I restarted and now everything is gone :(

greatkibble · October 2, 2011

Well I already posted this before, just in the wrong forum so here we go;

Its so weird this should happen to me; I've been having this problem with my web browsers, Firefox and Chrome. The problem was whenever trying to access certain sites those browsers would freeze up and considerably slow down like a dying dinosaur which would obligate me to manually terminate them by whatever means. After terminating and trying to reopen the browsers I would get errors of profile still open.
For Firefox the only solution was to restart the entire system; for Chrome I only had to open up task manager and end its process - even though there would still be a previous chrome process running after I start up a new one and trying to kill the Firefox process ended with no dice.
Trying to solve this I ran all types of scans to check what was up. I used Ad-aware, Spybot-S&D, I removed Microsoft security Essentials and replaced it with AVG antivirus, I already had installed SuperAntiSpyware but it didn't seem to helping my problem though very helpful in finding some trojans lurking around. I use advanced system care so the Iobit Malware fighter is also part of my virus fighting arsenal. Strangely I always had Malwarebytes but hardly used it because it didn't seem to really protect me nor did it pick up anything during scans which my other programs would normally pick up on so I basically left it in a corner for months but today I just updated it from version 4 to 5 and now I see a big difference in the two and even greater benefits to come along with the later version.
But all in all I fear its too late for me cause right now my entire Window XP OS has restored straight to 'first-date' setting and now everything has renewed and I'm missing many programs which used to be apart of my desktop. They're still there in the hard drive though thankfully. My custom wallpaper is now the windows default grassy plains with clouds above and the little tweaks and custom bits I added to make my pc more 'me' has now been smudged away and rinsed cleanly all back to default settings. I find the defaults really ugly and unappealing - now everything must be started ever once more - but I won't do anything cause I can still tell whatever did this to my registry is still there and that's why I'm posting this!
Before this happened there were a lot of suspicious activity going on in my processes; I could see what in security task manager. I believe 'something' was running all around in windows32 area and overtime disguising theirselves as genuine applications or hiding behind such while modifying things until this happened
Even now its sad to know that malicious things can really destroy the framework of everything in your pc and leave you with a worthless trash that doesn't work. For me its more trouble than its worth to be trying to self fix this - I've been trying to for 3 weeks now with no success! This is what it's come to now =/
I knew of a file, scvlhosts.exe(not sure if that's the correct spelling)that I believe was malicious cause it was found in drive c: but I don't have a drive c: , all i have is C: (notice the capital letters) so I deleted it but still other things weren't going on or at least I think things weren't going on normally.
I learned about this site today as well and was following the first basic procedure for removing malware. I downloaded the defogger tool and ran it but it never prompted me to restart the system(is that normal btw?) ...So getting impatient I went myself to restart the computer and here I am now - and I can't restore anything cause I turned it off, you know, a standard advice given to xp users to not accidentally restore bad data.
I don't have a window backup cd too so I'm just in bad luck
The Iobit malware fighter recently picked up a program trying to modify the registry(while in the new hated mode) but I forgot its name, ctfmon.exe I think - I blocked it but not really sure if that helped. Spybot has been removed from the desktop along with many other programs and when trying to reinstall it back to the desktop I get a runtime error - "Runtime Error (at-1:0): Cannot Import dll:C:\Program Files\Spybot - Search & Destroy\UninsSrv.dll."
I'm so unlucky this is happening, please just try whatever to help me before its too late
Thank you in advance for trying

Here's the most recent Mbam scan log here;

mbam-log-2011-10-02 (04-26-37).txt

I had problems trying to download the GMER scanner - again I'm still having browser lagging and freezing issues. At least I still got through with DDS, the DDS.txt file here;

.

DDS (Ver_2011-08-26.01) - NTFSx86

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_26

Run by C.Henry at 10:08:00 on 2011-10-02

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.906 [GMT -4:00]

.

AV: AVG Anti-Virus Free Edition 2012 *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}

AV: Lavasoft Ad-Watch Live! Anti-Virus *Enabled/Updated* {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33}

AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}

FW: ZoneAlarm Firewall *Enabled*

.

============== Running Processes ===============

.

C:\PROGRA~1\AVG\AVG2012\avgrsx.exe

C:\Program Files\AVG\AVG2012\avgcsrvx.exe

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup

svchost.exe

C:\WINDOWS\system32\ZoneLabs\vsmon.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe

C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\IObit\IObit Malware Fighter\IMFsrv.exe

C:\Program Files\SUPERAntiSpyware\SASCORE.EXE

C:\Program Files\IObit\Advanced SystemCare 4\ASCService.exe

C:\Program Files\AVG\AVG2012\avgwdsvc.exe

C:\Program Files\Microsoft\BingBar\SeaPort.EXE

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files\Nero\Update\NASvc.exe

C:\Program Files\AVG\AVG2012\avgnsx.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\8.0.1\ToolbarUpdater.exe

C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe

C:\WINDOWS\system32\devldr32.exe

svchost.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe

C:\Program Files\AVG\AVG2012\avgtray.exe

C:\Program Files\AVG Secure Search\vprot.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Program Files\IObit\IObit Malware Fighter\IMF.exe

C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Mozilla Firefox\plugin-container.exe

.

============== Pseudo HJT Report ===============

.

uURLSearchHooks: H - No File

mWinlogon: UIHost=c:\documents and settings\all users\application data\tuneup software\tu2011\winstyler\tu_logonui.exe

BHO: AutorunsDisabled - No File

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Conduit Engine : {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\prxConduitEngine.dll

BHO: DivX Plus Web Player HTML5 <video>: {326e768d-4182-46fd-9c16-1449a49795f4} - c:\program files\divx\divx plus web player\npdivx32.dll

BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg2012\avgssie.dll

BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot - search & destroy\SDHelper.dll

BHO: DivX HiQ: {593ddec6-7468-4cdd-90e1-42dadaa222e9} - c:\program files\divx\divx plus web player\npdivx32.dll

BHO: BitTorrentBar Toolbar: {88c7f2aa-f93f-432c-8f0e-b7d85967a527} - c:\program files\bittorrentbar\prxtbBit2.dll

BHO: {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - No File

BHO: {91da5e8a-3318-4f8c-b67e-5964de3ab546} - No File

BHO: AVG Security Toolbar: {95b7759c-8c7f-4bf1-b163-73684a933233} - c:\program files\avg secure search\8.0.0.34\AVG Secure Search_toolbar.dll

BHO: CBHO Object: {cba74cda-df78-4ad9-954e-3b15d0a993de} - c:\program files\corestreet\spoofstick\SpoofStickBHO.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: BitTorrentBar Toolbar: {88c7f2aa-f93f-432c-8f0e-b7d85967a527} - c:\program files\bittorrentbar\prxtbBit2.dll

TB: SpoofStick: {4d46ed77-1429-4cf6-8f63-c84b5d710baf} - c:\program files\corestreet\spoofstick\SpoofStick.dll

TB: {91da5e8a-3318-4f8c-b67e-5964de3ab546} - No File

TB: Conduit Engine : {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\prxConduitEngine.dll

TB: AVG Security Toolbar: {95b7759c-8c7f-4bf1-b163-73684a933233} - c:\program files\avg secure search\8.0.0.34\AVG Secure Search_toolbar.dll

{e7df6bff-55a5-4eb7-a673-4ed3e9456d39}

mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [ZoneAlarm Client] "c:\program files\zone labs\zonealarm\zlclient.exe"

mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime

mRun: [iObit Malware Fighter] "c:\program files\iobit\iobit malware fighter\IMF.exe" /autostart

mRun: [AVG_TRAY] "c:\program files\avg\avg2012\avgtray.exe"

mRun: [vProt] "c:\program files\avg secure search\vprot.exe"

mRun: [iSW] "c:\program files\checkpoint\zaforcefield\ForceField.exe" /icon="hidden"

mRun: [nwiz] nwiz.exe /install

mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit

mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll

IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot - search & destroy\SDHelper.dll

DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab

DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6770.cab

DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1290136917968

DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1282520954890

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

TCP: DhcpNameServer = 63.245.66.41 63.245.66.42

TCP: Interfaces\{031219DC-6F85-4FF2-B3BF-A18390BC98F3} : DhcpNameServer = 63.245.66.41 63.245.66.42

TCP: Interfaces\{B0976CA2-33CD-4EFD-AAC2-6DCFB3AB5BF8} : DhcpNameServer = 63.245.66.41 63.245.66.42

Handler: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - c:\program files\hp\hpcoretech\comp\hpuiprot.dll

Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg2012\avgpp.dll

Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\common files\avg secure search\viprotocolinstaller\8.0.1\ViProtocol.dll

Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL

Hosts: 127.0.0.1 www.spywareinfo.com

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\documents and settings\c.henry.upgrade\application data\mozilla\firefox\profiles\5iierj4b.default\

.

============= SERVICES / DRIVERS ===============

.

=============== Created Last 30 ================

.

==================== Find3M ====================

.

============= FINISH: 10:10:22.64 ===============

Again I really appreciate anyone helping with my problem(Y)

attach.zip

greatkibble · October 4, 2011

*bumping thread*

Also I ran safe mode and ran the Gmer scanner which is attached in this thread

Again, thanks in advance

greatkibble · October 4, 2011

oops forgot to attach the file he silly me...

ark.zip

greatkibble · October 6, 2011

*bump bump*

greatkibble · October 8, 2011

Hello again even though no one hasn't replied to my thread yet.

I'm just updating here to tell I now have a windows backup disk so I'm gonna clean this computer.

I just wish I could get a reply sooner so I could be guided through this process; I'll just look around this forum concerning that, until someone posts here...

AdvancedSetup · October 8, 2011

Hello and sorry for the delay but as you can tell the site is quite busy,

Please visit this webpage for instructions for running ComboFix:

When the tool is finished, it will produce a report for you.
Please post the C:\ComboFix.txt along with a new DDS log so we may continue cleaning the system.

greatkibble · October 9, 2011

It's ok, I'm happy you came

Here's the Combofix logfile;

ComboFix 11-10-08.05 - C.Henry 10/08/2011 19:51:31.1.1 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.888 [GMT -4:00]

Running from: c:\documents and settings\C.Henry.UPGRADE\Desktop\ComboFix.exe

AV: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}

AV: Lavasoft Ad-Watch Live! Anti-Virus *Disabled/Updated* {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33}

AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}

FW: ZoneAlarm Firewall *Disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\C.Henry.UPGRADE\Application Data\PriceGong

c:\documents and settings\C.Henry.UPGRADE\Application Data\PriceGong\Data\mru.xml

c:\windows\system32\d3d9caps.dat

c:\windows\system32\drivers\etc\hosts.txt

.

((((((((((((((((((((((((( Files Created from 2011-09-09 to 2011-10-09 )))))))))))))))))))))))))))))))

.

2011-10-08 22:02 . 2011-10-08 22:02 -------- d-----w- c:\windows\LastGood

2011-10-08 20:19 . 2011-10-08 20:20 -------- d-----w- c:\program files\Sony Media Go Install

2011-10-04 02:50 . 2011-10-09 00:06 -------- d-----w- c:\program files\SPYBOT - SEARCH & DESTROY

2011-10-02 06:44 . 2011-09-21 18:59 16432 ----a-w- c:\windows\system32\lsdelete.exe

2011-10-02 01:09 . 2011-10-08 18:41 -------- d-----w- c:\documents and settings\C.Henry.UPGRADE

2011-10-01 22:25 . 2011-10-08 08:15 -------- d-----w- c:\program files\MALWAREBYTES ANTI-MALWARE

2011-10-01 17:43 . 2011-10-01 17:43 -------- d-----w- c:\documents and settings\All Users\Application Data\UAB

2011-10-01 17:42 . 2011-10-01 17:42 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Drivers HeadQuarters

2011-10-01 17:39 . 2011-10-01 17:39 -------- d-----w- c:\program files\PC Drivers HeadQuarters

2011-10-01 04:21 . 2011-10-01 04:21 -------- d--h--w- c:\windows\PIF

2011-09-30 16:17 . 2011-10-01 23:35 -------- d-----w- c:\documents and settings\All Users\Application Data\SecTaskMan

2011-09-30 16:16 . 2011-10-01 04:50 -------- d-----w- c:\program files\Security Task Manager

2011-09-30 06:45 . 2011-09-30 06:45 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache

2011-09-29 15:45 . 2011-09-29 15:45 50688 ----a-w- C:\ATF-Cleaner.exe

2011-09-29 01:05 . 2011-09-29 01:05 2521 ----a-w- C:\xp_taskbar_desktop_fixall.vbs

2011-09-29 01:03 . 2011-09-29 01:04 262 ----a-w- C:\wallpaperviews.vbs

2011-09-28 02:15 . 2011-09-28 02:15 -------- d-----w- c:\program files\SystemRequirementsLab

2011-09-27 21:06 . 2011-10-01 03:20 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

2011-09-24 18:58 . 2011-09-21 18:59 101720 ----a-w- c:\windows\system32\drivers\SBREDrv.sys

2011-09-22 15:58 . 2011-09-22 15:58 -------- d-----w- C:\$AVG

2011-09-22 15:20 . 2011-09-22 15:20 -------- d-----w- c:\program files\Common Files\AVG Secure Search

2011-09-22 15:20 . 2011-09-22 15:20 -------- d-----w- c:\program files\AVG Secure Search

2011-09-22 15:19 . 2011-10-07 13:03 -------- d-----w- c:\windows\system32\drivers\AVG

2011-09-22 15:19 . 2011-09-22 15:37 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG2012

2011-09-21 18:54 . 2011-08-18 19:25 64512 ----a-w- c:\windows\system32\drivers\Lbd.sys

2011-09-21 18:53 . 2011-09-21 18:53 -------- d-----w- c:\program files\Lavasoft

2011-09-21 18:53 . 2011-09-21 18:54 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft

2011-09-11 12:30 . 2011-09-11 12:30 -------- d-----w- c:\documents and settings\All Users\Application Data\iolo

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-10-01 15:02 . 2004-08-04 12:00 507904 ----a-w- c:\windows\system32\winlogon.exe

2011-10-01 04:57 . 2007-11-07 12:12 232960 ----a-w- C:\VC_RED.MSI

2011-10-01 02:12 . 2003-10-06 18:16 7700480 ----a-w- c:\windows\system32\nvcpl.dll

2011-09-30 22:56 . 2004-08-04 12:00 270848 ----a-w- c:\windows\system32\sbe.dll

2011-09-30 19:19 . 2004-08-04 12:00 33280 ----a-w- c:\windows\system32\rundll32.exe

2011-09-29 12:02 . 2011-05-16 11:21 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-09-27 19:32 . 2004-08-04 12:00 142336 ----a-w- c:\windows\system32\nwprovau.dll

2011-09-13 10:30 . 2011-07-11 05:13 32592 ----a-w- c:\windows\system32\drivers\avgrkx86.sys

2011-09-09 09:12 . 2004-08-04 12:00 599040 ----a-w- c:\windows\system32\crypt32.dll

2011-08-31 21:00 . 2010-11-07 12:48 22216 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-08-19 20:33 . 2011-09-06 00:27 25944 ----a-w- c:\windows\system32\SmartDefragBootTime.exe

2011-08-08 10:08 . 2011-08-08 10:08 40016 ----a-w- c:\windows\system32\drivers\avgmfx86.sys

2011-07-15 13:29 . 2004-08-04 12:00 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys

2011-07-11 05:14 . 2011-07-11 05:14 295248 ----a-w- c:\windows\system32\drivers\avgtdix.sys

2011-07-11 05:14 . 2011-07-11 05:14 16720 ----a-w- c:\windows\system32\drivers\AVGIDSShim.sys

2011-07-11 05:14 . 2011-07-11 05:14 24272 ----a-w- c:\windows\system32\drivers\AVGIDSFilter.sys

2011-07-11 05:14 . 2011-07-11 05:14 23120 ----a-w- c:\windows\system32\drivers\AVGIDSEH.sys

2011-07-11 05:14 . 2011-07-11 05:14 134608 ----a-w- c:\windows\system32\drivers\AVGIDSDriver.sys

2011-07-11 05:13 . 2011-07-11 05:13 229840 ----a-w- c:\windows\system32\drivers\avgldx86.sys

2010-01-26 14:11 . 2010-11-22 01:06 444283 ----a-w- c:\program files\Common Files\WinPcapNmap.exe

2004-09-12 19:10 . 2010-11-25 01:36 11578 ----a-r- c:\program files\Replacer.cmd

2011-09-29 06:53 . 2011-10-02 02:35 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]

2011-03-28 16:22 176936 ----a-w- c:\program files\ConduitEngine\prxConduitEngine.dll

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{88c7f2aa-f93f-432c-8f0e-b7d85967a527}]

2011-05-09 09:49 176936 ----a-w- c:\program files\BitTorrentBar\prxtbBit2.dll

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]

2011-09-22 15:20 1451336 ----a-w- c:\program files\AVG Secure Search\8.0.0.34\AVG Secure Search_toolbar.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{88c7f2aa-f93f-432c-8f0e-b7d85967a527}"= "c:\program files\BitTorrentBar\prxtbBit2.dll" [2011-05-09 176936]

"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\prxConduitEngine.dll" [2011-03-28 176936]

"{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files\AVG Secure Search\8.0.0.34\AVG Secure Search_toolbar.dll" [2011-09-22 1451336]

.

[HKEY_CLASSES_ROOT\clsid\{88c7f2aa-f93f-432c-8f0e-b7d85967a527}]

.

[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]

.

[HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}]

[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1]

[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj]

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{88C7F2AA-F93F-432C-8F0E-B7D85967A527}"= "c:\program files\BitTorrentBar\prxtbBit2.dll" [2011-05-09 176936]

.

[HKEY_CLASSES_ROOT\clsid\{88c7f2aa-f93f-432c-8f0e-b7d85967a527}]

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"cdloader"="c:\documents and settings\C.Henry.UPGRADE\Application Data\mjusbsp\cdloader2.exe" [2011-08-23 50592]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2011-10-01 7700480]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]

"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2011-03-18 1043968]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-07-05 421888]

"IObit Malware Fighter"="c:\program files\IObit\IObit Malware Fighter\IMF.exe" [2011-07-20 4393816]

"AVG_TRAY"="c:\program files\AVG\AVG2012\avgtray.exe" [2011-09-23 2404704]

"vProt"="c:\program files\AVG Secure Search\vprot.exe" [2011-09-22 218440]

"ISW"="c:\program files\CheckPoint\ZAForceField\ForceField.exe" [2011-02-15 738808]

"nwiz"="nwiz.exe" [2006-10-22 1622016]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-22 86016]

"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-08-31 449608]

.

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2011-08-06 113024]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]

"UIHost"="c:\documents and settings\All Users\Application Data\TuneUp Software\TU2011\WinStyler\tu_logonui.exe"

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]

2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute REG_MULTI_SZ autocheck autochk *\0lsdelete\0c:\progra~1\AVG\AVG2012\avgrsx.exe /sync /restart

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

@="Service"

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]

"DisableMonitoring"=dword:00000001

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=

"c:\\WINDOWS\\system32\\mmc.exe"=

"c:\\Program Files\\Google\\Google Earth\\plugin\\geplugin.exe"=

"c:\\Program Files\\uTorrent\\uTorrent.exe"=

"c:\\Program Files\\Google\\Google Earth\\client\\googleearth.exe"=

"c:\\Program Files\\SUPERAntiSpyware\\SUPERANTISPYWARE.EXE"=

"c:\\Program Files\\KingsIsle Entertainment\\Wizard101\\Wizard101.exe"=

"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=

"c:\\WINDOWS\\system32\\dpvsetup.exe"=

"c:\\Documents and Settings\\C.Henry\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=

"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=

"c:\\WINDOWS\\system32\\ZoneLabs\\vsmon.exe"=

"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=

"UpdateSvchost"= c:\\WINDOWS\\optimashit\\svchost.exe

"c:\\Program Files\\AVG\\AVG2012\\avgmfapx.exe"=

"c:\\Program Files\\AVG\\AVG2012\\avgemcx.exe"=

"c:\\Documents and Settings\\C.Henry\\Application Data\\mjusbsp\\magicJack.exe"=

"c:\\Program Files\\AVG\\AVG2012\\avgnsx.exe"=

"c:\\Program Files\\AVG\\AVG2012\\avgdiagex.exe"=

"c:\\Documents and Settings\\C.Henry.UPGRADE\\Application Data\\mjusbsp\\magicJack.exe"=

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009

"20200:UDP"= 20200:UDP:Free Realms tm

"20299:UDP"= 20299:UDP:Free Realms tm2

"6881:TCP"= 6881:TCP:Port 6881

"53952:TCP"= 53952:TCP:port 53952

"44191:TCP"= 44191:TCP:Port 44191

"86:TCP"= 86:TCP:BroadCam Video Streaming Server TCP/IP Port

"1935:TCP"= 1935:TCP:BroadCam Video Streaming Server Flash Video Server

"20201:UDP"= 20201:UDP:Port 20201

"20202:UDP"= 20202:UDP:Port 20202

"20203:UDP"= 20203:UDP:Port 20203

"20204:UDP"= 20204:UDP:Port 20204

"20205:UDP"= 20205:UDP:Port 20205

"20206:UDP"= 20206:UDP:Port 20206

"20207:UDP"= 20207:UDP:Port 20207

"20208:UDP"= 20208:UDP:Port 20208

"20209:UDP"= 20209:UDP:Port 20209

"20210:UDP"= 20210:UDP:Port 20210

"20211:UDP"= 20211:UDP:20211

"20212:UDP"= 20212:UDP:Port 20212

"20213:UDP"= 20213:UDP:Port 20213

"20214:UDP"= 20214:UDP:Port 20214

"20215:UDP"= 20215:UDP:Port 20215

"20216:UDP"= 20216:UDP:Port 20216

"20217:UDP"= 20217:UDP:Port 20217

"20218:UDP"= 20218:UDP:Port 20218

"20219:UDP"= 20219:UDP:Port 20219

"20220:UDP"= 20220:UDP:Port 20220

"20221:UDP"= 20221:UDP:Port 20221

"20222:UDP"= 20222:UDP:Port 20222

"20223:UDP"= 20223:UDP:Port 20223

"20224:UDP"= 20224:UDP:Port 20224

"20225:UDP"= 20225:UDP:Port 20225

"20226:UDP"= 20226:UDP:Port 20226

"20227:UDP"= 20227:UDP:Port 20227

"20228:UDP"= 20228:UDP:Port 20228

"20229:UDP"= 20229:UDP:Port 20229

"20230:UDP"= 20230:UDP:Port 20230

"20231:UDP"= 20231:UDP:Port 20231

"20232:UDP"= 20232:UDP:Port 20232

"20233:UDP"= 20233:UDP:Port 20233

"20234:UDP"= 20234:UDP:Port 20234

"20235:UDP"= 20235:UDP:Port 20235

"20236:UDP"= 20236:UDP:Port 20236

"20237:UDP"= 20237:UDP:Port 20237

"20238:UDP"= 20238:UDP:Port 20238

"20239:UDP"= 20239:UDP:Port 20239

"20240:UDP"= 20240:UDP:Port 20240

"20241:UDP"= 20241:UDP:Port 20241

"20242:UDP"= 20242:UDP:Port 20242

"20243:UDP"= 20243:UDP:Port 20243

"20244:UDP"= 20244:UDP:Port 20244

"20245:UDP"= 20245:UDP:Port 20245

"20246:UDP"= 20246:UDP:Port 20246

"20247:UDP"= 20247:UDP:Port 20247

"20248:UDP"= 20248:UDP:Port 20248

"20249:UDP"= 20249:UDP:Port 20249

"20250:UDP"= 20250:UDP:Port 20250

"20251:UDP"= 20251:UDP:Port 20251

"20252:UDP"= 20252:UDP:Port 20252

"20253:UDP"= 20253:UDP:Port 20253

"20254:UDP"= 20254:UDP:Port 20254

"20255:UDP"= 20255:UDP:Port 20255

"20256:UDP"= 20256:UDP:Port 20256

"20257:UDP"= 20257:UDP:Port 20257

"20258:UDP"= 20258:UDP:Port 20258

"20259:UDP"= 20259:UDP:Port 20259

"20260:UDP"= 20260:UDP:Port 20260

"20261:UDP"= 20261:UDP:Port 20261

"20262:UDP"= 20262:UDP:Port 20262

"20263:UDP"= 20263:UDP:Port 20263

"20264:UDP"= 20264:UDP:Port 20264

"20265:UDP"= 20265:UDP:port 20265

"20266:UDP"= 20266:UDP:Port 20266

"20267:UDP"= 20267:UDP:Port 20267

"20268:UDP"= 20268:UDP:Port 20268

"20269:UDP"= 20269:UDP:Port 20269

"20270:UDP"= 20270:UDP:Port 20270

"20271:UDP"= 20271:UDP:Port 20271

"20272:UDP"= 20272:UDP:Port 20272

"20273:UDP"= 20273:UDP:Port 20273

"20274:UDP"= 20274:UDP:Port 20274

"20275:UDP"= 20275:UDP:Port 20275

"20276:UDP"= 20276:UDP:port 20276

"20277:UDP"= 20277:UDP:Port 20277

"20278:UDP"= 20278:UDP:Port 20278

"20279:UDP"= 20279:UDP:Port 20279

"20280:UDP"= 20280:UDP:Port 20280

"20281:UDP"= 20281:UDP:Port 20281

"20282:UDP"= 20282:UDP:Port 20282

"20283:UDP"= 20283:UDP:Port 20283

"20284:UDP"= 20284:UDP:Port 20284

"20285:UDP"= 20285:UDP:Port 20285

"20286:UDP"= 20286:UDP:Port 20286

"20287:UDP"= 20287:UDP:Port 20287

"20288:UDP"= 20288:UDP:Port 20288

"20289:UDP"= 20289:UDP:Port 20289

"20290:UDP"= 20290:UDP:Port 20290

"20291:UDP"= 20291:UDP:Port 20291

"20292:UDP"= 20292:UDP:Port 20292

"20293:UDP"= 20293:UDP:Port 20293

"20294:UDP"= 20294:UDP:Port 20294

"20296:UDP"= 20296:UDP:Port 20296

"20297:UDP"= 20297:UDP:Port 20297

"20295:UDP"= 20295:UDP:Port 20295

"20298:UDP"= 20298:UDP:Port 20298

"5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management

.

R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [7/11/2011 1:14 AM 23120]

R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [7/11/2011 1:13 AM 32592]

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [9/21/2011 2:54 PM 64512]

R0 SmartDefragDriver;SmartDefragDriver;c:\windows\system32\drivers\SmartDefragDriver.sys [9/5/2011 8:27 PM 14776]

R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [7/11/2011 1:13 AM 229840]

R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [7/11/2011 1:14 AM 295248]

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2/17/2010 2:25 PM 12880]

R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/10/2010 2:41 PM 67664]

R2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE.EXE [6/29/2010 1:48 PM 116608]

R2 AdvancedSystemCareService;Advanced SystemCare Service;c:\program files\IObit\Advanced SystemCare 4\ASCService.exe [9/5/2011 8:24 PM 328536]

R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2012\avgwdsvc.exe [8/2/2011 6:09 AM 192776]

R2 BBUpdate;BBUpdate;c:\program files\Microsoft\BingBar\SeaPort.EXE [6/15/2011 5:33 PM 249648]

R2 IMFservice;IMF Service;c:\program files\IObit\IObit Malware Fighter\IMFsrv.exe [9/5/2011 8:26 PM 820568]

R2 ISWKL;ZoneAlarm Toolbar ISWKL;c:\program files\CheckPoint\ZAForceField\ISWKL.sys [2/15/2011 11:25 AM 26872]

R2 IswSvc;ZoneAlarm Toolbar IswSvc;c:\program files\CheckPoint\ZAForceField\ISWSVC.exe [2/15/2011 11:25 AM 488952]

R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [11/7/2010 8:48 AM 366152]

R2 NAUpdate;@c:\program files\Nero\Update\NASvc.exe,-200;c:\program files\Nero\Update\NASvc.exe [7/22/2011 2:26 PM 690472]

R2 npf;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [1/26/2010 10:09 PM 50704]

R2 vToolbarUpdater;vToolbarUpdater;c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\8.0.1\ToolbarUpdater.exe [9/22/2011 11:20 AM 246600]

R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [7/11/2011 1:14 AM 134608]

R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [7/11/2011 1:14 AM 24272]

R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [7/11/2011 1:14 AM 16720]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [11/7/2010 8:48 AM 22216]

R3 RegFilter;RegFilter;c:\program files\IObit\IObit Malware Fighter\Drivers\wxp_x86\RegFilter.sys [9/5/2011 8:26 PM 30368]

R3 UrlFilter;UrlFilter;c:\program files\IObit\IObit Malware Fighter\Drivers\wxp_x86\UrlFilter.sys [9/5/2011 8:26 PM 16080]

R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [3/18/2010 1:16 PM 753504]

S1 MpKsl0fa035be;MpKsl0fa035be;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{CEED8A1D-9F19-4916-8D31-F596B03764FF}\MpKsl0fa035be.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{CEED8A1D-9F19-4916-8D31-F596B03764FF}\MpKsl0fa035be.sys [?]

S1 MpKsl0fbb6989;MpKsl0fbb6989;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{4883059C-6725-46A6-9EE1-704195679FEE}\MpKsl0fbb6989.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{4883059C-6725-46A6-9EE1-704195679FEE}\MpKsl0fbb6989.sys [?]

S1 MpKsl30d36f72;MpKsl30d36f72;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{157D2A1D-4E1F-4B01-9D65-618127A0C4BF}\MpKsl30d36f72.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{157D2A1D-4E1F-4B01-9D65-618127A0C4BF}\MpKsl30d36f72.sys [?]

S1 MpKsl333bf458;MpKsl333bf458;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{9CF64B81-051C-4A17-A0DF-5014C91D8C89}\MpKsl333bf458.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{9CF64B81-051C-4A17-A0DF-5014C91D8C89}\MpKsl333bf458.sys [?]

S1 MpKsl46a99366;MpKsl46a99366;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{711C98D2-67B7-4852-8CB3-4C94E0E24226}\MpKsl46a99366.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{711C98D2-67B7-4852-8CB3-4C94E0E24226}\MpKsl46a99366.sys [?]

S1 MpKsl59e99f45;MpKsl59e99f45;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{CF3444D5-D97D-4C84-B260-2863EE3F72A7}\MpKsl59e99f45.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{CF3444D5-D97D-4C84-B260-2863EE3F72A7}\MpKsl59e99f45.sys [?]

S1 MpKsl681962f3;MpKsl681962f3;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{5B11A087-0284-4EC3-8390-CF08E2DC4C8F}\MpKsl681962f3.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{5B11A087-0284-4EC3-8390-CF08E2DC4C8F}\MpKsl681962f3.sys [?]

S1 MpKsl6fff11b7;MpKsl6fff11b7;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{EB14A9C9-4980-42A1-B067-366D25A21ECB}\MpKsl6fff11b7.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{EB14A9C9-4980-42A1-B067-366D25A21ECB}\MpKsl6fff11b7.sys [?]

S1 MpKsl72ab06f5;MpKsl72ab06f5;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{711C98D2-67B7-4852-8CB3-4C94E0E24226}\MpKsl72ab06f5.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{711C98D2-67B7-4852-8CB3-4C94E0E24226}\MpKsl72ab06f5.sys [?]

S1 MpKsl7385528c;MpKsl7385528c;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{644D7768-315E-4178-8CA8-6DB4B17078F3}\MpKsl7385528c.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{644D7768-315E-4178-8CA8-6DB4B17078F3}\MpKsl7385528c.sys [?]

S1 MpKsl790e18a0;MpKsl790e18a0;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{4D3C1CB2-5A1D-4308-9148-4BE14BA90448}\MpKsl790e18a0.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{4D3C1CB2-5A1D-4308-9148-4BE14BA90448}\MpKsl790e18a0.sys [?]

S1 MpKsl836a2924;MpKsl836a2924;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{9FC23C9E-9C99-4174-960D-09E094C0ECAB}\MpKsl836a2924.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{9FC23C9E-9C99-4174-960D-09E094C0ECAB}\MpKsl836a2924.sys [?]

S1 MpKsl85f9705b;MpKsl85f9705b;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{F521C242-9B9D-472F-A80F-B2597F7B4809}\MpKsl85f9705b.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{F521C242-9B9D-472F-A80F-B2597F7B4809}\MpKsl85f9705b.sys [?]

S1 MpKsl8836105c;MpKsl8836105c;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{711C98D2-67B7-4852-8CB3-4C94E0E24226}\MpKsl8836105c.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{711C98D2-67B7-4852-8CB3-4C94E0E24226}\MpKsl8836105c.sys [?]

S1 MpKsl9496f593;MpKsl9496f593;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{4883059C-6725-46A6-9EE1-704195679FEE}\MpKsl9496f593.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{4883059C-6725-46A6-9EE1-704195679FEE}\MpKsl9496f593.sys [?]

S1 MpKsl952967d3;MpKsl952967d3;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{644D7768-315E-4178-8CA8-6DB4B17078F3}\MpKsl952967d3.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{644D7768-315E-4178-8CA8-6DB4B17078F3}\MpKsl952967d3.sys [?]

S1 MpKsl9e395e06;MpKsl9e395e06;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{9FC23C9E-9C99-4174-960D-09E094C0ECAB}\MpKsl9e395e06.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{9FC23C9E-9C99-4174-960D-09E094C0ECAB}\MpKsl9e395e06.sys [?]

S1 MpKsl9ebaeedb;MpKsl9ebaeedb;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{6BC9E516-D6D4-4A47-9E62-23878CDF10FF}\MpKsl9ebaeedb.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{6BC9E516-D6D4-4A47-9E62-23878CDF10FF}\MpKsl9ebaeedb.sys [?]

S1 MpKslc8e71ba2;MpKslc8e71ba2;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{7F17E62F-BAD0-4663-A601-49565D71DCF7}\MpKslc8e71ba2.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{7F17E62F-BAD0-4663-A601-49565D71DCF7}\MpKslc8e71ba2.sys [?]

S1 MpKsle6108664;MpKsle6108664;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{8CE9007E-53A4-4783-B0C4-32250B67F340}\MpKsle6108664.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{8CE9007E-53A4-4783-B0C4-32250B67F340}\MpKsle6108664.sys [?]

S1 MpKsle7a8409d;MpKsle7a8409d;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{EB14A9C9-4980-42A1-B067-366D25A21ECB}\MpKsle7a8409d.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{EB14A9C9-4980-42A1-B067-366D25A21ECB}\MpKsle7a8409d.sys [?]

S1 MpKslf660ee8d;MpKslf660ee8d;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{157D2A1D-4E1F-4B01-9D65-618127A0C4BF}\MpKslf660ee8d.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{157D2A1D-4E1F-4B01-9D65-618127A0C4BF}\MpKslf660ee8d.sys [?]

S2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2012\AVGIDSAgent.exe [9/12/2011 6:23 AM 5265248]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3/18/2010 1:16 PM 130384]

S2 gupdate1ca2c9565ca07ae;Google Update Service (gupdate1ca2c9565ca07ae);c:\program files\Google\Update\GoogleUpdate.exe [9/3/2009 8:52 AM 133104]

S3 BBSvc;Bing Bar Update Service;c:\program files\Microsoft\BingBar\BBSvc.EXE [7/7/2011 7:31 PM 195336]

S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [9/3/2009 8:52 AM 133104]

S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [8/18/2011 3:25 PM 2151640]

S3 PSSDK42;PSSDK42;c:\windows\system32\drivers\pssdk42.sys [11/18/2010 1:53 AM 38976]

S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [8/4/2004 8:00 AM 14336]

S4 BroadCamService;BroadCam Video Streaming Server;c:\program files\NCH Software\BroadCam\broadcam.exe [10/16/2010 12:59 PM 1175556]

S4 FileMonitor;FileMonitor;c:\program files\IObit\IObit Malware Fighter\Drivers\wxp_x86\FileMonitor.sys [9/5/2011 8:26 PM 239600]

S4 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files\Lavasoft\Ad-Aware\kernexplorer.sys [8/18/2011 3:25 PM 15232]

.

--- Other Services/Drivers In Memory ---

.

*NewlyCreated* - LAVASOFT_KERNEXPLORER

*Deregistered* - PAGEDFRG

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

WINRM REG_MULTI_SZ WINRM

.

Contents of the 'Scheduled Tasks' folder

.

2011-10-08 c:\windows\Tasks\Ad-Aware Scan (everyday protection).job

- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2011-08-18 18:59]

.

2011-10-08 c:\windows\Tasks\Ad-Aware Scan (Weekly protection).job

- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2011-08-18 18:59]

.

2011-10-08 c:\windows\Tasks\Ad-Aware Update (Weekly).job

- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2011-08-18 18:59]

.

2011-10-05 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 21:57]

.

2011-10-06 c:\windows\Tasks\ASC4_PerformanceMonitor.job

- c:\program files\IObit\Advanced SystemCare 4\PMonitor.exe [2011-09-06 20:40]

.

2011-07-03 c:\windows\Tasks\Defraggler Volume C Task.job

- c:\program files\Defraggler\df.exe [2011-09-13 09:45]

.

2011-09-12 c:\windows\Tasks\expressburnShakeIcon.job

- c:\program files\NCH Swift Sound\ExpressBurn\expressburn.exe [2010-09-23 07:00]

.

2011-06-06 c:\windows\Tasks\expressripShakeIcon.job

- c:\program files\NCH Swift Sound\ExpressRip\expressrip.exe [2010-09-23 07:02]

.

2011-10-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-09-03 12:52]

.

2011-10-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-09-03 12:52]

.

2011-10-08 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-57989841-688789844-682003330-1003Core.job

- c:\documents and settings\C.Henry\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-06-27 15:16]

.

2011-10-08 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-57989841-688789844-682003330-1003UA.job

- c:\documents and settings\C.Henry\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-06-27 15:16]

.

2011-06-06 c:\windows\Tasks\pixillionShakeIcon.job

- c:\program files\NCH Software\Pixillion\pixillion.exe [2010-10-16 16:59]

.

2011-06-06 c:\windows\Tasks\prismDowngrade.job

- c:\program files\NCH Software\Prism\prism.exe [2010-09-23 16:59]

.

2011-07-09 c:\windows\Tasks\prismShakeIcon.job

- c:\program files\NCH Software\Prism\prism.exe [2010-09-23 16:59]

.

2011-10-08 c:\windows\Tasks\User_Feed_Synchronization-{4D2ABBC6-BA46-42D6-ADD5-C2E6C2D58B6A}.job

- c:\windows\system32\msfeedssync.exe [2009-03-08 09:31]

.

2011-10-08 c:\windows\Tasks\User_Feed_Synchronization-{6AADCA7F-9D09-413E-B8D5-3FB647C74798}.job

- c:\windows\system32\msfeedssync.exe [2009-03-08 09:31]

.

2011-06-06 c:\windows\Tasks\videopadShakeIcon.job

- c:\program files\NCH Software\VideoPad\videopad.exe [2010-09-23 07:03]

.

2011-06-06 c:\windows\Tasks\wavepadDowngrade.job

- c:\program files\NCH Swift Sound\WavePad\wavepad.exe [2010-09-23 07:01]

.

2011-06-06 c:\windows\Tasks\wavepadShakeIcon.job

- c:\program files\NCH Swift Sound\WavePad\wavepad.exe [2010-09-23 07:01]

.

------- Supplementary Scan -------

.

TCP: DhcpNameServer = 63.245.66.41 63.245.66.42

Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\Common Files\AVG Secure Search\ViProtocolInstaller\8.0.1\ViProtocol.dll

FF - ProfilePath - c:\documents and settings\C.Henry.UPGRADE\Application Data\Mozilla\Firefox\Profiles\5iierj4b.default\

# Mozilla User Preferences

/* Do not edit this file.

*

* If you make changes to this file while the application is running,

* the changes will be overwritten when the application exits.

*

* To make a manual change to preferences, you can visit the URL about:config

* For more information, see hxxp://www.mozilla.org/unix/customizing.html#prefs

*/

FF - user.js: app.update.lastUpdateTime.addon-background-update-timer - 1317645442

FF - user.js: app.update.lastUpdateTime.background-update-timer - 1317645682

FF - user.js: app.update.lastUpdateTime.blocklist-background-update-timer - 1317645562

FF - user.js: app.update.lastUpdateTime.search-engine-update-timer - 1317680467

FF - user.js: browser.bookmarks.restore_default_bookmarks - false

FF - user.js: browser.cache.disk.capacity - 1048576

FF - user.js: browser.cache.disk.smart_size.first_run - false

FF - user.js: browser.cache.disk.smart_size_cached_value - 640000

FF - user.js: browser.download.lastDir - c:\\Documents and Settings\\C.Henry.UPGRADE\\Desktop

FF - user.js: browser.download.manager.alertOnEXEOpen - true

FF - user.js: browser.download.useDownloadDir - false

FF - user.js: browser.migration.version - 5

FF - user.js: browser.places.smartBookmarksVersion - 2

FF - user.js: browser.privatebrowsing.dont_prompt_on_enter - true

FF - user.js: browser.rights.3.shown - true

FF - user.js: browser.startup.homepage_override.buildID - 20110928134238

FF - user.js: browser.startup.homepage_override.mstone - rv:7.0.1

FF - user.js: browser.syncPromoViewsLeft - 2

FF - user.js: dom.disable_window_flip - false

FF - user.js: extensions.blocklist.pingCountTotal - 2

FF - user.js: extensions.blocklist.pingCountVersion - 2

FF - user.js: extensions.bootstrappedAddons - {}

FF - user.js: extensions.databaseSchema - 5

FF - user.js: extensions.enabledAddons - jqs@sun.com:1.0,{1E73965B-8B48-48be-9C8D-68B920ABC1C4}:12.0.0.1806,{972ce4c6-7e08-4474-a285-3208198ce6fd}:7.0.1

FF - user.js: extensions.installCache - [{\name\:\winreg-app-global\,\addons\:{\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}\:{\descriptor\:\c:\\\\Program Files\\\\DivX\\\\DivX Plus Web Player\\\\firefox\\\\html5video\,\mtime\:1302093671134},\{6904342A-8307-11DF-A508-4AE2DFD72085}\:{\descriptor\:\c:\\\\Program Files\\\\DivX\\\\DivX Plus Web Player\\\\firefox\\\\wpa\,\mtime\:1302093671822},\jqs@sun.com\:{\descriptor\:\c:\\\\Program Files\\\\Java\\\\jre6\\\\lib\\\\deploy\\\\jqs\\\\ff\,\mtime\:1287015690781},\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}\:{\descriptor\:\c:\\\\Program Files\\\\CheckPoint\\\\ZAForceField\\\\TrustChecker\,\mtime\:1317440292281},\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}\:{\descriptor\:\c:\\\\Program Files\\\\AVG\\\\AVG2012\\\\Firefox4\,\mtime\:1316704857625}}},{\name\:\app-global\,\addons\:{\{972ce4c6-7e08-4474-a285-3208198ce6fd}\:{\descriptor\:\c:\\\\Program Files\\\\Mozilla Firefox\\\\extensions\\\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\,\mtime\:1317527281437}}}]

FF - user.js: extensions.lastAppVersion - 7.0.1

FF - user.js: extensions.lastPlatformVersion - 7.0.1

FF - user.js: extensions.pendingOperations - false

FF - user.js: font.internaluseonly.changed - true

FF - user.js: gfx.blacklist.direct2d - 3

FF - user.js: gfx.blacklist.layers.direct3d10 - 3

FF - user.js: gfx.blacklist.layers.direct3d10-1 - 3

FF - user.js: gfx.blacklist.layers.direct3d9 - 3

FF - user.js: gfx.blacklist.layers.opengl - 3

FF - user.js: gfx.blacklist.webgl.angle - 3

FF - user.js: gfx.blacklist.webgl.opengl - 3

FF - user.js: idle.lastDailyNotification - 1317649027

FF - user.js: intl.charsetmenu.browser.cache - windows-1252, ISO-8859-1, UTF-8

FF - user.js: network.cookie.prefsMigrated - true

FF - user.js: places.database.lastMaintenance - 1317649027

FF - user.js: places.history.expiration.transient_current_max_pages - 42924

FF - user.js: pref.advanced.javascript.disable_button.advanced - false

FF - user.js: privacy.sanitize.migrateFx3Prefs - true

FF - user.js: security.warn_viewing_mixed.show_once - false

FF - user.js: storage.vacuum.last.index - 1

FF - user.js: storage.vacuum.last.places.sqlite - 1317523296

FF - user.js: toolkit.telemetry.prompted - true

FF - user.js: urlclassifier.keyupdatetime.hxxps://sb-ssl.google.com/safebrowsing/newkey - 1320113089

FF - user.js: xpinstall.whitelist.add -

FF - user.js: xpinstall.whitelist.add.36 -

.

- - - - ORPHANS REMOVED - - - -

.

URLSearchHooks-{A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)

BHO-{91da5e8a-3318-4f8c-b67e-5964de3ab546} - (no file)

Toolbar-Locked - (no file)

Toolbar-{91da5e8a-3318-4f8c-b67e-5964de3ab546} - (no file)

WebBrowser-{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - (no file)

AddRemove-{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1 - c:\program files\Spybot - Search & Destroy\unins000.exe

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2011-10-08 20:43

Windows 5.1.2600 Service Pack 3 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'winlogon.exe'(1104)

c:\program files\SUPERAntiSpyware\SASWINLO.DLL

c:\windows\system32\WININET.dll

c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll

c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86\MSVCR80.dll

.

- - - - - - - > 'lsass.exe'(1164)

c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll

.

Completion time: 2011-10-08 20:47:08

ComboFix-quarantined-files.txt 2011-10-09 00:46

.

Pre-Run: 50,846,928,896 bytes free

Post-Run: 51,049,959,424 bytes free

.

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

UnsupportedDebug="do not select this" /debug

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptOut /TUTag=TXUGW3

.

- - End Of File - - 2F0DFDB9FD2E979C1FCEE03993E4F1F4

I never knew that after running Combofix there would be an automatic DDS scan, but my scans failed numerously when Cfx did its job and it never automatically restored from blanking out the taskbar - luckily I knew about the explorer.exe task in Task manager so that helped but I never got any DDS files after about 20 mins from running Combofix, so I ran one later, right here;

.

DDS (Ver_2011-08-26.01) - NTFSx86

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_26

Run by C.Henry at 22:00:38 on 2011-10-08

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.679 [GMT -4:00]

.

AV: AVG Anti-Virus Free Edition 2012 *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}

AV: Lavasoft Ad-Watch Live! Anti-Virus *Disabled/Updated* {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33}

AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}

FW: ZoneAlarm Firewall *Disabled*

.

============== Running Processes ===============

.

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup

svchost.exe

C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\IObit\IObit Malware Fighter\IMFsrv.exe

C:\Program Files\SUPERAntiSpyware\SASCORE.EXE

C:\Program Files\IObit\Advanced SystemCare 4\ASCService.exe

C:\Program Files\AVG\AVG2012\avgwdsvc.exe

C:\Program Files\Microsoft\BingBar\SeaPort.EXE

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files\Nero\Update\NASvc.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\8.0.1\ToolbarUpdater.exe

svchost.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\WINDOWS\system32\devldr32.exe

C:\Program Files\AVG\AVG2012\avgtray.exe

C:\Program Files\AVG Secure Search\vprot.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\DivX\DivX Update\DivXUpdate.exe

C:\Documents and Settings\C.Henry\My Documents\Downloads\SoftonicDownloader_for_vdownloader.exe

C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe

C:\Program Files\AVG\AVG2012\avgnsx.exe

C:\Program Files\AVG\AVG2012\avgrsx.exe

C:\Program Files\AVG\AVG2012\avgcsrvx.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\explorer.exe

C:\Program Files\IObit\Advanced SystemCare 4\PMonitor.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

C:\Documents and Settings\C.Henry.UPGRADE\Application Data\mjusbsp\magicJack.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

C:\WINDOWS\System32\NOTEPAD.EXE