All my mentioned problems seem to have gone away. I can now access windows update and its no longer intercepting my google searches related to virus's or blocking post requests with certain keywords (i tried posting the same post I had issues with earlier). Seems its gone as far as I can tell but its only been a short while.
I noticed got rid of my Flashget. Did it do this accurately? I never thought that would be the cause of anything and have used Flashget for years. Although I've only been using version 3 since I reinstalled on my new drive ~2 months ago.
ComboFix 10-04-21.01 - thewird 04/25/2010 15:16:39.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3326.2689 [GMT -4:00]
Running from: c:\documents and settings\thewird\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\docume~1\thewird\LOCALS~1\Temp\clclean.0001.dir.0011\~df394b.tmp
c:\documents and settings\All Users\Start Menu\Programs\Startup\Bluetooth.lnk
c:\documents and settings\thewird\Application Data\BITS
c:\documents and settings\thewird\Application Data\BITS\BITS.ini
c:\documents and settings\thewird\Application Data\BITS\DHTTable.dat
c:\documents and settings\thewird\Application Data\BITS\ProxyList.ini
c:\documents and settings\thewird\Application Data\BITS\UPnP.ini
c:\documents and settings\thewird\Application Data\FlashGetBHO
c:\documents and settings\thewird\Application Data\FlashGetBHO\FlashGetBHO3.dll
c:\documents and settings\thewird\Application Data\FlashGetBHO\FlashGetHook.dll
c:\documents and settings\thewird\Application Data\FlashGetBHO\GetAllUrl.htm
c:\documents and settings\thewird\Application Data\FlashGetBHO\GetUrl.htm
c:\documents and settings\thewird\Local Settings\Temp\clclean.0001.dir.0011\~df394b.tmp
c:\program files\FlashGet Network
c:\program files\FlashGet Network\FlashGet 3\adns.dll
c:\program files\FlashGet Network\FlashGet 3\btcoreu.dll
c:\program files\FlashGet Network\FlashGet 3\BugReport.dll
c:\program files\FlashGet Network\FlashGet 3\BugReport.exe
c:\program files\FlashGet Network\FlashGet 3\cd1.ico
c:\program files\FlashGet Network\FlashGet 3\ckcore.dll
c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\14_43260.dll
c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\28_83260.dll
c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\atrc.dll
c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\Codecs.zip
c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\cook.dll
c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\ddnt3260.dll
c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\dnet3260.dll
c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\drv1.dll
c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\drv2.dll
c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\drvc.dll
c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\hxltcolor.dll
c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\raac.dll
c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\ralf.dll
c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\rv10.dll
c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\rv20.dll
c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\rv30.dll
c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\rv40.dll
c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\sipr.dll
c:\program files\FlashGet Network\FlashGet 3\commonlib.dll
c:\program files\FlashGet Network\FlashGet 3\componentskrnl.dll
c:\program files\FlashGet Network\FlashGet 3\config\clients.met
c:\program files\FlashGet Network\FlashGet 3\config\clients.met.bak
c:\program files\FlashGet Network\FlashGet 3\config\cryptkey.dat
c:\program files\FlashGet Network\FlashGet 3\config\emfriends.met
c:\program files\FlashGet Network\FlashGet 3\config\known.met
c:\program files\FlashGet Network\FlashGet 3\config\known2_64.met
c:\program files\FlashGet Network\FlashGet 3\config\preferences.dat
c:\program files\FlashGet Network\FlashGet 3\config\preferences.ini
c:\program files\FlashGet Network\FlashGet 3\config\server.met
c:\program files\FlashGet Network\FlashGet 3\config\server_met.old
c:\program files\FlashGet Network\FlashGet 3\config\upload.met
c:\program files\FlashGet Network\FlashGet 3\corestat.dll
c:\program files\FlashGet Network\FlashGet 3\dat\Appsetting.cfg
c:\program files\FlashGet Network\FlashGet 3\dat\directui\client_33665566.jpg
c:\program files\FlashGet Network\FlashGet 3\dat\directui\client_4-L.jpg
c:\program files\FlashGet Network\FlashGet 3\dat\directui\client_5-04400194A.jpg
c:\program files\FlashGet Network\FlashGet 3\dat\directui\client_5_4504_1.jpg
c:\program files\FlashGet Network\FlashGet 3\dat\directui\client_csqyz010315.jpg
c:\program files\FlashGet Network\FlashGet 3\dat\directui\client_icon01.jpg
c:\program files\FlashGet Network\FlashGet 3\dat\directui\client_icon03.jpg
c:\program files\FlashGet Network\FlashGet 3\dat\directui\client_icon04.jpg
c:\program files\FlashGet Network\FlashGet 3\dat\directui\client_leifeng12.jpg
c:\program files\FlashGet Network\FlashGet 3\dat\directui\client_logo.jpg
c:\program files\FlashGet Network\FlashGet 3\dat\directui\client_paidangzhentan12.jpg
c:\program files\FlashGet Network\FlashGet 3\dat\directui\client_WuBiaoTi-2.jpg
c:\program files\FlashGet Network\FlashGet 3\dat\directui\dian.jpg
c:\program files\FlashGet Network\FlashGet 3\dat\directui\directui_new_1270777588.zip
c:\program files\FlashGet Network\FlashGet 3\dat\directui\gameall.gif
c:\program files\FlashGet Network\FlashGet 3\dat\directui\gametop.gif
c:\program files\FlashGet Network\FlashGet 3\dat\directui\newgame.gif
c:\program files\FlashGet Network\FlashGet 3\dat\directui\newmovie.gif
c:\program files\FlashGet Network\FlashGet 3\dat\directui\p1.gif
c:\program files\FlashGet Network\FlashGet 3\dat\directui\p2.gif
c:\program files\FlashGet Network\FlashGet 3\dat\directui\p3.gif
c:\program files\FlashGet Network\FlashGet 3\dat\directui\p4.gif
c:\program files\FlashGet Network\FlashGet 3\dat\directui\p5.gif
c:\program files\FlashGet Network\FlashGet 3\dat\directui\p6.gif
c:\program files\FlashGet Network\FlashGet 3\dat\directui\p7.gif
c:\program files\FlashGet Network\FlashGet 3\dat\directui\p8.gif
c:\program files\FlashGet Network\FlashGet 3\dat\directui\reom.jpg
c:\program files\FlashGet Network\FlashGet 3\dat\directui\rescenter.txt
c:\program files\FlashGet Network\FlashGet 3\dat\directui\soft.jpg
c:\program files\FlashGet Network\FlashGet 3\dat\directui\tab.gif
c:\program files\FlashGet Network\FlashGet 3\dat\FlashGet3db.bak
c:\program files\FlashGet Network\FlashGet 3\dat\FlashGet3db.db
c:\program files\FlashGet Network\FlashGet 3\dat\stat\advertisement\domain_url_list_en.zip
c:\program files\FlashGet Network\FlashGet 3\dat\stat\advertisement\port.ini
c:\program files\FlashGet Network\FlashGet 3\dat\stat\skinpreview\preview_blue.png
c:\program files\FlashGet Network\FlashGet 3\dat\stat\skinpreview\preview_classic.png
c:\program files\FlashGet Network\FlashGet 3\dat\stat\skinpreview\preview_white.png
c:\program files\FlashGet Network\FlashGet 3\dat\stat\statdata\statinfo.dat
c:\program files\FlashGet Network\FlashGet 3\dbghelp.dll
c:\program files\FlashGet Network\FlashGet 3\fg.ico
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\default.htm
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\FGResDetector.conf
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\banner.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\bullet.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\close.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\closelabel.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\download-icon.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\explorer.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\ftp.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\image.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\introTextBg.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\loading.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\nextlabel.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\prevlabel.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\software.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\vod.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\FGResDetector.exe
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\about.png
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\ftplist_tree_icon.png
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\option_icon.png
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\quickop_hide.png
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\quickop_show.png
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\statusbar_bk.png
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\tasktab_close.png
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\toolbar_back.png
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\toolbar_bk.png
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\toolbar_close.png
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\toolbar_forward.png
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\toolbar_refresh.png
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\lang\l.eng.xml
c:\program files\FlashGet Network\FlashGet 3\FGSoftware.exe
c:\program files\FlashGet Network\FlashGet 3\Flashget3.exe
c:\program files\FlashGet Network\FlashGet 3\FlashGet3.xpi
c:\program files\FlashGet Network\FlashGet 3\FlashGetBHO3.dll
c:\program files\FlashGet Network\FlashGet 3\FlashGetHook.dll
c:\program files\FlashGet Network\FlashGet 3\fnsArchive.dll
c:\program files\FlashGet Network\FlashGet 3\fnsDirectuix.dll
c:\program files\FlashGet Network\FlashGet 3\fnsLanguage.dll
c:\program files\FlashGet Network\FlashGet 3\fnslanguage_en.dll
c:\program files\FlashGet Network\FlashGet 3\fnsScheduler.dll
c:\program files\FlashGet Network\FlashGet 3\fnsSecurity.dll
c:\program files\FlashGet Network\FlashGet 3\fnsSkinX.dll
c:\program files\FlashGet Network\FlashGet 3\fnsStatistics.dll
c:\program files\FlashGet Network\FlashGet 3\game.ico
c:\program files\FlashGet Network\FlashGet 3\gb2312-unicode.dic
c:\program files\FlashGet Network\FlashGet 3\gdiplus.dll
c:\program files\FlashGet Network\FlashGet 3\GetAllUrl.htm
c:\program files\FlashGet Network\FlashGet 3\GetUrl.htm
c:\program files\FlashGet Network\FlashGet 3\GoogleToolbarInstaller_download_signed.exe
c:\program files\FlashGet Network\FlashGet 3\libem.dll
c:\program files\FlashGet Network\FlashGet 3\license.txt
c:\program files\FlashGet Network\FlashGet 3\lst_tz.bin
c:\program files\FlashGet Network\FlashGet 3\P2PCfg.ini
c:\program files\FlashGet Network\FlashGet 3\p2pcore.dll
c:\program files\FlashGet Network\FlashGet 3\p2score.dll
c:\program files\FlashGet Network\FlashGet 3\perf.ini
c:\program files\FlashGet Network\FlashGet 3\pncrt.dll
c:\program files\FlashGet Network\FlashGet 3\pstat.dat
c:\program files\FlashGet Network\FlashGet 3\pup.dat
c:\program files\FlashGet Network\FlashGet 3\RdOldDb.dll
c:\program files\FlashGet Network\FlashGet 3\RealMediaSplitter.ax
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\BarSet.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\btn_check.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\btn_normal.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\btn_radio.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\desktoplink.ico
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\login_line.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\menu_icon.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\option_line.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\option_page_line.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\skin.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\SuspendLogo.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\SuspendNoLogo.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbar_backgrand.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbar_cancle.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbar_catgroy.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbar_group.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbar_new.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbar_open.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbar_option.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbar_pause.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbar_recly.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbar_start.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbarbutton_left.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbarbutton_middle.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbarbutton_right.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\top_logotitle.gif
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\torrent.ico
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\userinfo_head.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\VistaStyleListItems.bmp
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\preview.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\skin.xml
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\sound\loginfailed.wav
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\sound\loginsucc.wav
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\sound\msgnotify.wav
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\sound\notify.wav
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\topmain.png
c:\program files\FlashGet Network\FlashGet 3\SnapShot.dll
c:\program files\FlashGet Network\FlashGet 3\storage.dll
c:\program files\FlashGet Network\FlashGet 3\SysOptimize.exe
c:\program files\FlashGet Network\FlashGet 3\uninst.exe
c:\program files\FlashGet Network\FlashGet 3\VodCore.dll
c:\program files\FlashGet Network\FlashGet 3\zlib.dll
c:\program files\Internet Explorer\SET21C.tmp
c:\program files\Internet Explorer\SET21D.tmp
c:\windows\system32\Data
c:\windows\system32\drivers\1028_DELL_XPS_MXG061 .MRK
c:\windows\system32\drivers\DELL_XPS_MXG061 .MRK
c:\windows\system32\secustat.dat
c:\windows\system32\uninstall.exe
Infected copy of c:\windows\system32\drivers\afd.sys was found and disinfected
Restored copy from - Kitty had a snack
.
((((((((((((((((((((((((( Files Created from 2010-03-25 to 2010-04-25 )))))))))))))))))))))))))))))))
.
2010-04-25 19:02 . 2010-04-25 19:02 -------- d-----w- c:\program files\ERUNT
2010-04-25 06:05 . 2010-04-25 06:05 -------- d-----w- C:\rsit
2010-04-23 21:14 . 2010-02-24 14:16 181632 ------w- c:\windows\system32\MpSigStub.exe
2010-04-23 21:12 . 2010-04-23 21:12 -------- d-----w- c:\program files\Windows Defender
2010-04-23 20:59 . 2010-04-23 20:59 -------- d-----w- c:\program files\Alwil Software
2010-04-23 20:59 . 2010-04-23 20:59 -------- d-----w- c:\documents and settings\All Users\Application Data\Alwil Software
2010-04-23 20:54 . 2010-04-23 20:54 503808 ----a-w- c:\documents and settings\thewird\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-697adea1-n\msvcp71.dll
2010-04-23 20:54 . 2010-04-23 20:54 499712 ----a-w- c:\documents and settings\thewird\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-697adea1-n\jmc.dll
2010-04-23 20:54 . 2010-04-23 20:54 348160 ----a-w- c:\documents and settings\thewird\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-697adea1-n\msvcr71.dll
2010-04-23 20:54 . 2010-04-23 20:54 -------- d-----w- c:\program files\Common Files\Java
2010-04-23 20:54 . 2010-04-23 20:54 61440 ----a-w- c:\documents and settings\thewird\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-42356531-n\decora-sse.dll
2010-04-23 20:54 . 2010-04-23 20:54 12800 ----a-w- c:\documents and settings\thewird\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-42356531-n\decora-d3d.dll
2010-04-23 20:53 . 2010-04-12 21:29 411368 ----a-w- c:\windows\system32\deployJava1.dll
2010-04-23 16:57 . 2010-04-23 16:57 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2010-04-23 16:57 . 2010-04-23 18:17 -------- d-----w- c:\documents and settings\thewird\Application Data\SUPERAntiSpyware.com
2010-04-23 16:57 . 2010-04-23 18:17 -------- d-----w- c:\program files\SUPERAntiSpyware
2010-04-23 16:41 . 2010-04-23 16:52 -------- d-----w- c:\program files\Windows Live Safety Center
2010-04-22 13:03 . 2010-04-22 13:03 242696 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgtdix.sys
2010-04-22 13:02 . 2010-04-22 13:02 1689952 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgupd.dll
2010-04-22 00:44 . 2010-04-22 00:44 -------- d-----w- c:\documents and settings\thewird\Local Settings\Application Data\Threat Expert
2010-04-21 23:31 . 2010-04-21 23:31 -------- d-----w- c:\documents and settings\thewird\Application Data\Malwarebytes
2010-04-21 23:31 . 2010-03-30 04:46 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-21 23:30 . 2010-04-21 23:31 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-04-21 23:30 . 2010-04-21 23:30 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-04-21 23:30 . 2010-03-30 04:45 20824 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-04-21 23:20 . 2010-04-22 17:53 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-04-21 16:12 . 2010-04-25 06:05 -------- d-----w- c:\program files\Trend Micro
2010-04-21 16:12 . 2010-04-21 16:12 388096 ----a-r- c:\documents and settings\thewird\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-04-21 16:07 . 2010-04-21 16:07 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2010-04-21 14:58 . 2010-04-23 07:19 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-04-21 14:58 . 2010-04-21 15:09 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-04-21 01:01 . 2010-04-21 01:01 -------- d-----w- C:\spoolerlogs
2010-04-21 00:47 . 2010-04-21 00:47 56978 ----a-w- c:\documents and settings\All Users\Application Data\DivX\WebPlayer\Uninstaller.exe
2010-04-21 00:47 . 2010-04-21 00:47 56766 ----a-w- c:\documents and settings\All Users\Application Data\DivX\DivXPlusShortcuts\Uninstaller.exe
2010-04-20 04:23 . 2010-04-20 04:23 -------- d-----w- c:\program files\Gameforge4D
2010-04-20 04:23 . 2004-05-10 16:14 118272 ----a-w- c:\windows\system32\SX5363S.DLL
2010-04-20 04:23 . 2004-05-10 16:14 102400 ----a-w- c:\windows\system32\RV32RTP.dll
2010-04-19 22:33 . 2010-04-19 22:33 552 ----a-w- c:\windows\system32\d3d8caps.dat
2010-04-19 13:35 . 2010-04-21 00:47 57344 ----a-w- c:\documents and settings\All Users\Application Data\DivX\RunAsUser\RUNASUSERPROCESS.dll
2010-04-19 13:32 . 2010-04-19 13:32 57679 ----a-w- c:\documents and settings\All Users\Application Data\DivX\Player\Uninstaller.exe
2010-04-19 13:31 . 2010-04-19 13:31 84040 ----a-w- c:\documents and settings\All Users\Application Data\DivX\TransferWizard\Uninstaller.exe
2010-04-19 13:31 . 2010-04-19 13:31 54153 ----a-w- c:\documents and settings\All Users\Application Data\DivX\DFXPlugin\Uninstaller.exe
2010-04-19 13:31 . 2010-04-19 13:31 57409 ----a-w- c:\documents and settings\All Users\Application Data\DivX\ControlPanel\Uninstaller.exe
2010-04-19 13:29 . 2010-04-21 00:46 144696 ----a-w- c:\documents and settings\All Users\Application Data\DivX\RunAsUser\RUNASUSERPROCESS.exe
2010-04-16 20:26 . 2010-04-16 20:26 41872 ----a-w- c:\windows\system32\xfcodec.dll
2010-04-14 23:36 . 2010-04-14 23:37 -------- d-----w- c:\program files\RDM+
2010-04-09 18:14 . 2010-04-09 18:14 -------- d-----w- c:\windows\Performance
2010-04-09 18:14 . 2010-04-09 18:14 -------- d-----w- c:\documents and settings\thewird\Local Settings\Application Data\Microsoft Corporation
2010-04-08 13:30 . 2010-04-08 13:30 4255072 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgcorex.dll
2010-04-02 12:08 . 2010-04-02 12:08 4076824 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgui.exe
2010-04-02 12:08 . 2010-04-02 12:08 2059544 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgtray.exe
2010-04-02 12:08 . 2010-04-02 12:08 1515224 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgwd.dll
2010-04-02 12:08 . 2010-04-02 12:08 1274136 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgfrw.exe
2010-04-02 12:08 . 2010-04-02 12:08 598296 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgsrmx.dll
2010-04-02 12:08 . 2010-04-02 12:08 556824 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgchjwx.dll
2010-04-02 12:08 . 2010-04-02 12:08 459544 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgcclix.dll
2010-04-02 12:08 . 2010-04-02 12:08 313112 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avglogx.dll
2010-04-02 12:08 . 2010-04-02 12:08 301336 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgchclx.dll
2010-04-02 12:08 . 2010-04-02 12:08 1086744 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgchsvx.exe
2010-04-02 12:08 . 2010-04-02 12:08 1035032 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgupd.exe
2010-03-30 07:29 . 2010-04-21 00:46 754984 ----a-w- c:\documents and settings\All Users\Application Data\DivX\Setup\Resource.dll
2010-03-30 07:29 . 2010-04-21 00:46 1180952 ----a-w- c:\documents and settings\All Users\Application Data\DivX\Setup\DivXSetup.exe
2010-03-30 07:29 . 2010-03-06 13:20 500400 ----a-w- c:\documents and settings\All Users\Application Data\DivX\DivX7\DivX Web Player\DivXWebPlayerUninstall.exe
2010-03-30 07:29 . 2010-03-30 07:29 53600 ----a-w- c:\documents and settings\All Users\Application Data\DivX\Update\Uninstaller.exe
2010-03-30 07:29 . 2010-03-30 07:29 -------- d-----w- c:\documents and settings\thewird\Application Data\DivX
2010-03-30 07:29 . 2010-03-30 07:29 54629 ----a-w- c:\documents and settings\All Users\Application Data\DivX\TranscodeEngine\Uninstaller.exe
2010-03-30 07:29 . 2010-03-30 07:29 54101 ----a-w- c:\documents and settings\All Users\Application Data\DivX\MPEG2Plugin\Uninstaller.exe
2010-03-30 07:29 . 2010-03-30 07:29 52963 ----a-w- c:\documents and settings\All Users\Application Data\DivX\MSVC80CRTRedist\Uninstaller.exe
2010-03-30 07:29 . 2010-03-30 07:29 54073 ----a-w- c:\documents and settings\All Users\Application Data\DivX\Qt4.5\Uninstaller.exe
2010-03-30 07:26 . 2010-04-21 00:47 -------- d-----w- c:\documents and settings\All Users\Application Data\DivX
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-25 19:03 . 2010-03-05 22:08 -------- d-----w- c:\program files\Trillian
2010-04-25 08:17 . 2004-08-04 10:00 138496 ----a-w- c:\windows\system32\drivers\afd.sys
2010-04-25 07:56 . 2010-03-05 21:42 -------- d-----w- c:\program files\Warcraft III
2010-04-25 05:33 . 2010-03-05 21:25 89917 ----a-w- c:\windows\system32\nvModes.dat
2010-04-23 21:54 . 2010-03-06 02:49 -------- d-----w- c:\documents and settings\thewird\Application Data\Xfire
2010-04-23 20:53 . 2010-03-06 11:54 -------- d-----w- c:\program files\Java
2010-04-23 20:47 . 2004-08-04 10:00 96512 ----a-w- c:\windows\system32\drivers\atapi.sys
2010-04-23 18:17 . 2010-03-05 21:22 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-04-23 06:02 . 2010-03-05 23:16 -------- d-----w- c:\documents and settings\thewird\Application Data\TeraCopy
2010-04-23 00:42 . 2010-03-06 12:04 -------- d-----w- c:\program files\DivX
2010-04-22 20:28 . 2010-03-06 02:49 -------- d-----w- c:\program files\Xfire
2010-04-22 13:03 . 2010-03-08 13:05 242896 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2010-04-21 20:29 . 2010-03-05 21:21 1324 ----a-w- c:\windows\system32\d3d9caps.dat
2010-04-21 14:18 . 2010-03-08 13:05 -------- d-----w- c:\documents and settings\All Users\Application Data\avg9
2010-04-20 06:37 . 2010-03-12 16:52 -------- d-----w- c:\documents and settings\thewird\Application Data\vlc
2010-04-13 12:40 . 2009-10-27 10:36 181096 ----a-w- c:\documents and settings\thewird\Application Data\Mozilla\Firefox\Profiles\5fonlhdr.default\FlashGot.exe
2010-04-13 04:47 . 2010-03-06 14:18 1477 ----a-w- c:\windows\system32\secushr.dat
2010-03-31 01:58 . 2010-03-10 17:29 9200 ------w- c:\windows\system32\drivers\cdralw2k.sys
2010-03-31 01:58 . 2010-03-10 17:29 9072 ------w- c:\windows\system32\drivers\cdr4_xp.sys
2010-03-31 01:58 . 2010-03-10 17:29 44944 ----a-w- c:\windows\system32\drivers\PxHelp20.sys
2010-03-31 01:58 . 2010-03-10 17:29 125424 ------w- c:\windows\system32\pxinsi64.exe
2010-03-31 01:58 . 2010-03-10 17:29 123888 ------w- c:\windows\system32\pxcpyi64.exe
2010-03-31 01:58 . 2010-03-10 17:29 133616 ------w- c:\windows\system32\pxafs.dll
2010-03-30 07:29 . 2010-03-06 13:20 -------- d-----w- c:\program files\Common Files\DivX Shared
2010-03-26 03:17 . 2010-03-26 03:17 -------- d-----w- c:\documents and settings\All Users\Application Data\Research In Motion
2010-03-26 01:30 . 2010-03-26 01:30 -------- d-----w- c:\documents and settings\thewird\Application Data\Mael
2010-03-26 01:21 . 2010-03-26 01:21 -------- d-----w- c:\program files\HxD
2010-03-23 23:54 . 2010-03-12 16:52 -------- d-----w- c:\documents and settings\thewird\Application Data\dvdcss
2010-03-23 19:25 . 2010-03-05 21:27 72800 ----a-w- c:\documents and settings\thewird\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-03-23 19:24 . 2010-03-23 19:24 -------- d-----w- c:\program files\Common Files\L&H
2010-03-23 19:23 . 2010-03-23 19:23 -------- d-----w- c:\program files\Microsoft ActiveSync
2010-03-23 19:23 . 2010-03-23 19:23 -------- d-----w- c:\program files\Microsoft Works
2010-03-23 19:21 . 2010-03-23 19:21 -------- d-----w- c:\program files\Microsoft.NET
2010-03-23 07:02 . 2010-03-06 21:39 -------- d-----w- c:\program files\PokerStars
2010-03-19 11:38 . 2010-03-19 11:35 -------- d-----w- c:\program files\K-Lite Codec Pack
2010-03-19 06:07 . 2010-03-19 06:07 -------- d-----w- c:\program files\WIDCOMM
2010-03-19 04:46 . 2010-03-05 22:23 -------- d-----w- c:\program files\Creative
2010-03-19 04:46 . 2010-03-05 22:21 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-03-19 04:30 . 2010-03-19 04:30 -------- d-----w- c:\documents and settings\thewird\Application Data\Creative
2010-03-19 04:09 . 2010-03-19 04:09 -------- d-----w- c:\program files\SigmaTel
2010-03-19 04:02 . 2010-03-19 04:02 -------- d-----w- c:\documents and settings\All Users\Application Data\Creative Labs
2010-03-19 04:01 . 2010-03-19 04:01 -------- d-----w- c:\program files\Common Files\Creative Labs Shared
2010-03-18 10:19 . 2010-03-18 00:52 256 ----a-w- c:\windows\system32\pool.bin
2010-03-18 07:34 . 2010-03-06 14:25 -------- d-----w- c:\program files\Steam
2010-03-18 00:52 . 2010-03-18 00:52 -------- d-----w- c:\documents and settings\thewird\Application Data\Research In Motion
2010-03-18 00:52 . 2010-03-18 00:52 -------- d-----w- c:\program files\Common Files\Research In Motion
2010-03-18 00:52 . 2010-03-18 00:52 -------- d-----w- c:\program files\Common Files\Roxio Shared
2010-03-18 00:52 . 2010-03-18 00:52 -------- d-----w- c:\program files\Research In Motion
2010-03-15 04:38 . 2010-03-15 04:37 -------- d-----w- c:\program files\BulletProof FTP Client 2009
2010-03-14 23:56 . 2010-03-14 22:28 -------- d-----w- c:\documents and settings\thewird\Application Data\Azureus
2010-03-14 22:28 . 2010-03-14 22:28 -------- d-----w- c:\documents and settings\All Users\Application Data\Azureus
2010-03-14 22:27 . 2010-03-14 22:27 -------- d-----w- c:\program files\Vuze
2010-03-14 18:00 . 2010-03-19 11:35 85504 ----a-w- c:\windows\system32\ff_vfw.dll
2010-03-12 16:50 . 2010-03-12 16:50 -------- d-----w- c:\program files\VideoLAN
2010-03-12 16:26 . 2010-03-12 16:26 -------- d-----w- c:\documents and settings\All Users\Application Data\Elaborate Bytes
2010-03-12 16:26 . 2010-03-12 16:26 -------- d-----w- c:\documents and settings\All Users\Application Data\SlySoft
2010-03-12 16:25 . 2010-03-12 16:25 -------- d-----w- c:\program files\Elaborate Bytes
2010-03-12 16:25 . 2010-03-12 16:25 -------- d-----w- c:\program files\SlySoft
2010-03-12 02:13 . 2010-03-12 02:13 -------- d-----w- c:\documents and settings\thewird\Application Data\XenSource
2010-03-11 20:36 . 2010-03-05 21:46 77606 ----a-w- c:\windows\War3Unin.dat
2010-03-10 18:04 . 2010-03-10 18:02 -------- d-----w- c:\documents and settings\thewird\Application Data\Canon
2010-03-10 17:36 . 2010-03-10 17:36 -------- d-----w- c:\documents and settings\All Users\Application Data\FLEXnet
2010-03-10 17:35 . 2010-03-10 17:35 -------- d-----w- c:\program files\2BrightSparks
2010-03-10 17:31 . 2010-03-07 17:11 -------- d-----w- c:\program files\Common Files\Adobe
2010-03-10 17:31 . 2010-03-10 17:31 -------- d-----w- c:\program files\Common Files\Macrovision Shared
2010-03-10 17:11 . 2010-03-10 17:11 -------- d-----w- c:\program files\PowerISO
2010-03-10 16:47 . 2010-03-10 16:15 -------- d-----w- c:\documents and settings\thewird\Application Data\DAEMON Tools Lite
2010-03-10 16:45 . 2010-03-10 16:16 -------- d-----w- c:\program files\DAEMON Tools Lite
2010-03-10 16:16 . 2010-03-10 16:16 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-03-10 16:15 . 2010-03-10 16:15 -------- d-----w- c:\documents and settings\All Users\Application Data\DAEMON Tools Lite
2010-03-10 16:08 . 2010-03-10 16:06 -------- d-----w- c:\program files\FC Edit Universal
2010-03-10 16:06 . 2010-03-10 16:04 249856 ------w- c:\windows\Setup1.exe
2010-03-10 16:06 . 2010-03-10 16:04 73216 ----a-w- c:\windows\ST6UNST.EXE
2010-03-10 06:15 . 2004-08-04 10:00 420352 ----a-w- c:\windows\system32\vbscript.dll
2010-03-10 04:38 . 2010-03-06 01:16 -------- d-----w- c:\documents and settings\thewird\Application Data\Ventrilo
2010-03-08 13:05 . 2010-03-08 13:05 12464 ----a-w- c:\windows\system32\avgrsstx.dll
2010-03-08 13:05 . 2010-03-08 13:05 29512 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2010-03-08 13:05 . 2010-03-08 13:05 216200 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2010-03-08 13:05 . 2010-03-08 13:05 -------- d-----w- c:\program files\AVG
2010-03-07 11:09 . 2010-03-07 11:09 -------- d-----w- c:\program files\TightVNC
2010-03-06 14:17 . 2010-03-06 14:17 -------- d-----w- c:\documents and settings\thewird\Application Data\FlashGet
2010-03-06 13:06 . 2010-03-06 10:51 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2010-03-06 12:56 . 2010-03-06 12:56 152576 ----a-w- c:\documents and settings\thewird\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2010-03-06 12:56 . 2010-03-06 12:56 79488 ----a-w- c:\documents and settings\thewird\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2010-03-06 11:54 . 2010-03-06 11:54 152576 ----a-w- c:\documents and settings\thewird\Application Data\Sun\Java\jre1.6.0_16\lzma.dll
2010-03-06 10:51 . 2010-03-06 10:51 1955472 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\install_flash_player_ax.exe
2010-03-06 10:28 . 2010-03-05 22:24 -------- d-----w- c:\program files\Intel
2010-03-06 03:17 . 2010-03-06 03:16 -------- d-----w- c:\documents and settings\thewird\Application Data\WhatPulse
2010-03-06 03:17 . 2010-03-06 03:16 -------- d-----w- c:\program files\WhatPulse
2010-03-06 03:12 . 2010-03-06 03:12 -------- d-----w- c:\documents and settings\LocalService\Application Data\Xfire
2010-03-06 03:09 . 2010-03-06 03:09 -------- d-----w- c:\documents and settings\NetworkService\Application Data\Xfire
2010-03-06 01:16 . 2010-03-06 01:16 -------- d-----w- c:\program files\Ventrilo
2010-03-06 00:26 . 2007-08-11 00:57 -------- d-----w- c:\program files\XenSource
2010-03-05 23:16 . 2010-03-05 23:16 -------- d-----w- c:\program files\TeraCopy
2010-03-05 22:39 . 2010-03-05 22:06 -------- d-----w- c:\program files\Windows Desktop Search
2010-03-05 22:29 . 2010-03-05 22:29 -------- d-----w- c:\program files\I8kfanGUI
2010-03-05 22:26 . 2010-03-05 22:26 -------- d-----w- c:\documents and settings\All Users\Application Data\Dell
2010-03-05 22:26 . 2010-03-05 22:23 -------- d-----w- c:\program files\Dell
2010-03-05 22:25 . 2010-03-05 22:25 -------- d-----w- c:\program files\DIFX
2010-03-05 22:23 . 2010-03-05 22:23 -------- d-----w- c:\documents and settings\thewird\Application Data\InstallShield
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
.
------- Sigcheck -------
[7] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
[7] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\system32\dllcache\tcpip.sys
[-] 2008-06-20 . 4AFB3B0919649F95C1964AA1FAD27D73 . 361600 . . [5.1.2600.5625] . . c:\windows\system32\drivers\tcpip.sys
[7] 2008-04-13 . 93EA8D04EC73A85DB02EB8805988F733 . 361344 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB951748$\tcpip.sys
[7] 2008-04-13 . 93EA8D04EC73A85DB02EB8805988F733 . 361344 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\tcpip.sys
[7] 2004-08-04 . 9F4B36614A0FC234525BA224957DE55C . 359040 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\tcpip.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"i8kfangui"="c:\program files\I8kfanGUI\I8kfanGUI.exe" [2007-02-16 856064]
"WhatPulse"="c:\program files\WhatPulse\WhatPulse.exe" [2009-04-08 2814976]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2009-10-30 369200]
"SetDefaultMIDI"="MIDIDef.exe" [2004-12-22 24576]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-01-30 13594624]
"nwiz"="nwiz.exe" [2009-01-30 1657376]
"NVHotkey"="nvHotkey.dll" [2009-01-30 90112]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-01-30 86016]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-08 761947]
"Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2007-05-14 1191936]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"CloneCDTray"="c:\program files\SlySoft\CloneCD\CloneCDTray.exe" [2009-01-29 57344]
"BlackBerryAutoUpdate"="c:\program files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe" [2010-03-11 648536]
"CTSysVol"="c:\program files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [2005-10-31 57344]
"MBMon"="CTMBHA.DLL" [2006-01-04 1355181]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
"SigmatelSysTrayApp"="c:\program files\SigmaTel\C-Major Audio\WDM\stsystra.exe" [2007-05-10 405504]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]
"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Elements 6.0\apdproxy.exe" [2007-09-11 67488]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-03-05 1135912]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2006-11-03 866584]
c:\documents and settings\thewird\Start Menu\Programs\Startup\
Trillian.lnk - c:\program files\Trillian\trillian.exe [2010-2-10 1930592]
Xfire.lnk - c:\program files\Xfire\Xfire.exe [2010-4-16 3438992]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2010-03-08 13:05 12464 ----a-w- c:\windows\system32\avgrsstx.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\RDM+]
2009-05-29 11:30 61440 ----a-w- c:\program files\RDM+\notify.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableNotifications"= 1 (0x1)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=
"c:\\Program Files\\Xfire\\Xfire.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Program Files\\Steam\\Steam.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=
"c:\\Program Files\\Vuze\\Azureus.exe"=
"c:\\Documents and Settings\\thewird\\Desktop\\gproxyplusplus_ptr_windows_1.0\\gproxy.exe"=
"c:\\Program Files\\Trillian\\trillian.exe"=
"c:\program files\Gameforge4D\AirRivals_EN\Launcher.atm"= c:\program files\Gameforge4D\AirRivals_EN\Launcher.atm:Enabled:GameExe2
"c:\program files\Gameforge4D\AirRivals_EN\Res-Voip\SCVoIP.exe"= c:\program files\Gameforge4D\AirRivals_EN\Res-Voip\SCVoIP.exe:Enabled:GameVoIP
"c:\\WINDOWS\\system32\\spoolsv.exe"=
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [3/8/2010 9:05 AM 216200]
R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [3/8/2010 9:05 AM 242896]
R1 fanio;FanIO driver;c:\windows\system32\drivers\fanio.sys [3/5/2010 6:29 PM 14464]
R2 avg9emc;AVG Free E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [3/8/2010 9:05 AM 916760]
R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [3/8/2010 9:05 AM 308064]
R3 dfmirage;dfmirage;c:\windows\system32\drivers\dfmirage.sys [5/29/2009 7:31 AM 31896]
S0 tmucil;tmucil; [x]
S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 7:19 PM 13592]
S3 RDMPLocalService;RDM+ Local Service;c:\program files\RDM+\rdmpserv.exe [3/22/2010 2:19 AM 813568]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [3/10/2010 12:16 PM 691696]
.
Contents of the 'Scheduled Tasks' folder
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.ca/
Trusted Zone: live.com\onecare
FF - ProfilePath - c:\documents and settings\thewird\Application Data\Mozilla\Firefox\Profiles\5fonlhdr.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo Search
FF - prefs.js: keyword.URL - hxxp://search.freecause.com/search?fr=freecause&ourmark=3&type=56939&p=
FF - component: c:\documents and settings\thewird\Application Data\Mozilla\Firefox\Profiles\5fonlhdr.default\extensions\{DB9127A2-3381-41ec-82B3-1B6ED4C6F29A}\components\FlashgetXpi.dll
FF - plugin: c:\documents and settings\thewird\Application Data\Mozilla\Firefox\Profiles\5fonlhdr.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
FF - plugin: c:\program files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - ORPHANS REMOVED - - - -
Toolbar-Locked - (no file)
SafeBoot-klmdb.sys
AddRemove-FlashGet 3.3 - c:\program files\FlashGet Network\FlashGet 3\uninst.exe
AddRemove-SLABCOMM - c:\windows\system32\uninstall.exe
**************************************************************************
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files:
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(652)
c:\program files\RDM+\notify.dll
.
Completion time: 2010-04-25 15:20:02
ComboFix-quarantined-files.txt 2010-04-25 19:20
Pre-Run: 68,578,779,136 bytes free
Post-Run: 69,148,110,848 bytes free
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
- - End Of File - - 972BB74F9F9E3D556A274FDFA7B023AC