Need help computer freezing

SteveO311t · July 6, 2009

My computer has been randomly freezing up seemingly when under load... I can't even finish a Malwarebytes scan... here is my log

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 6:56:58 PM, on 7/6/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe

C:\Program Files\Ideazon\ZEngine\Zboard.exe

C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

C:\Program Files\Unlocker\UnlockerAssistant.exe

C:\Program Files\STOPzilla!\STOPzilla.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\WINDOWS\system32\ctfmon.exe

C:\PROGRA~1\Ideazon\Reaper\Reaper_Settings.exe

C:\Program Files\RocketDock\RocketDock.exe

C:\Program Files\Microsoft ActiveSync\Wcescomm.exe

C:\Program Files\HDD Health\hddhealth.exe

C:\Program Files\Steam\Steam.exe

C:\PROGRA~1\MICROS~2\rapimgr.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Program Files\Dropbox\Dropbox.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe

C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe

C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe

C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe

C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe

C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

O2 - BHO: SITEguard BHO - {1827766B-9F49-4854-8034-F6EE26FCB1EC} - C:\Program Files\STOPzilla!\SZSG.dll

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: STOPzilla Browser Helper Object - {E3215F20-3212-11D6-9F8B-00D0B743919D} - C:\Program Files\STOPzilla!\SZIEBHO.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2008\IEToolbar.dll

O3 - Toolbar: STOPzilla - {98828DED-A591-462F-83BA-D2F62A68B8B8} - C:\Program Files\STOPzilla!\SZSG.dll

O4 - HKLM\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear

O4 - HKLM\..\Run: [bitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2008\IEShow.exe"

O4 - HKLM\..\Run: [bDAgent] "C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe"

O4 - HKLM\..\Run: [Zboard] C:\Program Files\Ideazon\ZEngine\Zboard.exe

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"

O4 - HKLM\..\Run: [unlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [skyTel] SkyTel.EXE

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [Reaper Gaming Mouse] C:\PROGRA~1\Ideazon\Reaper\Reaper_Settings.exe

O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"

O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\Wcescomm.exe"

O4 - HKCU\..\Run: [HDDHealth] C:\Program Files\HDD Health\hddhealth.exe -wl

O4 - HKCU\..\Run: [steam] "C:\Program Files\Steam\Steam.exe" -silent

O4 - S-1-5-18 Startup: Client Default.lnk = C:\Program Files\Samurize\Client.exe (User 'SYSTEM')

O4 - S-1-5-18 Startup: Dropbox.lnk = C:\Program Files\Dropbox\Dropbox.exe (User 'SYSTEM')

O4 - .DEFAULT Startup: Client Default.lnk = C:\Program Files\Samurize\Client.exe (User 'Default user')

O4 - .DEFAULT Startup: Dropbox.lnk = C:\Program Files\Dropbox\Dropbox.exe (User 'Default user')

O4 - Startup: Client Default.lnk = C:\Program Files\Samurize\Client.exe

O4 - Startup: Dropbox.lnk = C:\Program Files\Dropbox\Dropbox.exe

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe

O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll

O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll

O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O10 - Unknown file in Winsock LSP: c:\program files\common files\is3\anti-spyware\is3lsp.dll

O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com.edgesuite.net/co...ex/qtplugin.cab

O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1242004654562

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O16 - DPF: {E001C731-5E37-4538-A5CB-8168736A2360} (Confirmation) - http://qscan.bitdefender.com/cab/ActiveQscan.cab

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe

O23 - Service: getPlus® Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe

O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE

O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe

O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe

O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O23 - Service: STOPzilla Service (szserver) - iS3, Inc. - C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe

O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S.R.L. - C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe

O23 - Service: BitDefender Communicator (XCOMM) - BitDefender - C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe

--

End of file - 10224 bytes

AdvancedSetup · July 10, 2009

Sorry for the delay, if you still need help please run the following and post back the log.

Please visit this webpage for instructions for downloading ComboFix to your

DESKTOP

:

how-to-use-combofix

Please ensure you read this guide carefully and install the Recovery Console first.

NOTE!!:

You must save and run

ComboFix.exe

on your DESKTOP and not from any other folder.

Also,

DO NOT

click the mouse or launch any other applications while this is running or it may stall the program

Additional links to download the tool:

ComboFix.exe

Note:

The

Windows Recovery Console

will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

Once installed, you should see a blue screen prompt that says:

The Recovery Console was successfully installed.

Please continue as follows:

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
Click
Yes
to allow ComboFix to continue scanning for malware.
When the tool is finished, it will produce a report for you.
Please post the
C:\ComboFix.txt
along with a
new HijackThis log
so we may continue cleaning the system.

SteveO311t · July 10, 2009

So here are my logs

ComboFix 09-07-09.08 - Stephen Hall 07/10/2009 18:08.4.4 - NTFSx86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2814.2097 [GMT -4:00]

Running from: c:\documents and settings\Stephen Hall\Desktop\ComboFix.exe

AV: Bitdefender Antivirus *On-access scanning disabled* (Updated) {6C4BB89C-B0ED-4F41-A29C-4373888923BB}

.

((((((((((((((((((((((((( Files Created from 2009-06-10 to 2009-07-10 )))))))))))))))))))))))))))))))

.

2009-07-06 16:29 . 2009-07-06 16:50 -------- d-----w- c:\documents and settings\Stephen Hall\Application Data\gtk-2.0

2009-07-06 16:29 . 2009-07-06 16:29 -------- d-----w- c:\documents and settings\Stephen Hall\.thumbnails

2009-07-06 16:26 . 2009-07-06 16:50 -------- d-----w- c:\documents and settings\Stephen Hall\.gimp-2.6

2009-07-06 16:26 . 2009-07-06 16:26 -------- d-----w- c:\documents and settings\Stephen Hall\.gegl-0.0

2009-07-06 02:27 . 2009-07-06 02:27 -------- d-----w- c:\documents and settings\All Users\Application Data\Digsby

2009-07-06 00:51 . 2009-07-06 00:51 -------- d-----w- c:\documents and settings\Stephen Hall\Local Settings\Application Data\World in Conflict - DEMO

2009-07-02 03:09 . 2009-07-01 18:07 581632 ----a-w- c:\documents and settings\Stephen Hall\Application Data\Mozilla\Firefox\Profiles\pf5mtp2b.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\bdqscan.dll

2009-07-02 03:09 . 2009-07-01 18:07 516096 ----a-w- c:\documents and settings\Stephen Hall\Application Data\Mozilla\Firefox\Profiles\pf5mtp2b.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll

2009-06-30 01:37 . 2009-06-30 01:38 -------- d-----w- c:\program files\Microsoft Games for Windows - LIVE

2009-06-30 01:37 . 2009-06-30 01:37 -------- d-----w- c:\windows\system32\xlive

2009-06-29 21:42 . 2009-07-06 02:27 -------- d-----w- c:\documents and settings\Stephen Hall\Application Data\Digsby

2009-06-29 21:42 . 2009-06-30 11:26 -------- d-----w- c:\documents and settings\Stephen Hall\Local Settings\Application Data\Digsby

2009-06-29 21:40 . 2009-06-29 21:40 -------- d-----w- c:\program files\Digsby

2009-06-29 21:25 . 2009-06-29 21:25 -------- d-sh--w- c:\documents and settings\Stephen Hall\IECompatCache

2009-06-28 19:29 . 2009-06-28 19:29 -------- d-----w- c:\program files\Common Files\DirectX

2009-06-28 19:28 . 2009-06-28 19:28 -------- d-----w- c:\windows\DD1865F0AD7340FBB23E1822E02396FF.TMP

2009-06-28 19:28 . 2009-06-28 19:28 -------- d-----w- c:\windows\A7E07C2B2220441587E3784D5814BC93.TMP

2009-06-28 19:27 . 2009-03-09 19:27 453456 ----a-w- c:\windows\system32\d3dx10_41.dll

2009-06-28 19:27 . 2009-03-09 19:27 4178264 ----a-w- c:\windows\system32\D3DX9_41.dll

2009-06-28 19:27 . 2009-03-09 19:27 1846632 ----a-w- c:\windows\system32\D3DCompiler_41.dll

2009-06-28 19:27 . 2009-03-16 18:18 69448 ----a-w- c:\windows\system32\XAPOFX1_3.dll

2009-06-28 19:27 . 2009-03-16 18:18 517448 ----a-w- c:\windows\system32\XAudio2_4.dll

2009-06-28 19:27 . 2009-03-16 18:18 235352 ----a-w- c:\windows\system32\xactengine3_4.dll

2009-06-28 19:27 . 2009-03-16 18:18 22360 ----a-w- c:\windows\system32\X3DAudio1_6.dll

2009-06-28 08:05 . 2008-10-27 14:04 514384 ----a-w- c:\windows\system32\XAudio2_3.dll

2009-06-28 08:05 . 2008-10-27 14:04 70992 ----a-w- c:\windows\system32\XAPOFX1_2.dll

2009-06-28 08:05 . 2008-10-15 10:22 452440 ----a-w- c:\windows\system32\d3dx10_40.dll

2009-06-28 08:05 . 2008-10-15 10:22 4379984 ----a-w- c:\windows\system32\D3DX9_40.dll

2009-06-28 08:05 . 2008-10-15 10:22 2036576 ----a-w- c:\windows\system32\D3DCompiler_40.dll

2009-06-28 08:05 . 2008-10-27 14:04 235856 ----a-w- c:\windows\system32\xactengine3_3.dll

2009-06-28 08:05 . 2008-10-27 14:04 23376 ----a-w- c:\windows\system32\X3DAudio1_5.dll

2009-06-28 07:53 . 2008-07-31 14:41 68616 ----a-w- c:\windows\system32\XAPOFX1_1.dll

2009-06-28 07:53 . 2008-07-31 14:40 509448 ----a-w- c:\windows\system32\XAudio2_2.dll

2009-06-28 07:53 . 2008-07-31 14:41 238088 ----a-w- c:\windows\system32\xactengine3_2.dll

2009-06-28 07:53 . 2008-07-12 12:18 467984 ----a-w- c:\windows\system32\d3dx10_39.dll

2009-06-28 07:53 . 2008-07-12 12:18 3851784 ----a-w- c:\windows\system32\D3DX9_39.dll

2009-06-28 07:53 . 2008-07-12 12:18 1493528 ----a-w- c:\windows\system32\D3DCompiler_39.dll

2009-06-28 01:30 . 2009-07-10 21:59 -------- d-----w- c:\program files\Steam

2009-06-27 23:17 . 2009-06-29 21:57 -------- d-----w- c:\documents and settings\Stephen Hall\Application Data\BitZipper

2009-06-24 23:49 . 2009-07-08 23:10 -------- d-----w- c:\documents and settings\Stephen Hall\Application Data\dvdcss

2009-06-24 23:49 . 2009-06-24 23:57 -------- d-----w- c:\documents and settings\Stephen Hall\Application Data\vlc

2009-06-24 23:42 . 2009-06-24 23:42 -------- d-----w- c:\program files\VideoLAN

2009-06-24 23:34 . 2007-03-22 10:46 126976 ----a-w- c:\documents and settings\Stephen Hall\Application Data\GRETECH\GomPlayer\GrLauncher.exe

2009-06-24 03:03 . 2009-06-24 03:03 -------- d-----w- c:\program files\HDD Health

2009-06-24 02:54 . 2009-06-24 03:01 -------- d-----w- c:\program files\r2 Studios

2009-06-24 02:48 . 2009-06-24 03:06 -------- d-----w- c:\documents and settings\Stephen Hall\Local Settings\Application Data\eSupport.com

2009-06-24 02:33 . 2009-06-30 19:38 25 ----a-w- c:\windows\popcinfot.dat

2009-06-24 02:33 . 2009-06-24 02:33 -------- d-----w- c:\documents and settings\All Users\Application Data\PopCap Games

2009-06-24 02:33 . 2009-06-24 02:33 -------- d-----w- c:\program files\PopCap Games

2009-06-23 11:52 . 2009-06-24 05:45 -------- d-----w- C:\Fraps

2009-06-23 05:20 . 2009-06-23 05:20 -------- d-----w- c:\program files\Microsoft ActiveSync

2009-06-23 04:09 . 2009-06-26 20:33 -------- d-----w- c:\program files\SpeedFan

2009-06-23 04:06 . 2009-06-23 04:06 -------- d-----w- c:\program files\MusicBrainz Picard

2009-06-23 04:01 . 2009-06-23 04:01 -------- d-----w- c:\program files\RegSeeker

2009-06-23 03:59 . 2009-06-23 03:59 -------- d-----w- c:\documents and settings\Stephen Hall\Application Data\GRETECH

2009-06-23 03:57 . 2009-06-23 03:57 -------- d-----w- c:\program files\Team MediaPortal

2009-06-23 03:54 . 2009-06-23 03:54 -------- d-----w- c:\documents and settings\Stephen Hall\Application Data\TrueCrypt

2009-06-23 03:51 . 2009-06-23 03:51 -------- d-----w- c:\program files\cpu-z-141

2009-06-23 03:21 . 2009-06-23 03:21 -------- d-----w- c:\documents and settings\Stephen Hall\Local Settings\Application Data\Thunderbird

2009-06-23 03:21 . 2009-06-23 03:21 -------- d-----w- c:\documents and settings\Stephen Hall\Application Data\Thunderbird

2009-06-23 03:18 . 2009-06-23 03:18 215872 ----a-w- c:\windows\system32\drivers\truecrypt.sys

2009-06-23 03:18 . 2009-06-23 03:18 -------- d-----w- c:\program files\TrueCrypt

2009-06-23 02:31 . 2009-06-23 02:55 -------- d-----w- c:\documents and settings\Stephen Hall\Application Data\KeePass

2009-06-23 02:26 . 2009-07-10 21:59 -------- d-----w- c:\documents and settings\Stephen Hall\Application Data\Dropbox

2009-06-23 02:26 . 2009-06-23 02:26 -------- d-----w- c:\program files\Dropbox

2009-06-23 02:20 . 2009-06-23 02:20 -------- d-----w- c:\documents and settings\All Users\Application Data\NCH Swift Sound

2009-06-23 02:20 . 2009-06-23 02:20 -------- d-----w- c:\program files\NCH Software

2009-06-23 02:20 . 2009-06-24 03:15 -------- d-----w- c:\program files\NCH Swift Sound

2009-06-23 02:20 . 2009-06-23 02:20 -------- d-----w- c:\documents and settings\Stephen Hall\Application Data\NCH Swift Sound

2009-06-23 02:19 . 2009-06-24 03:13 -------- d-----w- c:\documents and settings\Stephen Hall\Local Settings\Application Data\MediaMonkey

2009-06-23 02:19 . 2009-06-23 02:19 -------- d-----w- c:\program files\MediaMonkey

2009-06-23 02:14 . 2009-06-23 02:14 -------- d-----w- c:\program files\GRETECH

2009-06-23 02:08 . 2009-06-23 02:08 -------- d-----w- c:\program files\GIMP-2.0

2009-06-23 02:05 . 2009-06-23 02:05 -------- d-----w- c:\program files\Audacity

2009-06-22 22:50 . 2009-06-22 22:50 -------- d-----w- c:\documents and settings\Stephen Hall\Application Data\Warsow

2009-06-22 22:43 . 2009-07-10 22:02 -------- d-----w- c:\program files\Mozilla Thunderbird

2009-06-22 22:41 . 2009-06-23 04:51 -------- d-----w- c:\program files\Samurize

2009-06-22 15:53 . 2009-06-22 15:53 -------- d-----w- c:\program files\CCleaner

2009-06-15 06:00 . 2009-06-15 06:00 -------- d-----w- c:\program files\STOPzilla!

2009-06-13 16:31 . 2009-03-19 20:32 23400 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys

2009-06-13 16:31 . 2008-04-17 16:12 107368 ----a-w- c:\windows\system32\GEARAspi.dll

2009-06-13 16:30 . 2009-06-13 16:31 -------- d-----w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}

2009-06-13 16:26 . 2009-06-13 16:26 75048 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\Safari 4.30.17.0\SetupAdmin.exe

2009-06-13 16:25 . 2009-06-13 16:25 -------- d-----w- c:\program files\QuickTime

2009-06-11 15:01 . 2009-06-11 15:01 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-07-10 22:13 . 2008-07-08 04:28 81984 ----a-w- c:\windows\system32\bdod.bin

2009-07-10 22:05 . 2009-03-22 18:27 -------- d-----w- c:\documents and settings\All Users\Application Data\STOPzilla!

2009-07-10 21:59 . 2009-07-10 21:59 1008 ----a-w- c:\windows\system32\drivers\kgpcpy.cfg

2009-06-28 19:28 . 2008-02-12 17:22 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard

2009-06-24 02:45 . 2009-03-10 11:32 -------- d-----w- c:\program files\Java

2009-06-24 02:45 . 2009-04-01 17:21 152576 ----a-w- c:\documents and settings\Stephen Hall\Application Data\Sun\Java\jre1.6.0_13\lzma.dll

2009-06-24 02:29 . 2008-10-30 16:22 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP

2009-06-23 10:35 . 2009-06-23 05:53 384 ----a-w- c:\program files\prime.txt

2009-06-23 10:28 . 2009-06-23 06:16 2032 ----a-w- c:\program files\results.txt

2009-06-23 09:21 . 2009-06-23 05:53 324 ----a-w- c:\program files\local.txt

2009-06-23 05:53 . 2009-03-15 21:43 2159 ----a-w- c:\program files\license.txt

2009-06-23 05:52 . 2009-03-15 21:10 4526080 ----a-w- c:\program files\prime95.exe

2009-06-23 05:52 . 2009-03-15 21:02 54847 ----a-w- c:\program files\whatsnew.txt

2009-06-23 05:52 . 2008-11-22 18:56 20169 ----a-w- c:\program files\undoc.txt

2009-06-23 05:52 . 2008-11-22 18:18 23570 ----a-w- c:\program files\readme.txt

2009-06-23 05:52 . 2008-11-19 21:26 7019 ----a-w- c:\program files\stress.txt

2009-06-23 04:09 . 2009-03-16 18:45 -------- d-----w- c:\program files\Safari

2009-06-23 02:48 . 2007-12-06 23:02 -------- d-----w- c:\program files\World of Warcraft

2009-06-23 02:14 . 2008-05-14 04:23 -------- d-----w- c:\program files\Common Files\AVSMedia

2009-06-21 03:35 . 2009-03-16 18:39 1 ----a-w- c:\documents and settings\Stephen Hall\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys

2009-06-13 16:31 . 2008-02-27 13:44 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer

2009-06-10 00:52 . 2009-06-10 00:52 152576 ----a-w- c:\documents and settings\Stephen Hall\Application Data\Sun\Java\jre1.6.0_14\lzma.dll

2009-06-08 22:45 . 2009-03-16 18:45 26040 ---ha-w- c:\windows\system32\mlfcache.dat

2009-06-08 22:31 . 2009-03-17 15:56 26848 ----a-w- c:\windows\system32\GDIPFONTCACHEV1.DAT

2009-06-08 22:30 . 2009-06-08 22:30 -------- d-----w- c:\program files\Microsoft

2009-06-08 22:30 . 2009-06-08 22:30 -------- d-----w- c:\program files\Windows Live

2009-06-08 22:30 . 2009-06-08 22:30 -------- d-----w- c:\program files\Windows Live SkyDrive

2009-06-08 22:26 . 2009-06-08 22:26 -------- d-----w- c:\program files\Common Files\Windows Live

2009-05-28 18:16 . 2009-05-28 18:16 17408 ----a-r- c:\windows\system32\SZIO5.dll

2009-05-28 18:15 . 2009-05-28 18:15 294912 ----a-r- c:\windows\system32\SZBase5.dll

2009-05-28 18:14 . 2009-05-28 18:14 540672 ----a-r- c:\windows\system32\SZComp5.dll

2009-05-21 15:33 . 2008-12-05 18:06 410984 ----a-w- c:\windows\system32\deploytk.dll

2009-05-19 03:30 . 2009-03-22 18:28 -------- d-----w- c:\documents and settings\All Users\Application Data\SITEguard

2009-05-13 05:15 . 2006-02-28 12:00 915456 ----a-w- c:\windows\system32\wininet.dll

2009-05-12 18:13 . 2009-05-12 18:13 61328 ----a-r- c:\windows\system32\drivers\SZKG.sys

2009-05-08 20:50 . 2009-03-18 20:46 107888 ----a-w- c:\windows\system32\CmdLineExt.dll

2009-05-08 20:43 . 2009-05-08 20:43 22328 ----a-w- c:\documents and settings\Stephen Hall\Application Data\PnkBstrK.sys

2009-05-08 20:43 . 2009-05-08 20:43 107832 ----a-w- c:\windows\system32\PnkBstrB.exe

2009-05-07 15:32 . 2008-08-22 00:07 345600 ----a-w- c:\windows\system32\localspl.dll

2009-05-01 04:31 . 2009-05-01 04:31 1657376 ----a-w- c:\windows\system32\nwiz.exe

2009-05-01 04:31 . 2009-05-01 04:31 449056 ----a-w- c:\windows\system32\nvappbar.exe

2009-05-01 04:31 . 2009-05-01 04:31 436768 ----a-w- c:\windows\system32\keystone.exe

2009-05-01 04:31 . 2009-05-01 04:31 466944 ----a-w- c:\windows\system32\nvshell.dll

2009-05-01 04:31 . 2009-05-01 04:31 1724416 ----a-w- c:\windows\system32\nvwdmcpl.dll

2009-05-01 04:31 . 2009-05-01 04:31 1507328 ----a-w- c:\windows\system32\nview.dll

2009-05-01 04:31 . 2009-05-01 04:31 1101824 ----a-w- c:\windows\system32\nvwimg.dll

2009-05-01 02:02 . 2009-05-01 02:02 663552 ----a-w- c:\windows\system32\nvcuvid.dll

2009-05-01 02:02 . 2009-05-01 02:02 1579630 ----a-w- c:\windows\system32\nvdata.bin

2009-05-01 02:02 . 2009-05-01 02:02 1314816 ----a-w- c:\windows\system32\nvcuvenc.dll

2009-05-01 02:02 . 2007-12-06 09:17 457248 ----a-w- c:\windows\system32\nvudisp.exe

2009-05-01 02:02 . 2007-12-05 06:41 1720320 ----a-w- c:\windows\system32\nvcuda.dll

2009-05-01 02:02 . 2005-12-28 09:01 9994240 ----a-w- c:\windows\system32\nvoglnt.dll

2009-05-01 02:02 . 2005-12-28 09:01 806912 ----a-w- c:\windows\system32\nvapi.dll

2009-05-01 02:02 . 2005-12-28 09:01 143360 ----a-w- c:\windows\system32\nvcodins.dll

2009-05-01 02:02 . 2005-12-28 09:01 143360 ----a-w- c:\windows\system32\nvcod.dll

2009-05-01 02:02 . 2005-12-28 09:01 8055584 ----a-w- c:\windows\system32\drivers\nv4_mini.sys

2009-05-01 02:02 . 2005-12-28 09:01 5896320 ----a-w- c:\windows\system32\nv4_disp.dll

2009-04-27 04:42 . 2007-12-06 09:09 457248 ----a-w- c:\windows\system32\NVUNINST.EXE

2009-04-22 04:20 . 2009-04-22 04:20 14311680 ----a-w- c:\windows\system32\xlive.dll

2009-04-22 04:20 . 2009-04-22 04:20 13642496 ----a-w- c:\windows\system32\xlivefnt.dll

2009-04-17 12:26 . 2008-08-22 00:07 1847168 ----a-w- c:\windows\system32\win32k.sys

2009-04-15 14:51 . 2006-02-28 12:00 585216 ----a-w- c:\windows\system32\rpcrt4.dll

2009-04-13 20:06 . 2008-04-06 22:54 117092 ----a-w- c:\windows\hpoins11.dat

2009-03-24 03:11 . 2009-03-24 03:11 5018 --sh--w- c:\windows\system32\visujowo.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2008-09-07 07:20 143360 ----a-w- c:\program files\Dropbox\DropboxExt.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2008-09-07 07:20 143360 ----a-w- c:\program files\Dropbox\DropboxExt.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2008-09-07 07:20 143360 ----a-w- c:\program files\Dropbox\DropboxExt.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

"Reaper Gaming Mouse"="c:\progra~1\Ideazon\Reaper\Reaper_Settings.exe" [2006-11-22 1507328]

"RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616]

"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\Wcescomm.exe" [2006-11-13 1289000]

"HDDHealth"="c:\program files\HDD Health\hddhealth.exe" [2008-06-15 1692672]

"Steam"="c:\program files\Steam\Steam.exe" [2009-06-28 1217784]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NVIDIA nTune"="c:\program files\NVIDIA Corporation\nTune\nTuneCmd.exe" [2006-10-13 81920]

"BitDefender Antiphishing Helper"="c:\program files\BitDefender\BitDefender 2008\IEShow.exe" [2007-10-09 61440]

"BDAgent"="c:\program files\BitDefender\BitDefender 2008\bdagent.exe" [2008-09-15 368640]

"Zboard"="c:\program files\Ideazon\ZEngine\Zboard.exe" [2008-11-12 57344]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-05-01 13750272]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-05-01 86016]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]

"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]

"UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2008-05-02 15872]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-21 148888]

"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2009-05-01 1657376]

"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.EXE [2006-10-18 16264192]

"SkyTel"="SkyTel.EXE" - c:\windows\SkyTel.exe [2006-10-18 2879488]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]

HP Photosmart Premier Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2006-2-10 73728]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Unreal Tournament 3\\Binaries\\UT3.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\Ubisoft\\Ghost Recon Advanced Warfighter\\GRAW.exe"=

"c:\\WINDOWS\\system32\\wbem\\wmiprvse.exe"=

"c:\\Program Files\\Ubisoft\\Far Cry 2\\bin\\FarCry2.exe"=

"c:\\Program Files\\Ubisoft\\Far Cry 2\\bin\\FC2Launcher.exe"=

"c:\\Program Files\\Ubisoft\\Far Cry 2\\bin\\FC2Editor.exe"=

"c:\\WINDOWS\\system32\\PnkBstrB.exe"=

"c:\\Program Files\\MusicBrainz Picard\\picard.exe"=

"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager

"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager

"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application

"c:\\Program Files\\Steam\\steamapps\\common\\defense grid demo\\DefenseGridDemo.exe"=

"c:\\Program Files\\Steam\\steamapps\\common\\plants vs zombies\\PlantsVsZombies.exe"=

"c:\\Program Files\\Steam\\steamapps\\common\\defcon\\defcon.exe"=

"c:\\Program Files\\Steam\\steamapps\\common\\dawn of war ii - spd\\DOW2.exe"=

"c:\\Program Files\\Steam\\steamapps\\common\\freedom force - demo\\fforce.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"6881:TCP"= 6881:TCP:6881

"6999:TCP"= 6999:TCP:6999

"6998:TCP"= 6998:TCP:6998

"6997:TCP"= 6997:TCP:6997

"6996:TCP"= 6996:TCP:6996

"6112:TCP"= 6112:TCP:blizzard Downloader

"3724:TCP"= 3724:TCP:3724

"6882:TCP"= 6882:TCP:6882

"6883:TCP"= 6883:TCP:6883

"6884:TCP"= 6884:TCP:6884

"6885:TCP"= 6885:TCP:6885

"6886:TCP"= 6886:TCP:6886

"6887:TCP"= 6887:TCP:6887

"6888:TCP"= 6888:TCP:6888

"6889:TCP"= 6889:TCP:6889

"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R0 szkg5;szkg;c:\windows\system32\drivers\SZKG.sys [5/12/2009 2:13 PM 61328]

R3 cmudaxp;Razer Barracuda AC-1 Gaming Interface;c:\windows\system32\drivers\cmudaxp.sys [1/22/2008 9:55 AM 1395840]

S3 getPlus® Helper;getPlus® Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [3/24/2009 6:29 PM 33176]

S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [5/10/2009 8:26 PM 38496]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

bdx REG_MULTI_SZ scan

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]

"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

.

Contents of the 'Scheduled Tasks' folder

2009-06-13 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.google.com/

uInternet Settings,ProxyOverride = *.local

IE: &Search

LSP: c:\program files\Common Files\iS3\Anti-Spyware\iS3lsp.dll

LSP: %SYSTEMROOT%\system32\nvappfilter.dll

FF - ProfilePath - c:\documents and settings\Stephen Hall\Application Data\Mozilla\Firefox\Profiles\pf5mtp2b.default\

FF - component: c:\documents and settings\Stephen Hall\Application Data\Mozilla\Firefox\Profiles\pf5mtp2b.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\bdqscan.dll

FF - plugin: c:\documents and settings\Stephen Hall\Application Data\Mozilla\Firefox\Profiles\pf5mtp2b.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----

FF - user.js: yahoo.homepage.dontask - truec:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");

c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");

c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-07-10 18:13

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1844237615-152049171-839522115-1004\Software\SecuROM\License information*]

"datasecu"=hex:8c,df,03,6f,9f,62,5e,88,68,2f,09,6a,ba,7c,9e,5e,45,fc,1b,d4,5a,

a6,1f,dc,26,4b,b4,0d,7a,9d,21,9a,b9,fe,82,a1,9f,c1,b8,82,2a,93,a8,33,50,c0,\

"rkeysecu"=hex:5b,fc,aa,20,af,e0,a0,97,84,f6,e2,85,da,cb,18,03

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'lsass.exe'(804)

c:\program files\Common Files\iS3\Anti-Spyware\iS3lsp.dll

c:\windows\system32\nvappfilter.dll

- - - - - - - > 'explorer.exe'(2856)

c:\windows\system32\WININET.dll

c:\program files\RocketDock\RocketDock.dll

c:\program files\Dropbox\DropboxExt.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

Completion time: 2009-07-10 18:14

ComboFix-quarantined-files.txt 2009-07-10 22:14

ComboFix2.txt 2009-06-22 13:34

Pre-Run: 283,976,380,416 bytes free

Post-Run: 284,578,004,992 bytes free

367 --- E O F --- 2009-07-01 11:19

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 6:21:08 PM, on 7/10/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe

C:\Program Files\Ideazon\ZEngine\Zboard.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\WINDOWS\system32\ctfmon.exe

C:\PROGRA~1\Ideazon\Reaper\Reaper_Settings.exe

C:\Program Files\RocketDock\RocketDock.exe

C:\Program Files\Microsoft ActiveSync\Wcescomm.exe

C:\PROGRA~1\MICROS~2\rapimgr.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe

C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe

C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe

C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe

C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe

C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\explorer.exe

C:\Program Files\Safari\Safari.exe