Every time that I right click to edit or delete my PC freezes.
Two error messages appear, windows explorer has encountered a problem and needs to close,
and DrWatson Post-mortem Debugger has encountered a problem and needs to close.
jephree has had a look at the error logs and suggested I post a hijackthis log here,the following
has just arrived from jephree:- DEFINITION OF: SET2.TMP
Safety Rating: Known Malware, do not run
Malware Family: Part of Malware group - Win32/Windu G
Malware Form: EXPLOIT

HJT LOG

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 04:42:04, on 06/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\PC Tools Firewall Plus\FWService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\a-squared Free\a2service.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\Program Files\ThreatFire\TFService.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Webroot\Washer\WasherSvc.exe
C:\WINDOWS\system32\ntvdm.exe
C:\Program Files\AnalogX\NetStat Live\nsl.exe
C:\Program Files\ThreatFire\TFTray.exe
C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe
C:\WINDOWS\system32\atwtusb.exe
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
C:\WINDOWS\system32\TBLMOUSE.EXE
C:\WINDOWS\System32\alg.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\WinTV\Ir.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Program Files\Opera\Opera.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Crawler Toolbar - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O4 - HKLM\..\Run: [NetStat Live] C:\Program Files\AnalogX\NetStat Live\nsl.exe
O4 - HKLM\..\Run: [ThreatFire] C:\Program Files\ThreatFire\TFTray.exe
O4 - HKLM\..\Run: [Openwares LiveUpdate] C:\Program Files\LiveUpdate\LiveUpdate.exe
O4 - HKLM\..\Run: [00PCTFW] "C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe" -s
O4 - HKLM\..\Run: [atwtusb] atwtusb.exe beta
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware 2007\Ad-Watch2007.exe
O4 - HKCU\..\Run: [AVG] C:\Program Files\Grisoft\AVG7\avgcc.exe
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
O4 - Startup: StartupFaster
O4 - Global Startup: StartupFaster
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://*.mcafee.com
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/softwareupda...31/CTSUEng.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://utilities.pcpitstop.com/da/PCPitStop.CAB
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1206022995125
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/softwareupda...5034/CTPID.cab
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O20 - AppInit_DLLs:
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HauppaugeTVServer - Hauppauge Computer Works - C:\PROGRA~1\WinTV\HCWTVS~1.EXE
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: PC Tools Firewall Plus (PCToolsFirewallPlus) - PC Tools - C:\Program Files\PC Tools Firewall Plus\FWService.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: ThreatFire - PC Tools - C:\Program Files\ThreatFire\TFService.exe
O23 - Service: Window Washer Engine (wwEngineSvc) - Webroot Software, Inc. - C:\Program Files\Webroot\Washer\WasherSvc.exe

--
End of file - 8040 bytes

SET2.TMP

I see many files with random name variations like that and it isn't necessarily the infection suggested by Jephree. There were also other variations of this as SET*.TMP where * equals a single digit number.



We might benefit by a more definitive diagnostic attempt, here:

HIDDEN FILES: To make sure you can see any and all hidden files, please follow the directions here



Submit the following file(s) to VirusTotal for their immediate evaluation and feedback. Use any of the following methods, as appropriate:

• Locate FULL FILE PATH if not apparent. Use Start (BUTTON)>Search, [WINDOWS+F] keys, or F3 key (from desktop).
• Copy & Paste the FULL FILE PATH into the input BOX
  -- OR --
• Navigate to the file in question.

Post those results in your next reply (if malware findings were indicated) for:

SET2.TMP
[suggest you submit several other variations for analysis as well]






The following scan will often remove such files:

Download ComboFix from one of the following links below:

Here or Here to your Desktop.


**Note: If you already have Combofix, delete previous copy(s) and download the latest version. It is important that it is saved directly to your desktop**

Combofix will disconnect your machine from the Internet and restore connections before it completes its run. If Combofix terminates prematurely and breaks the Internet connections, they can be restored manually by rebooting the machine. Note: If you have an "always on" connection (DSL/cable), unplug the cable from the modem before running Combofix. Do not reconnect before Combofix has finished its scan.

• Very Important! Temporarily disable your:
  • anti-virus,
  • script blocking and
  • any anti-malware real-time protection
  before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause unpredictable results.
• Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
  
  
• Double click combofix.exe and follow the prompts.
• When finished, it shall produce a log for you. Post that log and a HijackThis log in your next reply

Note: Do not mouseclick combofix's window while its running. That may cause it to stall

ComboFix SHOULD NOT be used unless requested by a forum helper.




Thereafter, you should check if files of the pattern *.TMP still exist. Your result may be better if done in SAFE MODE (tapping the F8 key while rebooting). Do a search on the following exact TEXT and delete all items found:

*.TMP




Lastly,

Please download ATF Cleaner http://www.atribune.org/ccount/click.php?id=1 by Atribune.
This program is for XP and Windows 2000 only

It does not require any installation and uses minimal system resources. It is set up to clean IE, FireFox and Opera, and detects the browsers you have and grays out the other(s).

• Double-click ATF-Cleaner.exe to run the program.
  Under Main choose: Select All
  Recommend UNCHECKING COOKIES if you rely on system remembered passwords.
  Click the Empty Selected button.

If you use Firefox browser

• Click Firefox at the top and choose: Select All EXCEPT FIREFOX SAVED PASSWORDS
  Click the Empty Selected button.
  NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

• Click Opera at the top and choose: Select All EXCEPT COOKIES AND SAVED PASSWORDS
  Click the Empty Selected button.
  NOTE: If you would like to keep your cookies and saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.



Let us know how you make out with any current observations and requested logs.

Not sure what to do after hidden files are unchecked? Do I run HJT and post log? Or do I run search for SET2.TMP and then copy/paste the full file path onto the virus total site?
Quote:
There are no foolish questions; the only thing foolish is not asking if you're unsure of something.

FIRST: run search for SET2.TMP and then copy/paste the full file path onto the virus total site?


SECOND: Run combofix and then run HJT and post log?

Here are the logs that you told me to post!

VirusTotal came back clean but I have put them in anyway to be on the safe side;
SET1.tmp C:\Documents and Settings\RON\Local Settings\Temp

MD5: b01ba38c120b8b1f5963e6b47ff12a1e
Date: 03.31.2008 19:49:11 (CET) [>6D]
Results: 0/32
Permalink: analisis/57faefc083e2f3bcdf87387f774e7deb

SET2.tmp C:\Documents and Settings\RON\Local Settings\Temp

MD5: b01ba38c120b8b1f5963e6b47ff12a1e
Date: 03.31.2008 19:49:11 (CET) [>6D]
Results: 0/32
Permalink: analisis/57faefc083e2f3bcdf87387f774e7deb

SET3.tmp C:\Documents and Settings\RON\Local Settings\Temp

MD5: b01ba38c120b8b1f5963e6b47ff12a1e
Date: 03.31.2008 19:49:11 (CET) [>6D]
Results: 0/32
Permalink: analisis/57faefc083e2f3bcdf87387f774e7deb

SET5.tmp C:\Documents and Settings\RON\Local Settings\Temp

MD5: b01ba38c120b8b1f5963e6b47ff12a1e
Date: 03.31.2008 19:49:11 (CET) [>6D]
Results: 0/32
Permalink: analisis/57faefc083e2f3bcdf87387f774e7deb


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 06:18:42, on 07/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\PC Tools Firewall Plus\FWService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\a-squared Free\a2service.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\PrevxCSI\PrevxCSI.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\Program Files\ThreatFire\TFService.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Webroot\Washer\WasherSvc.exe
C:\Program Files\ThreatFire\TFTray.exe
C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe
C:\WINDOWS\system32\atwtusb.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\TBLMOUSE.EXE
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Program Files\WinTV\Ir.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\AnalogX\NetStat Live\nsl.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\Ad-Watch2007.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Crawler Toolbar - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O4 - HKLM\..\Run: [NetStat Live] C:\Program Files\AnalogX\NetStat Live\nsl.exe
O4 - HKLM\..\Run: [ThreatFire] C:\Program Files\ThreatFire\TFTray.exe
O4 - HKLM\..\Run: [Openwares LiveUpdate] C:\Program Files\LiveUpdate\LiveUpdate.exe
O4 - HKLM\..\Run: [00PCTFW] "C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe" -s
O4 - HKLM\..\Run: [atwtusb] atwtusb.exe beta
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware 2007\Ad-Watch2007.exe
O4 - HKCU\..\Run: [AVG] C:\Program Files\Grisoft\AVG7\avgcc.exe
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
O4 - Startup: StartupFaster
O4 - Global Startup: StartupFaster
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://*.mcafee.com
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/softwareupda...31/CTSUEng.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://utilities.pcpitstop.com/da/PCPitStop.CAB
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1206022995125
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/softwareupda...5034/CTPID.cab
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O20 - AppInit_DLLs:
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: CSIScanner - Prevx - C:\Program Files\PrevxCSI\\PrevxCSI.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HauppaugeTVServer - Hauppauge Computer Works - C:\PROGRA~1\WinTV\HCWTVS~1.EXE
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: PC Tools Firewall Plus (PCToolsFirewallPlus) - PC Tools - C:\Program Files\PC Tools Firewall Plus\FWService.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: ThreatFire - PC Tools - C:\Program Files\ThreatFire\TFService.exe
O23 - Service: Window Washer Engine (wwEngineSvc) - Webroot Software, Inc. - C:\Program Files\Webroot\Washer\WasherSvc.exe

--
End of file - 8445 bytes



ComboFix 08-04-06.1 - RON 2008-04-07 5:55:16.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.420 [GMT 1:00]
Running from: C:\Documents and Settings\RON\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\RON\Application Data\inst.exe
C:\WINDOWS\system32\5F94D62D94.dll

.
((((((((((((((((((((((((( Files Created from 2008-03-07 to 2008-04-07 )))))))))))))))))))))))))))))))
.

2008-04-06 05:50 . 2008-04-07 02:00 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\PrevxCSI
2008-04-06 04:41 . 2008-04-06 04:41 <DIR> d-------- C:\Program Files\Trend Micro
2008-04-06 03:12 . 2008-04-06 03:16 <DIR> d-------- C:\Program Files\ShellExView
2008-04-06 03:12 . 2008-04-06 03:12 39,424 --a------ C:\WINDOWS\zipinst.exe
2008-04-05 05:16 . 2008-04-05 05:16 <DIR> d-------- C:\Program Files\Common Files\PC Tools
2008-04-04 23:01 . 2008-04-05 05:16 <DIR> d-------- C:\Program Files\PC Tools Firewall Plus
2008-04-04 23:01 . 2008-02-25 16:49 159,128 --a------ C:\WINDOWS\system32\drivers\pctfw2.sys
2008-04-04 23:01 . 2008-02-25 16:38 93,440 --a------ C:\WINDOWS\system32\drivers\pctfw.sys
2008-04-04 23:01 . 2008-02-21 08:56 40,856 --a------ C:\WINDOWS\system32\drivers\pctmp.sys
2008-04-04 23:01 . 2008-02-21 08:56 18,328 --a------ C:\WINDOWS\system32\drivers\pctssipc.sys
2008-04-04 21:50 . 2008-04-04 21:50 <DIR> d-------- C:\Program Files\Lavasoft
2008-04-04 21:50 . 2008-04-04 21:50 <DIR> d-------- C:\Program Files\Free Notes & Office Ink
2008-04-04 21:50 . 2008-04-04 21:50 <DIR> d-------- C:\Program Files\AdwareAlert
2008-04-04 21:22 . 2008-04-05 09:51 23 --a------ C:\WINDOWS\WinInit.bak
2008-04-04 12:43 . 2008-04-04 12:43 <DIR> d-------- C:\Program Files\Crawler
2008-04-04 07:49 . 2008-04-05 05:16 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\comodo
2008-04-04 00:18 . 2008-04-04 00:18 <DIR> d-------- C:\Program Files\VSO
2008-04-04 00:18 . 2008-04-04 00:18 <DIR> d-------- C:\Documents and Settings\RON\Application Data\Vso
2008-04-04 00:18 . 2004-05-04 11:53 1,645,320 --a------ C:\WINDOWS\gdiplus.dll
2008-04-04 00:18 . 2006-05-20 16:16 1,184,984 --a------ C:\WINDOWS\system32\wvc1dmod.dll
2008-04-04 00:18 . 2006-05-11 19:21 626,688 --a------ C:\WINDOWS\system32\vp7vfw.dll
2008-04-04 00:18 . 2006-09-29 12:24 217,127 --a------ C:\WINDOWS\system32\drv43260.dll
2008-04-04 00:18 . 2006-09-29 12:25 208,935 --a------ C:\WINDOWS\system32\drv33260.dll
2008-04-04 00:18 . 2006-09-29 12:26 176,165 --a------ C:\WINDOWS\system32\drv23260.dll
2008-04-04 00:18 . 2007-03-18 20:37 65,602 --a------ C:\WINDOWS\system32\cook3260.dll
2008-04-04 00:18 . 2008-04-04 00:18 47,360 --a------ C:\WINDOWS\system32\drivers\pcouffin.sys
2008-04-04 00:18 . 2008-04-04 00:18 47,360 --a------ C:\Documents and Settings\RON\Application Data\pcouffin.sys
2008-04-03 05:08 . 2008-04-03 05:27 305,491,968 --a------ C:\_Channel 4+1 (1)_20080403_050852.mpg
2008-04-03 04:41 . 2008-04-03 05:08 479,043,584 --a------ C:\_Channel 4+1_20080403_044119.mpg
2008-03-30 23:46 . 2008-03-30 23:47 18,634,752 --a------ C:\_Channel 4+1_20080330_234629.mpg
2008-03-30 04:18 . 2008-03-30 04:18 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-03-30 04:18 . 2008-03-30 04:18 1,409 --a------ C:\WINDOWS\QTFont.for
2008-03-29 22:31 . 2008-03-29 23:30 1,674,674,176 --a------ C:\_BBC TWO Scot_20080329_213132.mpg
2008-03-29 03:17 . 2008-04-02 17:55 <DIR> d-------- C:\Program Files\PeerGuardian2
2008-03-29 01:00 . 2008-03-29 01:00 <DIR> d-------- C:\ConverterOutput
2008-03-29 00:59 . 2008-03-29 00:59 <DIR> d-------- C:\Program Files\Cucusoft
2008-03-29 00:59 . 2004-10-12 15:40 2,255,360 --a------ C:\WINDOWS\system32\libavcodec.dll
2008-03-29 00:59 . 2004-10-12 15:46 1,761,280 --a------ C:\WINDOWS\system32\ffdshow.ax
2008-03-29 00:59 . 2004-10-05 17:16 395,776 --a------ C:\WINDOWS\system32\libmplayer.dll
2008-03-29 00:59 . 2004-10-12 15:42 262,144 --a------ C:\WINDOWS\system32\TomsMoComp_ff.dll
2008-03-29 00:59 . 2003-04-03 01:17 172,032 --a------ C:\WINDOWS\system32\ac3filter.ax
2008-03-29 00:59 . 2004-10-04 02:50 112,640 --a------ C:\WINDOWS\system32\libmpeg2_ff.dll
2008-03-29 00:09 . 2008-03-29 00:12 <DIR> d-------- C:\Documents and Settings\RON\Application Data\DivX
2008-03-29 00:05 . 2008-03-29 00:06 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Protexis
2008-03-28 22:39 . 2008-03-28 22:39 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\NCH Software
2008-03-27 19:41 . 2008-03-27 19:41 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-03-24 23:12 . 2008-03-24 23:12 7,544,832 --a------ C:\_ITV2 (1)_20080324_221225.mpg
2008-03-24 23:06 . 2008-03-24 23:06 3,962,880 --a------ C:\_ITV2 (1)_20080324_220630.mpg
2008-03-24 23:05 . 2008-03-24 23:05 6,799,360 --a------ C:\_ITV2 (1)_20080324_220502.mpg
2008-03-24 23:04 . 2008-03-24 23:04 11,427,840 --a------ C:\_ITV2 (1)_20080324_220410.mpg
2008-03-23 12:26 . 2008-03-23 12:26 <DIR> d-------- C:\Program Files\RegCure
2008-03-22 14:28 . 2008-03-22 14:28 <DIR> d-------- C:\Program Files\LIVEUPDATE
2008-03-22 14:28 . 2008-03-22 14:28 <DIR> d-------- C:\Program Files\DVD Shrink
2008-03-22 14:28 . 2008-03-22 14:28 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\DVD Shrink
2008-03-22 13:01 . 2008-03-22 13:01 <DIR> d-------- C:\WINDOWS\MVUNINST
2008-03-22 13:01 . 2008-03-22 13:01 <DIR> d-------- C:\Program Files\cdstomp
2008-03-20 15:34 . 2003-06-13 00:25 7,062 --a------ C:\WINDOWS\system32\audiopid.vxd
2008-03-20 15:24 . 2007-07-30 20:19 43,352 --a------ C:\WINDOWS\system32\wups2.dll
2008-03-20 15:24 . 2007-07-30 20:18 34,136 --a------ C:\WINDOWS\system32\wucltui.dll.mui
2008-03-20 15:24 . 2007-07-30 20:19 25,944 --a------ C:\WINDOWS\system32\wuaucpl.cpl.mui
2008-03-20 15:24 . 2007-07-30 20:19 25,944 --a------ C:\WINDOWS\system32\wuapi.dll.mui
2008-03-20 15:24 . 2007-07-30 20:18 20,312 --a------ C:\WINDOWS\system32\wuaueng.dll.mui
2008-03-20 15:10 . 2008-03-20 15:10 <DIR> d--h----- C:\WINDOWS\msdownld.tmp
2008-03-20 15:09 . 2006-09-06 17:43 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2008-03-20 15:08 . 2008-03-20 15:08 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2008-03-12 00:46 . 2006-05-08 09:55 118,784 --a------ C:\WINDOWS\system32\HCWSched.ocx
2008-03-12 00:46 . 2006-05-08 09:54 73,792 --a------ C:\WINDOWS\system32\CHSUITE.OCX
2008-03-12 00:46 . 2006-09-13 11:58 45,316 --a------ C:\WINDOWS\system32\HCWTVServer.tlb
2008-03-12 00:46 . 2006-05-08 09:55 40,960 --a------ C:\WINDOWS\system32\HcwTvTvOCX.ocx
2008-03-12 00:46 . 2006-05-08 09:55 28,672 --a------ C:\WINDOWS\system32\hcwsched.dll
2008-03-12 00:44 . 2008-03-12 00:49 1,968 --a------ C:\WINDOWS\HCWPNP.INI
2008-03-12 00:43 . 2006-11-21 05:03 299,776 -ra------ C:\WINDOWS\system32\drivers\hcw88tse.sys
2008-03-12 00:43 . 2006-11-21 05:03 207,872 -ra------ C:\WINDOWS\system32\drivers\hcw88bda.sys
2008-03-12 00:43 . 2006-11-21 05:03 114,752 -ra------ C:\WINDOWS\system32\drivers\hcw88prx.ax
2008-03-12 00:42 . 2006-11-21 05:03 497,664 -ra------ C:\WINDOWS\system32\drivers\hcw88vid.sys
2008-03-12 00:42 . 2006-11-21 05:03 150,016 -ra------ C:\WINDOWS\system32\drivers\hcw88tun.sys
2008-03-12 00:42 . 2005-04-29 22:14 139,324 -ra------ C:\WINDOWS\system32\hcwecp.ax
2008-03-12 00:42 . 2002-09-23 18:11 40,960 -ra------ C:\WINDOWS\system32\hcwxds.dll
2008-03-12 00:42 . 2006-11-21 05:06 23,040 -ra------ C:\WINDOWS\system32\drivers\hcw88bar.sys
2008-03-12 00:42 . 2006-11-21 05:03 11,776 -ra------ C:\WINDOWS\system32\drivers\hcw88rc5.sys
2008-03-12 00:42 . 2006-08-24 22:01 9,539 -ra------ C:\WINDOWS\system32\drivers\hcw88r9x.sys
2008-03-12 00:11 . 2004-06-08 00:03 36,921 --a------ C:\WINDOWS\system32\hcwutl32.dll
2008-03-11 23:57 . 2008-03-11 23:57 <DIR> d-------- C:\Hauppauge
2008-03-08 13:21 . 2008-03-08 13:21 <DIR> d-------- C:\Program Files\DNA
2008-03-08 13:21 . 2008-03-08 13:21 <DIR> d-------- C:\Program Files\BitTorrent
2008-03-08 13:21 . 2008-03-22 01:20 <DIR> d-------- C:\Documents and Settings\RON\Application Data\DNA
2008-03-08 13:21 . 2008-04-02 19:06 <DIR> d-------- C:\Documents and Settings\RON\Application Data\BitTorrent
2008-03-07 23:36 . 2008-03-07 23:36 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\nView_Profiles
2008-03-07 21:18 . 2008-03-07 21:18 <DIR> d-------- C:\Program Files\Active Ports
2008-03-07 21:18 . 1999-12-17 11:13 49,664 --a------ C:\WINDOWS\unvise32.exe
2008-03-07 18:48 . 2008-03-07 18:48 <DIR> d-------- C:\Program Files\uTorrent

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
.
2008-04-07 04:57 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-04-07 03:29 --------- d-----w C:\Program Files\WinTV
2008-04-07 01:00 10,880 ----a-w C:\WINDOWS\system32\drivers\pxark.sys
2008-04-06 20:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\avg7
2008-04-06 18:44 --------- d-----w C:\Documents and Settings\RON\Application Data\SiteAdvisor
2008-04-06 16:36 --------- d-----w C:\Documents and Settings\RON\Application Data\AVG7
2008-04-06 12:13 --------- d-----w C:\Program Files\SUPERAntiSpyware
2008-04-06 04:50 --------- d-----w C:\Program Files\PrevxCSI
2008-04-06 04:50 --------- d-----w C:\Documents and Settings\RON\Application Data\PrevxCSI
2008-04-05 08:43 --------- d-----w C:\Program Files\ThreatFire
2008-04-05 05:13 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-04-05 04:37 53,728 ----a-w C:\WINDOWS\rmfile.exe
2008-04-05 04:37 43,664 ----a-w C:\WINDOWS\addrun.exe
2008-04-04 21:11 --------- d-----w C:\Documents and Settings\RON\Application Data\Comodo
2008-04-04 20:50 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-04 20:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-04-04 06:49 --------- d-----w C:\Program Files\COMODO
2008-04-03 23:23 --------- d-----w C:\Documents and Settings\RON\Application Data\U3
2008-04-03 16:39 --------- d-----w C:\Program Files\a-squared Free
2008-04-02 03:24 --------- d-----w C:\Documents and Settings\RON\Application Data\uTorrent
2008-03-29 01:53 --------- d-----w C:\Program Files\DivX
2008-03-28 21:39 --------- d-----w C:\Program Files\NCH Software
2008-03-27 19:03 --------- d-----w C:\Program Files\Startup Optimizer
2008-03-27 19:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-03-27 18:32 --------- d-----w C:\Program Files\Startup Faster 2004
2008-03-22 15:28 --------- d-----w C:\Program Files\Opera
2008-03-20 14:45 --------- d-----w C:\Program Files\Google
2008-03-20 14:31 --------- d-----w C:\Program Files\Creative
2008-03-10 07:15 --------- d-----w C:\Documents and Settings\RON\Application Data\Keybreeze Data
2008-03-06 16:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\IM
2008-03-06 16:39 --------- d-----w C:\Documents and Settings\All Users\Application Data\IncrediMail
2008-03-05 04:56 --------- d-----w C:\Documents and Settings\RON\Application Data\URSoft
2008-03-04 18:56 --------- d-----w C:\Program Files\Common Files\Adobe
2008-03-03 16:36 --------- d-----w C:\Program Files\JockerSoft
2008-03-03 04:59 --------- d-----w C:\Program Files\IObit
2008-03-02 21:45 --------- d-----w C:\Program Files\A!K Research Labs
2008-03-02 02:33 --------- d-----w C:\Documents and Settings\RON\Application Data\.purple
2008-03-02 02:31 --------- d-----w C:\Documents and Settings\RON\Application Data\gtk-2.0
2008-03-01 22:42 --------- d-----w C:\Program Files\FSGlobal 2008
2008-03-01 21:40 --------- d-----w C:\Program Files\Microsoft Games
2008-03-01 18:29 --------- d-----w C:\Program Files\NCH Swift Sound
2008-03-01 18:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\NCH Swift Sound
2008-03-01 18:13 --------- d-----w C:\Documents and Settings\RON\Application Data\NCH Swift Sound
2008-03-01 17:53 --------- d-----w C:\Documents and Settings\RON\Application Data\Ahead
2008-03-01 16:28 --------- d-----w C:\Program Files\Common Files\xing shared
2008-03-01 16:28 --------- d-----w C:\Program Files\Common Files\Real
2008-03-01 16:27 --------- d-----w C:\Program Files\Real
2008-03-01 04:08 --------- d-----w C:\Program Files\Hawking
2008-02-29 14:56 90,786 ----a-w C:\WINDOWS\wubi-uninstall.exe
2008-02-29 13:26 --------- d-----w C:\Documents and Settings\All Users\Application Data\SecTaskMan
2008-02-29 12:46 --------- d-----w C:\Program Files\Pidgin
2008-02-29 12:45 --------- d-----w C:\Program Files\Common Files\GTK
2008-02-27 13:35 --------- d-----w C:\Program Files\a-squared Anti-Malware
2008-02-27 13:19 --------- d-----w C:\Documents and Settings\RON\Application Data\PCToolsFirewallPlus
2008-02-27 01:35 --------- d-----w C:\Program Files\SystemRequirementsLab
2008-02-27 01:35 --------- d-----w C:\Documents and Settings\RON\Application Data\SystemRequirementsLab
2008-02-27 01:10 --------- d-----w C:\Program Files\PCPitstop
2008-02-25 17:57 --------- d-----w C:\Documents and Settings\RON\Application Data\foobar2000
2008-02-25 17:41 --------- d-----w C:\Program Files\Security Task Manager
2008-02-25 16:55 --------- d-----w C:\Documents and Settings\RON\Application Data\SUPERAntiSpyware.com
2008-02-25 16:55 --------- d-----w C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-02-25 13:31 --------- d-----w C:\Documents and Settings\RON\Application Data\Avant Profiles
2008-02-25 13:30 --------- d-----w C:\Program Files\Avant Browser
2008-02-25 00:49 --------- d-----w C:\Documents and Settings\RON\Application Data\Uniblue
2008-02-21 02:03 156,992 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-02-15 17:21 41,280 ----a-w C:\WINDOWS\system32\drivers\TfSysMon.sys
2008-02-15 17:21 33,088 ----a-w C:\WINDOWS\system32\drivers\TfNetMon.sys
2008-02-15 17:21 12,608 ----a-w C:\WINDOWS\system32\drivers\TfKbMon.sys
2008-02-15 17:20 51,520 ----a-w C:\WINDOWS\system32\drivers\TfFsMon.sys
2008-02-08 06:49 --------- d-----w C:\Program Files\Trojan Remover
2008-02-06 16:07 82,432 ----a-w C:\WINDOWS\system32\Wrting32.Dll
2008-02-06 16:07 347,648 ----a-w C:\WINDOWS\system32\ScrSav.Scr
2008-02-06 16:07 271,360 ----a-w C:\WINDOWS\system32\InkPanel.Dll
2008-01-29 13:37 64,650 ----a-w C:\WINDOWS\BricoPackUninst.cmd
2008-01-29 13:37 6,110 ----a-w C:\WINDOWS\BricoPackFoldersDelete.cmd
2008-01-29 13:37 218,624 ----a-w C:\WINDOWS\system32\uxtheme.dll
.

------- Sigcheck -------

2004-08-04 13:00 974336 a5c1f2cf7c31874e66478910b43d6513 C:\WINDOWS\explorer.exe
2004-08-04 13:00 974336 a5c1f2cf7c31874e66478910b43d6513 C:\WINDOWS\system32\dllcache\explorer.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
"AVG"="C:\Program Files\Grisoft\AVG7\avgcc.exe" [2008-01-29 15:47 579072]
"PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" [2007-12-10 11:12 695808]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"NetStat Live"="C:\Program Files\AnalogX\NetStat Live\nsl.exe" [2007-10-22 13:10 126980]
"ThreatFire"="C:\Program Files\ThreatFire\TFTray.exe" [2008-02-15 18:20 1152320]
"Openwares LiveUpdate"="C:\Program Files\LiveUpdate\LiveUpdate.exe" [2003-12-13 18:17 61440]
"00PCTFW"="C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe" [2008-02-25 16:49 2594712]
"atwtusb"="atwtusb.exe" [2006-02-21 09:32 294912 C:\WINDOWS\system32\ATWTUSB.EXE]
"Ad-Watch"="C:\Program Files\Lavasoft\Ad-Aware 2007\Ad-Watch2007.exe" [2007-07-06 13:12 2224128]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Cur rentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 13:00 15360]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-11-07 18:35 1294336]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-01-29 15:47 219136]

C:\Documents and Settings\RON\Start Menu\Programs\Startup\
RocketDock.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe [2007-03-18 23:05:02 630784]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"MSVideo8"= VfWWDM32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\rundisabled]
"NvMediaCenter"=RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
"SbUsb AudCtrl"=RunDll32 sbusbdll.dll,RCMonitor
"nwiz"=nwiz.exe /install

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
"C:\\WINDOWS\\system32\\sessmgr.exe"=
"C:\\Program Files\\Opera\\Opera.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Avant Browser\\avant.exe"=
"C:\\Program Files\\BitTorrent\\bittorrent.exe"=
"C:\\Program Files\\DNA\\btdna.exe"=

R0 pxark;pxark;C:\WINDOWS\system32\drivers\pxark.sys [2008-04-07 02:00]
R0 TfFsMon;TfFsMon;C:\WINDOWS\system32\drivers\TfFsMo n.sys [2008-02-15 18:20]
R0 TfSysMon;TfSysMon;C:\WINDOWS\system32\drivers\TfSy sMon.sys [2008-02-15 18:21]
R1 aiptektp;HyperPen;C:\WINDOWS\system32\DRIVERS\aipt ektp.sys [2004-07-07 17:02]
R1 pctfw2;pctfw2;C:\WINDOWS\system32\drivers\pctfw2.s ys [2008-02-25 16:49]
R1 pctmp;PC Tools Firewall Memory Protection Driver;C:\WINDOWS\system32\drivers\pctmp.sys [2008-02-21 08:56]
R1 pctssipc;PC Tools Security Suite IPC Driver;C:\WINDOWS\system32\drivers\pctssipc.sys [2008-02-21 08:56]
R2 CSIScanner;CSIScanner;"C:\Program Files\PrevxCSI\\PrevxCSI.exe" /service []
R2 ThreatFire;ThreatFire;C:\Program Files\ThreatFire\TFService.exe service []
R2 wwEngineSvc;Window Washer Engine;C:\Program Files\Webroot\Washer\WasherSvc.exe [2007-11-26 15:47]
R3 HCW88BDA;Hauppauge WinTV 88x DVB Tuner/Demod;C:\WINDOWS\system32\drivers\hcw88bda.sys [2006-11-21 05:03]
R3 hcw88rc5;Hauppauge WinTV 88x IR Decoder;C:\WINDOWS\system32\Drivers\hcw88rc5.sys [2006-11-21 05:03]
R3 HCW88TSE;Hauppauge WinTV 88x MPEG/TS Capture;C:\WINDOWS\system32\drivers\hcw88tse.sys [2006-11-21 05:03]
R3 hcw88vid;Hauppauge WinTV 88x Video;C:\WINDOWS\system32\drivers\hcw88vid.sys [2006-11-21 05:03]
R3 sbusb;Sound Blaster USB Audio Driver;C:\WINDOWS\system32\DRIVERS\sbusb.sys [2005-06-10 10:39]
R3 TfNetMon;TfNetMon;C:\WINDOWS\system32\drivers\TfNe tMon.sys [2008-02-15 18:21]
R3 ZD1211U(Hawking);Hawking Hi-Gain Wireless-G USB Dish Adapter(Hawking);C:\WINDOWS\system32\DRIVERS\zd121 1u.sys [2005-08-16 15:50]
S3 HauppaugeTVServer;HauppaugeTVServer;C:\PROGRA~1\Wi nTV\HCWTVS~1.EXE [2006-12-01 15:41]

.
Contents of the 'Scheduled Tasks' folder
"2008-03-24 11:11:00 C:\WINDOWS\Tasks\RegCure.job"
- E:\PROGRAMS\programs from C drive\RegCure\RegCure.exe
"2008-02-25 00:23:01 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC.job"
- C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe
.
************************************************** ************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-07 05:57:52
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

************************************************** ************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\A d-Watch Real-Time Scanner]
"ImagePath"="\??\C:\WINDOWS\system32\drivers\AWRTP D.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\A d-Watch Registry Filter]
"ImagePath"="\??\C:\WINDOWS\system32\drivers\AWRTR D.sys"
.
Completion time: 2008-04-07 5:58:49
ComboFix-quarantined-files.txt 2008-04-07 04:58:39
Pre-Run: 89,395,613,696 bytes free
Post-Run: 89,384,505,344 bytes free

Ran search in safe mode 5 files found, 3 are C:\WINDOWS, 1 is C:\WINDOWS\Temp and 1 is C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Tem p. should they be deleted also?