Here are the requested files : log.text and hijackthis.log
ComboFix 08-10-31.02 - Administrator 2008-11-01 16:04:51.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.526 [GMT 0:00]
Running from: C:\Documents and Settings\Administrator\Desktop\Downloads\Hijack Progs\ComboFix.exe
.
((((((((((((((((((((((((( Files Created from 2008-10-01 to 2008-11-01 )))))))))))))))))))))))))))))))
.
2008-11-01 01:59 . 2008-11-01 02:01 <DIR> d-------- C:\Program Files\a-squared HiJackFree
2008-10-31 22:22 . 2008-10-31 22:22 23,912 --ah----- C:\WINDOWS\system32\mlfcache.dat
2008-10-31 05:37 . 2008-10-31 05:37 <DIR> d-------- C:\Program Files\Browser Hijack Recover
2008-10-31 05:37 . 2008-10-31 05:37 0 --a------ C:\WINDOWS\system32\8104297.jun
2008-10-31 05:21 . 2008-10-31 05:21 <DIR> d-------- C:\Program Files\Zamaan's Software
2008-10-31 05:21 . 1998-06-24 13:00 244,024 --a------ C:\WINDOWS\system32\MSFLXGRD.OCX
2008-10-31 05:21 . 2000-05-22 17:00 203,976 --a------ C:\WINDOWS\system32\richtx32.ocx
2008-10-31 04:53 . 2008-10-31 04:53 <DIR> d-------- C:\WINDOWS\system32\scripting
2008-10-31 04:53 . 2008-10-31 04:53 <DIR> d-------- C:\WINDOWS\system32\en
2008-10-31 04:53 . 2008-10-31 04:53 <DIR> d-------- C:\WINDOWS\system32\bits
2008-10-31 04:53 . 2008-10-31 04:53 <DIR> d-------- C:\WINDOWS\l2schemas
2008-10-31 04:23 . 2008-04-14 00:12 712,704 --------- C:\WINDOWS\system32\windowscodecs.dll
2008-10-31 04:23 . 2008-04-14 00:12 346,112 --------- C:\WINDOWS\system32\windowscodecsext.dll
2008-10-31 04:23 . 2008-04-14 00:12 290,304 --------- C:\WINDOWS\system32\rhttpaa.dll
2008-10-31 04:23 . 2008-04-14 00:12 276,992 --------- C:\WINDOWS\system32\wmphoto.dll
2008-10-31 04:23 . 2008-04-14 00:12 69,120 --------- C:\WINDOWS\system32\wlanapi.dll
2008-10-31 04:23 . 2008-04-14 00:12 53,248 --------- C:\WINDOWS\system32\tsgqec.dll
2008-10-31 04:23 . 2008-04-14 00:12 50,688 --------- C:\WINDOWS\system32\tspkg.dll
2008-10-31 04:23 . 2008-04-14 00:12 32,768 --------- C:\WINDOWS\system32\setupn.exe
2008-10-31 04:23 . 2008-04-14 00:12 28,672 --------- C:\WINDOWS\system32\verclsid.exe
2008-10-31 04:23 . 2008-04-13 18:40 10,240 --------- C:\WINDOWS\system32\drivers\sffp_mmc.sys
2008-10-31 04:21 . 2008-04-14 00:11 650,752 --------- C:\WINDOWS\system32\dot3ui.dll
2008-10-31 04:20 . 2008-04-14 00:11 233,472 --------- C:\WINDOWS\system32\azroles.dll
2008-10-31 04:20 . 2008-04-14 00:11 136,192 --------- C:\WINDOWS\system32\aaclient.dll
2008-10-31 04:20 . 2008-04-14 00:11 7,168 --------- C:\WINDOWS\system32\bitsprx4.dll
2008-10-31 03:41 . 2008-09-15 12:12 1,846,400 -----c--- C:\WINDOWS\system32\dllcache\win32k.sys
2008-10-31 03:41 . 2008-09-08 10:41 333,824 -----c--- C:\WINDOWS\system32\dllcache\srv.sys
2008-10-31 03:41 . 2008-06-13 11:05 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
2008-10-31 03:41 . 2008-05-08 14:02 203,136 -----c--- C:\WINDOWS\system32\dllcache\rmcast.sys
2008-10-31 03:41 . 2008-08-14 10:04 138,496 -----c--- C:\WINDOWS\system32\dllcache\afd.sys
2008-10-31 03:40 . 2008-04-11 19:04 691,712 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll
2008-10-31 03:40 . 2008-05-01 14:33 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll
2008-10-31 03:36 . 2008-10-15 16:34 337,408 -----c--- C:\WINDOWS\system32\dllcache\netapi32.dll
2008-10-31 03:34 . 2008-10-03 17:41 6,066,176 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll
2008-10-31 03:34 . 2007-04-17 09:32 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat
2008-10-31 03:34 . 2007-03-08 05:10 991,232 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2008-10-31 03:34 . 2008-08-26 07:24 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll
2008-10-31 03:34 . 2008-08-26 07:24 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll
2008-10-31 03:34 . 2008-08-26 07:24 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll
2008-10-31 03:34 . 2008-08-26 07:24 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll
2008-10-31 03:34 . 2008-08-26 07:24 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2008-10-31 03:34 . 2008-08-25 08:38 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-10-31 03:26 . 2008-11-01 03:05 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2008-10-31 03:26 . 2008-08-14 10:11 2,189,184 -----c--- C:\WINDOWS\system32\dllcache\ntoskrnl.exe
2008-10-31 03:26 . 2008-08-14 10:09 2,145,280 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlmp.exe
2008-10-31 03:26 . 2008-08-14 09:33 2,066,048 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlpa.exe
2008-10-31 03:26 . 2008-08-14 09:33 2,023,936 -----c--- C:\WINDOWS\system32\dllcache\ntkrpamp.exe
2008-10-31 03:26 . 2008-11-01 03:06 1,374 --a------ C:\WINDOWS\imsins.BAK
2008-10-31 02:44 . 2008-10-31 02:44 <DIR> d-------- C:\Program Files\TeaTimer (Spybot - Search & Destroy)
2008-10-31 02:44 . 2008-10-31 02:44 <DIR> d-------- C:\Program Files\SDHelper (Spybot - Search & Destroy)
2008-10-31 02:41 . 2008-10-31 02:54 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-10-31 02:28 . 2008-10-31 02:54 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-10-30 21:58 . 2008-06-24 12:45 1,414,440 --a------ C:\WINDOWS\system32\ShellManager310E2D762.dll
2008-10-30 21:58 . 2008-06-23 16:36 773,120 --a------ C:\WINDOWS\system32\NEROINSTAEC43759.DB
2008-10-30 21:57 . 2008-10-30 21:57 0 --a------ C:\WINDOWS\Irremote.ini
2008-10-30 21:24 . 2008-10-30 21:24 <DIR> d-------- C:\Program Files\Trend Micro
2008-10-30 16:58 . 2008-10-30 22:30 <DIR> d-------- C:\Program Files\Spyware Doctor
2008-10-30 16:58 . 2008-10-30 16:58 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\PC Tools
2008-10-30 16:58 . 2008-08-25 12:36 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
2008-10-30 16:58 . 2008-08-25 12:36 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
2008-10-30 16:58 . 2008-08-25 12:36 40,840 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
2008-10-30 16:58 . 2008-06-02 16:19 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys
2008-10-30 15:37 . 2008-10-30 22:25 0 --a------ C:\WINDOWS\system32\drivers\mchInjDrv.sys
2008-10-30 02:44 . 2008-10-30 02:44 20,992 --ahs---- C:\WINDOWS\system32\c00CF244.mat
2008-10-30 01:50 . 2008-10-30 16:52 22 --a------ C:\WINDOWS\RsConfig.ini
2008-10-30 01:35 . 2008-10-31 02:06 <DIR> dr------- C:\RavBin
2008-10-30 00:06 . 2008-10-30 00:15 <DIR> d-------- C:\Program Files\XoftSpySE
2008-10-29 23:41 . 2008-10-29 23:41 20,992 --ahs---- C:\WINDOWS\system32\c00C9F04.mat
2008-10-29 23:38 . 2008-10-30 00:38 <DIR> d-------- C:\WINDOWS\system32\EV19
2008-10-29 23:38 . 2008-10-29 23:38 <DIR> d-------- C:\Temp\xp34
2008-10-29 23:38 . 2008-10-29 23:38 <DIR> d-------- C:\Temp
2008-10-29 23:21 . 2008-10-29 23:30 <DIR> d-------- C:\5
2008-10-29 13:58 . 2008-10-29 13:58 43 --a------ C:\WINDOWS\system32\backup.ini
2008-10-29 13:16 . 2008-10-29 13:17 <DIR> d-------- C:\Program Files\WinImage
2008-10-29 12:55 . 2008-10-29 12:55 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\WinCare2008
2008-10-29 12:53 . 2008-10-29 13:52 <DIR> d-------- C:\4
2008-10-29 12:05 . 2008-10-29 12:08 <DIR> d-------- C:\Program Files\Cain
2008-10-21 14:23 . 2008-10-21 14:23 <DIR> d-------- C:\Program Files\Poker Mania
2008-10-21 14:23 . 2008-10-30 13:40 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Poker Mania
2008-10-21 14:23 . 1996-06-20 19:57 200,704 --a------ C:\WINDOWS\system32\threed32.ocx
2008-10-21 14:23 . 1999-03-07 10:38 135,168 --a------ C:\WINDOWS\system32\vbcards.ocx
2008-10-21 14:23 . 2008-10-21 14:23 0 --a------ C:\WINDOWS\system32\PMv3.frd
2008-10-18 18:32 . 2008-10-18 18:32 <DIR> d-------- C:\Program Files\Freelancer Mod Manager
2008-10-14 23:42 . 2008-10-14 23:42 <DIR> d-------- C:\Program Files\IObit
2008-10-14 22:56 . 2008-10-14 22:56 <DIR> d-------- C:\Program Files\Bonjour
2008-10-06 19:35 . 2008-10-30 21:49 <DIR> d-------- C:\Program Files\IrfanView
2008-10-01 16:10 . 2008-10-01 16:10 <DIR> d-------- C:\Program Files\Microsoft GIF Animator
2008-10-01 16:10 . 2008-10-01 16:10 <DIR> d-------- C:\Multimedia Files
2008-10-01 00:32 . 2008-10-01 00:32 <DIR> d-------- C:\Program Files\Concel Systems
2008-10-01 00:32 . 2008-10-01 00:32 220 ---hs---- C:\WINDOWS\dwin.sys
2008-10-01 00:28 . 2008-10-01 00:29 <DIR> d-------- C:\Program Files\Phone Spy
2008-10-01 00:19 . 2008-10-01 00:19 <DIR> d-------- C:\Program Files\TechTracker
2008-10-01 00:19 . 2008-10-16 01:33 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\VersionTracker Pro
2008-10-01 00:12 . 2008-10-01 00:12 <DIR> d-------- C:\Program Files\Babya Software Group
2008-10-01 00:01 . 2008-10-21 16:01 70 --a------ C:\WINDOWS\mmpoly.ini
2008-10-01 00:00 . 2003-04-15 17:07 6,852 --a------ C:\WINDOWS\system32\drivers\Vcs.sys
2008-10-01 00:00 . 2008-10-01 00:00 16 --a------ C:\WINDOWS\system32\DataRnvx.dat
2008-10-01 00:00 . 2008-10-01 00:00 16 --a------ C:\WINDOWS\backodbc.ini
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-01 16:07 21,245,984 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-11-01 15:54 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kontiki
2008-11-01 03:44 249,764 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-11-01 03:18 2,723,328 ----a-w C:\WINDOWS\Internet Logs\xDB4.tmp
2008-11-01 03:18 2,232,320 ----a-w C:\WINDOWS\Internet Logs\xDB5.tmp
2008-10-31 23:44 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater
2008-10-30 22:32 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-10-30 22:04 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-10-30 22:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Nero
2008-10-30 21:50 --------- d-----w C:\Program Files\Java
2008-10-30 21:45 --------- d-----w C:\Program Files\Button Shop
2008-10-30 21:42 --------- d-----w C:\Program Files\Tunebite
2008-10-29 23:56 --------- d-----w C:\Documents and Settings\Administrator\Application Data\uTorrent
2008-10-21 17:31 2,000,896 ----a-w C:\WINDOWS\Internet Logs\xDB3.tmp
2008-10-18 16:32 --------- d-----w C:\Program Files\Microsoft Games
2008-10-14 22:55 --------- d-----w C:\Program Files\Common Files\Apple
2008-10-11 14:10 166,016 ----a-w C:\WINDOWS\system32\drivers\vidstub.sys
2008-10-02 10:19 54,708 ----a-w C:\WINDOWS\Internet Logs\vsmon_2nd_2008_10_02_11_10_44_small.dmp.zip
2008-09-29 07:59 2,289,333 ----a-w C:\WINDOWS\Internet Logs\tvDebug.zip
2008-09-25 10:29 --------- d-----w C:\Documents and Settings\Administrator\Application Data\tunebite
2008-09-20 22:30 --------- d-----w C:\Program Files\InstantCD+DVD
2008-09-18 22:54 --------- d-----w C:\Program Files\NVIDIA Corporation
2008-09-18 22:54 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-09-18 22:53 --------- d-----w C:\Program Files\NVIDIA nTune Performance Application
2008-09-18 19:27 39,424 ----a-w C:\WINDOWS\zipinst.exe
2008-09-18 03:11 --------- d-----w C:\Program Files\Solveig Multimedia
2008-09-18 03:10 --------- d-----w C:\Program Files\Common Files\AVSMedia
2008-09-18 03:10 --------- d-----w C:\Program Files\AVS4YOU
2008-09-18 02:52 --------- d-----w C:\Documents and Settings\All Users\Application Data\AVS4YOU
2008-09-18 02:52 --------- d-----w C:\Documents and Settings\Administrator\Application Data\AVS4YOU
2008-09-18 01:41 --------- d-----w C:\Program Files\VideoCacheView
2008-09-18 00:03 --------- d-----w C:\Program Files\SDP Multimedia
2008-09-15 12:12 1,846,400 ----a-w C:\WINDOWS\system32\win32k.sys
2008-09-08 10:41 333,824 ----a-w C:\WINDOWS\system32\drivers\srv.sys
2008-09-05 00:45 --------- d-----w C:\Program Files\Kontiki
2008-09-05 00:45 --------- d-----w C:\Program Files\Channel4
2008-09-05 00:45 --------- d-----w C:\Documents and Settings\All Users\Application Data\Channel4
2008-09-03 08:28 --------- d-----w C:\Documents and Settings\Administrator\Application Data\DeepBurner
2008-09-03 08:26 --------- d-----w C:\Program Files\Astonsoft
2008-09-02 19:11 --------- d-----w C:\Program Files\PSM5
2008-09-02 19:11 --------- d-----w C:\Program Files\Cool2000
2008-09-02 10:09 24 ----a-w C:\Documents and Settings\Administrator\jagex_runescape_preferences.dat
2008-08-29 09:18 87,336 ----a-w C:\WINDOWS\system32\dns-sd.exe
2008-08-29 08:53 61,440 ----a-w C:\WINDOWS\system32\dnssd.dll
2008-08-26 07:24 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-08-23 08:11 72,390 ----a-w C:\WINDOWS\BricoPackUninst.cmd
2008-08-23 08:11 5,276 ----a-w C:\WINDOWS\BricoPackFoldersDelete.cmd
2008-08-14 10:09 2,145,280 ----a-w C:\WINDOWS\system32\ntoskrnl.exe
2008-08-14 09:33 2,023,936 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe
2008-08-12 17:22 1,598,464 ----a-w C:\WINDOWS\Internet Logs\xDB2.tmp
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296]
"RocketDock"="C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe" [2007-03-18 630784]
"NVIDIA nTune"="C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" [2007-09-04 81920]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="C:\WINDOWS\System32\igfxtray.exe" [2006-03-22 94208]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-01-08 8523776]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-01-08 81920]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-09-30 1234712]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-07-09 919016]
"BHR"="C:\Program Files\Zamaan's Software\Browser Hijack Retaliator 4.5\BHR.exe" [2006-10-24 9375744]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.Exe" [2004-03-04 4681728]
C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\
RocketDock.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe [2007-03-18 630784]
TransBar.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe [2005-06-01 65536]
UberIcon.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe [2006-05-21 180224]
Y'z Shadow.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe [2006-05-21 155648]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.exe.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-07-27 113664]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveSearch"= 1 (0x1)
"NoBandCustomize"= 0 (0x0)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoBandCustomize"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\c00C9F04]
2008-10-29 23:41 20992 C:\WINDOWS\system32\c00C9F04.mat
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.wmv3"= C:\WINDOWS\System32\WMV9VCM.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^VersionTracker Pro.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\VersionTracker Pro.lnk
backup=C:\WINDOWS\pss\VersionTracker Pro.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinFlip.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WinFlip.lnk
backup=C:\WINDOWS\pss\WinFlip.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\4oD]
--a------ 2007-04-23 10:23 1032640 C:\Program Files\Kontiki\KHost.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
--a------ 2006-12-22 06:29 67752 C:\Program Files\Adobe\Photoshop Elements 5.0\apdproxy.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
--a------ 2008-10-01 11:57 111936 C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\btbb_McciTrayApp]
--a------ 2007-11-01 03:39 1475072 C:\Program Files\BT Broadband Desktop Help\btbb\BTHelpNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\btbb_wcm_McciTrayApp]
--a------ 2007-11-29 12:30 1474048 C:\Program Files\BT Broadband Desktop Help\btbb_wcm\McciTrayApp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Daemon14]
--a------ 2000-06-02 18:07 28746 C:\PROGRA~1\MICROS~2\GAMECO~1\STRATE~1\Daemon14.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FastTVSync]
--a------ 2003-09-08 01:33 241664 C:\Program Files\Common Files\InterVideo\FastTVSync\FastTVSync.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IW Controlcenter]
--a------ 2002-03-01 14:04 732160 C:\PROGRA~1\INSTAN~1\INSTAN~1\iwctrl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\kdx]
--a------ 2007-04-23 10:23 1032640 C:\Program Files\Kontiki\KHost.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVIDIA nTune]
--a------ 2007-09-04 18:25 81920 C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2008-06-10 03:27 144784 C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 2008-01-08 17:53 1626112 C:\WINDOWS\system32\nwiz.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Kontiki\\KService.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\WINDOWS\\PCHealth\\HelpCtr\\Binaries\\helpctr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
R1 Asapi;ASAPI;C:\WINDOWS\system32\drivers\Asapi.sys [2000-01-08 10240]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-08-29 97928]
R1 vobcom;vobcom;C:\WINDOWS\system32\drivers\vobcom.sys [2001-10-04 9728]
R1 vobiw;vobiw;C:\WINDOWS\system32\drivers\vobiw.sys [2002-02-24 173568]
R2 avg8emc;AVG Free8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-08-29 875288]
R2 avg8wd;AVG Free8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-08-29 231704]
R2 AvgTdiX;AVG Free8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-07-28 76040]
R2 McciCMService;McciCMService;C:\Program Files\Common Files\Motive\McciCMService.exe [2007-11-17 303104]
R2 Vcs;Vcs support;C:\WINDOWS\system32\Drivers\Vcs.sys [2003-04-15 6852]
R3 MaBtPort;MA Bluetooth VCOM Driver;C:\WINDOWS\system32\DRIVERS\mabtport.sys [2004-12-29 101952]
R3 MaBtVad;Mobile Action Bluetooth Audio;C:\WINDOWS\system32\DRIVERS\MaBtVad.sys [2004-12-10 14414]
S1 cdrdrv;cdrdrv;C:\WINDOWS\system32\drivers\cdrdrv.sys [2002-02-23 57344]
S1 mchInjDrv;madCodeHook DLL injection driver;C:\WINDOWS\system32\Drivers\mchInjDrv.sys [2008-10-30 0]
S3 MaBtc;MA Bluetooth Core Driver;C:\WINDOWS\system32\DRIVERS\MABTC.sys [2005-01-18 96736]
S3 MovRVDrv32;MovRVDrv32;C:\WINDOWS\system32\DRIVERS\MovRVDrv32.sys [2008-04-17 3768]
S3 MREMP50;MREMP50 NDIS Protocol Driver;C:\PROGRA~1\COMMON~1\Motive\MREMP50.SYS [2007-11-17 19712]
S3 MREMP50a64;MREMP50a64 NDIS Protocol Driver;C:\PROGRA~1\COMMON~1\Motive\MREMP50a64.SYS [ ]
S3 MRESP50;MRESP50 NDIS Protocol Driver;C:\PROGRA~1\COMMON~1\Motive\MRESP50.SYS [2007-11-17 18304]
S3 MRESP50a64;MRESP50a64 NDIS Protocol Driver;C:\PROGRA~1\COMMON~1\Motive\MRESP50a64.SYS [ ]
S3 SndTDriverV32;SndTDriverV32;C:\WINDOWS\system32\drivers\SndTDriverV32.sys [2008-04-17 508544]
*Newly Created Service* - CATCHME
.
Contents of the 'Scheduled Tasks' folder
2008-11-01 C:\WINDOWS\Tasks\XoftSpySE 2.job
- C:\Program Files\XoftSpySE\XoftSpy.exe [2008-10-23 18:58]
2008-11-01 C:\WINDOWS\Tasks\XoftSpySE.job
- C:\Program Files\XoftSpySE\XoftSpy.exe [2008-10-23 18:58]
.
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page =
hxxp://www.google.com/R0 -: HKLM-Main,Start Page =
hxxp://www.google.comR0 -: HKLM-Main,Window Title =
R1 -: HKCU-Internet Settings,ProxyServer = localhost:9095
R1 -: HKCU-Internet Settings,ProxyOverride = *.local
R1 -: HKCU-SearchURL,(Default) =
hxxp://www.google.com/keyword/%s
O8 -: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O16 -: DirectAnimation Java Classes -
file://C:\WINDOWS\Java\classes\dajava.cab
C:\WINDOWS\Downloaded Program Files\DirectAnimation Java Classes.osd
O16 -: Microsoft XML Parser for Java -
file://C:\WINDOWS\Java\classes\xmldso.cab
C:\WINDOWS\Downloaded Program Files\Microsoft XML Parser for Java.osd
O16 -: {193C772A-87BE-4B19-A7BB-445B226FE9A1} -
hxxp://downloads.ewido.net/ewidoOnlineScan.cabC:\WINDOWS\Downloaded Program Files\ewidoOnlineScan.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2008-11-01 16:06:41
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\c00C9F04.mat
PROCESS: C:\WINDOWS\explorer.exe
-> C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.dll
-> C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon.dll
-> C:\WINDOWS\system32\c00C9F04.mat
.
Completion time: 2008-11-01 16:08:24
ComboFix-quarantined-files.txt 2008-11-01 16:08:18
Pre-Run: 48,593,424,384 bytes free
Post-Run: 48,583,593,984 bytes free
312 --- E O F --- 2008-11-01 03:06:32
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:11:08, on 01/11/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = localhost:9095
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AVG Safe Search - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [BHR] C:\Program Files\Zamaan's Software\Browser Hijack Retaliator 4.5\BHR.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [RocketDock] "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background (User 'Default user')
O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
O4 - Startup: TransBar.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe
O4 - Startup: UberIcon.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
O4 - Startup: Y'z Shadow.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel -
res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.google.com
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) -
http://downloads.ewido.net/ewidoOnlineScan.cabO16 - DPF: {493ACF15-5CD9-4474-82A6-91670C3DD66E} (LinkedIn ContactFinderControl) -
http://www.linkedin.com/cab/LinkedInCon ... ontrol.cabO16 - DPF: {C606BA60-AB76-48B6-96A7-2C4D5C386F70} (PreQualifier Class) -
http://help.broadbandassist.com/bbdeskt ... reQual.cabO18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O20 - Winlogon Notify: c00C9F04 - C:\WINDOWS\SYSTEM32\c00C9F04.mat
O23 - Service: Adobe Active File Monitor V5 (AdobeActiveFileMonitor5.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: KService - Kontiki Inc. - C:\Program Files\Kontiki\KService.exe
O23 - Service: McciCMService - Motive Communications, Inc. - C:\Program Files\Common Files\Motive\McciCMService.exe
O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
--
End of file - 7783 bytes