\mrdkbhmt.dll" [2007-11-11 21:10]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-04-19 14:26]
"a-squared"="C:\Program Files\a-squared Anti-Malware\a2guard.exe" [2007-11-12 01:16]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-01 01:00]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" [2005-10-28 17:25]
"BitTorrent DNA"="C:\Program Files\BitTorrent_DNA\dna.exe" [2007-08-09 16:25]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce]
"Spyware Doctor"="C:\Program Files\Spyware Doctor\swdoctor.exe" /RM /FS /X

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"MySpaceIM"=C:\Program Files\MySpace\IM\MySpaceIM.exe
"Spyware Doctor"=

C:\Documents and Settings\PC USER\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-03-15 10:25:04]
OpenOffice.org 2.1.lnk - C:\Program Files\OpenOffice.org 2.1\program\quickstart.exe [2006-11-27 16:45:48]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-F400-7760-000000000003}\_SC_Acrobat.exe [2007-03-15 15:52:06]
Adobe Acrobat Synchronizer.lnk - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe [2006-10-23 00:01:50]
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-03-15 10:25:04]
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 01:48:20]
Adobe Reader Synchronizer.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 00:01:50]
Image Transfer.lnk - C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe [2007-07-05 19:06:30]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{BCC73622-F72D-4277-803C-D65565A0947F}"= C:\WINDOWS\system32\iifgdca.dll [2007-11-09 23:55 35328]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\iifgdca]
iifgdca.dll 2007-11-09 23:55 35328 C:\WINDOWS\system32\iifgdca.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
LMIinit.dll 2006-10-06 20:56 11504 C:\WINDOWS\system32\LMIinit.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\uhtlbgit]
uhtlbgit.dll 2007-11-11 03:26 145984 C:\WINDOWS\system32\uhtlbgit.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\system32\gebcd.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\2c760616]
rundll32.exe "C:\WINDOWS\system32\mgwbytuc.dll",b

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"C:\Program Files\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MySpaceIM]
C:\Program Files\MySpace\IM\MySpaceIM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Podbridge Launcher]
"C:\Program Files\PodBridge\Podbridge launcher.exe" /AutoRun

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SRFirstRun]
rundll32 srclient.dll,CreateFirstRunRp

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
"c:\progra~1\steam\steam.exe" -silent

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinAble]
C:\Program Files\WinAble\winable.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Bonjour Service"=2 (0x2)
"iPod Service"=3 (0x3)
"PnkBstrA"=2 (0x2)
"ose"=3 (0x3)
"IDriverT"=3 (0x3)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Acrobat Assistant 8.0"="C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"

R0 SiSRaid;SiSRaid;C:\WINDOWS\system32\DRIVERS\SiSRaid.sys
R0 sonypvl2;sonypvl2;C:\WINDOWS\system32\drivers\sonypvl2.sys
R1 sonypvf2;sonypvf2;C:\WINDOWS\system32\drivers\sonypvf2.sys
R1 sonypvt2;sonypvt2;C:\WINDOWS\system32\drivers\sonypvt2.sys
S1 oreans32;oreans32;\??\C:\WINDOWS\system32\drivers\oreans32.sys
S2 LMIInfo;LogMeIn Kernel Information Provider;\??\C:\Program Files\LogMeIn\RaInfo.sys
S3 bbcap;bbcap;C:\WINDOWS\system32\DRIVERS\bbcap.sys
S3 genmcmn;Genius Mouse Driver;C:\WINDOWS\system32\DRIVERS\gmfiltr.sys
S3 genmcmnUSB;Genius USB Mouse Driver;C:\WINDOWS\system32\DRIVERS\gflmouhid.sys
S3 LMImirr;LMImirr;C:\WINDOWS\system32\DRIVERS\LMImirr.sys
S3 sonypvs1;Sony Digital Imaging Video2;C:\WINDOWS\system32\DRIVERS\sonypvs1.sys

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe MS32DLL.dll.vbs

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe MS32DLL.dll.vbs

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe MS32DLL.dll.vbs

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe MS32DLL.dll.vbs

.
Contents of the 'Scheduled Tasks' folder
"2007-08-13 01:25:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2007-11-10 14:30:37 C:\WINDOWS\Tasks\RegistrySmart Scheduled Scan.job"
- C:\Program Files\RegistrySmart\RegistrySmart.exe
.
**************************************************************************

catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-12 08:36:04
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-12 8:39:47 - machine was rebooted
.
— E O F —

Did the above, still getting popups and wndows did not reboot, here are the logs my friend.


ComboFix 07-11-08.1 - PC USER 2007-11-12 10:12:04.2 - NTFSx86 NETWORK
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1673 [GMT 13:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\PC USER\Desktop\CFScript.txt
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Start Menu\Live Safety Center.lnk
C:\Documents and Settings\All Users\Start Menu\Online Security Guide.lnk
C:\Documents and Settings\PC USER\Desktop\Live Safety Center.lnk
C:\Documents and Settings\PC USER\Desktop\Online Security Guide.lnk
C:\Documents and Settings\PC USER\Favorites\Online Security Guide.lnk
C:\WINDOWS\system32\ssttt.dll
C:\WINDOWS\system32\tttss.bak1
C:\WINDOWS\system32\tttss.ini
C:\WINDOWS\system32\uhtlbgit.dllbox

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
——-\LEGACY_IKHFILE
——-\LEGACY_IKHLAYER
——-\ikhfile
——-\ikhlayer


((((((((((((((((((((((((( Files Created from 2007-10-11 to 2007-11-11 )))))))))))))))))))))))))))))))
.

2007-11-12 10:06 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-11-12 02:55 d——– C:\WINDOWS\Fonts2
2007-11-12 01:06 d——– C:\Program Files\a-squared Anti-Malware
2007-11-11 23:18 d——– C:\Documents and Settings\All Users\Application Data\Prevx
2007-11-11 22:44 664 –a—— C:\WINDOWS\system32\d3d9caps.dat
2007-11-11 21:19 d——– C:\Program Files\WhatsRunning
2007-11-11 21:10 88,128 –a—— C:\WINDOWS\system32\mrdkbhmt.dll
2007-11-11 21:07 79,936 –a—— C:\WINDOWS\system32\xnuknkkv.dll
2007-11-11 17:55 552 –a—— C:\WINDOWS\system32\d3d8caps.dat
2007-11-11 17:23 d——– C:\WINDOWS\LastGood
2007-11-11 17:13 20,992 –a—— C:\WINDOWS\system32\drivers\RTL8139.sys
2007-11-11 17:07 24,661 –a—— C:\WINDOWS\system32\spxcoins.dll
2007-11-11 17:07 24,661 –a–c— C:\WINDOWS\system32\dllcache\spxcoins.dll
2007-11-11 17:07 13,312 –a—— C:\WINDOWS\system32\irclass.dll
2007-11-11 17:07 13,312 –a–c— C:\WINDOWS\system32\dllcache\irclass.dll
2007-11-11 16:12 331,776 –a—— C:\WINDOWS\system32\wpdmtpdr.dll
2007-11-11 16:12 331,264 –a—— C:\WINDOWS\system32\wpdsp.dll
2007-11-11 16:12 114,176 –a—— C:\WINDOWS\system32\wpdmtp.dll
2007-11-11 16:12 66,560 –a—— C:\WINDOWS\system32\wpdmtpus.dll
2007-11-11 16:12 18,944 –a—— C:\WINDOWS\system32\drivers\wpdusb.sys
2007-11-11 16:12 10,752 –a—— C:\WINDOWS\system32\wpdtrace.dll
2007-11-11 15:24 d——– C:\Documents and Settings\Administrator.MARK-C9D0B9D2AC.001\Application Data\PC Tools
2007-11-11 12:42 d——– C:\Program Files\Spyware Doctor
2007-11-11 12:42 d——– C:\Documents and Settings\PC USER\Application Data\PC Tools
2007-11-11 12:42 51,072 –a—— C:\WINDOWS\system32\drivers\ikhlayer.sys
2007-11-11 12:42 30,592 –a—— C:\WINDOWS\system32\drivers\ikhfile.sys
2007-11-11 12:29 626,688 –a—— C:\WINDOWS\system32\msvcr80.dll
2007-11-11 12:16 36,352 –a—— C:\WINDOWS\system32\pmnnkll.dll
2007-11-11 04:19 d——– C:\WINDOWS\pss
2007-11-11 03:35 85,056 –a—— C:\WINDOWS\system32\mgwbytuc.dll
2007-11-11 03:32 81,472 –a—— C:\WINDOWS\system32\fgnfyfqn.dll
2007-11-11 03:26 145,984 –a—— C:\WINDOWS\system32\whccsiyp.dll
2007-11-11 03:26 145,984 –a—— C:\WINDOWS\system32\uhtlbgit.dll
2007-11-10 16:59 d——– C:\Documents and Settings\All Users\Application Data\nView_Profiles
2007-11-10 15:20 d——– C:\Program Files\Lavasoft
2007-11-10 15:20 d——– C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-11-10 15:04 d——– C:\Program Files\Common Files\Wise Installation Wizard
2007-11-10 14:28 36,352 –a—— C:\WINDOWS\system32\awtqpom.dll
2007-11-10 13:08 d——– C:\Copy (2) of WINDOWS
2007-11-10 12:40 d——– C:\Documents and Settings\Administrator.MARK-C9D0B9D2AC.001\Application Data\iolo
2007-11-10 11:48 d——– C:\Documents and Settings\Administrator.MARK-C9D0B9D2AC.001\Application Data\Allume Systems
2007-11-09 23:58 147,456 –a—— C:\WINDOWS\system32\vbzip10.dll
2007-11-09 23:55 35,328 –a—— C:\WINDOWS\system32\iifgdca.dll
2007-11-09 23:55 134 –a—— C:\n.bat
2007-11-09 23:55 0 –a—— C:\x.dat
2007-11-09 23:54 172,032 –a—— C:\winlogon.exe
2007-11-09 23:54 0 –a—— C:\z.dat
2007-11-07 15:20 22,328 –a—— C:\WINDOWS\system32\drivers\PnkBstrK.sys
2007-11-07 15:19 107,832 –a—— C:\WINDOWS\system32\PnkBstrB.exe
2007-11-07 15:19 66,872 –a—— C:\WINDOWS\system32\PnkBstrA.exe
2007-10-20 13:56 1,044,480 –a—— C:\WINDOWS\system32\libdivx.dll
2007-10-20 13:56 524,288 –a—— C:\WINDOWS\system32\DivXsm.exe
2007-10-20 13:56 200,704 –a—— C:\WINDOWS\system32\ssldivx.dll
2007-10-20 13:54 823,296 –a—— C:\WINDOWS\system32\divx_xx0c.dll
2007-10-20 13:54 823,296 –a—— C:\WINDOWS\system32\divx_xx07.dll
2007-10-20 13:54 802,816 –a—— C:\WINDOWS\system32\divx_xx11.dll
2007-10-20 13:54 739,840 –a—— C:\WINDOWS\system32\DivX.dll
2007-10-18 22:06 156,992 –a—— C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2007-10-18 22:03 344,064 –a—— C:\WINDOWS\system32\dpus11.dll
2007-10-18 22:03 294,912 –a—— C:\WINDOWS\system32\dpu11.dll
2007-10-18 22:03 294,912 –a—— C:\WINDOWS\system32\dpu10.dll
2007-10-18 22:03 57,344 –a—— C:\WINDOWS\system32\dpv11.dll
2007-10-18 22:03 53,248 –a—— C:\WINDOWS\system32\dpuGUI10.dll
2007-10-18 22:02 12,288 –a—— C:\WINDOWS\system32\DivXWMPExtType.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-04-28 02:32 ——— d—–w C:\Program Files\Java
2013-04-28 02:03 ——— d—–w C:\Documents and Settings\PC USER\Application Data\iolo
2013-04-28 01:59 ——— d—–w C:\Documents and Settings\LocalService\Application Data\iolo
2007-11-11 21:12 ——— d—–w C:\Program Files\Mozilla Firefox2
2007-11-11 09:00 ——— d—–w C:\Program Files\RegistrySmart
2007-11-11 00:06 ——— d—–w C:\Program Files\BOINC
2007-11-11 00:04 ——— d—–w C:\Documents and Settings\PC USER\Application Data\BitTorrent DNA
2007-11-10 23:40 ——— d—a-w C:\Documents and Settings\All Users\Application Data\TEMP
2007-11-10 23:20 ——— d—–w C:\Documents and Settings\PC USER\Application Data\OpenOffice.org2
2007-11-10 23:16 ——— d—–w C:\Documents and Settings\PC USER\Application Data\Podbridge Service
2007-11-10 23:15 ——— d—–w C:\Program Files\RSSoft
2007-11-10 23:14 ——— d—–w C:\Program Files\Steam
2007-11-10 02:15 ——— d—–w C:\Program Files\LimeWire
2007-11-10 01:22 ——— d—–w C:\Program Files\iolo
2007-11-10 00:02 ——— d—–w C:\Documents and Settings\All Users\Application Data\iolo
2007-11-09 22:32 ——— d—–w C:\Documents and Settings\PC USER\Application Data\BitTorrent
2007-11-09 12:06 ——— d—–w C:\Program Files\Image-Line
2007-11-09 12:03 ——— d—–w C:\Program Files\VSTplugins
2007-11-09 10:58 278,538 —-a-w C:\WINDOWS\Fonts\Setup.exe
2007-11-09 04:42 ——— d—–w C:\Program Files\DivX
2007-10-25 16:05 94,416 —-a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-10-25 16:05 93,264 -c–a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-10-25 16:03 23,152 —-a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-10-25 16:01 42,912 —-a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-10-25 15:58 26,624 —-a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2007-08-01 14:03 6,049 —-a-w C:\Program Files\musicmaker.ini
2007-08-01 14:03 582 —-a-w C:\Program Files\crm.dat
2007-03-29 12:55 20,163 —ha-w C:\Program Files\MusicMaker.GID
2007-03-29 12:51 901 —-a-w C:\Program Files\reinstall3rdParty.ini
2007-03-29 12:51 674 —-a-w C:\Program Files\unwise.ini
2007-03-29 12:51 344,829 -c–a-w C:\Program Files\INSTALL.LOG
2007-03-29 12:51 202 —-a-w C:\Program Files\Validation.ini
2007-03-29 12:51 12,812 -c–a-w C:\Program Files\register.rtf
2007-03-29 12:25 10,874,880 —-a-w C:\Program Files\musicmaker.exe.CiM
2007-03-29 12:25 10,874,880 —-a-w C:\Program Files\musicmaker.exe
2007-03-29 12:15 19,651 -c–a-w C:\Program Files\license.txt
2006-06-15 03:56 4,272 —-a-w C:\Program Files\e-mode.ini
2006-06-13 09:57 17,408 —-a-w C:\Program Files\keygen.exe
2006-05-12 00:32 269,159 —-a-w C:\Program Files\addoninstall.exe
2006-04-24 23:08 8,637 -c–a-w C:\Program Files\order.rtf
2006-03-22 04:23 176,128 —-a-w C:\Program Files\unwise.exe
2006-02-26 22:43 24,576 —-a-w C:\Program Files\Validation.exe
2005-11-14 01:59 4,839 —-a-w C:\Program Files\uninstall.ini
2005-11-07 01:04 10,874,880 —-a-w C:\Program Files\musicmaker.exe.BAK
2005-11-02 07:56 3,822 -c–a-w C:\Program Files\e-mode-upgradedlg-exit.rtf
2005-11-02 07:56 3,822 -c–a-w C:\Program Files\e-mode-upgradedialog.rtf
2005-11-01 07:17 15,032 —-a-w C:\Program Files\crack.exe
2005-10-24 00:19 418 —-a-w C:\Program Files\Install.cfg
2005-10-24 00:17 2,138 -c–a-w C:\Program Files\mp3encoder_upgrade.rtf
2005-10-11 02:39 4,609 —-a-w C:\Program Files\musicmaker.cnt
2005-10-11 02:39 4,018,365 —-a-w C:\Program Files\musicmaker.hlp
2005-09-28 23:22 3,358 -c–a-w C:\Program Files\support.rtf
2005-09-01 21:57 81,920 -c–a-w C:\Program Files\MagixOFA-uk.dll
2005-09-01 21:56 618,496 —-a-w C:\Program Files\MagixOFA.dll
2005-08-31 02:59 471,040 —-a-w C:\Program Files\Mxtlc.dll
2005-08-22 05:40 81,920 —-a-w C:\Program Files\unwise.adf
2005-08-22 05:26 176,128 —-a-w C:\Program Files\instslct.exe
2005-08-15 03:30 237,568 —-a-w C:\Program Files\Mxautoupdate.dll
2005-08-01 03:40 442,368 —-a-w C:\Program Files\Mfl.dll
2005-06-22 03:42 128,512 —-a-w C:\Program Files\uninstall.exe
2005-06-19 20:30 225,327 —-a-w C:\Program Files\Tts.dll
2005-05-20 02:10 192,512 —-a-w C:\Program Files\reinstall3rdParty.exe
2004-10-22 04:41 118,784 —-a-w C:\Program Files\Zipdll.dll
2004-10-18 05:15 212,992 —-a-w C:\Program Files\eModeUpgradeDlg.dll
2004-04-15 03:48 32,768 -c–a-w C:\Program Files\MagixUpdater.exe
2003-10-19 23:29 49,152 —-a-w C:\Program Files\Mdll32.dll
2003-04-02 23:09 49,152 —-a-w C:\Program Files\Cpuinf32.dll
2003-02-19 20:51 28,672 —-a-w C:\Program Files\Hhwmprxy.dll
2002-12-10 22:58 60,416 —-a-w C:\Program Files\Dsetup.dll
2002-09-11 21:39 392,704 —-a-w C:\Program Files\LFCMP13n.DLL
2002-09-11 21:36 445,952 —-a-w C:\Program Files\Ltimg13n.dll
2002-09-11 21:36 265,728 —-a-w C:\Program Files\Ltdis13n.dll
2002-09-11 21:36 205,312 —-a-w C:\Program Files\Ltefx13n.dll
2002-09-11 21:36 139,264 —-a-w C:\Program Files\Ltfil13n.dll
2002-09-11 21:35 445,440 —-a-w C:\Program Files\Ltkrn13n.dll
2002-08-21 22:30 10,593 -c–a-w C:\Program Files\Soundpools.dat
2002-06-24 00:00 86,016 —-a-w C:\Program Files\Samsig.dll
2001-08-30 05:29 122,880 —-a-w C:\Program Files\Hhwmprxy7.dll
2001-06-13 23:16 667,648 —-a-w C:\Program Files\Mumaipl.dll
2001-05-10 05:26 638,976 —-a-w C:\Program Files\Playriplpx.dll
2001-05-10 05:26 20,480 —-a-w C:\Program Files\Playripl.dll
2000-08-17 22:57 28,672 —-a-w C:\Program Files\Hhrashlp.dll
2000-08-10 07:28 93,937 —-a-w C:\Program Files\Mp3util.dll
2000-05-01 23:00 508,928 —-a-w C:\Program Files\Rmbe3260.dll
2000-05-01 23:00 379,904 —-a-w C:\Program Files\Pngu3264.dll
2000-04-11 03:53 90,112 —-a-w C:\Program Files\Dac37.dll
1999-12-10 01:00 431,376 —-a-w C:\Program Files\riched20.dll
1999-02-08 22:46 137,728 —-a-w C:\Program Files\Ijl10.dll
1999-01-04 12:00 401,484 —-a-w C:\Program Files\Msvcrtd.dll
1998-11-05 15:07 102,400 —-a-w C:\Program Files\Rn5c3260.dll
1998-09-24 12:00 929,844 -c–a-w C:\Program Files\Mfc42d.dll
1998-03-26 01:00 229,888 —-a-w C:\Program Files\Qtmlclient.dll
1997-12-21 13:30 94,208 —-a-w C:\Program Files\Unzdll.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A95B2816-1D7E-4561-A202-68C0DE02353A}]
2007-11-11 03:26 145984 –a—— C:\WINDOWS\system32\uhtlbgit.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BCC73622-F72D-4277-803C-D65565A0947F}]
2007-11-09 23:55 35328 –a—— C:\WINDOWS\system32\iifgdca.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{11A69AE4-FBED-4832-A2BF-45AF82825583}"= C:\WINDOWS\system32\uhtlbgit.dll [2007-11-11 03:26 145984]

[HKEY_CLASSES_ROOT\CLSID\{11A69AE4-FBED-4832-A2BF-45AF82825583}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SiSUSBRG"="C:\WINDOWS\SiSUSBrg.exe" [2002-07-12 23:15]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-10-26 04:20]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 04:43]
"Red Swoosh"="C:\Program Files\RSSoft\RedSwoosh.exe" [2007-02-22 15:13]
"EPSON Stylus Photo R350 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAJP.exe" [2005-05-12 17:00]
"QuickTime Task"="C:\Program Files\QuickTime Alternative\qttask.exe" [2007-02-16 11:54]
"mouseElf"="C:\PROGRA~1\GENIUS~1\mouseElf.exe" [2004-02-24 18:47]
"LogMeIn GUI"="C:\Program Files\LogMeIn\LogMeInSystray.exe" [2006-10-06 20:55]
"MAFWTaskbarApp"="C:\WINDOWS\system32\MAFWTray.exe" [2004-09-27 17:44]
"RegistrySmart"="C:\Program Files\RegistrySmart\RegistrySmart.exe" [2006-08-25 14:01]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50]
"MSConfig"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2006-03-01 01:00]
"SoundMan"="SOUNDMAN.EXE" [2004-11-15 23:20 C:\WINDOWS\SOUNDMAN.EXE]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-04-19 14:26]
"a-squared"="C:\Program Files\a-squared Anti-Malware\a2guard.exe" [2007-11-12 01:16]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-01 01:00]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" [2005-10-28 17:25]
"BitTorrent DNA"="C:\Program Files\BitTorrent_DNA\dna.exe" [2007-08-09 16:25]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce]
"Spyware Doctor"="C:\Program Files\Spyware Doctor\swdoctor.exe" /RM /FS /X

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"MySpaceIM"=C:\Program Files\MySpace\IM\MySpaceIM.exe
"Spyware Doctor"=

C:\Documents and Settings\PC USER\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-03-15 10:25:04]
OpenOffice.org 2.1.lnk - C:\Program Files\OpenOffice.org 2.1\program\quickstart.exe [2006-11-27 16:45:48]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-F400-7760-000000000003}\_SC_Acrobat.exe [2007-03-15 15:52:06]
Adobe Acrobat Synchronizer.lnk - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe [2006-10-23 00:01:50]
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-03-15 10:25:04]
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 01:48:20]
Adobe Reader Synchronizer.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 00:01:50]
Image Transfer.lnk - C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe [2007-07-05 19:06:30]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{BCC73622-F72D-4277-803C-D65565A0947F}"= C:\WINDOWS\system32\iifgdca.dll [2007-11-09 23:55 35328]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\iifgdca]
iifgdca.dll 2007-11-09 23:55 35328 C:\WINDOWS\system32\iifgdca.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
LMIinit.dll 2006-10-06 20:56 11504 C:\WINDOWS\system32\LMIinit.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\uhtlbgit]
uhtlbgit.dll 2007-11-11 03:26 145984 C:\WINDOWS\system32\uhtlbgit.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"C:\Program Files\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MySpaceIM]
C:\Program Files\MySpace\IM\MySpaceIM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Podbridge Launcher]
"C:\Program Files\PodBridge\Podbridge launcher.exe" /AutoRun

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SRFirstRun]
rundll32 srclient.dll,CreateFirstRunRp

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
"c:\progra~1\steam\steam.exe" -silent

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinAble]
C:\Program Files\WinAble\winable.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Bonjour Service"=2 (0x2)
"iPod Service"=3 (0x3)
"PnkBstrA"=2 (0x2)
"ose"=3 (0x3)
"IDriverT"=3 (0x3)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Acrobat Assistant 8.0"="C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"

R0 SiSRaid;SiSRaid;C:\WINDOWS\system32\DRIVERS\SiSRaid.sys
R0 sonypvl2;sonypvl2;C:\WINDOWS\system32\drivers\sonypvl2.sys
R1 sonypvf2;sonypvf2;C:\WINDOWS\system32\drivers\sonypvf2.sys
R1 sonypvt2;sonypvt2;C:\WINDOWS\system32\drivers\sonypvt2.sys
S1 oreans32;oreans32;\??\C:\WINDOWS\system32\drivers\oreans32.sys
S2 LMIInfo;LogMeIn Kernel Information Provider;\??\C:\Program Files\LogMeIn\RaInfo.sys
S3 bbcap;bbcap;C:\WINDOWS\system32\DRIVERS\bbcap.sys
S3 genmcmn;Genius Mouse Driver;C:\WINDOWS\system32\DRIVERS\gmfiltr.sys
S3 genmcmnUSB;Genius USB Mouse Driver;C:\WINDOWS\system32\DRIVERS\gflmouhid.sys
S3 LMImirr;LMImirr;C:\WINDOWS\system32\DRIVERS\LMImirr.sys
S3 sonypvs1;Sony Digital Imaging Video2;C:\WINDOWS\system32\DRIVERS\sonypvs1.sys

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\Shell\AutoRun\command - E:\ierunner.exe

.
Contents of the 'Scheduled Tasks' folder
"2007-08-13 01:25:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2007-11-10 14:30:37 C:\WINDOWS\Tasks\RegistrySmart Scheduled Scan.job"
- C:\Program Files\RegistrySmart\RegistrySmart.exe
.
**************************************************************************

catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-12 10:24:12
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-12 10:27:58 - machine was rebooted
C:\ComboFix2.txt … 2007-11-12 08:39
.
— E O F —


Logfile of HijackThis v1.99.1
Scan saved at 10:31:15 a.m., on 12/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {A95B2816-1D7E-4561-A202-68C0DE02353A} - C:\WINDOWS\system32\uhtlbgit.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: (no name) - {BCC73622-F72D-4277-803C-D65565A0947F} - C:\WINDOWS\system32\iifgdca.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdmcks.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Security Toolbar - {11A69AE4-FBED-4832-A2BF-45AF82825583} - C:\WINDOWS\system32\uhtlbgit.dll
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [Red Swoosh] C:\Program Files\RSSoft\RedSwoosh.exe /S
O4 - HKLM\..\Run: [EPSON Stylus Photo R350 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAJP.EXE /P30 "EPSON Stylus Photo R350 Series" /O6 "USB001" /M "Stylus Photo R350"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime Alternative\qttask.exe" -atboottime
O4 - HKLM\..\Run: [mouseElf] C:\PROGRA~1\GENIUS~1\mouseElf.exe
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\LogMeInSystray.exe"
O4 - HKLM\..\Run: [MAFWTaskbarApp] C:\WINDOWS\system32\MAFWTray.exe
O4 - HKLM\..\Run: [RegistrySmart] "C:\Program Files\RegistrySmart\RegistrySmart.exe" -boot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [a-squared] "C:\Program Files\a-squared Anti-Malware\a2guard.exe"
O4 - HKLM\..\RunOnce: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /RM /FS /X
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\BitTorrent_DNA\dna.exe"
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: OpenOffice.org 2.1.lnk = C:\Program Files\OpenOffice.org 2.1\program\quickstart.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Adobe Acrobat Synchronizer.lnk = C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Image Transfer.lnk = ?
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O20 - Winlogon Notify: iifgdca - C:\WINDOWS\SYSTEM32\iifgdca.dll
O20 - Winlogon Notify: LMIinit - C:\WINDOWS\SYSTEM32\LMIinit.dll
O20 - Winlogon Notify: uhtlbgit - C:\WINDOWS\SYSTEM32\uhtlbgit.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Emsi Software GmbH - C:\Program Files\a-squared Anti-Malware\a2service.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe

Hey again, i rebooted ang got a blue screen with these paramaters within the message nv4_disp.dll, page_fault_homepaged

stop:0x00000050 (0xESA32c04,0x00000000,0xBFA05005,0x00000002,nu4_disp.dll Adress BFA05005 base at BF9D3000 date stamp 4627d557 (i stopped it at memory dump 41)

I rebooted again, screen went blank again, so rebooted back into safe mode as where i am now, here is combo fix file and hijackthis file, Still get an error message of unable to find "null" which i think is the avast quarintine folder. I have noticed this time round that no popups have started (hope this isnt temporary! and scrolling the browser is still slow, dang spoke too soon! w.savetheinformation.com/v7/?gai=hamm_h5_pop&gli;=pop_1&gff;=hamm_15003_2c7606b9%20A62EEC99A9A54C639324595BB970780B&eai;=hamm_h5_pop&eli;=pop_1&eaf;=hamm_15003_2c7606b9%20A62EEC99A9A54C639324595BB970780B&air;=hamm_h5_pop&lir;=pop_1𝔞=hamm_15003_2c7606b9%20A62EEC99A9A54C639324595BB970780B

Just came up!

here are the logs

ComboFix 07-11-08.1 - PC USER 2007-11-12 10:56:34.3 - NTFSx86 NETWORK
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1732 [GMT 13:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
.

Unable to gain System Privileges

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Start Menu\Live Safety Center.lnk
C:\Documents and Settings\All Users\Start Menu\Online Security Guide.lnk
C:\Documents and Settings\PC USER\Desktop\Live Safety Center.lnk
C:\Documents and Settings\PC USER\Desktop\Online Security Guide.lnk
C:\Documents and Settings\PC USER\Favorites\Online Security Guide.lnk
C:\WINDOWS\system32\gebyx.dll
C:\WINDOWS\system32\uhtlbgit.dllbox
C:\WINDOWS\system32\xybeg.bak1
C:\WINDOWS\system32\xybeg.ini

.
((((((((((((((((((((((((( Files Created from 2007-10-11 to 2007-11-11 )))))))))))))))))))))))))))))))
.

2007-11-12 10:06 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-11-12 02:55 d——– C:\WINDOWS\Fonts2
2007-11-12 01:06 d——– C:\Program Files\a-squared Anti-Malware
2007-11-11 23:18 d——– C:\Documents and Settings\All Users\Application Data\Prevx
2007-11-11 22:44 664 –a—— C:\WINDOWS\system32\d3d9caps.dat
2007-11-11 21:19 d——– C:\Program Files\WhatsRunning
2007-11-11 21:10 88,128 –a—— C:\WINDOWS\system32\mrdkbhmt.dll
2007-11-11 21:07 79,936 –a—— C:\WINDOWS\system32\xnuknkkv.dll
2007-11-11 17:55 552 –a—— C:\WINDOWS\system32\d3d8caps.dat
2007-11-11 17:23 d——– C:\WINDOWS\LastGood
2007-11-11 17:13 20,992 –a—— C:\WINDOWS\system32\drivers\RTL8139.sys
2007-11-11 17:07 24,661 –a—— C:\WINDOWS\system32\spxcoins.dll
2007-11-11 17:07 24,661 –a–c— C:\WINDOWS\system32\dllcache\spxcoins.dll
2007-11-11 17:07 13,312 –a—— C:\WINDOWS\system32\irclass.dll
2007-11-11 17:07 13,312 –a–c— C:\WINDOWS\system32\dllcache\irclass.dll
2007-11-11 16:12 331,776 –a—— C:\WINDOWS\system32\wpdmtpdr.dll
2007-11-11 16:12 331,264 –a—— C:\WINDOWS\system32\wpdsp.dll
2007-11-11 16:12 114,176 –a—— C:\WINDOWS\system32\wpdmtp.dll
2007-11-11 16:12 66,560 –a—— C:\WINDOWS\system32\wpdmtpus.dll
2007-11-11 16:12 18,944 –a—— C:\WINDOWS\system32\drivers\wpdusb.sys
2007-11-11 16:12 10,752 –a—— C:\WINDOWS\system32\wpdtrace.dll
2007-11-11 15:24 d——– C:\Documents and Settings\Administrator.MARK-C9D0B9D2AC.001\Application Data\PC Tools
2007-11-11 12:42 d——– C:\Program Files\Spyware Doctor
2007-11-11 12:42 d——– C:\Documents and Settings\PC USER\Application Data\PC Tools
2007-11-11 12:42 51,072 –a—— C:\WINDOWS\system32\drivers\ikhlayer.sys
2007-11-11 12:42 30,592 –a—— C:\WINDOWS\system32\drivers\ikhfile.sys
2007-11-11 12:29 626,688 –a—— C:\WINDOWS\system32\msvcr80.dll
2007-11-11 12:16 36,352 –a—— C:\WINDOWS\system32\pmnnkll.dll
2007-11-11 04:19 d——– C:\WINDOWS\pss
2007-11-11 03:35 85,056 –a—— C:\WINDOWS\system32\mgwbytuc.dll
2007-11-11 03:32 81,472 –a—— C:\WINDOWS\system32\fgnfyfqn.dll
2007-11-11 03:26 145,984 –a—— C:\WINDOWS\system32\whccsiyp.dll
2007-11-11 03:26 145,984 –a—— C:\WINDOWS\system32\uhtlbgit.dll
2007-11-10 16:59 d——– C:\Documents and Settings\All Users\Application Data\nView_Profiles
2007-11-10 15:20 d——– C:\Program Files\Lavasoft
2007-11-10 15:20 d——– C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-11-10 15:04 d——– C:\Program Files\Common Files\Wise Installation Wizard
2007-11-10 14:28 36,352 –a—— C:\WINDOWS\system32\awtqpom.dll
2007-11-10 13:08 d——– C:\Copy (2) of WINDOWS
2007-11-10 12:40 d——– C:\Documents and Settings\Administrator.MARK-C9D0B9D2AC.001\Application Data\iolo
2007-11-10 11:48 d——– C:\Documents and Settings\Administrator.MARK-C9D0B9D2AC.001\Application Data\Allume Systems
2007-11-09 23:58 147,456 –a—— C:\WINDOWS\system32\vbzip10.dll
2007-11-09 23:55 35,328 –a—— C:\WINDOWS\system32\iifgdca.dll
2007-11-09 23:55 134 –a—— C:\n.bat
2007-11-09 23:55 0 –a—— C:\x.dat
2007-11-09 23:54 172,032 –a—— C:\winlogon.exe
2007-11-09 23:54 0 –a—— C:\z.dat
2007-11-07 15:20 22,328 –a—— C:\WINDOWS\system32\drivers\PnkBstrK.sys
2007-11-07 15:19 107,832 –a—— C:\WINDOWS\system32\PnkBstrB.exe
2007-11-07 15:19 66,872 –a—— C:\WINDOWS\system32\PnkBstrA.exe
2007-10-20 13:56 1,044,480 –a—— C:\WINDOWS\system32\libdivx.dll
2007-10-20 13:56 524,288 –a—— C:\WINDOWS\system32\DivXsm.exe
2007-10-20 13:56 200,704 –a—— C:\WINDOWS\system32\ssldivx.dll
2007-10-20 13:54 823,296 –a—— C:\WINDOWS\system32\divx_xx0c.dll
2007-10-20 13:54 823,296 –a—— C:\WINDOWS\system32\divx_xx07.dll
2007-10-20 13:54 802,816 –a—— C:\WINDOWS\system32\divx_xx11.dll
2007-10-20 13:54 739,840 –a—— C:\WINDOWS\system32\DivX.dll
2007-10-18 22:06 156,992 –a—— C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2007-10-18 22:03 344,064 –a—— C:\WINDOWS\system32\dpus11.dll
2007-10-18 22:03 294,912 –a—— C:\WINDOWS\system32\dpu11.dll
2007-10-18 22:03 294,912 –a—— C:\WINDOWS\system32\dpu10.dll
2007-10-18 22:03 57,344 –a—— C:\WINDOWS\system32\dpv11.dll
2007-10-18 22:03 53,248 –a—— C:\WINDOWS\system32\dpuGUI10.dll
2007-10-18 22:02 12,288 –a—— C:\WINDOWS\system32\DivXWMPExtType.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-04-28 02:32 ——— d—–w C:\Program Files\Java
2013-04-28 02:03 ——— d—–w C:\Documents and Settings\PC USER\Application Data\iolo
2013-04-28 01:59 ——— d—–w C:\Documents and Settings\LocalService\Application Data\iolo
2007-11-11 21:55 ——— d—–w C:\Program Files\Mozilla Firefox2
2007-11-11 09:00 ——— d—–w C:\Program Files\RegistrySmart
2007-11-11 00:06 ——— d—–w C:\Program Files\BOINC
2007-11-11 00:04 ——— d—–w C:\Documents and Settings\PC USER\Application Data\BitTorrent DNA
2007-11-10 23:40 ——— d—a-w C:\Documents and Settings\All Users\Application Data\TEMP
2007-11-10 23:20 ——— d—–w C:\Documents and Settings\PC USER\Application Data\OpenOffice.org2
2007-11-10 23:16 ——— d—–w C:\Documents and Settings\PC USER\Application Data\Podbridge Service
2007-11-10 23:15 ——— d—–w C:\Program Files\RSSoft
2007-11-10 23:14 ——— d—–w C:\Program Files\Steam
2007-11-10 02:15 ——— d—–w C:\Program Files\LimeWire
2007-11-10 01:22 ——— d—–w C:\Program Files\iolo
2007-11-10 00:02 ——— d—–w C:\Documents and Settings\All Users\Application Data\iolo
2007-11-09 22:32 ——— d—–w C:\Documents and Settings\PC USER\Application Data\BitTorrent
2007-11-09 12:06 ——— d—–w C:\Program Files\Image-Line
2007-11-09 12:03 ——— d—–w C:\Program Files\VSTplugins
2007-11-09 10:58 278,538 —-a-w C:\WINDOWS\Fonts\Setup.exe
2007-11-09 04:42 ——— d—–w C:\Program Files\DivX
2007-10-25 16:05 94,416 —-a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-10-25 16:05 93,264 -c–a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-10-25 16:03 23,152 —-a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-10-25 16:01 42,912 —-a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-10-25 15:58 26,624 —-a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2007-08-01 14:03 6,049 —-a-w C:\Program Files\musicmaker.ini
2007-08-01 14:03 582 —-a-w C:\Program Files\crm.dat
2007-03-29 12:55 20,163 —ha-w C:\Program Files\MusicMaker.GID
2007-03-29 12:51 901 —-a-w C:\Program Files\reinstall3rdParty.ini
2007-03-29 12:51 674 —-a-w C:\Program Files\unwise.ini
2007-03-29 12:51 344,829 -c–a-w C:\Program Files\INSTALL.LOG
2007-03-29 12:51 202 —-a-w C:\Program Files\Validation.ini
2007-03-29 12:51 12,812 -c–a-w C:\Program Files\register.rtf
2007-03-29 12:25 10,874,880 —-a-w C:\Program Files\musicmaker.exe.CiM
2007-03-29 12:25 10,874,880 —-a-w C:\Program Files\musicmaker.exe
2007-03-29 12:15 19,651 -c–a-w C:\Program Files\license.txt
2006-06-15 03:56 4,272 —-a-w C:\Program Files\e-mode.ini
2006-06-13 09:57 17,408 —-a-w C:\Program Files\keygen.exe
2006-05-12 00:32 269,159 —-a-w C:\Program Files\addoninstall.exe
2006-04-24 23:08 8,637 -c–a-w C:\Program Files\order.rtf
2006-03-22 04:23 176,128 —-a-w C:\Program Files\unwise.exe
2006-02-26 22:43 24,576 —-a-w C:\Program Files\Validation.exe
2005-11-14 01:59 4,839 —-a-w C:\Program Files\uninstall.ini
2005-11-07 01:04 10,874,880 —-a-w C:\Program Files\musicmaker.exe.BAK
2005-11-02 07:56 3,822 -c–a-w C:\Program Files\e-mode-upgradedlg-exit.rtf
2005-11-02 07:56 3,822 -c–a-w C:\Program Files\e-mode-upgradedialog.rtf
2005-11-01 07:17 15,032 —-a-w C:\Program Files\crack.exe
2005-10-24 00:19 418 —-a-w C:\Program Files\Install.cfg
2005-10-24 00:17 2,138 -c–a-w C:\Program Files\mp3encoder_upgrade.rtf
2005-10-11 02:39 4,609 —-a-w C:\Program Files\musicmaker.cnt
2005-10-11 02:39 4,018,365 —-a-w C:\Program Files\musicmaker.hlp
2005-09-28 23:22 3,358 -c–a-w C:\Program Files\support.rtf
2005-09-01 21:57 81,920 -c–a-w C:\Program Files\MagixOFA-uk.dll
2005-09-01 21:56 618,496 —-a-w C:\Program Files\MagixOFA.dll
2005-08-31 02:59 471,040 —-a-w C:\Program Files\Mxtlc.dll
2005-08-22 05:40 81,920 —-a-w C:\Program Files\unwise.adf
2005-08-22 05:26 176,128 —-a-w C:\Program Files\instslct.exe
2005-08-15 03:30 237,568 —-a-w C:\Program Files\Mxautoupdate.dll
2005-08-01 03:40 442,368 —-a-w C:\Program Files\Mfl.dll
2005-06-22 03:42 128,512 —-a-w C:\Program Files\uninstall.exe
2005-06-19 20:30 225,327 —-a-w C:\Program Files\Tts.dll
2005-05-20 02:10 192,512 —-a-w C:\Program Files\reinstall3rdParty.exe
2004-10-22 04:41 118,784 —-a-w C:\Program Files\Zipdll.dll
2004-10-18 05:15 212,992 —-a-w C:\Program Files\eModeUpgradeDlg.dll
2004-04-15 03:48 32,768 -c–a-w C:\Program Files\MagixUpdater.exe
2003-10-19 23:29 49,152 —-a-w C:\Program Files\Mdll32.dll
2003-04-02 23:09 49,152 —-a-w C:\Program Files\Cpuinf32.dll
2003-02-19 20:51 28,672 —-a-w C:\Program Files\Hhwmprxy.dll
2002-12-10 22:58 60,416 —-a-w C:\Program Files\Dsetup.dll
2002-09-11 21:39 392,704 —-a-w C:\Program Files\LFCMP13n.DLL
2002-09-11 21:36 445,952 —-a-w C:\Program Files\Ltimg13n.dll
2002-09-11 21:36 265,728 —-a-w C:\Program Files\Ltdis13n.dll
2002-09-11 21:36 205,312 —-a-w C:\Program Files\Ltefx13n.dll
2002-09-11 21:36 139,264 —-a-w C:\Program Files\Ltfil13n.dll
2002-09-11 21:35 445,440 —-a-w C:\Program Files\Ltkrn13n.dll
2002-08-21 22:30 10,593 -c–a-w C:\Program Files\Soundpools.dat
2002-06-24 00:00 86,016 —-a-w C:\Program Files\Samsig.dll
2001-08-30 05:29 122,880 —-a-w C:\Program Files\Hhwmprxy7.dll
2001-06-13 23:16 667,648 —-a-w C:\Program Files\Mumaipl.dll
2001-05-10 05:26 638,976 —-a-w C:\Program Files\Playriplpx.dll
2001-05-10 05:26 20,480 —-a-w C:\Program Files\Playripl.dll
2000-08-17 22:57 28,672 —-a-w C:\Program Files\Hhrashlp.dll
2000-08-10 07:28 93,937 —-a-w C:\Program Files\Mp3util.dll
2000-05-01 23:00 508,928 —-a-w C:\Program Files\Rmbe3260.dll
2000-05-01 23:00 379,904 —-a-w C:\Program Files\Pngu3264.dll
2000-04-11 03:53 90,112 —-a-w C:\Program Files\Dac37.dll
1999-12-10 01:00 431,376 —-a-w C:\Program Files\riched20.dll
1999-02-08 22:46 137,728 —-a-w C:\Program Files\Ijl10.dll
1999-01-04 12:00 401,484 —-a-w C:\Program Files\Msvcrtd.dll
1998-11-05 15:07 102,400 —-a-w C:\Program Files\Rn5c3260.dll
1998-09-24 12:00 929,844 -c–a-w C:\Program Files\Mfc42d.dll
1998-03-26 01:00 229,888 —-a-w C:\Program Files\Qtmlclient.dll
1997-12-21 13:30 94,208 —-a-w C:\Program Files\Unzdll.dll
.

((((((((((((((((((((((((((((( snapshot@2007-11-12_ 8.38.58.59 )))))))))))))))))))))))))))))))))))))))))
.
- 2007-11-11 19:11:42 1,697,672 —-a-w C:\WINDOWS\system32\FNTCACHE.DAT
+ 2007-11-11 21:53:01 1,697,672 —-a-w C:\WINDOWS\system32\FNTCACHE.DAT
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A95B2816-1D7E-4561-A202-68C0DE02353A}]
2007-11-11 03:26 145984 –a—— C:\WINDOWS\system32\uhtlbgit.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BCC73622-F72D-4277-803C-D65565A0947F}]
2007-11-09 23:55 35328 –a—— C:\WINDOWS\system32\iifgdca.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{11A69AE4-FBED-4832-A2BF-45AF82825583}"= C:\WINDOWS\system32\uhtlbgit.dll [2007-11-11 03:26 145984]

[HKEY_CLASSES_ROOT\CLSID\{11A69AE4-FBED-4832-A2BF-45AF82825583}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SiSUSBRG"="C:\WINDOWS\SiSUSBrg.exe" [2002-07-12 23:15]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-10-26 04:20]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 04:43]
"Red Swoosh"="C:\Program Files\RSSoft\RedSwoosh.exe" [2007-02-22 15:13]
"EPSON Stylus Photo R350 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAJP.exe" [2005-05-12 17:00]
"QuickTime Task"="C:\Program Files\QuickTime Alternative\qttask.exe" [2007-02-16 11:54]
"mouseElf"="C:\PROGRA~1\GENIUS~1\mouseElf.exe" [2004-02-24 18:47]
"LogMeIn GUI"="C:\Program Files\LogMeIn\LogMeInSystray.exe" [2006-10-06 20:55]
"MAFWTaskbarApp"="C:\WINDOWS\system32\MAFWTray.exe" [2004-09-27 17:44]
"RegistrySmart"="C:\Program Files\RegistrySmart\RegistrySmart.exe" [2006-08-25 14:01]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50]
"MSConfig"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2006-03-01 01:00]
"SoundMan"="SOUNDMAN.EXE" [2004-11-15 23:20 C:\WINDOWS\SOUNDMAN.EXE]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-04-19 14:26]
"a-squared"="C:\Program Files\a-squared Anti-Malware\a2guard.exe" [2007-11-12 01:16]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-01 01:00]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" [2005-10-28 17:25]
"BitTorrent DNA"="C:\Program Files\BitTorrent_DNA\dna.exe" [2007-08-09 16:25]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce]
"Spyware Doctor"="C:\Program Files\Spyware Doctor\swdoctor.exe" /RM /FS /X

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"MySpaceIM"=C:\Program Files\MySpace\IM\MySpaceIM.exe
"Spyware Doctor"=

C:\Documents and Settings\PC USER\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-03-15 10:25:04]
OpenOffice.org 2.1.lnk - C:\Program Files\OpenOffice.org 2.1\program\quickstart.exe [2006-11-27 16:45:48]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-F400-7760-000000000003}\_SC_Acrobat.exe [2007-03-15 15:52:06]
Adobe Acrobat Synchronizer.lnk - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe [2006-10-23 00:01:50]
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-03-15 10:25:04]
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 01:48:20]
Adobe Reader Synchronizer.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 00:01:50]
Image Transfer.lnk - C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe [2007-07-05 19:06:30]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{BCC73622-F72D-4277-803C-D65565A0947F}"= C:\WINDOWS\system32\iifgdca.dll [2007-11-09 23:55 35328]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\iifgdca]
iifgdca.dll 2007-11-09 23:55 35328 C:\WINDOWS\system32\iifgdca.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
LMIinit.dll 2006-10-06 20:56 11504 C:\WINDOWS\system32\LMIinit.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\uhtlbgit]
uhtlbgit.dll 2007-11-11 03:26 145984 C:\WINDOWS\system32\uhtlbgit.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\system32\gebyx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"C:\Program Files\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MySpaceIM]
C:\Program Files\MySpace\IM\MySpaceIM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Podbridge Launcher]
"C:\Program Files\PodBridge\Podbridge launcher.exe" /AutoRun

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SRFirstRun]
rundll32 srclient.dll,CreateFirstRunRp

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
"c:\progra~1\steam\steam.exe" -silent

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinAble]
C:\Program Files\WinAble\winable.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Bonjour Service"=2 (0x2)
"iPod Service"=3 (0x3)
"PnkBstrA"=2 (0x2)
"ose"=3 (0x3)
"IDriverT"=3 (0x3)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Acrobat Assistant 8.0"="C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"

R0 SiSRaid;SiSRaid;C:\WINDOWS\system32\DRIVERS\SiSRaid.sys
R0 sonypvl2;sonypvl2;C:\WINDOWS\system32\drivers\sonypvl2.sys
R1 sonypvf2;sonypvf2;C:\WINDOWS\system32\drivers\sonypvf2.sys
R1 sonypvt2;sonypvt2;C:\WINDOWS\system32\drivers\sonypvt2.sys
S1 oreans32;oreans32;\??\C:\WINDOWS\system32\drivers\oreans32.sys
S2 LMIInfo;LogMeIn Kernel Information Provider;\??\C:\Program Files\LogMeIn\RaInfo.sys
S3 bbcap;bbcap;C:\WINDOWS\system32\DRIVERS\bbcap.sys
S3 genmcmn;Genius Mouse Driver;C:\WINDOWS\system32\DRIVERS\gmfiltr.sys
S3 genmcmnUSB;Genius USB Mouse Driver;C:\WINDOWS\system32\DRIVERS\gflmouhid.sys
S3 LMImirr;LMImirr;C:\WINDOWS\system32\DRIVERS\LMImirr.sys
S3 sonypvs1;Sony Digital Imaging Video2;C:\WINDOWS\system32\DRIVERS\sonypvs1.sys

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\Shell\AutoRun\command - E:\ierunner.exe

.
Contents of the 'Scheduled Tasks' folder
"2007-08-13 01:25:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2007-11-10 14:30:37 C:\WINDOWS\Tasks\RegistrySmart Scheduled Scan.job"
- C:\Program Files\RegistrySmart\RegistrySmart.exe
.
**************************************************************************

catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-12 11:13:29
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-12 11:17:20 - machine was rebooted
C:\ComboFix2.txt … 2007-11-12 10:27
C:\ComboFix3.txt … 2007-11-12 08:39
.
— E O F —



Logfile of HijackThis v1.99.1
Scan saved at 11:31:28 a.m., on 12/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {A95B2816-1D7E-4561-A202-68C0DE02353A} - C:\WINDOWS\system32\uhtlbgit.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: (no name) - {BCC73622-F72D-4277-803C-D65565A0947F} - C:\WINDOWS\system32\iifgdca.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdmcks.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Security Toolbar - {11A69AE4-FBED-4832-A2BF-45AF82825583} - C:\WINDOWS\system32\uhtlbgit.dll
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [Red Swoosh] C:\Program Files\RSSoft\RedSwoosh.exe /S
O4 - HKLM\..\Run: [EPSON Stylus Photo R350 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAJP.EXE /P30 "EPSON Stylus Photo R350 Series" /O6 "USB001" /M "Stylus Photo R350"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime Alternative\qttask.exe" -atboottime
O4 - HKLM\..\Run: [mouseElf] C:\PROGRA~1\GENIUS~1\mouseElf.exe
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\LogMeInSystray.exe"
O4 - HKLM\..\Run: [MAFWTaskbarApp] C:\WINDOWS\system32\MAFWTray.exe
O4 - HKLM\..\Run: [RegistrySmart] "C:\Program Files\RegistrySmart\RegistrySmart.exe" -boot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [a-squared] "C:\Program Files\a-squared Anti-Malware\a2guard.exe"
O4 - HKLM\..\RunOnce: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /RM /FS /X
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\BitTorrent_DNA\dna.exe"
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: OpenOffice.org 2.1.lnk = C:\Program Files\OpenOffice.org 2.1\program\quickstart.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Adobe Acrobat Synchronizer.lnk = C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Image Transfer.lnk = ?
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O20 - Winlogon Notify: iifgdca - C:\WINDOWS\SYSTEM32\iifgdca.dll
O20 - Winlogon Notify: LMIinit - C:\WINDOWS\SYSTEM32\LMIinit.dll
O20 - Winlogon Notify: uhtlbgit - C:\WINDOWS\SYSTEM32\uhtlbgit.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Emsi Software GmbH - C:\Program Files\a-squared Anti-Malware\a2service.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe

The good news is windows is now logging in but still cant get rid of the popups and false system error messages, here are the files.

ComboFix 07-11-08.1 - PC USER 2007-11-15 13:33:37.9 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1590 [GMT 13:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
.

Unable to gain System Privileges

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Start Menu\Live Safety Center.lnk
C:\Documents and Settings\All Users\Start Menu\Online Security Guide.lnk
C:\Documents and Settings\PC USER\Desktop\Live Safety Center.lnk
C:\Documents and Settings\PC USER\Desktop\Online Security Guide.lnk
C:\Documents and Settings\PC USER\Favorites\Online Security Guide.lnk
C:\WINDOWS\system32\prqss.ini
C:\WINDOWS\system32\prqss.ini2
C:\WINDOWS\system32\ssqrp.dll
C:\WINDOWS\system32\uhtlbgit.dllbox

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
——-\LEGACY_DOMAINSERVICE
——-\DomainService


((((((((((((((((((((((((( Files Created from 2007-10-15 to 2007-11-15 )))))))))))))))))))))))))))))))
.

2007-11-15 13:27 85,056 –a—— C:\WINDOWS\system32\gebmavkh.dll
2007-11-15 13:27 79,424 –a—— C:\WINDOWS\system32\qlhvpitv.dll
2007-11-15 13:24 71,232 –a—— C:\WINDOWS\system32\dhxrkuve.exe
2007-11-14 19:36 20,992 –a—— C:\WINDOWS\system32\drivers\RTL8139.sys
2007-11-14 19:25 24,661 –a—— C:\WINDOWS\system32\spxcoins.dll
2007-11-14 19:25 24,661 –a–c— C:\WINDOWS\system32\dllcache\spxcoins.dll
2007-11-14 19:25 13,312 –a—— C:\WINDOWS\system32\irclass.dll
2007-11-14 19:25 13,312 –a–c— C:\WINDOWS\system32\dllcache\irclass.dll
2007-11-14 02:14 674,600 –a—— C:\WINDOWS\system32\pbsvc.exe
2007-11-14 02:14 22,328 –a—— C:\Documents and Settings\PC USER\Application Data\PnkBstrK.sys
2007-11-14 00:41 d——– C:\avast report files
2007-11-13 23:47 801,144 –a—— C:\WINDOWS\system32\aswBoot.exe
2007-11-13 23:47 95,608 –a—— C:\WINDOWS\system32\AvastSS.scr
2007-11-13 23:47 94,416 –a—— C:\WINDOWS\system32\drivers\aswmon2.sys
2007-11-13 23:47 92,848 –a—— C:\WINDOWS\system32\drivers\aswmon.sys
2007-11-13 23:47 42,912 –a—— C:\WINDOWS\system32\drivers\aswTdi.sys
2007-11-13 23:47 26,624 –a—— C:\WINDOWS\system32\drivers\aavmker4.sys
2007-11-13 23:47 23,152 –a—— C:\WINDOWS\system32\drivers\aswRdr.sys
2007-11-13 22:20 d——– C:\Documents and Settings\PC USER\Application Data\Uniblue
2007-11-12 11:51 d——– C:\Documents and Settings\PC USER\DoctorWeb
2007-11-12 10:06 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-11-12 01:06 d——– C:\Program Files\a-squared Anti-Malware
2007-11-11 23:18 d——– C:\Documents and Settings\All Users\Application Data\Prevx
2007-11-11 22:44 664 –a—— C:\WINDOWS\system32\d3d9caps.dat
2007-11-11 21:19 d——– C:\Program Files\WhatsRunning
2007-11-11 21:10 88,128 –a—— C:\WINDOWS\system32\mrdkbhmt.dll
2007-11-11 21:07 79,936 –a—— C:\WINDOWS\system32\xnuknkkv.dll
2007-11-11 17:55 552 –a—— C:\WINDOWS\system32\d3d8caps.dat
2007-11-11 16:12 331,776 –a—— C:\WINDOWS\system32\wpdmtpdr.dll
2007-11-11 16:12 331,264 –a—— C:\WINDOWS\system32\wpdsp.dll
2007-11-11 16:12 114,176 –a—— C:\WINDOWS\system32\wpdmtp.dll
2007-11-11 16:12 66,560 –a—— C:\WINDOWS\system32\wpdmtpus.dll
2007-11-11 16:12 18,944 –a—— C:\WINDOWS\system32\drivers\wpdusb.sys
2007-11-11 16:12 10,752 –a—— C:\WINDOWS\system32\wpdtrace.dll
2007-11-11 16:11 1,512,448 –a—— C:\WINDOWS\system32\WMVADVE.DLL
2007-11-11 16:11 1,218,808 –a—— C:\WINDOWS\system32\wmvadvd.dll
2007-11-11 16:11 335,872 –a—— C:\WINDOWS\system32\WMDRMdev.dll
2007-11-11 16:11 290,816 –a—— C:\WINDOWS\system32\WMDRMNet.dll
2007-11-11 16:11 61,952 –a—— C:\WINDOWS\system32\wpdconns.dll
2007-11-11 16:11 47,104 –a—— C:\WINDOWS\system32\uwdf.exe
2007-11-11 16:11 38,912 –a—— C:\WINDOWS\system32\wpd_ci.dll
2007-11-11 16:11 38,912 –a—— C:\WINDOWS\system32\wdfmgr.exe
2007-11-11 16:11 15,872 –a—— C:\WINDOWS\system32\wdfapi.dll
2007-11-11 15:24 d——– C:\Documents and Settings\Administrator.MARK-C9D0B9D2AC.001\Application Data\PC Tools
2007-11-11 12:42 d——– C:\Program Files\Spyware Doctor
2007-11-11 12:42 d——– C:\Documents and Settings\PC USER\Application Data\PC Tools
2007-11-11 12:42 51,072 –a—— C:\WINDOWS\system32\drivers\ikhlayer.sys
2007-11-11 12:42 30,592 –a—— C:\WINDOWS\system32\drivers\ikhfile.sys
2007-11-11 12:29 626,688 –a—— C:\WINDOWS\system32\msvcr80.dll
2007-11-11 12:16 36,352 –a—— C:\WINDOWS\system32\pmnnkll.dll
2007-11-11 04:19 d——– C:\WINDOWS\pss
2007-11-11 03:35 85,056 –a—— C:\WINDOWS\system32\mgwbytuc.dll
2007-11-11 03:32 81,472 –a—— C:\WINDOWS\system32\fgnfyfqn.dll
2007-11-11 03:26 145,984 –a—— C:\WINDOWS\system32\whccsiyp.dll
2007-11-11 03:26 145,984 –a—— C:\WINDOWS\system32\uhtlbgit.dll
2007-11-10 16:59 d——– C:\Documents and Settings\All Users\Application Data\nView_Profiles
2007-11-10 15:20 d——– C:\Program Files\Lavasoft
2007-11-10 15:20 d——– C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-11-10 15:04 d——– C:\Program Files\Common Files\Wise Installation Wizard
2007-11-10 14:28 36,352 –a—— C:\WINDOWS\system32\awtqpom.dll
2007-11-10 12:40 d——– C:\Documents and Settings\Administrator.MARK-C9D0B9D2AC.001\Application Data\iolo
2007-11-10 11:48 d——– C:\Documents and Settings\Administrator.MARK-C9D0B9D2AC.001\Application Data\Allume Systems
2007-11-09 23:58 147,456 –a—— C:\WINDOWS\system32\vbzip10.dll
2007-11-09 23:55 35,328 –a—— C:\WINDOWS\system32\iifgdca.dll
2007-11-09 23:55 134 –a—— C:\n.bat
2007-11-09 23:55 0 –a—— C:\x.dat
2007-11-09 23:54 0 –a—— C:\z.dat
2007-11-07 15:20 22,328 –a—— C:\WINDOWS\system32\drivers\PnkBstrK.sys
2007-11-07 15:19 107,832 –a—— C:\WINDOWS\system32\PnkBstrB.exe
2007-11-07 15:19 66,872 –a—— C:\WINDOWS\system32\PnkBstrA.exe
2007-10-20 13:56 1,044,480 –a—— C:\WINDOWS\system32\libdivx.dll
2007-10-20 13:56 524,288 –a—— C:\WINDOWS\system32\DivXsm.exe
2007-10-20 13:56 200,704 –a—— C:\WINDOWS\system32\ssldivx.dll
2007-10-20 13:54 823,296 –a—— C:\WINDOWS\system32\divx_xx0c.dll
2007-10-20 13:54 823,296 –a—— C:\WINDOWS\system32\divx_xx07.dll
2007-10-20 13:54 802,816 –a—— C:\WINDOWS\system32\divx_xx11.dll
2007-10-20 13:54 739,840 –a—— C:\WINDOWS\system32\DivX.dll
2007-10-18 22:06 156,992 –a—— C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2007-10-18 22:03 344,064 –a—— C:\WINDOWS\system32\dpus11.dll
2007-10-18 22:03 294,912 –a—— C:\WINDOWS\system32\dpu11.dll
2007-10-18 22:03 294,912 –a—— C:\WINDOWS\system32\dpu10.dll
2007-10-18 22:03 57,344 –a—— C:\WINDOWS\system32\dpv11.dll
2007-10-18 22:03 53,248 –a—— C:\WINDOWS\system32\dpuGUI10.dll
2007-10-18 22:02 12,288 –a—— C:\WINDOWS\system32\DivXWMPExtType.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-04-28 02:32 ——— d—–w C:\Program Files\Java
2013-04-28 02:03 ——— d—–w C:\Documents and Settings\PC USER\Application Data\iolo
2013-04-28 01:59 ——— d—–w C:\Documents and Settings\LocalService\Application Data\iolo
2007-11-14 05:58 ——— d—–w C:\Program Files\Mozilla Firefox2
2007-11-13 14:02 ——— d—–w C:\Documents and Settings\PC USER\Application Data\Free Download Manager
2007-11-13 10:19 ——— d—–w C:\Documents and Settings\PC USER\Application Data\BitTorrent DNA
2007-11-13 09:59 ——— d—–w C:\Program Files\RSSoft
2007-11-13 09:00 ——— d—–w C:\Documents and Settings\PC USER\Application Data\OpenOffice.org2
2007-11-13 07:15 ——— d—–w C:\Program Files\LogMeIn
2007-11-11 09:00 ——— d—–w C:\Program Files\RegistrySmart
2007-11-11 00:06 ——— d—–w C:\Program Files\BOINC
2007-11-10 23:40 ——— d—a-w C:\Documents and Settings\All Users\Application Data\TEMP
2007-11-10 23:16 ——— d—–w C:\Documents and Settings\PC USER\Application Data\Podbridge Service
2007-11-10 23:14 ——— d—–w C:\Program Files\Steam
2007-11-10 02:15 ——— d—–w C:\Program Files\LimeWire
2007-11-10 01:22 ——— d—–w C:\Program Files\iolo
2007-11-10 00:02 ——— d—–w C:\Documents and Settings\All Users\Application Data\iolo
2007-11-09 22:32 ——— d—–w C:\Documents and Settings\PC USER\Application Data\BitTorrent
2007-11-09 12:06 ——— d—–w C:\Program Files\Image-Line
2007-11-09 12:03 ——— d—–w C:\Program Files\VSTplugins
2007-11-09 10:58 278,538 —-a-w C:\WINDOWS\Fonts\Setup.exe
2007-11-09 04:42 ——— d—–w C:\Program Files\DivX
2007-08-01 14:03 6,049 —-a-w C:\Program Files\musicmaker.ini
2007-08-01 14:03 582 —-a-w C:\Program Files\crm.dat
2007-03-29 12:55 20,163 —ha-w C:\Program Files\MusicMaker.GID
2007-03-29 12:51 901 —-a-w C:\Program Files\reinstall3rdParty.ini
2007-03-29 12:51 674 —-a-w C:\Program Files\unwise.ini
2007-03-29 12:51 344,829 -c–a-w C:\Program Files\INSTALL.LOG
2007-03-29 12:51 202 —-a-w C:\Program Files\Validation.ini
2007-03-29 12:51 12,812 -c–a-w C:\Program Files\register.rtf
2007-03-29 12:25 10,874,880 —-a-w C:\Program Files\musicmaker.exe.CiM
2007-03-29 12:25 10,874,880 —-a-w C:\Program Files\musicmaker.exe
2007-03-29 12:15 19,651 -c–a-w C:\Program Files\license.txt
2006-06-15 03:56 4,272 —-a-w C:\Program Files\e-mode.ini
2006-06-13 09:57 17,408 —-a-w C:\Program Files\keygen.exe
2006-05-12 00:32 269,159 —-a-w C:\Program Files\addoninstall.exe
2006-04-24 23:08 8,637 -c–a-w C:\Program Files\order.rtf
2006-03-22 04:23 176,128 —-a-w C:\Program Files\unwise.exe
2006-02-26 22:43 24,576 —-a-w C:\Program Files\Validation.exe
2005-11-14 01:59 4,839 —-a-w C:\Program Files\uninstall.ini
2005-11-07 01:04 10,874,880 —-a-w C:\Program Files\musicmaker.exe.BAK
2005-11-02 07:56 3,822 -c–a-w C:\Program Files\e-mode-upgradedlg-exit.rtf
2005-11-02 07:56 3,822 -c–a-w C:\Program Files\e-mode-upgradedialog.rtf
2005-11-01 07:17 15,032 —-a-w C:\Program Files\crack.exe
2005-10-24 00:19 418 —-a-w C:\Program Files\Install.cfg
2005-10-24 00:17 2,138 -c–a-w C:\Program Files\mp3encoder_upgrade.rtf
2005-10-11 02:39 4,609 —-a-w C:\Program Files\musicmaker.cnt
2005-10-11 02:39 4,018,365 —-a-w C:\Program Files\musicmaker.hlp
2005-09-28 23:22 3,358 -c–a-w C:\Program Files\support.rtf
2005-09-01 21:57 81,920 -c–a-w C:\Program Files\MagixOFA-uk.dll
2005-09-01 21:56 618,496 —-a-w C:\Program Files\MagixOFA.dll
2005-08-31 02:59 471,040 —-a-w C:\Program Files\Mxtlc.dll
2005-08-22 05:40 81,920 —-a-w C:\Program Files\unwise.adf
2005-08-22 05:26 176,128 —-a-w C:\Program Files\instslct.exe
2005-08-15 03:30 237,568 —-a-w C:\Program Files\Mxautoupdate.dll
2005-08-01 03:40 442,368 —-a-w C:\Program Files\Mfl.dll
2005-06-22 03:42 128,512 —-a-w C:\Program Files\uninstall.exe
2005-06-19 20:30 225,327 —-a-w C:\Program Files\Tts.dll
2005-05-20 02:10 192,512 —-a-w C:\Program Files\reinstall3rdParty.exe
2004-10-22 04:41 118,784 —-a-w C:\Program Files\Zipdll.dll
2004-10-18 05:15 212,992 —-a-w C:\Program Files\eModeUpgradeDlg.dll
2004-04-15 03:48 32,768 -c–a-w C:\Program Files\MagixUpdater.exe
2003-10-19 23:29 49,152 —-a-w C:\Program Files\Mdll32.dll
2003-04-02 23:09 49,152 —-a-w C:\Program Files\Cpuinf32.dll
2003-02-19 20:51 28,672 —-a-w C:\Program Files\Hhwmprxy.dll
2002-12-10 22:58 60,416 —-a-w C:\Program Files\Dsetup.dll
2002-09-11 21:39 392,704 —-a-w C:\Program Files\LFCMP13n.DLL
2002-09-11 21:36 445,952 —-a-w C:\Program Files\Ltimg13n.dll
2002-09-11 21:36 265,728 —-a-w C:\Program Files\Ltdis13n.dll
2002-09-11 21:36 205,312 —-a-w C:\Program Files\Ltefx13n.dll
2002-09-11 21:36 139,264 —-a-w C:\Program Files\Ltfil13n.dll
2002-09-11 21:35 445,440 —-a-w C:\Program Files\Ltkrn13n.dll
2002-08-21 22:30 10,593 -c–a-w C:\Program Files\Soundpools.dat
2002-06-24 00:00 86,016 —-a-w C:\Program Files\Samsig.dll
2001-08-30 05:29 122,880 —-a-w C:\Program Files\Hhwmprxy7.dll
2001-06-13 23:16 667,648 —-a-w C:\Program Files\Mumaipl.dll
2001-05-10 05:26 638,976 —-a-w C:\Program Files\Playriplpx.dll
2001-05-10 05:26 20,480 —-a-w C:\Program Files\Playripl.dll
2000-08-17 22:57 28,672 —-a-w C:\Program Files\Hhrashlp.dll
2000-08-10 07:28 93,937 —-a-w C:\Program Files\Mp3util.dll
2000-05-01 23:00 508,928 —-a-w C:\Program Files\Rmbe3260.dll
2000-05-01 23:00 379,904 —-a-w C:\Program Files\Pngu3264.dll
2000-04-11 03:53 90,112 —-a-w C:\Program Files\Dac37.dll
1999-12-10 01:00 431,376 —-a-w C:\Program Files\riched20.dll
1999-02-08 22:46 137,728 —-a-w C:\Program Files\Ijl10.dll
1999-01-04 12:00 401,484 —-a-w C:\Program Files\Msvcrtd.dll
1998-11-05 15:07 102,400 —-a-w C:\Program Files\Rn5c3260.dll
1998-09-24 12:00 929,844 -c–a-w C:\Program Files\Mfc42d.dll
1998-03-26 01:00 229,888 —-a-w C:\Program Files\Qtmlclient.dll
1997-12-21 13:30 94,208 —-a-w C:\Program Files\Unzdll.dll
.

((((((((((((((((((((((((((((( snapshot_2007-11-14_20.21.00.15 )))))))))))))))))))))))))))))))))))))))))
.
- 2005-05-04 02:45:26 209,632 -c–a-w C:\WINDOWS\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe
+ 2005-05-04 01:45:26 209,632 -c—-w C:\WINDOWS\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe
- 2005-05-04 02:45:28 371,936 -c–a-w C:\WINDOWS\$MSI31Uninstall_KB893803v2$\spuninst\updspapi.dll
+ 2005-05-04 01:45:28 371,936 -c—-w C:\WINDOWS\$MSI31Uninstall_KB893803v2$\spuninst\updspapi.dll
- 2006-02-28 12:00:00 2,804,224 -c–a-w C:\WINDOWS\system32\dllcache\msi.dll
+ 2005-05-04 01:45:32 2,890,240 -c–a-w C:\WINDOWS\system32\dllcache\msi.dll
- 2006-02-28 12:00:00 77,312 -c–a-w C:\WINDOWS\system32\dllcache\msiexec.exe
+ 2005-05-04 01:45:36 78,848 -c–a-w C:\WINDOWS\system32\dllcache\msiexec.exe
- 2006-02-28 12:00:00 331,264 -c–a-w C:\WINDOWS\system32\dllcache\msihnd.dll
+ 2005-05-04 01:45:36 271,360 -c–a-w C:\WINDOWS\system32\dllcache\msihnd.dll
- 2006-02-28 12:00:00 884,736 -c–a-w C:\WINDOWS\system32\dllcache\msimsg.dll
+ 2005-05-04 01:45:36 884,736 -c–a-w C:\WINDOWS\system32\dllcache\msimsg.dll
- 2006-02-28 12:00:00 44,032 -c–a-w C:\WINDOWS\system32\dllcache\msisip.dll
+ 2005-05-04 01:45:36 15,360 -c–a-w C:\WINDOWS\system32\dllcache\msisip.dll
- 2006-02-28 12:00:00 36,864 -c–a-w C:\WINDOWS\system32\dllcache\wups.dll
+ 2007-07-30 07:18:40 33,624 -c–a-w C:\WINDOWS\system32\dllcache\wups.dll
- 2006-02-28 12:00:00 2,804,224 —-a-w C:\WINDOWS\system32\msi.dll
+ 2005-05-04 01:45:32 2,890,240 —-a-w C:\WINDOWS\system32\msi.dll
- 2006-02-28 12:00:00 77,312 —-a-w C:\WINDOWS\system32\msiexec.exe
+ 2005-05-04 01:45:36 78,848 —-a-w C:\WINDOWS\system32\msiexec.exe
- 2006-02-28 12:00:00 331,264 —-a-w C:\WINDOWS\system32\msihnd.dll
+ 2005-05-04 01:45:36 271,360 —-a-w C:\WINDOWS\system32\msihnd.dll
- 2006-02-28 12:00:00 884,736 —-a-w C:\WINDOWS\system32\msimsg.dll
+ 2005-05-04 01:45:36 884,736 —-a-w C:\WINDOWS\system32\msimsg.dll
- 2006-02-28 12:00:00 44,032 —-a-w C:\WINDOWS\system32\msisip.dll
+ 2005-05-04 01:45:36 15,360 —-a-w C:\WINDOWS\system32\msisip.dll
- 2007-11-14 06:40:58 58,596 —-a-w C:\WINDOWS\system32\perfc009.dat
+ 2007-11-14 07:24:10 58,596 —-a-w C:\WINDOWS\system32\perfc009.dat
- 2007-11-14 06:40:58 392,296 —-a-w C:\WINDOWS\system32\perfh009.dat
+ 2007-11-14 07:24:10 392,296 —-a-w C:\WINDOWS\system32\perfh009.dat
- 2006-02-28 12:00:00 36,864 —-a-w C:\WINDOWS\system32\wups.dll
+ 2007-07-30 07:18:40 33,624 —-a-w C:\WINDOWS\system32\wups.dll
+ 2007-11-15 00:46:04 16,384 —-atw C:\WINDOWS\TEMP\Perflib_Perfdata_5a0.dat
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8b4e7040-1851-419d-9038-5355b643fe6e}]
2007-11-15 13:27 79424 –a—— C:\WINDOWS\system32\qlhvpitv.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A95B2816-1D7E-4561-A202-68C0DE02353A}]
2007-11-11 03:26 145984 –a—— C:\WINDOWS\system32\uhtlbgit.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BCC73622-F72D-4277-803C-D65565A0947F}]
2007-11-09 23:55 35328 –a—— C:\WINDOWS\system32\iifgdca.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{11A69AE4-FBED-4832-A2BF-45AF82825583}"= C:\WINDOWS\system32\uhtlbgit.dll [2007-11-11 03:26 145984]

[HKEY_CLASSES_ROOT\CLSID\{11A69AE4-FBED-4832-A2BF-45AF82825583}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{11A69AE4-FBED-4832-A2BF-45AF82825583}"= C:\WINDOWS\system32\uhtlbgit.dll [2007-11-11 03:26 145984]

[HKEY_CLASSES_ROOT\CLSID\{11A69AE4-FBED-4832-A2BF-45AF82825583}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 04:43]
"EPSON Stylus Photo R350 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAJP.exe" [2005-05-12 17:00]
"QuickTime Task"="C:\Program Files\QuickTime Alternative\qttask.exe" [2007-02-16 11:54]
"mouseElf"="C:\PROGRA~1\GENIUS~1\mouseElf.exe" [2004-02-24 18:47]
"MAFWTaskbarApp"="C:\WINDOWS\system32\MAFWTray.exe" [2004-09-27 17:44]
"RegistrySmart"="C:\Program Files\RegistrySmart\RegistrySmart.exe" [2006-08-25 14:01]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-04-19 14:26]
"SoundMan"="SOUNDMAN.EXE" [2004-11-15 23:20 C:\WINDOWS\SOUNDMAN.EXE]
"nwiz"="nwiz.exe" [2007-04-19 14:26 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-04-19 14:26]
"2c760616"="C:\WINDOWS\system32\gebmavkh.dll" [2007-11-15 13:27]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" [2005-10-28 17:25]
"Uniblue RegistryBooster 2"="C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe" []
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-01 01:00]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"MySpaceIM"=C:\Program Files\MySpace\IM\MySpaceIM.exe
"Spyware Doctor"=

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-F400-7760-000000000003}\_SC_Acrobat.exe [2007-03-15 15:52:06]
Adobe Acrobat Synchronizer.lnk - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe [2006-10-23 00:01:50]
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-03-15 10:25:04]
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 01:48:20]
Adobe Reader Synchronizer.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 00:01:50]
Image Transfer.lnk - C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe [2007-07-05 19:06:30]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{BCC73622-F72D-4277-803C-D65565A0947F}"= C:\WINDOWS\system32\iifgdca.dll [2007-11-09 23:55 35328]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\iifgdca]
iifgdca.dll 2007-11-09 23:55 35328 C:\WINDOWS\system32\iifgdca.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
LMIinit.dll 2006-10-06 20:56 11504 C:\WINDOWS\system32\LMIinit.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\uhtlbgit]
uhtlbgit.dll 2007-11-11 03:26 145984 C:\WINDOWS\system32\uhtlbgit.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\system32\ssqrp.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"C:\Program Files\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MySpaceIM]
C:\Program Files\MySpace\IM\MySpaceIM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Podbridge Launcher]
"C:\Program Files\PodBridge\Podbridge launcher.exe" /AutoRun

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SRFirstRun]
rundll32 srclient.dll,CreateFirstRunRp

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
"c:\progra~1\steam\steam.exe" -silent

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinAble]
C:\Program Files\WinAble\winable.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Bonjour Service"=2 (0x2)
"iPod Service"=3 (0x3)
"PnkBstrA"=2 (0x2)
"ose"=3 (0x3)
"IDriverT"=3 (0x3)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Acrobat Assistant 8.0"="C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"

R0 SiSRaid;SiSRaid;C:\WINDOWS\system32\DRIVERS\SiSRaid.sys
R0 sonypvl2;sonypvl2;C:\WINDOWS\system32\drivers\sonypvl2.sys
R1 oreans32;oreans32;\??\C:\WINDOWS\system32\drivers\oreans32.sys
R1 sonypvf2;sonypvf2;C:\WINDOWS\system32\drivers\sonypvf2.sys
R1 sonypvt2;sonypvt2;C:\WINDOWS\system32\drivers\sonypvt2.sys
R2 LMIInfo;LogMeIn Kernel Information Provider;\??\C:\Program Files\LogMeIn\RaInfo.sys
R3 bbcap;bbcap;C:\WINDOWS\system32\DRIVERS\bbcap.sys
R3 LMImirr;LMImirr;C:\WINDOWS\system32\DRIVERS\LMImirr.sys
S3 genmcmn;Genius Mouse Driver;C:\WINDOWS\system32\DRIVERS\gmfiltr.sys
S3 genmcmnUSB;Genius USB Mouse Driver;C:\WINDOWS\system32\DRIVERS\gflmouhid.sys
S3 sonypvs1;Sony Digital Imaging Video2;C:\WINDOWS\system32\DRIVERS\sonypvs1.sys

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\Shell\AutoRun\command - E:\Autorun.exe

.
Contents of the 'Scheduled Tasks' folder
"2007-08-13 01:25:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2007-11-15 00:44:36 C:\WINDOWS\Tasks\RegistrySmart Scheduled Scan.job"
- C:\Program Files\RegistrySmart\RegistrySmart.exe
.
**************************************************************************

catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-15 13:48:19
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-15 13:54:28 - machine was rebooted
C:\ComboFix2.txt … 2007-11-14 20:22
C:\ComboFix3.txt … 2007-11-13 12:58
.
— E O F —


Logfile of HijackThis v1.99.1
Scan saved at 1:55:11 p.m., on 15/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\a-squared Anti-Malware\a2service.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAJP.EXE
C:\WINDOWS\system32\MAFWTray.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\acrobat_sl.exe
C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: {e6ef346b-5535-8309-d914-15810407e4b8} - {8b4e7040-1851-419d-9038-5355b643fe6e} - C:\WINDOWS\system32\qlhvpitv.dll
O2 - BHO: (no name) - {A95B2816-1D7E-4561-A202-68C0DE02353A} - C:\WINDOWS\system32\uhtlbgit.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: (no name) - {BCC73622-F72D-4277-803C-D65565A0947F} - C:\WINDOWS\system32\iifgdca.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdmcks.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Security Toolbar - {11A69AE4-FBED-4832-A2BF-45AF82825583} - C:\WINDOWS\system32\uhtlbgit.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [EPSON Stylus Photo R350 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAJP.EXE /P30 "EPSON Stylus Photo R350 Series" /O6 "USB001" /M "Stylus Photo R350"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime Alternative\qttask.exe" -atboottime
O4 - HKLM\..\Run: [mouseElf] C:\PROGRA~1\GENIUS~1\mouseElf.exe
O4 - HKLM\..\Run: [MAFWTaskbarApp] C:\WINDOWS\system32\MAFWTray.exe
O4 - HKLM\..\Run: [RegistrySmart] "C:\Program Files\RegistrySmart\RegistrySmart.exe" -boot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [2c760616] rundll32.exe "C:\WINDOWS\system32\gebmavkh.dll",b
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Adobe Acrobat Synchronizer.lnk = C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Image Transfer.lnk = ?
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O20 - Winlogon Notify: iifgdca - C:\WINDOWS\SYSTEM32\iifgdca.dll
O20 - Winlogon Notify: LMIinit - C:\WINDOWS\SYSTEM32\LMIinit.dll
O20 - Winlogon Notify: uhtlbgit - C:\WINDOWS\SYSTEM32\uhtlbgit.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Emsi Software GmbH - C:\Program Files\a-squared Anti-Malware\a2service.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe

hi, dobne as requested, but on start up get 2 warnings, one for cant find "null" and the other is a crytical system wanring popup refering to spyware cyberlog-x

here are the logs

ComboFix 07-11-08.1 - PC USER 2007-11-15 15:25:51.10 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1592 [GMT 13:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\PC USER\Desktop\CFScript.txt
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\qtutv.ini
C:\WINDOWS\system32\qtutv.ini2
C:\WINDOWS\system32\uhtlbgit.dllbox
C:\WINDOWS\system32\vtutq.dll

.
((((((((((((((((((((((((( Files Created from 2007-10-15 to 2007-11-15 )))))))))))))))))))))))))))))))
.

2007-11-15 13:27 85,056 –a—— C:\WINDOWS\system32\gebmavkh.dll
2007-11-15 13:27 79,424 –a—— C:\WINDOWS\system32\qlhvpitv.dll
2007-11-15 13:24 71,232 –a—— C:\WINDOWS\system32\dhxrkuve.exe
2007-11-14 19:36 20,992 –a—— C:\WINDOWS\system32\drivers\RTL8139.sys
2007-11-14 19:25 24,661 –a—— C:\WINDOWS\system32\spxcoins.dll
2007-11-14 19:25 24,661 –a–c— C:\WINDOWS\system32\dllcache\spxcoins.dll
2007-11-14 19:25 13,312 –a—— C:\WINDOWS\system32\irclass.dll
2007-11-14 19:25 13,312 –a–c— C:\WINDOWS\system32\dllcache\irclass.dll
2007-11-14 02:14 674,600 –a—— C:\WINDOWS\system32\pbsvc.exe
2007-11-14 02:14 22,328 –a—— C:\Documents and Settings\PC USER\Application Data\PnkBstrK.sys
2007-11-14 00:41 d——– C:\avast report files
2007-11-13 23:47 801,144 –a—— C:\WINDOWS\system32\aswBoot.exe
2007-11-13 23:47 95,608 –a—— C:\WINDOWS\system32\AvastSS.scr
2007-11-13 23:47 94,416 –a—— C:\WINDOWS\system32\drivers\aswmon2.sys
2007-11-13 23:47 92,848 –a—— C:\WINDOWS\system32\drivers\aswmon.sys
2007-11-13 23:47 42,912 –a—— C:\WINDOWS\system32\drivers\aswTdi.sys
2007-11-13 23:47 26,624 –a—— C:\WINDOWS\system32\drivers\aavmker4.sys
2007-11-13 23:47 23,152 –a—— C:\WINDOWS\system32\drivers\aswRdr.sys
2007-11-13 22:20 d——– C:\Documents and Settings\PC USER\Application Data\Uniblue
2007-11-12 11:51 d——– C:\Documents and Settings\PC USER\DoctorWeb
2007-11-12 10:06 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-11-12 01:06 d——– C:\Program Files\a-squared Anti-Malware
2007-11-11 23:18 d——– C:\Documents and Settings\All Users\Application Data\Prevx
2007-11-11 22:44 664 –a—— C:\WINDOWS\system32\d3d9caps.dat
2007-11-11 21:19 d——– C:\Program Files\WhatsRunning
2007-11-11 21:10 88,128 –a—— C:\WINDOWS\system32\mrdkbhmt.dll
2007-11-11 21:07 79,936 –a—— C:\WINDOWS\system32\xnuknkkv.dll
2007-11-11 17:55 552 –a—— C:\WINDOWS\system32\d3d8caps.dat
2007-11-11 16:12 331,776 –a—— C:\WINDOWS\system32\wpdmtpdr.dll
2007-11-11 16:12 331,264 –a—— C:\WINDOWS\system32\wpdsp.dll
2007-11-11 16:12 114,176 –a—— C:\WINDOWS\system32\wpdmtp.dll
2007-11-11 16:12 66,560 –a—— C:\WINDOWS\system32\wpdmtpus.dll
2007-11-11 16:12 18,944 –a—— C:\WINDOWS\system32\drivers\wpdusb.sys
2007-11-11 16:12 10,752 –a—— C:\WINDOWS\system32\wpdtrace.dll
2007-11-11 16:11 1,512,448 –a—— C:\WINDOWS\system32\WMVADVE.DLL
2007-11-11 16:11 1,218,808 –a—— C:\WINDOWS\system32\wmvadvd.dll
2007-11-11 16:11 335,872 –a—— C:\WINDOWS\system32\WMDRMdev.dll
2007-11-11 16:11 290,816 –a—— C:\WINDOWS\system32\WMDRMNet.dll
2007-11-11 16:11 61,952 –a—— C:\WINDOWS\system32\wpdconns.dll
2007-11-11 16:11 47,104 –a—— C:\WINDOWS\system32\uwdf.exe
2007-11-11 16:11 38,912 –a—— C:\WINDOWS\system32\wpd_ci.dll
2007-11-11 16:11 38,912 –a—— C:\WINDOWS\system32\wdfmgr.exe
2007-11-11 16:11 15,872 –a—— C:\WINDOWS\system32\wdfapi.dll
2007-11-11 15:24 d——– C:\Documents and Settings\Administrator.MARK-C9D0B9D2AC.001\Application Data\PC Tools
2007-11-11 12:42 d——– C:\Program Files\Spyware Doctor
2007-11-11 12:42 d——– C:\Documents and Settings\PC USER\Application Data\PC Tools
2007-11-11 12:42 51,072 –a—— C:\WINDOWS\system32\drivers\ikhlayer.sys
2007-11-11 12:42 30,592 –a—— C:\WINDOWS\system32\drivers\ikhfile.sys
2007-11-11 12:29 626,688 –a—— C:\WINDOWS\system32\msvcr80.dll
2007-11-11 12:16 36,352 –a—— C:\WINDOWS\system32\pmnnkll.dll
2007-11-11 04:19 d——– C:\WINDOWS\pss
2007-11-11 03:35 85,056 –a—— C:\WINDOWS\system32\mgwbytuc.dll
2007-11-11 03:32 81,472 –a—— C:\WINDOWS\system32\fgnfyfqn.dll
2007-11-11 03:26 145,984 –a—— C:\WINDOWS\system32\whccsiyp.dll
2007-11-11 03:26 145,984 –a—— C:\WINDOWS\system32\uhtlbgit.dll
2007-11-10 16:59 d——– C:\Documents and Settings\All Users\Application Data\nView_Profiles
2007-11-10 15:20 d——– C:\Program Files\Lavasoft
2007-11-10 15:20 d——– C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-11-10 15:04 d——– C:\Program Files\Common Files\Wise Installation Wizard
2007-11-10 14:28 36,352 –a—— C:\WINDOWS\system32\awtqpom.dll
2007-11-10 12:40 d——– C:\Documents and Settings\Administrator.MARK-C9D0B9D2AC.001\Application Data\iolo
2007-11-10 11:48 d——– C:\Documents and Settings\Administrator.MARK-C9D0B9D2AC.001\Application Data\Allume Systems
2007-11-09 23:58 147,456 –a—— C:\WINDOWS\system32\vbzip10.dll
2007-11-09 23:55 35,328 –a—— C:\WINDOWS\system32\iifgdca.dll
2007-11-09 23:55 134 –a—— C:\n.bat
2007-11-09 23:55 0 –a—— C:\x.dat
2007-11-09 23:54 0 –a—— C:\z.dat
2007-11-07 15:20 22,328 –a—— C:\WINDOWS\system32\drivers\PnkBstrK.sys
2007-11-07 15:19 107,832 –a—— C:\WINDOWS\system32\PnkBstrB.exe
2007-11-07 15:19 66,872 –a—— C:\WINDOWS\system32\PnkBstrA.exe
2007-10-20 13:56 1,044,480 –a—— C:\WINDOWS\system32\libdivx.dll
2007-10-20 13:56 524,288 –a—— C:\WINDOWS\system32\DivXsm.exe
2007-10-20 13:56 200,704 –a—— C:\WINDOWS\system32\ssldivx.dll
2007-10-20 13:54 823,296 –a—— C:\WINDOWS\system32\divx_xx0c.dll
2007-10-20 13:54 823,296 –a—— C:\WINDOWS\system32\divx_xx07.dll
2007-10-20 13:54 802,816 –a—— C:\WINDOWS\system32\divx_xx11.dll
2007-10-20 13:54 739,840 –a—— C:\WINDOWS\system32\DivX.dll
2007-10-18 22:06 156,992 –a—— C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2007-10-18 22:03 344,064 –a—— C:\WINDOWS\system32\dpus11.dll
2007-10-18 22:03 294,912 –a—— C:\WINDOWS\system32\dpu11.dll
2007-10-18 22:03 294,912 –a—— C:\WINDOWS\system32\dpu10.dll
2007-10-18 22:03 57,344 –a—— C:\WINDOWS\system32\dpv11.dll
2007-10-18 22:03 53,248 –a—— C:\WINDOWS\system32\dpuGUI10.dll
2007-10-18 22:02 12,288 –a—— C:\WINDOWS\system32\DivXWMPExtType.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-04-28 02:32 ——— d—–w C:\Program Files\Java
2013-04-28 02:03 ——— d—–w C:\Documents and Settings\PC USER\Application Data\iolo
2013-04-28 01:59 ——— d—–w C:\Documents and Settings\LocalService\Application Data\iolo
2007-11-14 05:58 ——— d—–w C:\Program Files\Mozilla Firefox2
2007-11-13 14:02 ——— d—–w C:\Documents and Settings\PC USER\Application Data\Free Download Manager
2007-11-13 10:19 ——— d—–w C:\Documents and Settings\PC USER\Application Data\BitTorrent DNA
2007-11-13 09:59 ——— d—–w C:\Program Files\RSSoft
2007-11-13 09:00 ——— d—–w C:\Documents and Settings\PC USER\Application Data\OpenOffice.org2
2007-11-13 07:15 ——— d—–w C:\Program Files\LogMeIn
2007-11-11 09:00 ——— d—–w C:\Program Files\RegistrySmart
2007-11-11 00:06 ——— d—–w C:\Program Files\BOINC
2007-11-10 23:40 ——— d—a-w C:\Documents and Settings\All Users\Application Data\TEMP
2007-11-10 23:16 ——— d—–w C:\Documents and Settings\PC USER\Application Data\Podbridge Service
2007-11-10 23:14 ——— d—–w C:\Program Files\Steam
2007-11-10 02:15 ——— d—–w C:\Program Files\LimeWire
2007-11-10 01:22 ——— d—–w C:\Program Files\iolo
2007-11-10 00:02 ——— d—–w C:\Documents and Settings\All Users\Application Data\iolo
2007-11-09 22:32 ——— d—–w C:\Documents and Settings\PC USER\Application Data\BitTorrent
2007-11-09 12:06 ——— d—–w C:\Program Files\Image-Line
2007-11-09 12:03 ——— d—–w C:\Program Files\VSTplugins
2007-11-09 10:58 278,538 —-a-w C:\WINDOWS\Fonts\Setup.exe
2007-11-09 04:42 ——— d—–w C:\Program Files\DivX
2007-08-01 14:03 6,049 —-a-w C:\Program Files\musicmaker.ini
2007-08-01 14:03 582 —-a-w C:\Program Files\crm.dat
2007-03-29 12:55 20,163 —ha-w C:\Program Files\MusicMaker.GID
2007-03-29 12:51 901 —-a-w C:\Program Files\reinstall3rdParty.ini
2007-03-29 12:51 674 —-a-w C:\Program Files\unwise.ini
2007-03-29 12:51 344,829 -c–a-w C:\Program Files\INSTALL.LOG
2007-03-29 12:51 202 —-a-w C:\Program Files\Validation.ini
2007-03-29 12:51 12,812 -c–a-w C:\Program Files\register.rtf
2007-03-29 12:25 10,874,880 —-a-w C:\Program Files\musicmaker.exe.CiM
2007-03-29 12:25 10,874,880 —-a-w C:\Program Files\musicmaker.exe
2007-03-29 12:15 19,651 -c–a-w C:\Program Files\license.txt
2006-06-15 03:56 4,272 —-a-w C:\Program Files\e-mode.ini
2006-06-13 09:57 17,408 —-a-w C:\Program Files\keygen.exe
2006-05-12 00:32 269,159 —-a-w C:\Program Files\addoninstall.exe
2006-04-24 23:08 8,637 -c–a-w C:\Program Files\order.rtf
2006-03-22 04:23 176,128 —-a-w C:\Program Files\unwise.exe
2006-02-26 22:43 24,576 —-a-w C:\Program Files\Validation.exe
2005-11-14 01:59 4,839 —-a-w C:\Program Files\uninstall.ini
2005-11-07 01:04 10,874,880 —-a-w C:\Program Files\musicmaker.exe.BAK
2005-11-02 07:56 3,822 -c–a-w C:\Program Files\e-mode-upgradedlg-exit.rtf
2005-11-02 07:56 3,822 -c–a-w C:\Program Files\e-mode-upgradedialog.rtf
2005-11-01 07:17 15,032 —-a-w C:\Program Files\crack.exe
2005-10-24 00:19 418 —-a-w C:\Program Files\Install.cfg
2005-10-24 00:17 2,138 -c–a-w C:\Program Files\mp3encoder_upgrade.rtf
2005-10-11 02:39 4,609 —-a-w C:\Program Files\musicmaker.cnt
2005-10-11 02:39 4,018,365 —-a-w C:\Program Files\musicmaker.hlp
2005-09-28 23:22 3,358 -c–a-w C:\Program Files\support.rtf
2005-09-01 21:57 81,920 -c–a-w C:\Program Files\MagixOFA-uk.dll
2005-09-01 21:56 618,496 —-a-w C:\Program Files\MagixOFA.dll
2005-08-31 02:59 471,040 —-a-w C:\Program Files\Mxtlc.dll
2005-08-22 05:40 81,920 —-a-w C:\Program Files\unwise.adf
2005-08-22 05:26 176,128 —-a-w C:\Program Files\instslct.exe
2005-08-15 03:30 237,568 —-a-w C:\Program Files\Mxautoupdate.dll
2005-08-01 03:40 442,368 —-a-w C:\Program Files\Mfl.dll
2005-06-22 03:42 128,512 —-a-w C:\Program Files\uninstall.exe
2005-06-19 20:30 225,327 —-a-w C:\Program Files\Tts.dll
2005-05-20 02:10 192,512 —-a-w C:\Program Files\reinstall3rdParty.exe
2004-10-22 04:41 118,784 —-a-w C:\Program Files\Zipdll.dll
2004-10-18 05:15 212,992 —-a-w C:\Program Files\eModeUpgradeDlg.dll
2004-04-15 03:48 32,768 -c–a-w C:\Program Files\MagixUpdater.exe
2003-10-19 23:29 49,152 —-a-w C:\Program Files\Mdll32.dll
2003-04-02 23:09 49,152 —-a-w C:\Program Files\Cpuinf32.dll
2003-02-19 20:51 28,672 —-a-w C:\Program Files\Hhwmprxy.dll
2002-12-10 22:58 60,416 —-a-w C:\Program Files\Dsetup.dll
2002-09-11 21:39 392,704 —-a-w C:\Program Files\LFCMP13n.DLL
2002-09-11 21:36 445,952 —-a-w C:\Program Files\Ltimg13n.dll
2002-09-11 21:36 265,728 —-a-w C:\Program Files\Ltdis13n.dll
2002-09-11 21:36 205,312 —-a-w C:\Program Files\Ltefx13n.dll
2002-09-11 21:36 139,264 —-a-w C:\Program Files\Ltfil13n.dll
2002-09-11 21:35 445,440 —-a-w C:\Program Files\Ltkrn13n.dll
2002-08-21 22:30 10,593 -c–a-w C:\Program Files\Soundpools.dat
2002-06-24 00:00 86,016 —-a-w C:\Program Files\Samsig.dll
2001-08-30 05:29 122,880 —-a-w C:\Program Files\Hhwmprxy7.dll
2001-06-13 23:16 667,648 —-a-w C:\Program Files\Mumaipl.dll
2001-05-10 05:26 638,976 —-a-w C:\Program Files\Playriplpx.dll
2001-05-10 05:26 20,480 —-a-w C:\Program Files\Playripl.dll
2000-08-17 22:57 28,672 —-a-w C:\Program Files\Hhrashlp.dll
2000-08-10 07:28 93,937 —-a-w C:\Program Files\Mp3util.dll
2000-05-01 23:00 508,928 —-a-w C:\Program Files\Rmbe3260.dll
2000-05-01 23:00 379,904 —-a-w C:\Program Files\Pngu3264.dll
2000-04-11 03:53 90,112 —-a-w C:\Program Files\Dac37.dll
1999-12-10 01:00 431,376 —-a-w C:\Program Files\riched20.dll
1999-02-08 22:46 137,728 —-a-w C:\Program Files\Ijl10.dll
1999-01-04 12:00 401,484 —-a-w C:\Program Files\Msvcrtd.dll
1998-11-05 15:07 102,400 —-a-w C:\Program Files\Rn5c3260.dll
1998-09-24 12:00 929,844 -c–a-w C:\Program Files\Mfc42d.dll
1998-03-26 01:00 229,888 —-a-w C:\Program Files\Qtmlclient.dll
1997-12-21 13:30 94,208 —-a-w C:\Program Files\Unzdll.dll
.

((((((((((((((((((((((((((((( snapshot_2007-11-15_13.53.05.29 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-11-15 02:35:40 16,384 —-atw C:\WINDOWS\TEMP\Perflib_Perfdata_5f4.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A95B2816-1D7E-4561-A202-68C0DE02353A}]
2007-11-11 03:26 145984 –a—— C:\WINDOWS\system32\uhtlbgit.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BCC73622-F72D-4277-803C-D65565A0947F}]
2007-11-09 23:55 35328 –a—— C:\WINDOWS\system32\iifgdca.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{11A69AE4-FBED-4832-A2BF-45AF82825583}"= C:\WINDOWS\system32\uhtlbgit.dll [2007-11-11 03:26 145984]

[HKEY_CLASSES_ROOT\CLSID\{11A69AE4-FBED-4832-A2BF-45AF82825583}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{11A69AE4-FBED-4832-A2BF-45AF82825583}"= C:\WINDOWS\system32\uhtlbgit.dll [2007-11-11 03:26 145984]

[HKEY_CLASSES_ROOT\CLSID\{11A69AE4-FBED-4832-A2BF-45AF82825583}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 04:43]
"EPSON Stylus Photo R350 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAJP.exe" [2005-05-12 17:00]
"QuickTime Task"="C:\Program Files\QuickTime Alternative\qttask.exe" [2007-02-16 11:54]
"mouseElf"="C:\PROGRA~1\GENIUS~1\mouseElf.exe" [2004-02-24 18:47]
"MAFWTaskbarApp"="C:\WINDOWS\system32\MAFWTray.exe" [2004-09-27 17:44]
"RegistrySmart"="C:\Program Files\RegistrySmart\RegistrySmart.exe" [2006-08-25 14:01]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-04-19 14:26]
"SoundMan"="SOUNDMAN.EXE" [2004-11-15 23:20 C:\WINDOWS\SOUNDMAN.EXE]
"nwiz"="nwiz.exe" [2007-04-19 14:26 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-04-19 14:26]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" [2005-10-28 17:25]
"Uniblue RegistryBooster 2"="C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe" []
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-01 01:00]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"MySpaceIM"=C:\Program Files\MySpace\IM\MySpaceIM.exe
"Spyware Doctor"=

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-F400-7760-000000000003}\_SC_Acrobat.exe [2007-03-15 15:52:06]
Adobe Acrobat Synchronizer.lnk - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe [2006-10-23 00:01:50]
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-03-15 10:25:04]
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 01:48:20]
Adobe Reader Synchronizer.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 00:01:50]
Image Transfer.lnk - C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe [2007-07-05 19:06:30]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{BCC73622-F72D-4277-803C-D65565A0947F}"= C:\WINDOWS\system32\iifgdca.dll [2007-11-09 23:55 35328]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\iifgdca]
iifgdca.dll 2007-11-09 23:55 35328 C:\WINDOWS\system32\iifgdca.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
LMIinit.dll 2006-10-06 20:56 11504 C:\WINDOWS\system32\LMIinit.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\uhtlbgit]
uhtlbgit.dll 2007-11-11 03:26 145984 C:\WINDOWS\system32\uhtlbgit.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"C:\Program Files\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MySpaceIM]
C:\Program Files\MySpace\IM\MySpaceIM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Podbridge Launcher]
"C:\Program Files\PodBridge\Podbridge launcher.exe" /AutoRun

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SRFirstRun]
rundll32 srclient.dll,CreateFirstRunRp

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
"c:\progra~1\steam\steam.exe" -silent

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Bonjour Service"=2 (0x2)
"iPod Service"=3 (0x3)
"PnkBstrA"=2 (0x2)
"ose"=3 (0x3)
"IDriverT"=3 (0x3)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Acrobat Assistant 8.0"="C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"

R0 SiSRaid;SiSRaid;C:\WINDOWS\system32\DRIVERS\SiSRaid.sys
R0 sonypvl2;sonypvl2;C:\WINDOWS\system32\drivers\sonypvl2.sys
R1 oreans32;oreans32;\??\C:\WINDOWS\system32\drivers\oreans32.sys
R1 sonypvf2;sonypvf2;C:\WINDOWS\system32\drivers\sonypvf2.sys
R1 sonypvt2;sonypvt2;C:\WINDOWS\system32\drivers\sonypvt2.sys
R2 LMIInfo;LogMeIn Kernel Information Provider;\??\C:\Program Files\LogMeIn\RaInfo.sys
R3 bbcap;bbcap;C:\WINDOWS\system32\DRIVERS\bbcap.sys
R3 LMImirr;LMImirr;C:\WINDOWS\system32\DRIVERS\LMImirr.sys
S3 genmcmn;Genius Mouse Driver;C:\WINDOWS\system32\DRIVERS\gmfiltr.sys
S3 genmcmnUSB;Genius USB Mouse Driver;C:\WINDOWS\system32\DRIVERS\gflmouhid.sys
S3 sonypvs1;Sony Digital Imaging Video2;C:\WINDOWS\system32\DRIVERS\sonypvs1.sys

.
Contents of the 'Scheduled Tasks' folder
"2007-08-13 01:25:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2007-11-15 00:44:36 C:\WINDOWS\Tasks\RegistrySmart Scheduled Scan.job"
- C:\Program Files\RegistrySmart\RegistrySmart.exe
.
**************************************************************************

catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-15 15:36:42
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-15 15:43:13 - machine was rebooted
C:\ComboFix2.txt … 2007-11-15 13:54
C:\ComboFix3.txt … 2007-11-14 20:22
.
— E O F —


Logfile of HijackThis v1.99.1
Scan saved at 3:56:50 p.m., on 15/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\a-squared Anti-Malware\a2service.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\WINDOWS\system32\MAFWTray.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe
C:\Program Files\Mozilla Firefox2\firefox.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {A95B2816-1D7E-4561-A202-68C0DE02353A} - C:\WINDOWS\system32\uhtlbgit.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: (no name) - {BCC73622-F72D-4277-803C-D65565A0947F} - C:\WINDOWS\system32\iifgdca.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdmcks.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Security Toolbar - {11A69AE4-FBED-4832-A2BF-45AF82825583} - C:\WINDOWS\system32\uhtlbgit.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [EPSON Stylus Photo R350 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAJP.EXE /P30 "EPSON Stylus Photo R350 Series" /O6 "USB001" /M "Stylus Photo R350"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime Alternative\qttask.exe" -atboottime
O4 - HKLM\..\Run: [mouseElf] C:\PROGRA~1\GENIUS~1\mouseElf.exe
O4 - HKLM\..\Run: [MAFWTaskbarApp] C:\WINDOWS\system32\MAFWTray.exe
O4 - HKLM\..\Run: [RegistrySmart] "C:\Program Files\RegistrySmart\RegistrySmart.exe" -boot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Adobe Acrobat Synchronizer.lnk = C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Image Transfer.lnk = ?
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O20 - Winlogon Notify: iifgdca - C:\WINDOWS\SYSTEM32\iifgdca.dll
O20 - Winlogon Notify: LMIinit - C:\WINDOWS\SYSTEM32\LMIinit.dll
O20 - Winlogon Notify: uhtlbgit - C:\WINDOWS\SYSTEM32\uhtlbgit.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Emsi Software GmbH - C:\Program Files\a-squared Anti-Malware\a2service.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe