Firefox redirected when selecting search results (Resolved) [Archive]

View Full Version : Firefox redirected when selecting search results (Resolved)

Lothaar

2010-02-15, 07:25

Been having a lot of redirects once I do a Google search and click on a search results. I ran Spybot S&D and Malwarebytes and both came up clean.

Here is my hijackthis log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:21:04 AM, on 2/15/2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Creative\Shared Files\CTAudSvc.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\n52te\n52teHid.exe
C:\PROGRA~1\AVG\AVG9\avgtray.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\n52te\n52teTra.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
O2 - BHO: (no name) - {cc05b7a4-9374-466b-9638-a216255260a4} - (no file)
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Jomantha] C:\Program Files\n52te\n52teHid.exe
O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exe
O4 - Startup: OpenOffice.org 3.1.lnk.disabled
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\n6uemyabwf.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\n6uemyabwf.dll
O15 - Trusted Zone: http://*.buy-internetsecurity10.com
O15 - Trusted Zone: http://*.buy-is2010.com
O15 - Trusted Zone: http://*.is-software-download.com
O15 - Trusted Zone: http://*.is-software-download25.com
O15 - Trusted Zone: http://*.is10-soft-download.com
O15 - Trusted Zone: http://*.buy-internetsecurity10.com (HKLM)
O15 - Trusted Zone: http://*.buy-is2010.com (HKLM)
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://ccfiles.creative.com/Web/softwareupdate/su2/ocx/15111/CTPID.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe
O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTAudSvc.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

--
End of file - 5262 bytes

katana

2010-02-20, 20:40

Please note that all instructions given are customised for this computer only,
the tools used may cause damage if used on a computer with different infections.

If you think you have similar problems, please post a log in the HJT forum and wait for help.

Hello and welcome to the forums

My name is Katana and I will be helping you to remove any infection(s) that you may have.

Please observe these rules while we work:
Please Read All Instructions Carefully
If you don't understand something, stop and ask! Don't keep going on.
Please do not run any other tools or scans whilst I am helping you
Failure to reply within 5 days will result in the topic being closed.
Please continue to respond until I give you the "All Clear"
(Just because you can't see a problem doesn't mean it isn't there)

If you can do those few things, everything should go smoothly http://www.countingcows.de/laechel.gif

Some of the logs I request will be quite large, You may need to split them over a couple of replies.

Please Note, your security programs may give warnings for some of the tools I will ask you to use.
Be assured, any links I give are safe
----------------------------------------------------------------------------------------

Download and Run RSIT

Please download Random's System Information Tool by random/random from here (http://images.malwareremoval.com/random/RSIT.exe) and save it to your desktop.
Double click on RSIT.exe to run RSIT.
Click Continue at the disclaimer screen.
Once it has finished, two logs will open:

log.txt will be opened maximized.
info.txt will be opened minimized.

Please post the contents of both log.txt and info.txt.
( They can also be found in the C:\RSIT folder )

GMER Rootkit Detector

Please download GMER Rootkit Scanner from Here (http://www.gmer.net/gmer.zip) or Here (http://majorgeeks.com/downloadget.php?id=5198&file=15&evp=3f18075291813a665b2a25536a70b307)

***Please close any open programs ***
Extract the contents of the zip file to your desktop.
Disable your onboard Anti Virus and any other Active protection programs you have installed.
Double-click gmer.exe. The program will begin to run.

Note:- If GMER doesn't run, please Reboot and then rename gmer.exe to Look.exe and try again

**Caution**
These types of scans can produce false positives. Do NOT take any action on any "<--- ROOKIT" entries unless advised by a trained Security Analyst

If it gives you a warning about rootkit activity and asks if you want to run a full scan...click on NO,
Now use the following settings for a more complete scan..

http://i51.photobucket.com/albums/f387/Katana_1970/th_Gmer_initScan-1.gif (http://i51.photobucket.com/albums/f387/Katana_1970/Gmer_initScanfull.gif)
Click the image to enlarge it

In the right panel, you will see several boxes that have been checked. Ensure the following are UNCHECKED ...
Sections
IAT/EAT
Drives/Partition other than Systemdrive (typically C:\)
Show All (don't miss this one)

Then click the Scan button & wait for it to finish.

Once the scan is complete, you may receive another notice about rootkit activity.
Click OK.

GMER will produce a log. Click on the Save button, and save the log as gmer.txt somewhere you can easily find it, such as your desktop.

DO NOT touch the PC at ALL for Whatever reason/s until it has 100% completed its scan, or attempted scan in case of some error etc !

Please post the results from the GMER scan in your reply.

----------------------------------------------------------------------------------------
Logs/Information to Post in Reply
Please post the following logs/Information in your reply
Some of the logs I request will be quite large, You may need to split them over a couple of replies.

RSIT Logs
GMER Log

Lothaar

2010-02-21, 08:07

info.txt logfile of random's system information tool 1.06 2010-02-20 15:43:55

======Uninstall list======

-->MsiExec /X{C5C1C0F0-D62F-4DBF-81D4-D7EF397C228B}
-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{17E96A7F-AFE3-4171-87B1-583E376319E8}\setup.exe" -l0x9
-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{700932B3-A964-4878-82A2-96054622A1F7}\setup.exe" -l0x9
-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{700932B3-A964-4878-82A2-96054622A1F7}\setup.exe" -l0x9 /remove
-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{88B1984E-36F0-47B8-B8DC-728966807A9C}\setup.exe" -l0x9
-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{CC3D3A93-C433-4329-AC3A-7EFC52A332C2}\setup.exe" -l0x9
-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{CC3D3A93-C433-4329-AC3A-7EFC52A332C2}\setup.exe" -l0x9 /remove
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Ad-Aware Email Scanner for Outlook-->MsiExec.exe /I{338F08AB-C262-42C7-B000-34DE1A475273}
Ad-Aware-->"C:\Documents and Settings\All Users\Application Data\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}\Ad-AwareInstaller.exe" REMOVE=TRUE MODIFY=FALSE
Ad-Aware-->C:\Documents and Settings\All Users\Application Data\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}\Ad-AwareInstaller.exe
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
ARMA 2-->"C:\Program Files\Steam\steam.exe" steam://uninstall/33900
AVG Free 9.0-->C:\Program Files\AVG\AVG9\setup.exe /UNINSTALL
BattlEye Uninstall-->c:\program files\steam\steamapps\common\arma 2\BattlEye\UnInstallBE.exe
CCleaner-->"C:\Program Files\CCleaner\uninst.exe"
CDDRV_Installer-->MsiExec.exe /I{0C826C5B-B131-423A-A229-C71B3CACCD6A}
Cities XL-->C:\Program Files\Monte Cristo\Cities XL\uninst.exe
CPUID HWMonitor 1.15-->"C:\Program Files\CPUID\HWMonitor\unins000.exe"
Creative Audio Control Panel-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{17E96A7F-AFE3-4171-87B1-583E376319E8}\setup.exe" -l0x9 /remove
Creative Software AutoUpdate-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{88B1984E-36F0-47B8-B8DC-728966807A9C}\setup.exe" -l0x9 /remove
Crysis-->"C:\Program Files\Steam\steam.exe" steam://uninstall/17300
Darkfall US-->MsiExec.exe /I{5024A609-3AC8-4FE8-8390-E8003BE1758E}
Diskeeper 2010 Professional-->MsiExec.exe /X{EB889931-70EC-46F3-8A42-9375575A0A33}
Electricsheep Screensaver 2.7b21-->C:\Program Files\Electricsheep Screensaver\uninst.exe
erLT-->MsiExec.exe /I{A498D9EB-927B-459B-85D6-DD6EF8C2C564}
ERUNT 1.1j-->"C:\Program Files\ERUNT\unins000.exe"
EVE Online (remove only)-->C:\Program Files\CCP\EVE\Uninstall.exe
Foxit Reader-->C:\Program Files\Foxit Software\Foxit Reader\Uninstall.exe
Guitar Pro 5.2-->"C:\Program Files\Guitar Pro 5\unins000.exe"
HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
Hotfix for Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB961118)-->"C:\WINDOWS\$NtUninstallKB961118$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB976098-v2)-->"C:\WINDOWS\$NtUninstallKB976098-v2$\spuninst\spuninst.exe"
Java(TM) 6 Update 16-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216016FF}
KhalInstallWrapper-->MsiExec.exe /I{3101CB58-3482-4D21-AF1A-7057FC935355}
Left 4 Dead 2-->"C:\Program Files\Steam\steam.exe" steam://uninstall/550
Logitech SetPoint-->"C:\Program Files\InstallShield Installation Information\{F29B21BD-CAA6-445F-8EF7-A7E2B9D8B14E}\setup.exe" -runfromtemp -l0x0009 -removeonly
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Microsoft .NET Framework 1.1 Security Update (KB953297)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M953297\M953297Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0 Service Pack 2-->MsiExec.exe /I{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}
Microsoft .NET Framework 3.0 Service Pack 2-->MsiExec.exe /I{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}
Microsoft .NET Framework 3.5 SP1-->C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5-->"C:\WINDOWS\$NtUninstallWdf01005$\spuninst\spuninst.exe"
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{837b34e3-7c30-493c-8f6a-2b0f04e2912c}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}
Mozilla Firefox (3.5.8)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSXML 6 Service Pack 2 (KB973686)-->MsiExec.exe /I{56EA8BC0-3751-4B93-BC9D-6651CC36E5AA}
n52te Editor-->C:\Program Files\InstallShield Installation Information\{0AC8162B-5175-41D7-B963-8307A40BD456}\n52te_win_driver_v2.1.2.exe -runfromtemp -l0x0009 -removeonly
NVIDIA Display Control Panel-->C:\Program Files\NVIDIA Corporation\Uninstall\nvuninst.exe DisplayControlPanel
NVIDIA Drivers-->C:\Program Files\NVIDIA Corporation\Uninstall\nvuninst.exe UninstallGUI
NVIDIA nView Desktop Manager-->C:\Program Files\NVIDIA Corporation\nView\nViewSetup.exe -uninstall
NVIDIA PhysX-->MsiExec.exe /X{C5C1C0F0-D62F-4DBF-81D4-D7EF397C228B}
OpenAL-->"C:\Program Files\OpenAL\OALInst.exe" /U
OpenOffice.org 3.1-->MsiExec.exe /I{E6B87DC4-2B3D-4483-ADFF-E483BF718991}
Psi (remove only)-->C:\Program Files\Psi\uninstall.exe
PunkBuster Services-->C:\WINDOWS\system32\pbsvc.exe -u
Saitek SD6 Programming Software 6.6.6.9-->MsiExec.exe /X{49480197-4A67-4EAB-AD44-001862FCEEB7}
Security Update for Windows Internet Explorer 8 (KB971961)-->"C:\WINDOWS\ie8updates\KB971961-IE8\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 8 (KB976325)-->"C:\WINDOWS\ie8updates\KB976325-IE8\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 8 (KB978207)-->"C:\WINDOWS\ie8updates\KB978207-IE8\spuninst\spuninst.exe"
Security Update for Windows Media Player (KB911564)-->"C:\WINDOWS\$NtUninstallKB911564$\spuninst\spuninst.exe"
Security Update for Windows Media Player (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
Security Update for Windows Media Player (KB954155)-->"C:\WINDOWS\$NtUninstallKB954155_WM9$\spuninst\spuninst.exe"
Security Update for Windows Media Player (KB968816)-->"C:\WINDOWS\$NtUninstallKB968816_WM9$\spuninst\spuninst.exe"
Security Update for Windows Media Player (KB973540)-->"C:\WINDOWS\$NtUninstallKB973540_WM9L$\spuninst\spuninst.exe"
Security Update for Windows Media Player 6.4 (KB925398)-->"C:\WINDOWS\$NtUninstallKB925398_WMP64$\spuninst\spuninst.exe"
Security Update for Windows XP (KB890046)-->"C:\WINDOWS\$NtUninstallKB890046$\spuninst\spuninst.exe"
Security Update for Windows XP (KB893756)-->"C:\WINDOWS\$NtUninstallKB893756$\spuninst\spuninst.exe"
Security Update for Windows XP (KB896358)-->"C:\WINDOWS\$NtUninstallKB896358$\spuninst\spuninst.exe"
Security Update for Windows XP (KB896423)-->"C:\WINDOWS\$NtUninstallKB896423$\spuninst\spuninst.exe"
Security Update for Windows XP (KB899591)-->"C:\WINDOWS\$NtUninstallKB899591$\spuninst\spuninst.exe"
Security Update for Windows XP (KB900725)-->"C:\WINDOWS\$NtUninstallKB900725$\spuninst\spuninst.exe"
Security Update for Windows XP (KB901017)-->"C:\WINDOWS\$NtUninstallKB901017$\spuninst\spuninst.exe"
Security Update for Windows XP (KB901214)-->"C:\WINDOWS\$NtUninstallKB901214$\spuninst\spuninst.exe"
Security Update for Windows XP (KB902400)-->"C:\WINDOWS\$NtUninstallKB902400$\spuninst\spuninst.exe"
Security Update for Windows XP (KB905414)-->"C:\WINDOWS\$NtUninstallKB905414$\spuninst\spuninst.exe"
Security Update for Windows XP (KB905749)-->"C:\WINDOWS\$NtUninstallKB905749$\spuninst\spuninst.exe"
Security Update for Windows XP (KB911562)-->"C:\WINDOWS\$NtUninstallKB911562$\spuninst\spuninst.exe"
Security Update for Windows XP (KB911927)-->"C:\WINDOWS\$NtUninstallKB911927$\spuninst\spuninst.exe"
Security Update for Windows XP (KB913580)-->"C:\WINDOWS\$NtUninstallKB913580$\spuninst\spuninst.exe"
Security Update for Windows XP (KB914388)-->"C:\WINDOWS\$NtUninstallKB914388$\spuninst\spuninst.exe"
Security Update for Windows XP (KB914389)-->"C:\WINDOWS\$NtUninstallKB914389$\spuninst\spuninst.exe"
Security Update for Windows XP (KB918118)-->"C:\WINDOWS\$NtUninstallKB918118$\spuninst\spuninst.exe"
Security Update for Windows XP (KB918439)-->"C:\WINDOWS\$NtUninstallKB918439$\spuninst\spuninst.exe"
Security Update for Windows XP (KB920213)-->"C:\WINDOWS\$NtUninstallKB920213$\spuninst\spuninst.exe"
Security Update for Windows XP (KB920670)-->"C:\WINDOWS\$NtUninstallKB920670$\spuninst\spuninst.exe"
Security Update for Windows XP (KB920683)-->"C:\WINDOWS\$NtUninstallKB920683$\spuninst\spuninst.exe"
Security Update for Windows XP (KB923191)-->"C:\WINDOWS\$NtUninstallKB923191$\spuninst\spuninst.exe"
Security Update for Windows XP (KB923561)-->"C:\WINDOWS\$NtUninstallKB923561$\spuninst\spuninst.exe"
Security Update for Windows XP (KB923789)-->C:\WINDOWS\system32\MacroMed\Flash\genuinst.exe C:\WINDOWS\system32\MacroMed\Flash\KB923789.inf
Security Update for Windows XP (KB923980)-->"C:\WINDOWS\$NtUninstallKB923980$\spuninst\spuninst.exe"
Security Update for Windows XP (KB924270)-->"C:\WINDOWS\$NtUninstallKB924270$\spuninst\spuninst.exe"
Security Update for Windows XP (KB924667)-->"C:\WINDOWS\$NtUninstallKB924667$\spuninst\spuninst.exe"
Security Update for Windows XP (KB925902)-->"C:\WINDOWS\$NtUninstallKB925902$\spuninst\spuninst.exe"
Security Update for Windows XP (KB926255)-->"C:\WINDOWS\$NtUninstallKB926255$\spuninst\spuninst.exe"
Security Update for Windows XP (KB926436)-->"C:\WINDOWS\$NtUninstallKB926436$\spuninst\spuninst.exe"
Security Update for Windows XP (KB927779)-->"C:\WINDOWS\$NtUninstallKB927779$\spuninst\spuninst.exe"
Security Update for Windows XP (KB927802)-->"C:\WINDOWS\$NtUninstallKB927802$\spuninst\spuninst.exe"
Security Update for Windows XP (KB928255)-->"C:\WINDOWS\$NtUninstallKB928255$\spuninst\spuninst.exe"
Security Update for Windows XP (KB928843)-->"C:\WINDOWS\$NtUninstallKB928843$\spuninst\spuninst.exe"
Security Update for Windows XP (KB929123)-->"C:\WINDOWS\$NtUninstallKB929123$\spuninst\spuninst.exe"
Security Update for Windows XP (KB930178)-->"C:\WINDOWS\$NtUninstallKB930178$\spuninst\spuninst.exe"
Security Update for Windows XP (KB931261)-->"C:\WINDOWS\$NtUninstallKB931261$\spuninst\spuninst.exe"
Security Update for Windows XP (KB932168)-->"C:\WINDOWS\$NtUninstallKB932168$\spuninst\spuninst.exe"
Security Update for Windows XP (KB938127)-->"C:\WINDOWS\$NtUninstallKB938127$\spuninst\spuninst.exe"
Security Update for Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Security Update for Windows XP (KB943055)-->"C:\WINDOWS\$NtUninstallKB943055$\spuninst\spuninst.exe"
Security Update for Windows XP (KB943460)-->"C:\WINDOWS\$NtUninstallKB943460$\spuninst\spuninst.exe"
Security Update for Windows XP (KB944338-v2)-->"C:\WINDOWS\$NtUninstallKB944338-v2$\spuninst\spuninst.exe"
Security Update for Windows XP (KB944653)-->"C:\WINDOWS\$NtUninstallKB944653$\spuninst\spuninst.exe"
Security Update for Windows XP (KB945553)-->"C:\WINDOWS\$NtUninstallKB945553$\spuninst\spuninst.exe"
Security Update for Windows XP (KB946026)-->"C:\WINDOWS\$NtUninstallKB946026$\spuninst\spuninst.exe"
Security Update for Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950749)-->"C:\WINDOWS\$NtUninstallKB950749$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Security Update for Windows XP (KB952004)-->"C:\WINDOWS\$NtUninstallKB952004$\spuninst\spuninst.exe"
Security Update for Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Security Update for Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956572)-->"C:\WINDOWS\$NtUninstallKB956572$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956844)-->"C:\WINDOWS\$NtUninstallKB956844$\spuninst\spuninst.exe"
Security Update for Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Security Update for Windows XP (KB958470)-->"C:\WINDOWS\$NtUninstallKB958470$\spuninst\spuninst.exe"
Security Update for Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Security Update for Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"
Security Update for Windows XP (KB958869)-->"C:\WINDOWS\$NtUninstallKB958869$\spuninst\spuninst.exe"
Security Update for Windows XP (KB959426)-->"C:\WINDOWS\$NtUninstallKB959426$\spuninst\spuninst.exe"
Security Update for Windows XP (KB960803)-->"C:\WINDOWS\$NtUninstallKB960803$\spuninst\spuninst.exe"
Security Update for Windows XP (KB960859)-->"C:\WINDOWS\$NtUninstallKB960859$\spuninst\spuninst.exe"
Security Update for Windows XP (KB961371-v2)-->"C:\WINDOWS\$NtUninstallKB961371-v2$\spuninst\spuninst.exe"
Security Update for Windows XP (KB961501)-->"C:\WINDOWS\$NtUninstallKB961501$\spuninst\spuninst.exe"
Security Update for Windows XP (KB969059)-->"C:\WINDOWS\$NtUninstallKB969059$\spuninst\spuninst.exe"
Security Update for Windows XP (KB969947)-->"C:\WINDOWS\$NtUninstallKB969947$\spuninst\spuninst.exe"
Security Update for Windows XP (KB970238)-->"C:\WINDOWS\$NtUninstallKB970238$\spuninst\spuninst.exe"
Security Update for Windows XP (KB970430)-->"C:\WINDOWS\$NtUninstallKB970430$\spuninst\spuninst.exe"
Security Update for Windows XP (KB971032)-->"C:\WINDOWS\$NtUninstallKB971032$\spuninst\spuninst.exe"
Security Update for Windows XP (KB971468)-->"C:\WINDOWS\$NtUninstallKB971468$\spuninst\spuninst.exe"
Security Update for Windows XP (KB971486)-->"C:\WINDOWS\$NtUninstallKB971486$\spuninst\spuninst.exe"
Security Update for Windows XP (KB971557)-->"C:\WINDOWS\$NtUninstallKB971557$\spuninst\spuninst.exe"
Security Update for Windows XP (KB971633)-->"C:\WINDOWS\$NtUninstallKB971633$\spuninst\spuninst.exe"
Security Update for Windows XP (KB971657)-->"C:\WINDOWS\$NtUninstallKB971657$\spuninst\spuninst.exe"
Security Update for Windows XP (KB971961)-->"C:\WINDOWS\$NtUninstallKB971961$\spuninst\spuninst.exe"
Security Update for Windows XP (KB972270)-->"C:\WINDOWS\$NtUninstallKB972270$\spuninst\spuninst.exe"
Security Update for Windows XP (KB973354)-->"C:\WINDOWS\$NtUninstallKB973354$\spuninst\spuninst.exe"
Security Update for Windows XP (KB973507)-->"C:\WINDOWS\$NtUninstallKB973507$\spuninst\spuninst.exe"
Security Update for Windows XP (KB973525)-->"C:\WINDOWS\$NtUninstallKB973525$\spuninst\spuninst.exe"
Security Update for Windows XP (KB973869)-->"C:\WINDOWS\$NtUninstallKB973869$\spuninst\spuninst.exe"
Security Update for Windows XP (KB973904)-->"C:\WINDOWS\$NtUninstallKB973904$\spuninst\spuninst.exe"
Security Update for Windows XP (KB974112)-->"C:\WINDOWS\$NtUninstallKB974112$\spuninst\spuninst.exe"
Security Update for Windows XP (KB974318)-->"C:\WINDOWS\$NtUninstallKB974318$\spuninst\spuninst.exe"
Security Update for Windows XP (KB974392)-->"C:\WINDOWS\$NtUninstallKB974392$\spuninst\spuninst.exe"
Security Update for Windows XP (KB974571)-->"C:\WINDOWS\$NtUninstallKB974571$\spuninst\spuninst.exe"
Security Update for Windows XP (KB975025)-->"C:\WINDOWS\$NtUninstallKB975025$\spuninst\spuninst.exe"
Security Update for Windows XP (KB975467)-->"C:\WINDOWS\$NtUninstallKB975467$\spuninst\spuninst.exe"
Security Update for Windows XP (KB975560)-->"C:\WINDOWS\$NtUninstallKB975560$\spuninst\spuninst.exe"
Security Update for Windows XP (KB975713)-->"C:\WINDOWS\$NtUninstallKB975713$\spuninst\spuninst.exe"
Security Update for Windows XP (KB976325)-->"C:\WINDOWS\$NtUninstallKB976325$\spuninst\spuninst.exe"
Security Update for Windows XP (KB977165)-->"C:\WINDOWS\$NtUninstallKB977165$\spuninst\spuninst.exe"
Security Update for Windows XP (KB977914)-->"C:\WINDOWS\$NtUninstallKB977914$\spuninst\spuninst.exe"
Security Update for Windows XP (KB978037)-->"C:\WINDOWS\$NtUninstallKB978037$\spuninst\spuninst.exe"
Security Update for Windows XP (KB978251)-->"C:\WINDOWS\$NtUninstallKB978251$\spuninst\spuninst.exe"
Security Update for Windows XP (KB978262)-->"C:\WINDOWS\$NtUninstallKB978262$\spuninst\spuninst.exe"
Security Update for Windows XP (KB978706)-->"C:\WINDOWS\$NtUninstallKB978706$\spuninst\spuninst.exe"
Spybot - Search & Destroy-->"C:\Program Files\Spybot - Search & Destroy\unins000.exe"
Steam-->MsiExec.exe /X{048298C9-A4D3-490B-9FF9-AB023A9238F3}
TeamSpeak 2 RC2-->"C:\Program Files\Teamspeak2_RC2\unins000.exe"
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {B2AE9C82-DC7B-3641-BFC8-87275C4F3607} /qb+ REBOOTPROMPT=""
Update for Windows Internet Explorer 8 (KB975364)-->"C:\WINDOWS\ie8updates\KB975364-IE8\spuninst\spuninst.exe"
Update for Windows XP (KB894391)-->"C:\WINDOWS\$NtUninstallKB894391$\spuninst\spuninst.exe"
Update for Windows XP (KB898461)-->"C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe"
Update for Windows XP (KB900485)-->"C:\WINDOWS\$NtUninstallKB900485$\spuninst\spuninst.exe"
Update for Windows XP (KB908531)-->"C:\WINDOWS\$NtUninstallKB908531$\spuninst\spuninst.exe"
Update for Windows XP (KB910437)-->"C:\WINDOWS\$NtUninstallKB910437$\spuninst\spuninst.exe"
Update for Windows XP (KB911280)-->"C:\WINDOWS\$NtUninstallKB911280$\spuninst\spuninst.exe"
Update for Windows XP (KB916595)-->"C:\WINDOWS\$NtUninstallKB916595$\spuninst\spuninst.exe"
Update for Windows XP (KB920872)-->"C:\WINDOWS\$NtUninstallKB920872$\spuninst\spuninst.exe"
Update for Windows XP (KB922582)-->"C:\WINDOWS\$NtUninstallKB922582$\spuninst\spuninst.exe"
Update for Windows XP (KB925720)-->"C:\WINDOWS\$NtUninstallKB925720$\spuninst\spuninst.exe"
Update for Windows XP (KB927891)-->"C:\WINDOWS\$NtUninstallKB927891$\spuninst\spuninst.exe"
Update for Windows XP (KB930916)-->"C:\WINDOWS\$NtUninstallKB930916$\spuninst\spuninst.exe"
Update for Windows XP (KB932823-v3)-->"C:\WINDOWS\$NtUninstallKB932823-v3$\spuninst\spuninst.exe"
Update for Windows XP (KB936357)-->"C:\WINDOWS\$NtUninstallKB936357$\spuninst\spuninst.exe"
Update for Windows XP (KB938828)-->"C:\WINDOWS\$NtUninstallKB938828$\spuninst\spuninst.exe"
Update for Windows XP (KB955759)-->"C:\WINDOWS\$NtUninstallKB955759$\spuninst\spuninst.exe"
Update for Windows XP (KB967715)-->"C:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.exe"
Update for Windows XP (KB968389)-->"C:\WINDOWS\$NtUninstallKB968389$\spuninst\spuninst.exe"
Update for Windows XP (KB971737)-->"C:\WINDOWS\$NtUninstallKB971737$\spuninst\spuninst.exe"
Update for Windows XP (KB973687)-->"C:\WINDOWS\$NtUninstallKB973687$\spuninst\spuninst.exe"
Update for Windows XP (KB973815)-->"C:\WINDOWS\$NtUninstallKB973815$\spuninst\spuninst.exe"
Ventrilo Client-->MsiExec.exe /I{789289CA-F73A-4A16-A331-54D498CE069F}
Visual C++ 2008 x86 Runtime - (v9.0.30729)-->MsiExec.exe /X{F333A33D-125C-32A2-8DCE-5C5D14231E27}
Visual C++ 2008 x86 Runtime - v9.0.30729.01-->C:\WINDOWS\system32\msiexec.exe /x {F333A33D-125C-32A2-8DCE-5C5D14231E27} /qb+ REBOOTPROMPT=""
VLC media player 1.0.3-->C:\Program Files\VideoLAN\VLC\uninstall.exe
Winamp-->"C:\Program Files\Winamp\UninstWA.exe"
Windows Driver Package - Belkin (HidUsb) HIDClass (01/11/2007 1.0)-->C:\PROGRA~1\DIFX\D6ACC4BE676423A2B130B78A4B627FC457D98997\DPInst.exe /u C:\WINDOWS\system32\DRVSTORE\jmtflter_92E9C44249735A5E0CACA1DD6109994985059DF9\jmtflter.inf
Windows Driver Package - MOTOROLA (uisp) USB (09/08/2006 1.2.0.0)-->C:\PROGRA~1\DIFX\D6ACC4BE676423A2B130B78A4B627FC457D98997\DPInst.exe /u C:\WINDOWS\system32\DRVSTORE\usbicp_148F9D51ADD758FCD4B68B61FF903F813AA2083E\usbicp.inf
Windows Imaging Component-->"C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe"
Windows Installer 3.1 (KB893803)-->"C:\WINDOWS\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe"
Windows Internet Explorer 8-->"C:\WINDOWS\ie8\spuninst\spuninst.exe"
Windows Media Format Runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows XP Hotfix - KB873339-->C:\WINDOWS\$NtUninstallKB873339$\spuninst\spuninst.exe
Windows XP Hotfix - KB885835-->C:\WINDOWS\$NtUninstallKB885835$\spuninst\spuninst.exe
Windows XP Hotfix - KB885836-->C:\WINDOWS\$NtUninstallKB885836$\spuninst\spuninst.exe
Windows XP Hotfix - KB886185-->C:\WINDOWS\$NtUninstallKB886185$\spuninst\spuninst.exe
Windows XP Hotfix - KB887472-->C:\WINDOWS\$NtUninstallKB887472$\spuninst\spuninst.exe
Windows XP Hotfix - KB888302-->C:\WINDOWS\$NtUninstallKB888302$\spuninst\spuninst.exe
Windows XP Hotfix - KB890859-->"C:\WINDOWS\$NtUninstallKB890859$\spuninst\spuninst.exe"
Windows XP Service Pack 2-->C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe
WinRAR archiver-->C:\Program Files\WinRAR\uninstall.exe

======Security center information======

AV: AVG Anti-Virus Free

======System event log======

Computer Name: 5P85VXVJFFF1DB2
Event Code: 51
Message: An error was detected on device \Device\Harddisk1\D during a paging operation.

Record Number: 1285
Source Name: Disk
Time Written: 20091229172510.000000-360
Event Type: warning
User:

Computer Name: 5P85VXVJFFF1DB2
Event Code: 51
Message: An error was detected on device \Device\Harddisk1\D during a paging operation.

Record Number: 1284
Source Name: Disk
Time Written: 20091229172510.000000-360
Event Type: warning
User:

Computer Name: 5P85VXVJFFF1DB2
Event Code: 51
Message: An error was detected on device \Device\Harddisk1\D during a paging operation.

Record Number: 1283
Source Name: Disk
Time Written: 20091229164734.000000-360
Event Type: warning
User:

Computer Name: 5P85VXVJFFF1DB2
Event Code: 4226
Message: TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.

Record Number: 1275
Source Name: Tcpip
Time Written: 20091229123411.000000-360
Event Type: warning
User:

Computer Name: 5P85VXVJFFF1DB2
Event Code: 36
Message: The time service has not been able to synchronize the system time
for 49152 seconds because none of the time providers has been able to
provide a usable time stamp. The system clock is unsynchronized.

Record Number: 1268
Source Name: W32Time
Time Written: 20091229072459.000000-360
Event Type: warning
User:

=====Application event log=====

Computer Name: 5P85VXVJFFF1DB2
Event Code: 1000
Message: Faulting application arma2.exe, version 1.5.0.62017, faulting module arma2.exe, version 1.5.0.62017, fault address 0x002fe4f9.

Record Number: 283
Source Name: Application Error
Time Written: 20091223032520.000000-360
Event Type: error
User:

Computer Name: 5P85VXVJFFF1DB2
Event Code: 1517
Message: Windows saved user 5P85VXVJFFF1DB2\Administrator registry while an application or service was still using the registry during log off. The memory used by the user's registry has not been freed. The registry will be unloaded when it is no longer in use.

This is often caused by services running as a user account, try configuring the services to run in either the LocalService or NetworkService account.

Record Number: 274
Source Name: Userenv
Time Written: 20091223002639.000000-360
Event Type: warning
User: NT AUTHORITY\SYSTEM

Computer Name: 5P85VXVJFFF1DB2
Event Code: 1000
Message: Faulting application eswlua.exe, version 0.0.0.0, faulting module luacurl.dll, version 0.0.0.0, fault address 0x000083d0.

Record Number: 258
Source Name: Application Error
Time Written: 20091222215603.000000-360
Event Type: error
User:

Computer Name: 5P85VXVJFFF1DB2
Event Code: 1000
Message: Faulting application eswlua.exe, version 0.0.0.0, faulting module luacurl.dll, version 0.0.0.0, fault address 0x000083d0.

Record Number: 256
Source Name: Application Error
Time Written: 20091222215258.000000-360
Event Type: error
User:

Computer Name: 5P85VXVJFFF1DB2
Event Code: 1000
Message: Faulting application eswlua.exe, version 0.0.0.0, faulting module luacurl.dll, version 0.0.0.0, fault address 0x000083d0.

Record Number: 253
Source Name: Application Error
Time Written: 20091222215016.000000-360
Event Type: error
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\system32\wbem;C:\PROGRA~1\DISKEE~1\DISKEE~1
"windir"=%SystemRoot%
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 15 Stepping 7, GenuineIntel
"PROCESSOR_REVISION"=0f07
"NUMBER_OF_PROCESSORS"=4
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"FP_NO_HOST_CHECK"=NO

-----------------EOF-----------------

Logfile of random's system information tool 1.06 (written by random/random)
Run by Administrator at 2010-02-20 15:43:42
Microsoft Windows XP Professional Service Pack 2
System drive C: has 224 GB (78%) free of 286 GB
Total RAM: 2047 MB (51% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:43:54 PM, on 2/20/2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Creative\Shared Files\CTAudSvc.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\n52te\n52teHid.exe
C:\PROGRA~1\AVG\AVG9\avgtray.exe
C:\Program Files\Saitek\SD6\Software\SaiMfd.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\n52te\n52teTra.exe
C:\Program Files\Saitek\SD6\Software\ProfilerU.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Administrator\Desktop\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Administrator.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
O2 - BHO: (no name) - {cc05b7a4-9374-466b-9638-a216255260a4} - (no file)
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Jomantha] C:\Program Files\n52te\n52teHid.exe
O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exe
O4 - HKLM\..\Run: [ProfilerU] C:\Program Files\Saitek\SD6\Software\ProfilerU.exe
O4 - HKLM\..\Run: [SaiMfd] C:\Program Files\Saitek\SD6\Software\SaiMfd.exe
O4 - Startup: OpenOffice.org 3.1.lnk.disabled
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\n6uemyabwf.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\n6uemyabwf.dll
O15 - Trusted Zone: http://*.buy-internetsecurity10.com
O15 - Trusted Zone: http://*.buy-is2010.com
O15 - Trusted Zone: http://*.is-software-download.com
O15 - Trusted Zone: http://*.is-software-download25.com
O15 - Trusted Zone: http://*.is10-soft-download.com
O15 - Trusted Zone: http://*.buy-internetsecurity10.com (HKLM)
O15 - Trusted Zone: http://*.buy-is2010.com (HKLM)
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://ccfiles.creative.com/Web/softwareupdate/su2/ocx/15111/CTPID.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe
O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTAudSvc.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

--
End of file - 5674 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]
AVG Safe Search - C:\Program Files\AVG\AVG9\avgssie.dll [2010-02-14 1484056]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
AVG Security Toolbar BHO - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll [2009-11-25 1230080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{cc05b7a4-9374-466b-9638-a216255260a4}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - AVG Security Toolbar - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll [2009-11-25 1230080]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Kernel and Hardware Abstraction Layer"=C:\WINDOWS\KHALMNPR.EXE [2009-06-17 55824]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2009-11-20 12669544]
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2009-11-20 110184]
"Jomantha"=C:\Program Files\n52te\n52teHid.exe [2008-06-13 159744]
"AVG9_TRAY"=C:\PROGRA~1\AVG\AVG9\avgtray.exe [2010-02-14 2033432]
"ProfilerU"=C:\Program Files\Saitek\SD6\Software\ProfilerU.exe [2009-06-03 237568]
"SaiMfd"=C:\Program Files\Saitek\SD6\Software\SaiMfd.exe [2009-06-03 131072]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe

C:\Documents and Settings\Administrator\Start Menu\Programs\Startup
OpenOffice.org 3.1.lnk.disabled - C:\Program Files\OpenOffice.org 3\program\quickstart.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\avgrsstarter]
C:\WINDOWS\system32\avgrsstx.dll [2010-02-14 12464]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\LBTWlgn]
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll [2009-07-20 72208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 239496]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Lavasoft Ad-Aware Service]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PEVSystemStart]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\procexp90.Sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WdfLoadGroup]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Steam\Steam.exe"="C:\Program Files\Steam\Steam.exe:*:Enabled:Steam"
"C:\Program Files\Steam\steamapps\common\arma 2\arma2.exe"="C:\Program Files\Steam\steamapps\common\arma 2\arma2.exe:*:Enabled:ARMA 2"
"C:\Program Files\Darkfall US\Lobby.exe"="C:\Program Files\Darkfall US\Lobby.exe:*:Enabled:Lobby"
"C:\Program Files\CCP\EVE\bin\ExeFile.exe"="C:\Program Files\CCP\EVE\bin\ExeFile.exe:*:Enabled:CCP ExeFile"
"C:\Program Files\Ventrilo\Ventrilo.exe"="C:\Program Files\Ventrilo\Ventrilo.exe:*:Enabled:Ventrilo.exe"
"C:\WINDOWS\system32\PnkBstrA.exe"="C:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA"
"C:\WINDOWS\system32\PnkBstrB.exe"="C:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB"
"C:\Program Files\Steam\steamapps\common\crysis\Bin32\Crysis.exe"="C:\Program Files\Steam\steamapps\common\crysis\Bin32\Crysis.exe:*:Enabled:Crysis"
"C:\Program Files\Psi\Psi.exe"="C:\Program Files\Psi\Psi.exe:*:Enabled:Psi"
"C:\Program Files\Steam\steamapps\common\left 4 dead 2\left4dead2.exe"="C:\Program Files\Steam\steamapps\common\left 4 dead 2\left4dead2.exe:*:Enabled:Left 4 Dead 2"
"C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe"="C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe:*:Enabled:DkService"
"C:\Program Files\AVG\AVG9\avgupd.exe"="C:\Program Files\AVG\AVG9\avgupd.exe:*:Enabled:avgupd.exe"
"C:\Program Files\AVG\AVG9\avgnsx.exe"="C:\Program Files\AVG\AVG9\avgnsx.exe:*:Enabled:avgnsx.exe"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

======List of files/folders created in the last 1 months======

2010-02-20 15:43:42 ----D---- C:\rsit
2010-02-15 17:28:17 ----HDC---- C:\Documents and Settings\All Users\Application Data\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}
2010-02-15 17:27:50 ----D---- C:\Program Files\Lavasoft
2010-02-15 17:27:50 ----D---- C:\Documents and Settings\All Users\Application Data\Lavasoft
2010-02-15 00:41:35 ----SD---- C:\ComboFix
2010-02-14 23:50:52 ----D---- C:\Program Files\ERUNT
2010-02-14 23:31:40 ----D---- C:\Program Files\Trend Micro
2010-02-14 23:08:09 ----A---- C:\WINDOWS\system32\avgrsstx.dll
2010-02-14 23:08:02 ----D---- C:\Documents and Settings\All Users\Application Data\AVG Security Toolbar
2010-02-14 22:34:49 ----SHD---- C:\RECYCLER
2010-02-14 21:59:38 ----A---- C:\ComboFix.txt
2010-02-14 21:53:17 ----A---- C:\Boot.bak
2010-02-14 21:53:14 ----RASHD---- C:\cmdcons
2010-02-14 21:52:19 ----A---- C:\WINDOWS\zip.exe
2010-02-14 21:52:19 ----A---- C:\WINDOWS\SWXCACLS.exe
2010-02-14 21:52:19 ----A---- C:\WINDOWS\SWSC.exe
2010-02-14 21:52:19 ----A---- C:\WINDOWS\SWREG.exe
2010-02-14 21:52:19 ----A---- C:\WINDOWS\sed.exe
2010-02-14 21:52:19 ----A---- C:\WINDOWS\PEV.exe
2010-02-14 21:52:19 ----A---- C:\WINDOWS\NIRCMD.exe
2010-02-14 21:52:19 ----A---- C:\WINDOWS\MBR.exe
2010-02-14 21:52:19 ----A---- C:\WINDOWS\grep.exe
2010-02-14 21:52:15 ----D---- C:\WINDOWS\ERDNT
2010-02-14 21:51:09 ----D---- C:\Qoobox
2010-02-14 21:49:12 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2010-02-14 21:16:12 ----A---- C:\WINDOWS\wininit.ini
2010-02-14 19:41:30 ----A---- C:\WINDOWS\system32\n6UemyABwf.dll
2010-02-09 16:50:37 ----HDC---- C:\WINDOWS\$NtUninstallKB978262$
2010-02-09 16:50:32 ----HDC---- C:\WINDOWS\$NtUninstallKB971468$
2010-02-09 16:49:17 ----HDC---- C:\WINDOWS\$NtUninstallKB978037$
2010-02-09 16:49:13 ----HDC---- C:\WINDOWS\$NtUninstallKB975713$
2010-02-09 16:49:08 ----HDC---- C:\WINDOWS\$NtUninstallKB978251$
2010-02-09 16:49:04 ----HDC---- C:\WINDOWS\$NtUninstallKB975560$
2010-02-09 16:48:57 ----HDC---- C:\WINDOWS\$NtUninstallKB977914$
2010-02-09 16:48:50 ----HDC---- C:\WINDOWS\$NtUninstallKB978706$
2010-02-09 16:48:40 ----HDC---- C:\WINDOWS\$NtUninstallKB977165$
2010-01-31 18:27:19 ----D---- C:\Documents and Settings\Administrator\Application Data\OpenOffice.org
2010-01-31 18:23:04 ----D---- C:\Program Files\Guitar Pro 5
2010-01-23 16:37:10 ----D---- C:\Program Files\Winamp
2010-01-23 16:37:10 ----D---- C:\Documents and Settings\Administrator\Application Data\Winamp

======List of files/folders modified in the last 1 months======

2010-02-20 15:43:49 ----D---- C:\WINDOWS\Prefetch
2010-02-20 15:39:51 ----D---- C:\Program Files\Mozilla Firefox
2010-02-20 13:09:12 ----D---- C:\Documents and Settings\Administrator\Application Data\vlc
2010-02-20 09:11:48 ----D---- C:\WINDOWS\Temp
2010-02-15 20:00:26 ----D---- C:\Program Files\Steam
2010-02-15 17:50:56 ----D---- C:\WINDOWS\system32\CatRoot2
2010-02-15 17:33:27 ----SD---- C:\WINDOWS\Tasks
2010-02-15 17:33:20 ----D---- C:\WINDOWS
2010-02-15 17:31:39 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-02-15 17:30:51 ----HD---- C:\WINDOWS\inf
2010-02-15 17:30:51 ----D---- C:\WINDOWS\system32\drivers
2010-02-15 17:30:49 ----DC---- C:\WINDOWS\system32\DRVSTORE
2010-02-15 17:28:22 ----SHD---- C:\WINDOWS\Installer
2010-02-15 17:28:22 ----D---- C:\WINDOWS\WinSxS
2010-02-15 17:27:50 ----RD---- C:\Program Files
2010-02-15 17:19:48 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2010-02-15 02:05:13 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-02-15 02:05:08 ----D---- C:\WINDOWS\system32
2010-02-15 02:05:04 ----D---- C:\WINDOWS\system32\ReinstallBackups
2010-02-15 01:59:04 ----SHD---- C:\System Volume Information
2010-02-15 01:59:04 ----D---- C:\WINDOWS\system32\Restore
2010-02-14 23:42:05 ----D---- C:\Documents and Settings\Administrator\Application Data\uTorrent
2010-02-14 23:07:59 ----D---- C:\Program Files\AVG
2010-02-14 23:07:59 ----D---- C:\Documents and Settings\All Users\Application Data\avg9
2010-02-14 23:06:54 ----SD---- C:\Documents and Settings\Administrator\Application Data\Microsoft
2010-02-14 22:29:17 ----HDC---- C:\WINDOWS\$NtUninstallKB971557$
2010-02-14 21:58:06 ----A---- C:\WINDOWS\system.ini
2010-02-14 21:57:50 ----SHD---- C:\WINDOWS\CSC
2010-02-14 21:56:34 ----D---- C:\WINDOWS\system32\config
2010-02-14 21:55:24 ----D---- C:\WINDOWS\AppPatch
2010-02-14 21:55:24 ----D---- C:\Program Files\Common Files
2010-02-14 21:53:17 ----RASH---- C:\boot.ini
2010-02-14 21:09:16 ----D---- C:\Program Files\Internet Explorer
2010-02-14 19:51:43 ----D---- C:\WINDOWS\Debug
2010-02-14 19:51:42 ----D---- C:\WINDOWS\Minidump
2010-02-09 16:50:36 ----HD---- C:\WINDOWS\$hf_mig$
2010-02-07 00:12:18 ----D---- C:\WINDOWS\Sun
2010-01-31 18:23:05 ----RSD---- C:\WINDOWS\Fonts
2010-01-23 16:37:17 ----D---- C:\Program Files\Winamp Detect

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AvgLdx86;AVG Free AVI Loader Driver x86; C:\WINDOWS\System32\Drivers\avgldx86.sys [2010-02-14 333192]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86; C:\WINDOWS\System32\Drivers\avgmfx86.sys [2010-02-14 28424]
R1 AvgTdiX;AVG Free Network Redirector; C:\WINDOWS\System32\Drivers\avgtdix.sys [2010-02-14 360584]
R1 intelppm;Intel Processor Driver; C:\WINDOWS\System32\DRIVERS\intelppm.sys [2004-08-03 36096]
R1 kbdhid;Keyboard HID Driver; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2004-08-03 14848]
R1 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2001-08-23 12032]
R2 cpuz132;cpuz132; \??\C:\WINDOWS\system32\drivers\cpuz132_x32.sys []
R2 LBeepKE;LBeepKE; C:\WINDOWS\System32\Drivers\LBeepKE.sys [2009-06-17 10384]
R3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\System32\DRIVERS\arp1394.sys [2004-08-03 60800]
R3 CT20XUT.SYS;CT20XUT.SYS; C:\WINDOWS\System32\drivers\CT20XUT.SYS [2009-06-04 171032]
R3 ctac32k;Creative AC3 Software Decoder; C:\WINDOWS\system32\drivers\ctac32k.sys [2009-06-04 511000]
R3 ctaud2k;Creative Audio Driver (WDM); C:\WINDOWS\system32\drivers\ctaud2k.sys [2009-06-04 526232]
R3 CTEXFIFX.SYS;CTEXFIFX.SYS; C:\WINDOWS\System32\drivers\CTEXFIFX.SYS [2009-06-04 1324056]
R3 ctprxy2k;Creative Proxy Driver; C:\WINDOWS\system32\drivers\ctprxy2k.sys [2009-06-04 14360]
R3 ctsfm2k;Creative SoundFont Management Device Driver; C:\WINDOWS\system32\drivers\ctsfm2k.sys [2009-06-04 158744]
R3 DKRtWrt;DKRtWrt; C:\WINDOWS\system32\DRIVERS\DKRtWrt.sys [2009-10-21 45232]
R3 emupia;E-mu Plug-in Architecture Driver; C:\WINDOWS\system32\drivers\emupia2k.sys [2009-06-04 95768]
R3 ha20x2k;Creative 20X HAL Driver; C:\WINDOWS\system32\drivers\ha20x2k.sys [2009-06-04 1177624]
R3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-08-17 9600]
R3 JmtFltr;n52te; C:\WINDOWS\System32\Drivers\JmtFltr.sys [2007-09-27 48896]
R3 LHidFilt;Logitech SetPoint KMDF HID Filter Driver; C:\WINDOWS\system32\DRIVERS\LHidFilt.Sys [2009-06-17 35472]
R3 LMouFilt;Logitech SetPoint KMDF Mouse Filter Driver; C:\WINDOWS\system32\DRIVERS\LMouFilt.Sys [2009-06-17 37392]
R3 mouhid;Mouse HID Driver; C:\WINDOWS\System32\DRIVERS\mouhid.sys [2001-08-17 12160]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\System32\DRIVERS\nic1394.sys [2004-08-03 61824]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2009-11-20 10235968]
R3 NVENETFD;NVIDIA nForce 10/100/1000 Mbps Ethernet ; C:\WINDOWS\System32\DRIVERS\NVENETFD.sys [2009-07-01 67328]
R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\System32\DRIVERS\nvnetbus.sys [2009-07-01 15872]
R3 ossrv;Creative OS Services Driver; C:\WINDOWS\system32\drivers\ctoss2k.sys [2009-06-04 130072]
R3 SaiH0255;SaiH0255; C:\WINDOWS\system32\DRIVERS\SaiH0255.sys [2007-05-01 132232]
R3 SaiMini;SaiMini; C:\WINDOWS\system32\DRIVERS\SaiMini.sys [2009-06-10 14080]
R3 SaiNtBus;SaiNtBus; C:\WINDOWS\system32\drivers\SaiBus.sys [2009-06-10 36992]
R3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-03 31616]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-03 26624]
R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2004-08-03 57600]
R3 usbohci;Microsoft USB Open Host Controller Miniport Driver; C:\WINDOWS\System32\DRIVERS\usbohci.sys [2004-08-03 17024]
R3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
R3 vhidmini;Virtual Hid Device; C:\WINDOWS\system32\DRIVERS\vhidmini.sys [2007-09-19 12672]
R3 Wdf01000;Wdf01000; C:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2006-11-02 492000]
S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
S3 CT20XUT;CT20XUT; C:\WINDOWS\system32\drivers\CT20XUT.SYS [2009-06-04 171032]
S3 ctdvda2k;Creative DVD-Audio Device Driver; C:\WINDOWS\system32\drivers\ctdvda2k.sys [2009-06-04 347080]
S3 CTEXFIFX;CTEXFIFX; C:\WINDOWS\system32\drivers\CTEXFIFX.SYS [2009-06-04 1324056]
S3 CTHWIUT.SYS;CTHWIUT.SYS; C:\WINDOWS\System32\drivers\CTHWIUT.SYS [2009-06-04 72728]
S3 CTHWIUT;CTHWIUT; C:\WINDOWS\system32\drivers\CTHWIUT.SYS [2009-06-04 72728]
S3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys []
S3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys []
S3 L8042Kbd;Logitech SetPoint Keyboard Driver; C:\WINDOWS\system32\DRIVERS\L8042Kbd.sys [2009-06-17 20240]
S3 usbaudio;USB Audio Driver (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2004-08-03 59264]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 avg9wd;AVG Free WatchDog; C:\Program Files\AVG\AVG9\avgwdsvc.exe [2010-02-14 285392]
R2 CTAudSvcService;Creative Audio Service; C:\Program Files\Creative\Shared Files\CTAudSvc.exe [2009-02-23 307200]
R2 Diskeeper;Diskeeper; C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe [2009-10-23 1732960]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-12-23 153376]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service; C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe [2010-02-15 1229232]
R2 nvsvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2009-11-20 154216]
R2 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2010-01-07 66872]
R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2005-01-28 38912]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service; C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2009-12-22 79360]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 LBTServ;Logitech Bluetooth Service; C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe [2009-07-20 121360]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-02-21 00:49:44
Windows 5.1.2600 Service Pack 2
Running: gmer.exe; Driver: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ugqdipoc.sys

---- System - GMER 1.0.15 ----

SSDT Lbd.sys (Boot Driver/Lavasoft AB) ZwCreateKey [0xB811887E]
SSDT Lbd.sys (Boot Driver/Lavasoft AB) ZwSetValueKey [0xB8118BFE]

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs SiWinAcc.sys (Windows Accelerator Driver/Silicon Image, Inc.)
AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Tcp Lbd.sys (Boot Driver/Lavasoft AB)
AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Udp Lbd.sys (Boot Driver/Lavasoft AB)
AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\RawIp Lbd.sys (Boot Driver/Lavasoft AB)

---- Registry - GMER 1.0.15 ----

Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@DeviceNotSelectedTimeout 15
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@GDIProcessHandleQuota 10000
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@Spooler yes
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@swapdisk
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@TransmissionRetryTimeout 90
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@USERProcessHandleQuota 10000
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@AppInit_DLLs
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@LoadAppInit_DLLs 1

---- EOF - GMER 1.0.15 ----

katana

2010-02-21, 11:54

I see that you have used Combofix, please can you post the log that it produced.

C:\ComboFix.txt

----------------------------------------------------------------------------------------
Step 1

Please download GooredFix from one of the locations below and save it to your Desktop
Download Mirror #1 (http://jpshortstuff.247fixes.com/GooredFix.exe)
Download Mirror #2 (http://downloads.securitycadets.com/GooredFix.exe) Ensure all Firefox windows are closed. To run the tool, double-click it (XP), or right-click and select Run As Administrator (Vista). When prompted to run the scan, click Yes. GooredFix will check for infections, and then a log will appear. Please post the contents of that log in your next reply (it can also be found on your desktop, called GooredFix.txt).

----------------------------------------------------------------------------------------
Step 2

Kaspersky Online Scanner .
Your Antivirus and/or Antispyware may give a warning during the scan. This is perfectly normal
NOTE:- This scan is best done from IE (Internet Explorer)
NOTE:- Vista users should start IE by Start(Vista Orb) >> Internet Explorer >> Right-Click Run As Admin
Go Here http://www.kaspersky.com/kos/eng/partner/default/kavwebscan.html

Read the Requirements and limitations before you click Accept.
Once the database has downloaded, click My Computer in the left pane
Now go and put the kettle on !
When the scan has completed, click Save Report As...
Enter a name for the file in the Filename: text box and then click the down arrow to the right of Save as type: and select text file (*.txt)
Click Save - by default the file will be saved to your Desktop, but you can change this if you wish.

**Note**

To optimize scanning time and produce a more sensible report for review: Close any open programs.
Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.
Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.

----------------------------------------------------------------------------------------
Logs/Information to Post in Reply
Please post the following logs/Information in your reply
Some of the logs I request will be quite large, You may need to split them over a couple of replies.

Combofix Log
Goored Fix Log
Kaspersky Log
How are things running now ?

Lothaar

2010-02-22, 05:21

Sorry I did not realize my assistant had run combofix the day before my original post. It was done in order to be able to run malwarebytes and spybot S&D. Both programs were blocked for some reason and after running combofix they were able to run. malwarebytes and spybot S&D were run several times until they came back clean. The following day I noticed the browser redirect problem and produced the hijackthis log and posted in the forum.

The redirect problem seems to have been solved. Let me know if I can turn back on S&D teatimer and reinstall AVG as I had to uninstall it to prevent interference with our testing.

Here are the requested logs.

ComboFix 10-02-12.01 - Administrator 02/14/2010 21:54:02.1.4 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2047.1460 [GMT -6:00]
Running from: c:\documents and settings\Administrator\My Documents\Downloads\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Security 2010.lnk
c:\documents and settings\Administrator\Local Settings\Application Data\av.exe
C:\s
c:\windows\pthreadGC2.dll
c:\windows\system32\18467.exe
c:\windows\system32\flags.ini
c:\windows\system32\helper32.dll
c:\windows\system32\info.tmp
c:\windows\system32\jifafusu.dll
c:\windows\system32\nugebini.dll
c:\windows\system32\orfvpgqgm.dll
c:\windows\system32\zerunuwa.dll

.
((((((((((((((((((((((((( Files Created from 2010-01-15 to 2010-02-15 )))))))))))))))))))))))))))))))
.

2010-02-15 03:52 . 2010-02-13 11:53 -------- d-----w- C:\32788R22FWJFW
2010-02-15 03:49 . 2010-01-07 22:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-15 03:49 . 2010-02-15 03:49 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-02-15 03:49 . 2010-01-07 22:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-02-15 01:41 . 2010-02-15 01:41 36864 ----a-w- c:\windows\system32\n6UemyABwf.dll
2010-02-01 00:27 . 2010-02-01 00:27 1 ----a-w- c:\documents and settings\Administrator\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-02-01 00:27 . 2010-02-01 00:27 -------- d-----w- c:\documents and settings\Administrator\Application Data\OpenOffice.org
2010-02-01 00:23 . 2010-02-01 00:23 -------- d-----w- c:\program files\Guitar Pro 5
2010-01-23 22:37 . 2010-01-23 23:45 -------- d-----w- c:\documents and settings\Administrator\Application Data\Winamp
2010-01-23 22:37 . 2010-01-23 22:37 -------- d-----w- c:\program files\Winamp
2010-01-18 02:36 . 2010-01-30 07:07 -------- d-----w- c:\documents and settings\Administrator\PsiData
2010-01-18 02:36 . 2010-01-18 02:36 -------- d-----w- c:\program files\Psi

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-15 03:48 . 2009-12-22 23:54 -------- d-----w- c:\documents and settings\Administrator\Application Data\vlc
2010-02-15 03:09 . 2009-12-22 23:34 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-02-14 07:43 . 2009-12-23 02:25 -------- d-----w- c:\documents and settings\Administrator\Application Data\uTorrent
2010-02-11 00:54 . 2009-12-23 03:40 -------- d-----w- c:\program files\Steam
2010-02-01 00:26 . 2009-12-22 17:27 19168 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-01-23 22:37 . 2009-12-23 18:17 -------- d-----w- c:\program files\Winamp Detect
2010-01-10 08:30 . 2010-01-10 08:30 -------- d-----w- c:\program files\DIFX
2010-01-10 08:30 . 2010-01-10 08:30 -------- d-----w- c:\documents and settings\Administrator\Application Data\n52te
2010-01-10 08:30 . 2010-01-10 08:30 -------- d-----w- c:\program files\n52te
2010-01-10 08:30 . 2009-12-22 23:59 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-01-10 08:30 . 2010-01-10 08:30 -------- d-----w- c:\documents and settings\Administrator\Application Data\InstallShield
2010-01-08 04:00 . 2010-01-08 04:00 -------- d--h--r- c:\documents and settings\Administrator\Application Data\SecuROM
2010-01-08 04:00 . 2010-01-08 04:00 107888 ----a-w- c:\windows\system32\CmdLineExt.dll
2010-01-08 04:00 . 2010-01-08 04:00 -------- d-----w- c:\program files\GameSpy
2010-01-08 03:58 . 2010-01-08 03:58 22328 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2010-01-08 03:58 . 2010-01-08 03:58 22328 ----a-w- c:\documents and settings\Administrator\Application Data\PnkBstrK.sys
2010-01-08 03:58 . 2010-01-08 03:58 22328 ----a-w- c:\documents and settings\Administrator\Application Data\PnkBstrK.sys
2010-01-08 03:58 . 2010-01-08 03:58 103736 ----a-w- c:\windows\system32\PnkBstrB.exe
2010-01-08 03:58 . 2010-01-08 03:58 669184 ----a-w- c:\windows\system32\pbsvc.exe
2010-01-08 03:58 . 2010-01-08 03:58 66872 ----a-w- c:\windows\system32\PnkBstrA.exe
2010-01-07 03:12 . 2010-01-07 03:12 -------- d-----w- c:\documents and settings\Administrator\Application Data\Songbird2
2010-01-07 03:02 . 2009-12-25 19:31 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2010-01-02 02:20 . 2010-01-02 02:20 -------- d-----w- c:\program files\Saitek
2010-01-01 09:41 . 2010-01-01 09:41 1956528 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\install_flash_player_ax.exe
2010-01-01 09:11 . 2010-01-01 09:10 -------- d-----w- c:\program files\NVIDIA Corporation
2010-01-01 09:10 . 2010-01-01 09:10 -------- d-----w- c:\program files\AGEIA Technologies
2010-01-01 09:10 . 2009-12-22 17:49 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-12-31 16:14 . 2001-08-23 12:00 352640 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-26 17:38 . 2009-12-24 02:42 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar
2009-12-26 17:13 . 2009-12-26 17:13 -------- d-----w- c:\program files\MSBuild
2009-12-26 17:13 . 2009-12-26 17:13 -------- d-----w- c:\program files\Reference Assemblies
2009-12-26 17:11 . 2009-12-26 17:11 -------- d-----w- c:\program files\MSXML 6.0
2009-12-26 05:05 . 2009-12-26 05:05 -------- d-----w- c:\documents and settings\Administrator\Application Data\Darkfall
2009-12-25 19:31 . 2009-12-25 19:31 1924200 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\install_flash_player.exe
2009-12-25 08:10 . 2009-12-25 08:10 -------- d-----w- c:\documents and settings\All Users\Application Data\Saitek
2009-12-24 02:58 . 2009-12-24 02:58 -------- d-----w- c:\program files\JRE
2009-12-24 02:58 . 2009-12-24 02:58 -------- d-----w- c:\program files\OpenOffice.org 3
2009-12-24 02:57 . 2009-12-24 02:57 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-12-24 02:57 . 2009-12-24 02:57 -------- d-----w- c:\program files\Java
2009-12-24 02:55 . 2009-12-24 02:55 -------- d-----w- c:\program files\TMonitor_101
2009-12-24 02:42 . 2009-12-24 02:42 12464 ----a-w- c:\windows\system32\avgrsstx.dll
2009-12-24 02:42 . 2009-12-24 02:42 360584 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2009-12-24 02:42 . 2009-12-24 02:42 333192 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-12-24 02:42 . 2009-12-24 02:42 28424 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-12-24 02:42 . 2009-12-24 02:42 -------- d-----w- c:\program files\AVG
2009-12-24 02:42 . 2009-12-24 02:42 -------- d-----w- c:\documents and settings\All Users\Application Data\avg9
2009-12-24 02:20 . 2009-12-24 02:14 -------- d-----w- c:\documents and settings\Administrator\Application Data\Ventrilo
2009-12-24 02:14 . 2009-12-24 02:14 -------- d-----w- c:\program files\Ventrilo
2009-12-24 00:59 . 2009-12-24 00:59 -------- d-----w- c:\program files\CCP
2009-12-24 00:59 . 2009-12-24 00:59 -------- d-----w- c:\documents and settings\All Users\Application Data\CCP
2009-12-24 00:59 . 2009-12-24 00:59 -------- d-----w- c:\documents and settings\Administrator\Application Data\Darkfall US
2009-12-24 00:58 . 2009-12-24 00:58 -------- d-----w- c:\program files\Darkfall US
2009-12-23 23:49 . 2009-12-23 23:49 -------- d-----w- c:\program files\Monte Cristo
2009-12-23 17:50 . 2009-12-23 17:38 -------- d-----w- c:\documents and settings\Administrator\Application Data\VirtualStore
2009-12-23 06:42 . 2009-12-22 23:34 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-12-23 06:42 . 2009-12-22 23:42 -------- d-----w- c:\program files\VS Revo Group
2009-12-23 06:41 . 2009-12-23 02:24 -------- d-----w- c:\program files\Foxit Software
2009-12-23 06:41 . 2009-12-23 02:26 -------- d-----w- c:\program files\Teamspeak2_RC2
2009-12-23 06:41 . 2009-12-23 02:26 -------- d-----w- c:\program files\uTorrent
2009-12-23 06:13 . 2009-12-23 06:13 -------- d-----w- c:\program files\Common Files\Diskeeper Corporation
2009-12-23 06:13 . 2009-12-23 06:13 -------- d-----w- c:\documents and settings\All Users\Application Data\Diskeeper Corporation
2009-12-23 06:13 . 2009-12-23 06:13 -------- d-----w- c:\program files\Windows Home Server
2009-12-23 06:13 . 2009-12-23 06:13 -------- d-----w- c:\program files\Diskeeper Corporation
2009-12-23 05:59 . 2009-12-23 05:25 -------- d-----w- c:\documents and settings\Administrator\Application Data\dvdcss
2009-12-23 03:55 . 2009-12-23 03:51 -------- d-----w- c:\documents and settings\All Users\Application Data\ElectricSheep
2009-12-23 03:51 . 2009-12-23 03:51 -------- d-----w- c:\program files\Electricsheep Screensaver
2009-12-23 03:44 . 2009-12-23 03:43 -------- d-----w- c:\documents and settings\All Users\Application Data\LogiShrd
2009-12-23 03:44 . 2009-12-23 03:44 -------- d-----w- c:\documents and settings\Administrator\Application Data\Logitech
2009-12-23 03:44 . 2009-12-23 03:44 -------- d-----w- c:\documents and settings\Administrator\Application Data\Leadertech
2009-12-23 03:44 . 2009-12-23 03:43 -------- d-----w- c:\program files\Common Files\Logishrd
2009-12-23 03:43 . 2009-12-23 03:43 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_LHidFilt_01005.Wdf
2009-12-23 03:43 . 2009-12-23 03:43 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
2009-12-23 03:43 . 2009-12-23 03:43 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2009-12-23 03:43 . 2009-12-23 03:43 -------- d-----w- c:\documents and settings\All Users\Application Data\Logitech
2009-12-23 03:43 . 2009-12-23 03:43 -------- d-----w- c:\program files\Logitech
2009-12-23 03:38 . 2009-12-23 03:38 -------- d-----w- c:\program files\CPUID
2009-12-23 03:04 . 2009-12-23 03:04 -------- d-----w- c:\documents and settings\Administrator\Application Data\teamspeak2
2009-12-23 02:37 . 2009-12-23 02:37 -------- d-----w- c:\program files\Common Files\Creative Labs Shared
2009-12-23 02:37 . 2009-12-23 00:02 -------- d-----w- c:\program files\Creative
2009-12-23 02:36 . 2009-12-23 02:36 444952 ----a-w- c:\windows\system32\wrap_oal.dll
2009-12-23 02:36 . 2009-12-23 02:36 109080 ----a-w- c:\windows\system32\OpenAL32.dll
2009-12-23 02:36 . 2009-12-23 02:36 -------- d-----w- c:\program files\OpenAL
2009-12-23 02:25 . 2009-12-23 02:25 -------- d-----w- c:\documents and settings\Administrator\Application Data\Foxit
2009-12-23 02:19 . 2009-12-23 02:19 -------- d-----w- c:\program files\CCleaner
2009-12-23 01:09 . 2009-12-23 01:09 0 ----a-w- c:\windows\nsreg.dat
2009-12-23 00:23 . 2009-12-23 00:02 -------- d-----w- c:\documents and settings\All Users\Application Data\Creative
2009-12-22 23:53 . 2009-12-22 23:53 -------- d-----w- c:\program files\VideoLAN
2009-12-22 23:40 . 2009-12-22 23:40 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2009-12-22 23:40 . 2009-12-22 23:40 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-12-22 19:26 . 2009-12-22 19:26 315392 ----a-w- c:\windows\HideWin.exe
2009-12-22 19:26 . 2009-12-22 19:26 -------- d-----w- c:\program files\Common Files\InstallShield
2009-12-22 19:04 . 2009-12-22 17:04 86327 ----a-w- c:\windows\PCHEALTH\HELPCTR\OfflineCache\index.dat
2009-12-22 17:48 . 2009-12-22 17:48 -------- d-----w- c:\documents and settings\All Users\Application Data\NVIDIA Corporation
2009-12-22 17:04 . 2009-12-22 17:04 -------- d-----w- c:\program files\microsoft frontpage
2009-12-22 17:01 . 2009-12-22 17:01 21640 ----a-w- c:\windows\system32\emptyregdb.dat
2009-12-21 19:14 . 2001-08-23 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2009-12-21 04:30 . 2010-01-07 03:13 274432 ----a-w- c:\documents and settings\Administrator\Application Data\Songbird2\Profiles\445hf58q.default\extensions\windowsmedia@songbirdnest.com\platform\WINNT_x86-msvc\components\sbWindowsMediacore.dll
2009-12-21 04:30 . 2010-01-07 03:13 106496 ----a-w- c:\documents and settings\Administrator\Application Data\Songbird2\Profiles\445hf58q.default\extensions\quicktime@songbirdnest.com\platform\WINNT_x86-msvc\components\sbQuickTimeMediacore.dll
2009-12-16 12:58 . 2009-12-22 17:01 343040 ----a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:35 . 2001-08-23 12:00 33280 ----a-w- c:\windows\system32\csrsrv.dll
1601-01-01 00:03 . 1601-01-01 00:03 45568 --sha-w- c:\windows\system32\ledamine.dll
1601-01-01 00:03 . 1601-01-01 00:03 39424 --sha-w- c:\windows\system32\mudagodu.dll
1601-01-01 00:03 . 1601-01-01 00:03 39424 --sha-w- c:\windows\system32\nukajuge.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-11-25 1230080]

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-11-25 1230080]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-11-25 1230080]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2009-06-17 55824]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-11-21 12669544]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-11-21 110184]
"Jomantha"="c:\program files\n52te\n52teHid.exe" [2008-06-13 159744]

c:\documents and settings\Administrator\Start Menu\Programs\Startup\
OpenOffice.org 3.1.lnk.disabled [2010-1-31 864]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2009-12-22 813584]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-12-24 02:42 12464 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2009-07-20 18:28 72208 ----a-w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" /background
"Internet Security 2010"=c:\program files\InternetSecurity2010\IS2010.exe
"Remote System Protection"=rundll32.exe c:\windows\system32\orfvpgqgm.dll, HUI_proc

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"Alcmtr"=ALCMTR.EXE
"NvCplDaemon"=RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
"NvMediaCenter"=RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
"NVRaidService"=c:\windows\System32\nvraidservice.exe
"nwiz"=nwiz.exe /installquiet
"RTHDCPL"=RTHDCPL.EXE
"SkyTel"=SkyTel.EXE
"CTxfiHlp"=CTXFIHLP.EXE
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe"
"KernelFaultCheck"=%systemroot%\system32\dumprep 0 -k
"WinampAgent"="c:\program files\Winamp\winampa.exe"
"SaiMfd"=c:\program files\Saitek\SD6\Software\SaiMfd.exe
"ProfilerU"=c:\program files\Saitek\SD6\Software\ProfilerU.exe
"hakiziped"=Rundll32.exe "c:\windows\system32\vunoyedi.dll",a

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableNotifications"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Steam\\Steam.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\arma 2\\arma2.exe"=
"c:\\Program Files\\Darkfall US\\Lobby.exe"=
"c:\\Program Files\\CCP\\EVE\\bin\\ExeFile.exe"=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\crysis\\Bin32\\Crysis.exe"=
"c:\\Program Files\\Psi\\Psi.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\left 4 dead 2\\left4dead2.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgchsvx.exe"=
"c:\\Program Files\\Diskeeper Corporation\\Diskeeper\\DkService.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [12/23/2009 8:42 PM 333192]
R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [12/23/2009 8:42 PM 360584]
R2 avg9emc;AVG Free E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [12/23/2009 8:42 PM 906520]
R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [12/23/2009 8:42 PM 285392]
R2 cpuz132;cpuz132;c:\windows\system32\drivers\cpuz132_x32.sys [12/22/2009 9:38 PM 12672]
R2 LBeepKE;LBeepKE;c:\windows\system32\drivers\LBeepKE.sys [12/22/2009 9:43 PM 10384]
R3 CT20XUT.SYS;CT20XUT.SYS;c:\windows\system32\drivers\CT20XUT.sys [6/4/2009 2:46 AM 171032]
R3 CTEXFIFX.SYS;CTEXFIFX.SYS;c:\windows\system32\drivers\CTEXFIFX.sys [6/4/2009 2:46 AM 1324056]
R3 CTHWIUT.SYS;CTHWIUT.SYS;c:\windows\system32\drivers\CTHWIUT.sys [6/4/2009 2:46 AM 72728]
R3 DKRtWrt;DKRtWrt;c:\windows\system32\drivers\DKRtWrt.sys [12/23/2009 12:13 AM 45232]
R3 JmtFltr;n52te;c:\windows\system32\drivers\JmtFltr.sys [1/10/2010 2:30 AM 48896]
S0 zkeydwx;zkeydwx; [x]
S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [12/22/2009 8:37 PM 79360]
S3 CT20XUT;CT20XUT;c:\windows\system32\drivers\CT20XUT.sys [6/4/2009 2:46 AM 171032]
S3 CTEXFIFX;CTEXFIFX;c:\windows\system32\drivers\CTEXFIFX.sys [6/4/2009 2:46 AM 1324056]
S3 CTHWIUT;CTHWIUT;c:\windows\system32\drivers\CTHWIUT.sys [6/4/2009 2:46 AM 72728]
S3 SaiH0255;SaiH0255;c:\windows\system32\drivers\SaiH0255.sys [5/1/2007 4:11 PM 132232]
.
.
------- Supplementary Scan -------
.
LSP: c:\windows\system32\n6UemyABwf.dll
Trusted Zone: buy-internetsecurity10.com
Trusted Zone: buy-is2010.com
Trusted Zone: is-software-download.com
Trusted Zone: is-software-download25.com
Trusted Zone: is10-soft-download.com
Trusted Zone: buy-internetsecurity10.com
Trusted Zone: buy-is2010.com
TCP: {D9A11353-4D86-40EF-BCB4-FE88923E062F} = 83.149.115.157,4.2.2.1,192.168.0.1
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\1b1z3yu5.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - prefs.js: keyword.URL - hxxp://search.avg.com/dispatcher.aspx?i=40&tp=ab&q=
FF - component: c:\program files\AVG\AVG9\Firefox\components\avgssff.dll
FF - component: c:\program files\AVG\AVG9\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils2.dll
FF - component: c:\program files\AVG\AVG9\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll
FF - component: c:\program files\AVG\AVG9\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll
FF - component: c:\program files\AVG\AVG9\Toolbar\Firefox\avg@igeared\components\xpavgtbapi.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npwachk.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true.
- - - - ORPHANS REMOVED - - - -

BHO-{A3BA40A2-74F0-42BD-F434-00B15A2C8953} - c:\windows\system32\orfvpgqgm.dll
BHO-{cc05b7a4-9374-466b-9638-a216255260a4} - zerunuwa.dll
HKCU-Run-Remote System Protection - c:\windows\system32\orfvpgqgm.dll
HKLM-Run-nwiz - nwiz.exe
HKLM-Run-hakiziped - c:\windows\system32\nugebini.dll
HKLM-Run-yogamabasu - numuligi.dll
SharedTaskScheduler-{A3BA40A2-74F0-42BD-F434-00B15A2C8953} - c:\windows\system32\orfvpgqgm.dll
SharedTaskScheduler-{a00e6d22-fbaa-4b82-8cd3-eba901929ba5} - c:\windows\system32\nugebini.dll
SSODL-howolahuk-{a00e6d22-fbaa-4b82-8cd3-eba901929ba5} - c:\windows\system32\nugebini.dll

**************************************************************************
scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files:

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-515967899-1580818891-682003330-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,b8,24,4f,b5,d6,89,f1,46,8c,bb,3e,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,b8,24,4f,b5,d6,89,f1,46,8c,bb,3e,\

[HKEY_USERS\S-1-5-21-515967899-1580818891-682003330-500\Software\SecuROM\License information*]
"datasecu"=hex:3a,a1,3f,6e,a2,33,a9,89,f6,06,11,1a,cd,d4,f7,1b,c0,75,f1,de,59,
a1,99,d7,ea,85,c4,f6,58,e6,1a,39,43,5d,b8,8f,cc,11,c1,4f,83,5a,34,3e,0e,cd,\
"rkeysecu"=hex:7d,40,10,cb,c7,39,e0,67,0a,69,a8,47,07,da,5b,5c
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(740)
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
c:\program files\common files\logishrd\bluetooth\LBTServ.dll

- - - - - - - > 'explorer.exe'(3136)
c:\windows\system32\WININET.dll
c:\program files\Logitech\SetPoint\GameHook.dll
c:\program files\Logitech\SetPoint\lgscroll.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\nvsvc32.exe
c:\program files\AVG\AVG9\avgchsvx.exe
c:\program files\AVG\AVG9\avgrsx.exe
c:\program files\Creative\Shared Files\CTAudSvc.exe
c:\program files\AVG\AVG9\avgcsrvx.exe
c:\program files\Diskeeper Corporation\Diskeeper\DkService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\wdfmgr.exe
c:\program files\AVG\AVG9\avgnsx.exe
c:\program files\AVG\AVG9\avgcsrvx.exe
c:\program files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
c:\program files\n52te\n52teTra.exe
.
**************************************************************************
.
Completion time: 2010-02-14 21:59:37 - machine was rebooted
ComboFix-quarantined-files.txt 2010-02-15 03:59

Pre-Run: 237,804,879,872 bytes free
Post-Run: 238,106,984,448 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

- - End Of File - - 961E1F23CBCAEE5C5CD901BF10EFD881

GooredFix by jpshortstuff (08.01.10.1)
Log created at 14:39 on 21/02/2010 (Administrator)
Firefox version 3.5.8 (en-US)

========== GooredScan ==========

Removing Orphan:
"{3f963a5b-e555-4543-90e2-c3908898db71}"="C:\Program Files\AVG\AVG9\Firefox" -> Success!
Removing Orphan:
"avg@igeared"="C:\Program Files\AVG\AVG9\Toolbar\Firefox\avg@igeared" -> Success!

========== GooredLog ==========

C:\Program Files\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd} [01:09 23/12/2009]
{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} [02:57 24/12/2009]

C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\1b1z3yu5.default\extensions\
{20a82645-c095-46ed-80e3-08825760534b} [19:33 26/12/2009]

[HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions]
"jqs@sun.com"="C:\Program Files\Java\jre6\lib\deploy\jqs\ff" [02:57 24/12/2009]
"{20a82645-c095-46ed-80e3-08825760534b}"="c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\" [17:14 26/12/2009]

-=E.O.F=-

KASPERSKY ONLINE SCANNER 7.0: scan report
Sunday, February 21, 2010
Operating system: Microsoft Windows XP Professional Service Pack 2 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Sunday, February 21, 2010 20:49:11
Records in database: 3610312
--------------------------------------------------------------------------------

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
C:\
D:\
F:\

Scan statistics:
Objects scanned: 78376
Threats found: 1
Infected objects found: 1
Suspicious objects found: 0
Scan duration: 06:42:30

File name / Threat / Threats count
C:\Qoobox\Quarantine\C\WINDOWS\system32\info.tmp.vir Infected: Trojan-Dropper.Win32.Agent.bnbs 1

Selected area has been scanned.

katana

2010-02-22, 11:41

WARNING
You must Copy/Paste (to a notepad file) or Print the information under Step 1 BEFORE YOU DO ANYTHING

----------------------------------------------------------------------------------------
Step 1

----------------------------------------- Copy or Print This Information -----------------------------------------------
If you are unable to connect to the internet after performing Step 3, please follow these instructions.

Navigate to C:\Windows\ERDNT\**-**-**** ---- ( **-**-**** will be todays date )
Double click on ERDNT.exe and then click OK
Now reboot your machine.

If you need to use these instructions, please do not continue with any other steps. Post back to the forum and let me know there was a problem.
----------------------------------------- Copy or Print This Information -----------------------------------------------

----------------------------------------------------------------------------------------
Step 2

Backup the Registry With ERUNT

Click Start >> All Programs >> ERUNT >> ERUNT
Click OK
Click OK
You will be informed that the folder does not exist, Click YES
Erunt will now backup your registry
Click OK

----------------------------------------------------------------------------------------
Step 3

LSP-Fix
Please read the warning above

Download LSP-Fix from the following link and save it to your desktop.
LSP-Fix Download Link (http://www.bleepingcomputer.com/files/lspfix.php)
Extract the zip folder to your desktop.
Open the new folder LspFix and double click LSPFix.exe
Put a tick in the "I know what I'm doing" box
Highlight n6UemyABwf.dll and click the >> button to move it to the Remove window
(if the file appears more than once repeat for each instance)
click on the finish button
click OK
Now reboot your PC

Make sure you can access the internet BEFORE continuing

----------------------------------------------------------------------------------------
Step 4

Custom CFScript

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

http://forums.spybot.info/showthread.php?p=360821#post360821
Collect::[4]
c:\windows\system32\n6UemyABwf.dll
c:\windows\system32\ledamine.dll
c:\windows\system32\mudagodu.dll
c:\windows\system32\nukajuge.dll
Driver::
zkeydwx
DDS::
Trusted Zone: buy-internetsecurity10.com
Trusted Zone: buy-is2010.com
Trusted Zone: is-software-download.com
Trusted Zone: is-software-download25.com
Trusted Zone: is10-soft-download.com
Trusted Zone: buy-internetsecurity10.com
Trusted Zone: buy-is2010.com

RegLock::
[HKEY_USERS\S-1-5-21-515967899-1580818891-682003330-500\Software\Microsoft\Internet Explorer\User Preferences]
Registry::
[HKEY_USERS\S-1-5-21-515967899-1580818891-682003330-500\Software\Microsoft\Internet Explorer\User Preferences]
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=-
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=-

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Internet Security 2010"=-
"Remote System Protection"=-

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"KernelFaultCheck"=-
"hakiziped"=-

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\uTorrent\\uTorrent.exe"=-
ADS::
Save this as CFScript.txt and place it on your desktop.

http://i51.photobucket.com/albums/f387/Katana_1970/CFScriptb.gif

Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
**Note**
When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture files to submit for analysis. Ensure you are connected to the internet and click OK on the message box.
Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

----------------------------------------------------------------------------------------
Logs/Information to Post in Reply
Please post the following logs/Information in your reply
Some of the logs I request will be quite large, You may need to split them over a couple of replies.

Combofix Log
A Fresh RSIT Log (only one will be produced)
How are things running now ?

Lothaar

2010-02-22, 16:44

No sign of any problems now. Have done multiple searches on google and no redirects when selecting search results.

ComboFix 10-02-21.02 - Administrator 02/22/2010 9:31.2.4 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2047.1434 [GMT -6:00]
Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Administrator\Desktop\CFScript.txt

file zipped: c:\windows\system32\n6UemyABwf.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\n6UemyABwf.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_zkeydwx

((((((((((((((((((((((((( Files Created from 2010-01-22 to 2010-02-22 )))))))))))))))))))))))))))))))
.

2010-02-20 21:47 . 2010-02-20 21:47 -------- d-----w- c:\documents and settings\Administrator\Application Data\AVG9
2010-02-20 21:43 . 2010-02-20 21:43 -------- d-----w- C:\rsit
2010-02-18 23:30 . 2010-02-18 23:30 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2010-02-16 10:01 . 2010-02-16 10:01 -------- d-----w- c:\documents and settings\Administrator\.exe
2010-02-15 23:33 . 2010-02-15 23:33 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2010-02-15 23:28 . 2010-02-15 23:28 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}
2010-02-15 23:28 . 2010-02-04 15:53 2954656 -c--a-w- c:\documents and settings\All Users\Application Data\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}\Ad-AwareInstaller.exe
2010-02-15 23:27 . 2010-02-15 23:30 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
2010-02-15 23:27 . 2010-02-15 23:28 -------- d-----w- c:\program files\Lavasoft
2010-02-15 23:13 . 2009-11-25 19:01 1230080 ----a-w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar\IEToolbar.dll
2010-02-15 05:50 . 2010-02-15 05:50 -------- d-----w- c:\program files\ERUNT
2010-02-15 05:31 . 2010-02-15 05:31 -------- d-----w- c:\program files\Trend Micro
2010-02-15 05:11 . 2010-02-15 05:11 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\AVG Security Toolbar
2010-02-15 05:08 . 2010-02-15 05:08 12464 ----a-w- c:\windows\system32\avgrsstx.dll
2010-02-15 05:08 . 2010-02-15 05:08 360584 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2010-02-15 05:08 . 2010-02-15 05:08 333192 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2010-02-15 05:08 . 2010-02-15 05:08 28424 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2010-02-15 05:08 . 2010-02-21 02:17 -------- d-----w- c:\windows\system32\drivers\Avg
2010-02-15 05:08 . 2010-02-15 23:13 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar
2010-02-15 03:49 . 2010-01-07 22:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-15 03:49 . 2010-02-15 04:32 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-02-15 03:49 . 2010-01-07 22:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-02-01 00:27 . 2010-02-01 00:27 1 ----a-w- c:\documents and settings\Administrator\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-02-01 00:27 . 2010-02-01 00:27 -------- d-----w- c:\documents and settings\Administrator\Application Data\OpenOffice.org
2010-02-01 00:23 . 2010-02-01 00:23 -------- d-----w- c:\program files\Guitar Pro 5
2010-01-23 22:37 . 2010-01-23 23:45 -------- d-----w- c:\documents and settings\Administrator\Application Data\Winamp
2010-01-23 22:37 . 2010-01-23 22:37 -------- d-----w- c:\program files\Winamp

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-22 07:30 . 2009-12-23 03:40 -------- d-----w- c:\program files\Steam
2010-02-22 04:11 . 2009-12-22 23:34 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-02-21 02:15 . 2009-12-24 02:42 -------- d-----w- c:\documents and settings\All Users\Application Data\avg9
2010-02-20 19:09 . 2009-12-22 23:54 -------- d-----w- c:\documents and settings\Administrator\Application Data\vlc
2010-02-18 23:30 . 2010-02-15 23:30 94712 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\PrivacyClean.dll
2010-02-18 23:30 . 2010-02-15 23:30 962496 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\CEAPI.dll
2010-02-18 23:30 . 2010-02-15 23:30 842992 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareAdmin.exe
2010-02-18 23:30 . 2010-02-15 23:30 1593320 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-Aware.exe
2010-02-15 05:42 . 2009-12-23 02:25 -------- d-----w- c:\documents and settings\Administrator\Application Data\uTorrent
2010-02-15 05:07 . 2009-12-24 02:42 -------- d-----w- c:\program files\AVG
2010-02-04 15:53 . 2010-02-15 23:30 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys
2010-02-01 00:26 . 2009-12-22 17:27 19168 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-01-23 22:37 . 2009-12-23 18:17 -------- d-----w- c:\program files\Winamp Detect
2010-01-18 02:36 . 2010-01-18 02:36 -------- d-----w- c:\program files\Psi
2010-01-10 08:30 . 2010-01-10 08:30 -------- d-----w- c:\program files\DIFX
2010-01-10 08:30 . 2010-01-10 08:30 -------- d-----w- c:\documents and settings\Administrator\Application Data\n52te
2010-01-10 08:30 . 2010-01-10 08:30 -------- d-----w- c:\program files\n52te
2010-01-10 08:30 . 2009-12-22 23:59 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-01-10 08:30 . 2010-01-10 08:30 -------- d-----w- c:\documents and settings\Administrator\Application Data\InstallShield
2010-01-08 04:00 . 2010-01-08 04:00 -------- d--h--r- c:\documents and settings\Administrator\Application Data\SecuROM
2010-01-08 04:00 . 2010-01-08 04:00 107888 ----a-w- c:\windows\system32\CmdLineExt.dll
2010-01-08 04:00 . 2010-01-08 04:00 -------- d-----w- c:\program files\GameSpy
2010-01-08 03:58 . 2010-01-08 03:58 22328 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2010-01-08 03:58 . 2010-01-08 03:58 22328 ----a-w- c:\documents and settings\Administrator\Application Data\PnkBstrK.sys
2010-01-08 03:58 . 2010-01-08 03:58 22328 ----a-w- c:\documents and settings\Administrator\Application Data\PnkBstrK.sys
2010-01-08 03:58 . 2010-01-08 03:58 103736 ----a-w- c:\windows\system32\PnkBstrB.exe
2010-01-08 03:58 . 2010-01-08 03:58 669184 ----a-w- c:\windows\system32\pbsvc.exe
2010-01-08 03:58 . 2010-01-08 03:58 66872 ----a-w- c:\windows\system32\PnkBstrA.exe
2010-01-07 03:12 . 2010-01-07 03:12 -------- d-----w- c:\documents and settings\Administrator\Application Data\Songbird2
2010-01-07 03:02 . 2009-12-25 19:31 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2010-01-02 02:20 . 2010-01-02 02:20 -------- d-----w- c:\program files\Saitek
2010-01-01 09:41 . 2010-01-01 09:41 1956528 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\install_flash_player_ax.exe
2010-01-01 09:11 . 2010-01-01 09:10 -------- d-----w- c:\program files\NVIDIA Corporation
2010-01-01 09:10 . 2010-01-01 09:10 -------- d-----w- c:\program files\AGEIA Technologies
2010-01-01 09:10 . 2009-12-22 17:49 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-12-31 16:14 . 2001-08-23 12:00 352640 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-26 17:13 . 2009-12-26 17:13 -------- d-----w- c:\program files\MSBuild
2009-12-26 17:13 . 2009-12-26 17:13 -------- d-----w- c:\program files\Reference Assemblies
2009-12-26 17:11 . 2009-12-26 17:11 -------- d-----w- c:\program files\MSXML 6.0
2009-12-26 05:05 . 2009-12-26 05:05 -------- d-----w- c:\documents and settings\Administrator\Application Data\Darkfall
2009-12-25 19:31 . 2009-12-25 19:31 1924200 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\install_flash_player.exe
2009-12-25 08:10 . 2009-12-25 08:10 -------- d-----w- c:\documents and settings\All Users\Application Data\Saitek
2009-12-24 02:57 . 2009-12-24 02:57 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-12-23 02:36 . 2009-12-23 02:36 444952 ----a-w- c:\windows\system32\wrap_oal.dll
2009-12-23 02:36 . 2009-12-23 02:36 109080 ----a-w- c:\windows\system32\OpenAL32.dll
2009-12-23 01:09 . 2009-12-23 01:09 0 ----a-w- c:\windows\nsreg.dat
2009-12-22 19:26 . 2009-12-22 19:26 315392 ----a-w- c:\windows\HideWin.exe
2009-12-22 19:04 . 2009-12-22 17:04 86327 ----a-w- c:\windows\PCHEALTH\HELPCTR\OfflineCache\index.dat
2009-12-22 17:01 . 2009-12-22 17:01 21640 ----a-w- c:\windows\system32\emptyregdb.dat
2009-12-21 19:14 . 2001-08-23 12:00 916480 ------w- c:\windows\system32\wininet.dll
2009-12-21 04:30 . 2010-01-07 03:13 274432 ----a-w- c:\documents and settings\Administrator\Application Data\Songbird2\Profiles\445hf58q.default\extensions\windowsmedia@songbirdnest.com\platform\WINNT_x86-msvc\components\sbWindowsMediacore.dll
2009-12-21 04:30 . 2010-01-07 03:13 106496 ----a-w- c:\documents and settings\Administrator\Application Data\Songbird2\Profiles\445hf58q.default\extensions\quicktime@songbirdnest.com\platform\WINNT_x86-msvc\components\sbQuickTimeMediacore.dll
2009-12-16 12:58 . 2009-12-22 17:01 343040 ----a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:35 . 2001-08-23 12:00 33280 ----a-w- c:\windows\system32\csrsrv.dll
2009-12-08 18:53 . 2001-08-23 12:00 2136064 ------w- c:\windows\system32\ntoskrnl.exe
2009-12-08 18:19 . 2001-08-17 13:48 2015744 ------w- c:\windows\system32\ntkrnlpa.exe
2009-12-04 14:41 . 2001-08-23 12:00 453760 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2009-12-02 08:28 . 2009-12-02 08:28 1561600 ----a-w- c:\windows\ElectricSheep_2_7b21.scr
2009-11-27 17:33 . 2001-08-23 12:00 1291264 ----a-w- c:\windows\system32\quartz.dll
2009-11-27 17:33 . 2001-08-17 22:36 17920 ----a-w- c:\windows\system32\msyuv.dll
2009-11-27 16:37 . 2001-08-23 12:00 84992 ----a-w- c:\windows\system32\avifil32.dll
2009-11-27 16:37 . 2001-08-23 12:00 28672 ----a-w- c:\windows\system32\msvidc32.dll
2009-11-27 16:37 . 2001-08-23 12:00 11264 ----a-w- c:\windows\system32\msrle32.dll
2009-11-27 16:37 . 2001-08-17 22:36 8704 ----a-w- c:\windows\system32\tsbyuv.dll
2009-11-27 16:37 . 2001-08-17 22:36 48128 ----a-w- c:\windows\system32\iyuv_32.dll
2009-11-26 08:06 . 2009-11-26 08:06 9820160 ----a-w- c:\windows\avcodec-52.dll
2009-11-26 08:06 . 2009-11-26 08:06 791040 ----a-w- c:\windows\avformat-52.dll
2009-11-26 08:06 . 2009-11-26 08:06 77312 ----a-w- c:\windows\avutil-50.dll
2009-11-26 08:06 . 2009-11-26 08:06 221696 ----a-w- c:\windows\swscale-0.dll
.

((((((((((((((((((((((((((((( SnapShot@2010-02-15_03.58.04 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-07-29 12:07 . 2008-07-29 12:07 80896 c:\windows\WinSxS\x86_Microsoft.VC90.DebugMFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_c94a3a24\mfcm90ud.dll
+ 2008-07-29 12:07 . 2008-07-29 12:07 80896 c:\windows\WinSxS\x86_Microsoft.VC90.DebugMFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_c94a3a24\mfcm90d.dll
+ 2010-02-22 15:36 . 2010-02-22 15:36 16384 c:\windows\Temp\Perflib_Perfdata_2a8.dat
+ 2010-02-22 15:36 . 2010-02-22 15:36 16384 c:\windows\Temp\Perflib_Perfdata_258.dat
+ 2010-02-15 08:05 . 2004-08-04 05:08 24960 c:\windows\system32\ReinstallBackups\0020\DriverFiles\i386\hidparse.sys
+ 2010-02-15 08:05 . 2004-08-04 05:08 36224 c:\windows\system32\ReinstallBackups\0020\DriverFiles\i386\hidclass.sys
+ 2010-02-15 08:05 . 2004-08-04 06:56 20992 c:\windows\system32\ReinstallBackups\0020\DriverFiles\i386\hid.dll
+ 2010-02-15 23:30 . 2010-02-04 15:53 64288 c:\windows\system32\DRVSTORE\lbd_B425E86B28F27CC7F4A0CAF275F9F2789F3C6909\Lbd.sys
+ 2010-02-15 23:30 . 2010-02-15 23:30 95024 c:\windows\system32\drivers\SBREDrv.sys
- 2009-12-22 17:05 . 2009-12-22 19:22 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2009-12-22 17:05 . 2010-02-15 23:33 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2009-12-22 17:05 . 2009-12-22 19:22 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2009-12-22 17:05 . 2010-02-15 23:33 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2010-02-15 23:33 . 2010-02-15 23:33 16384 c:\windows\system32\config\systemprofile\IETldCache\index.dat
- 2009-12-22 17:05 . 2009-12-22 19:22 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2010-02-15 23:33 . 2010-02-15 23:33 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2010-02-15 23:28 . 2010-02-15 23:28 29926 c:\windows\Installer\{338F08AB-C262-42C7-B000-34DE1A475273}\_6FEFF9B68218417F98F549.exe
+ 2010-02-15 08:05 . 2001-08-17 20:02 9600 c:\windows\system32\ReinstallBackups\0020\DriverFiles\i386\hidusb.sys
+ 2008-07-29 14:05 . 2008-07-29 14:05 875520 c:\windows\WinSxS\x86_Microsoft.VC90.DebugCRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_f863c71f\msvcp90d.dll
+ 2008-07-29 09:54 . 2008-07-29 09:54 312832 c:\windows\WinSxS\x86_Microsoft.VC90.DebugCRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_f863c71f\msvcm90d.dll
+ 2009-07-12 06:02 . 2009-07-12 06:02 653120 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcr90.dll
+ 2009-07-12 06:02 . 2009-07-12 06:02 569664 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcp90.dll
+ 2009-07-12 06:05 . 2009-07-12 06:05 225280 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcm90.dll
+ 2010-02-15 08:06 . 2010-02-15 08:06 649216 c:\windows\Installer\845e0.msi
+ 2010-02-15 23:28 . 2010-02-15 23:28 167424 c:\windows\Installer\35bdac3.msi
+ 2010-02-15 23:27 . 2010-02-15 23:27 236032 c:\windows\Installer\35bdab3.msi
+ 2010-02-15 08:06 . 2010-02-15 08:06 237568 c:\windows\Installer\{49480197-4A67-4EAB-AD44-001862FCEEB7}\Profiler.exe
- 2010-01-02 02:20 . 2010-01-02 02:20 237568 c:\windows\Installer\{49480197-4A67-4EAB-AD44-001862FCEEB7}\Profiler.exe
- 2010-01-02 02:20 . 2010-01-02 02:20 110592 c:\windows\Installer\{49480197-4A67-4EAB-AD44-001862FCEEB7}\ProfileEditor.exe
+ 2010-02-15 08:06 . 2010-02-15 08:06 110592 c:\windows\Installer\{49480197-4A67-4EAB-AD44-001862FCEEB7}\ProfileEditor.exe
+ 2010-02-22 15:19 . 2010-02-22 15:19 184320 c:\windows\ERDNT\2-22-2010\Users\00000002\UsrClass.dat
+ 2010-02-22 15:19 . 2005-10-20 18:02 163328 c:\windows\ERDNT\2-22-2010\ERDNT.EXE
+ 2010-02-15 05:51 . 2010-02-15 05:51 184320 c:\windows\ERDNT\2-14-2010\Users\00000002\UsrClass.dat
+ 2010-02-15 05:51 . 2005-10-20 18:02 163328 c:\windows\ERDNT\2-14-2010\ERDNT.EXE
+ 2008-07-29 14:05 . 2008-07-29 14:05 5982720 c:\windows\WinSxS\x86_Microsoft.VC90.DebugMFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_c94a3a24\mfc90ud.dll
+ 2008-07-29 14:05 . 2008-07-29 14:05 5937144 c:\windows\WinSxS\x86_Microsoft.VC90.DebugMFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_c94a3a24\mfc90d.dll
+ 2008-07-29 14:05 . 2008-07-29 14:05 1180672 c:\windows\WinSxS\x86_Microsoft.VC90.DebugCRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_f863c71f\msvcr90d.dll
+ 2010-02-15 23:28 . 2010-02-15 23:28 1859072 c:\windows\Installer\35bdabd.msi
+ 2010-02-22 15:19 . 2010-02-22 15:19 6557696 c:\windows\ERDNT\2-22-2010\Users\00000001\NTUSER.DAT
+ 2010-02-15 05:51 . 2010-02-15 05:51 6557696 c:\windows\ERDNT\2-14-2010\Users\00000001\NTUSER.DAT
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2009-06-17 55824]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-11-21 12669544]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-11-21 110184]
"Jomantha"="c:\program files\n52te\n52teHid.exe" [2008-06-13 159744]
"ProfilerU"="c:\program files\Saitek\SD6\Software\ProfilerU.exe" [2009-06-03 237568]
"SaiMfd"="c:\program files\Saitek\SD6\Software\SaiMfd.exe" [2009-06-03 131072]

c:\documents and settings\Administrator\Start Menu\Programs\Startup\
OpenOffice.org 3.1.lnk.disabled [2010-1-31 864]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2009-12-22 813584]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2010-02-15 05:08 12464 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2009-07-20 18:28 72208 ----a-w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"Alcmtr"=ALCMTR.EXE
"NvCplDaemon"=RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
"NvMediaCenter"=RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
"NVRaidService"=c:\windows\System32\nvraidservice.exe
"nwiz"=nwiz.exe /installquiet
"RTHDCPL"=RTHDCPL.EXE
"SkyTel"=SkyTel.EXE
"CTxfiHlp"=CTXFIHLP.EXE
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe"
"WinampAgent"="c:\program files\Winamp\winampa.exe"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableNotifications"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Steam\\Steam.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\arma 2\\arma2.exe"=
"c:\\Program Files\\Darkfall US\\Lobby.exe"=
"c:\\Program Files\\CCP\\EVE\\bin\\ExeFile.exe"=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\crysis\\Bin32\\Crysis.exe"=
"c:\\Program Files\\Psi\\Psi.exe"=
"c:\\Program Files\\Diskeeper Corporation\\Diskeeper\\DkService.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\left 4 dead 2\\left4dead2.exe"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2/15/2010 5:30 PM 64288]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2/14/2010 11:08 PM 333192]
R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2/14/2010 11:08 PM 360584]
R2 cpuz132;cpuz132;c:\windows\system32\drivers\cpuz132_x32.sys [12/22/2009 9:38 PM 12672]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2/4/2010 9:52 AM 1229232]
R2 LBeepKE;LBeepKE;c:\windows\system32\drivers\LBeepKE.sys [12/22/2009 9:43 PM 10384]
R3 CT20XUT.SYS;CT20XUT.SYS;c:\windows\system32\drivers\CT20XUT.sys [6/4/2009 2:46 AM 171032]
R3 CTEXFIFX.SYS;CTEXFIFX.SYS;c:\windows\system32\drivers\CTEXFIFX.sys [6/4/2009 2:46 AM 1324056]
R3 CTHWIUT.SYS;CTHWIUT.SYS;c:\windows\system32\drivers\CTHWIUT.sys [6/4/2009 2:46 AM 72728]
R3 DKRtWrt;DKRtWrt;c:\windows\system32\drivers\DKRtWrt.sys [12/23/2009 12:13 AM 45232]
R3 JmtFltr;n52te;c:\windows\system32\drivers\JmtFltr.sys [1/10/2010 2:30 AM 48896]
R3 SaiH0255;SaiH0255;c:\windows\system32\drivers\SaiH0255.sys [5/1/2007 4:11 PM 132232]
S2 avg9wd;AVG Free WatchDog;"c:\program files\AVG\AVG9\avgwdsvc.exe" --> c:\program files\AVG\AVG9\avgwdsvc.exe [?]
S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [12/22/2009 8:37 PM 79360]
S3 CT20XUT;CT20XUT;c:\windows\system32\drivers\CT20XUT.sys [6/4/2009 2:46 AM 171032]
S3 CTEXFIFX;CTEXFIFX;c:\windows\system32\drivers\CTEXFIFX.sys [6/4/2009 2:46 AM 1324056]
S3 CTHWIUT;CTHWIUT;c:\windows\system32\drivers\CTHWIUT.sys [6/4/2009 2:46 AM 72728]
.
Contents of the 'Scheduled Tasks' folder

2010-02-22 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2010-02-04 23:30]
.
.
------- Supplementary Scan -------
.
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\1b1z3yu5.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - prefs.js: keyword.URL - hxxp://search.avg.com/dispatcher.aspx?i=40&tp=ab&q=
FF - plugin: c:\program files\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npwachk.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true.
- - - - ORPHANS REMOVED - - - -

URLSearchHooks-{A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)
BHO-{cc05b7a4-9374-466b-9638-a216255260a4} - (no file)
Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)

**************************************************************************
scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files:

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-515967899-1580818891-682003330-500\Software\SecuROM\License information*]
"datasecu"=hex:3a,a1,3f,6e,a2,33,a9,89,f6,06,11,1a,cd,d4,f7,1b,c0,75,f1,de,59,
a1,99,d7,ea,85,c4,f6,58,e6,1a,39,43,5d,b8,8f,cc,11,c1,4f,83,5a,34,3e,0e,cd,\
"rkeysecu"=hex:7d,40,10,cb,c7,39,e0,67,0a,69,a8,47,07,da,5b,5c
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(744)
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
c:\program files\common files\logishrd\bluetooth\LBTServ.dll

- - - - - - - > 'explorer.exe'(1680)
c:\windows\system32\WININET.dll
c:\program files\Logitech\SetPoint\GameHook.dll
c:\program files\Logitech\SetPoint\lgscroll.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\nvsvc32.exe
c:\program files\Creative\Shared Files\CTAudSvc.exe
c:\program files\Diskeeper Corporation\Diskeeper\DkService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\PnkBstrA.exe
c:\program files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
c:\windows\system32\wdfmgr.exe
c:\windows\System32\wbem\unsecapp.exe
c:\windows\system32\wscntfy.exe
c:\program files\n52te\n52teTra.exe
c:\program files\Lavasoft\Ad-Aware\AAWTray.exe
.
**************************************************************************
.
Completion time: 2010-02-22 09:37:47 - machine was rebooted
ComboFix-quarantined-files.txt 2010-02-22 15:37

Pre-Run: 238,237,347,840 bytes free
Post-Run: 238,835,396,608 bytes free

- - End Of File - - EBFDF129C35DD3F0B499014DC4AE18BD

Logfile of random's system information tool 1.06 (written by random/random)
Run by Administrator at 2010-02-22 09:40:56
Microsoft Windows XP Professional Service Pack 2
System drive C: has 228 GB (80%) free of 286 GB
Total RAM: 2047 MB (68% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:41:03 AM, on 2/22/2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Creative\Shared Files\CTAudSvc.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\ComboFix\CF30488.cfxxe
C:\Program Files\n52te\n52teHid.exe
C:\Program Files\Saitek\SD6\Software\ProfilerU.exe
C:\Program Files\Saitek\SD6\Software\SaiMfd.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\ComboFix\mbr.cfxxe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\n52te\n52teTra.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Administrator\Desktop\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Administrator.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Jomantha] C:\Program Files\n52te\n52teHid.exe
O4 - HKLM\..\Run: [ProfilerU] C:\Program Files\Saitek\SD6\Software\ProfilerU.exe
O4 - HKLM\..\Run: [SaiMfd] C:\Program Files\Saitek\SD6\Software\SaiMfd.exe
O4 - Startup: OpenOffice.org 3.1.lnk.disabled
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://ccfiles.creative.com/Web/softwareupdate/su2/ocx/15111/CTPID.cab
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: AVG Free WatchDog (avg9wd) - Unknown owner - C:\Program Files\AVG\AVG9\avgwdsvc.exe (file missing)
O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTAudSvc.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

--
End of file - 4269 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job

======Registry dump======

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Kernel and Hardware Abstraction Layer"=C:\WINDOWS\KHALMNPR.EXE [2009-06-17 55824]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2009-11-20 12669544]
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2009-11-20 110184]
"Jomantha"=C:\Program Files\n52te\n52teHid.exe [2008-06-13 159744]
"ProfilerU"=C:\Program Files\Saitek\SD6\Software\ProfilerU.exe [2009-06-03 237568]
"SaiMfd"=C:\Program Files\Saitek\SD6\Software\SaiMfd.exe [2009-06-03 131072]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe

C:\Documents and Settings\Administrator\Start Menu\Programs\Startup
OpenOffice.org 3.1.lnk.disabled - C:\Program Files\OpenOffice.org 3\program\quickstart.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\avgrsstarter]
C:\WINDOWS\system32\avgrsstx.dll [2010-02-14 12464]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\LBTWlgn]
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll [2009-07-20 72208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 239496]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Lavasoft Ad-Aware Service]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WdfLoadGroup]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Steam\Steam.exe"="C:\Program Files\Steam\Steam.exe:*:Enabled:Steam"
"C:\Program Files\Steam\steamapps\common\arma 2\arma2.exe"="C:\Program Files\Steam\steamapps\common\arma 2\arma2.exe:*:Enabled:ARMA 2"
"C:\Program Files\Darkfall US\Lobby.exe"="C:\Program Files\Darkfall US\Lobby.exe:*:Enabled:Lobby"
"C:\Program Files\CCP\EVE\bin\ExeFile.exe"="C:\Program Files\CCP\EVE\bin\ExeFile.exe:*:Enabled:CCP ExeFile"
"C:\Program Files\Ventrilo\Ventrilo.exe"="C:\Program Files\Ventrilo\Ventrilo.exe:*:Enabled:Ventrilo.exe"
"C:\WINDOWS\system32\PnkBstrA.exe"="C:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA"
"C:\WINDOWS\system32\PnkBstrB.exe"="C:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB"
"C:\Program Files\Steam\steamapps\common\crysis\Bin32\Crysis.exe"="C:\Program Files\Steam\steamapps\common\crysis\Bin32\Crysis.exe:*:Enabled:Crysis"
"C:\Program Files\Psi\Psi.exe"="C:\Program Files\Psi\Psi.exe:*:Enabled:Psi"
"C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe"="C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe:*:Enabled:DkService"
"C:\Program Files\Steam\steamapps\common\left 4 dead 2\left4dead2.exe"="C:\Program Files\Steam\steamapps\common\left 4 dead 2\left4dead2.exe:*:Enabled:Left 4 Dead 2"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

======List of files/folders created in the last 1 months======

2010-02-22 09:37:47 ----A---- C:\ComboFix.txt
2010-02-22 09:31:20 ----D---- C:\ComboFix
2010-02-20 15:47:01 ----D---- C:\Documents and Settings\Administrator\Application Data\AVG9
2010-02-20 15:43:42 ----D---- C:\rsit
2010-02-15 17:28:17 ----HDC---- C:\Documents and Settings\All Users\Application Data\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}
2010-02-15 17:27:50 ----D---- C:\Program Files\Lavasoft
2010-02-15 17:27:50 ----D---- C:\Documents and Settings\All Users\Application Data\Lavasoft
2010-02-14 23:50:52 ----D---- C:\Program Files\ERUNT
2010-02-14 23:31:40 ----D---- C:\Program Files\Trend Micro
2010-02-14 23:08:09 ----A---- C:\WINDOWS\system32\avgrsstx.dll
2010-02-14 23:08:02 ----D---- C:\Documents and Settings\All Users\Application Data\AVG Security Toolbar
2010-02-14 21:53:17 ----A---- C:\Boot.bak
2010-02-14 21:53:14 ----RASHD---- C:\cmdcons
2010-02-14 21:52:19 ----A---- C:\WINDOWS\zip.exe
2010-02-14 21:52:19 ----A---- C:\WINDOWS\SWXCACLS.exe
2010-02-14 21:52:19 ----A---- C:\WINDOWS\SWSC.exe
2010-02-14 21:52:19 ----A---- C:\WINDOWS\SWREG.exe
2010-02-14 21:52:19 ----A---- C:\WINDOWS\sed.exe
2010-02-14 21:52:19 ----A---- C:\WINDOWS\PEV.exe
2010-02-14 21:52:19 ----A---- C:\WINDOWS\NIRCMD.exe
2010-02-14 21:52:19 ----A---- C:\WINDOWS\MBR.exe
2010-02-14 21:52:19 ----A---- C:\WINDOWS\grep.exe
2010-02-14 21:52:15 ----D---- C:\WINDOWS\ERDNT
2010-02-14 21:51:09 ----D---- C:\Qoobox
2010-02-14 21:49:12 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2010-02-14 21:16:12 ----A---- C:\WINDOWS\wininit.ini
2010-02-09 16:50:37 ----HDC---- C:\WINDOWS\$NtUninstallKB978262$
2010-02-09 16:50:32 ----HDC---- C:\WINDOWS\$NtUninstallKB971468$
2010-02-09 16:49:17 ----HDC---- C:\WINDOWS\$NtUninstallKB978037$
2010-02-09 16:49:13 ----HDC---- C:\WINDOWS\$NtUninstallKB975713$
2010-02-09 16:49:08 ----HDC---- C:\WINDOWS\$NtUninstallKB978251$
2010-02-09 16:49:04 ----HDC---- C:\WINDOWS\$NtUninstallKB975560$
2010-02-09 16:48:57 ----HDC---- C:\WINDOWS\$NtUninstallKB977914$
2010-02-09 16:48:50 ----HDC---- C:\WINDOWS\$NtUninstallKB978706$
2010-02-09 16:48:40 ----HDC---- C:\WINDOWS\$NtUninstallKB977165$
2010-01-31 18:27:19 ----D---- C:\Documents and Settings\Administrator\Application Data\OpenOffice.org
2010-01-31 18:23:04 ----D---- C:\Program Files\Guitar Pro 5
2010-01-23 16:37:10 ----D---- C:\Program Files\Winamp
2010-01-23 16:37:10 ----D---- C:\Documents and Settings\Administrator\Application Data\Winamp

======List of files/folders modified in the last 1 months======

2010-02-22 09:38:56 ----D---- C:\Program Files\Mozilla Firefox
2010-02-22 09:37:49 ----D---- C:\WINDOWS\Temp
2010-02-22 09:37:49 ----D---- C:\WINDOWS\system32\drivers
2010-02-22 09:36:48 ----D---- C:\WINDOWS\system32\CatRoot2
2010-02-22 09:36:45 ----SD---- C:\WINDOWS\Tasks
2010-02-22 09:36:08 ----D---- C:\WINDOWS
2010-02-22 09:36:08 ----A---- C:\WINDOWS\system.ini
2010-02-22 09:34:32 ----D---- C:\WINDOWS\system32\config
2010-02-22 09:34:13 ----D---- C:\WINDOWS\system32
2010-02-22 09:33:12 ----D---- C:\WINDOWS\AppPatch
2010-02-22 09:33:07 ----D---- C:\Program Files\Common Files
2010-02-22 09:31:27 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-02-22 09:30:12 ----D---- C:\WINDOWS\Prefetch
2010-02-22 01:30:49 ----D---- C:\Program Files\Steam
2010-02-21 22:11:28 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2010-02-21 14:46:31 ----SHD---- C:\WINDOWS\CSC
2010-02-20 20:16:34 ----SD---- C:\Documents and Settings\Administrator\Application Data\Microsoft
2010-02-20 20:15:44 ----D---- C:\Documents and Settings\All Users\Application Data\avg9
2010-02-20 13:09:12 ----D---- C:\Documents and Settings\Administrator\Application Data\vlc
2010-02-15 17:30:51 ----HD---- C:\WINDOWS\inf
2010-02-15 17:30:49 ----DC---- C:\WINDOWS\system32\DRVSTORE
2010-02-15 17:28:22 ----SHD---- C:\WINDOWS\Installer
2010-02-15 17:28:22 ----D---- C:\WINDOWS\WinSxS
2010-02-15 17:27:50 ----RD---- C:\Program Files
2010-02-15 02:05:13 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-02-15 02:05:04 ----D---- C:\WINDOWS\system32\ReinstallBackups
2010-02-15 01:59:04 ----SHD---- C:\System Volume Information
2010-02-15 01:59:04 ----D---- C:\WINDOWS\system32\Restore
2010-02-14 23:42:05 ----D---- C:\Documents and Settings\Administrator\Application Data\uTorrent
2010-02-14 23:07:59 ----D---- C:\Program Files\AVG
2010-02-14 22:29:17 ----HDC---- C:\WINDOWS\$NtUninstallKB971557$
2010-02-14 21:53:17 ----RASH---- C:\boot.ini
2010-02-14 21:09:16 ----D---- C:\Program Files\Internet Explorer
2010-02-14 19:51:43 ----D---- C:\WINDOWS\Debug
2010-02-14 19:51:42 ----D---- C:\WINDOWS\Minidump
2010-02-09 16:50:36 ----HD---- C:\WINDOWS\$hf_mig$
2010-02-07 00:12:18 ----D---- C:\WINDOWS\Sun
2010-01-31 18:23:05 ----RSD---- C:\WINDOWS\Fonts
2010-01-23 16:37:17 ----D---- C:\Program Files\Winamp Detect

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AvgLdx86;AVG Free AVI Loader Driver x86; C:\WINDOWS\System32\Drivers\avgldx86.sys [2010-02-14 333192]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86; C:\WINDOWS\System32\Drivers\avgmfx86.sys [2010-02-14 28424]
R1 AvgTdiX;AVG Free Network Redirector; C:\WINDOWS\System32\Drivers\avgtdix.sys [2010-02-14 360584]
R1 intelppm;Intel Processor Driver; C:\WINDOWS\System32\DRIVERS\intelppm.sys [2004-08-03 36096]
R1 kbdhid;Keyboard HID Driver; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2004-08-03 14848]
R1 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2001-08-23 12032]
R2 cpuz132;cpuz132; \??\C:\WINDOWS\system32\drivers\cpuz132_x32.sys []
R2 LBeepKE;LBeepKE; C:\WINDOWS\System32\Drivers\LBeepKE.sys [2009-06-17 10384]
R3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\System32\DRIVERS\arp1394.sys [2004-08-03 60800]
R3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
R3 CT20XUT.SYS;CT20XUT.SYS; C:\WINDOWS\System32\drivers\CT20XUT.SYS [2009-06-04 171032]
R3 ctac32k;Creative AC3 Software Decoder; C:\WINDOWS\system32\drivers\ctac32k.sys [2009-06-04 511000]
R3 ctaud2k;Creative Audio Driver (WDM); C:\WINDOWS\system32\drivers\ctaud2k.sys [2009-06-04 526232]
R3 CTEXFIFX.SYS;CTEXFIFX.SYS; C:\WINDOWS\System32\drivers\CTEXFIFX.SYS [2009-06-04 1324056]
R3 CTHWIUT.SYS;CTHWIUT.SYS; C:\WINDOWS\System32\drivers\CTHWIUT.SYS [2009-06-04 72728]
R3 ctprxy2k;Creative Proxy Driver; C:\WINDOWS\system32\drivers\ctprxy2k.sys [2009-06-04 14360]
R3 ctsfm2k;Creative SoundFont Management Device Driver; C:\WINDOWS\system32\drivers\ctsfm2k.sys [2009-06-04 158744]
R3 DKRtWrt;DKRtWrt; C:\WINDOWS\system32\DRIVERS\DKRtWrt.sys [2009-10-21 45232]
R3 emupia;E-mu Plug-in Architecture Driver; C:\WINDOWS\system32\drivers\emupia2k.sys [2009-06-04 95768]
R3 ha20x2k;Creative 20X HAL Driver; C:\WINDOWS\system32\drivers\ha20x2k.sys [2009-06-04 1177624]
R3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-08-17 9600]
R3 JmtFltr;n52te; C:\WINDOWS\System32\Drivers\JmtFltr.sys [2007-09-27 48896]
R3 LHidFilt;Logitech SetPoint KMDF HID Filter Driver; C:\WINDOWS\system32\DRIVERS\LHidFilt.Sys [2009-06-17 35472]
R3 LMouFilt;Logitech SetPoint KMDF Mouse Filter Driver; C:\WINDOWS\system32\DRIVERS\LMouFilt.Sys [2009-06-17 37392]
R3 mouhid;Mouse HID Driver; C:\WINDOWS\System32\DRIVERS\mouhid.sys [2001-08-17 12160]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\System32\DRIVERS\nic1394.sys [2004-08-03 61824]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2009-11-20 10235968]
R3 NVENETFD;NVIDIA nForce 10/100/1000 Mbps Ethernet ; C:\WINDOWS\System32\DRIVERS\NVENETFD.sys [2009-07-01 67328]
R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\System32\DRIVERS\nvnetbus.sys [2009-07-01 15872]
R3 ossrv;Creative OS Services Driver; C:\WINDOWS\system32\drivers\ctoss2k.sys [2009-06-04 130072]
R3 SaiH0255;SaiH0255; C:\WINDOWS\system32\DRIVERS\SaiH0255.sys [2007-05-01 132232]
R3 SaiMini;SaiMini; C:\WINDOWS\system32\DRIVERS\SaiMini.sys [2009-06-10 14080]
R3 SaiNtBus;SaiNtBus; C:\WINDOWS\system32\drivers\SaiBus.sys [2009-06-10 36992]
R3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-03 31616]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-03 26624]
R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2004-08-03 57600]
R3 usbohci;Microsoft USB Open Host Controller Miniport Driver; C:\WINDOWS\System32\DRIVERS\usbohci.sys [2004-08-03 17024]
R3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
R3 vhidmini;Virtual Hid Device; C:\WINDOWS\system32\DRIVERS\vhidmini.sys [2007-09-19 12672]
R3 Wdf01000;Wdf01000; C:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2006-11-02 492000]
S3 CT20XUT;CT20XUT; C:\WINDOWS\system32\drivers\CT20XUT.SYS [2009-06-04 171032]
S3 ctdvda2k;Creative DVD-Audio Device Driver; C:\WINDOWS\system32\drivers\ctdvda2k.sys [2009-06-04 347080]
S3 CTEXFIFX;CTEXFIFX; C:\WINDOWS\system32\drivers\CTEXFIFX.SYS [2009-06-04 1324056]
S3 CTHWIUT;CTHWIUT; C:\WINDOWS\system32\drivers\CTHWIUT.SYS [2009-06-04 72728]
S3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys []
S3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys []
S3 L8042Kbd;Logitech SetPoint Keyboard Driver; C:\WINDOWS\system32\DRIVERS\L8042Kbd.sys [2009-06-17 20240]
S3 mbr;mbr; \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\mbr.sys []
S3 usbaudio;USB Audio Driver (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2004-08-03 59264]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 CTAudSvcService;Creative Audio Service; C:\Program Files\Creative\Shared Files\CTAudSvc.exe [2009-02-23 307200]
R2 Diskeeper;Diskeeper; C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe [2009-10-23 1732960]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-12-23 153376]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service; C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe [2010-02-15 1229232]
R2 nvsvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2009-11-20 154216]
R2 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2010-01-07 66872]
R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2005-01-28 38912]
S2 avg9wd;AVG Free WatchDog; C:\Program Files\AVG\AVG9\avgwdsvc.exe []
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service; C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2009-12-22 79360]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 LBTServ;Logitech Bluetooth Service; C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe [2009-07-20 121360]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

katana

2010-02-22, 18:02

It looks like the file we need to look at didn't get submitted.
Please can you do the following ...

Please Submit a file

Please open LINK >>> THIS PAGE (http://www.bleepingcomputer.com/submit-malware.php?channel=4) <<<LINK in a new window.

In the box marked Link to topic where this file was requested: please put this text

http://forums.spybot.info/showthread.php?p=360889#post360889

Click the Browse button and navigate to C:\Qoobox\Quarantine\
There should be a zip file there called [4]-Submit_****-**-**_**.**.**.zip ( the * denote Date and time stamp )
Select this file and click Open

In the Largest box please put

File Requested By Katana
Failed Submit

Finally click SendFile

Please let me know when you have completed the above.

Lothaar

2010-02-22, 18:24

File submitted

katana

2010-02-22, 18:41

File submitted
Thanks for that :bigthumb:

Congratulations your logs look clean :)

Let's see if I can help you keep it that way

First lets tidy up

Uninstall Combofix
This will clear your System Volume Information restore points and remove all the infected files that were quarantined
Click START then RUN
Now type Combofix /Uninstall in the runbox and click OK. Note the space between the X and the /U, it needs to be there.
http://neoshine.co.uk/mina/Katana/CFU.gif

You can also delete any logs we have produced and any other tools we have downloaded.

----------------------------------------------------------- -----------------------------------------------------------

The following is some info to help you stay safe and clean.

You may already have some of the following programs, but I include the full list for the benefit of all the other people who will be reading this thread in the future.
( Vista users must ensure that any programs are Vista compatible BEFORE installing )

Online Scanners
I would recommend a scan at one or more of the following sites at least once a month.

http://www.pandasecurity.com/activescan
http://www.kaspersky.com/kos/eng/partner/71706/kavwebscan.html

!!! Make sure that all your programs are updated !!!
Secunia Software Inspector does all the work for you, .... see HERE (http://secunia.com/software_inspector/) for details

AntiSpyware
AntiSpyware is not the same thing as Antivirus.
Different AntiSpyware programs detect different things, so in this case it is recommended that you have more than one.
You should only have one running all the time, the other/s should be used "on demand" on a regular basis.
Most of the programs in this list have a free (for Home Users ) and paid versions,
it is worth paying for one and having "realtime" protection, unless you intend to do a manual scan often.
Spybot - Search & Destroy (http://www.safer-networking.org/) <<< A must have program It includes host protection and registry protection A hosts file is a bit like a phone book, it points to the actual numeric address (i.e. the IP address) from the human friendly name of a website. This feature can be used to block malicious websites
MalwareBytes Anti-malware (http://www.malwarebytes.org/mbam.php) <<< A New and effective program
a-squared Free (http://www.emsisoft.com/en/software/free/) <<< A good "realtime" or "on demand" scanner
superantispyware (http://www.superantispyware.com/) <<< A good "realtime" or "on demand" scanner

Prevention
These programs don't detect malware, they help stop it getting on your machine in the first place.
Each does a different job, so you can have more than one
Winpatrol (http://www.winpatrol.com) An excellent startup manager and then some !! Notifies you if programs are added to startup Allows delayed startup A must have addition
SpywareBlaster 4.0 (http://www.javacoolsoftware.com/spywareblaster.html) SpywareBlaster sets killbits in the registry to prevent known malicious activex controls from installing themselves on your computer.
SpywareGuard 2.2 (http://www.javacoolsoftware.com/spywareguard.html) SpywareGuard provides real-time protection against spyware. Not required if you have other "realtime" antispyware or Winpatrol
ZonedOut (http://www.funkytoad.com/index.php?option=com_content&view=article&id=15&Itemid=33) Formerly known as IE-SPYAD, adds a long list of sites and domains associated with known advertisers and marketers to the Restricted sites zone of Internet Explorer.
MVPS HOSTS (http://www.mvps.org/winhelp2002/hosts.zip) This little program packs a powerful punch as it blocks ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers. For information on how to download and install, please read this tutorial (http://www.mvps.org/winhelp2002/hosts.htm) by WinHelp2002. Not required if you are using other host file protections

Internet Browsers
Microsoft has worked hard to make IE.7 a more secure browser, unfortunately whilst it is still the leading browser of choice it will always be under attack from the bad guys.
Using a different web browser can help stop malware getting on your machine.

Make your Internet Explorer more secure - This can be done by following these simple instructions:
From within Internet Explorer click on the Tools menu and then click on Options.
Click once on the Security tab
Click once on the Internet icon so it becomes highlighted.
Click once on the Custom Level button.

Change the Download signed ActiveX controls to Prompt
Change the Download unsigned ActiveX controls to Disable
Change the Initialise and script ActiveX controls not marked as safe to Disable
Change the Installation of desktop items to Prompt
Change the Launching programs and files in an IFRAME to Prompt
Change the Navigate sub-frames across different domains to Prompt
When all these settings have been made, click on the OK button.
If it prompts you as to whether or not you want to save the settings, press the Yes button.

Next press the Apply button and then the OK to exit the Internet Properties page.

If you are still using IE6 then either update, or get one of the following.
FireFox (http://www.mozilla.com/en-US/firefox/) With many addons available that make customization easy this is a very popular choice NoScript and AdBlockPlus addons are essential
Opera (http://www.opera.com/) Another popular alternative
Netscape (http://browser.netscape.com/addons) Another popular alternative Also has Addons available

Cleaning Temporary Internet Files and Tracking Cookies
Temporary Internet Files are mainly the files that are downloaded when you open a web page.
Unfortunately, if the site you visit is of a dubious nature or has been hacked, they can also be an entry point for malware.
It is a good idea to empty the Temporary Internet Files folder on a regular basis.

Tracking Cookies are files that websites use to monitor which sites you visit and how often.
A lot of Antispyware scanners pick up these tracking cookies and flag them as unwanted.
CAUTION :- If you delete all your cookies you will lose any autologin information for sites that you visit, and will need your passwords

Both of these can be cleaned manually, but a quicker option is to use a program
ATF Cleaner (http://www.atribune.org/index.php?option=com_content&task=view&id=25&Itemid=25) Free and very simple to use
CCleaner (http://www.ccleaner.com/) Free and very flexible, you can chose which cookies to keep

Also PLEASE read this article.....So How Did I Get Infected In The First Place (http://forum.malwareremoval.com/viewtopic.php?t=4959)

The last and most important thing I can tell you is UPDATE.
If you don't update your security programs (Antivirus, Antispyware even Windows) then you are at risk.
Malware changes on a day to day basis. You should update every week at the very least.

If you follow this advice then (with a bit of luck) you will never have to hear from me again :D

If you could post back one more time to let me know everything is OK, then I can have this thread archived.

Happy surfing K'

Lothaar

2010-02-22, 18:53

Thank you for all your help. The info about the programs is great, I had some of them and now I will have few more. I will follow your final cleanup instructions.

Thank you again.