I'm infected, Help please! - Plenty of log files included

Haunt · March 25, 2011

Hey guys, I seem to be infected with a rather fussy redirect. Cant seem to find it with a number of popular scans/programs. I've gone ahead and disabled cd emulation prior to gathering the included log files. We've got a combofix log, DDS and Attach.zip from the dds script, and a log from OTL. The OTL scan was run with Minimal Output, LOP and Purity checks, "all" standard registry, and these custom settings pasted in..

netsvcs

%SYSTEMDRIVE%\*.*

%systemroot%\system32\*.dll /lockedfiles

%systemroot%\Tasks\*.job /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\system32\drivers\*.sys /90

%systemroot%\system32\Spool\prtprocs\w32x86\*.dll

Like I said, this thing is really fussy so I'm unable to run a full GMER. I get about 30 seconds in and the computer reboots. Again, for the record I've taken care to disable CD Emulation as well as Avast, even Teatimer for what its worth ;P

We'll start with the DDS log, then, OTL, followed by the Combofix log.

.

DDS (Ver_11-03-05.01) - NTFSx86

Run by Terry at 18:07:57.65 on Fri 03/25/2011

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_23

AV: avast! Antivirus *Disabled/Outdated* {7591DB91-41F0-48A3-B128-1A293FD8233D}

.

============== Running Processes ===============

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.google.com/

uURLSearchHooks: SearchHook Class: {bc86e1ab-eda5-4059-938f-ce307b0c6f0a} - c:\program files\devicevm\browser configuration utility\AddressBarSearch.dll

uURLSearchHooks: Freecorder Toolbar: {1392b8d2-5c05-419f-a8f6-b9f15a596612} - c:\program files\freecorder\prxtbFre0.dll

BHO: Freecorder Toolbar: {1392b8d2-5c05-419f-a8f6-b9f15a596612} - c:\program files\freecorder\prxtbFre0.dll

BHO: Conduit Engine : {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\prxConduitEngine.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: Freecorder Toolbar: {1392b8d2-5c05-419f-a8f6-b9f15a596612} - c:\program files\freecorder\prxtbFre0.dll

uRun: [Messenger (Yahoo!)] "c:\appz\messen~1\YAHOOM~1.EXE" -quiet

mRun: [bCU] "c:\program files\devicevm\browser configuration utility\BCU.exe"

mRun: [avast5] "c:\appz\avast5\avastUI.exe" /nogui

mRun: [XboxStat] "c:\program files\microsoft xbox 360 accessories\XboxStat.exe" silentrun

mRun: [Freecorder FLV Service] "c:\appz\freecorder\FLVSrvc.exe" /run

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1292133625515

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

Notify: AtiExtEvent - Ati2evxx.dll

AppInit_DLLs: c:\windows\system32\wbsys.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

SSODL: IconPackager Repair - {1799460C-0BC8-4865-B9DF-4A36CD703FF0} - c:\appz\iconpackager\iprepair.dll

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\docume~1\terry\applic~1\mozilla\firefox\profiles\hsh5e79q.default\

FF - prefs.js: browser.startup.homepage - www.google.com

FF - prefs.js: network.proxy.type - 0

FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\appz\firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\appz\firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension

FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\java\jre6\lib\deploy\jqs\ff

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}

FF - Ext: All-in-One Gestures: {8b86149f-01fb-4842-9dd8-4d7eb02fd055} - %profile%\extensions\{8b86149f-01fb-4842-9dd8-4d7eb02fd055}

FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}

.

---- FIREFOX POLICIES ----

FF - user.js: yahoo.ytff.general.dontshowhpoffer - true

.

============= SERVICES / DRIVERS ===============

.

=============== Created Last 30 ================

.

2011-03-25 20:50:26 -------- d-----w- c:\program files\ESET

2011-03-17 15:00:58 -------- d-----w- c:\docume~1\terry\locals~1\applic~1\ConduitEngine

2011-03-17 15:00:57 0 ----a-w- c:\windows\system32\ConduitEngine.tmp

2011-03-17 15:00:57 -------- d-----w- c:\program files\ConduitEngine

2011-03-13 17:29:23 -------- d-----w- c:\docume~1\terry\locals~1\applic~1\Conduit

2011-03-13 17:29:22 -------- d-----w- c:\program files\Conduit

2011-03-13 17:29:21 -------- d-----w- c:\program files\Freecorder

2011-03-13 17:29:21 -------- d-----w- c:\docume~1\terry\locals~1\applic~1\Freecorder

2011-03-13 17:11:56 -------- d-----w- c:\docume~1\terry\locals~1\applic~1\EZSoftMagic

2011-03-13 17:11:37 -------- d-----w- c:\program files\v0cNs188Hm

2011-03-09 19:15:18 -------- d-----w- c:\docume~1\terry\locals~1\applic~1\Adobe

2011-03-09 17:48:37 -------- d-----w- c:\docume~1\terry\locals~1\applic~1\TQVault

2011-03-07 21:32:55 -------- d-----w- c:\program files\Microsoft Xbox 360 Accessories

2011-03-07 21:31:59 -------- d-----w- c:\program files\XBox 360 Controller for Windows Software

2011-03-07 20:50:54 -------- d-----w- c:\docume~1\terry\applic~1\fofix

2011-03-06 18:53:18 -------- d-----w- c:\program files\THQ

2011-03-04 19:17:03 40960 ----a-r- c:\windows\system32\psfind.dll

2011-02-28 16:50:35 -------- d-----w- c:\docume~1\terry\locals~1\applic~1\Secunia PSI

2011-02-24 18:03:38 90112 ----a-w- c:\windows\unvise32.exe

.

==================== Find3M ====================

.

2011-03-08 19:44:49 98304 ----a-w- c:\windows\system32\CmdLineExt.dll

2011-02-04 22:48:32 456192 ----a-w- c:\windows\system32\encdec.dll

2011-02-04 22:48:30 291840 ----a-w- c:\windows\system32\sbe.dll

2011-02-03 16:06:54 218624 ----a-w- c:\windows\system32\uxtheme.dll

2011-02-02 07:58:35 2067456 ----a-w- c:\windows\system32\mstscax.dll

2011-01-27 11:57:06 677888 ----a-w- c:\windows\system32\mstsc.exe

2011-01-25 21:13:55 63116508 ----a-w- C:\Entire.reg

2011-01-22 17:51:16 2560 ----a-w- c:\windows\_MSRSTRT.EXE

2011-01-21 14:44:37 439296 ----a-w- c:\windows\system32\shimgvw.dll

2011-01-20 04:50:52 73728 ----a-w- c:\windows\system32\javacpl.cpl

2011-01-20 04:50:52 472808 ----a-w- c:\windows\system32\deployJava1.dll

2011-01-13 19:36:34 48471 ----a-w- c:\windows\system32\ForceBindIP-Uninstaller.exe

2011-01-07 14:09:02 290048 ----a-w- c:\windows\system32\atmfd.dll

2010-12-31 13:10:33 1854976 ----a-w- c:\windows\system32\win32k.sys

.

============= FINISH: 18:08:16.09 ===============

Now the OTL log...

OTL logfile created on: 3/25/2011 6:04:30 PM - Run 3

OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Terry\Desktop

Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 82.00% Memory free

5.00 Gb Paging File | 5.00 Gb Available in Paging File | 93.00% Paging File free

Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 465.75 Gb Total Space | 97.31 Gb Free Space | 20.89% Space Free | Partition Type: NTFS

Drive H: | 7.55 Gb Total Space | 0.90 Gb Free Space | 11.87% Space Free | Partition Type: FAT32

Computer Name: LLAMA-09F031757 | User Name: Terry | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Terry\Desktop\OTL.exe (OldTimer Tools)

PRC - C:\Appz\Firefox\firefox.exe (Mozilla Corporation)

PRC - C:\Appz\Avast5\Setup\avast.setup (AVAST Software)

PRC - C:\Appz\Avast5\AvastUI.exe (AVAST Software)

PRC - C:\Appz\Avast5\AvastSvc.exe (AVAST Software)

PRC - C:\Appz\Freecorder\FLVSrvc.exe (Applian Technologies, Inc.)

PRC - C:\Program Files\DeviceVM\Browser Configuration Utility\BCUService.exe (DeviceVM, Inc.)

PRC - C:\Program Files\DeviceVM\Browser Configuration Utility\BCU.exe (DeviceVM, Inc.)

PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Terry\Local Settings\Application Data\FLVService\lib\FLVSrvLib.dll (Applian Technologies, Inc.)

MOD - C:\Documents and Settings\Terry\Desktop\OTL.exe (OldTimer Tools)

MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)

MOD - C:\Appz\IconPackager\iprepair.dll (Stardock.net, Inc)

MOD - C:\WINDOWS\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcr90.dll (Microsoft Corporation)

MOD - C:\WINDOWS\system32\wbsys.dll (Stardock.Net, Inc)

========== Win32 Services (SafeList) ==========

SRV - (Nomad) -- File not found

SRV - (HidServ) -- File not found

SRV - (avast! Web Scanner) -- C:\Appz\Avast5\AvastSvc.exe (AVAST Software)

SRV - (avast! Mail Scanner) -- C:\Appz\Avast5\AvastSvc.exe (AVAST Software)

SRV - (avast! Antivirus) -- C:\Appz\Avast5\AvastSvc.exe (AVAST Software)

SRV - (rpcapd) Remote Packet Capture Protocol v.0 (experimental) -- C:\Program Files\WinPcap\rpcapd.exe (CACE Technologies, Inc.)

SRV - (AppleChargerSrv) -- C:\WINDOWS\system32\AppleChargerSrv.exe ()

SRV - (BCUService) -- C:\Program Files\DeviceVM\Browser Configuration Utility\BCUService.exe (DeviceVM, Inc.)

========== Driver Services (SafeList) ==========

DRV - (TS_AR5416) -- C:\WINDOWS\system32\drivers\ts_athw.sys (TamoSoft)

DRV - (ati2mtag) -- C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)

DRV - (aswSnx) -- C:\WINDOWS\System32\drivers\aswSnx.sys (AVAST Software)

DRV - (aswTdi) -- C:\WINDOWS\System32\drivers\aswTdi.sys (AVAST Software)

DRV - (aswSP) -- C:\WINDOWS\System32\drivers\aswSP.sys (AVAST Software)

DRV - (aswRdr) -- C:\WINDOWS\System32\drivers\aswRdr.sys (AVAST Software)

DRV - (aswMon2) -- C:\WINDOWS\System32\drivers\aswmon2.sys (AVAST Software)

DRV - (aswFsBlk) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys (AVAST Software)

DRV - (Aavmker4) -- C:\WINDOWS\System32\drivers\aavmker4.sys (AVAST Software)

DRV - (NPF) -- C:\WINDOWS\system32\drivers\npf.sys (CACE Technologies, Inc.)

DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)

DRV - (AppleCharger) -- C:\WINDOWS\system32\drivers\AppleCharger.sys ()

DRV - (nvgts) -- C:\WINDOWS\system32\DRIVERS\nvgts.sys (NVIDIA Corporation)

DRV - (nvnetbus) -- C:\WINDOWS\system32\drivers\nvnetbus.sys (NVIDIA Corporation)

DRV - (NVENETFD) -- C:\WINDOWS\system32\drivers\NVENETFD.sys (NVIDIA Corporation)

DRV - (AR5416) -- C:\WINDOWS\system32\drivers\athw.sys (Atheros Communications, Inc.)

DRV - (Monfilt) -- C:\WINDOWS\system32\drivers\Monfilt.sys (Creative Technology Ltd.)

DRV - (Ambfilt) -- C:\WINDOWS\system32\drivers\Ambfilt.sys (Creative)

DRV - (nm) -- C:\WINDOWS\system32\drivers\nmnt.sys (Microsoft Corporation)

DRV - (ATITool) -- C:\WINDOWS\system32\drivers\ATITool.sys ()

DRV - (SCDEmu) -- C:\WINDOWS\System32\drivers\scdemu.sys (PowerISO Computing, Inc.)

DRV - (AtiHdmiService) -- C:\WINDOWS\system32\drivers\AtiHdmi.sys (ATI Research Inc.)

DRV - (ts_lb) -- C:\WINDOWS\system32\drivers\ts_lb.sys (TamoSoft)

DRV - (AmdPPM) -- C:\WINDOWS\system32\drivers\AmdPPM.sys (Advanced Micro Devices)

DRV - (athr) -- C:\WINDOWS\system32\drivers\athr.sys (Atheros Communications, Inc.)

DRV - (CV2K1) -- C:\WINDOWS\system32\drivers\cv2k1.sys (TamoSoft)

DRV - (NSNDIS5) -- C:\WINDOWS\system32\nsndis5.sys (Printing Communications Assoc., Inc. (PCAUSA))

========== Standard Registry (All) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/

IE - HKCU\..\URLSearchHook: {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files\Freecorder\prxtbFre0.dll (Conduit Ltd.)

IE - HKCU\..\URLSearchHook: {BC86E1AB-EDA5-4059-938F-CE307B0C6F0A} - C:\Program Files\DeviceVM\Browser Configuration Utility\AddressBarSearch.dll (DeviceVM, Inc.)

IE - HKCU\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\WINDOWS\system32\ieframe.dll (Microsoft Corporation)

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "www.google.com"

FF - prefs.js..extensions.enabledItems: {20a82645-c095-46ed-80e3-08825760534b}:1.2.1

FF - prefs.js..extensions.enabledItems: {8b86149f-01fb-4842-9dd8-4d7eb02fd055}:0.21.1

FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23

FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0

FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.16

FF - prefs.js..network.proxy.type: 0

FF - HKLM\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b}: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2010/12/12 02:48:50 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Firefox\Extensions\\jqs@sun.com: C:\Program Files\Java\jre6\lib\deploy\jqs\ff [2011/01/20 00:50:52 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.16\extensions\\Components: C:\Appz\Firefox\components [2011/03/24 12:09:59 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.16\extensions\\Plugins: C:\Appz\Firefox\plugins [2011/03/24 12:09:58 | 000,000,000 | ---D | M]

[2010/12/14 03:15:52 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Terry\Application Data\Mozilla\Extensions

[2010/12/14 03:15:52 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Terry\Application Data\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}

[2011/03/25 17:44:19 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Terry\Application Data\Mozilla\Firefox\Profiles\hsh5e79q.default\extensions

[2011/03/13 13:30:36 | 000,000,000 | ---D | M] (Freecorder Toolbar) -- C:\Documents and Settings\Terry\Application Data\Mozilla\Firefox\Profiles\hsh5e79q.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}

[2010/12/15 22:58:39 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Terry\Application Data\Mozilla\Firefox\Profiles\hsh5e79q.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}

[2010/12/15 15:16:13 | 000,000,000 | ---D | M] (All-in-One Gestures) -- C:\Documents and Settings\Terry\Application Data\Mozilla\Firefox\Profiles\hsh5e79q.default\extensions\{8b86149f-01fb-4842-9dd8-4d7eb02fd055}

[2011/01/09 20:19:42 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Documents and Settings\Terry\Application Data\Mozilla\Firefox\Profiles\hsh5e79q.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}

[2011/01/25 18:09:30 | 000,000,000 | ---D | M] ("TrackerBlock") -- C:\Documents and Settings\Terry\Application Data\Mozilla\Firefox\Profiles\hsh5e79q.default\extensions\trackerblock@privacychoice(2).org

[2011/01/20 00:51:01 | 000,000,000 | ---D | M] (Java Console) -- C:\APPZ\FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}

[2011/01/20 00:50:52 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF

O1 HOSTS File: ([2011/03/25 17:23:07 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 localhost

O2 - BHO: (Freecorder Toolbar) - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files\Freecorder\prxtbFre0.dll (Conduit Ltd.)

O2 - BHO: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)

O2 - BHO: (Java Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)

O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)

O3 - HKLM\..\Toolbar: (Freecorder Toolbar) - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files\Freecorder\prxtbFre0.dll (Conduit Ltd.)

O3 - HKCU\..\Toolbar\ShellBrowser: (&Address) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)

O3 - HKCU\..\Toolbar\WebBrowser: (&Address) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)

O3 - HKCU\..\Toolbar\WebBrowser: (&Links) - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)

O3 - HKCU\..\Toolbar\WebBrowser: (Freecorder Toolbar) - {1392B8D2-5C05-419F-A8F6-B9F15A596612} - C:\Program Files\Freecorder\prxtbFre0.dll (Conduit Ltd.)

O4 - HKLM..\Run: [avast5] C:\Appz\Avast5\avastUI.exe (AVAST Software)

O4 - HKLM..\Run: [bCU] C:\Program Files\DeviceVM\Browser Configuration Utility\BCU.exe (DeviceVM, Inc.)

O4 - HKLM..\Run: [Freecorder FLV Service] C:\Appz\Freecorder\FLVSrvc.exe (Applian Technologies, Inc.)

O4 - HKLM..\Run: [XboxStat] c:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe (Microsoft Corporation)

O4 - HKCU..\Run: [Messenger (Yahoo!)] C:\Appz\Messenger\YahooMessenger.exe (Yahoo! Inc.)

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe (Microsoft Corporation)

O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\WINDOWS\system32\winrnr.dll (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\WINDOWS\system32\rsvpsp.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\WINDOWS\system32\rsvpsp.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1292133625515 (MUWebControl Class)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)

O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 213.109.65.68 213.109.75.214 1.1.1.1

O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\system32\msvidctl.dll (Microsoft Corporation)

O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\gopher {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)

O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)

O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)

O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)

O18 - Protocol\Handler\ipp - No CLSID value found

O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)

O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll (Microsoft Corporation)

O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\WINDOWS\system32\inetcomm.dll (Microsoft Corporation)

O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp - No CLSID value found

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)

O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll (Microsoft Corporation)

O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Handler\sysimage {76E67A63-06E9-11D2-A840-006008059382} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\system32\msvidctl.dll (Microsoft Corporation)

O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Handler\wia {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\system32\wiascr.dll (Microsoft Corporation)

O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation)

O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation)

O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation)

O18 - Protocol\Filter\Class Install Handler {32B533BB-EDAE-11d0-BD5A-00AA00B92AF1} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Filter\deflate {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Filter\gzip {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Filter\lzdhtml {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Filter\text/webviewhtml {733AC4CB-F1A4-11d0-B951-00A0C90312E1} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)

O20 - AppInit_DLLs: (C:\WINDOWS\system32\wbsys.dll) - C:\WINDOWS\system32\wbsys.dll (Stardock.Net, Inc)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UIHost - (logonui.exe) - C:\WINDOWS\System32\logonui.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (rundll32 shell32) - C:\WINDOWS\System32\shell32.dll (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - C:\WINDOWS\System32\sysdm.cpl (Microsoft Corporation)

O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)

O20 - Winlogon\Notify\crypt32chain: DllName - crypt32.dll - C:\WINDOWS\System32\crypt32.dll (Microsoft Corporation)

O20 - Winlogon\Notify\cryptnet: DllName - cryptnet.dll - C:\WINDOWS\System32\cryptnet.dll (Microsoft Corporation)

O20 - Winlogon\Notify\cscdll: DllName - cscdll.dll - C:\WINDOWS\System32\cscdll.dll (Microsoft Corporation)

O20 - Winlogon\Notify\dimsntfy: DllName - %SystemRoot%\System32\dimsntfy.dll - C:\WINDOWS\system32\dimsntfy.dll (Microsoft Corporation)

O20 - Winlogon\Notify\ScCertProp: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)

O20 - Winlogon\Notify\Schedule: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)

O20 - Winlogon\Notify\sclgntfy: DllName - sclgntfy.dll - C:\WINDOWS\System32\sclgntfy.dll (Microsoft Corporation)

O20 - Winlogon\Notify\SensLogn: DllName - WlNotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)

O20 - Winlogon\Notify\termsrv: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)

O20 - Winlogon\Notify\wlballoon: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)

O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)

O21 - SSODL: IconPackager Repair - {1799460C-0BC8-4865-B9DF-4A36CD703FF0} - C:\Appz\IconPackager\iprepair.dll (Stardock.net, Inc)

O21 - SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)

O21 - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} - C:\WINDOWS\system32\stobject.dll (Microsoft Corporation)

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\WINDOWS\system32\webcheck.dll (Microsoft Corporation)

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll (Microsoft Corporation)

O22 - SharedTaskScheduler: {438755C2-A8BA-11D1-B96B-00A0C90312E1} - Browseui preloader - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)

O22 - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Component Categories cache daemon - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)

O24 - Desktop Components:0 (My Current Home Page) - About:Home

O24 - Desktop WallPaper: C:\Documents and Settings\Terry\Local Settings\Application Data\Microsoft\Wallpaper1.bmp

O24 - Desktop BackupWallPaper: C:\Documents and Settings\Terry\Local Settings\Application Data\Microsoft\Wallpaper1.bmp

O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - C:\WINDOWS\System32\shell32.dll (Microsoft Corporation)

O29 - HKLM SecurityProviders - (msapsspc.dll) - C:\WINDOWS\System32\msapsspc.dll (Microsoft Corporation)

O29 - HKLM SecurityProviders - (schannel.dll) - C:\WINDOWS\System32\schannel.dll (Microsoft Corporation)

O29 - HKLM SecurityProviders - (digest.dll) - C:\WINDOWS\System32\digest.dll (Microsoft Corporation)

O29 - HKLM SecurityProviders - (msnsspc.dll) - C:\WINDOWS\System32\msnsspc.dll (Microsoft Corporation)

O30 - LSA: Authentication Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation)

O30 - LSA: Security Packages - (kerberos) - C:\WINDOWS\System32\kerberos.dll (Microsoft Corporation)

O30 - LSA: Security Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation)

O30 - LSA: Security Packages - (schannel) - C:\WINDOWS\System32\schannel.dll (Microsoft Corporation)

O30 - LSA: Security Packages - (wdigest) - C:\WINDOWS\System32\wdigest.dll (Microsoft Corporation)

O31 - SafeBoot: AlternateShell - cmd.exe

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2010/12/12 01:12:21 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *) - File not found

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = ComFile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found

NetSvcs: HidServ - File not found

NetSvcs: Ias - File not found

NetSvcs: Iprip - File not found

NetSvcs: Irmon - File not found

NetSvcs: NWCWorkstation - File not found

NetSvcs: Nwsapagent - File not found

NetSvcs: WmdmPmSp - File not found

========== Files/Folders - Created Within 30 Days ==========

[2011/03/25 17:44:47 | 000,000,000 | -HSD | C] -- C:\RECYCLER

[2011/03/25 17:27:11 | 000,580,608 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Terry\Desktop\OTL.exe

[2011/03/25 16:50:26 | 000,000,000 | ---D | C] -- C:\Program Files\ESET

[2011/03/21 16:27:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Terry\Application Data\Google

[2011/03/21 03:27:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Terry\Desktop\Astral Travel for Beginners - Richard Webster

[2011/03/17 17:04:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\TQVault

[2011/03/17 11:00:58 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Terry\Local Settings\Application Data\ConduitEngine

[2011/03/17 11:00:57 | 000,000,000 | ---D | C] -- C:\Program Files\ConduitEngine

[2011/03/13 13:29:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Terry\Local Settings\Application Data\Conduit

[2011/03/13 13:29:22 | 000,000,000 | ---D | C] -- C:\Program Files\Conduit

[2011/03/13 13:29:21 | 000,000,000 | ---D | C] -- C:\Program Files\Freecorder

[2011/03/13 13:29:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Terry\Local Settings\Application Data\Freecorder

[2011/03/13 13:27:08 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Terry\Start Menu\Programs\Freecorder

[2011/03/13 13:11:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Terry\Local Settings\Application Data\EZSoftMagic

[2011/03/13 13:11:37 | 000,000,000 | ---D | C] -- C:\Program Files\v0cNs188Hm

[2011/03/11 18:45:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Terry\Desktop\New Movies - 3-11-11

[2011/03/09 15:15:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Terry\Local Settings\Application Data\Adobe

[2011/03/09 15:15:09 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe

[2011/03/09 13:48:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Terry\Local Settings\Application Data\TQVault

[2011/03/07 17:32:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Xbox 360 Accessories

[2011/03/07 17:32:55 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Xbox 360 Accessories

[2011/03/07 17:31:59 | 000,000,000 | ---D | C] -- C:\Program Files\XBox 360 Controller for Windows Software

[2011/03/07 16:50:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Terry\Application Data\fofix

[2011/03/06 14:53:18 | 000,000,000 | ---D | C] -- C:\Program Files\THQ

[2011/03/06 14:40:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Documents\STALKER-SHOC

[2011/03/06 14:30:27 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Terry\Recent

[2011/03/06 13:19:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Guitar Pro 5

[2011/02/28 12:50:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Terry\Local Settings\Application Data\Secunia PSI

[2011/02/24 14:03:38 | 000,090,112 | ---- | C] (MindVision Software) -- C:\WINDOWS\unvise32.exe

[2011/02/24 14:03:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\AiroWizard 1.0 Beta

[78 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

[6 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp -> ]

[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/03/25 17:48:05 | 000,002,065 | ---- | M] () -- C:\Documents and Settings\Terry\Desktop\Attach.zip

[2011/03/25 17:41:27 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2011/03/25 17:39:17 | 000,625,664 | ---- | M] () -- C:\Documents and Settings\Terry\Desktop\dds.scr

[2011/03/25 17:38:43 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\Terry\defogger_reenable

[2011/03/25 17:37:14 | 000,050,477 | ---- | M] () -- C:\Documents and Settings\Terry\Desktop\Defogger.exe

[2011/03/25 17:27:18 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Terry\Desktop\OTL.exe

[2011/03/25 17:23:07 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts

[2011/03/25 17:14:51 | 004,302,235 | R--- | M] () -- C:\Documents and Settings\Terry\Desktop\Comfix.exe

[2011/03/25 17:02:33 | 001,006,778 | ---- | M] () -- C:\Documents and Settings\Terry\Desktop\rkill.exe

[2011/03/25 16:45:41 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2011/03/17 17:31:26 | 000,101,440 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2011/03/17 17:05:53 | 000,481,330 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat

[2011/03/17 17:05:53 | 000,079,278 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat

[2011/03/17 17:04:50 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK

[2011/03/08 15:44:49 | 000,098,304 | ---- | M] (Sony DADC Austria AG.) -- C:\WINDOWS\System32\CmdLineExt.dll

[2011/03/07 17:28:47 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\Msft_Kernel_xusb21_01005.Wdf

[2011/03/07 17:28:45 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf

[2011/03/06 12:14:13 | 000,000,041 | ---- | M] () -- C:\WINDOWS\lz_tcm.ini

[78 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

[6 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp -> ]

[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/03/25 17:48:05 | 000,002,065 | ---- | C] () -- C:\Documents and Settings\Terry\Desktop\Attach.zip

[2011/03/25 17:39:14 | 000,625,664 | ---- | C] () -- C:\Documents and Settings\Terry\Desktop\dds.scr

[2011/03/25 17:38:43 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Terry\defogger_reenable

[2011/03/25 17:37:13 | 000,050,477 | ---- | C] () -- C:\Documents and Settings\Terry\Desktop\Defogger.exe

[2011/03/25 17:06:35 | 004,302,235 | R--- | C] () -- C:\Documents and Settings\Terry\Desktop\Comfix.exe

[2011/03/25 17:02:26 | 001,006,778 | ---- | C] () -- C:\Documents and Settings\Terry\Desktop\rkill.exe

[2011/03/07 17:34:23 | 000,167,648 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat

[2011/03/07 17:28:47 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\Msft_Kernel_xusb21_01005.Wdf

[2011/03/07 17:28:45 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf

[2011/03/07 17:28:43 | 000,001,374 | ---- | C] () -- C:\WINDOWS\imsins.BAK

[2011/03/06 12:14:07 | 000,000,041 | ---- | C] () -- C:\WINDOWS\lz_tcm.ini

[2011/03/04 15:17:03 | 000,040,960 | R--- | C] () -- C:\WINDOWS\System32\psfind.dll

[2011/02/23 13:53:43 | 000,014,051 | ---- | C] () -- C:\WINDOWS\System32\RaCoInst.dat

[2011/02/18 18:30:39 | 000,000,023 | ---- | C] () -- C:\WINDOWS\BlendSettings.ini

[2011/01/30 18:18:34 | 000,000,980 | ---- | C] () -- C:\WINDOWS\eReg.dat

[2011/01/25 18:31:47 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe

[2011/01/25 18:31:47 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe

[2011/01/25 18:31:47 | 000,089,088 | ---- | C] () -- C:\WINDOWS\MBR.exe

[2011/01/25 18:31:47 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe

[2011/01/25 18:31:47 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe

[2011/01/22 12:58:04 | 000,002,560 | ---- | C] () -- C:\WINDOWS\_MSRSTRT.EXE

[2011/01/13 15:36:34 | 000,048,471 | ---- | C] () -- C:\WINDOWS\System32\ForceBindIP-Uninstaller.exe

[2010/12/26 16:21:34 | 000,000,565 | ---- | C] () -- C:\Documents and Settings\Terry\Application Data\myMPQ.ini

[2010/12/16 20:13:37 | 000,000,021 | ---- | C] () -- C:\WINDOWS\WB.ini

[2010/12/16 19:19:23 | 000,004,568 | ---- | C] () -- C:\WINDOWS\langorig.ini

[2010/12/16 19:19:01 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\wbload.dll

[2010/12/15 14:46:51 | 000,044,544 | ---- | C] () -- C:\WINDOWS\System32\GIF89.DLL

[2010/12/15 14:46:50 | 000,484,352 | ---- | C] () -- C:\WINDOWS\System32\lame_enc.dll

[2010/12/14 03:10:24 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat

[2010/12/12 09:00:44 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI

[2010/12/12 08:58:13 | 000,101,440 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2010/12/12 02:32:35 | 000,000,000 | ---- | C] () -- C:\WINDOWS\ativpsrm.bin

[2010/12/12 02:32:17 | 000,887,724 | ---- | C] () -- C:\WINDOWS\System32\ativva6x.dat

[2010/12/12 02:32:17 | 000,223,990 | ---- | C] () -- C:\WINDOWS\System32\atiicdxx.dat

[2010/12/12 02:32:17 | 000,000,003 | ---- | C] () -- C:\WINDOWS\System32\ativva5x.dat

[2010/12/12 02:05:37 | 000,001,324 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat

[2010/12/12 02:01:45 | 000,031,272 | ---- | C] () -- C:\WINDOWS\System32\AppleChargerSrv.exe

[2010/12/12 02:01:45 | 000,019,496 | ---- | C] () -- C:\WINDOWS\System32\drivers\AppleCharger.sys

[2010/12/12 01:25:07 | 000,010,084 | R--- | C] () -- C:\WINDOWS\System32\drivers\nvphy.bin

[2010/12/12 01:20:45 | 000,207,400 | R--- | C] () -- C:\WINDOWS\GSetup.exe

[2010/12/12 01:20:45 | 000,000,010 | ---- | C] () -- C:\WINDOWS\GSetup.ini

[2010/12/12 01:14:07 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat

[2010/12/12 01:08:35 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat

[2010/06/25 13:03:12 | 000,053,299 | ---- | C] () -- C:\WINDOWS\System32\pthreadVC.dll

[2009/09/17 07:26:52 | 000,007,168 | ---- | C] () -- C:\WINDOWS\System32\ForceBindIP.exe

[2008/10/28 18:40:48 | 000,173,552 | ---- | C] () -- C:\WINDOWS\System32\xlive.dll.cat

[2007/08/08 12:54:10 | 000,028,968 | ---- | C] () -- C:\WINDOWS\System32\drivers\ATITool.sys

[2005/08/05 15:01:54 | 000,235,008 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll

[2004/08/10 08:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin

[2004/08/10 08:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat

[2004/08/10 08:00:00 | 000,481,330 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat

[2004/08/10 08:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat

[2004/08/10 08:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat

[2004/08/10 08:00:00 | 000,079,278 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat

[2004/08/10 08:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin

[2004/08/10 08:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat

[2004/08/10 08:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat

[2004/08/10 08:00:00 | 000,004,461 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat

[2004/08/10 08:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin

[2004/08/10 08:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat

========== LOP Check ==========

[2011/02/23 16:42:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Alwil Software

[2010/12/14 19:36:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\BVRP Software

[2010/12/18 12:33:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Electronic Arts

[2011/01/30 19:04:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Fallout3

[2011/01/20 00:46:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\FileCure

[2011/02/23 13:53:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Ralink Driver

[2010/12/18 23:14:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Stardock

[2010/12/16 20:19:29 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\{1C533CDB-BAC7-4600-B3DE-0B628D9AC643}

[2010/12/18 23:14:24 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\{1EB63B4B-5639-4477-8E24-05C31B5F8019}

[2011/01/17 22:08:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Terry\Application Data\Atari

[2011/03/07 16:51:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Terry\Application Data\fofix

[2011/01/18 14:07:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Terry\Application Data\Foxit

[2011/01/18 14:08:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Terry\Application Data\Foxit Software

[2010/12/29 18:29:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Terry\Application Data\FreeBurner

[2010/12/26 18:28:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Terry\Application Data\fretsonfire

[2011/02/21 21:16:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Terry\Application Data\gtk-2.0

[2011/01/17 22:07:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Terry\Application Data\Leadertech

[2010/12/20 17:02:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Terry\Application Data\Mael

[2011/03/05 17:01:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Terry\Application Data\runic games

[2011/02/27 17:07:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Terry\Application Data\SPORE

[2010/12/18 23:14:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Terry\Application Data\Stardock

[2011/03/21 17:49:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Terry\Application Data\uTorrent

[2011/02/21 17:30:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Terry\Application Data\Wireshark

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >

[2010/12/12 01:12:21 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT

[2011/01/25 18:04:39 | 000,000,221 | ---- | M] () -- C:\Boot.bak

[2011/02/17 13:30:29 | 000,000,337 | RHS- | M] () -- C:\boot.ini

[2004/08/04 00:00:00 | 000,260,272 | RHS- | M] () -- C:\cmldr

[2010/12/12 01:12:21 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS

[2011/01/25 17:13:55 | 063,116,508 | ---- | M] () -- C:\Entire.reg

[2010/12/12 01:12:21 | 000,000,000 | RHS- | M] () -- C:\IO.SYS

[2010/12/12 01:12:21 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS

[2004/08/10 08:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM

[2010/12/12 02:22:27 | 000,250,048 | RHS- | M] () -- C:\ntldr

[2011/03/25 17:41:24 | 2145,386,496 | -HS- | M] () -- C:\pagefile.sys

< %systemroot%\system32\*.dll /lockedfiles >

[2008/04/13 20:11:51 | 001,267,200 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\comsvcs.dll

[78 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\System32\config\*.sav >

[2010/12/12 08:57:28 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav

[2010/12/12 08:57:28 | 000,659,456 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav

[2010/12/12 08:57:28 | 000,892,928 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

< %systemroot%\system32\drivers\*.sys /90 >

[2011/01/09 10:22:53 | 001,629,992 | ---- | M] (TamoSoft) -- C:\WINDOWS\system32\drivers\ts_athw.sys

< %systemroot%\system32\Spool\prtprocs\w32x86\*.dll >

[2008/07/06 08:06:10 | 000,089,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll

< End of report >

Now the Combofix...

ComboFix 11-03-24.06 - Terry 03/25/2011 18:13:43.5.3 - x86

Running from: c:\documents and settings\Terry\Desktop\Comfix.exe

AV: avast! Antivirus *Disabled/Outdated* {7591DB91-41F0-48A3-B128-1A293FD8233D}

.

((((((((((((((((((((((((( Files Created from 2011-02-25 to 2011-03-25 )))))))))))))))))))))))))))))))

.

2011-03-25 20:50 . 2011-03-25 20:50 -------- d-----w- c:\program files\ESET

2011-03-17 15:00 . 2011-03-17 15:00 0 ----a-w- c:\windows\system32\ConduitEngine.tmp

2011-03-13 17:29 . 2011-03-17 15:00 -------- d-----w- c:\documents and settings\Terry\Local Settings\Application Data\Conduit

2011-03-13 17:29 . 2011-03-13 17:29 -------- d-----w- c:\program files\Conduit

2011-03-13 17:29 . 2011-03-22 22:32 -------- d-----w- c:\documents and settings\Terry\Local Settings\Application Data\Freecorder

2011-03-13 17:29 . 2011-03-17 15:01 -------- d-----w- c:\program files\Freecorder

2011-03-13 17:11 . 2011-03-13 17:11 -------- d-----w- c:\documents and settings\Terry\Local Settings\Application Data\EZSoftMagic

2011-03-13 17:11 . 2011-03-13 17:11 -------- d-----w- c:\program files\v0cNs188Hm

2011-03-09 19:15 . 2011-03-09 19:15 -------- d-----w- c:\documents and settings\Terry\Local Settings\Application Data\Adobe

2011-03-09 19:15 . 2011-03-09 19:15 -------- d-----w- c:\program files\Common Files\Adobe

2011-03-09 17:48 . 2011-03-09 17:48 -------- d-----w- c:\documents and settings\Terry\Local Settings\Application Data\TQVault

2011-03-07 21:32 . 2011-03-07 21:32 -------- d-----w- c:\program files\Microsoft Xbox 360 Accessories

2011-03-07 21:31 . 2011-03-07 21:31 -------- d-----w- c:\program files\XBox 360 Controller for Windows Software

2011-03-07 20:50 . 2011-03-07 20:51 -------- d-----w- c:\documents and settings\Terry\Application Data\fofix

2011-03-06 18:53 . 2011-03-06 18:53 -------- d-----w- c:\program files\THQ

2011-03-04 19:17 . 2007-01-02 00:03 40960 ----a-r- c:\windows\system32\psfind.dll

2011-02-28 16:50 . 2011-02-28 16:50 -------- d-----w- c:\documents and settings\Terry\Local Settings\Application Data\Secunia PSI

2011-02-24 18:03 . 2004-03-29 21:23 90112 ----a-w- c:\windows\unvise32.exe

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-03-08 19:44 . 2010-12-14 05:38 98304 ----a-w- c:\windows\system32\CmdLineExt.dll

2011-02-04 22:48 . 2004-08-10 12:00 456192 ----a-w- c:\windows\system32\encdec.dll

2011-02-04 22:48 . 2004-08-10 12:00 291840 ----a-w- c:\windows\system32\sbe.dll

2011-02-03 16:06 . 2004-08-10 12:00 218624 ----a-w- c:\windows\system32\uxtheme.dll

2011-02-02 07:58 . 2010-12-12 05:05 2067456 ----a-w- c:\windows\system32\mstscax.dll

2011-01-27 11:57 . 2010-12-12 05:05 677888 ----a-w- c:\windows\system32\mstsc.exe

2011-01-25 21:13 . 2011-01-25 21:13 63116508 ----a-w- C:\Entire.reg

2011-01-22 17:51 . 2011-01-22 16:58 2560 ----a-w- c:\windows\_MSRSTRT.EXE

2011-01-21 14:44 . 2004-08-10 12:00 439296 ----a-w- c:\windows\system32\shimgvw.dll

2011-01-20 04:50 . 2011-01-20 04:50 73728 ----a-w- c:\windows\system32\javacpl.cpl

2011-01-20 04:50 . 2011-01-20 04:50 472808 ----a-w- c:\windows\system32\deployJava1.dll

2011-01-13 19:36 . 2011-01-13 19:36 48471 ----a-w- c:\windows\system32\ForceBindIP-Uninstaller.exe

2011-01-09 14:22 . 2010-07-26 17:20 1629992 ----a-w- c:\windows\system32\drivers\ts_athw.sys

2011-01-07 14:09 . 2004-08-10 12:00 290048 ----a-w- c:\windows\system32\atmfd.dll

2010-12-31 13:10 . 2004-08-10 12:00 1854976 ----a-w- c:\windows\system32\win32k.sys

.

((((((((((((((((((((((((((((( SnapShot_2011-03-25_21.23.12 )))))))))))))))))))))))))))))))))))))))))

.

+ 2011-03-25 21:41 . 2011-03-25 21:41 16384 c:\windows\Temp\Perflib_Perfdata_4e8.dat

+ 2010-12-12 05:16 . 2011-03-25 21:41 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat

- 2010-12-12 05:16 . 2011-03-25 20:49 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat

+ 2010-12-12 05:16 . 2011-03-25 21:41 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat

- 2010-12-12 05:16 . 2011-03-25 20:49 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat

+ 2011-01-26 00:13 . 2011-03-25 21:41 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat

- 2011-01-26 00:13 . 2011-03-25 20:49 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{1392b8d2-5c05-419f-a8f6-b9f15a596612}"= "c:\program files\Freecorder\prxtbFre0.dll" [2011-01-17 175912]

.

[HKEY_CLASSES_ROOT\clsid\{1392b8d2-5c05-419f-a8f6-b9f15a596612}]

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1392b8d2-5c05-419f-a8f6-b9f15a596612}]

2011-01-17 14:54 175912 ----a-w- c:\program files\Freecorder\prxtbFre0.dll

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]

2011-01-17 14:54 175912 ----a-w- c:\program files\ConduitEngine\prxConduitEngine.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{1392b8d2-5c05-419f-a8f6-b9f15a596612}"= "c:\program files\Freecorder\prxtbFre0.dll" [2011-01-17 175912]

.

[HKEY_CLASSES_ROOT\clsid\{1392b8d2-5c05-419f-a8f6-b9f15a596612}]

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{1392B8D2-5C05-419F-A8F6-B9F15A596612}"= "c:\program files\Freecorder\prxtbFre0.dll" [2011-01-17 175912]

.

[HKEY_CLASSES_ROOT\clsid\{1392b8d2-5c05-419f-a8f6-b9f15a596612}]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\snxPluginsShell]

@="{F4B3B0AA-13D1-4a36-BDA2-2055B0F3D5DE}"

[HKEY_CLASSES_ROOT\CLSID\{F4B3B0AA-13D1-4a36-BDA2-2055B0F3D5DE}]

2010-09-07 16:14 152160 ----a-w- c:\appz\Avast5\snxPlugins.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"BCU"="c:\program files\DeviceVM\Browser Configuration Utility\BCU.exe" [2009-10-15 375000]

"avast5"="c:\appz\Avast5\avastUI.exe" [2010-09-07 2838912]

"XboxStat"="c:\program files\Microsoft Xbox 360 Accessories\XboxStat.exe" [2007-02-12 734624]

"Freecorder FLV Service"="c:\appz\Freecorder\FLVSrvc.exe" [2010-06-26 167936]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=c:\windows\system32\wbsys.dll

.

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Secunia PSI Tray.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Secunia PSI Tray.lnk

backup=c:\windows\pss\Secunia PSI Tray.lnkCommon Startup

.

[HKLM\~\startupfolder\C:^Documents and Settings^Terry^Start Menu^Programs^Startup^Map Hack 2007.exe]

path=c:\documents and settings\Terry\Start Menu\Programs\Startup\Map Hack 2007.exe

backup=c:\windows\pss\Map Hack 2007.exeStartup

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICustomerCare]

2010-05-04 21:05 311296 ----a-r- c:\program files\ATI\ATICustomerCare\ATICustomerCare.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BCU]

2009-10-15 19:06 375000 ----a-w- c:\program files\DeviceVM\Browser Configuration Utility\BCU.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]

2004-08-10 09:04 59392 ------w- c:\windows\ehome\ehtray.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]

2007-08-07 00:05 200704 ----a-w- c:\appz\PowerISO\PWRISOVM.EXE

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]

2010-04-30 09:22 19523616 ----a-w- c:\windows\RTHDCPL.EXE

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]

2010-10-27 03:37 98304 ----a-w- c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

2010-05-14 16:44 248552 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnlockerAssistant]

2010-07-04 19:51 17408 ----a-w- c:\appz\Unlocker\UnlockerAssistant.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"Nomad"=2 (0x2)

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Appz\\uTorrent\\uTorrent.exe"=

"c:\\Games\\Demigod\\bin\\Demigod.exe"=

"c:\\Games\\Dawn of War\\W40k.exe"=

"c:\\Games\\Prototype\\prototypef.exe"=

"c:\\Games\\Borderlands\\Binaries\\Borderlands.exe"=

"c:\\Games\\StarCraft II\\StarCraft II.exe"=

"c:\\Games\\StarCraft II\\Versions\\Base15405\\SC2.exe"=

"c:\\Appz\\Messenger\\YahooMessenger.exe"=

"c:\\Program Files\\WinPcap\\rpcapd.exe"=

"c:\\Games\\Titan Quest\\Titan Quest.exe"=

"c:\\Games\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\XR_3DA.exe"=

"c:\\Games\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\dedicated\\XR_3DA.exe"=

"c:\\Games\\Emulators\\Nes\\NESTCL95.EXE"=

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management

.

R2 BVRPNDIS;BVRPNDIS Protocol Driver U/I;c:\appz\Connection Manager\BVRPNDIS.SYS [x]

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2009-11-17 1691480]

R3 AppleChargerSrv;AppleChargerSrv;c:\windows\system32\AppleChargerSrv.exe [2010-04-06 31272]

R3 CV2K1;CommView Network Monitor;c:\windows\system32\DRIVERS\cv2k1.sys [2006-12-08 19240]

R3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe [2008-04-14 14336]

R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]

R4 Nomad;Connection Manager;c:\appz\Connection Manager\NomadSvr.exe [x]

S1 AppleCharger;AppleCharger;c:\windows\system32\DRIVERS\AppleCharger.sys [2010-04-27 19496]

S1 aswSnx;aswSnx; [x]

S1 aswSP;aswSP; [x]

S1 ts_lb;ts_lb;c:\windows\system32\drivers\ts_lb.sys [2007-06-20 24096]

S2 aswFsBlk;aswFsBlk; [x]

S2 BCUService;Browser Configuration Utility Service;c:\program files\DeviceVM\Browser Configuration Utility\BCUService.exe [2009-10-15 223464]

S2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2010-06-25 35088]

S3 TS_AR5416;[CommView] Atheros AR5008 Wireless Network Adapter Service 7.7;c:\windows\system32\DRIVERS\ts_athw.sys [2011-01-09 14:22 1629992]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

WINRM REG_MULTI_SZ WINRM

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.google.com/

FF - ProfilePath - c:\documents and settings\Terry\Application Data\Mozilla\Firefox\Profiles\hsh5e79q.default\

FF - prefs.js: browser.startup.homepage - www.google.com

FF - prefs.js: network.proxy.type - 0

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\appz\Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\appz\Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension

FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}

FF - Ext: All-in-One Gestures: {8b86149f-01fb-4842-9dd8-4d7eb02fd055} - %profile%\extensions\{8b86149f-01fb-4842-9dd8-4d7eb02fd055}

FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}

FF - user.js: yahoo.ytff.general.dontshowhpoffer - true

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2011-03-25 18:19

Windows 5.1.2600 Service Pack 3 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_USERS\S-1-5-21-1993962763-1979792683-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID]

@Denied: (Full) (LocalSystem)

.

[HKEY_USERS\S-1-5-21-1993962763-1979792683-839522115-1003\Software\SecuROM\License information*]

@Allowed: (Read) (RestrictedCode)

"datasecu"=hex:b9,5f,f7,0d,68,3e,7a,1d,d3,2b,ec,be,fb,15,1e,c5,ba,6e,5d,3a,87,

f3,70,96,bf,14,8e,6d,97,fb,b3,d7,f2,53,3b,93,e4,8f,fb,16,b9,eb,70,ac,97,48,\

"rkeysecu"=hex:f2,26,6e,de,e9,28,fd,b8,05,0f,ce,ec,b1,73,b0,60

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'winlogon.exe'(696)

c:\windows\system32\Ati2evxx.dll

c:\windows\system32\atiadlxx.dll

.

- - - - - - - > 'explorer.exe'(3840)

c:\windows\system32\WININET.dll

c:\documents and settings\Terry\Local Settings\Application Data\FLVService\lib\FLVSrvLib.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\WPDShServiceObj.dll

c:\appz\IconPackager\iprepair.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

c:\windows\system32\WindowsPowerShell\v1.0\pwrshsip.dll

c:\program files\Microsoft Silverlight\xapauthenticodesip.dll

.

Completion time: 2011-03-25 18:20:31

ComboFix-quarantined-files.txt 2011-03-25 22:20

ComboFix2.txt 2011-02-28 17:06

ComboFix3.txt 2011-02-17 20:38

ComboFix4.txt 2011-01-26 00:13

.

Pre-Run: 104,462,409,728 bytes free

Post-Run: 104,445,997,056 bytes free

.

- - End Of File - - 792A82294667A5974DE4672C4924834B

Attach.zip

LDTate · March 26, 2011

Please don't attach the scans / logs for these tools, use "copy/paste".

DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.

Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.

Vista and Windows 7 users:

1. These tools MUST be run from the executable. (.exe) every time you run them

2. With Admin Rights (Right click, choose "Run as Administrator")

Stay with this topic until I give you the all clean post.

You might want to print these instructions out.

I suggest you do this:

XP Users

Double-click My Computer.

Click the Tools menu, and then click Folder Options.

Click the View tab.

Uncheck "Hide file extensions for known file types."

Under the "Hidden files" folder, select "Show hidden files and folders."

Uncheck "Hide protected operating system files."

Click Apply, and then click OK.

Vista Users

To enable the viewing of hidden and protected system files in Windows Vista please follow these steps:

Close all programs so that you are at your desktop.

Click on the Start button. This is the small round button with the Windows flag in the lower left corner.

Click on the Control Panel menu option.

When the control panel opens you can either be in Classic View or Control Panel Home view:

If you are in the Classic View do the following:

Double-click on the Folder Options icon.

Click on the View tab.

If you are in the Control Panel Home view do the following:

Click on the Appearance and Personalization link.

Click on Show Hidden Files or Folders.

Under the Hidden files and folders section select the radio button labeled Show hidden files and folders.

Remove the checkmark from the checkbox labeled Hide extensions for known file types.

Remove the checkmark from the checkbox labeled Hide protected operating system files.

Please do not delete anything unless instructed to.

I've been seeing some Java infections lately.

Go here and follow the instructions to clear your Java Cache

http://www.java.com/en/download/help/plugin_cache.xml

Next:

Note: Close all browsers before running ATF Cleaner: IE, FireFox, etc.

Please download ATF Cleaner by Atribune.

Download - ATF Cleaner

Haunt · March 26, 2011

Run date: 2011-03-26 11:49:28

-----------------------------

11:49:28.843 OS Version: Windows 5.1.2600 Service Pack 3

11:49:28.843 Number of processors: 3 586 0x503

11:49:28.843 ComputerName: LLAMA-09F031757 UserName: Terry

11:49:30.000 Initialize success

11:49:31.343 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Scsi\nvgts1Port2Path0Target0Lun0

11:49:31.343 Disk 0 Vendor: Hitachi_ JP2O Size: 476940MB BusType: 3

11:49:31.468 Disk 0 MBR read successfully

11:49:31.468 Disk 0 MBR scan

11:49:31.578 Disk 0 scanning sectors +976752000

11:49:31.609 Disk 0 scanning C:\WINDOWS\system32\drivers

11:49:36.109 Service scanning

11:49:36.812 Disk 0 trace - called modules:

11:49:36.828 ntkrnlpa.exe catchme.sys CLASSPNP.SYS disk.sys ACPI.sys hal.dll SCSIPORT.SYS nvgts.sys

11:49:36.843 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8a606480]

11:49:36.843 3 CLASSPNP.SYS[f74c7fd7] -> nt!IofCallDriver -> \Device\0000006c[0x8a6062e8]

11:49:36.843 5 ACPI.sys[f735e620] -> nt!IofCallDriver -> \Device\Scsi\nvgts1Port2Path0Target0Lun0[0x8a5ca030]

11:49:36.843 Scan finished successfully

LDTate · March 26, 2011

No RootKit

Can you post the combofix scan?

Haunt · March 26, 2011