What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Closed] My HJT log

2 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:35:57 PM, on 2/17/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Mediafour\MacDrive 7\MacDriveService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\OneStepSearch\onestep.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WLService.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\OneStepSearch\onestep.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WMP54GSv1_1.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\lg_fwupdate\fwupdate.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Gigabyte\ET5\GUI.exe
C:\WINDOWS\system32\WF2K.EXE
C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Mediafour\MacDrive 7\MacDrive.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Razer\Habu\razerhid.exe
C:\Program Files\Seekmo\bin\10.0.406.0\OEAddOn.exe
C:\Program Files\Seekmo\bin\10.0.406.0\SeekmoSA.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\program files\steam\steam.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Metacafe\MetacafeAgent.exe
C:\Program Files\Razer\Habu\razertra.exe
C:\Program Files\Razer\Habu\razerofa.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Java\jre1.6.0_02\bin\jucheck.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.inbox.com/search/dispatcher.asp…&tbid=70041
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://\shdoclc.dll/dnserror.htm#http://moongamers.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.inbox.com/search/ie.aspx?tb_id=70041
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.inbox.com/support/sa_customize.aspx?TbId=70041
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.inbox.com/search/ie.aspx?tb_id=70041
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://dnl.inbox.com/support/sa_customize.aspx?TbId=70041
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_1.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Seekmo /fleok=1D8A83A5C7E6197A98AB6B2A1FBB39BFE4976E26CAEDA120180A196D6093 - {07AA283A-43D7-4CBE-A064-32A21112D94D} - C:\Program Files\Seekmo\bin\10.0.406.0\HostIE.dll
O2 - BHO: (no name) - {184746EC-9E9D-4C7D-B9E7-9039EBD801A9} - C:\Program Files\Video ActiveX Access\iesplg.dll (file missing)
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Inbox\ctbr.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_1.dll
O3 - Toolbar: &Inbox Toolbar - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Inbox\ctbr.dll
O3 - Toolbar: Protection Bar - {29C5A3B6-9A8D-4FA0-B5AD-3E20F4AA5C00} - C:\Program Files\Video ActiveX Access\iesbpl.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Seekmo - {07AA283A-43D7-4CBE-A064-32A21112D94D} - C:\Program Files\Seekmo\bin\10.0.406.0\HostIE.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LGODDFU] "C:\Program Files\lg_fwupdate\fwupdate.exe" blrun
O4 - HKLM\..\Run: [P17Helper] Rundll32 SPIRun.dll,RunDLLEntry
O4 - HKLM\..\Run: [EasyTuneV] C:\Program Files\Gigabyte\ET5\GUI.exe
O4 - HKLM\..\Run: [WinFoxV2] C:\WINDOWS\system32\WF2K.EXE Initial
O4 - HKLM\..\Run: [WinFast2KLoadDefault] rundll32.exe C:\WINDOWS\system32\wf2kcpl.dll,DllLoadDefaultSettings
O4 - HKLM\..\Run: [WinFast Schedule] C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
O4 - HKLM\..\Run: [SpyLocked 4.3] "C:\Program Files\SpyLocked 4.3\SpyLocked 4.3.exe" /h
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [{B179023B-6238-4499-8F26-CD73E9D90E0A}] "C:\Program Files\Mediafour\MacDrive 7\MacDrive.exe"
O4 - HKLM\..\Run: [MDGetStarted.exe] "C:\Program Files\Mediafour\MacDrive 7\MDGetStarted.exe" /auto
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Habu] C:\Program Files\Razer\Habu\razerhid.exe
O4 - HKLM\..\Run: [SeekmoOE] C:\Program Files\Seekmo\bin\10.0.406.0\OEAddOn.exe
O4 - HKLM\..\Run: [SeekmoSA] "C:\Program Files\Seekmo\bin\10.0.406.0\SeekmoSA.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [PATHPILOT] C:\Program Files\MegaSoundRecorder\Mega Sound Recorder.exe
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SaitekInstall] "D:\WinXP\setup.exe" -S0 -R
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKLM\..\Policies\Explorer\Run: [user32.dll] C:\Program Files\Video ActiveX Access\iesmn.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Folding@Home 5.03.lnk = ?
O4 - Startup: Metacafe.lnk = C:\Program Files\Metacafe\MetacafeAgent.exe
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Metacafe.lnk = C:\Program Files\Metacafe\MetacafeAgent.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: Download Image with Download Manager - tbr:iemenudownload
O8 - Extra context menu item: Download URL in selection with Download Manager - tbr:iemenudownsel
O8 - Extra context menu item: Download URL with Download Manager - tbr:iemenudownload
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Inbox Search - tbr:iemenu
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{E4DE0915-A520-4BCD-A811-A838F360917D}: NameServer = 192.168.1.254
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Inbox\ctbr.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
O22 - SharedTaskScheduler: hundi - {596e4935-4d3b-4a3c-842d-2efd1b3de598} - C:\WINDOWS\system32\pjgerka.dll (file missing)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Desktop Manager 5.5.709.30344 (GoogleDesktopManager-093007-112848) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MacDriveService - Mediafour Corporation - C:\Program Files\Mediafour\MacDrive 7\MacDriveService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: OneStep Search Service - OneStepSearch.net, Inc. - C:\Program Files\OneStepSearch\onestep.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: Spyware Doctor Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: WMP54GSSVC - GEMTEKS - C:\Program Files\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WLService.exe

–
End of file - 13891 bytes

Lately COH crashes within one minute of opening, it also doesn't let me connect to other clients in online play. Also my firefox will freeze (my other programs act normally while this is happening), so i have to use CNTRL+ALT+DEL to shut it down.
Post #2
Download ComboFix from Here or Here to your Desktop.

In the event you already have Combofix, this is a new version that I need you to download.
It must be saved directly to your desktop.


1. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

  • Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan.
  • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
  • Remember to re enable the protection again afterwards before connecting to the net


2. Close any open browsers and make sure you are disconnected from the net. Unplug the cable if need be before running combofix.
  • IF you have not already done so Combofix will disconnect your machine from the Internet when it starts.
  • If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.

3. Now double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review


Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze.
Post #3
here is the HJT log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:01:11 PM, on 2/24/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Mediafour\MacDrive 7\MacDriveService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\OneStepSearch\onestep.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WLService.exe
C:\Program Files\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WMP54GSv1_1.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\OneStepSearch\onestep.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\lg_fwupdate\fwupdate.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Gigabyte\ET5\GUI.exe
C:\WINDOWS\system32\WF2K.EXE
C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Mediafour\MacDrive 7\MacDrive.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Razer\Habu\razerhid.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Leapfrog\FlyWorld\bin\FlyMonitor.exe
C:\program files\steam\steam.exe
C:\Program Files\Razer\Habu\razertra.exe
C:\Program Files\Razer\Habu\razerofa.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Metacafe\MetacafeAgent.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\explorer.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://\shdoclc.dll/dnserror.htm#http://moongamers.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.inbox.com/search/ie.aspx?tb_id=70041
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.inbox.com/support/sa_customize.aspx?TbId=70041
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Inbox\ctbr.dll
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_1.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {184746EC-9E9D-4C7D-B9E7-9039EBD801A9} - C:\Program Files\Video ActiveX Access\iesplg.dll (file missing)
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Inbox\ctbr.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_1.dll
O3 - Toolbar: &Inbox Toolbar - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Inbox\ctbr.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: (no name) - {07AA283A-43D7-4CBE-A064-32A21112D94D} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LGODDFU] "C:\Program Files\lg_fwupdate\fwupdate.exe" blrun
O4 - HKLM\..\Run: [P17Helper] Rundll32 SPIRun.dll,RunDLLEntry
O4 - HKLM\..\Run: [EasyTuneV] C:\Program Files\Gigabyte\ET5\GUI.exe
O4 - HKLM\..\Run: [WinFoxV2] C:\WINDOWS\system32\WF2K.EXE Initial
O4 - HKLM\..\Run: [WinFast2KLoadDefault] rundll32.exe C:\WINDOWS\system32\wf2kcpl.dll,DllLoadDefaultSettings
O4 - HKLM\..\Run: [WinFast Schedule] C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [{B179023B-6238-4499-8F26-CD73E9D90E0A}] "C:\Program Files\Mediafour\MacDrive 7\MacDrive.exe"
O4 - HKLM\..\Run: [MDGetStarted.exe] "C:\Program Files\Mediafour\MacDrive 7\MDGetStarted.exe" /auto
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Habu] C:\Program Files\Razer\Habu\razerhid.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [PATHPILOT] C:\Program Files\MegaSoundRecorder\Mega Sound Recorder.exe
O4 - HKLM\..\Run: [FlyMonitor] "C:\Program Files\Leapfrog\FlyWorld\bin\FlyMonitor.exe"
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SaitekInstall] "D:\WinXP\setup.exe" -S0 -R
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Folding@Home 5.03.lnk = ?
O4 - Startup: Metacafe.lnk = C:\Program Files\Metacafe\MetacafeAgent.exe
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Metacafe.lnk = C:\Program Files\Metacafe\MetacafeAgent.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: Download Image with Download Manager - tbr:iemenudownload
O8 - Extra context menu item: Download URL in selection with Download Manager - tbr:iemenudownsel
O8 - Extra context menu item: Download URL with Download Manager - tbr:iemenudownload
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Inbox Search - tbr:iemenu
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{E4DE0915-A520-4BCD-A811-A838F360917D}: NameServer = 192.168.1.254
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Inbox\ctbr.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Desktop Manager 5.5.709.30344 (GoogleDesktopManager-093007-112848) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MacDriveService - Mediafour Corporation - C:\Program Files\Mediafour\MacDrive 7\MacDriveService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: OneStep Search Service - OneStepSearch.net, Inc. - C:\Program Files\OneStepSearch\onestep.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: Spyware Doctor Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: WMP54GSSVC - GEMTEKS - C:\Program Files\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WLService.exe

–
End of file - 12680 bytes



and here is the combofix.txt:
ComboFix 08-02-24.4 - User 2008-02-24 13:32:23.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.2562 [GMT -5:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
C:\Documents and Settings\All Users\Application Data\SeekmoSA
C:\Documents and Settings\All Users\Application Data\SeekmoSA\SeekmoSA.dat
C:\Documents and Settings\All Users\Application Data\SeekmoSA\SeekmoSA_kyf.dat
C:\Documents and Settings\All Users\Application Data\SeekmoSA\SeekmoSAAbout.mht
C:\Documents and Settings\All Users\Application Data\SeekmoSA\SeekmoSAau.dat
C:\Documents and Settings\All Users\Application Data\SeekmoSA\SeekmoSAEULA.mht
C:\Documents and Settings\User\Application Data\microsoft\internet explorer\quick launch\SpyLocked 4.3.lnk
C:\Documents and Settings\User\Application Data\Seekmo
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\030104_emte10_prv.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\030104_emte11_prv.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\030104_emte12_prv.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\030104_emte13_prv.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\030104_emte14_prv.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\030104_emte19_prv.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\030104_emte20_prv.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\030104_emte21_prv.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\030104_emte9_prv.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\030203lib_prv.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\033102angel_1_prv.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\033102bigluf_1_prv.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\033102bigsmile_1_prv.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\033102birthday_1_prv.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\033102cheers_1_prv.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\033102flo_1_prv.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\033102good_1_prv.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\033102jump_1_prv.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\033102king_1_prv.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\033102lough_1_prv.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\033102luf_1_prv.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\033102smile_1_prv.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\033102smiled_1_prv.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\033102sor_1_prv.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\033102thanx_1_prv.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\033102uhu_1_prv.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\040103ahh_prv.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\040103wow_prv.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\040104_emi2_prv.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\042102_1134_112_prv.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\050103big_prv.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\050103gig_prv.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\050103hm_prv.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\050103nomail_emoti_prv.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\050103norm_prv.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\060104_ema15_prv.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\060104_ema16_prv.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\060104_ema17_prv.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\060104_ema18_prv.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\060104_ema19_prv.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\060104_ema20_prv.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\060104_ema21_prv.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\060104_ema24_prv.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\060104_ema25_prv.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\060104_ema26_prv.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\060104_ema30_prv.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\060104_ema33_prv.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\060104_ema34_prv.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\062802hippi_prv.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\062802jumpie_prv.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\080402argh_prv.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\080402oops_prv.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\080402ouch_prv.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\082502no_prv.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\082502yes_prv.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\110103_boring1_prv.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\110103_confused_prv.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\110103_crying_ugly_prv.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\110103_fantastic_prv.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\110103_feel_better_prv.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\110103_gimme_break_prv.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\110103_heehee_prv.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\110103_hlopaet_prv.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\110103_ign_prv.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\110103_lol_prv.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\110103_no_comment_prv.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\110103_peace_prv.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\110103_smashing_prv.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\110103_talk2thehand_prv.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\block_sm.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\block_sm2.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\block_smli.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\block_smli2.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\blocked.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\blocked2.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\btn_add-but.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\btn_back-but.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\btn_left_cut_enabled_1.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\btn_left_enabled_1.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\btn_left_pressed_1.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\btn_middle_enabled_1.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\btn_middle_pressed_1.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\btn_right_cut_enabled_1.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\btn_right_enabled_1.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\btn_right_pressed_1.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\business_promo.htm
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\buttondir.txt
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\components.cdf
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\css_cattree.css
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\css_flashpreview.css
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\css2_main.css
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\css2_pagingmodule.css
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\css2_topbuttons.css
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\cursors.res
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\delete.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\edit_clear_sound.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\edit_fs.htm
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\edit_select.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\email-def-511724-543450.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\email-def-511724-548964.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\email-def-511724-589306.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\email-def-511724-591943.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\email-def-511724-592579.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\email-def-511724-598579.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\email-def-511724-603763.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\email-def-511724-9595.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\email-def-511724-9696.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\email-def-511745-514279.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\email-def-email-backgrounds.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\email-def-email-bcards.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\email-def-email-ecards.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\email-def-email-emoticons.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\email-def-email-estationery.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\email-def-email-funny.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\email-def-email-help.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\email-def-email-images.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\email-def-email-info.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\email-def-email-more.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\email-def-email-my.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\email-def-email-new.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\email-def-email-new2.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\email-def-email-options.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\email-def-email-people.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\email-def-email-photo.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\email-def-email-tell.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\email-def-email-temp.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\email-def-email-text.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\email-def-email-voice.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\email-def.cdf
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\email-premium-email-premium.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\email-t1-bg.res
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\email-temp-bg.res
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\estatationery.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\flashpatch.js
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\flashpreview.htm
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\fs3.htm
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\hotbar_promo.htm
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\icon_checked_1.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\icon_close_1.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\icon_close_pressed_1.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\icon_edit_preview.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\icon_edit_send.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\icon_flash_preview.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\icon_recently_used.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\icon_remove_1.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\icon_remove_pressed_1.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\icon_sand-clock2.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\icon_tell_1.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\icon_tell_pressed_1.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\icon_tree_null.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\icon_unchecked_1.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\icon_unchecked_pressed_1.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\img_barlayout.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\img_barlayout2.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\img_barlayout4.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\img_corner_left.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\img_local_logo.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\js2_basetemplate.js
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\js2_hbgroups.js
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\js2_hbobject3.js
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\js2_hbobjectset3.js
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\js2_hotbarwrapper.js
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\js2_iteratorsandreaders3nf.js
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\js2_pagingmoduleobj3.js
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\js2_texts3.js
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\js2_xmltree3nf.js
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\layout.cdf
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\linkpathlegal.txt
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\n.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\nav_b_2.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\nav_bb_2.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\nav_f_2.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\nav_ff_2.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\progress.res
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\sales_buttons.res
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\searchbtn.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\seekmo_btn.res
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\submit.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\tab_bg.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\tab_bga.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\tab_bgia.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\tab_l.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\tab_la.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\tab_lia.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\tab_r.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\tab_ra.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\tab_ria.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\tree_dots.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\tree_minus.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\tree_plus.gif
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\treedata_animations.xml
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\treedata_backgrounds.xml
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\treedata_ecards.xml
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\treedata_emoticons.xml
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\treedata_notifiers.xml
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\1\treedata_text.xml
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\DownLoad\business_promo.xip
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\DownLoad\buttondir.xip
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\DownLoad\code.xip
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\DownLoad\cursors.xip
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\DownLoad\email-def.xip
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\DownLoad\email-t1-bg.xip
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\DownLoad\email-temp-bg.xip
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\DownLoad\hotbar_promo.xip
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\DownLoad\images.xip
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\DownLoad\layout.xip
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\DownLoad\linkpathlegal.xip
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\DownLoad\localcontent.xip
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\DownLoad\progress.xip
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\DownLoad\sales_buttons.xip
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\DownLoad\seekmo_btn.xip
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\HostOI\static\DownLoad\treexml.xip
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\dynamic\1.sdf
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\dynamic\domains.txt
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\dynamic\TooltipXML\14271
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\dynamic\TooltipXML\18906
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\dynamic\TooltipXML\20304
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\dynamic\TooltipXML\25818
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\dynamic\TooltipXML\32290
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\dynamic\TooltipXML\35006
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\dynamic\TooltipXML\35062
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\dynamic\TooltipXML\528235
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\dynamic\TooltipXML\551747
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\dynamic\TooltipXML\58478
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\dynamic\TooltipXML\69911
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\dynamic\TooltipXML\744963
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\dynamic\TooltipXML\745340
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\dynamic\TooltipXML\745356
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\dynamic\TooltipXML\79805
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\dynamic\TooltipXML\97801
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\1\btntrans.idx
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\1\btntrans1.dat
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\1\buttondir.txt
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\1\components.cdf
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\1\cursors.res
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\1\d_icons_buttons_1000.res
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\1\d_icons_buttons_2000.res
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\1\d_icons_buttons_3000.res
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\1\d_icons_buttons_bar.res
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\1\d_icons_buttons_bbar1.res
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\1\d_icons_buttons_logos.res
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\1\d_icons_buttons_other.res
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\1\d_icons_weather.res
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\1\default.cdf
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\1\Default_511745-514279.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\1\Default_categorize.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\1\Default_comparison.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\1\Default_explorer-Mails.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\1\Default_explorer-people.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\1\Default_favorites.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\1\Default_Games.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\1\Default_Hide.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\1\Default_hotbarcom.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\1\Default_Hotmail.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\1\Default_hsskin.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\1\Default_Mails.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\1\Default_new.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\1\Default_premium.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\1\Default_searchfor.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\1\Default_searchgo.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\1\Default_weather.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\1\Default_yellowpages.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\1\email-def-511724-548964.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\1\email-def-511724-9595.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\1\email-t1-bg.res
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\1\icons2.res
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\1\ie_games_icon.res
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\1\ie_video.res
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\1\keywords.idx
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\1\keywords1.dat
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\1\layout.cdf
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\1\linkpathlegal.txt
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\1\progress.res
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\1\s_icons_buttons.res
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\1\sales_buttons.res
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\1\seekmo.res
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\1\seekmo_ie_menu.res
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\1\t2_bg.res
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\1\theweb.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\1\top7.cdf
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\1\Top7_theweb.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\1\tsd_bg.res
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\2\btntrans.idx
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\2\btntrans1.dat
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\2\buttondir.txt
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\2\components.cdf
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\2\cursors.res
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\2\d_icons_buttons_1000.res
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\2\d_icons_buttons_2000.res
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\2\d_icons_buttons_3000.res
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\2\d_icons_buttons_bar.res
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\2\d_icons_buttons_bbar1.res
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\2\d_icons_buttons_logos.res
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\2\d_icons_buttons_other.res
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\2\d_icons_weather.res
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\2\default.cdf
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\2\Default_511745-514279.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\2\Default_categorize.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\2\Default_comparison.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\2\Default_explorer-Mails.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\2\Default_explorer-people.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\2\Default_favorites.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\2\Default_Games.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\2\Default_Hide.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\2\Default_hotbarcom.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\2\Default_Hotmail.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\2\Default_hsskin.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\2\Default_Mails.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\2\Default_new.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\2\Default_premium.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\2\Default_searchfor.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\2\Default_searchgo.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\2\Default_weather.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\2\Default_yellowpages.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\2\email-def-511724-548964.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\2\email-def-511724-9595.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\2\email-t1-bg.res
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\2\icons2.res
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\2\ie_games_icon.res
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\2\ie_video.res
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\2\keywords.idx
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\2\keywords1.dat
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\2\layout.cdf
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\2\linkpathlegal.txt
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\2\progress.res
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\2\s_icons_buttons.res
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\2\sales_buttons.res
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\2\seekmo.res
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\2\seekmo_ie_menu.res
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\2\t2_bg.res
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\2\theweb.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\2\top7.cdf
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\2\Top7_theweb.mnu
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\2\tsd_bg.res
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\BtnTrans.xip
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\BtnTrans1.xip
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\buttondir.xip
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\cursors.xip
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\d_icons_buttons_1000.xip
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\d_icons_buttons_2000.xip
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\d_icons_buttons_3000.xip
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\d_icons_buttons_bar.xip
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\d_icons_buttons_bbar1.xip
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\d_icons_buttons_logos.xip
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\d_icons_buttons_other.xip
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\d_icons_weather.xip
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\default.xip
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\email-t1-bg.xip
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\icons2.xip
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\ie_games_icon.xip
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\ie_video.xip
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\keywords.xip
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\keywords1.xip
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\layout.xip
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\linkpathlegal.xip
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\progress.xip
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\s_icons_buttons.xip
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\sales_buttons.xip
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\samplegroups2.txt
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\samplegroups2.xip
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\seekmo.xip
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\seekmo_ie_menu.xip
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\t2_bg.xip
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\top7.xip
C:\Documents and Settings\User\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\tsd_bg.xip
C:\Program Files\seekmo
C:\Program Files\seekmo\bin\10.0.406.0\arrow.ico
C:\Program Files\seekmo\bin\10.0.406.0\copyright.txt
C:\Program Files\seekmo\bin\10.0.406.0\CoreSrv.dll
C:\Program Files\seekmo\bin\10.0.406.0\firefox\extensions\chrome.manifest
C:\Program Files\seekmo\bin\10.0.406.0\firefox\extensions\components\npclntax.xpt
C:\Program Files\seekmo\bin\10.0.406.0\firefox\extensions\install.rdf
C:\Program Files\seekmo\bin\10.0.406.0\firefox\extensions\plugins\npclntax_SeekmoSA.dll
C:\Program Files\seekmo\bin\10.0.406.0\HostIE.dll
C:\Program Files\seekmo\bin\10.0.406.0\HostOE.dll
C:\Program Files\seekmo\bin\10.0.406.0\HostOL.dll
C:\Program Files\seekmo\bin\10.0.406.0\InstIE.dll
C:\Program Files\seekmo\bin\10.0.406.0\link.ico
C:\Program Files\seekmo\bin\10.0.406.0\OEAddOn.exe
C:\Program Files\seekmo\bin\10.0.406.0\SeekmoSA.exe
C:\Program Files\seekmo\bin\10.0.406.0\SeekmoSAAX.dll
C:\Program Files\seekmo\bin\10.0.406.0\SeekmoSADF.exe
C:\Program Files\seekmo\bin\10.0.406.0\SeekmoSAHook.dll
C:\Program Files\seekmo\bin\10.0.406.0\SeekmoUnInstaller.exe
C:\Program Files\seekmo\bin\10.0.406.0\Srv.exe
C:\Program Files\seekmo\bin\10.0.406.0\Toolbar.dll
C:\Program Files\seekmo\bin\10.0.406.0\Wallpaper.dll
C:\Program Files\video activex access
C:\Program Files\video activex access\imsmain.exe
C:\WINDOWS\system32\drivers\sfsync02.sys
C:\WINDOWS\system32\tmp38.tmp

—– BITS: Possible infected sites —–

hxxp://d.trymedia.com
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
——-\LEGACY_SFSYNC02
——-\sfsync02


((((((((((((((((((((((((( Files Created from 2008-01-24 to 2008-02-24 )))))))))))))))))))))))))))))))
.

2008-02-24 13:15 . 2008-02-24 13:15 d——– C:\Documents and Settings\User\.assistant
2008-02-24 12:26 . 2008-02-24 13:10 513 –a—— C:\logfile.dat
2008-02-24 12:25 . 2008-02-24 12:25 444 –a—— C:\WINDOWS\{5D946D0D-9437-4E15-AC1F-F9BCF0B32561}_WiseFW.ini
2008-02-24 12:24 . 2008-02-24 12:24 d——– C:\Documents and Settings\All Users\Application Data\Leapfrog
2008-02-24 12:21 . 2008-02-24 12:25 d——– C:\Program Files\LeapFrog
2008-02-18 14:22 . 2008-02-18 14:22 d——– C:\Program Files\GlobalSCAPE
2008-02-18 14:22 . 2008-02-18 14:22 d——– C:\Documents and Settings\User\Application Data\GlobalSCAPE
2008-02-18 14:22 . 2008-02-18 14:22 d——– C:\Documents and Settings\All Users\Application Data\GlobalSCAPE
2008-02-18 13:28 . 2008-02-18 14:27 d——– C:\Documents and Settings\User\Application Data\FileZilla
2008-02-18 13:27 . 2008-02-18 13:27 d——– C:\Program Files\FileZilla FTP Client
2008-02-17 16:55 . 2008-02-17 16:55 d——– C:\Program Files\Trend Micro
2008-02-17 16:28 . 2008-02-24 11:28 d——– C:\Program Files\OneStepSearch
2008-02-17 16:28 . 2008-02-24 13:22 d——– C:\Program Files\MegaSoundRecorder
2008-02-17 16:28 . 2004-07-29 01:19 175,104 –a—— C:\WINDOWS\system32\lame_enc.dll
2008-02-14 23:10 . 2008-02-14 23:10 d——– C:\Documents and Settings\User\Application Data\My Games
2008-02-14 23:01 . 2008-02-14 23:01 d——– C:\Program Files\Firaxis Games
2008-02-14 21:25 . 2008-02-14 21:25 d——– C:\Program Files\Digital Locker Assistant
2008-02-07 18:30 . 2008-02-08 16:18 d——– C:\Program Files\AGEod's American Civil War
2008-02-07 16:11 . 2008-02-07 16:11 d——– C:\Program Files\Lead Pursuit
2008-02-02 18:57 . 2008-02-02 18:57 d——– C:\Program Files\Perfect Alarm Clock

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-24 18:48 ——— d—–w C:\Program Files\Steam
2008-02-24 18:47 ——— d—–w C:\Program Files\lg_fwupdate
2008-02-24 18:40 ——— d—–w C:\Documents and Settings\User\Application Data\Metacafe
2008-02-24 18:40 ——— d—–w C:\Documents and Settings\All Users\Application Data\Metacafe
2008-02-24 18:28 ——— d—–w C:\Program Files\Inbox
2008-02-24 17:27 ——— d—–w C:\Program Files\DIFX
2008-02-24 17:24 ——— d—–w C:\Program Files\Common Files\Wise Installation Wizard
2008-02-24 16:40 ——— d—a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-02-24 16:40 ——— d—–w C:\Program Files\Spyware Doctor
2008-02-24 16:35 ——— d—–w C:\Documents and Settings\All Users\Application Data\Google Updater
2008-02-22 02:46 22,328 —-a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-02-18 19:22 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-02-16 04:06 ——— d—–w C:\Program Files\COD4 Rcon Commander (BETA)
2008-02-12 23:30 ——— d—–w C:\Documents and Settings\User\Application Data\gtk-2.0
2008-02-08 00:24 ——— d—–w C:\Program Files\Common Files\Adobe
2008-02-02 20:46 ——— d—–w C:\Program Files\mIRC
2008-02-02 01:09 ——— d-s—w C:\Program Files\Xfire
2008-01-21 15:10 ——— d—–w C:\Program Files\American Conquest
2008-01-21 15:07 ——— d—–w C:\Program Files\EA GAMES
2008-01-21 14:59 ——— d—–w C:\Program Files\Ubisoft
2008-01-21 14:51 ——— d—–w C:\Program Files\Kuma Games
2008-01-21 14:50 ——— d—–w C:\Program Files\id Software
2008-01-20 18:57 ——— d—–w C:\Program Files\QuickTime
2008-01-20 18:43 ——— d—–w C:\Program Files\iTunes
2008-01-20 18:43 ——— d—–w C:\Program Files\iPod
2008-01-20 18:41 ——— d—–w C:\Program Files\Bonjour
2008-01-20 18:37 ——— d—–w C:\Program Files\Common Files\Apple
2008-01-18 17:32 ——— d—–w C:\Program Files\Microsoft Silverlight
2008-01-16 22:55 ——— d—–w C:\Documents and Settings\All Users\Application Data\2ACA5CC3-0F83-453D-A079-1076FE1A8B65
2008-01-12 04:47 22,328 —-a-w C:\Documents and Settings\User\Application Data\PnkBstrK.sys
2008-01-12 01:59 ——— d—–w C:\Documents and Settings\User\Application Data\HLSW
2008-01-12 01:27 2,289,489 —-a-w C:\WINDOWS\COD4 Rcon Commander (BETA) Uninstaller.exe
2008-01-11 01:46 ——— d—–w C:\Program Files\RD
2008-01-11 00:35 ——— d—–w C:\Program Files\GIMP-2.0
2008-01-10 02:31 ——— d—–w C:\Documents and Settings\User\Application Data\Xfire
2008-01-06 07:29 ——— d—–w C:\Program Files\GTactix
2008-01-06 01:39 ——— d—–w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-01-04 23:50 ——— d-s—w C:\Program Files\HLSW
2008-01-04 16:42 ——— d—–w C:\Program Files\EwisoftWeb
2008-01-04 16:42 ——— d—–w C:\Documents and Settings\All Users\Application Data\EwisoftWeb
2008-01-02 23:18 ——— d—–w C:\Program Files\Sierra Entertainment
2007-12-24 19:05 ——— d—–w C:\Documents and Settings\User\Application Data\InstallShield
2007-11-28 23:34 286,720 —-a-w C:\WINDOWS\iun507.exe
2004-10-01 19:00 40,960 —-a-w C:\Program Files\Uninstall_CDS.exe
.

——- Sigcheck ——-

8f078ae4ed187aaabc0a305146de6716 C:\WINDOWS\system32\svchost.exe
—-a-w 14,336 2004-08-04 12:00:00 C:\WINDOWS\system32\svchost.exe
-c–a-w 14,336 2004-08-04 12:00:00 C:\WINDOWS\system32\dllcache\svchost.exe

2ed0b7f12a60f90092081c50fa0ec2b2 C:\WINDOWS\system32\ws2_32.dll
—-a-w 82,944 2004-08-04 12:00:00 C:\WINDOWS\system32\ws2_32.dll
-c–a-w 82,944 2004-08-04 12:00:00 C:\WINDOWS\system32\dllcache\ws2_32.dll

01c3346c241652f43aed8e2149881bfe C:\WINDOWS\system32\winlogon.exe
—-a-w 502,272 2004-08-04 12:00:00 C:\WINDOWS\system32\winlogon.exe
-c–a-w 502,272 2004-08-04 12:00:00 C:\WINDOWS\system32\dllcache\winlogon.exe

558635d3af1c7546d26067d5d9b6959e C:\WINDOWS\system32\drivers\ndis.sys
-c–a-w 182,912 2004-08-04 12:00:00 C:\WINDOWS\system32\dllcache\ndis.sys
—-a-w 182,912 2004-08-04 12:00:00 C:\WINDOWS\system32\drivers\ndis.sys

4448006b6bc60e6c027932cfc38d6855 C:\WINDOWS\system32\drivers\ip6fw.sys
-c–a-w 29,056 2004-08-04 12:00:00 C:\WINDOWS\system32\dllcache\ip6fw.sys
—-a-w 29,056 2004-08-04 12:00:00 C:\WINDOWS\system32\drivers\ip6fw.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{184746EC-9E9D-4C7D-B9E7-9039EBD801A9}]
C:\Program Files\Video ActiveX Access\iesplg.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\{FD8348AB-D74A-4C76-B2FE-926FF6D7CC40}]
@=MacDrive Volume Icons

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="c:\program files\steam\steam.exe" [2007-12-02 13:46 1266936]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 11:54 5674352]
"SaitekInstall"="D:\WinXP\setup.exe" [ ]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 07:00 15360]
"Uniblue SpeedUpMyPC"="" []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-09-17 00:07 8491008]
"nwiz"="nwiz.exe" [2007-09-17 00:07 1626112 C:\WINDOWS\system32\nwiz.exe]
"RTHDCPL"="RTHDCPL.EXE" [2006-05-18 01:27 16207872 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 05:04 2879488 C:\WINDOWS\SkyTel.exe]
"RemoteControl"="C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" [2004-11-02 19:24 32768]
"InCD"="C:\Program Files\Ahead\InCD\InCD.exe" [2006-03-13 21:06 1397760]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 09:50 155648]
"LGODDFU"="C:\Program Files\lg_fwupdate\fwupdate.exe" [2006-02-28 14:37 249856]
"P17Helper"="SPIRun.dll" [2006-07-03 12:43 10752 C:\WINDOWS\system32\SPIRUN.DLL]
"EasyTuneV"="C:\Program Files\Gigabyte\ET5\GUI.exe" [2004-06-14 11:54 200704]
"WinFoxV2"="C:\WINDOWS\system32\WF2K.exe" [2006-07-17 14:31 1490944]
"WinFast2KLoadDefault"="C:\WINDOWS\system32\wf2kcpl.dll" [2006-02-22 13:29 668672]
"WinFast Schedule"="C:\Program Files\WinFast\WFTVFM\WFWIZ.exe" [2006-07-07 17:15 348160]
"SDTray"="C:\Program Files\Spyware Doctor\SDTrayApp.exe" [2007-07-01 23:14 1051464]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 03:00 132496]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-02-11 17:14 29744]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 01:41 49152]
"{B179023B-6238-4499-8F26-CD73E9D90E0A}"="C:\Program Files\Mediafour\MacDrive 7\MacDrive.exe" [2007-07-12 09:57 179288]
"MDGetStarted.exe"="C:\Program Files\Mediafour\MacDrive 7\MDGetStarted.exe" [2007-06-13 12:23 139264]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-09-17 00:07 81920]
"Habu"="C:\Program Files\Razer\Habu\razerhid.exe" [2007-05-11 11:58 176128]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-01-15 03:22 267048]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-01-10 15:27 385024]
"UserFaultCheck"="C:\WINDOWS\system32\dumprep 0 -u" [ ]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]
"PATHPILOT"="C:\Program Files\MegaSoundRecorder\Mega Sound Recorder.exe" [ ]
"FlyMonitor"="C:\Program Files\Leapfrog\FlyWorld\bin\FlyMonitor.exe" [2007-11-15 14:32 669000]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2007-07-09 21:54:54 124912]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 03:21:22 288472]
Metacafe.lnk - C:\Program Files\Metacafe\MetacafeAgent.exe [2007-09-04 10:04:34 149256]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"C:\\WINDOWS\\system32\\rundll32.exe"=
"C:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"=
"C:\\Program Files\\Steam\\SteamApps\\generalramsey\\counter-strike source\\hl2.exe"=
"C:\\Program Files\\Steam\\SteamApps\\generalramsey\\day of defeat source\\hl2.exe"=
"C:\\Program Files\\Steam\\SteamApps\\generalramsey\\half-life 2 deathmatch\\hl2.exe"=
"C:\\Program Files\\THQ\\Company of Heroes\\RelicCOH.exe"=
"C:\\Program Files\\Steam\\SteamApps\\generalramsey\\source sdk base\\hl2.exe"=
"C:\\Program Files\\Strategy First\\Making History 2.0\\bin\\makehist.exe"=
"C:\\Program Files\\Steam\\SteamApps\\generalramsey\\garrysmod\\hl2.exe"=
"C:\\Program Files\\Ubisoft\\Faces of War\\facesofwar.exe"=
"C:\\Program Files\\Microsoft Games\\Microsoft Flight Simulator X\\fsx.exe"=
"C:\\Program Files\\America's Army\\System\\ArmyOps.exe"=
"C:\\Program Files\\Dreamcatcher\\First Battalion\\pea.exe"=
"C:\\Program Files\\EA GAMES\\Battlefield 1942\\BF1942.exe"=
"C:\\WINDOWS\\system32\\PnkBstrA.exe"=
"C:\\WINDOWS\\system32\\PnkBstrB.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Steam\\Steam.exe"=
"C:\\Program Files\\Steam\\SteamApps\\common\\company of heroes\\RelicCOH.exe"=
"C:\\Program Files\\Microsoft Games\\Flight Simulator 9\\fs9.exe"=
"C:\\Program Files\\Electronic Arts\\Battlefield 2142\\BF2142.exe"=
"C:\\Program Files\\Steam\\SteamApps\\generalramsey\\team fortress 2\\hl2.exe"=
"C:\\Program Files\\Steam\\SteamApps\\generalramsey\\half-life 2\\hl2.exe"=
"C:\\Program Files\\Electronic Arts\\Medal of Honor Airborne\\UnrealEngine3\\Binaries\\MOHA.exe"=
"C:\\Program Files\\Sierra\\FEAR\\FEAR.exe"=
"C:\\Program Files\\Steam\\SteamApps\\common\\call of duty 4\\iw3mp.exe"=
"C:\\Program Files\\HTC\\Aces High II\\aceshigh.exe"=
"C:\\Program Files\\id Software\\Enemy Territory - QUAKE Wars\\etqwded.exe"=
"C:\\Program Files\\id Software\\Enemy Territory - QUAKE Wars\\etqw.exe"=
"C:\\Program Files\\Sierra Entertainment\\World in Conflict\\wic.exe"=
"C:\\Program Files\\Sierra Entertainment\\World in Conflict\\wic_online.exe"=
"C:\\Program Files\\Sierra Entertainment\\World in Conflict\\wic_ds.exe"=
"C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=
"C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
"C:\\Program Files\\HLSW\\hlsw.exe"=
"C:\\Program Files\\ModernRcon v0.4\\PBUCON\\pbucon.exe"=
"C:\\Program Files\\GTactix\\GTactix.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\American Civil War - Gettysburg\\Gettysburg.exe"=
"C:\\Program Files\\mIRC\\mirc.exe"=
"C:\\Program Files\\Firaxis Games\\Sid Meier's Civilization IV\\Civilization4.exe"=
"C:\\Program Files\\LeapFrog\\FlyWorld\\bin\\FLYMonitor.exe"=
"C:\\Program Files\\LeapFrog\\FlyWorld\\bin\\FLYWorld.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"89:TCP"= 89:TCP:moongamers.com
"80:TCP"= 80:TCP:www.moongamers.com
"6112:UDP"= 6112:UDP:CoH
"30260:UDP"= 30260:UDP:CoH
"9100:UDP"= 9100:UDP:CoH

R0 MDFSYSNT;MacDrive file system driver;C:\WINDOWS\system32\drivers\MDFSYSNT.sys [2007-09-05 14:01]
R0 MDPMGRNT;MDPMGRNT;C:\WINDOWS\system32\drivers\MDPMGRNT.sys [2007-02-28 10:15]
R1 oreans32;oreans32;C:\WINDOWS\system32\drivers\oreans32.sys [2007-08-15 21:00]
R2 MacDriveService;MacDriveService;"C:\Program Files\Mediafour\MacDrive 7\MacDriveService.exe" [2007-05-01 13:55]
R2 OneStep Search Service;OneStep Search Service;"C:\Program Files\OneStepSearch\onestep.exe" "C:\Program Files\OneStepSearch\onestep.dll" Service []
R3 HabuFltr;Habu Mouse;C:\WINDOWS\system32\drivers\habu.sys [2006-10-23 12:09]
R3 MarkFun_NT;MarkFun_NT;C:\Program Files\Gigabyte\ET5\markfun.w32 [2005-04-27 11:40]
R3 P17xfi;Sound Blaster X-Fi Xtreme Audio;C:\WINDOWS\system32\drivers\P17xfi.sys [2007-06-13 10:08]
R3 p17xfilt;p17xfilt;C:\WINDOWS\system32\drivers\p17xfilt.sys [2007-08-20 13:35]
R3 WFIOCTL;WFIOCTL;C:\Program Files\WinFast\WFTVFM\WFIOCTL.SYS [2005-01-06 16:55]
R4 WINFOXIO;WINFOXIO;C:\WINDOWS\system32\Drivers\WINFOXIO.SYS [2005-03-25 18:24]
S3 GoogleDesktopManager-093007-112848;Google Desktop Manager 5.5.709.30344;"C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-02-11 17:14]
S3 SaiH0004;SaiH0004;C:\WINDOWS\system32\DRIVERS\SaiH0004.sys [2006-08-21 12:01]
S3 SaiL0004;SaiL0004;C:\WINDOWS\system32\DRIVERS\SaiL0004.sys [2006-08-21 12:02]
S3 SaiU0004;SaiU0004;C:\WINDOWS\system32\DRIVERS\SaiU0004.sys [2006-08-21 12:01]
S3 uisp;Freescale USB JW32 driver;C:\WINDOWS\system32\Drivers\usbicp.sys [2005-12-21 11:23]

*Newly Created Service* - MARKFUN_NT
.
Contents of the 'Scheduled Tasks' folder
"2008-02-16 15:23:04 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-02-15 20:00:00 C:\WINDOWS\Tasks\Norton Security Scan.job"
- C:\Program Files\Norton Security Scan\Nss.exe
"2008-02-21 03:29:26 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC Nag.job"
- C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe
"2007-10-13 20:31:49 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC.job"
- C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-24 13:48:17
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\OneStepSearch\onestep.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WLService.exe
C:\Program Files\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WMP54GSv1_1.exe
C:\Program Files\OneStepSearch\onestep.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Razer\Habu\razertra.exe
C:\Program Files\Razer\Habu\razerofa.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\MSN Messenger\usnsvc.exe
.
**************************************************************************
.
Completion time: 2008-02-24 13:57:01 - machine was rebooted [User]
ComboFix-quarantined-files.txt 2008-02-24 18:56:58
.
2008-02-13 03:55:41 — E O F —
Post #4
I cannot stress how important this is!!
Please read the instructions on how to install the Recovery Console:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Post back with the log it generates.

———————————————————————

Next step

Open notepad and copy/paste the text in the codebox below into it:

Driver::
sfsync02
LEGACY_SFSYNC02

File::
 C:\Program Files\Video ActiveX Access\iesplg.dll

Folder::
 C:\Program Files\Video ActiveX Access

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{184746EC-9E9D-4C7D-B9E7-9039EBD801A9}]

Save this as Save this as "CFScript"


[external image: Posted Image]

Refering to the picture above, drag CFScript.txt into ComboFix.exe

Then post the results log and a new HijackThis log.
Post #5
Thanks for helping me out Eagle, here is the new HJT log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:51, on 2008-02-25
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Mediafour\MacDrive 7\MacDriveService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\OneStepSearch\onestep.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WLService.exe
C:\Program Files\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WMP54GSv1_1.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\OneStepSearch\onestep.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\lg_fwupdate\fwupdate.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Gigabyte\ET5\GUI.exe
C:\WINDOWS\system32\WF2K.EXE
C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Mediafour\MacDrive 7\MacDrive.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Razer\Habu\razerhid.exe
C:\Program Files\Leapfrog\FlyWorld\bin\FlyMonitor.exe
C:\program files\steam\steam.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Razer\Habu\razertra.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Razer\Habu\razerofa.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Metacafe\MetacafeAgent.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://\shdoclc.dll/dnserror.htm#http://moongamers.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.inbox.com/search/ie.aspx?tb_id=70041
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.inbox.com/support/sa_customize.aspx?TbId=70041
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Inbox\ctbr.dll
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_1.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Inbox\ctbr.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_1.dll
O3 - Toolbar: &Inbox Toolbar - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Inbox\ctbr.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: (no name) - {07AA283A-43D7-4CBE-A064-32A21112D94D} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LGODDFU] "C:\Program Files\lg_fwupdate\fwupdate.exe" blrun
O4 - HKLM\..\Run: [P17Helper] Rundll32 SPIRun.dll,RunDLLEntry
O4 - HKLM\..\Run: [EasyTuneV] C:\Program Files\Gigabyte\ET5\GUI.exe
O4 - HKLM\..\Run: [WinFoxV2] C:\WINDOWS\system32\WF2K.EXE Initial
O4 - HKLM\..\Run: [WinFast2KLoadDefault] rundll32.exe C:\WINDOWS\system32\wf2kcpl.dll,DllLoadDefaultSettings
O4 - HKLM\..\Run: [WinFast Schedule] C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [{B179023B-6238-4499-8F26-CD73E9D90E0A}] "C:\Program Files\Mediafour\MacDrive 7\MacDrive.exe"
O4 - HKLM\..\Run: [MDGetStarted.exe] "C:\Program Files\Mediafour\MacDrive 7\MDGetStarted.exe" /auto
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Habu] C:\Program Files\Razer\Habu\razerhid.exe
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [PATHPILOT] C:\Program Files\MegaSoundRecorder\Mega Sound Recorder.exe
O4 - HKLM\..\Run: [FlyMonitor] "C:\Program Files\Leapfrog\FlyWorld\bin\FlyMonitor.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SaitekInstall] "D:\WinXP\setup.exe" -S0 -R
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Folding@Home 5.03.lnk = ?
O4 - Startup: Metacafe.lnk = C:\Program Files\Metacafe\MetacafeAgent.exe
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Metacafe.lnk = C:\Program Files\Metacafe\MetacafeAgent.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: Download Image with Download Manager - tbr:iemenudownload
O8 - Extra context menu item: Download URL in selection with Download Manager - tbr:iemenudownsel
O8 - Extra context menu item: Download URL with Download Manager - tbr:iemenudownload
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Inbox Search - tbr:iemenu
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{E4DE0915-A520-4BCD-A811-A838F360917D}: NameServer = 192.168.1.254
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Inbox\ctbr.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Desktop Manager 5.5.709.30344 (GoogleDesktopManager-093007-112848) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MacDriveService - Mediafour Corporation - C:\Program Files\Mediafour\MacDrive 7\MacDriveService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: OneStep Search Service - OneStepSearch.net, Inc. - C:\Program Files\OneStepSearch\onestep.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: Spyware Doctor Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: WMP54GSSVC - GEMTEKS - C:\Program Files\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WLService.exe

–
End of file - 12403 bytes




Here is the new ComboFix log:
ComboFix 08-02-25.3 - User 2008-02-25 17:46:00.6 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.2543 [GMT -5:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix(2).exe
Command switches used :: C:\Documents and Settings\User\Desktop\CFScript.txt
* Created a new restore point

FILE ::
C:\Program Files\Video ActiveX Access\iesplg.dll
.

((((((((((((((((((((((((( Files Created from 2008-01-25 to 2008-02-25 )))))))))))))))))))))))))))))))
.

2008-02-25 17:45 . 2008-02-25 17:47 d——– C:\ComboFix(2)
2008-02-25 17:41 . 2004-08-03 23:00 260,272 –a—— C:\cmldr
2008-02-25 17:41 . 2006-08-23 18:19 211 –a—— C:\Boot.bak
2008-02-25 16:41 . 2008-02-25 16:54 d——– C:\ComboFix
2008-02-25 16:41 . 2004-08-04 07:00 388,608 –a—— C:\WINDOWS\system32\kmd.exe
2008-02-24 21:58 . 2008-02-24 21:58 13,858 –a—— C:\WINDOWS\system32\ealregsnapshot1.reg
2008-02-24 20:17 . 2008-02-24 20:18 d——– C:\Program Files\RS Demo
2008-02-24 15:18 . 2008-02-25 15:56 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2008-02-24 15:18 . 2008-02-24 15:18 1,409 –a—— C:\WINDOWS\QTFont.for
2008-02-24 15:17 . 2008-02-24 15:17 d——– C:\Program Files\iPod
2008-02-24 13:57 . 2008-02-25 17:46 d——– C:\WINDOWS\TEMP
2008-02-24 13:29 . 2008-02-25 17:45 d——– C:\QooBox
2008-02-24 13:29 . 2000-08-31 08:00 212,480 –a—— C:\WINDOWS\system32\swxcacls.exe
2008-02-24 13:29 . 2000-08-31 08:00 161,792 –a—— C:\WINDOWS\system32\swreg.exe
2008-02-24 13:29 . 2000-08-31 08:00 136,704 –a—— C:\WINDOWS\system32\swsc.exe
2008-02-24 13:29 . 2000-08-31 08:00 98,816 –a—— C:\WINDOWS\system32\sed.exe
2008-02-24 13:29 . 2000-08-31 08:00 80,412 –a—— C:\WINDOWS\system32\grep.exe
2008-02-24 13:29 . 2000-08-31 08:00 73,728 –a—— C:\WINDOWS\system32\fdsv.exe
2008-02-24 13:29 . 2000-08-31 08:00 68,096 –a—— C:\WINDOWS\system32\zip.exe
2008-02-24 13:29 . 2000-08-31 08:00 51,200 –a—— C:\WINDOWS\Nircmd.exe
2008-02-24 13:29 . 2000-08-31 08:00 49,152 –a—— C:\WINDOWS\system32\VFind.exe
2008-02-24 13:15 . 2008-02-24 13:15 d——– C:\Documents and Settings\User\.assistant
2008-02-24 12:26 . 2008-02-25 16:21 1,026 –a—— C:\logfile.dat
2008-02-24 12:25 . 2008-02-24 12:25 444 –a—— C:\WINDOWS\{5D946D0D-9437-4E15-AC1F-F9BCF0B32561}_WiseFW.ini
2008-02-24 12:24 . 2008-02-24 12:24 d——– C:\Documents and Settings\All Users\Application Data\Leapfrog
2008-02-24 12:21 . 2008-02-24 12:25 d——– C:\Program Files\LeapFrog
2008-02-18 14:22 . 2008-02-18 14:22 d——– C:\Program Files\GlobalSCAPE
2008-02-18 14:22 . 2008-02-18 14:22 d——– C:\Documents and Settings\User\Application Data\GlobalSCAPE
2008-02-18 14:22 . 2008-02-18 14:22 d——– C:\Documents and Settings\All Users\Application Data\GlobalSCAPE
2008-02-18 13:28 . 2008-02-18 14:27 d——– C:\Documents and Settings\User\Application Data\FileZilla
2008-02-18 13:27 . 2008-02-18 13:27 d——– C:\Program Files\FileZilla FTP Client
2008-02-17 16:55 . 2008-02-17 16:55 d——– C:\Program Files\Trend Micro
2008-02-17 16:28 . 2008-02-24 11:28 d——– C:\Program Files\OneStepSearch
2008-02-17 16:28 . 2008-02-24 13:22 d——– C:\Program Files\MegaSoundRecorder
2008-02-17 16:28 . 2004-07-29 01:19 175,104 –a—— C:\WINDOWS\system32\lame_enc.dll
2008-02-14 23:10 . 2008-02-14 23:10 d——– C:\Documents and Settings\User\Application Data\My Games
2008-02-14 23:01 . 2008-02-14 23:01 d——– C:\Program Files\Firaxis Games
2008-02-14 21:25 . 2008-02-14 21:25 d——– C:\Program Files\Digital Locker Assistant
2008-02-07 18:30 . 2008-02-08 16:18 d——– C:\Program Files\AGEod's American Civil War
2008-02-07 16:11 . 2008-02-07 16:11 d——– C:\Program Files\Lead Pursuit
2008-02-02 18:57 . 2008-02-02 18:57 d——– C:\Program Files\Perfect Alarm Clock
2008-01-31 23:13 . 2008-01-31 23:13 90,112 –a—— C:\WINDOWS\system32\QuickTimeVR.qtx
2008-01-31 23:13 . 2008-01-31 23:13 57,344 –a—— C:\WINDOWS\system32\QuickTime.qts

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-25 22:43 ——— d—–w C:\Program Files\Mozilla Firefox
2008-02-25 22:36 ——— d—–w C:\Documents and Settings\User\Application Data\Metacafe
2008-02-25 22:36 ——— d—–w C:\Documents and Settings\All Users\Application Data\Metacafe
2008-02-25 21:06 ——— d—a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-02-25 21:06 ——— d—–w C:\Program Files\Spyware Doctor
2008-02-25 20:59 ——— d—–w C:\Documents and Settings\All Users\Application Data\Google Updater
2008-02-25 20:56 ——— d—–w C:\Program Files\Steam
2008-02-25 20:55 ——— d—–w C:\Program Files\lg_fwupdate
2008-02-25 20:52 2,145,386,496 –sha-w C:\pagefile.sys
2008-02-25 02:59 22,328 —-a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-02-25 02:59 107,832 —-a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-02-25 01:59 ——— d—–w C:\Program Files\Inbox
2008-02-24 20:18 ——— d—–w C:\Program Files\iTunes
2008-02-24 20:16 ——— d—–w C:\Program Files\QuickTime
2008-02-24 17:27 ——— d—–w C:\Program Files\DIFX
2008-02-24 17:24 ——— d—–w C:\Program Files\Common Files\Wise Installation Wizard
2008-02-18 19:22 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-02-16 04:06 ——— d—–w C:\Program Files\COD4 Rcon Commander (BETA)
2008-02-13 03:53 ——— d—–w C:\Program Files\Internet Explorer
2008-02-12 23:30 ——— d—–w C:\Documents and Settings\User\Application Data\gtk-2.0
2008-02-08 00:24 ——— d—–w C:\Program Files\Common Files\Adobe
2008-02-08 00:24 ——— d—–w C:\Program Files\Adobe
2008-02-04 23:09 18,214,008 —-a-w C:\WINDOWS\system32\MRT.exe
2008-02-02 20:46 ——— d—–w C:\Program Files\mIRC
2008-02-02 01:09 ——— d-s—w C:\Program Files\Xfire
2008-01-22 22:44 409,600 —-a-w C:\WINDOWS\system32\wrap_oal.dll
2008-01-22 22:44 114,688 —-a-w C:\WINDOWS\system32\OpenAL32.dll
2008-01-21 15:10 ——— d—–w C:\Program Files\American Conquest
2008-01-21 15:07 ——— d—–w C:\Program Files\EA GAMES
2008-01-21 14:59 ——— d—–w C:\Program Files\Ubisoft
2008-01-21 14:51 ——— d—–w C:\Program Files\Kuma Games
2008-01-21 14:50 ——— d—–w C:\Program Files\id Software
2008-01-20 18:41 ——— d—–w C:\Program Files\Bonjour
2008-01-20 18:37 ——— d—–w C:\Program Files\Common Files\Apple
2008-01-20 18:37 ——— d—–w C:\Program Files\Common Files
2008-01-18 17:32 ——— d—–w C:\Program Files\Microsoft Silverlight
2008-01-16 22:55 ——— d—–w C:\Documents and Settings\All Users\Application Data\2ACA5CC3-0F83-453D-A079-1076FE1A8B65
2008-01-16 22:38 54,608 —-a-w C:\WINDOWS\system32\xfcodec.dll
2008-01-12 04:47 674,600 —-a-w C:\WINDOWS\system32\pbsvc.exe
2008-01-12 04:47 66,872 —-a-w C:\WINDOWS\system32\PnkBstrA.exe
2008-01-12 04:47 22,328 —-a-w C:\Documents and Settings\User\Application Data\PnkBstrK.sys
2008-01-12 01:59 ——— d—–w C:\Documents and Settings\User\Application Data\HLSW
2008-01-12 01:27 2,289,489 —-a-w C:\WINDOWS\COD4 Rcon Commander (BETA) Uninstaller.exe
2008-01-11 05:53 44,544 —-a-w C:\WINDOWS\system32\pngfilt.dll
2008-01-11 01:46 ——— d—–w C:\Program Files\RD
2008-01-11 00:35 ——— d—–w C:\Program Files\GIMP-2.0
2008-01-10 02:31 ——— d—–w C:\Documents and Settings\User\Application Data\Xfire
2008-01-06 07:29 ——— d—–w C:\Program Files\GTactix
2008-01-06 01:39 ——— d—–w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-01-04 23:50 ——— d-s—w C:\Program Files\HLSW
2008-01-04 16:42 ——— d—–w C:\Program Files\EwisoftWeb
2008-01-04 16:42 ——— d—–w C:\Documents and Settings\All Users\Application Data\EwisoftWeb
2008-01-02 23:18 ——— d—–w C:\Program Files\Sierra Entertainment
2007-12-19 23:01 347,136 —-a-w C:\WINDOWS\system32\dxtmsft.dll
2007-12-11 19:46 524,288 —-a-w C:\WINDOWS\system32\DivXsm.exe
2007-12-11 19:46 3,596,288 —-a-w C:\WINDOWS\system32\qt-dx331.dll
2007-12-11 19:45 200,704 —-a-w C:\WINDOWS\system32\ssldivx.dll
2007-12-11 19:45 1,044,480 —-a-w C:\WINDOWS\system32\libdivx.dll
2007-12-11 19:43 12,288 —-a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2007-12-08 05:21 3,592,192 —-a-w C:\WINDOWS\system32\mshtml.dll
2007-12-06 11:00 70,656 —-a-w C:\WINDOWS\system32\ie4uinit.exe
2007-12-06 11:00 13,824 —-a-w C:\WINDOWS\system32\ieudinit.exe
2007-12-06 04:59 161,792 —-a-w C:\WINDOWS\system32\ieakui.dll
2007-12-04 18:38 550,912 —-a-w C:\WINDOWS\system32\oleaut32.dll
2007-11-28 23:34 286,720 —-a-w C:\WINDOWS\iun507.exe
2004-10-01 19:00 40,960 —-a-w C:\Program Files\Uninstall_CDS.exe
.

——- Sigcheck ——-

8f078ae4ed187aaabc0a305146de6716 C:\WINDOWS\system32\svchost.exe
—-a-w 14,336 2004-08-04 12:00:00 C:\WINDOWS\system32\svchost.exe
-c–a-w 14,336 2004-08-04 12:00:00 C:\WINDOWS\system32\dllcache\svchost.exe

2ed0b7f12a60f90092081c50fa0ec2b2 C:\WINDOWS\system32\ws2_32.dll
—-a-w 82,944 2004-08-04 12:00:00 C:\WINDOWS\system32\ws2_32.dll
-c–a-w 82,944 2004-08-04 12:00:00 C:\WINDOWS\system32\dllcache\ws2_32.dll

01c3346c241652f43aed8e2149881bfe C:\WINDOWS\system32\winlogon.exe
—-a-w 502,272 2004-08-04 12:00:00 C:\WINDOWS\system32\winlogon.exe
-c–a-w 502,272 2004-08-04 12:00:00 C:\WINDOWS\system32\dllcache\winlogon.exe

558635d3af1c7546d26067d5d9b6959e C:\WINDOWS\system32\drivers\ndis.sys
-c–a-w 182,912 2004-08-04 12:00:00 C:\WINDOWS\system32\dllcache\ndis.sys
—-a-w 182,912 2004-08-04 12:00:00 C:\WINDOWS\system32\drivers\ndis.sys

4448006b6bc60e6c027932cfc38d6855 C:\WINDOWS\system32\drivers\ip6fw.sys
-c–a-w 29,056 2004-08-04 12:00:00 C:\WINDOWS\system32\dllcache\ip6fw.sys
—-a-w 29,056 2004-08-04 12:00:00 C:\WINDOWS\system32\drivers\ip6fw.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\{FD8348AB-D74A-4C76-B2FE-926FF6D7CC40}]
@=MacDrive Volume Icons

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="c:\program files\steam\steam.exe" [2007-12-02 13:46 1266936]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 11:54 5674352]
"SaitekInstall"="D:\WinXP\setup.exe" [ ]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 07:00 15360]
"Uniblue SpeedUpMyPC"="" []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-09-17 00:07 8491008]
"nwiz"="nwiz.exe" [2007-09-17 00:07 1626112 C:\WINDOWS\system32\nwiz.exe]
"RTHDCPL"="RTHDCPL.EXE" [2006-05-18 01:27 16207872 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 05:04 2879488 C:\WINDOWS\SkyTel.exe]
"RemoteControl"="C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" [2004-11-02 19:24 32768]
"InCD"="C:\Program Files\Ahead\InCD\InCD.exe" [2006-03-13 21:06 1397760]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 09:50 155648]
"LGODDFU"="C:\Program Files\lg_fwupdate\fwupdate.exe" [2006-02-28 14:37 249856]
"P17Helper"="SPIRun.dll" [2006-07-03 12:43 10752 C:\WINDOWS\system32\SPIRUN.DLL]
"EasyTuneV"="C:\Program Files\Gigabyte\ET5\GUI.exe" [2004-06-14 11:54 200704]
"WinFoxV2"="C:\WINDOWS\system32\WF2K.exe" [2006-07-17 14:31 1490944]
"WinFast2KLoadDefault"="C:\WINDOWS\system32\wf2kcpl.dll" [2006-02-22 13:29 668672]
"WinFast Schedule"="C:\Program Files\WinFast\WFTVFM\WFWIZ.exe" [2006-07-07 17:15 348160]
"SDTray"="C:\Program Files\Spyware Doctor\SDTrayApp.exe" [2007-07-01 23:14 1051464]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 03:00 132496]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-02-11 17:14 29744]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 01:41 49152]
"{B179023B-6238-4499-8F26-CD73E9D90E0A}"="C:\Program Files\Mediafour\MacDrive 7\MacDrive.exe" [2007-07-12 09:57 179288]
"MDGetStarted.exe"="C:\Program Files\Mediafour\MacDrive 7\MDGetStarted.exe" [2007-06-13 12:23 139264]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-09-17 00:07 81920]
"Habu"="C:\Program Files\Razer\Habu\razerhid.exe" [2007-05-11 11:58 176128]
"UserFaultCheck"="C:\WINDOWS\system32\dumprep 0 -u" [ ]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]
"PATHPILOT"="C:\Program Files\MegaSoundRecorder\Mega Sound Recorder.exe" [ ]
"FlyMonitor"="C:\Program Files\Leapfrog\FlyWorld\bin\FlyMonitor.exe" [2007-11-15 14:32 669000]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-01-31 23:13 385024]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 13:10 267048]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2007-07-09 21:54:54 124912]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 03:21:22 288472]
Metacafe.lnk - C:\Program Files\Metacafe\MetacafeAgent.exe [2007-09-04 10:04:34 149256]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"C:\\WINDOWS\\system32\\rundll32.exe"=
"C:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"=
"C:\\Program Files\\Steam\\SteamApps\\generalramsey\\counter-strike source\\hl2.exe"=
"C:\\Program Files\\Steam\\SteamApps\\generalramsey\\day of defeat source\\hl2.exe"=
"C:\\Program Files\\Steam\\SteamApps\\generalramsey\\half-life 2 deathmatch\\hl2.exe"=
"C:\\Program Files\\THQ\\Company of Heroes\\RelicCOH.exe"=
"C:\\Program Files\\Steam\\SteamApps\\generalramsey\\source sdk base\\hl2.exe"=
"C:\\Program Files\\Strategy First\\Making History 2.0\\bin\\makehist.exe"=
"C:\\Program Files\\Steam\\SteamApps\\generalramsey\\garrysmod\\hl2.exe"=
"C:\\Program Files\\Ubisoft\\Faces of War\\facesofwar.exe"=
"C:\\Program Files\\Microsoft Games\\Microsoft Flight Simulator X\\fsx.exe"=
"C:\\Program Files\\America's Army\\System\\ArmyOps.exe"=
"C:\\Program Files\\Dreamcatcher\\First Battalion\\pea.exe"=
"C:\\Program Files\\EA GAMES\\Battlefield 1942\\BF1942.exe"=
"C:\\WINDOWS\\system32\\PnkBstrA.exe"=
"C:\\WINDOWS\\system32\\PnkBstrB.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Steam\\Steam.exe"=
"C:\\Program Files\\Steam\\SteamApps\\common\\company of heroes\\RelicCOH.exe"=
"C:\\Program Files\\Microsoft Games\\Flight Simulator 9\\fs9.exe"=
"C:\\Program Files\\Electronic Arts\\Battlefield 2142\\BF2142.exe"=
"C:\\Program Files\\Steam\\SteamApps\\generalramsey\\team fortress 2\\hl2.exe"=
"C:\\Program Files\\Steam\\SteamApps\\generalramsey\\half-life 2\\hl2.exe"=
"C:\\Program Files\\Electronic Arts\\Medal of Honor Airborne\\UnrealEngine3\\Binaries\\MOHA.exe"=
"C:\\Program Files\\Sierra\\FEAR\\FEAR.exe"=
"C:\\Program Files\\Steam\\SteamApps\\common\\call of duty 4\\iw3mp.exe"=
"C:\\Program Files\\HTC\\Aces High II\\aceshigh.exe"=
"C:\\Program Files\\id Software\\Enemy Territory - QUAKE Wars\\etqwded.exe"=
"C:\\Program Files\\id Software\\Enemy Territory - QUAKE Wars\\etqw.exe"=
"C:\\Program Files\\Sierra Entertainment\\World in Conflict\\wic.exe"=
"C:\\Program Files\\Sierra Entertainment\\World in Conflict\\wic_online.exe"=
"C:\\Program Files\\Sierra Entertainment\\World in Conflict\\wic_ds.exe"=
"C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=
"C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
"C:\\Program Files\\HLSW\\hlsw.exe"=
"C:\\Program Files\\ModernRcon v0.4\\PBUCON\\pbucon.exe"=
"C:\\Program Files\\GTactix\\GTactix.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\American Civil War - Gettysburg\\Gettysburg.exe"=
"C:\\Program Files\\mIRC\\mirc.exe"=
"C:\\Program Files\\Firaxis Games\\Sid Meier's Civilization IV\\Civilization4.exe"=
"C:\\Program Files\\LeapFrog\\FlyWorld\\bin\\FLYMonitor.exe"=
"C:\\Program Files\\LeapFrog\\FlyWorld\\bin\\FLYWorld.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"89:TCP"= 89:TCP:moongamers.com
"80:TCP"= 80:TCP:www.moongamers.com
"6112:UDP"= 6112:UDP:CoH
"30260:UDP"= 30260:UDP:CoH
"9100:UDP"= 9100:UDP:CoH

R0 MDFSYSNT;MacDrive file system driver;C:\WINDOWS\system32\drivers\MDFSYSNT.sys [2007-09-05 14:01]
R0 MDPMGRNT;MDPMGRNT;C:\WINDOWS\system32\drivers\MDPMGRNT.sys [2007-02-28 10:15]
R2 MacDriveService;MacDriveService;"C:\Program Files\Mediafour\MacDrive 7\MacDriveService.exe" [2007-05-01 13:55]
R2 OneStep Search Service;OneStep Search Service;"C:\Program Files\OneStepSearch\onestep.exe" "C:\Program Files\OneStepSearch\onestep.dll" Service []
R3 HabuFltr;Habu Mouse;C:\WINDOWS\system32\drivers\habu.sys [2006-10-23 12:09]
R3 MarkFun_NT;MarkFun_NT;C:\Program Files\Gigabyte\ET5\markfun.w32 [2005-04-27 11:40]
R3 P17xfi;Sound Blaster X-Fi Xtreme Audio;C:\WINDOWS\system32\drivers\P17xfi.sys [2007-06-13 10:08]
R3 p17xfilt;p17xfilt;C:\WINDOWS\system32\drivers\p17xfilt.sys [2007-08-20 13:35]
R3 WFIOCTL;WFIOCTL;C:\Program Files\WinFast\WFTVFM\WFIOCTL.SYS [2005-01-06 16:55]
R4 WINFOXIO;WINFOXIO;C:\WINDOWS\system32\Drivers\WINFOXIO.SYS [2005-03-25 18:24]
S3 GoogleDesktopManager-093007-112848;Google Desktop Manager 5.5.709.30344;"C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-02-11 17:14]
S3 SaiH0004;SaiH0004;C:\WINDOWS\system32\DRIVERS\SaiH0004.sys [2006-08-21 12:01]
S3 SaiL0004;SaiL0004;C:\WINDOWS\system32\DRIVERS\SaiL0004.sys [2006-08-21 12:02]
S3 SaiU0004;SaiU0004;C:\WINDOWS\system32\DRIVERS\SaiU0004.sys [2006-08-21 12:01]
S3 uisp;Freescale USB JW32 driver;C:\WINDOWS\system32\Drivers\usbicp.sys [2005-12-21 11:23]

*Newly Created Service* - GTNDIS5
.
Contents of the 'Scheduled Tasks' folder
"2008-02-16 15:23:04 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-02-15 20:00:00 C:\WINDOWS\Tasks\Norton Security Scan.job"
- C:\Program Files\Norton Security Scan\Nss.exe
"2008-02-21 03:29:26 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC Nag.job"
- C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe
"2007-10-13 20:31:49 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC.job"
- C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-25 17:47:16
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Post #6
Download the OTMoveIt.
  • Save it to your desktop.
  • Please double-click OTMoveIt.exe to run it.
Press cleanup & it will search for and delete/uninstall all the tools we have used
to fix your problems and all their backup folders and then delete itself when you next reboot.

—————————————————–

Reboot and rescan with HiJackThis and post a new log here.
Also please describe how your computer behaves at the moment.
Post #7 last edited
There are many symptoms my computer has, every once in a while fire fox seems to take up 100% of my CPU (it says so in the Task Manager), so i have to use Task Manager to exit out of it. Some things I try to run will trigger Spy ware doctor to give me a warning in the bottom left of my screen, if i choose to ignore that warning it closes and gives me an error message.

My HJT log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:15, on 2008-02-25
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Mediafour\MacDrive 7\MacDriveService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\OneStepSearch\onestep.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WLService.exe
C:\Program Files\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WMP54GSv1_1.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\OneStepSearch\onestep.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\lg_fwupdate\fwupdate.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Gigabyte\ET5\GUI.exe
C:\WINDOWS\system32\WF2K.EXE
C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Mediafour\MacDrive 7\MacDrive.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Razer\Habu\razerhid.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\Leapfrog\FlyWorld\bin\FlyMonitor.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\program files\steam\steam.exe
C:\Program Files\Razer\Habu\razertra.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Razer\Habu\razerofa.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Metacafe\MetacafeAgent.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.inbox.com/search/dispatcher.asp…&tbid=70041
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://\shdoclc.dll/dnserror.htm#http://moongamers.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.inbox.com/search/ie.aspx?tb_id=70041
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.inbox.com/support/sa_customize.aspx?TbId=70041
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Inbox\ctbr.dll
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_1.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Inbox\ctbr.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_1.dll
O3 - Toolbar: &Inbox Toolbar - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Inbox\ctbr.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: (no name) - {07AA283A-43D7-4CBE-A064-32A21112D94D} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LGODDFU] "C:\Program Files\lg_fwupdate\fwupdate.exe" blrun
O4 - HKLM\..\Run: [P17Helper] Rundll32 SPIRun.dll,RunDLLEntry
O4 - HKLM\..\Run: [EasyTuneV] C:\Program Files\Gigabyte\ET5\GUI.exe
O4 - HKLM\..\Run: [WinFoxV2] C:\WINDOWS\system32\WF2K.EXE Initial
O4 - HKLM\..\Run: [WinFast2KLoadDefault] rundll32.exe C:\WINDOWS\system32\wf2kcpl.dll,DllLoadDefaultSettings
O4 - HKLM\..\Run: [WinFast Schedule] C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [{B179023B-6238-4499-8F26-CD73E9D90E0A}] "C:\Program Files\Mediafour\MacDrive 7\MacDrive.exe"
O4 - HKLM\..\Run: [MDGetStarted.exe] "C:\Program Files\Mediafour\MacDrive 7\MDGetStarted.exe" /auto
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Habu] C:\Program Files\Razer\Habu\razerhid.exe
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [PATHPILOT] C:\Program Files\MegaSoundRecorder\Mega Sound Recorder.exe
O4 - HKLM\..\Run: [FlyMonitor] "C:\Program Files\Leapfrog\FlyWorld\bin\FlyMonitor.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SaitekInstall] "D:\WinXP\setup.exe" -S0 -R
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Folding@Home 5.03.lnk = ?
O4 - Startup: Metacafe.lnk = C:\Program Files\Metacafe\MetacafeAgent.exe
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Metacafe.lnk = C:\Program Files\Metacafe\MetacafeAgent.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: Download Image with Download Manager - tbr:iemenudownload
O8 - Extra context menu item: Download URL in selection with Download Manager - tbr:iemenudownsel
O8 - Extra context menu item: Download URL with Download Manager - tbr:iemenudownload
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Inbox Search - tbr:iemenu
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{E4DE0915-A520-4BCD-A811-A838F360917D}: NameServer = 192.168.1.254
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Inbox\ctbr.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Desktop Manager 5.5.709.30344 (GoogleDesktopManager-093007-112848) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MacDriveService - Mediafour Corporation - C:\Program Files\Mediafour\MacDrive 7\MacDriveService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: OneStep Search Service - OneStepSearch.net, Inc. - C:\Program Files\OneStepSearch\onestep.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: Spyware Doctor Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: WMP54GSSVC - GEMTEKS - C:\Program Files\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WLService.exe

–
End of file - 12666 bytes
Post #8
Run - ATF Cleaner instructions here.

—————-


Then download Malwarebytes' Anti-Malware to your desktop.

* Double-click mbam-setup.exe and follow the prompts to install the program.
* Be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform FULL SCAN, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad. Please save it to a convenient location. The log can also be opened by going to Start > All Programs > Malwarebytes' Anti-Malware > Logs > log-date.txt

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI