dns.flush Win32.agent.ieu + Win32.fraudload.edt

[saultodd]

I think ive got rid of them but i will like an expert to check.

Logfile of Trend Micro HijackThis v2.0.3 (BETA)
Scan saved at 10:05:13, on 22/04/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
C:\Program Files\BitDefender\BitDefender 2010\vsserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\BitDefender\BitDefender 2010\bdagent.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\BitDefender\BitDefender 2010\seccenter.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\TrendMicro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.co.uk
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = A Williamson
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2010\IEToolbar.dll
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2010\IEShow.exe"
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2010\bdagent.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O13 - Gopher Prefix:
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1269111174234
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1269111163734
O16 - DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} (SysInfo Class) - http://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_intel_4.1.66.0.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{7D00F085-7980-4BE2-B34E-24C824F3A634}: NameServer = 192.168.1.1,192.168.2.1
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 93.188.164.101,93.188.161.167
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 93.188.164.101,93.188.161.167
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 93.188.164.101,93.188.161.167
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: BitDefender Arrakis Server (Arrakis3) - BitDefender S.R.L. http://www.bitdefender.com - C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\arrakis3.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender S.R.L. - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S.R.L. - C:\Program Files\BitDefender\BitDefender 2010\vsserv.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe

--
End of file - 7240 bytes




DDS (Ver_10-03-17.01) - NTFSx86
Run by A Williamson at 10:06:17.85 on 22/04/2010
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18.1023.480 [GMT 1:00]

AV: BitDefender Antivirus *On-access scanning enabled* (Updated) {6C4BB89C-B0ED-4F41-A29C-4373888923BB}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
C:\Program Files\BitDefender\BitDefender 2010\vsserv.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\BitDefender\BitDefender 2010\bdagent.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\BitDefender\BitDefender 2010\seccenter.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\msiexec.exe
C:\Documents and Settings\A Williamson\Desktop\dds.com

============== Pseudo HJT Report ===============

uSearch Page = www.google.co.uk
uStart Page = hxxp://www.google.co.uk/
uWindow Title = A Williamson
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
TB: BitDefender Toolbar: {381ffde8-2394-4f90-b10d-fc6124a40f8c} - c:\program files\bitdefender\bitdefender 2010\IEToolbar.dll
uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe
uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"
mRun: [CTHelper] CTHELPER.EXE
mRun: [CTxfiHlp] CTXFIHLP.EXE
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [BitDefender Antiphishing Helper] "c:\program files\bitdefender\bitdefender 2010\IEShow.exe"
mRun: [BDAgent] "c:\program files\bitdefender\bitdefender 2010\bdagent.exe"
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
mPolicies-system: EnableLUA = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://download.microsoft.com/download/C/B/F/CBF23A2C-3E55-4664-BC5C-762780D79BA0/OGAControl.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1269111174234
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1269111163734
DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} - hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_intel_4.1.66.0.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: NameServer = 93.188.164.101,93.188.161.167
TCP: {7D00F085-7980-4BE2-B34E-24C824F3A634} = 192.168.1.1,192.168.2.1
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
Hosts: 127.0.0.1 www.spywareinfo.com

============= SERVICES / DRIVERS ===============

R3 bdfm;BDFM;c:\windows\system32\drivers\bdfm.sys [2009-12-7 153448]
S3 Arrakis3;BitDefender Arrakis Server;c:\program files\common files\bitdefender\bitdefender arrakis server\bin\arrakis3.exe [2009-10-19 183880]
S3 cpudrv;cpudrv;c:\program files\systemrequirementslab\cpudrv.sys [2009-12-18 11336]
S3 cpuz132;cpuz132;\??\c:\docume~1\awilli~1\locals~1\temp\cpuz132\cpuz132_x32.sys --> c:\docume~1\awilli~1\locals~1\temp\cpuz132\cpuz132_x32.sys [?]

=============== Created Last 30 ================

2010-04-22 09:04:04 0 d-----w- c:\program files\TrendMicro
2010-04-21 17:41:46 0 d-----w- c:\windows\system32\CatRoot2
2010-04-21 08:20:15 0 d-----w- c:\program files\SpywareBlaster
2010-04-20 22:08:48 204 ----a-w- c:\windows\system32\MRT.INI
2010-04-20 12:39:53 0 d-----w- c:\program files\Spybot - Search & Destroy
2010-04-20 12:39:53 0 d-----w- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
2010-04-13 14:32:43 0 d-----w- C:\spoolerlogs
2010-04-13 14:31:01 161792 ----a-w- c:\windows\Pmoxic.exe
2010-04-13 14:30:22 161792 ----a-w- c:\windows\Pmoxib.exe
2010-04-13 14:29:59 161792 ----a-w- c:\windows\Pmoxia.exe
2010-04-12 19:29:51 0 d-----w- c:\docume~1\awilli~1\applic~1\Office Genuine Advantage
2010-04-12 12:11:28 0 d-----w- c:\program files\No-IP
2010-04-12 10:17:32 26624 ----a-w- c:\windows\system32\VNCpm.dll
2010-04-12 10:17:20 4608 ----a-w- c:\windows\system32\drivers\vncmirror.sys
2010-04-12 10:17:20 20992 ----a-w- c:\windows\system32\vncmirror.dll
2010-04-12 10:17:14 0 d-----w- c:\program files\RealVNC
2010-04-08 17:58:15 0 d-----w- c:\docume~1\awilli~1\applic~1\BitDefender
2010-04-08 17:27:12 81408 ----a-w- c:\windows\system32\devcon_x64.exe
2010-04-08 17:27:11 0 d-----w- c:\program files\Driver Checker
2010-04-08 17:24:14 0 d-----w- c:\windows\system32\wbem\Repository
2010-04-08 16:41:19 53248 ----a-w- c:\windows\system32\CSVer.dll
2010-04-08 16:41:03 0 d-----w- C:\Intel
2010-04-08 16:21:15 0 d-----w- c:\program files\Intel Desktop Board Audio Driver
2010-04-08 16:16:48 0 d-----w- c:\program files\SystemRequirementsLab
2010-04-08 15:50:54 356352 ----a-w- c:\windows\system32\nvudisp.exe
2010-04-08 15:50:54 17737 ----a-w- c:\windows\system32\nvdisp.nvu
2010-04-08 15:50:54 163353 ----a-w- c:\windows\system32\nvapps.xml
2010-04-08 15:50:54 0 d-----w- c:\windows\nview
2010-04-08 15:50:40 0 d-----w- c:\windows\system32\ReinstallBackups
2010-04-08 15:50:30 356352 ----a-w- c:\windows\system32\NVUNINST.EXE
2010-04-08 15:50:11 0 d-----w- C:\NVIDIA
2010-04-08 14:33:03 306688 ----a-w- c:\windows\IsUninst.exe
2010-04-07 16:12:06 0 d-----w- c:\windows\SxsCaPendDel
2010-04-07 16:07:37 0 d-----w- c:\windows\system32\appmgmt
2010-04-07 15:45:11 850 ----a-w- c:\documents and settings\a williamson\Application DataProductTweaks.xml
2010-04-07 15:45:11 385 ----a-w- c:\documents and settings\a williamson\Application Datauser_gensett.xml
2010-04-07 15:45:11 376 ----a-w- c:\documents and settings\a williamson\Application Dataprivacy.xml

==================== Find3M ====================

2010-04-08 19:35:21 153448 ----a-w- c:\windows\system32\drivers\bdfm.sys
2010-04-08 19:35:21 106464 ----a-w- c:\windows\system32\drivers\bdhv.sys
2010-04-08 19:35:01 291352 ----a-w- c:\windows\system32\drivers\bdfsfltr.sys
2010-03-21 14:26:33 409600 ----a-w- c:\windows\system32\wrap_oal.dll
2010-03-21 14:26:33 114688 ----a-w- c:\windows\system32\OpenAL32.dll
2010-03-13 12:23:42 21640 ----a-w- c:\windows\system32\emptyregdb.dat
2010-03-10 06:15:52 420352 ----a-w- c:\windows\system32\vbscript.dll
2010-02-25 06:24:37 916480 ----a-w- c:\windows\system32\wininet.dll
2010-02-24 11:57:57 457216 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-02-12 10:03:03 293376 ------w- c:\windows\system32\browserchoice.exe
2010-02-12 04:27:58 100864 ----a-w- c:\windows\system32\6to4svc.dll
2010-01-28 17:09:36 182784 ----a-w- c:\windows\system32\Ncs2Setp.dll
2010-01-28 16:52:50 734328 ----a-w- c:\windows\system32\ncs2dmix.dll
2010-01-28 16:52:50 518264 ----a-w- c:\windows\system32\accesor.dll
2010-01-28 16:32:04 128120 ----a-w- c:\windows\system32\ncs2instutility.dll
2010-01-28 16:16:16 1718904 ----a-w- c:\windows\system32\ncscolib.dll
2010-01-27 12:52:26 256712 ----a-w- c:\windows\system32\Prounstl.exe

============= FINISH: 10:07:39.43 ===============

[saultodd]

ComboFix 10-04-21.01 - A Williamson 22/04/2010 10:23:51.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18.1023.718 [GMT 1:00]
Running from: c:\documents and settings\A Williamson\Desktop\ComboFix.exe
AV: BitDefender Antivirus *On-access scanning disabled* (Updated) {6C4BB89C-B0ED-4F41-A29C-4373888923BB}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\A Williamson\Application Data\chrtmp
c:\windows\Pmoxia.exe
c:\windows\Pmoxib.exe
c:\windows\Pmoxic.exe
c:\windows\system32\OGACheckControl.dll

.
((((((((((((((((((((((((( Files Created from 2010-03-22 to 2010-04-22 )))))))))))))))))))))))))))))))
.

2010-04-22 09:04 . 2010-04-22 09:04 388096 ----a-r- c:\documents and settings\A Williamson\Application Data\Microsoft\Installer\{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}\HiJackThis.exe
2010-04-22 09:04 . 2010-04-22 09:04 -------- d-----w- c:\program files\TrendMicro
2010-04-21 17:41 . 2010-04-22 09:23 -------- d-----w- c:\windows\system32\CatRoot2
2010-04-21 16:43 . 2010-04-21 16:47 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2010-04-21 08:20 . 2010-04-21 16:45 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-04-21 08:20 . 2010-04-21 08:28 -------- d-----w- c:\program files\SpywareBlaster
2010-04-20 12:39 . 2010-04-20 19:58 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-04-20 12:39 . 2010-04-20 12:40 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-04-13 14:32 . 2010-04-13 14:32 -------- d-----w- C:\spoolerlogs
2010-04-12 19:29 . 2010-04-12 19:29 -------- d-----w- c:\documents and settings\A Williamson\Application Data\Office Genuine Advantage
2010-04-12 12:11 . 2010-04-13 14:04 -------- d-----w- c:\program files\No-IP
2010-04-12 10:17 . 2009-07-24 23:21 26624 ----a-w- c:\windows\system32\VNCpm.dll
2010-04-12 10:17 . 2009-07-24 23:21 4608 ----a-w- c:\windows\system32\drivers\vncmirror.sys
2010-04-12 10:17 . 2009-07-24 23:21 20992 ----a-w- c:\windows\system32\vncmirror.dll
2010-04-12 10:17 . 2010-04-12 10:17 -------- d-----w- c:\program files\RealVNC
2010-04-08 17:58 . 2010-04-08 17:58 -------- d-----w- c:\documents and settings\A Williamson\Application Data\BitDefender
2010-04-08 17:27 . 2008-12-03 16:40 81408 ----a-w- c:\windows\system32\devcon_x64.exe
2010-04-08 17:27 . 2010-04-08 17:27 -------- d-----w- c:\program files\Driver Checker
2010-04-08 17:24 . 2010-04-08 17:24 -------- d-----w- c:\windows\system32\wbem\Repository
2010-04-08 16:41 . 2010-04-08 16:41 -------- dc----w- c:\windows\system32\DRVSTORE
2010-04-08 16:41 . 2009-12-14 11:33 53248 ----a-w- c:\windows\system32\CSVer.dll
2010-04-08 16:41 . 2010-04-08 16:41 -------- d-----w- C:\Intel
2010-04-08 16:32 . 2010-04-08 16:41 -------- d-----w- c:\program files\Intel
2010-04-08 16:21 . 2010-04-08 16:21 -------- d-----w- c:\program files\Intel Desktop Board Audio Driver
2010-04-08 16:16 . 2010-04-08 16:16 -------- d-----w- c:\program files\SystemRequirementsLab
2010-04-08 15:50 . 2010-04-08 15:50 -------- d-----w- c:\windows\nview
2010-04-08 15:50 . 2007-12-05 00:41 356352 ----a-w- c:\windows\system32\nvudisp.exe
2010-04-08 15:50 . 2007-12-05 01:53 356352 ----a-w- c:\windows\system32\NVUNINST.EXE
2010-04-08 15:50 . 2010-04-08 15:50 -------- d-----w- c:\program files\Common Files\InstallShield
2010-04-08 15:50 . 2010-04-08 15:50 -------- d-----w- C:\NVIDIA
2010-04-08 14:33 . 1998-10-29 15:45 306688 ----a-w- c:\windows\IsUninst.exe
2010-04-07 16:12 . 2010-04-07 16:15 -------- d-----w- c:\windows\SxsCaPendDel
2010-04-07 15:55 . 2010-04-07 16:06 -------- d-----w- c:\documents and settings\A Williamson\Local Settings\Application Data\ApplicationHistory

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-20 22:15 . 2010-03-20 20:56 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-04-08 19:35 . 2009-12-07 17:49 106464 ----a-w- c:\windows\system32\drivers\bdhv.sys
2010-04-08 19:35 . 2009-12-07 17:46 153448 ----a-w- c:\windows\system32\drivers\bdfm.sys
2010-04-08 19:35 . 2009-07-24 10:26 291352 ----a-w- c:\windows\system32\drivers\bdfsfltr.sys
2010-04-08 17:58 . 2010-03-21 14:26 -------- d-----w- c:\documents and settings\All Users\Application Data\BitDefender
2010-04-08 17:57 . 2010-03-21 14:24 -------- d-----w- c:\program files\Common Files\BitDefender
2010-04-07 16:04 . 2010-03-22 08:08 -------- d-----w- c:\program files\Windows Desktop Search
2010-03-22 08:29 . 2010-03-22 08:29 -------- d-----w- c:\program files\Microsoft Office Outlook Connector
2010-03-22 08:27 . 2010-03-22 08:13 -------- d-----w- c:\program files\Microsoft
2010-03-22 08:14 . 2010-03-22 08:14 -------- d-----w- c:\program files\Common Files\Windows Live
2010-03-21 14:26 . 2010-03-21 14:26 -------- d-----w- c:\program files\BitDefender
2010-03-21 14:26 . 2010-03-21 14:26 409600 ----a-w- c:\windows\system32\wrap_oal.dll
2010-03-21 14:26 . 2010-03-21 14:26 114688 ----a-w- c:\windows\system32\OpenAL32.dll
2010-03-21 14:26 . 2010-03-21 14:26 -------- d-----w- c:\documents and settings\A Williamson\Application Data\Creative
2010-03-21 09:33 . 2010-03-21 08:51 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2010-03-21 09:23 . 2010-03-20 19:41 68456 ----a-w- c:\documents and settings\A Williamson\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-03-20 23:12 . 2010-03-20 23:12 -------- d-----w- c:\documents and settings\All Users\Application Data\Office Genuine Advantage
2010-03-20 22:36 . 2010-03-20 21:32 -------- d-----w- c:\program files\Microsoft Works
2010-03-20 21:32 . 2010-03-20 18:03 -------- d-----w- c:\program files\MSBuild
2010-03-20 21:31 . 2010-03-20 21:31 -------- d-----w- c:\program files\Microsoft.NET
2010-03-20 21:29 . 2010-03-20 21:29 -------- d-----w- c:\program files\Microsoft Visual Studio 8
2010-03-20 19:59 . 2010-03-20 19:55 -------- d-----w- c:\program files\UnRar for Windows
2010-03-20 19:41 . 2010-03-20 19:41 -------- d-----w- c:\documents and settings\All Users\Application Data\Driver Whiz
2010-03-20 19:20 . 2010-03-13 12:25 -------- d-----w- c:\program files\Microsoft Silverlight
2010-03-20 19:19 . 2010-03-20 19:19 -------- d-----w- c:\program files\MSXML 4.0
2010-03-20 18:03 . 2010-03-20 18:03 -------- d-----w- c:\program files\Reference Assemblies
2010-03-13 12:47 . 2010-03-13 12:26 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-03-13 12:27 . 2010-03-13 12:27 -------- d-----w- c:\program files\microsoft frontpage
2010-03-13 12:25 . 2010-03-13 12:25 -------- d-----w- c:\program files\Windows Media Connect 2
2010-03-13 12:23 . 2010-03-13 12:23 21640 ----a-w- c:\windows\system32\emptyregdb.dat
2010-03-10 06:15 . 2008-06-25 17:19 420352 ----a-w- c:\windows\system32\vbscript.dll
2010-02-25 06:24 . 2008-06-23 16:01 916480 ----a-w- c:\windows\system32\wininet.dll
2010-02-24 11:57 . 2008-07-30 12:09 457216 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-02-12 10:03 . 2010-03-20 19:06 293376 ------w- c:\windows\system32\browserchoice.exe
2010-02-12 04:27 . 2008-04-14 12:00 100864 ----a-w- c:\windows\system32\6to4svc.dll
2010-02-11 11:36 . 2008-07-28 10:35 226880 ----a-w- c:\windows\system32\drivers\tcpip6.sys
2010-01-28 17:09 . 2010-01-28 17:09 182784 ----a-w- c:\windows\system32\Ncs2Setp.dll
2010-01-28 16:52 . 2010-01-28 16:52 734328 ----a-w- c:\windows\system32\ncs2dmix.dll
2010-01-28 16:52 . 2010-01-28 16:52 518264 ----a-w- c:\windows\system32\accesor.dll
2010-01-28 16:32 . 2010-01-28 16:32 128120 ----a-w- c:\windows\system32\ncs2instutility.dll
2010-01-28 16:16 . 2010-01-28 16:16 1718904 ----a-w- c:\windows\system32\ncscolib.dll
2010-01-27 12:52 . 2007-04-12 11:47 256712 ----a-w- c:\windows\system32\Prounstl.exe
.

------- Sigcheck -------

[-] 2008-04-25 . B5B1080D35974C0E718D64280761BCD5 . 182912 . . [5.1.2600.5588] . . c:\windows\system32\dllcache\ndis.sys
[-] 2008-04-25 . B5B1080D35974C0E718D64280761BCD5 . 182912 . . [5.1.2600.5588] . . c:\windows\system32\drivers\ndis.sys

[-] 2008-04-22 . A0857C97770034FD2AF17DC4014B5ABD . 576384 . . [5.1.2600.5585] . . c:\windows\system32\dllcache\ntfs.sys
[-] 2008-04-22 . A0857C97770034FD2AF17DC4014B5ABD . 576384 . . [5.1.2600.5585] . . c:\windows\system32\drivers\ntfs.sys

[-] 2008-07-28 . 367DE8E5F638C091F49273144274F629 . 361600 . . [5.1.2600.5649] . . c:\windows\system32\dllcache\tcpip.sys
[-] 2008-07-28 . 367DE8E5F638C091F49273144274F629 . 361600 . . [5.1.2600.5649] . . c:\windows\system32\drivers\tcpip.sys

[-] 2008-04-03 . 7E39A3EDC13B076E70FDB9A6F6D7A4B4 . 78336 . . [5.1.2600.5574] . . c:\windows\system32\browser.dll
[-] 2008-04-03 . 7E39A3EDC13B076E70FDB9A6F6D7A4B4 . 78336 . . [5.1.2600.5574] . . c:\windows\system32\dllcache\browser.dll

[-] 2009-02-09 . 9222562D44021B988B9F9F62207FB6F2 . 401408 . . [5.1.2600.5755] . . c:\windows\system32\rpcss.dll
[-] 2009-02-09 . 9222562D44021B988B9F9F62207FB6F2 . 401408 . . [5.1.2600.5755] . . c:\windows\system32\dllcache\rpcss.dll
[7] 2008-04-14 . 2589FE6015A316C0F5D5112B4DA7B509 . 399360 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB956572$\rpcss.dll

[-] 2009-02-06 . 020CEAAEDC8EB655B6506B8C70D53BB6 . 110592 . . [5.1.2600.5755] . . c:\windows\system32\services.exe
[-] 2009-02-06 . 020CEAAEDC8EB655B6506B8C70D53BB6 . 110592 . . [5.1.2600.5755] . . c:\windows\system32\dllcache\services.exe
[7] 2008-04-14 . 0E776ED5F7CC9F94299E70461B7B8185 . 108544 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB956572$\services.exe

[-] 2008-04-24 . D1BAC55BC35A0CA735AEA19F609F2B22 . 507904 . . [5.1.2600.5587] . . c:\windows\system32\winlogon.exe
[-] 2008-04-24 . D1BAC55BC35A0CA735AEA19F609F2B22 . 507904 . . [5.1.2600.5587] . . c:\windows\system32\dllcache\winlogon.exe

[-] 2008-07-07 20:23 . F17F6226BDC0CD5F0BEF0DAF84D29BEC . 253952 . . [2001.12.4414.706] . . c:\windows\system32\es.dll
[-] 2008-07-07 20:23 . F17F6226BDC0CD5F0BEF0DAF84D29BEC . 253952 . . [2001.12.4414.706] . . c:\windows\system32\dllcache\es.dll

[-] 2009-03-21 . DA11D9D6ECBDF0F93436A4B7C13F7BEC . 991744 . . [5.1.2600.5781] . . c:\windows\$hf_mig$\KB959426\SP3QFE\kernel32.dll
[-] 2009-03-21 . B921FB870C9AC0D509B2CCABBBBE95F3 . 989696 . . [5.1.2600.5781] . . c:\windows\system32\kernel32.dll
[-] 2009-03-21 . B921FB870C9AC0D509B2CCABBBBE95F3 . 989696 . . [5.1.2600.5781] . . c:\windows\system32\dllcache\kernel32.dll
[7] 2008-04-14 . C24B983D211C34DA8FCC1AC38477971D . 989696 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB959426$\kernel32.dll

[-] 2010-02-25 . 7054F6ADC9B670887659F1561603B0D0 . 5944832 . . [8.00.6001.18904] . . c:\windows\system32\mshtml.dll
[-] 2010-02-25 . 7054F6ADC9B670887659F1561603B0D0 . 5944832 . . [8.00.6001.18904] . . c:\windows\system32\dllcache\mshtml.dll
[-] 2010-02-25 . 974772C74DA7C7A8E7C813A9908A845F . 5946880 . . [8.00.6001.22995] . . c:\windows\$hf_mig$\KB980182-IE8\SP3QFE\mshtml.dll
[-] 2010-01-05 . 1673677DBD70142DB1294F1B6FC3323E . 3602944 . . [7.00.6000.21183] . . c:\windows\$hf_mig$\KB978207-IE7\SP3QFE\mshtml.dll
[-] 2009-12-21 . BE6EEBEF636773A8E7A82214E81C563A . 5942784 . . [8.00.6001.18876] . . c:\windows\ie8updates\KB980182-IE8\mshtml.dll
[-] 2009-12-21 . E6B64C6C729BBC38AB7CC92CE33F97A5 . 5945856 . . [8.00.6001.22967] . . c:\windows\$hf_mig$\KB978207-IE8\SP3QFE\mshtml.dll
[-] 2009-10-29 . C0F9AC6FAB2C788FFEE3E69585A0E93F . 5944320 . . [8.00.6001.22945] . . c:\windows\$hf_mig$\KB976325-IE8\SP3QFE\mshtml.dll
[-] 2009-10-29 . CBB1EF54B86EDB78649909DD1699E5CA . 5940736 . . [8.00.6001.18854] . . c:\windows\ie8updates\KB978207-IE8\mshtml.dll
[7] 2009-03-08 . D469A0EBA2EF5C6BEE8065B7E3196E5E . 5937152 . . [8.00.6001.18702] . . c:\windows\ie8updates\KB976325-IE8\mshtml.dll
[-] 2008-06-23 . 28B8231CA8D55FC85E027A57C90F5C88 . 3594240 . . [7.00.6000.20861] . . c:\windows\ie8\mshtml.dll

[-] 2008-07-28 . 290C1A30DEFC723BBE10910AC2D6F6D0 . 245248 . . [5.1.2600.5649] . . c:\windows\system32\mswsock.dll
[-] 2008-07-28 . 290C1A30DEFC723BBE10910AC2D6F6D0 . 245248 . . [5.1.2600.5649] . . c:\windows\system32\dllcache\mswsock.dll

[-] 2008-04-17 . 06CF9EEDB7E827205C6948C9DAF56974 . 407040 . . [5.1.2600.5582] . . c:\windows\system32\netlogon.dll
[-] 2008-04-17 . 06CF9EEDB7E827205C6948C9DAF56974 . 407040 . . [5.1.2600.5582] . . c:\windows\system32\dllcache\netlogon.dll

[-] 2010-02-17 . D41C3CBAD0E1C0728D1CDFD541F60CFA . 2189952 . . [5.1.2600.5938] . . c:\windows\SoftwareDistribution\Download\9d21500a4aa475547c4a2420fee1c623\SP3GDR\ntoskrnl.exe
[-] 2010-02-16 . 97E2BF68857818A4D142B872404DC41B . 2186880 . . [5.1.2600.3670] . . c:\windows\SoftwareDistribution\Download\9d21500a4aa475547c4a2420fee1c623\SP2QFE\ntoskrnl.exe
[-] 2010-02-16 . EBB75B113E74E90074382347B74D652B . 2181376 . . [5.1.2600.3670] . . c:\windows\SoftwareDistribution\Download\9d21500a4aa475547c4a2420fee1c623\SP2GDR\ntoskrnl.exe
[-] 2010-02-16 . E1F653A542449D54FA2D27463D99B6B6 . 2190080 . . [5.1.2600.5938] . . c:\windows\SoftwareDistribution\Download\9d21500a4aa475547c4a2420fee1c623\SP3QFE\ntoskrnl.exe
[-] 2009-12-09 . 05BE3D9A71972223AFF6A3C823BA51B1 . 2189312 . . [5.1.2600.5913] . . c:\windows\Driver Cache\i386\ntoskrnl.exe
[-] 2009-12-09 . 05BE3D9A71972223AFF6A3C823BA51B1 . 2189312 . . [5.1.2600.5913] . . c:\windows\system32\ntoskrnl.exe
[-] 2009-12-09 . 05BE3D9A71972223AFF6A3C823BA51B1 . 2189312 . . [5.1.2600.5913] . . c:\windows\system32\dllcache\ntoskrnl.exe
[-] 2009-02-07 . EFE8EACE83EAAD5849A7A548FB75B584 . 2189184 . . [5.1.2600.5755] . . c:\windows\$NtUninstallKB977165-v2$\ntoskrnl.exe
[-] 2008-04-23 . 459D68B36FCC8B6220730164C6FE81E5 . 2189184 . . [5.1.2600.5586] . . c:\windows\$NtUninstallKB956572$\ntoskrnl.exe

[-] 2008-08-06 . E2B32B10ACC5D97623275AAFB67E5F03 . 249856 . . [5.1.2600.5654] . . c:\windows\system32\tapisrv.dll
[-] 2008-08-06 . E2B32B10ACC5D97623275AAFB67E5F03 . 249856 . . [5.1.2600.5654] . . c:\windows\system32\dllcache\tapisrv.dll

[-] 2010-02-25 . 7A42CFED96CDA7F2FB1A26D1F9F65775 . 916480 . . [8.00.6001.18904] . . c:\windows\system32\wininet.dll
[-] 2010-02-25 . 7A42CFED96CDA7F2FB1A26D1F9F65775 . 916480 . . [8.00.6001.18904] . . c:\windows\system32\dllcache\wininet.dll
[-] 2010-02-25 . 4458D59F2B0369F4D3B137541D284041 . 919040 . . [8.00.6001.22995] . . c:\windows\$hf_mig$\KB980182-IE8\SP3QFE\wininet.dll
[-] 2010-01-05 . E7B99465DE2EDCF29784B7600BF6FAE8 . 841216 . . [7.00.6000.21183] . . c:\windows\$hf_mig$\KB978207-IE7\SP3QFE\wininet.dll
[-] 2009-12-21 . FF4241C74E0C0A5AFFFE05F584213ECB . 916480 . . [8.00.6001.18876] . . c:\windows\ie8updates\KB980182-IE8\wininet.dll
[-] 2009-12-21 . 5E1F666B8955FD77E65D65C4C4D882A3 . 916480 . . [8.00.6001.22967] . . c:\windows\$hf_mig$\KB978207-IE8\SP3QFE\wininet.dll
[-] 2009-10-29 . 6AF52998B90F72FF2325D84D90EDA1CC . 916480 . . [8.00.6001.22945] . . c:\windows\$hf_mig$\KB976325-IE8\SP3QFE\wininet.dll
[-] 2009-10-29 . 75240F6EDBCE7B85DF66874407D38A4F . 916480 . . [8.00.6001.18854] . . c:\windows\ie8updates\KB978207-IE8\wininet.dll
[7] 2009-03-08 . 6CE32F7778061CCC5814D5E0F282D369 . 914944 . . [8.00.6001.18702] . . c:\windows\ie8updates\KB976325-IE8\wininet.dll
[-] 2008-06-23 . C66402A06B83B036C195242C0C8CF83C . 827904 . . [7.00.6000.20861] . . c:\windows\ie8\wininet.dll

[-] 2008-07-03 . 2BB75B7F548D82A099125D0C5971DE7D . 1033728 . . [6.00.2900.5634] . . c:\windows\explorer.exe
[-] 2008-07-03 . 2BB75B7F548D82A099125D0C5971DE7D . 1033728 . . [6.00.2900.5634] . . c:\windows\system32\dllcache\explorer.exe

[-] 2010-02-17 . 1811AFC2FADB60B88947E3D08E250860 . 2063744 . . [5.1.2600.3670] . . c:\windows\SoftwareDistribution\Download\9d21500a4aa475547c4a2420fee1c623\SP2QFE\ntkrnlpa.exe
[-] 2010-02-16 . A046C627EC20456E2959B7BD628E1FD0 . 2066816 . . [5.1.2600.5938] . . c:\windows\SoftwareDistribution\Download\9d21500a4aa475547c4a2420fee1c623\SP3GDR\ntkrnlpa.exe
[-] 2010-02-16 . 1EE6B94ACA7BE115A1813BBCA65099A8 . 2058368 . . [5.1.2600.3670] . . c:\windows\SoftwareDistribution\Download\9d21500a4aa475547c4a2420fee1c623\SP2GDR\ntkrnlpa.exe
[-] 2010-02-16 . DED8B5A89B085284634502E9D75AC78C . 2066944 . . [5.1.2600.5938] . . c:\windows\SoftwareDistribution\Download\9d21500a4aa475547c4a2420fee1c623\SP3QFE\ntkrnlpa.exe
[-] 2009-12-09 . FFDCE1EEA79C678C40237D4E031E5B51 . 2066176 . . [5.1.2600.5913] . . c:\windows\Driver Cache\i386\ntkrnlpa.exe
[-] 2009-12-09 . FFDCE1EEA79C678C40237D4E031E5B51 . 2066176 . . [5.1.2600.5913] . . c:\windows\system32\ntkrnlpa.exe
[-] 2009-12-09 . FFDCE1EEA79C678C40237D4E031E5B51 . 2066176 . . [5.1.2600.5913] . . c:\windows\system32\dllcache\ntkrnlpa.exe
[-] 2009-02-06 . 607352B9CB3D708C67F6039097801B5A . 2066176 . . [5.1.2600.5755] . . c:\windows\$NtUninstallKB977165-v2$\ntkrnlpa.exe
[-] 2008-04-14 . 820BA42F77C78395EDE704F3E23893A8 . 2066048 . . [5.1.2600.5586] . . c:\windows\$NtUninstallKB956572$\ntkrnlpa.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"CTHelper"="CTHELPER.EXE" [2007-04-09 19456]
"CTxfiHlp"="CTXFIHLP.EXE" [2007-04-09 19968]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-12-05 8523776]
"nwiz"="nwiz.exe" [2007-12-05 1626112]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-12-05 81920]
"BitDefender Antiphishing Helper"="c:\program files\BitDefender\BitDefender 2010\IEShow.exe" [2009-10-19 71152]
"BDAgent"="c:\program files\BitDefender\BitDefender 2010\bdagent.exe" [2010-04-08 1123360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\RealVNC\\VNC4\\winvnc4.exe"=
"c:\\Program Files\\RealVNC\\VNC4\\vncviewer.exe"=
"c:\\WINDOWS\\system32\\spoolsv.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5900:TCP"= 5900:TCP:Real Vnc
"5800:TCP"= 5800:TCP:Real Vnc
"8245:TCP"= 8245:TCP:No-Ip
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R3 bdfm;BDFM;c:\windows\system32\drivers\bdfm.sys [07/12/2009 18:46 153448]
S3 Arrakis3;BitDefender Arrakis Server;c:\program files\Common Files\BitDefender\BitDefender Arrakis Server\bin\arrakis3.exe [19/10/2009 16:06 183880]
S3 cpudrv;cpudrv;c:\program files\SystemRequirementsLab\cpudrv.sys [18/12/2009 10:58 11336]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bdx REG_MULTI_SZ scan
.
Contents of the 'Scheduled Tasks' folder
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.co.uk/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
TCP: {7D00F085-7980-4BE2-B34E-24C824F3A634} = 192.168.1.1,192.168.2.1
DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} - hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_intel_4.1.66.0.cab
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-msnmsgr - c:\program files\Windows Live\Messenger\msnmsgr.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-22 10:29
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
CTHelper = CTHELPER.EXE?
CTxfiHlp = CTXFIHLP.EXE?

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe catchme.sys CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys >>UNKNOWN [0x86F6A8C8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf7707f28
\Driver\ACPI -> ACPI.sys @ 0xf765acb8
\Driver\atapi -> atapi.sys @ 0xf75efb3a
IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805a05a9
ParseProcedure -> ntoskrnl.exe @ 0x8056ea15
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805a05a9
ParseProcedure -> ntoskrnl.exe @ 0x8056ea15
NDIS: Intel(R) PRO/100 VE Network Connection -> SendCompleteHandler -> NDIS.sys @ 0xf74b2bb0
PacketIndicateHandler -> NDIS.sys @ 0xf74bfb21
SendHandler -> NDIS.sys @ 0xf749d87b
user & kernel MBR OK

**************************************************************************
.
Completion time: 2010-04-22 10:33:07
ComboFix-quarantined-files.txt 2010-04-22 09:33

Pre-Run: 107,702,292,480 bytes free
Post-Run: 107,700,047,872 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - AEEB75A503D1968A18A70D654E53BDB1




DDS (Ver_10-03-17.01) - NTFSx86
Run by A Williamson at 11:44:23.84 on 22/04/2010
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18.1023.682 [GMT 1:00]

AV: BitDefender Antivirus *On-access scanning disabled* (Updated) {6C4BB89C-B0ED-4F41-A29C-4373888923BB}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
C:\Program Files\BitDefender\BitDefender 2010\vsserv.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\A Williamson\Desktop\dds.com

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.co.uk/
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
TB: BitDefender Toolbar: {381ffde8-2394-4f90-b10d-fc6124a40f8c} - c:\program files\bitdefender\bitdefender 2010\IEToolbar.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"
mRun: [CTHelper] CTHELPER.EXE
mRun: [CTxfiHlp] CTXFIHLP.EXE
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [BitDefender Antiphishing Helper] "c:\program files\bitdefender\bitdefender 2010\IEShow.exe"
mRun: [BDAgent] "c:\program files\bitdefender\bitdefender 2010\bdagent.exe"
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://download.microsoft.com/download/C/B/F/CBF23A2C-3E55-4664-BC5C-762780D79BA0/OGAControl.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1269111174234
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1269111163734
DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} - hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_intel_4.1.66.0.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: {7D00F085-7980-4BE2-B34E-24C824F3A634} = 192.168.1.1,192.168.2.1
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
Hosts: 127.0.0.1 www.spywareinfo.com (http://www.spywareinfo.com)

============= SERVICES / DRIVERS ===============

R3 bdfm;BDFM;c:\windows\system32\drivers\bdfm.sys [2009-12-7 153448]
S3 Arrakis3;BitDefender Arrakis Server;c:\program files\common files\bitdefender\bitdefender arrakis server\bin\arrakis3.exe [2009-10-19 183880]
S3 cpudrv;cpudrv;c:\program files\systemrequirementslab\cpudrv.sys [2009-12-18 11336]
S3 cpuz132;cpuz132;\??\c:\docume~1\awilli~1\locals~1\temp\cpuz132\cpuz132_x32.sys --> c:\docume~1\awilli~1\locals~1\temp\cpuz132\cpuz132_x32.sys [?]

=============== Created Last 30 ================

2010-04-22 09:17:44 0 d-sha-r- C:\cmdcons
2010-04-22 09:16:28 98816 ----a-w- c:\windows\sed.exe
2010-04-22 09:16:28 77312 ----a-w- c:\windows\MBR.exe
2010-04-22 09:16:28 261632 ----a-w- c:\windows\PEV.exe
2010-04-22 09:16:28 161792 ----a-w- c:\windows\SWREG.exe
2010-04-22 09:04:04 0 d-----w- c:\program files\TrendMicro
2010-04-21 17:41:46 0 d-----w- c:\windows\system32\CatRoot2
2010-04-21 08:20:15 0 d-----w- c:\program files\SpywareBlaster
2010-04-20 22:08:48 204 ----a-w- c:\windows\system32\MRT.INI
2010-04-20 12:39:53 0 d-----w- c:\program files\Spybot - Search & Destroy
2010-04-20 12:39:53 0 d-----w- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
2010-04-13 14:32:43 0 d-----w- C:\spoolerlogs
2010-04-12 19:29:51 0 d-----w- c:\docume~1\awilli~1\applic~1\Office Genuine Advantage
2010-04-12 12:11:28 0 d-----w- c:\program files\No-IP
2010-04-12 10:17:32 26624 ----a-w- c:\windows\system32\VNCpm.dll
2010-04-12 10:17:20 4608 ----a-w- c:\windows\system32\drivers\vncmirror.sys
2010-04-12 10:17:20 20992 ----a-w- c:\windows\system32\vncmirror.dll
2010-04-12 10:17:14 0 d-----w- c:\program files\RealVNC
2010-04-08 17:58:15 0 d-----w- c:\docume~1\awilli~1\applic~1\BitDefender
2010-04-08 17:27:12 81408 ----a-w- c:\windows\system32\devcon_x64.exe
2010-04-08 17:27:11 0 d-----w- c:\program files\Driver Checker
2010-04-08 17:24:14 0 d-----w- c:\windows\system32\wbem\Repository
2010-04-08 16:41:19 53248 ----a-w- c:\windows\system32\CSVer.dll
2010-04-08 16:41:03 0 d-----w- C:\Intel
2010-04-08 16:21:15 0 d-----w- c:\program files\Intel Desktop Board Audio Driver
2010-04-08 16:16:48 0 d-----w- c:\program files\SystemRequirementsLab
2010-04-08 15:50:54 356352 ----a-w- c:\windows\system32\nvudisp.exe
2010-04-08 15:50:54 17737 ----a-w- c:\windows\system32\nvdisp.nvu
2010-04-08 15:50:54 163353 ----a-w- c:\windows\system32\nvapps.xml
2010-04-08 15:50:54 0 d-----w- c:\windows\nview
2010-04-08 15:50:40 0 d-----w- c:\windows\system32\ReinstallBackups
2010-04-08 15:50:30 356352 ----a-w- c:\windows\system32\NVUNINST.EXE
2010-04-08 15:50:11 0 d-----w- C:\NVIDIA
2010-04-08 14:33:03 306688 ----a-w- c:\windows\IsUninst.exe
2010-04-07 16:12:06 0 d-----w- c:\windows\SxsCaPendDel
2010-04-07 16:07:37 0 d-----w- c:\windows\system32\appmgmt
2010-04-07 15:45:11 850 ----a-w- c:\documents and settings\a williamson\Application DataProductTweaks.xml
2010-04-07 15:45:11 385 ----a-w- c:\documents and settings\a williamson\Application Datauser_gensett.xml
2010-04-07 15:45:11 376 ----a-w- c:\documents and settings\a williamson\Application Dataprivacy.xml

==================== Find3M ====================

2010-04-08 19:35:21 153448 ----a-w- c:\windows\system32\drivers\bdfm.sys
2010-04-08 19:35:21 106464 ----a-w- c:\windows\system32\drivers\bdhv.sys
2010-04-08 19:35:01 291352 ----a-w- c:\windows\system32\drivers\bdfsfltr.sys
2010-03-21 14:26:33 409600 ----a-w- c:\windows\system32\wrap_oal.dll
2010-03-21 14:26:33 114688 ----a-w- c:\windows\system32\OpenAL32.dll
2010-03-13 12:23:42 21640 ----a-w- c:\windows\system32\emptyregdb.dat
2010-03-10 06:15:52 420352 ----a-w- c:\windows\system32\vbscript.dll
2010-02-25 06:24:37 916480 ----a-w- c:\windows\system32\wininet.dll
2010-02-24 11:57:57 457216 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-02-12 10:03:03 293376 ------w- c:\windows\system32\browserchoice.exe
2010-02-12 04:27:58 100864 ----a-w- c:\windows\system32\6to4svc.dll
2010-01-28 17:09:36 182784 ----a-w- c:\windows\system32\Ncs2Setp.dll
2010-01-28 16:52:50 734328 ----a-w- c:\windows\system32\ncs2dmix.dll
2010-01-28 16:52:50 518264 ----a-w- c:\windows\system32\accesor.dll
2010-01-28 16:32:04 128120 ----a-w- c:\windows\system32\ncs2instutility.dll
2010-01-28 16:16:16 1718904 ----a-w- c:\windows\system32\ncscolib.dll
2010-01-27 12:52:26 256712 ----a-w- c:\windows\system32\Prounstl.exe

============= FINISH: 11:45:00.84 ===============

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Second topic: http://forums.spybot.info/showthread.php?t=56934


If you have more than one infected computer in the house please let your helper know. Start a new topic for the next machine once the prior thread has been closed.
"BEFORE you POST"(READ this Procedure BEFORE Requesting Assistance) (http://forums.spybot.info/showthread.php?t=288)


Please do NOT run 'FIXES' (ComboFix etc) without being asked (http://forums.spybot.info/showthread.php?t=16806 )