On PC Start up the following pop up window has started to appear.
16 bit MS-DOS Subsystem

C:\PROGRA~1\LIVEUP~1\LIVEUP~1.EXE
The NTVDM CPU has encountered an illegal instruction.
CS:0f42 IP:0381 OP:ff ff 00 00 00 choose 'Close' to terminate the
Application.

Close-------Ignore

Did a check on Google and tried a on line scan with Panda Active scan, this found 3 threats but as I do not have a credit card was unable TO PAY TO HAVE THEM delete the entries, or find out what these threats were.
Have ran the following programs, which found nothing but tracking cookies, AVG Anti-Virus, AVG Anti-Spy ware, SUPERAnti-Spyware, Spybot-S&D. Tried a system restore that has not helped either. Can anyone suggest any other course of action to solve this problem?

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:28:04, on 16/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\PC Tools Firewall Plus\FWService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\a-squared Free\a2service.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\AnalogX\NetStat Live\nsl.exe
C:\Program Files\ThreatFire\TFTray.exe
C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe
C:\Program Files\PrevxCSI\PrevxCSI.exe
C:\WINDOWS\system32\atwtusb.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\WINDOWS\system32\TBLMOUSE.EXE
C:\Program Files\PrevxCSI\PrevxCSI.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\G oogleToolbarNotifier.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe
C:\Program Files\Kontiki\KService.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
C:\Program Files\ThreatFire\TFService.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Webroot\Washer\WasherSvc.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Program Files\Opera\Opera.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Crawler Toolbar - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O4 - HKLM\..\Run: [NetStat Live] C:\Program Files\AnalogX\NetStat Live\nsl.exe
O4 - HKLM\..\Run: [ThreatFire] C:\Program Files\ThreatFire\TFTray.exe
O4 - HKLM\..\Run: [Openwares LiveUpdate] C:\Program Files\LiveUpdate\LiveUpdate.exe
O4 - HKLM\..\Run: [00PCTFW] "C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe" -s
O4 - HKLM\..\Run: [atwtusb] atwtusb.exe beta
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware 2007\Ad-Watch2007.exe
O4 - HKLM\..\Run: [4oD] "C:\Program Files\Kontiki\KHost.exe" -all
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [PrevxCSI] "C:\Program Files\PrevxCSI\prevxcsi.exe" /bootupreg
O4 - HKCU\..\Run: [AVG] C:\Program Files\Grisoft\AVG7\avgcc.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\G oogleToolbarNotifier.exe
O4 - HKCU\..\Run: [kdx] C:\Program Files\Kontiki\KHost.exe -all
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
O4 - Startup: StartupFaster
O4 - Startup: TransBar.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe
O4 - Startup: UberIcon.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
O4 - Global Startup: StartupFaster
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://*.mcafee.com
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/softwareupda...31/CTSUEng.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://utilities.pcpitstop.com/da/PCPitStop.CAB
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1206022995125
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/softwareupda...5034/CTPID.cab
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O20 - AppInit_DLLs:
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: CSIScanner - Prevx - C:\Program Files\PrevxCSI\\PrevxCSI.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HauppaugeTVServer - Hauppauge Computer Works - C:\PROGRA~1\WinTV\HCWTVS~1.EXE
O23 - Service: KService - Kontiki Inc. - C:\Program Files\Kontiki\KService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: PC Tools Firewall Plus (PCToolsFirewallPlus) - PC Tools - C:\Program Files\PC Tools Firewall Plus\FWService.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: ThreatFire - PC Tools - C:\Program Files\ThreatFire\TFService.exe
O23 - Service: Window Washer Engine (wwEngineSvc) - Webroot Software, Inc. - C:\Program Files\Webroot\Washer\WasherSvc.exe

--
End of file - 9445 bytes


Uninstall_list

4oD
A Really Small App 2.0
Active Ports
Ad-Aware 2007
Adobe Bridge 1.0
Adobe Common File Installer
Adobe Flash Player ActiveX
Adobe Help Center 1.0
Adobe Photoshop CS2
Adobe Reader 8.1.2
Adobe Stock Photos 1.0
a-squared Free 3.1
Avant Browser (remove only)
AVG 7.5
AVG Anti-Rootkit Free
AVG Anti-Spyware 7.5
CCleaner (remove only)
CD Stomper 32 bit
ConvertXtoDVD 3.0.0.7
Crawler Toolbar with Web Security Guard
Creative EAX Console
Creative MediaSource
Creative MediaSource 5
Creative Speaker Settings
Creative Vienna SoundFont Studio
Cucusoft MPEG/MOV/RM/DivX/AVI to DVD/VCD/SVCD Creator Pro 7.07
Customize Folder Shell Extension
Device Control
Diskeeper Professional Premier Edition
DVD Shrink
Encyclopaedia Britannica 2005 Deluxe Edition CD-ROM
EPSON Attach To Email
EPSON Easy Photo Print
EPSON File Manager
EPSON PRINT Image Framer Tool
EPSON Printer Software
EPSON Scan Assistant
EPSON Web-To-Page
foobar2000 v0.9.4.4
Free Notes & Office Ink
FSGlobal 2008
Google Earth
Google Toolbar for Internet Explorer
GTK+ Runtime 2.12.1 rev b (remove only)
Hauppauge English Help Files and Resources
Hauppauge WinTV Infrared Remote
Hauppauge WinTV Scheduler
Hauppauge WinTV TV Services
Hauppauge WinTV2000
Hawking Hi-Gain Wireless-G USB Dish Adapter
HijackThis 2.0.2
Hotfix for Windows XP (KB915865)
InterVideo FilterSDK for Hauppauge
IrfanView (remove only)
IZArc 3.81
Keybreeze
Memory-Map OS Edition Version 5
Microsoft .NET Framework 2.0
Microsoft Flight Simulator 2002
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office Professional Edition 2003
Microsoft Visual C++ 2005 Redistributable
Mozilla Firefox (2.0.0.13)
MSVC80_x86
NCH Toolbox
Nero 7 Ultra Edition
Nokia Connectivity Cable Driver
Nokia PC Suite
Nokia PC Suite
NVIDIA Drivers
Online Manuals for WinTV (English)
Pack Vista Inspirat 2 1.0
Panda ActiveScan 2.0
PC Connectivity Solution
PC Pitstop Driver Alert 1.0
PC Pitstop Optimize 1.5
PC Tools Firewall Plus 3.0
PeerGuardian 2.0
Pidgin
Prevx CSI
Prism Video Converter
QuickTime
RealPlayer
Registry Mechanic 6.0
Security Task Manager 1.7d
ShellExView
Spybot - Search & Destroy
Startup Optimizer 1.6
Stellarium 0.8.2
SUPERAntiSpyware Free Edition
Switch
System Requirements Lab
Tasco SkyWatch (Remove only)
The Ultimate Troubleshooter
ThreatFire 3.0
VideoLAN VLC media player 0.8.6f
Window Washer
Windows Driver Package - Nokia Modem (08/03/2007 6.84.0.2)
Windows Driver Package - Nokia Modem (10/12/2007 3.6)
Windows Internet Explorer 7
Windows Media Format Runtime
Windows Media Player 10
Windows XP Hotfix - KB896626
Wubi
Yahoo! Toolbar

Did a check on Google and tried a on line scan with Panda Active scan, this found 3 threats but as I do not have a credit card was unable TO PAY TO HAVE THEM delete the entries, or find out what these threats were.

You should still post what was found (copy and paste) - it might provide useful clues and also be removable manually.


Also, see if the following links help (18 hits):

http://www.google.ca/search?hl=en&q=...G=Search&meta=

Had to do another scan this time found 4 threats? Hope I’ve done this right this time?

Application/Pr... Tracking Application Latent Hide + Info Not disinfectable
1. C:\System Volume Information\_restore{E16AA56...0037539.exe[SDFix\apps\Process.exe]
2. C:\Program Files\Opera\profile\cache4\opr03ZU8.exe[SDFix\apps\Process.exe]

Application/Ps... Tracking Application Latent Hide + Info
1. C:\WINDOWS\PSEXESVC.EXE

dialer.su Dialer Latent Hide + Info
1. hkey_local_machine\software\microsoft\windows\curr entversion\uninstall\switch

Did you run SDFIX? It is not clear. What application created your latest findings? Also, the complete log might be very relevant, here:

Application/Pr... Tracking Application Latent Hide + Info Not disinfectable
1. C:\System Volume Information\_restore{E16AA56...0037539.exe[SDFix\apps\Process.exe]
2. C:\Program Files\Opera\profile\cache4\opr03ZU8.exe[SDFix\apps\Process.exe]

Download ComboFix from one of the following links below:

Here or Here to your Desktop.


**Note: If you already have Combofix, delete previous copy(s) and download the latest version. It is important that it is saved directly to your desktop**

Combofix will disconnect your machine from the Internet and restore connections before it completes its run. If Combofix terminates prematurely and breaks the Internet connections, they can be restored manually by rebooting the machine. Note: If you have an "always on" connection (DSL/cable), unplug the cable from the modem before running Combofix. Do not reconnect before Combofix has finished its scan.

• Very Important! Temporarily disable your:
  • anti-virus,
  • script blocking and
  • any anti-malware real-time protection
  before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause unpredictable results.
• Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
  
  
• Double click combofix.exe and follow the prompts.
• When finished, it shall produce a log for you. Post that log and a HijackThis log in your next reply

Note: Do not mouseclick combofix's window while its running. That may cause it to stall

ComboFix SHOULD NOT be used unless requested by a forum helper.

The latest findings are from Panda security online scan. Found SDFix in the opera cache, downloaded 15 April 2008. must have overlooked this prog opened it and found the following:- Please install to the default location by clicking Install -- The SDFix Folder will be extracted to %systemdrive% \ (Drive that contains the Windows directory - typically 'C:\SDFix') -- Open the SDFix folder in Safe Mode then double click the RunThis.bat file to start the fixtool -- If run in Normal Mode, options to download and run Anti-Virus command line scanners are displayed --
Catchme.exe Stealth Malware Detector by GMER is also included in the SDFix folder
Do you want me to run this program before downloading combofix? Also found the last copy of combofix in recycle bin, +4 other combofix txt files in C: should these be deleted now also? Don’t understand about the complete log that you want? Thanks for your patience with this.
PS what is script blocking, don’t know how to turn this off or if it is even turned on, at the moment on my PC.

Do you want me to run this program before downloading combofix? Also found the last copy of combofix in recycle bin, +4 other combofix txt files in C: should these be deleted now also?

Since you appear to be surprised that SDFIX was on your system, I have no way to know the source and trustworthiness of such content. Would suggest you delete all prior traces of SDFIX and COMBOFIX before proceeding. Also include the following in your deleted items:

C:\Program Files\Opera\profile\cache4\opr03ZU8.exe

Don’t understand about the complete log that you want?

I just wanted a straight copy and paste of what was produce by PANDA. Did not recognize the content posted since it appeared to be an edited version (haven't used PANDA in quite a while).

PS what is script blocking, don’t know how to turn this off or if it is even turned on, at the moment on my PC.

If that means nothing to you, lets skip that step.




Add the following step before running COMBOFIX:

Please download ATF Cleaner http://www.atribune.org/ccount/click.php?id=1 by Atribune.
This program is for XP and Windows 2000 only

It does not require any installation and uses minimal system resources. It is set up to clean IE, FireFox and Opera, and detects the browsers you have and grays out the other(s).

• Double-click ATF-Cleaner.exe to run the program.
  Under Main choose: Select All
  Recommend UNCHECKING COOKIES if you rely on system remembered passwords.
  Click the Empty Selected button.

If you use Firefox browser

• Click Firefox at the top and choose: Select All EXCEPT FIREFOX SAVED PASSWORDS
  Click the Empty Selected button.
  NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

• Click Opera at the top and choose: Select All EXCEPT COOKIES AND SAVED PASSWORDS
  Click the Empty Selected button.
  NOTE: If you would like to keep your cookies and saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.




Download and run ComboFix as instructed, please.

Here are the logs you wanted:-
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:40:38, on 19/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\PC Tools Firewall Plus\FWService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\PrevxCSI\PrevxCSI.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Kontiki\KService.exe
C:\Program Files\ThreatFire\TFService.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Webroot\Washer\WasherSvc.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\AnalogX\NetStat Live\nsl.exe
C:\Program Files\ThreatFire\TFTray.exe
C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe
C:\WINDOWS\system32\atwtusb.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\G oogleToolbarNotifier.exe
C:\Program Files\Kontiki\KHost.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe
C:\WINDOWS\system32\TBLMOUSE.EXE
C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Crawler Toolbar - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O4 - HKLM\..\Run: [NetStat Live] C:\Program Files\AnalogX\NetStat Live\nsl.exe
O4 - HKLM\..\Run: [ThreatFire] C:\Program Files\ThreatFire\TFTray.exe
O4 - HKLM\..\Run: [Openwares LiveUpdate] C:\Program Files\LiveUpdate\LiveUpdate.exe
O4 - HKLM\..\Run: [00PCTFW] "C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe" -s
O4 - HKLM\..\Run: [atwtusb] atwtusb.exe beta
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware 2007\Ad-Watch2007.exe
O4 - HKLM\..\Run: [4oD] "C:\Program Files\Kontiki\KHost.exe" -all
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [PrevxCSI] "C:\Program Files\PrevxCSI\prevxcsi.exe" /bootupreg
O4 - HKCU\..\Run: [AVG] C:\Program Files\Grisoft\AVG7\avgcc.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\G oogleToolbarNotifier.exe
O4 - HKCU\..\Run: [kdx] C:\Program Files\Kontiki\KHost.exe -all
O4 - HKCU\..\Run: [EPSON Stylus Photo R220 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIA IE.EXE /FU "C:\WINDOWS\TEMP\E_S157.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
O4 - Startup: StartupFaster
O4 - Startup: TransBar.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe
O4 - Startup: UberIcon.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
O4 - Global Startup: StartupFaster
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://*.mcafee.com
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/softwareupda...31/CTSUEng.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://utilities.pcpitstop.com/da/PCPitStop.CAB
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1206022995125
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/softwareupda...5034/CTPID.cab
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O20 - AppInit_DLLs:
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: CSIScanner - Prevx - C:\Program Files\PrevxCSI\\PrevxCSI.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HauppaugeTVServer - Hauppauge Computer Works - C:\PROGRA~1\WinTV\HCWTVS~1.EXE
O23 - Service: KService - Kontiki Inc. - C:\Program Files\Kontiki\KService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: PC Tools Firewall Plus (PCToolsFirewallPlus) - PC Tools - C:\Program Files\PC Tools Firewall Plus\FWService.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: ThreatFire - PC Tools - C:\Program Files\ThreatFire\TFService.exe
O23 - Service: Window Washer Engine (wwEngineSvc) - Webroot Software, Inc. - C:\Program Files\Webroot\Washer\WasherSvc.exe

--
End of file - 9226 bytes

ComboFix 08-04-18.3 - RON 2008-04-19 9:24:36.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.444 [GMT 1:00]
Running from: C:\Documents and Settings\RON\Desktop\DOWNLOADS\Downloads April\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-03-19 to 2008-04-19 )))))))))))))))))))))))))))))))
.

2008-04-19 08:50 . 2008-04-19 08:50 <DIR> d-------- C:\WINDOWS\ERUNT
2008-04-19 08:43 . 2008-04-19 09:02 <DIR> d-------- C:\SDFix
2008-04-18 19:47 . 2008-04-18 20:57 <DIR> d-------- C:\Documents and Settings\RON\Application Data\uTorrent
2008-04-18 09:08 . 2008-04-18 09:08 <DIR> d-------- C:\Documents and Settings\RON\Application Data\InstallShield
2008-04-16 09:19 . 2008-04-16 09:19 <DIR> d--h----- C:\WINDOWS\PIF
2008-04-16 06:49 . 2008-04-16 06:49 <DIR> d-------- C:\Documents and Settings\RON\Application Data\Grisoft
2008-04-16 06:48 . 2008-04-16 06:48 <DIR> d-------- C:\Program Files\Channel4
2008-04-16 06:48 . 2008-04-16 06:48 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Channel4
2008-04-16 05:48 . 2007-05-30 13:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-04-15 18:12 . 2008-04-15 18:13 <DIR> d-------- C:\Program Files\Panda Security
2008-04-14 15:06 . 2008-04-16 06:48 <DIR> d-------- C:\Program Files\Kontiki
2008-04-14 15:06 . 2008-04-19 09:28 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kontiki
2008-04-10 08:56 . 2008-04-10 08:56 <DIR> d-------- C:\Documents and Settings\RON\Application Data\vlc
2008-04-10 03:21 . 2008-04-10 03:21 <DIR> d-------- C:\Program Files\VideoLAN
2008-04-09 12:46 . 2008-04-09 12:46 <DIR> d--hs---- C:\Documents and Settings\Folder Settings
2008-04-09 12:46 . 2008-04-09 12:46 303 --ah----- C:\Documents and Settings\desktop.ini
2008-04-08 07:14 . 2008-04-08 07:17 5,263 --a------ C:\WINDOWS\BricoPackFoldersDelete.cmd
2008-04-08 06:14 . 2008-04-08 06:17 <DIR> d-------- C:\I386
2008-04-08 05:29 . 2004-08-04 00:56 116,224 --a--c--- C:\WINDOWS\system32\dllcache\xrxwiadr.dll
2008-04-08 05:29 . 2001-08-17 22:37 27,648 --a--c--- C:\WINDOWS\system32\dllcache\xrxftplt.exe
2008-04-08 05:29 . 2001-08-17 22:36 23,040 --a--c--- C:\WINDOWS\system32\dllcache\xrxwbtmp.dll
2008-04-08 05:29 . 2001-08-17 22:36 17,408 --a--c--- C:\WINDOWS\system32\dllcache\xrxscnui.dll
2008-04-08 05:29 . 2001-08-17 22:37 4,608 --a--c--- C:\WINDOWS\system32\dllcache\xrxflnch.exe
2008-04-08 05:28 . 2001-08-17 13:28 771,581 --a--c--- C:\WINDOWS\system32\dllcache\winacisa.sys
2008-04-08 05:28 . 2004-08-03 22:31 154,624 --a--c--- C:\WINDOWS\system32\dllcache\wlluc48.sys
2008-04-08 05:28 . 2001-08-17 22:37 99,865 --a--c--- C:\WINDOWS\system32\dllcache\xlog.exe
2008-04-08 05:28 . 2001-08-17 22:36 53,760 --a--c--- C:\WINDOWS\system32\dllcache\wiamsmud.dll
2008-04-08 05:28 . 2001-08-17 12:12 34,890 --a--c--- C:\WINDOWS\system32\dllcache\wlandrv2.sys
2008-04-08 05:28 . 2004-08-03 22:29 19,455 --a--c--- C:\WINDOWS\system32\dllcache\wvchntxx.sys
2008-04-08 05:28 . 2001-08-17 12:11 16,970 --a--c--- C:\WINDOWS\system32\dllcache\xem336n5.sys
2008-04-08 05:28 . 2004-08-03 22:29 12,063 --a--c--- C:\WINDOWS\system32\dllcache\wsiintxx.sys
2008-04-08 05:28 . 2004-08-03 23:07 8,832 --a--c--- C:\WINDOWS\system32\dllcache\wmiacpi.sys
2008-04-08 05:28 . 2004-08-04 00:56 8,192 --a--c--- C:\WINDOWS\system32\dllcache\wshirda.dll
2008-04-08 05:26 . 2001-08-17 13:28 794,654 --a--c--- C:\WINDOWS\system32\dllcache\usr1801.sys
2008-04-08 05:25 . 2001-08-17 22:36 525,568 --a--c--- C:\WINDOWS\system32\dllcache\tridxp.dll
2008-04-08 05:24 . 2001-08-17 14:56 440,576 --a--c--- C:\WINDOWS\system32\dllcache\tridkb.dll
2008-04-08 05:23 . 2001-08-17 14:56 172,768 --a--c--- C:\WINDOWS\system32\dllcache\t2r4disp.dll
2008-04-08 05:22 . 2001-08-17 12:18 285,760 --a--c--- C:\WINDOWS\system32\dllcache\stlnata.sys
2008-04-08 05:21 . 2001-08-17 14:56 147,200 --a--c--- C:\WINDOWS\system32\dllcache\smidispb.dll
2008-04-08 05:20 . 2004-08-03 22:41 404,990 --a--c--- C:\WINDOWS\system32\dllcache\slntamr.sys
2008-04-08 05:19 . 2001-08-17 22:36 386,560 --a--c--- C:\WINDOWS\system32\dllcache\sgiul50.dll
2008-04-08 05:19 . 2001-07-21 14:29 161,568 --a--c--- C:\WINDOWS\system32\dllcache\sgsmusb.sys
2008-04-08 05:19 . 2001-08-17 12:51 98,080 --a--c--- C:\WINDOWS\system32\dllcache\sgiulnt5.sys
2008-04-08 05:19 . 2001-08-17 12:19 36,480 --a--c--- C:\WINDOWS\system32\dllcache\sfmanm.sys
2008-04-08 05:19 . 2001-07-21 14:29 18,400 --a--c--- C:\WINDOWS\system32\dllcache\sgsmld.sys
2008-04-08 05:19 . 2001-08-17 13:48 17,664 --a--c--- C:\WINDOWS\system32\dllcache\sermouse.sys
2008-04-08 05:19 . 2001-08-17 13:51 17,280 --a--c--- C:\WINDOWS\system32\dllcache\scr111.sys
2008-04-08 05:19 . 2001-08-17 13:52 11,648 --a--c--- C:\WINDOWS\system32\dllcache\scsiprnt.sys
2008-04-08 05:19 . 2001-08-17 13:53 10,880 --a--c--- C:\WINDOWS\system32\dllcache\scsiscan.sys
2008-04-08 05:19 . 2001-08-17 13:53 6,912 --a--c--- C:\WINDOWS\system32\dllcache\seaddsmc.sys
2008-04-08 05:19 . 2001-08-17 13:53 6,784 --a--c--- C:\WINDOWS\system32\dllcache\serscan.sys
2008-04-08 05:17 . 2001-08-17 22:36 86,097 --a--c--- C:\WINDOWS\system32\dllcache\reslog32.dll
2008-04-08 05:16 . 2001-08-17 13:28 899,146 --a--c--- C:\WINDOWS\system32\dllcache\r2mdkxga.sys
2008-04-08 05:15 . 2004-08-04 00:56 259,328 --a--c--- C:\WINDOWS\system32\dllcache\perm3dd.dll
2008-04-08 05:14 . 2001-08-17 14:05 351,616 --a--c--- C:\WINDOWS\system32\dllcache\ovcodek2.sys
2008-04-08 05:13 . 2004-08-03 22:59 2,015,232 --a--c--- C:\WINDOWS\system32\dllcache\ntkrpamp.exe
2008-04-08 05:12 . 2004-08-03 22:31 132,695 --a--c--- C:\WINDOWS\system32\dllcache\netwlan5.sys
2008-04-08 05:11 . 2004-08-04 00:56 1,737,856 --a--c--- C:\WINDOWS\system32\dllcache\mtxparhd.dll
2008-04-08 05:10 . 2001-08-17 12:50 320,384 --a--c--- C:\WINDOWS\system32\dllcache\mgaum.sys
2008-04-08 05:09 . 2001-08-17 13:28 802,683 --a--c--- C:\WINDOWS\system32\dllcache\ltsm.sys
2008-04-08 05:08 . 2004-08-04 00:56 152,576 --a--c--- C:\WINDOWS\system32\dllcache\irftp.exe
2008-04-08 05:07 . 2001-08-17 22:36 372,824 --a--c--- C:\WINDOWS\system32\dllcache\iconf32.dll
2008-04-08 05:06 . 2004-08-03 22:41 1,041,536 --a--c--- C:\WINDOWS\system32\dllcache\hsfdpsp2.sys
2008-04-08 05:05 . 2001-08-17 22:36 324,608 --a--c--- C:\WINDOWS\system32\dllcache\hpojwia.dll
2008-04-08 05:04 . 2001-08-17 14:56 1,733,120 --a--c--- C:\WINDOWS\system32\dllcache\g400d.dll
2008-04-08 05:03 . 2001-08-17 13:28 595,647 --a--c--- C:\WINDOWS\system32\dllcache\es56cvmp.sys
2008-04-08 05:02 . 2001-08-17 13:28 634,134 --a--c--- C:\WINDOWS\system32\dllcache\el656ct5.sys
2008-04-08 05:01 . 2001-08-17 12:14 952,007 --a--c--- C:\WINDOWS\system32\dllcache\diwan.sys
2008-04-08 05:00 . 2004-08-04 00:56 249,856 --a--c--- C:\WINDOWS\system32\dllcache\ctmasetp.dll
2008-04-08 04:59 . 2001-08-17 12:13 980,034 --a--c--- C:\WINDOWS\system32\dllcache\cicap.sys
2008-04-08 04:58 . 2001-08-17 13:28 871,388 --a--c--- C:\WINDOWS\system32\dllcache\bcmdm.sys
2008-04-08 04:57 . 2004-08-04 00:56 1,888,992 --a--c--- C:\WINDOWS\system32\dllcache\ati3duag.dll
2008-04-08 04:56 . 2004-08-03 23:18 2,148,352 --a--c--- C:\WINDOWS\system32\dllcache\ntkrnlmp.exe
2008-04-08 04:56 . 2001-08-17 14:56 66,048 --a--c--- C:\WINDOWS\system32\dllcache\s3legacy.dll
2008-04-08 04:56 . 2004-08-03 23:10 53,248 --a--c--- C:\WINDOWS\system32\dllcache\1394bus.sys
2008-04-08 04:56 . 2001-08-17 14:06 11,264 --a--c--- C:\WINDOWS\system32\dllcache\1394vdbg.sys
2008-04-06 05:50 . 2008-04-18 15:29 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\PrevxCSI
2008-04-06 04:41 . 2008-04-06 04:41 <DIR> d-------- C:\Program Files\Trend Micro
2008-04-06 03:12 . 2008-04-06 03:16 <DIR> d-------- C:\Program Files\ShellExView
2008-04-06 03:12 . 2008-04-06 03:12 39,424 --a------ C:\WINDOWS\zipinst.exe
2008-04-05 05:16 . 2008-04-05 05:16 <DIR> d-------- C:\Program Files\Common Files\PC Tools
2008-04-04 23:01 . 2008-04-16 06:50 <DIR> d-------- C:\Program Files\PC Tools Firewall Plus
2008-04-04 23:01 . 2008-04-12 00:49 159,896 --a------ C:\WINDOWS\system32\drivers\pctfw2.sys
2008-04-04 23:01 . 2008-02-25 16:38 93,440 --a------ C:\WINDOWS\system32\drivers\pctfw.sys
2008-04-04 23:01 . 2008-02-21 08:56 40,856 --a------ C:\WINDOWS\system32\drivers\pctmp.sys
2008-04-04 23:01 . 2008-02-21 08:56 18,328 --a------ C:\WINDOWS\system32\drivers\pctssipc.sys
2008-04-04 21:50 . 2008-04-04 21:50 <DIR> d-------- C:\Program Files\Lavasoft
2008-04-04 21:50 . 2008-04-04 21:50 <DIR> d-------- C:\Program Files\Free Notes & Office Ink
2008-04-04 21:50 . 2008-04-04 21:50 <DIR> d-------- C:\Program Files\AdwareAlert
2008-04-04 21:22 . 2008-04-05 09:51 23 --a------ C:\WINDOWS\WinInit.bak
2008-04-04 12:43 . 2008-04-04 12:43 <DIR> d-------- C:\Program Files\Crawler
2008-04-04 07:49 . 2008-04-05 05:16 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\comodo
2008-04-04 00:18 . 2008-04-04 00:18 <DIR> d-------- C:\Program Files\VSO
2008-04-04 00:18 . 2008-04-04 00:18 <DIR> d-------- C:\Documents and Settings\RON\Application Data\Vso
2008-04-04 00:18 . 2004-05-04 11:53 1,645,320 --a------ C:\WINDOWS\gdiplus.dll
2008-04-04 00:18 . 2006-05-20 16:16 1,184,984 --a------ C:\WINDOWS\system32\wvc1dmod.dll
2008-04-04 00:18 . 2006-05-11 19:21 626,688 --a------ C:\WINDOWS\system32\vp7vfw.dll
2008-04-04 00:18 . 2006-09-29 12:24 217,127 --a------ C:\WINDOWS\system32\drv43260.dll
2008-04-04 00:18 . 2006-09-29 12:25 208,935 --a------ C:\WINDOWS\system32\drv33260.dll
2008-04-04 00:18 . 2006-09-29 12:26 176,165 --a------ C:\WINDOWS\system32\drv23260.dll
2008-04-04 00:18 . 2007-03-18 20:37 65,602 --a------ C:\WINDOWS\system32\cook3260.dll
2008-04-04 00:18 . 2008-04-04 00:18 47,360 --a------ C:\WINDOWS\system32\drivers\pcouffin.sys
2008-04-04 00:18 . 2008-04-04 00:18 47,360 --a------ C:\Documents and Settings\RON\Application Data\pcouffin.sys
2008-03-30 04:18 . 2008-04-08 03:55 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-03-30 04:18 . 2008-03-30 04:18 1,409 --a------ C:\WINDOWS\QTFont.for
2008-03-29 03:17 . 2008-04-02 17:55 <DIR> d-------- C:\Program Files\PeerGuardian2
2008-03-29 01:00 . 2008-03-29 01:00 <DIR> d-------- C:\ConverterOutput
2008-03-29 00:59 . 2008-03-29 00:59 <DIR> d-------- C:\Program Files\Cucusoft
2008-03-29 00:59 . 2004-10-12 15:40 2,255,360 --a------ C:\WINDOWS\system32\libavcodec.dll
2008-03-29 00:59 . 2004-10-12 15:46 1,761,280 --a------ C:\WINDOWS\system32\ffdshow.ax
2008-03-29 00:59 . 2004-10-05 17:16 395,776 --a------ C:\WINDOWS\system32\libmplayer.dll
2008-03-29 00:59 . 2004-10-12 15:42 262,144 --a------ C:\WINDOWS\system32\TomsMoComp_ff.dll
2008-03-29 00:59 . 2003-04-03 01:17 172,032 --a------ C:\WINDOWS\system32\ac3filter.ax
2008-03-29 00:59 . 2004-10-04 02:50 112,640 --a------ C:\WINDOWS\system32\libmpeg2_ff.dll
2008-03-29 00:09 . 2008-03-29 00:12 <DIR> d-------- C:\Documents and Settings\RON\Application Data\DivX
2008-03-29 00:05 . 2008-03-29 00:06 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Protexis
2008-03-28 22:39 . 2008-03-28 22:39 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\NCH Software
2008-03-27 19:41 . 2008-03-27 19:41 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-03-23 12:26 . 2008-03-23 12:26 <DIR> d-------- C:\Program Files\RegCure
2008-03-22 14:28 . 2008-04-07 06:54 <DIR> d-------- C:\Program Files\LIVEUPDATE
2008-03-22 14:28 . 2008-03-22 14:28 <DIR> d-------- C:\Program Files\DVD Shrink
2008-03-22 14:28 . 2008-03-22 14:28 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\DVD Shrink
2008-03-22 13:01 . 2008-03-22 13:01 <DIR> d-------- C:\WINDOWS\MVUNINST
2008-03-22 13:01 . 2008-03-22 13:01 <DIR> d-------- C:\Program Files\cdstomp
2008-03-20 15:34 . 2003-06-13 00:25 7,062 --a------ C:\WINDOWS\system32\audiopid.vxd

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
.
2008-04-19 08:28 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-04-19 08:02 --------- d-----w C:\Documents and Settings\RON\Application Data\AVG7
2008-04-19 06:14 --------- d-----w C:\Documents and Settings\RON\Application Data\Keybreeze Data
2008-04-18 22:28 --------- d-----w C:\Documents and Settings\RON\Application Data\SiteAdvisor
2008-04-18 20:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\avg7
2008-04-18 14:28 10,880 ----a-w C:\WINDOWS\system32\drivers\pxark.sys
2008-04-18 08:08 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-18 08:07 --------- d-----w C:\Program Files\EPSON
2008-04-17 22:04 --------- d-----w C:\Program Files\Yahoo!
2008-04-16 05:53 --------- d-----w C:\Program Files\PrevxCSI
2008-04-16 05:49 --------- d-----w C:\Program Files\a-squared Free
2008-04-15 08:44 --------- d-----w C:\Program Files\WinTV
2008-04-13 07:40 --------- d-----w C:\Program Files\Opera
2008-04-08 06:17 71,329 ----a-w C:\WINDOWS\BricoPackUninst.cmd
2008-04-08 06:17 218,624 ----a-w C:\WINDOWS\system32\uxtheme.dll
2008-04-06 12:13 --------- d-----w C:\Program Files\SUPERAntiSpyware
2008-04-06 04:50 --------- d-----w C:\Documents and Settings\RON\Application Data\PrevxCSI
2008-04-05 08:43 --------- d-----w C:\Program Files\ThreatFire
2008-04-05 05:13 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-04-05 04:37 53,728 ----a-w C:\WINDOWS\rmfile.exe
2008-04-05 04:37 43,664 ----a-w C:\WINDOWS\addrun.exe
2008-04-04 21:11 --------- d-----w C:\Documents and Settings\RON\Application Data\Comodo
2008-04-04 20:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-04-04 06:49 --------- d-----w C:\Program Files\COMODO
2008-04-03 23:23 --------- d-----w C:\Documents and Settings\RON\Application Data\U3
2008-04-02 18:06 --------- d-----w C:\Documents and Settings\RON\Application Data\BitTorrent
2008-03-29 01:53 --------- d-----w C:\Program Files\DivX
2008-03-28 21:39 --------- d-----w C:\Program Files\NCH Software
2008-03-27 19:03 --------- d-----w C:\Program Files\Startup Optimizer
2008-03-27 19:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-03-27 18:32 --------- d-----w C:\Program Files\Startup Faster 2004
2008-03-22 00:20 --------- d-----w C:\Documents and Settings\RON\Application Data\DNA
2008-03-20 14:45 --------- d-----w C:\Program Files\Google
2008-03-20 14:31 --------- d-----w C:\Program Files\Creative
2008-03-08 12:21 --------- d-----w C:\Program Files\DNA
2008-03-08 12:21 --------- d-----w C:\Program Files\BitTorrent
2008-03-07 22:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\nView_Profiles
2008-03-07 20:18 --------- d-----w C:\Program Files\Active Ports
2008-03-06 16:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\IM
2008-03-06 16:39 --------- d-----w C:\Documents and Settings\All Users\Application Data\IncrediMail
2008-03-05 04:56 --------- d-----w C:\Documents and Settings\RON\Application Data\URSoft
2008-03-04 18:56 --------- d-----w C:\Program Files\Common Files\Adobe
2008-03-03 16:36 --------- d-----w C:\Program Files\JockerSoft
2008-03-03 04:59 --------- d-----w C:\Program Files\IObit
2008-03-02 21:45 --------- d-----w C:\Program Files\A!K Research Labs
2008-03-02 02:33 --------- d-----w C:\Documents and Settings\RON\Application Data\.purple
2008-03-02 02:31 --------- d-----w C:\Documents and Settings\RON\Application Data\gtk-2.0
2008-03-01 22:42 --------- d-----w C:\Program Files\FSGlobal 2008
2008-03-01 21:40 --------- d-----w C:\Program Files\Microsoft Games
2008-03-01 18:29 --------- d-----w C:\Program Files\NCH Swift Sound
2008-03-01 18:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\NCH Swift Sound
2008-03-01 18:13 --------- d-----w C:\Documents and Settings\RON\Application Data\NCH Swift Sound
2008-03-01 17:53 --------- d-----w C:\Documents and Settings\RON\Application Data\Ahead
2008-03-01 16:28 --------- d-----w C:\Program Files\Common Files\xing shared
2008-03-01 16:28 --------- d-----w C:\Program Files\Common Files\Real
2008-03-01 16:27 --------- d-----w C:\Program Files\Real
2008-03-01 14:10 --------- d-----w C:\WINDOWS\system32\config\systemprofile\Applicati on Data\PC Suite
2008-03-01 04:08 --------- d-----w C:\Program Files\Hawking
2008-02-29 14:56 90,786 ----a-w C:\WINDOWS\wubi-uninstall.exe
2008-02-29 13:26 --------- d-----w C:\Documents and Settings\All Users\Application Data\SecTaskMan
2008-02-29 12:46 --------- d-----w C:\Program Files\Pidgin
2008-02-29 12:45 --------- d-----w C:\Program Files\Common Files\GTK
2008-02-27 13:35 --------- d-----w C:\Program Files\a-squared Anti-Malware
2008-02-27 13:19 --------- d-----w C:\Documents and Settings\RON\Application Data\PCToolsFirewallPlus
2008-02-27 01:35 --------- d-----w C:\Program Files\SystemRequirementsLab
2008-02-27 01:35 --------- d-----w C:\Documents and Settings\RON\Application Data\SystemRequirementsLab
2008-02-27 01:10 --------- d-----w C:\Program Files\PCPitstop
2008-02-25 17:57 --------- d-----w C:\Documents and Settings\RON\Application Data\foobar2000
2008-02-25 17:41 --------- d-----w C:\Program Files\Security Task Manager
2008-02-25 16:55 --------- d-----w C:\Documents and Settings\RON\Application Data\SUPERAntiSpyware.com
2008-02-25 16:55 --------- d-----w C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-02-25 13:31 --------- d-----w C:\Documents and Settings\RON\Application Data\Avant Profiles
2008-02-25 13:30 --------- d-----w C:\Program Files\Avant Browser
2008-02-25 00:49 --------- d-----w C:\Documents and Settings\RON\Application Data\Uniblue
2008-02-21 02:03 156,992 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-02-06 16:07 82,432 ----a-w C:\WINDOWS\system32\Wrting32.Dll
2008-02-06 16:07 347,648 ----a-w C:\WINDOWS\system32\ScrSav.Scr
2008-02-06 16:07 271,360 ----a-w C:\WINDOWS\system32\InkPanel.Dll
2004-08-04 12:00 73,728 --sha-w C:\WINDOWS\RegisteredPackages\{DD90D410-1823-43EB-9A16-A2331BF08799}$BACKUP$\System\wmplayer.exe
.

------- Sigcheck -------

2004-08-04 13:00 690176 3a5ee0514f56b1b775d7641cfba5ad37 C:\WINDOWS\ie7\wininet.dll
2006-11-07 22:03 809472 ac7bfbbc9577a576e8ddcf938083665b C:\WINDOWS\system32\wininet.dll
2006-11-07 22:03 809472 ac7bfbbc9577a576e8ddcf938083665b C:\WINDOWS\system32\dllcache\wininet.dll

2004-08-04 13:00 974336 a5c1f2cf7c31874e66478910b43d6513 C:\WINDOWS\explorer.exe
2004-08-04 13:00 974336 a5c1f2cf7c31874e66478910b43d6513 C:\WINDOWS\system32\dllcache\explorer.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
"AVG"="C:\Program Files\Grisoft\AVG7\avgcc.exe" [2008-04-15 08:40 579584]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\G oogleToolbarNotifier.exe" [2008-03-20 15:22 171448]
"kdx"="C:\Program Files\Kontiki\KHost.exe" [2007-04-23 11:23 1032640]
"EPSON Stylus Photo R220 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\ 3\E_FATIAIE.exe" [2006-12-25 05:00 177664]
"PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" [2007-12-10 11:12 695808]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"NetStat Live"="C:\Program Files\AnalogX\NetStat Live\nsl.exe" [2007-10-22 13:10 126980]
"ThreatFire"="C:\Program Files\ThreatFire\TFTray.exe" [2008-02-15 18:20 1152320]
"Openwares LiveUpdate"="C:\Program Files\LiveUpdate\LiveUpdate.exe" [2003-12-13 18:17 61440]
"00PCTFW"="C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe" [2008-04-12 00:49 2598808]
"atwtusb"="atwtusb.exe" [2006-02-21 09:32 294912 C:\WINDOWS\system32\ATWTUSB.EXE]
"Ad-Watch"="C:\Program Files\Lavasoft\Ad-Aware 2007\Ad-Watch2007.exe" [2007-07-06 13:12 2224128]
"4oD"="C:\Program Files\Kontiki\KHost.exe" [2007-04-23 11:23 1032640]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25 6731312]
"PrevxCSI"="C:\Program Files\PrevxCSI\prevxcsi.exe" [2008-04-16 06:53 650296]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Cur rentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 13:00 15360]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-11-07 18:35 1294336]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-01-29 15:47 219136]

C:\Documents and Settings\RON\Start Menu\Programs\Startup\
RocketDock.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe [2007-03-18 23:05:02 630784]
TransBar.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe [2005-06-01 20:41:18 65536]
UberIcon.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe [2006-05-21 08:43:08 180224]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=

[HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\rundisabled]
"NvMediaCenter"=RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
"SbUsb AudCtrl"=RunDll32 sbusbdll.dll,RCMonitor
"nwiz"=nwiz.exe /install

[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
"C:\\WINDOWS\\system32\\sessmgr.exe"=
"C:\\Program Files\\Opera\\Opera.exe"=
"C:\\Program Files\\Avant Browser\\avant.exe"=
"C:\\Program Files\\BitTorrent\\bittorrent.exe"=
"C:\\Program Files\\DNA\\btdna.exe"=
"C:\\Program Files\\Kontiki\\KService.exe"=

R0 pxark;pxark;C:\WINDOWS\system32\drivers\pxark.sys [2008-04-18 15:28]
R0 TfFsMon;TfFsMon;C:\WINDOWS\system32\drivers\TfFsMo n.sys [2008-02-15 18:20]
R0 TfSysMon;TfSysMon;C:\WINDOWS\system32\drivers\TfSy sMon.sys [2008-02-15 18:21]
R1 aiptektp;HyperPen;C:\WINDOWS\system32\DRIVERS\aipt ektp.sys [2004-07-07 17:02]
R1 pctfw2;pctfw2;C:\WINDOWS\system32\drivers\pctfw2.s ys [2008-04-12 00:49]
R1 pctmp;PC Tools Firewall Memory Protection Driver;C:\WINDOWS\system32\drivers\pctmp.sys [2008-02-21 08:56]
R1 pctssipc;PC Tools Security Suite IPC Driver;C:\WINDOWS\system32\drivers\pctssipc.sys [2008-02-21 08:56]
R2 CSIScanner;CSIScanner;"C:\Program Files\PrevxCSI\\PrevxCSI.exe" /service []
R2 ThreatFire;ThreatFire;C:\Program Files\ThreatFire\TFService.exe service []
R2 wwEngineSvc;Window Washer Engine;C:\Program Files\Webroot\Washer\WasherSvc.exe [2007-11-26 15:47]
R3 HCW88BDA;Hauppauge WinTV 88x DVB Tuner/Demod;C:\WINDOWS\system32\drivers\hcw88bda.sys [2006-11-21 05:03]
R3 hcw88rc5;Hauppauge WinTV 88x IR Decoder;C:\WINDOWS\system32\Drivers\hcw88rc5.sys [2006-11-21 05:03]
R3 HCW88TSE;Hauppauge WinTV 88x MPEG/TS Capture;C:\WINDOWS\system32\drivers\hcw88tse.sys [2006-11-21 05:03]
R3 hcw88vid;Hauppauge WinTV 88x Video;C:\WINDOWS\system32\drivers\hcw88vid.sys [2006-11-21 05:03]
R3 sbusb;Sound Blaster USB Audio Driver;C:\WINDOWS\system32\DRIVERS\sbusb.sys [2005-06-10 10:39]
R3 TfNetMon;TfNetMon;C:\WINDOWS\system32\drivers\TfNe tMon.sys [2008-02-15 18:21]
R3 ZD1211U(Hawking);Hawking Hi-Gain Wireless-G USB Dish Adapter(Hawking);C:\WINDOWS\system32\DRIVERS\zd121 1u.sys [2005-08-16 15:50]
S3 HauppaugeTVServer;HauppaugeTVServer;C:\PROGRA~1\Wi nTV\HCWTVS~1.EXE [2006-12-01 15:41]

.
Contents of the 'Scheduled Tasks' folder
"2008-03-24 11:11:00 C:\WINDOWS\Tasks\RegCure.job"
- E:\PROGRAMS\programs from C drive\RegCure\RegCure.exe
"2008-02-25 00:23:01 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC.job"
- C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe
.
************************************************** ************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-19 09:28:27
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

************************************************** ************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\explorer.exe
-> C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.dll
-> C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon.dll
.
Completion time: 2008-04-19 9:30:52
ComboFix-quarantined-files.txt 2008-04-19 08:30:42

Pre-Run: 89,934,905,344 bytes free
Post-Run: 89,922,461,696 bytes free

315