[Resolved] HijackThis Log

I recently bought a laptop for my deployment to Iraq (I am there right now) and on occasion my laptop just powers down. Now when I hit ctrl+alt+del there is no option for task manager (especially strange, I have never heard of that happening) and it seems to be a lot slower and locks up on occasion. I have done a scan with a fully updated AVG on all drives and a full system scan with Windows Defender. I also ran an error check and defragmented all drives. I have 2 built in hard drives and a backup drive.

Any and all help is greatly appreciatied, thanks for your time guys and girls.

Here is my HijackThis log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:36:44 PM, on 2/18/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16609)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Synaptics\SynTP\SynTPStart.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\iTunes\iTunes.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceHelper.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\distnoted.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\MSN Messenger\livecall.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\War\Desktop\PC Cleanup\HiJackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…n&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…n&pf=laptop
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O13 - Gopher Prefix:
O15 - Trusted Zone: http://*.www.di.fm
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - http://ipgweb.cce.hp.com/rdqnbk/downloads/sysinfo.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: avgwlntf - C:\Windows\SYSTEM32\avgwlntf.dll
O21 - SSODL: bdmnopx - {2828FC1A-426F-4CCB-AA0B-10CBD0AFCBB1} - C:\Windows\bdmnopx.dll
O21 - SSODL: admggxp - {90A96E54-B75A-4BC9-AFC1-18CC78EDD546} - C:\Windows\admggxp.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG7 Resident Shield Service (AvgCoreSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe

–
End of file - 6536 bytes

I did everything as you told me to and I have had no random power downs for awhile. I still don't have task manager when I press ctrl + alt + del and I made sure I am logged in as the administrator (I only have one user on this computer). Here is my new log file:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:59:44 AM, on 2/27/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16609)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Synaptics\SynTP\SynTPStart.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\MSN Messenger\livecall.exe
D:\PC Cleanup\HiJackThis\HijackThis.exe
C:\Windows\system32\DllHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…n&pf=laptop
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O13 - Gopher Prefix:
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - http://ipgweb.cce.hp.com/rdqnbk/downloads/sysinfo.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: avgwlntf - C:\Windows\SYSTEM32\avgwlntf.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG7 Resident Shield Service (AvgCoreSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe

–
End of file - 5715 bytes


Thanks for all of your help man.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:28:06 PM, on 2/27/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16609)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Synaptics\SynTP\SynTPStart.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\MSN Messenger\livecall.exe
D:\PC Cleanup\HiJackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…n&pf;=laptop
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O13 - Gopher Prefix:
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - http://ipgweb.cce.hp.com/rdqnbk/downloads/sysinfo.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: avgwlntf - C:\Windows\SYSTEM32\avgwlntf.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG7 Resident Shield Service (AvgCoreSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe

–
End of file - 5367 bytes


ComboFix 08-02-25.3 - War 2008-02-27 19:33:40.2 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1033.18.1208 [GMT 3:00]
Running from: C:\Users\[removed]\Desktop\ComboFix.exe
.

((((((((((((((((((((((((( Files Created from 2008-01-27 to 2008-02-27 )))))))))))))))))))))))))))))))
.

2008-02-25 00:57 . 2006-11-02 13:23 dr——- C:\Users\Mcx2\Videos
2008-02-25 00:57 . 2006-11-02 13:23 d——– C:\Users\Mcx2\Saved Games
2008-02-25 00:57 . 2006-11-02 13:23 dr——- C:\Users\Mcx2\Pictures
2008-02-25 00:57 . 2006-11-02 13:23 dr——- C:\Users\Mcx2\Music
2008-02-25 00:57 . 2006-11-02 13:23 dr——- C:\Users\Mcx2\Links
2008-02-25 00:57 . 2006-11-02 13:23 dr——- C:\Users\Mcx2\Downloads
2008-02-25 00:57 . 2008-02-25 00:57 dr——- C:\Users\Mcx2\Documents
2008-02-25 00:57 . 2008-02-25 00:57 d–h—– C:\Users\Mcx2\AppData
2008-02-14 18:48 . 2008-02-14 18:48 94,208 –a—— C:\Windows\DIIUnin.exe
2008-02-14 18:48 . 2008-02-14 19:03 26,771 –a—— C:\Windows\DIIUnin.dat
2008-02-14 18:48 . 2008-02-14 18:48 2,829 –a—— C:\Windows\DIIUnin.pif
2008-02-14 03:08 . 2008-02-14 03:08 194,560 –a—— C:\Windows\System32\WebClnt.dll
2008-02-14 03:08 . 2008-02-14 03:08 110,080 –a—— C:\Windows\System32\drivers\mrxdav.sys
2008-02-14 03:06 . 2008-02-14 03:06 4,247,552 –a—— C:\Windows\System32\GameUXLegacyGDFs.dll
2008-02-14 03:06 . 2008-02-14 03:06 1,686,528 –a—— C:\Windows\System32\gameux.dll
2008-02-10 21:14 . 2008-02-14 21:07 d——– C:\Users\War\AppData\Roaming\skypePM
2008-02-10 21:14 . 2008-02-10 21:14 32 –a—— C:\Users\All Users\ezsid.dat
2008-02-10 21:14 . 2008-02-10 21:14 32 –a—— C:\ProgramData\ezsid.dat
2008-02-10 21:12 . 2008-02-14 21:15 d——– C:\Users\War\AppData\Roaming\Skype
2008-02-10 21:07 . 2008-02-10 21:07 d——– C:\Users\All Users\Skype
2008-02-10 21:07 . 2008-02-10 21:07 d——– C:\ProgramData\Skype
2008-02-10 21:07 . 2008-02-10 21:07 d——– C:\Program Files\Skype
2008-02-10 21:07 . 2008-02-10 21:07 d——– C:\Program Files\Common Files\Skype
2008-02-07 01:00 . 2008-02-07 01:00 d——– C:\Users\War\AppData\Roaming\vlc
2008-02-04 21:58 . 2008-02-04 21:58 d——– C:\Windows\System32\URTTEMP
2008-02-01 21:02 . 2008-02-01 21:09 d——– C:\Program Files\Common Files\3DO Shared
2008-02-01 21:02 . 2008-02-01 21:09 d——– C:\Program Files\3DO
2008-02-01 21:01 . 1998-10-29 16:45 306,688 –a—— C:\Windows\IsUninst.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-24 20:30 ——— d—–w C:\Users\War\AppData\Roaming\LimeWire
2008-02-18 02:19 20 —h–w C:\Users\All Users\PKP_DLec.DAT
2008-02-18 02:19 20 —h–w C:\Users\All Users\PKP_DLds.DAT
2008-02-18 02:19 20 —h–w C:\ProgramData\PKP_DLec.DAT
2008-02-18 02:19 20 —h–w C:\ProgramData\PKP_DLds.DAT
2008-02-14 19:48 ——— d—–w C:\ProgramData\avg7
2008-02-14 00:07 803,328 —-a-w C:\Windows\system32\drivers\tcpip.sys
2008-02-14 00:07 45,112 —-a-w C:\Windows\system32\drivers\pciidex.sys
2008-02-14 00:07 3,504,696 —-a-w C:\Windows\System32\ntkrnlpa.exe
2008-02-14 00:07 3,470,392 —-a-w C:\Windows\System32\ntoskrnl.exe
2008-02-14 00:07 24,064 —-a-w C:\Windows\System32\netcfg.exe
2008-02-14 00:07 22,016 —-a-w C:\Windows\System32\netiougc.exe
2008-02-14 00:07 216,632 —-a-w C:\Windows\system32\drivers\netio.sys
2008-02-14 00:07 21,560 —-a-w C:\Windows\system32\drivers\atapi.sys
2008-02-14 00:07 167,424 —-a-w C:\Windows\System32\tcpipcfg.dll
2008-02-14 00:07 154,624 —-a-w C:\Windows\system32\drivers\nwifi.sys
2008-02-14 00:07 15,928 —-a-w C:\Windows\system32\drivers\pciide.sys
2008-02-14 00:07 109,624 —-a-w C:\Windows\system32\drivers\ataport.sys
2008-02-14 00:06 537,600 —-a-w C:\Windows\AppPatch\AcLayers.dll
2008-02-14 00:06 449,536 —-a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-02-14 00:06 2,144,256 —-a-w C:\Windows\AppPatch\AcGenral.dll
2008-02-14 00:06 173,056 —-a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-02-14 00:02 824,832 —-a-w C:\Windows\System32\wininet.dll
2008-02-14 00:02 56,320 —-a-w C:\Windows\System32\iesetup.dll
2008-02-14 00:02 52,736 —-a-w C:\Windows\AppPatch\iebrshim.dll
2008-02-14 00:02 26,624 —-a-w C:\Windows\System32\ieUnatt.exe
2008-02-13 20:26 ——— d—–w C:\Users\War\AppData\Roaming\OpenOffice.org2
2008-02-04 19:28 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-01-22 18:42 ——— d—–w C:\Users\War\AppData\Roaming\Any Video Converter
2008-01-22 17:42 ——— d—–w C:\Program Files\iTunes
2008-01-22 17:41 ——— d—–w C:\Program Files\iPod
2008-01-22 17:37 ——— d—–w C:\Program Files\QuickTime
2008-01-17 03:56 ——— d—–w C:\ProgramData\Media Center Programs
2008-01-17 03:55 278,728 —-a-w C:\Windows\system32\drivers\atksgt.sys
2008-01-17 03:55 25,416 —-a-w C:\Windows\system32\drivers\lirsgt.sys
2008-01-17 03:43 ——— d—–w C:\Program Files\Ubisoft
2008-01-13 02:16 ——— d—–w C:\Users\War\AppData\Roaming\U3
2008-01-10 02:36 ——— d—–w C:\Users\War\AppData\Roaming\muvee Technologies
2008-01-10 02:32 ——— d—–w C:\ProgramData\muvee Technologies
2008-01-09 22:18 ——— d—–w C:\Users\War\AppData\Roaming\ArcSoft
2008-01-09 22:16 ——— d—–w C:\ProgramData\Ultima_T15
2008-01-09 22:16 ——— d—–w C:\ProgramData\EnterNHelp
2008-01-09 22:13 ——— d—–w C:\Users\War\AppData\Roaming\Nikon
2008-01-09 22:13 ——— d—–w C:\Program Files\PictureProject In Touch Downloader
2008-01-09 22:13 ——— d—–w C:\Program Files\Common Files\Nikon
2008-01-09 22:12 ——— d—–w C:\ProgramData\Screen Savers
2008-01-09 22:12 ——— d—–w C:\ProgramData\Nikon
2008-01-09 22:12 ——— d—–w C:\Program Files\Nikon
2008-01-09 22:10 ——— d—–w C:\Program Files\ArcSoft
2008-01-08 23:24 ——— d—–w C:\Program Files\Windows Mail
2008-01-08 23:22 211,000 —-a-w C:\Windows\system32\drivers\volsnap.sys
2008-01-08 23:22 11,776 —-a-w C:\Windows\System32\sbunattend.exe
2008-01-08 23:22 1,060,920 —-a-w C:\Windows\system32\drivers\ntfs.sys
2008-01-08 23:22 ——— d—–w C:\Program Files\Windows Sidebar
2008-01-08 13:27 ——— d—–w C:\Program Files\astroempires
2008-01-08 13:26 247,828 —-a-w C:\Program Files\astroempires.zip
2007-12-28 16:21 104,448 —-a-w C:\Windows\system32\drivers\Rtlh86.sys
2007-12-28 16:01 ——— d—–w C:\Users\War\AppData\Roaming\AVG7
2007-12-14 20:48 1,244,672 —-a-w C:\Windows\System32\mcmde.dll
2007-12-13 17:12 1,327,104 —-a-w C:\Windows\System32\quartz.dll
2007-12-13 17:11 9,728 —-a-w C:\Windows\System32\LAPRXY.DLL
2007-12-13 17:11 223,232 —-a-w C:\Windows\System32\WMASF.DLL
2007-10-18 05:08 27,145 —-a-w C:\Users\War\AppData\Roaming\nvModes.dat
2007-10-17 02:56 174 –sha-w C:\Program Files\desktop.ini
2007-10-21 21:47 16,384 –sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\Cookies\index.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 15:35 125440]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2007-10-17 05:11 1006264]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-12-22 17:07 579072]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-01-15 11:22 267048]
"SynTPStart"="C:\Program Files\Synaptics\SynTP\SynTPStart.exe" [2007-09-15 10:29 102400]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="%WINDIR%\SMINST\launcher.exe" [ ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-10-25 06:43 219136]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
NkbMonitor.exe.lnk - C:\Program Files\Nikon\PictureProject\NkbMonitor.exe [2008-01-10 01:12:31 118784]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgwlntf]
avgwlntf.dll 2007-10-17 06:22 9216 C:\Windows\System32\avgwlntf.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
–a—— 2007-10-11 03:51 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
–a—— 2007-09-18 17:16 171464 C:\Program Files\DAEMON Tools\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Health Check Scheduler]
–a—— 2007-06-05 18:12 71176 C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
–a—— 2005-02-17 09:11 49152 C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpWirelessAssistant]
–a—— 2007-03-01 23:18 472776 C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif]
–a—— 2007-02-12 17:37 174872 C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
–a—— 2008-01-15 11:22 267048 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
–a—— 2007-05-15 08:38 8429568 C:\Windows\system32\NvCpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
–a—— 2007-05-15 08:38 81920 C:\Windows\system32\NvMcTray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QlbCtrl]
–a—— 2007-02-13 21:38 159744 C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QPService]
–a—— 2007-04-24 04:11 176128 C:\Program Files\HP\QuickPlay\QPService.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
–a—— 2008-01-10 23:27 385024 C:\Program Files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]
–a—— 2007-03-09 20:50 4390912 C:\Windows\RtHDVCpl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMSERIAL]
–a—— 2006-10-09 23:43 729088 C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
–a—— 2007-09-25 09:11 132496 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
–a—— 2007-09-15 10:50 1021224 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPStart]
–a—— 2007-09-15 10:29 102400 C:\Program Files\Synaptics\SynTP\SynTPStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WAWifiMessage]
–a—— 2007-01-11 02:12 317128 C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{220513BC-B2BE-4FA0-BAC9-60F5F7F74726}"= C:\Program Files\HP\QuickPlay\QP.exe:Quick Play|Desc=Quick Play
"{5A90CF99-4F43-41A7-BD63-833D156B1E88}"= C:\Program Files\HP\QuickPlay\QPService.exe:Quick Play Resident Program|Desc=Quick Play Resident Program
"{95383F02-9BF8-4FFB-9917-671A202B8E80}"= UDP:C:\Program Files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{CD4068D7-B5D6-4E40-BF0F-A5E33A97304B}"= TCP:C:\Program Files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{94F144FD-51FF-47FC-9888-47B9EB6EBB2C}"= UDP:C:\Program Files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{D4E92348-BAF7-45C0-8F15-C60F4331067A}"= TCP:C:\Program Files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{F03EBEA6-16B0-45AC-BFB6-B06BA544D646}"= UDP:C:\Program Files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{463360B5-9168-4A8C-99C2-D408F72A831A}"= TCP:C:\Program Files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{E2B58408-A741-4057-81DE-556EF2790006}"= UDP:C:\Program Files\SmartFTP Client\SmartFTP.exe:SmartFTP Client
"{260CDAD4-FC3B-4206-AB5F-F1938A4C4B94}"= TCP:C:\Program Files\SmartFTP Client\SmartFTP.exe:SmartFTP Client
"TCP Query User{6AE1073A-2FF2-4AAB-AA97-3ECD4C26AADB}C:\program files\hp games\wheel of fortune\wheel of fortune.exe"= UDP:C:\program files\hp games\wheel of fortune\wheel of fortune.exe:Wheel of Fortune|Desc=Wheel of Fortune
"UDP Query User{8D444368-C475-4001-9B3A-9B373F7A3644}C:\program files\hp games\wheel of fortune\wheel of fortune.exe"= TCP:C:\program files\hp games\wheel of fortune\wheel of fortune.exe:Wheel of Fortune|Desc=Wheel of Fortune
"{FD56858F-AD9F-4737-8CA5-7DAC1B0937E6}"= C:\Program Files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)|Edge=TRUE|
"{27B76849-B574-49B0-8A3B-D8E2BA02FA50}"= UDP:C:\Program Files\Atari\Neverwinter Nights 2\nwn2main.exe:Neverwinter Nights 2 Main
"{9DF7287D-79BF-43A8-BE07-0C1B43E39200}"= TCP:C:\Program Files\Atari\Neverwinter Nights 2\nwn2main.exe:Neverwinter Nights 2 Main
"{7F0B5251-0FA4-4F9B-84D3-98022F44FEEB}"= UDP:C:\Program Files\Atari\Neverwinter Nights 2\nwn2main_amdxp.exe:Neverwinter Nights 2 AMD
"{7977D25C-E1F7-4690-A074-53FE8FB341D5}"= TCP:C:\Program Files\Atari\Neverwinter Nights 2\nwn2main_amdxp.exe:Neverwinter Nights 2 AMD
"{D049E5CD-90D9-4E6E-B44B-818ABD99925E}"= UDP:C:\Program Files\Atari\Neverwinter Nights 2\nwupdate.exe:Neverwinter Nights 2 Updater
"{B5D3226D-57DB-4412-BDCD-E94C865B6A16}"= TCP:C:\Program Files\Atari\Neverwinter Nights 2\nwupdate.exe:Neverwinter Nights 2 Updater
"{F49089DD-D10C-406B-93FA-5EF1855FFF2B}"= UDP:C:\Program Files\Atari\Neverwinter Nights 2\nwn2server.exe:Neverwinter Nights 2 Server
"{321CB5D2-C3BF-4485-BB2D-65471F045BB2}"= TCP:C:\Program Files\Atari\Neverwinter Nights 2\nwn2server.exe:Neverwinter Nights 2 Server
"{D155C57B-A896-4A7C-AD7D-80AB0B784A55}"= UDP:C:\Program Files\THQ\Gas Powered Games\Supreme Commander\bin\SupremeCommander.exe:Supreme Commander
"{98994F47-1AFA-4A4B-A554-EF352DA6CCF2}"= TCP:C:\Program Files\THQ\Gas Powered Games\Supreme Commander\bin\SupremeCommander.exe:Supreme Commander
"{BF7BAB0E-CF88-4AE4-B63B-937652F0698A}"= UDP:C:\Program Files\THQ\Gas Powered Games\GPGNet\GPG.Multiplayer.Client.exe:GPGNet - Supreme Commander
"{315741C3-AF61-4B80-8BB1-A9E0B77E1270}"= TCP:C:\Program Files\THQ\Gas Powered Games\GPGNet\GPG.Multiplayer.Client.exe:GPGNet - Supreme Commander
"{C6433CD7-6EDB-48BD-BA9C-491F43A437CA}"= UDP:C:\Program Files\LucasArts\Star Wars Empire at War\GameData\sweaw.exe:Star Wars: Empire at War
"{26B3DA7C-B6DC-45DB-A7A6-A6F4252A745F}"= TCP:C:\Program Files\LucasArts\Star Wars Empire at War\GameData\sweaw.exe:Star Wars: Empire at War
"{9EEF8FAF-A391-4951-BBEA-DBF0DC39F8E7}"= UDP:C:\Program Files\LucasArts\Star Wars Empire at War Forces of Corruption\swfoc.exe:Star Wars®: Empire at War™: Forces of Corruption™
"{2D2FF4D0-9E1D-4EB2-99B3-433C42C447BE}"= TCP:C:\Program Files\LucasArts\Star Wars Empire at War Forces of Corruption\swfoc.exe:Star Wars®: Empire at War™: Forces of Corruption™
"{59C42A26-F449-468E-AE2A-E806FEF62535}"= UDP:C:\Program Files\Sierra Entertainment\World in Conflict\wic.exe:World in Conflict
"{B1B5EBDB-E849-46BD-BDCF-7DF83AA71EB8}"= TCP:C:\Program Files\Sierra Entertainment\World in Conflict\wic.exe:World in Conflict
"{2E829442-0318-405B-9FC7-90551C4873CE}"= UDP:C:\Program Files\Sierra Entertainment\World in Conflict\wic_online.exe:World in Conflict - Online Only
"{C47A7790-F417-4677-A2A5-EE9741CCE649}"= TCP:C:\Program Files\Sierra Entertainment\World in Conflict\wic_online.exe:World in Conflict - Online Only
"{85CC481D-9538-4916-B4F4-58075FE82855}"= UDP:C:\Program Files\Sierra Entertainment\World in Conflict\wic_ds.exe:World in Conflict - Dedicated Server
"{84E8CA83-E924-448D-B00D-D5E902B0211C}"= TCP:C:\Program Files\Sierra Entertainment\World in Conflict\wic_ds.exe:World in Conflict - Dedicated Server
"TCP Query User{7945D97B-2567-4B47-8D33-DF2EF2B1DA40}C:\program files\sierra\fear\fpupdate.exe"= UDP:C:\program files\sierra\fear\fpupdate.exe:fpupdate|Desc=fpupdate
"UDP Query User{29E70005-EEBF-44DF-81EB-E5C9FD4254EE}C:\program files\sierra\fear\fpupdate.exe"= TCP:C:\program files\sierra\fear\fpupdate.exe:fpupdate|Desc=fpupdate
"{2C6718D6-82E4-4990-A255-46DEAA69B250}"= UDP:C:\Program Files\Sierra\FEAR\FEAR.exe:FEAR
"{9F335A2A-8A21-46EF-820C-0A51CCF4DCC2}"= TCP:C:\Program Files\Sierra\FEAR\FEAR.exe:FEAR
"{3CD87DC8-55C7-4AA0-B254-B26A299AA21B}"= UDP:C:\Program Files\Sierra\FEAR\FEARMP.exe:FEAR
"{83E0DDE2-6ECC-4E09-98B5-4D86B992AB07}"= TCP:C:\Program Files\Sierra\FEAR\FEARMP.exe:FEAR
"{BF4C97D5-5A9A-4FC2-BF91-A6E14D8F3402}"= UDP:C:\Program Files\Flagship Studios\Hellgate London\Launcher.exe:Hellgate: London
"{855BAA1C-B274-483A-92FC-8B53ACB8BCAD}"= TCP:C:\Program Files\Flagship Studios\Hellgate London\Launcher.exe:Hellgate: London
"{CA401B04-C2FF-449F-94CC-A5678FE88790}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{FEEEA320-8C8B-4BA5-9FDE-1741C02F8899}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes
"TCP Query User{EDEB0457-D3BC-41DF-91E3-48D5C47A7338}D:\itunes\itunes.exe"= UDP:D:\itunes\itunes.exe:iTunes|Desc=iTunes
"UDP Query User{F82DF302-F986-40A9-8322-35FE97F77B6E}D:\itunes\itunes.exe"= TCP:D:\itunes\itunes.exe:iTunes|Desc=iTunes
"{2893022B-8F16-4545-814B-91CDA45833BA}"= UDP:C:\Program Files\Ubisoft\THE SETTLERS - Rise of an Empire\base\bin\Settlers6.exe:THE SETTLERS - Rise of an Empire
"{99618164-D785-486F-A17C-B03298A21BBB}"= TCP:C:\Program Files\Ubisoft\THE SETTLERS - Rise of an Empire\base\bin\Settlers6.exe:THE SETTLERS - Rise of an Empire
"TCP Query User{1189BBD1-7211-4893-9A69-4419C5DF9F92}D:\sword of the stars\sword of the stars.exe"= UDP:D:\sword of the stars\sword of the stars.exe:Sword of the Stars|Desc=Sword of the Stars
"UDP Query User{EADC33A5-06B5-4F86-B8F1-18E157F8A5F9}D:\sword of the stars\sword of the stars.exe"= TCP:D:\sword of the stars\sword of the stars.exe:Sword of the Stars|Desc=Sword of the Stars
"{A6C13759-94EB-413D-AF26-0EFBE609618E}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{5DCDC3A1-C4DA-449C-9121-9ACF2E1C8AB7}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes
"TCP Query User{0B6961F4-7A0C-476C-A3FC-AFE90289182A}D:\diablo ii\game.exe"= UDP:D:\diablo ii\game.exe:Diablo II|Desc=Diablo II
"UDP Query User{E3A5DBDF-3FFF-4C27-B016-83FA1C6F6DDB}D:\diablo ii\game.exe"= TCP:D:\diablo ii\game.exe:Diablo II|Desc=Diablo II
"{B592456D-0B5F-47CA-BA28-3322B7D050FC}"= Disabled:UDP:C:\Program Files\Skype\Phone\Skype.exe:Skype
"{548BD42F-6708-4554-A29E-699B7865BE9B}"= Disabled:TCP:C:\Program Files\Skype\Phone\Skype.exe:Skype

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\EarthLink TotalAccess\TaskPanl.exe"= C:\Program Files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink

R3 AvgWFP;AVG7 Firewall Driver x86;C:\Windows\system32\Drivers\avgwfp.sys [2007-12-22 17:07]
R3 NETw4v32;Intel® Wireless WiFi Link Adapter Driver for Windows Vista 32 Bit;C:\Windows\system32\DRIVERS\NETw4v32.sys [2007-09-26 13:12]
R3 RTL8169;Realtek 8169 NT Driver;C:\Windows\system32\DRIVERS\Rtlh86.sys [2007-12-28 19:21]
S3 BCM43XV;Broadcom Extensible 802.11 Network Adapter Driver;C:\Windows\system32\DRIVERS\bcmwl6.sys [2006-11-02 10:30]
S3 hcw85bda;Hauppauge WinTV 885 Video Capture;C:\Windows\system32\drivers\HCW85BDA.sys [2006-12-02 01:41]
S3 UMPass;Microsoft UMPass Driver;C:\Windows\system32\DRIVERS\umpass.sys [2006-11-02 11:55]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{152aab1d-7ffb-11dc-b149-001b247e5028}]
\shell\AutoRun\command - G:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{152aab20-7ffb-11dc-b149-001b247e5028}]
\shell\AutoRun\command - H:\NoAutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{77663f62-d0ef-11dc-8b58-001b247e5028}]
\shell\AutoRun\command - "I:\Install FreeAgent Tools.exe" /run

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cd3ec90c-c175-11dc-91c5-001b247e5028}]
\shell\AutoRun\command - J:\LaunchU3.exe

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-27 19:34:48
Windows 6.0.6000 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-27 19:35:57
ComboFix-quarantined-files.txt 2008-02-27 16:35:54
ComboFix2.txt 2008-02-27 16:08:35
.
2008-02-24 17:23:14 — E O F —