"YOUR SYSTEM IS INFECTED" desktop+popup virus

[franktothemax]

Logfile of Trend Micro HijackThis v2.0.3 (BETA)
Scan saved at 4:24:57 PM, on 1/19/2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 SP2 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\AVG\AVG9\avgtray.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\lxddcoms.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\AVG\AVG9\avgemc.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\ComboFix\CF9223.cfxxe
C:\ComboFix\mbr.cfxxe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\TrendMicro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [QlbCtrl.exe] C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe"
O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1262481124046
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} (GMNRev Class) - http://h20270.www2.hp.com/ediags/gmn...Detection2.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} (get_atlcom Class) - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free E-mail Scanner (avg9emc) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgemc.exe
O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Com4QLBEx - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: lxdd_device - - C:\WINDOWS\system32\lxddcoms.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 7134 bytes

[Broni]

How are the issues?


1. Please open Notepad

• Click Start , then Run
• Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

File::
c:\windows\DUMP59b8.tmp


Folder::
c:\program files\Common Files\Symantec Shared
c:\documents and settings\All Users\Application Data\Norton
c:\documents and settings\All Users\Application Data\Symantec
c:\documents and settings\All Users\Application Data\NortonInstaller
c:\program files\Avira
c:\documents and settings\All Users\Application Data\Avira


Driver::
AntiVirSchedulerService


Registry::

RegLockDel::

3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.




5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

• Combofix.txt
• A new HijackThis log.

[franktothemax]

ComboFix 10-01-19.02 - frank 01/19/2010 16:45:52.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1983.1279 [GMT -6:00]
Running from: c:\documents and settings\frank\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\frank\Desktop\CFScript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

FILE ::
"c:\windows\DUMP59b8.tmp"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Avira
c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\addr_file.html
c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\CONFIG\AVWIN.INI
c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\EVENTDB\avevtdb.dbe
c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\IDX\master.idx
c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\JOBS\produpd.avj
c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\JOBS\scanjob.avj
c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\JOBS\startupd.avj
c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\JOBS\updjob.avj
c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\LOGFILES\avguard.log
c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\LOGFILES\sched.log
c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\LOGFILES\setup.log
c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\LOGFILES\Upd-2010-01-19-16-02-28.log
c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\PROFILES\folder.avp
c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\PROFILES\rootkit.avp
c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\REPORTS\1c278670.avl
c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\TEMP\avguard.tmp
c:\documents and settings\All Users\Application Data\Norton
c:\documents and settings\All Users\Application Data\Norton\symdata.xml
c:\documents and settings\All Users\Application Data\NortonInstaller
c:\documents and settings\All Users\Application Data\NortonInstaller\Logs\01-17-2010-18h37m53s\Install.1.mft.7z
c:\documents and settings\All Users\Application Data\NortonInstaller\Logs\01-17-2010-18h37m53s\Norton Security Scan-0x0E70.log
c:\documents and settings\All Users\Application Data\NortonInstaller\Logs\01-17-2010-18h37m53s\NortonInstall-01-17-2010-18h37m53s.log
c:\documents and settings\All Users\Application Data\NortonInstaller\Logs\01-17-2010-18h38m38s\NortonInstall-01-17-2010-18h38m38s.log
c:\documents and settings\All Users\Application Data\NortonInstaller\Logs\12-31-2009-14h47m16s\Install.1.mft.7z
c:\documents and settings\All Users\Application Data\NortonInstaller\Logs\12-31-2009-14h47m16s\NortonInstall-12-31-2009-14h47m16s.log
c:\documents and settings\All Users\Application Data\NortonInstaller\Logs\12-31-2009-15h08m56s\NortonInstall-12-31-2009-15h08m56s.log
c:\documents and settings\All Users\Application Data\Symantec
c:\documents and settings\All Users\Application Data\Symantec\symdata.xml
c:\program files\Avira
c:\program files\Avira\AntiVir Desktop\about.htm
c:\program files\Avira\AntiVir Desktop\aebb.dll
c:\program files\Avira\AntiVir Desktop\aecore.dll
c:\program files\Avira\AntiVir Desktop\aecore.dll.tmp
c:\program files\Avira\AntiVir Desktop\aeemu.dll
c:\program files\Avira\AntiVir Desktop\aeemu.dll.tmp
c:\program files\Avira\AntiVir Desktop\aegen.dll
c:\program files\Avira\AntiVir Desktop\aegen.dll.tmp
c:\program files\Avira\AntiVir Desktop\aehelp.dll
c:\program files\Avira\AntiVir Desktop\aehelp.dll.tmp
c:\program files\Avira\AntiVir Desktop\aeheur.dll
c:\program files\Avira\AntiVir Desktop\aeheur.dll.tmp
c:\program files\Avira\AntiVir Desktop\aelidb.dat
c:\program files\Avira\AntiVir Desktop\aeoffice.dll
c:\program files\Avira\AntiVir Desktop\aepack.dll
c:\program files\Avira\AntiVir Desktop\aepack.dll.tmp
c:\program files\Avira\AntiVir Desktop\aerdl.dll
c:\program files\Avira\AntiVir Desktop\aerdl.dll.tmp
c:\program files\Avira\AntiVir Desktop\aesbx.dll
c:\program files\Avira\AntiVir Desktop\aescn.dll
c:\program files\Avira\AntiVir Desktop\aescn.dll.tmp
c:\program files\Avira\AntiVir Desktop\aescript.dll
c:\program files\Avira\AntiVir Desktop\aescript.dll.tmp
c:\program files\Avira\AntiVir Desktop\aeset.dat
c:\program files\Avira\AntiVir Desktop\aevdf.dat
c:\program files\Avira\AntiVir Desktop\aevdf.dll
c:\program files\Avira\AntiVir Desktop\aevdf.dll.tmp
c:\program files\Avira\AntiVir Desktop\alldiscs.avp
c:\program files\Avira\AntiVir Desktop\alldrives.avp
c:\program files\Avira\AntiVir Desktop\antivir.oem
c:\program files\Avira\AntiVir Desktop\antivir0.vdf
c:\program files\Avira\AntiVir Desktop\antivir1.vdf
c:\program files\Avira\AntiVir Desktop\antivir2.vdf
c:\program files\Avira\AntiVir Desktop\antivir3.vdf
c:\program files\Avira\AntiVir Desktop\avadmin.exe
c:\program files\Avira\AntiVir Desktop\avarkt.dll
c:\program files\Avira\AntiVir Desktop\avcenter.exe
c:\program files\Avira\AntiVir Desktop\avconfig.cpl
c:\program files\Avira\AntiVir Desktop\avconfig.dll
c:\program files\Avira\AntiVir Desktop\avconfig.exe
c:\program files\Avira\AntiVir Desktop\avconfig64.cpl
c:\program files\Avira\AntiVir Desktop\avconfigrc.dll
c:\program files\Avira\AntiVir Desktop\avevtlog.dll
c:\program files\Avira\AntiVir Desktop\avevtrc.dll
c:\program files\Avira\AntiVir Desktop\avgio.dll
c:\program files\Avira\AntiVir Desktop\avgio.sys
c:\program files\Avira\AntiVir Desktop\avgnt.exe
c:\program files\Avira\AntiVir Desktop\avgntflt.inf
c:\program files\Avira\AntiVir Desktop\avgntflt.sys
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Avira\AntiVir Desktop\avinet.dll
c:\program files\Avira\AntiVir Desktop\avipbb.inf
c:\program files\Avira\AntiVir Desktop\avipc.dll
c:\program files\Avira\AntiVir Desktop\avnotify.dll
c:\program files\Avira\AntiVir Desktop\avnotify.exe
c:\program files\Avira\AntiVir Desktop\avpref.dll
c:\program files\Avira\AntiVir Desktop\avreg.dll
c:\program files\Avira\AntiVir Desktop\avrep.dll
c:\program files\Avira\AntiVir Desktop\avscan.dat
c:\program files\Avira\AntiVir Desktop\avscan.dll
c:\program files\Avira\AntiVir Desktop\avscan.exe
c:\program files\Avira\AntiVir Desktop\avupgsvc.exe
c:\program files\Avira\AntiVir Desktop\avwin.chm
c:\program files\Avira\AntiVir Desktop\avwinll.dll
c:\program files\Avira\AntiVir Desktop\avwmi.dll
c:\program files\Avira\AntiVir Desktop\avwsc.exe
c:\program files\Avira\AntiVir Desktop\build.dat
c:\program files\Avira\AntiVir Desktop\ccev.dll
c:\program files\Avira\AntiVir Desktop\ccevrc.dll
c:\program files\Avira\AntiVir Desktop\ccgen.dll
c:\program files\Avira\AntiVir Desktop\ccgenrc.dll
c:\program files\Avira\AntiVir Desktop\ccgrdrc.dll
c:\program files\Avira\AntiVir Desktop\ccguard.dll
c:\program files\Avira\AntiVir Desktop\cclib.dll
c:\program files\Avira\AntiVir Desktop\cclic.dll
c:\program files\Avira\AntiVir Desktop\cclicrc.dll
c:\program files\Avira\AntiVir Desktop\ccmainrc.dll
c:\program files\Avira\AntiVir Desktop\ccmsg.dll
c:\program files\Avira\AntiVir Desktop\ccplg.xml
c:\program files\Avira\AntiVir Desktop\ccprofil.dll
c:\program files\Avira\AntiVir Desktop\ccquamgr.dll
c:\program files\Avira\AntiVir Desktop\ccquarc.dll
c:\program files\Avira\AntiVir Desktop\ccreporc.dll
c:\program files\Avira\AntiVir Desktop\ccreport.dll
c:\program files\Avira\AntiVir Desktop\ccscanrc.dll
c:\program files\Avira\AntiVir Desktop\ccsched.dll
c:\program files\Avira\AntiVir Desktop\ccscherc.dll
c:\program files\Avira\AntiVir Desktop\cctpc.dll
c:\program files\Avira\AntiVir Desktop\ccupdate.dll
c:\program files\Avira\AntiVir Desktop\ccupdrc.dll
c:\program files\Avira\AntiVir Desktop\cfglib.dll
c:\program files\Avira\AntiVir Desktop\default.wav
c:\program files\Avira\AntiVir Desktop\eula.txt
c:\program files\Avira\AntiVir Desktop\fact.exe
c:\program files\Avira\AntiVir Desktop\factrc.dll
c:\program files\Avira\AntiVir Desktop\FAILSAFE\aebb.dll
c:\program files\Avira\AntiVir Desktop\FAILSAFE\aecore.dll
c:\program files\Avira\AntiVir Desktop\FAILSAFE\aeemu.dll
c:\program files\Avira\AntiVir Desktop\FAILSAFE\aegen.dll
c:\program files\Avira\AntiVir Desktop\FAILSAFE\aehelp.dll
c:\program files\Avira\AntiVir Desktop\FAILSAFE\aeheur.dll
c:\program files\Avira\AntiVir Desktop\FAILSAFE\aelidb.dat
c:\program files\Avira\AntiVir Desktop\FAILSAFE\aeoffice.dll
c:\program files\Avira\AntiVir Desktop\FAILSAFE\aepack.dll
c:\program files\Avira\AntiVir Desktop\FAILSAFE\aerdl.dll
c:\program files\Avira\AntiVir Desktop\FAILSAFE\aesbx.dll
c:\program files\Avira\AntiVir Desktop\FAILSAFE\aescn.dll
c:\program files\Avira\AntiVir Desktop\FAILSAFE\aescript.dll
c:\program files\Avira\AntiVir Desktop\FAILSAFE\aeset.dat
c:\program files\Avira\AntiVir Desktop\FAILSAFE\aevdf.dat
c:\program files\Avira\AntiVir Desktop\FAILSAFE\aevdf.dll
c:\program files\Avira\AntiVir Desktop\FAILSAFE\antivir0.vdf
c:\program files\Avira\AntiVir Desktop\FAILSAFE\antivir1.vdf
c:\program files\Avira\AntiVir Desktop\FAILSAFE\antivir2.vdf
c:\program files\Avira\AntiVir Desktop\FAILSAFE\antivir3.vdf
c:\program files\Avira\AntiVir Desktop\FAILSAFE\avrep.dll
c:\program files\Avira\AntiVir Desktop\FAILSAFE\unacev2.dll
c:\program files\Avira\AntiVir Desktop\FAILSAFE\vbase000.vdf
c:\program files\Avira\AntiVir Desktop\FAILSAFE\vbase001.vdf
c:\program files\Avira\AntiVir Desktop\FAILSAFE\vbase002.vdf
c:\program files\Avira\AntiVir Desktop\FAILSAFE\vbase003.vdf
c:\program files\Avira\AntiVir Desktop\FAILSAFE\vbase004.vdf
c:\program files\Avira\AntiVir Desktop\FAILSAFE\vbase005.vdf
c:\program files\Avira\AntiVir Desktop\FAILSAFE\vbase006.vdf
c:\program files\Avira\AntiVir Desktop\FAILSAFE\vbase007.vdf
c:\program files\Avira\AntiVir Desktop\FAILSAFE\vbase008.vdf
c:\program files\Avira\AntiVir Desktop\FAILSAFE\vbase009.vdf
c:\program files\Avira\AntiVir Desktop\FAILSAFE\vbase010.vdf
c:\program files\Avira\AntiVir Desktop\FAILSAFE\vbase011.vdf
c:\program files\Avira\AntiVir Desktop\FAILSAFE\vbase012.vdf
c:\program files\Avira\AntiVir Desktop\FAILSAFE\vbase013.vdf
c:\program files\Avira\AntiVir Desktop\FAILSAFE\vbase014.vdf
c:\program files\Avira\AntiVir Desktop\FAILSAFE\vbase015.vdf
c:\program files\Avira\AntiVir Desktop\FAILSAFE\vbase016.vdf
c:\program files\Avira\AntiVir Desktop\FAILSAFE\vbase017.vdf
c:\program files\Avira\AntiVir Desktop\FAILSAFE\vbase018.vdf
c:\program files\Avira\AntiVir Desktop\FAILSAFE\vbase019.vdf
c:\program files\Avira\AntiVir Desktop\FAILSAFE\vbase020.vdf
c:\program files\Avira\AntiVir Desktop\FAILSAFE\vbase021.vdf
c:\program files\Avira\AntiVir Desktop\FAILSAFE\vbase022.vdf
c:\program files\Avira\AntiVir Desktop\FAILSAFE\vbase023.vdf
c:\program files\Avira\AntiVir Desktop\FAILSAFE\vbase024.vdf
c:\program files\Avira\AntiVir Desktop\FAILSAFE\vbase025.vdf
c:\program files\Avira\AntiVir Desktop\FAILSAFE\vbase026.vdf
c:\program files\Avira\AntiVir Desktop\FAILSAFE\vbase027.vdf
c:\program files\Avira\AntiVir Desktop\FAILSAFE\vbase028.vdf
c:\program files\Avira\AntiVir Desktop\FAILSAFE\vbase029.vdf
c:\program files\Avira\AntiVir Desktop\FAILSAFE\vbase030.vdf
c:\program files\Avira\AntiVir Desktop\FAILSAFE\vbase031.vdf
c:\program files\Avira\AntiVir Desktop\guardgui.exe
c:\program files\Avira\AntiVir Desktop\guardmsg.dll
c:\program files\Avira\AntiVir Desktop\hbedv.key
c:\program files\Avira\AntiVir Desktop\licmgr.dll
c:\program files\Avira\AntiVir Desktop\licmgr.exe
c:\program files\Avira\AntiVir Desktop\luke.dll
c:\program files\Avira\AntiVir Desktop\lukeres.dll
c:\program files\Avira\AntiVir Desktop\mgrs.dll
c:\program files\Avira\AntiVir Desktop\msgclient.dll
c:\program files\Avira\AntiVir Desktop\mydocs.avp
c:\program files\Avira\AntiVir Desktop\netnt.dll
c:\program files\Avira\AntiVir Desktop\prefix_msg.avr
c:\program files\Avira\AntiVir Desktop\process.avp
c:\program files\Avira\AntiVir Desktop\prodinfo.dat
c:\program files\Avira\AntiVir Desktop\rchelp.dll
c:\program files\Avira\AntiVir Desktop\rcimage.dll
c:\program files\Avira\AntiVir Desktop\rctext.dll
c:\program files\Avira\AntiVir Desktop\readme.txt
c:\program files\Avira\AntiVir Desktop\rmdiscs.avp
c:\program files\Avira\AntiVir Desktop\scewxmlw.dll
c:\program files\Avira\AntiVir Desktop\sched.exe
c:\program files\Avira\AntiVir Desktop\schedr.dll
c:\program files\Avira\AntiVir Desktop\setup.dll
c:\program files\Avira\AntiVir Desktop\setup.exe
c:\program files\Avira\AntiVir Desktop\setupprf.dat
c:\program files\Avira\AntiVir Desktop\shlext.dll
c:\program files\Avira\AntiVir Desktop\smtplib.dll
c:\program files\Avira\AntiVir Desktop\sqlite3.dll
c:\program files\Avira\AntiVir Desktop\ssmdrv.inf
c:\program files\Avira\AntiVir Desktop\sweb.zip
c:\program files\Avira\AntiVir Desktop\sysdir.avp
c:\program files\Avira\AntiVir Desktop\sysscan.avp
c:\program files\Avira\AntiVir Desktop\unacev2.dll
c:\program files\Avira\AntiVir Desktop\update.dll
c:\program files\Avira\AntiVir Desktop\update.exe
c:\program files\Avira\AntiVir Desktop\updaterc.dll
c:\program files\Avira\AntiVir Desktop\updext.dll
c:\program files\Avira\AntiVir Desktop\updfix.exe
c:\program files\Avira\AntiVir Desktop\updgui.dll
c:\program files\Avira\AntiVir Desktop\updguirc.dll
c:\program files\Avira\AntiVir Desktop\vbase000.vdf
c:\program files\Avira\AntiVir Desktop\vbase001.vdf
c:\program files\Avira\AntiVir Desktop\vbase002.vdf
c:\program files\Avira\AntiVir Desktop\vbase003.vdf
c:\program files\Avira\AntiVir Desktop\vbase004.vdf
c:\program files\Avira\AntiVir Desktop\vbase005.vdf
c:\program files\Avira\AntiVir Desktop\vbase006.vdf
c:\program files\Avira\AntiVir Desktop\vbase007.vdf
c:\program files\Avira\AntiVir Desktop\vbase008.vdf
c:\program files\Avira\AntiVir Desktop\vbase009.vdf
c:\program files\Avira\AntiVir Desktop\vbase010.vdf
c:\program files\Avira\AntiVir Desktop\vbase011.vdf
c:\program files\Avira\AntiVir Desktop\vbase012.vdf
c:\program files\Avira\AntiVir Desktop\vbase013.vdf
c:\program files\Avira\AntiVir Desktop\vbase014.vdf
c:\program files\Avira\AntiVir Desktop\vbase015.vdf
c:\program files\Avira\AntiVir Desktop\vbase016.vdf
c:\program files\Avira\AntiVir Desktop\vbase017.vdf
c:\program files\Avira\AntiVir Desktop\vbase018.vdf
c:\program files\Avira\AntiVir Desktop\vbase019.vdf
c:\program files\Avira\AntiVir Desktop\vbase020.vdf
c:\program files\Avira\AntiVir Desktop\vbase021.vdf
c:\program files\Avira\AntiVir Desktop\vbase022.vdf
c:\program files\Avira\AntiVir Desktop\vbase023.vdf
c:\program files\Avira\AntiVir Desktop\vbase024.vdf
c:\program files\Avira\AntiVir Desktop\vbase025.vdf
c:\program files\Avira\AntiVir Desktop\vbase026.vdf
c:\program files\Avira\AntiVir Desktop\vbase027.vdf
c:\program files\Avira\AntiVir Desktop\vbase028.vdf
c:\program files\Avira\AntiVir Desktop\vbase029.vdf
c:\program files\Avira\AntiVir Desktop\vbase030.vdf
c:\program files\Avira\AntiVir Desktop\vbase031.vdf
c:\program files\Avira\AntiVir Desktop\weblink.url
c:\program files\Avira\AntiVir Desktop\wksstats.dll
c:\program files\Avira\AntiVir Desktop\wsctool.exe

[franktothemax]

c:\program files\Common Files\Symantec Shared
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20100115.019\catalog.dat
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20100115.019\cceraser.dll
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20100115.019\ecmsvr32.dll
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20100115.019\eeCtrl.sys
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20100115.019\ERASER.grd
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20100115.019\ERASER.sig
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20100115.019\ERASER.spm
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20100115.019\ERASER.sys
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20100115.019\ESRDEF.BIN
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20100115.019\hh
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20100115.019\naveng.sys
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20100115.019\naveng32.dll
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20100115.019\navex15.sys
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20100115.019\navex32a.dll
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20100115.019\ncsacert.txt
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20100115.019\scrauth.dat
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20100115.019\symaveng.cat
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20100115.019\symaveng.inf
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20100115.019\SymErase.cat
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20100115.019\SymErase.inf
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20100115.019\TCDEFS.DAT
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20100115.019\TCSCAN7.DAT
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20100115.019\TCSCAN8.DAT
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20100115.019\TCSCAN9.DAT
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20100115.019\technote.txt
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20100115.019\TINF.DAT
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20100115.019\tinfidx.dat
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20100115.019\TINFL.DAT
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20100115.019\TSCAN1.DAT
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20100115.019\tscan1hd.dat
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20100115.019\V.GRD
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20100115.019\V.SIG
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20100115.019\VIRSCAN.INF
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20100115.019\VIRSCAN1.DAT
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20100115.019\VIRSCAN2.DAT
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20100115.019\VIRSCAN3.DAT
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20100115.019\VIRSCAN4.DAT
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20100115.019\VIRSCAN5.DAT
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20100115.019\VIRSCAN6.DAT
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20100115.019\VIRSCAN7.DAT
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20100115.019\VIRSCAN8.DAT
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20100115.019\VIRSCAN9.DAT
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20100115.019\WHATSNEW.TXT
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20100115.019\zdone.dat
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\catalog.dat
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\cceraser.dll
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\ecmsvr32.dll
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\eeCtrl.sys
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\ERASER.grd
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\ERASER.sig
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\ERASER.spm
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\ERASER.sys
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\esrdef.bin
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\hh
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\naveng.sys
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\naveng32.dll
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\navex15.sys
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\navex32a.dll
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\ncsacert.txt
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\scrauth.dat
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\symaveng.cat
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\symaveng.inf
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\SymErase.cat
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\SymErase.inf
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\tcdefs.dat
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\tcscan7.dat
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\tcscan8.dat
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\tcscan9.dat
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\technote.txt
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\tinf.dat
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\tinfidx.dat
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\tinfl.dat
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\tscan1.dat
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\tscan1hd.dat
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\v.grd
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\v.sig
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\virscan.inf
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\virscan1.dat
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\virscan2.dat
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\virscan3.dat
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\virscan4.dat
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\virscan5.dat
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\virscan6.dat
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\virscan7.dat
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\virscan8.dat
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\virscan9.dat
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\whatsnew.txt
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\zdone.dat
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\definfo.dat
c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\usage.dat
c:\windows\DUMP59b8.tmp

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_ANTIVIRSCHEDULERSERVICE
-------\Service_AntiVirSchedulerService


((((((((((((((((((((((((( Files Created from 2009-12-19 to 2010-01-19 )))))))))))))))))))))))))))))))
.

2010-01-19 22:00 . 2009-03-30 16:33 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2010-01-19 22:00 . 2009-02-13 18:29 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2010-01-19 22:00 . 2009-02-13 18:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2010-01-19 21:54 . 2010-01-19 21:54 -------- d--h--w- c:\windows\system32\GroupPolicy
2010-01-19 20:00 . 2010-01-19 20:00 388096 ----a-r- c:\documents and settings\frank\Application Data\Microsoft\Installer\{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}\HiJackThis.exe
2010-01-19 20:00 . 2010-01-19 20:00 -------- d-----w- c:\program files\TrendMicro
2010-01-18 15:14 . 2010-01-18 15:14 52224 ----a-w- c:\documents and settings\frank\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-01-18 15:14 . 2010-01-18 15:17 117760 ----a-w- c:\documents and settings\frank\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-01-18 15:14 . 2010-01-18 15:14 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2010-01-18 03:28 . 2010-01-18 03:28 12464 ----a-w- c:\windows\system32\avgrsstx.dll
2010-01-18 03:28 . 2010-01-18 03:28 333192 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2010-01-18 03:28 . 2010-01-18 03:28 28424 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2010-01-18 03:28 . 2010-01-19 14:15 -------- d-----w- c:\windows\system32\drivers\Avg
2010-01-18 03:28 . 2010-01-18 03:28 360584 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2010-01-18 03:28 . 2010-01-18 03:28 -------- d-----w- c:\program files\AVG
2010-01-18 01:11 . 2010-01-18 01:11 -------- d-----w- c:\documents and settings\frank\Application Data\Malwarebytes
2010-01-18 01:11 . 2010-01-07 22:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-18 01:11 . 2010-01-07 22:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-01-18 01:11 . 2010-01-18 01:11 -------- d-----w- c:\program files\Malwarebytes
2010-01-18 00:27 . 2010-01-18 00:27 -------- d-----w- c:\windows\system32\CatRoot_bak
2010-01-17 02:42 . 2010-01-18 03:28 -------- d-----w- c:\documents and settings\All Users\Application Data\avg9
2010-01-13 15:43 . 2009-11-21 15:51 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll
2010-01-06 08:57 . 2010-01-06 08:57 -------- d-----w- c:\program files\AC3Filter
2010-01-05 20:27 . 2010-01-05 20:27 -------- d-sh--w- c:\documents and settings\Guest\IETldCache
2010-01-05 20:25 . 2010-01-05 20:25 -------- d-sh--w- c:\documents and settings\Marcy\IETldCache
2010-01-04 18:50 . 2010-01-04 18:50 -------- d-----w- c:\documents and settings\frank\Local Settings\Application Data\PCHealth
2010-01-04 09:10 . 2010-01-04 09:11 -------- d-----w- C:\b15ed8c1a1319963d88c
2010-01-04 08:29 . 2010-01-04 08:29 -------- d-sh--w- c:\documents and settings\frank\PrivacIE
2010-01-04 03:25 . 2010-01-04 03:25 -------- d-sh--w- c:\documents and settings\frank\IETldCache
2010-01-03 23:03 . 2009-10-29 07:45 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2010-01-03 23:03 . 2009-10-29 07:45 594432 -c----w- c:\windows\system32\dllcache\msfeeds.dll
2010-01-03 23:03 . 2009-10-29 07:45 55296 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll
2010-01-03 23:03 . 2009-10-29 07:45 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2010-01-03 23:03 . 2009-10-29 07:45 1985536 -c----w- c:\windows\system32\dllcache\iertutil.dll
2010-01-03 23:03 . 2009-10-29 07:45 11069952 -c----w- c:\windows\system32\dllcache\ieframe.dll
2010-01-03 23:03 . 2010-01-05 09:01 -------- d-----w- c:\windows\ie8updates
2010-01-03 23:03 . 2009-10-02 04:44 92160 -c----w- c:\windows\system32\dllcache\iecompat.dll
2010-01-03 23:01 . 2010-01-03 23:03 -------- dc-h--w- c:\windows\ie8
2010-01-03 22:19 . 2010-01-03 22:19 -------- d-----w- c:\program files\MSXML 6.0
2010-01-03 20:08 . 2008-04-14 00:10 102912 -c----w- c:\windows\system32\dllcache\dpcdll.dll
2010-01-03 20:08 . 2008-04-14 00:09 24064 -c----w- c:\windows\system32\dllcache\pidgen.dll
2010-01-03 20:08 . 2008-04-14 00:12 10752 ------w- c:\windows\system32\smtpapi.dll
2010-01-03 20:08 . 2008-04-14 00:12 9728 ------w- c:\windows\system32\rwnh.dll
2010-01-03 20:08 . 2008-04-14 12:00 81920 ------w- c:\windows\system32\ieencode.dll
2010-01-03 20:08 . 2008-04-14 00:11 498742 -c----w- c:\windows\system32\dllcache\dxmasf.dll
2010-01-03 20:08 . 2008-04-14 12:00 87040 -c----w- c:\windows\system32\dllcache\drmstor.dll
2010-01-03 20:08 . 2008-04-14 12:00 695808 -c----w- c:\windows\system32\dllcache\drmv2clt.dll
2010-01-03 20:08 . 2008-04-14 12:00 299520 -c----w- c:\windows\system32\dllcache\drmclien.dll
2010-01-03 20:08 . 2008-04-14 00:12 294912 -c----w- c:\windows\system32\dllcache\dlimport.exe
2010-01-03 20:08 . 2008-04-14 12:00 33792 -c----w- c:\windows\system32\dllcache\custsat.dll
2010-01-03 20:08 . 2008-04-14 12:00 286720 -c----w- c:\windows\system32\dllcache\blackbox.dll
2010-01-03 20:08 . 2008-04-13 17:23 8192 -c----w- c:\windows\system32\dllcache\asferror.dll
2010-01-03 19:51 . 2008-06-13 11:05 272128 -c----w- c:\windows\system32\dllcache\bthport.sys
2010-01-03 19:49 . 2008-05-08 14:02 203136 -c----w- c:\windows\system32\dllcache\rmcast.sys
2010-01-03 19:49 . 2008-10-24 11:21 455296 -c----w- c:\windows\system32\dllcache\mrxsmb.sys
2010-01-03 19:49 . 2008-12-11 10:57 333952 -c----w- c:\windows\system32\dllcache\srv.sys
2010-01-03 19:49 . 2009-07-10 13:27 1315328 -c----w- c:\windows\system32\dllcache\msoe.dll
2010-01-03 19:49 . 2008-05-01 14:33 331776 -c----w- c:\windows\system32\dllcache\msadce.dll
2010-01-03 19:48 . 2008-04-11 19:04 691712 -c----w- c:\windows\system32\dllcache\inetcomm.dll
2010-01-03 19:48 . 2009-06-05 07:42 655872 -c----w- c:\windows\system32\dllcache\mstscax.dll
2010-01-03 19:48 . 2008-10-15 16:34 337408 -c----w- c:\windows\system32\dllcache\netapi32.dll
2010-01-03 19:48 . 2008-05-03 11:55 2560 ------w- c:\windows\system32\xpsp4res.dll
2010-01-03 19:48 . 2008-04-21 12:08 215552 -c----w- c:\windows\system32\dllcache\wordpad.exe
2010-01-03 13:31 . 2010-01-03 13:31 -------- d-----w- c:\documents and settings\Guest\Local Settings\Application Data\Mozilla
2010-01-03 13:31 . 2010-01-03 13:31 -------- d-----w- c:\documents and settings\Guest\Local Settings\Application Data\Apple Computer
2010-01-03 05:39 . 2010-01-04 06:31 -------- d-----w- c:\documents and settings\frank\Application Data\HpUpdate
2010-01-03 05:39 . 2010-01-03 05:39 -------- d-----w- c:\windows\Hewlett-Packard
2010-01-03 05:24 . 2008-04-14 12:00 221184 ----a-w- c:\windows\system32\wmpns.dll
2010-01-03 03:48 . 2010-01-03 05:21 -------- d-----w- c:\windows\system32\wbem\Repository.001
2010-01-03 03:46 . 2010-01-03 22:14 -------- d-----w- c:\windows\ServicePackFiles
2010-01-03 02:56 . 2010-01-03 02:56 10134 ----a-r- c:\documents and settings\frank\Application Data\Microsoft\Installer\{CAE7D1D9-3794-4169-B4DD-964ADBC534EE}\ARPPRODUCTICON.exe
2010-01-03 02:56 . 2010-01-03 05:39 -------- d-----w- c:\program files\HP
2010-01-03 02:56 . 2010-01-03 02:56 -------- d-----w- c:\windows\Downloaded Installations
2010-01-03 01:56 . 2002-08-29 09:40 20480 ----a-w- c:\windows\system32\drivers\hidserv.dll
2010-01-03 01:42 . 2004-08-02 20:20 4569 ------w- c:\windows\system32\secupd.dat
2010-01-03 01:22 . 2008-04-14 00:11 1082368 ----a-w- c:\windows\system32\esent.dll
2010-01-03 01:15 . 2010-01-16 09:35 -------- d-----w- c:\windows\system32\bits
2010-01-03 01:14 . 2010-01-17 09:02 -------- d--h--w- c:\windows\$hf_mig$
2010-01-03 01:13 . 2009-08-25 09:17 354816 ----a-w- c:\windows\system32\winhttp.dll
2010-01-03 01:13 . 2008-04-14 00:12 18944 ----a-w- c:\windows\system32\qmgrprxy.dll
2010-01-03 01:12 . 2009-08-07 01:24 44768 ----a-w- c:\windows\system32\wups2.dll
2010-01-03 00:57 . 2010-01-03 00:57 -------- d-----w- C:\WUTemp
2010-01-03 00:55 . 2001-08-18 04:36 8192 -c--a-w- c:\windows\system32\dllcache\tsbyuv.dll
2010-01-03 00:54 . 2008-04-14 00:11 191488 ----a-w- c:\windows\system32\iuengine.dll
2010-01-02 22:16 . 2002-08-29 12:00 5632 -c--a-w- c:\windows\system32\dllcache\kbdfa.dll
2010-01-02 22:15 . 2002-08-29 12:00 6144 -c--a-w- c:\windows\system32\dllcache\ftpsapi2.dll
2010-01-02 22:15 . 2002-08-29 12:00 5632 -c--a-w- c:\windows\system32\dllcache\iisrstap.dll
2010-01-02 22:15 . 2002-08-29 12:00 14336 -c--a-w- c:\windows\system32\dllcache\iisreset.exe
2010-01-02 22:15 . 2008-04-13 18:45 52864 ----a-w- c:\windows\system32\drivers\dmusic.sys
2010-01-02 22:15 . 2008-04-13 18:45 6272 ----a-w- c:\windows\system32\drivers\splitter.sys
2010-01-02 22:15 . 2010-01-02 22:15 -------- d-----w- c:\documents and settings\Default User\Application Data\DivX
2010-01-02 22:12 . 2008-04-14 00:12 131584 ----a-w- c:\windows\system32\sndrec32.exe
2010-01-02 22:03 . 2008-04-13 18:40 57600 ----a-w- c:\windows\system32\drivers\redbook.sys
2010-01-02 22:01 . 2002-08-29 12:00 13312 -c--a-w- c:\windows\system32\dllcache\irclass.dll
2010-01-02 22:01 . 2002-08-29 12:00 13312 ----a-w- c:\windows\system32\irclass.dll
2010-01-02 22:01 . 2002-08-29 12:00 24661 -c--a-w- c:\windows\system32\dllcache\spxcoins.dll
2010-01-02 22:01 . 2002-08-29 12:00 24661 ----a-w- c:\windows\system32\spxcoins.dll
2010-01-02 21:40 . 2008-04-14 00:13 40840 ----a-w- c:\windows\system32\drivers\termdd.sys
2010-01-02 21:40 . 2008-04-13 18:32 196224 ----a-w- c:\windows\system32\drivers\rdpdr.sys
2010-01-02 21:39 . 2008-04-13 18:54 11264 ----a-w- c:\windows\system32\drivers\irenum.sys
2010-01-02 21:39 . 2008-04-14 00:12 146432 ----a-w- c:\windows\system\winspool.drv
2010-01-02 21:39 . 2008-04-14 00:12 74752 ----a-w- c:\windows\system32\storprop.dll
2009-12-31 20:57 . 2009-12-31 20:57 286720 ------w- c:\windows\Setup1.exe
2009-12-31 20:57 . 2009-12-31 20:57 73216 ----a-w- c:\windows\ST6UNST.EXE
2009-12-31 20:44 . 2009-12-31 20:44 -------- d-----w- c:\documents and settings\All Users\Application Data\PY_Software
2009-12-31 20:29 . 2009-12-31 21:09 -------- d-----w- c:\program files\webcam2
2009-12-31 20:17 . 2008-04-14 00:12 53760 ----a-w- c:\windows\system32\vfwwdm32.dll
2009-12-31 20:17 . 2008-04-14 00:11 4096 -c--a-w- c:\windows\system32\dllcache\ksuser.dll
2009-12-31 20:17 . 2008-04-14 00:11 4096 ----a-w- c:\windows\system32\ksuser.dll
2009-12-31 20:17 . 2009-12-31 20:17 -------- d-----w- c:\documents and settings\frank\Application Data\ManyCam
2009-12-31 20:08 . 2009-12-31 21:09 -------- d-----w- c:\program files\webcam
2009-12-31 20:02 . 2009-12-31 20:03 -------- d-----w- c:\documents and settings\frank\.yawcam
2009-12-31 20:01 . 2009-12-31 21:00 -------- d-----w- c:\program files\Yawcam
2009-12-31 01:34 . 2009-12-31 01:34 -------- d-----w- c:\program files\NOS

[franktothemax]

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-19 22:55 . 2007-01-04 19:13 -------- d-----w- c:\documents and settings\frank\Application Data\uTorrent
2010-01-18 15:14 . 2010-01-17 20:35 -------- d-----w- c:\program files\SUPERAntiSpyware
2010-01-18 02:59 . 2007-01-03 05:28 -------- d-----w- c:\program files\COMODO
2010-01-18 01:14 . 2009-09-30 22:59 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-01-18 00:11 . 2010-01-17 02:42 -------- d-----w- c:\program files\AVG(2)
2010-01-18 00:11 . 2010-01-17 06:42 -------- d-----w- c:\program files\RegCleaner
2010-01-18 00:10 . 2010-01-17 23:49 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-01-17 23:49 . 2010-01-17 23:49 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-01-17 20:35 . 2010-01-17 20:35 -------- d-----w- c:\documents and settings\frank\Application Data\SUPERAntiSpyware.com
2010-01-17 02:43 . 2010-01-17 02:43 12464 ----a-w- c:\windows\system32\avgrsstx(2).dll
2010-01-12 22:49 . 2009-09-21 03:51 -------- d-----w- c:\program files\World of Warcraft
2010-01-08 10:57 . 2007-01-07 22:17 -------- d-----w- c:\documents and settings\frank\Application Data\Vso
2010-01-08 05:51 . 2007-01-04 10:05 14364 ---ha-w- c:\windows\system32\mlfcache.dat
2010-01-05 06:08 . 2007-01-03 04:29 14088 ----a-w- c:\documents and settings\frank\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-01-05 00:02 . 2009-09-29 00:22 -------- d-----w- c:\program files\DivX
2010-01-05 00:01 . 2009-09-29 00:22 -------- d-----w- c:\program files\Common Files\DivX Shared
2010-01-04 09:08 . 2010-01-04 09:08 -------- d-----w- c:\program files\MSBuild
2010-01-04 09:08 . 2010-01-04 09:08 -------- d-----w- c:\program files\Reference Assemblies
2010-01-04 08:50 . 2007-01-03 04:43 -------- d-----w- c:\program files\Hewlett-Packard
2010-01-03 03:51 . 2007-01-03 04:23 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-01-03 02:04 . 2007-01-03 04:43 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-01-03 01:56 . 2010-01-03 01:56 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_NuidFltr_01005.Wdf
2010-01-02 22:15 . 2010-01-02 22:15 2678 ----a-w- c:\windows\java\Packages\Data\SR97RBPN.DAT
2010-01-02 22:15 . 2010-01-02 22:15 558142 ----a-w- c:\windows\java\Packages\KTZRXVXJ.ZIP
2010-01-02 22:15 . 2010-01-02 22:15 2678 ----a-w- c:\windows\java\Packages\Data\O8A0OOEX.DAT
2010-01-02 22:15 . 2010-01-02 22:15 155995 ----a-w- c:\windows\java\Packages\DZ9ZZL3P.ZIP
2010-01-02 22:15 . 2010-01-02 22:15 2678 ----a-w- c:\windows\java\Packages\Data\Q25B9RXV.DAT
2010-01-02 22:15 . 2010-01-02 22:15 2678 ----a-w- c:\windows\java\Packages\Data\M4OZN7JF.DAT
2010-01-02 22:15 . 2010-01-02 22:15 2678 ----a-w- c:\windows\java\Packages\Data\F1ZJJNVF.DAT
2010-01-02 22:12 . 2007-01-03 04:21 22720 ----a-w- c:\windows\system32\emptyregdb.dat
2009-12-31 01:35 . 2009-09-29 03:25 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2009-12-19 01:09 . 2009-12-19 01:09 -------- d-----w- c:\documents and settings\Marcy\Application Data\Ventrilo
2009-12-13 07:05 . 2009-09-30 23:00 -------- d-----w- c:\documents and settings\frank\Application Data\Ventrilo
2009-12-10 17:19 . 2007-01-03 05:58 -------- d-----w- c:\program files\Digsby
2009-12-05 09:11 . 2009-12-05 09:11 -------- d-----w- c:\documents and settings\frank\Application Data\Acoustica
2009-12-05 09:11 . 2009-12-05 09:11 -------- d-----w- c:\documents and settings\All Users\Application Data\Acoustica
2009-11-21 15:51 . 2002-08-29 12:00 471552 ----a-w- c:\windows\AppPatch\aclayers.dll
2009-11-14 00:47 . 2009-11-14 00:47 856064 ----a-w- c:\windows\system32\divx_xx0c.dll
2009-11-14 00:47 . 2009-11-14 00:47 856064 ----a-w- c:\windows\system32\divx_xx07.dll
2009-11-14 00:47 . 2009-11-14 00:47 847872 ----a-w- c:\windows\system32\divx_xx0a.dll
2009-11-14 00:47 . 2009-11-14 00:47 843776 ----a-w- c:\windows\system32\divx_xx16.dll
2009-11-14 00:47 . 2009-11-14 00:47 839680 ----a-w- c:\windows\system32\divx_xx11.dll
2009-11-14 00:47 . 2009-11-14 00:47 696320 ----a-w- c:\windows\system32\DivX.dll
2009-10-29 07:45 . 2006-06-23 17:33 916480 ------w- c:\windows\system32\wininet.dll
2009-10-27 23:09 . 2009-10-27 23:09 12728 ----a-w- c:\documents and settings\Marcy\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2009-12-04 289584]
"NVIDIA nTune"="c:\program files\NVIDIA Corporation\nTune\nTuneCmd.exe" [2007-07-20 81920]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QlbCtrl.exe"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2008-08-01 202032]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-08-23 8478720]
"nwiz"="nwiz.exe" [2007-08-23 1626112]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2007-01-04 149280]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-09-05 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-09-21 305440]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-08-23 81920]
"SynTPStart"="c:\program files\Synaptics\SynTP\SynTPStart.exe" [2007-09-15 102400]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2008-12-08 54576]
"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2010-01-18 2033432]

c:\documents and settings\frank\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 20:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2010-01-18 03:28 12464 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0sprestrt

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ACU]
2007-05-03 23:42 376921 ----a-w- c:\program files\Atheros\ACU.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\STYLEXP]
2006-05-24 18:31 1372160 ----a-w- c:\program files\TGTSoft\StyleXP\StyleXP.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPStart]
2007-09-15 01:29 102400 ----a-w- c:\program files\Synaptics\SynTP\SynTPStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ACS"=2 (0x2)
"nTuneService"=2 (0x2)
"hpqwmiex"=3 (0x3)
"Com4QLBEx"=3 (0x3)
"StyleXPService"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-3.2.0.10314-to-3.2.2.10482-enUS-downloader.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-3.2.2.10482-to-3.2.2.10505-enUS-downloader.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=
"c:\\WINDOWS\\system32\\lxddcoms.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxddpswx.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxddjswx.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxddtime.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Digsby\\lib\\digsby-app.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [1/17/2010 9:28 PM 333192]
R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [1/17/2010 9:28 PM 360584]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [1/5/2010 7:56 AM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [1/5/2010 7:56 AM 74480]
R2 avg9emc;AVG Free E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [1/17/2010 9:28 PM 906520]
R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [1/17/2010 9:28 PM 285392]
R2 lxdd_device;lxdd_device;c:\windows\system32\lxddcoms.exe -service --> c:\windows\system32\lxddcoms.exe -service [?]
R3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [1/2/2007 10:43 PM 193840]
S3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\DRIVERS\ManyCam.sys --> c:\windows\system32\DRIVERS\ManyCam.sys [?]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [1/5/2010 7:56 AM 7408]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
.
.
------- Supplementary Scan -------
.
uStart Page = google.com
uInternet Settings,ProxyOverride = *.local
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\frank\Application Data\Mozilla\Firefox\Profiles\kybn2o2b.default\
FF - component: c:\program files\AVG\AVG9\Firefox\components\avgssff.dll
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-avgnt - c:\program files\Avira\AntiVir Desktop\avgnt.exe
AddRemove-Avira AntiVir Desktop - c:\program files\Avira\AntiVir Desktop\setup.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-19 16:52
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(904)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\WININET.dll

- - - - - - - > 'explorer.exe'(3232)
c:\windows\system32\WININET.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\IEFRAME.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\AVG\AVG9\avgchsvx.exe
c:\program files\AVG\AVG9\avgrsx.exe
c:\program files\AVG\AVG9\avgcsrvx.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\lxddcoms.exe
c:\windows\system32\nvsvc32.exe
c:\program files\AVG\AVG9\avgnsx.exe
c:\program files\AVG\AVG9\avgcsrvx.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\RUNDLL32.EXE
c:\program files\Synaptics\SynTP\SynTPEnh.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2010-01-19 16:57:51 - machine was rebooted
ComboFix-quarantined-files.txt 2010-01-19 22:57
ComboFix2.txt 2010-01-19 22:23

Pre-Run: 12,273,057,792 bytes free
Post-Run: 12,193,783,808 bytes free

- - End Of File - - 7670C97ABCB2E4EE0641FBBEE58B42D3

[franktothemax]

Logfile of Trend Micro HijackThis v2.0.3 (BETA)
Scan saved at 5:06:44 PM, on 1/19/2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 SP2 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\lxddcoms.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\AVG\AVG9\avgemc.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\AVG\AVG9\avgtray.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\TrendMicro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [QlbCtrl.exe] C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exe
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe"
O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1262481124046
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} (GMNRev Class) - http://h20270.www2.hp.com/ediags/gmn...Detection2.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} (get_atlcom Class) - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Unknown owner - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free E-mail Scanner (avg9emc) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgemc.exe
O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Com4QLBEx - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: lxdd_device - - C:\WINDOWS\system32\lxddcoms.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 6785 bytes

[Broni]

How is the computer doing?


1. Download Temp File Cleaner (TFC)
Double click on TFC.exe to run the program.
Click on Start button to begin cleaning process.
TFC will close all running programs, and it may ask you to restart computer.


2. Go to Kaspersky website and perform an online antivirus scan.

1. Disable your active antivirus program.
2. Read through the requirements and privacy statement and click on Accept button.
3. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
4. When the downloads have finished, click on Settings.
5. Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:

• Spyware, Adware, Dialers, and other potentially dangerous programs
• Archives
• Mail databases

6. Click on My Computer under Scan.
7. Once the scan is complete, it will display the results. Click on View Scan Report.
8. You will see a list of infected items there. Click on Save Report As....
9. Save this report to a convenient place. Change the Files of type to Text file (.txt before clicking on the Save button. Then post it here.