My log file.. (computer is sucking) [F]

[sharkskinman]

My problems:

Can barely browse My Computer and Hard Drive folders (with random crashes)
Alot of progammes/software won't load, work or install

Log: !Hijack would only work in safemode!


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:11:22, on 27/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Yahoo! UK & Ireland Games - Download Free Games | Free Online Games
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Live Search
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Live Search
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [Lachesis] C:\Program Files\Razer\Lachesis\razerhid.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [RemoteControl8] "C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe"
O4 - HKLM\..\Run: [PDVD8LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe"
O4 - HKLM\..\Run: [BDRegion] C:\Program Files\Cyberlink\Shared Files\brs.exe
O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [µTorrent] "C:\Documents and Settings\Project Mayhem\Desktop\utorrent.exe"
O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [uTorrent] "C:\Documents and Settings\Project Mayhem\Desktop\utorrent.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~3\Office12\GR99D3~1.DLL
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (file missing)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AFinding Service (AFinding) - Unknown owner - C:\WINDOWS\system32\afinding.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762# # (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: perfmons Service (perfmons) - Unknown owner - C:\WINDOWS\system32\perfmonss.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: WServing Service (WServing) - Unknown owner - C:\WINDOWS\system32\wserving.exe

--
End of file - 8233 bytes

[Mak213]

Hello,

You are infected. So please follow these steps:

Step1 | ComboFix

Download ComboFix from Here or Here to your Desktop.
Read first: "How to download and use ComboFix"
If you downloaded ComboFix previously, delete that version and download it again as the tool is frequently updated!

• Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

• Double click combofix.exe and follow the prompts.
• When finished, it shall produce a log for you. Post that log and a HiJackthis log in your next reply
• Be sure to re-enable your anti-virus and other security programs, after ComboFix finished.

Note: Do not mouseclick combofix's window while its running. That may cause it to stall.

Extra-Note: Please, DO NOT use ComboFix on your own. It is a very powerful tool designed to deal with sophisticated infections and if something goes wrong or you use it incorrectly, you could possibly lose the use of your computer. It is ONLY meant to be used under the direct supervision of a malware removal specialist. Please read Combofix's Disclaimer

Logs needed in next post:

ComboFix

Cheers,
Mak

[sharkskinman]

ComboFix 08-06-20.4 - Project Mayhem 2008-06-27 19:34:09.1 - NTFSx86 NETWORK
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1717 [GMT 1:00]
Running from: C:\Documents and Settings\Project Mayhem\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Project Mayhem\Application Data\inst.exe
C:\WINDOWS\system32\afinding.exe
C:\WINDOWS\system32\comsa32.sys
C:\WINDOWS\system32\drmgs.sys
C:\WINDOWS\system32\Indt2.sys
C:\WINDOWS\system32\tmp0_10077372852.bk
C:\WINDOWS\system32\tmp0_113597308196.bk
C:\WINDOWS\system32\tmp0_11392097483.bk
C:\WINDOWS\system32\tmp0_118635364573.bk
C:\WINDOWS\system32\tmp0_124260891625.bk
C:\WINDOWS\system32\tmp0_128217760213.bk
C:\WINDOWS\system32\tmp0_132165170830.bk
C:\WINDOWS\system32\tmp0_15539395597.bk
C:\WINDOWS\system32\tmp0_15753466693.bk
C:\WINDOWS\system32\tmp0_1639932636.bk
C:\WINDOWS\system32\tmp0_178617365103.bk
C:\WINDOWS\system32\tmp0_196290116344.bk
C:\WINDOWS\system32\tmp0_198921754842.bk
C:\WINDOWS\system32\tmp0_199939231759.bk
C:\WINDOWS\system32\tmp0_20028623655.bk
C:\WINDOWS\system32\tmp0_201394436025.bk
C:\WINDOWS\system32\tmp0_201962342424.bk
C:\WINDOWS\system32\tmp0_204034756151.bk
C:\WINDOWS\system32\tmp0_206231707787.bk
C:\WINDOWS\system32\tmp0_210147699919.bk
C:\WINDOWS\system32\tmp0_211214677997.bk
C:\WINDOWS\system32\tmp0_212166380553.bk
C:\WINDOWS\system32\tmp0_214850755843.bk
C:\WINDOWS\system32\tmp0_217978380767.bk
C:\WINDOWS\system32\tmp0_22571665336.bk
C:\WINDOWS\system32\tmp0_227485257105.bk
C:\WINDOWS\system32\tmp0_228187482778.bk
C:\WINDOWS\system32\tmp0_256876644847.bk
C:\WINDOWS\system32\tmp0_258919719410.bk
C:\WINDOWS\system32\tmp0_262463535222.bk
C:\WINDOWS\system32\tmp0_271212370080.bk
C:\WINDOWS\system32\tmp0_274871657653.bk
C:\WINDOWS\system32\tmp0_277545503521.bk
C:\WINDOWS\system32\tmp0_281249350475.bk
C:\WINDOWS\system32\tmp0_285181435284.bk
C:\WINDOWS\system32\tmp0_290668892181.bk
C:\WINDOWS\system32\tmp0_29526379067.bk
C:\WINDOWS\system32\tmp0_29586212963.bk
C:\WINDOWS\system32\tmp0_301082454679.bk
C:\WINDOWS\system32\tmp0_315035701496.bk
C:\WINDOWS\system32\tmp0_3158151419.bk
C:\WINDOWS\system32\tmp0_328337329076.bk
C:\WINDOWS\system32\tmp0_331881264990.bk
C:\WINDOWS\system32\tmp0_352702805243.bk
C:\WINDOWS\system32\tmp0_355800132331.bk
C:\WINDOWS\system32\tmp0_376067325875.bk
C:\WINDOWS\system32\tmp0_405721847640.bk
C:\WINDOWS\system32\tmp0_42871086850.bk
C:\WINDOWS\system32\tmp0_43519366786.bk
C:\WINDOWS\system32\tmp0_439747824924.bk
C:\WINDOWS\system32\tmp0_440994541631.bk
C:\WINDOWS\system32\tmp0_460831630539.bk
C:\WINDOWS\system32\tmp0_468508849626.bk
C:\WINDOWS\system32\tmp0_477642438022.bk
C:\WINDOWS\system32\tmp0_480720834829.bk
C:\WINDOWS\system32\tmp0_48469525265.bk
C:\WINDOWS\system32\tmp0_502498686202.bk
C:\WINDOWS\system32\tmp0_50371119032.bk
C:\WINDOWS\system32\tmp0_520286214086.bk
C:\WINDOWS\system32\tmp0_525275155804.bk
C:\WINDOWS\system32\tmp0_540134278749.bk
C:\WINDOWS\system32\tmp0_5430199100.bk
C:\WINDOWS\system32\tmp0_548918669278.bk
C:\WINDOWS\system32\tmp0_555235468438.bk
C:\WINDOWS\system32\tmp0_555480855396.bk
C:\WINDOWS\system32\tmp0_559235776622.bk
C:\WINDOWS\system32\tmp0_565078856518.bk
C:\WINDOWS\system32\tmp0_568244152050.bk
C:\WINDOWS\system32\tmp0_584348643236.bk
C:\WINDOWS\system32\tmp0_584676339471.bk
C:\WINDOWS\system32\tmp0_603364351541.bk
C:\WINDOWS\system32\tmp0_617612306586.bk
C:\WINDOWS\system32\tmp0_618777736766.bk
C:\WINDOWS\system32\tmp0_623803486668.bk
C:\WINDOWS\system32\tmp0_630490857163.bk
C:\WINDOWS\system32\tmp0_636469139065.bk
C:\WINDOWS\system32\tmp0_665870276682.bk
C:\WINDOWS\system32\tmp0_668898661030.bk
C:\WINDOWS\system32\tmp0_669369466639.bk
C:\WINDOWS\system32\tmp0_67214885096.bk
C:\WINDOWS\system32\tmp0_672533231330.bk
C:\WINDOWS\system32\tmp0_68966577495.bk
C:\WINDOWS\system32\tmp0_701293543944.bk
C:\WINDOWS\system32\tmp0_712740399262.bk
C:\WINDOWS\system32\tmp0_71328790517.bk
C:\WINDOWS\system32\tmp0_716313336620.bk
C:\WINDOWS\system32\tmp0_718081567321.bk
C:\WINDOWS\system32\tmp0_724179673883.bk
C:\WINDOWS\system32\tmp0_734249668372.bk
C:\WINDOWS\system32\tmp0_741310166384.bk
C:\WINDOWS\system32\tmp0_743335570072.bk
C:\WINDOWS\system32\tmp0_74862460012.bk
C:\WINDOWS\system32\tmp0_751007594298.bk
C:\WINDOWS\system32\tmp0_761623182963.bk
C:\WINDOWS\system32\tmp0_76959412684.bk
C:\WINDOWS\system32\tmp0_771978745901.bk
C:\WINDOWS\system32\tmp0_773945471774.bk
C:\WINDOWS\system32\tmp0_786141766122.bk
C:\WINDOWS\system32\tmp0_787979552001.bk
C:\WINDOWS\system32\tmp0_792415187070.bk
C:\WINDOWS\system32\tmp0_7949131276.bk
C:\WINDOWS\system32\tmp0_79852573413.bk
C:\WINDOWS\system32\tmp0_801669215265.bk
C:\WINDOWS\system32\tmp0_80167522060.bk
C:\WINDOWS\system32\tmp0_80501195516.bk
C:\WINDOWS\system32\tmp0_813322311908.bk
C:\WINDOWS\system32\tmp0_81540726889.bk
C:\WINDOWS\system32\tmp0_819549636549.bk
C:\WINDOWS\system32\tmp0_820813252222.bk
C:\WINDOWS\system32\tmp0_822345290740.bk
C:\WINDOWS\system32\tmp0_824620590202.bk
C:\WINDOWS\system32\tmp0_828662562878.bk
C:\WINDOWS\system32\tmp0_833923781705.bk
C:\WINDOWS\system32\tmp0_834584654685.bk
C:\WINDOWS\system32\tmp0_837119289001.bk
C:\WINDOWS\system32\tmp0_842956613148.bk
C:\WINDOWS\system32\tmp0_844086698623.bk
C:\WINDOWS\system32\tmp0_876600292135.bk
C:\WINDOWS\system32\tmp0_877499769887.bk
C:\WINDOWS\system32\tmp0_879390250101.bk
C:\WINDOWS\system32\tmp0_88286040776.bk
C:\WINDOWS\system32\tmp0_88451737680.bk
C:\WINDOWS\system32\tmp0_889975465779.bk
C:\WINDOWS\system32\tmp0_89095332047.bk
C:\WINDOWS\system32\tmp0_894972484381.bk
C:\WINDOWS\system32\tmp0_899749367934.bk
C:\WINDOWS\system32\tmp0_92545287161.bk
C:\WINDOWS\system32\tmp1_10395995700.bk
C:\WINDOWS\system32\tmp1_107855825082.bk
C:\WINDOWS\system32\tmp1_11378443830.bk
C:\WINDOWS\system32\tmp1_118895708895.bk
C:\WINDOWS\system32\tmp1_128993693764.bk
C:\WINDOWS\system32\tmp1_138659300682.bk
C:\WINDOWS\system32\tmp1_159847789819.bk
C:\WINDOWS\system32\tmp1_164442462441.bk
C:\WINDOWS\system32\tmp1_1648741429.bk
C:\WINDOWS\system32\tmp1_167960827130.bk
C:\WINDOWS\system32\tmp1_179712734495.bk
C:\WINDOWS\system32\tmp1_180758678864.bk
C:\WINDOWS\system32\tmp1_180886224575.bk
C:\WINDOWS\system32\tmp1_200966602310.bk
C:\WINDOWS\system32\tmp1_217697856538.bk
C:\WINDOWS\system32\tmp1_231862407118.bk
C:\WINDOWS\system32\tmp1_236915177153.bk
C:\WINDOWS\system32\tmp1_247891261187.bk
C:\WINDOWS\system32\tmp1_25241515751.bk
C:\WINDOWS\system32\tmp1_257057446986.bk
C:\WINDOWS\system32\tmp1_274216795596.bk
C:\WINDOWS\system32\tmp1_277558728202.bk
C:\WINDOWS\system32\tmp1_290328496885.bk
C:\WINDOWS\system32\tmp1_293225614077.bk
C:\WINDOWS\system32\tmp1_315856417915.bk
C:\WINDOWS\system32\tmp1_334519735320.bk
C:\WINDOWS\system32\tmp1_352510531807.bk
C:\WINDOWS\system32\tmp1_355597294492.bk
C:\WINDOWS\system32\tmp1_359537305388.bk
C:\WINDOWS\system32\tmp1_396031177358.bk
C:\WINDOWS\system32\tmp1_397901246641.bk
C:\WINDOWS\system32\tmp1_398838804361.bk
C:\WINDOWS\system32\tmp1_405939691438.bk
C:\WINDOWS\system32\tmp1_415671708604.bk
C:\WINDOWS\system32\tmp1_419982649345.bk
C:\WINDOWS\system32\tmp1_42285920586.bk
C:\WINDOWS\system32\tmp1_427332699755.bk
C:\WINDOWS\system32\tmp1_431940190336.bk
C:\WINDOWS\system32\tmp1_432068206334.bk
C:\WINDOWS\system32\tmp1_43540412959.bk
C:\WINDOWS\system32\tmp1_443580126725.bk
C:\WINDOWS\system32\tmp1_45053776222.bk
C:\WINDOWS\system32\tmp1_4757161206.bk
C:\WINDOWS\system32\tmp1_477854698510.bk
C:\WINDOWS\system32\tmp1_479646104404.bk
C:\WINDOWS\system32\tmp1_482702779026.bk
C:\WINDOWS\system32\tmp1_4840169237.bk
C:\WINDOWS\system32\tmp1_48426866739.bk
C:\WINDOWS\system32\tmp1_48683034402.bk
C:\WINDOWS\system32\tmp1_507181414365.bk
C:\WINDOWS\system32\tmp1_514754699081.bk
C:\WINDOWS\system32\tmp1_53414100472.bk
C:\WINDOWS\system32\tmp1_53720012128.bk
C:\WINDOWS\system32\tmp1_557480640915.bk
C:\WINDOWS\system32\tmp1_560954600014.bk
C:\WINDOWS\system32\tmp1_563699521528.bk
C:\WINDOWS\system32\tmp1_569448204429.bk
C:\WINDOWS\system32\tmp1_588882593289.bk
C:\WINDOWS\system32\tmp1_603267797985.bk
C:\WINDOWS\system32\tmp1_616421858257.bk
C:\WINDOWS\system32\tmp1_629471535439.bk
C:\WINDOWS\system32\tmp1_641283838682.bk
C:\WINDOWS\system32\tmp1_661199215900.bk
C:\WINDOWS\system32\tmp1_66188697545.bk
C:\WINDOWS\system32\tmp1_664095679939.bk
C:\WINDOWS\system32\tmp1_66991883374.bk
C:\WINDOWS\system32\tmp1_676194446236.bk
C:\WINDOWS\system32\tmp1_67983321338.bk
C:\WINDOWS\system32\tmp1_695948787914.bk
C:\WINDOWS\system32\tmp1_71885899489.bk
C:\WINDOWS\system32\tmp1_727417574065.bk
C:\WINDOWS\system32\tmp1_73008180719.bk
C:\WINDOWS\system32\tmp1_743827848689.bk
C:\WINDOWS\system32\tmp1_748167633808.bk
C:\WINDOWS\system32\tmp1_749574763881.bk
C:\WINDOWS\system32\tmp1_750800284562.bk
C:\WINDOWS\system32\tmp1_754582817359.bk
C:\WINDOWS\system32\tmp1_755944720124.bk
C:\WINDOWS\system32\tmp1_756998580349.bk
C:\WINDOWS\system32\tmp1_775933204055.bk
C:\WINDOWS\system32\tmp1_787515675576.bk
C:\WINDOWS\system32\tmp1_791135108130.bk
C:\WINDOWS\system32\tmp1_807130386868.bk
C:\WINDOWS\system32\tmp1_80911514131.bk
C:\WINDOWS\system32\tmp1_813151783668.bk
C:\WINDOWS\system32\tmp1_816490391322.bk
C:\WINDOWS\system32\tmp1_823788826574.bk
C:\WINDOWS\system32\tmp1_837692743674.bk
C:\WINDOWS\system32\tmp1_841796876895.bk
C:\WINDOWS\system32\tmp1_845001841329.bk
C:\WINDOWS\system32\tmp1_851420818325.bk
C:\WINDOWS\system32\tmp1_858421206160.bk
C:\WINDOWS\system32\tmp1_861035896749.bk
C:\WINDOWS\system32\tmp1_863919282250.bk
C:\WINDOWS\system32\tmp1_87152981854.bk
C:\WINDOWS\system32\tmp1_891778453837.bk
C:\WINDOWS\system32\tmp1_893732653242.bk
C:\WINDOWS\system32\tmp1_897293509821.bk

[sharkskinman]

C:\WINDOWS\system32\tmp1_93370809587.bk
C:\WINDOWS\system32\tmp2_10526497387.bk
C:\WINDOWS\system32\tmp2_134636130909.bk
C:\WINDOWS\system32\tmp2_195172581180.bk
C:\WINDOWS\system32\tmp2_22718659265.bk
C:\WINDOWS\system32\tmp2_348006143954.bk
C:\WINDOWS\system32\tmp2_411824761106.bk
C:\WINDOWS\system32\tmp2_493241270727.bk
C:\WINDOWS\system32\tmp2_554079283433.bk
C:\WINDOWS\system32\tmp2_562884285979.bk
C:\WINDOWS\system32\tmp2_618309424816.bk
C:\WINDOWS\system32\tmp2_639655235686.bk
C:\WINDOWS\system32\tmp2_68439897175.bk
C:\WINDOWS\system32\tmp2_709680503923.bk
C:\WINDOWS\system32\tmp2_713621907.bk
C:\WINDOWS\system32\tmp2_740768570776.bk
C:\WINDOWS\system32\tmp2_854662653566.bk
C:\WINDOWS\system32\tmp2_890815433930.bk
C:\WINDOWS\system32\tmp3_108427876291.bk
C:\WINDOWS\system32\tmp3_109322509618.bk
C:\WINDOWS\system32\tmp3_109922809937.bk
C:\WINDOWS\system32\tmp3_112127754670.bk
C:\WINDOWS\system32\tmp3_116339381182.bk
C:\WINDOWS\system32\tmp3_122233718074.bk
C:\WINDOWS\system32\tmp3_124204541509.bk
C:\WINDOWS\system32\tmp3_129524102245.bk
C:\WINDOWS\system32\tmp3_130178247827.bk
C:\WINDOWS\system32\tmp3_134204252964.bk
C:\WINDOWS\system32\tmp3_142112320679.bk
C:\WINDOWS\system32\tmp3_146596363112.bk
C:\WINDOWS\system32\tmp3_148012791747.bk
C:\WINDOWS\system32\tmp3_155480688579.bk
C:\WINDOWS\system32\tmp3_155782106358.bk
C:\WINDOWS\system32\tmp3_156083888581.bk
C:\WINDOWS\system32\tmp3_156401498380.bk
C:\WINDOWS\system32\tmp3_163214165309.bk
C:\WINDOWS\system32\tmp3_168685616304.bk
C:\WINDOWS\system32\tmp3_169138174677.bk
C:\WINDOWS\system32\tmp3_17262404428.bk
C:\WINDOWS\system32\tmp3_17652796514.bk
C:\WINDOWS\system32\tmp3_181904124179.bk
C:\WINDOWS\system32\tmp3_19990875511.bk
C:\WINDOWS\system32\tmp3_207688101058.bk
C:\WINDOWS\system32\tmp3_22895364030.bk
C:\WINDOWS\system32\tmp3_231137133739.bk
C:\WINDOWS\system32\tmp3_231575648318.bk
C:\WINDOWS\system32\tmp3_23549495046.bk
C:\WINDOWS\system32\tmp3_236201658782.bk
C:\WINDOWS\system32\tmp3_242865692958.bk
C:\WINDOWS\system32\tmp3_265319213112.bk
C:\WINDOWS\system32\tmp3_27885181488.bk
C:\WINDOWS\system32\tmp3_2841350647.bk
C:\WINDOWS\system32\tmp3_32663532065.bk
C:\WINDOWS\system32\tmp3_345857160329.bk
C:\WINDOWS\system32\tmp3_349451120520.bk
C:\WINDOWS\system32\tmp3_350269308198.bk
C:\WINDOWS\system32\tmp3_366372661621.bk
C:\WINDOWS\system32\tmp3_376781212146.bk
C:\WINDOWS\system32\tmp3_39093784031.bk
C:\WINDOWS\system32\tmp3_39371961177.bk
C:\WINDOWS\system32\tmp3_408626556054.bk
C:\WINDOWS\system32\tmp3_436906785201.bk
C:\WINDOWS\system32\tmp3_4476126521.bk
C:\WINDOWS\system32\tmp3_456489860715.bk
C:\WINDOWS\system32\tmp3_462139692484.bk
C:\WINDOWS\system32\tmp3_463488536922.bk
C:\WINDOWS\system32\tmp3_49108195721.bk
C:\WINDOWS\system32\tmp3_492075593363.bk
C:\WINDOWS\system32\tmp3_492731532607.bk
C:\WINDOWS\system32\tmp3_493042566985.bk
C:\WINDOWS\system32\tmp3_4972592218.bk
C:\WINDOWS\system32\tmp3_507980547708.bk
C:\WINDOWS\system32\tmp3_514089363330.bk
C:\WINDOWS\system32\tmp3_51414468379.bk
C:\WINDOWS\system32\tmp3_51418189521.bk
C:\WINDOWS\system32\tmp3_516133164654.bk
C:\WINDOWS\system32\tmp3_518171406522.bk
C:\WINDOWS\system32\tmp3_5195048463.bk
C:\WINDOWS\system32\tmp3_521849325096.bk
C:\WINDOWS\system32\tmp3_522265148729.bk
C:\WINDOWS\system32\tmp3_526210103997.bk
C:\WINDOWS\system32\tmp3_526297413933.bk
C:\WINDOWS\system32\tmp3_537465608036.bk
C:\WINDOWS\system32\tmp3_544548410140.bk
C:\WINDOWS\system32\tmp3_549220152262.bk
C:\WINDOWS\system32\tmp3_550615563907.bk
C:\WINDOWS\system32\tmp3_565906834994.bk
C:\WINDOWS\system32\tmp3_584759879412.bk
C:\WINDOWS\system32\tmp3_587711715976.bk
C:\WINDOWS\system32\tmp3_587885559047.bk
C:\WINDOWS\system32\tmp3_598249149310.bk
C:\WINDOWS\system32\tmp3_599153208676.bk
C:\WINDOWS\system32\tmp3_622108665320.bk
C:\WINDOWS\system32\tmp3_62658277992.bk
C:\WINDOWS\system32\tmp3_630566131772.bk
C:\WINDOWS\system32\tmp3_638822346223.bk
C:\WINDOWS\system32\tmp3_642742650331.bk
C:\WINDOWS\system32\tmp3_650326487874.bk
C:\WINDOWS\system32\tmp3_651968168400.bk
C:\WINDOWS\system32\tmp3_652496224026.bk
C:\WINDOWS\system32\tmp3_653403214063.bk
C:\WINDOWS\system32\tmp3_658946210541.bk
C:\WINDOWS\system32\tmp3_66218162517.bk
C:\WINDOWS\system32\tmp3_672393622795.bk
C:\WINDOWS\system32\tmp3_673482809658.bk
C:\WINDOWS\system32\tmp3_677467751119.bk
C:\WINDOWS\system32\tmp3_681716596817.bk
C:\WINDOWS\system32\tmp3_692779526344.bk
C:\WINDOWS\system32\tmp3_69328693683.bk
C:\WINDOWS\system32\tmp3_695552250535.bk
C:\WINDOWS\system32\tmp3_699638674409.bk
C:\WINDOWS\system32\tmp3_700267107915.bk
C:\WINDOWS\system32\tmp3_71196378915.bk
C:\WINDOWS\system32\tmp3_722107315239.bk
C:\WINDOWS\system32\tmp3_722567246483.bk
C:\WINDOWS\system32\tmp3_731214772922.bk
C:\WINDOWS\system32\tmp3_731674694340.bk
C:\WINDOWS\system32\tmp3_765924387584.bk
C:\WINDOWS\system32\tmp3_769305282290.bk
C:\WINDOWS\system32\tmp3_785969203970.bk
C:\WINDOWS\system32\tmp3_7889145057.bk
C:\WINDOWS\system32\tmp3_791320258376.bk
C:\WINDOWS\system32\tmp3_793654408508.bk
C:\WINDOWS\system32\tmp3_807819105385.bk
C:\WINDOWS\system32\tmp3_813878253536.bk
C:\WINDOWS\system32\tmp3_818269311858.bk
C:\WINDOWS\system32\tmp3_82292392665.bk
C:\WINDOWS\system32\tmp3_826548383914.bk
C:\WINDOWS\system32\tmp3_826868277205.bk
C:\WINDOWS\system32\tmp3_833749490154.bk
C:\WINDOWS\system32\tmp3_842950575920.bk
C:\WINDOWS\system32\tmp3_848947564764.bk
C:\WINDOWS\system32\tmp3_849295772830.bk
C:\WINDOWS\system32\tmp3_855467451849.bk
C:\WINDOWS\system32\tmp3_85869543860.bk
C:\WINDOWS\system32\tmp3_858862615738.bk
C:\WINDOWS\system32\tmp3_862490828127.bk
C:\WINDOWS\system32\tmp3_880360260174.bk
C:\WINDOWS\system32\tmp3_883326351893.bk
C:\WINDOWS\system32\tmp3_890675369028.bk
C:\WINDOWS\system32\tmp3_9305574986.bk
C:\WINDOWS\system32\tmp3_95886201111.bk
C:\WINDOWS\system32\tmp4_10327219940.bk
C:\WINDOWS\system32\tmp4_112283799817.bk
C:\WINDOWS\system32\tmp4_113332714380.bk
C:\WINDOWS\system32\tmp4_122187775636.bk
C:\WINDOWS\system32\tmp4_128691130452.bk
C:\WINDOWS\system32\tmp4_1391217671.bk
C:\WINDOWS\system32\tmp4_1445023902.bk
C:\WINDOWS\system32\tmp4_146815561373.bk
C:\WINDOWS\system32\tmp4_147845484573.bk
C:\WINDOWS\system32\tmp4_156760377274.bk
C:\WINDOWS\system32\tmp4_159039101689.bk
C:\WINDOWS\system32\tmp4_159062205988.bk
C:\WINDOWS\system32\tmp4_185391549105.bk
C:\WINDOWS\system32\tmp4_195693731071.bk
C:\WINDOWS\system32\tmp4_197740458919.bk
C:\WINDOWS\system32\tmp4_205154789516.bk
C:\WINDOWS\system32\tmp4_20813866646.bk
C:\WINDOWS\system32\tmp4_21150295204.bk
C:\WINDOWS\system32\tmp4_214533393392.bk
C:\WINDOWS\system32\tmp4_217231148338.bk
C:\WINDOWS\system32\tmp4_228954556312.bk
C:\WINDOWS\system32\tmp4_23555616344.bk
C:\WINDOWS\system32\tmp4_245010854142.bk
C:\WINDOWS\system32\tmp4_255016135984.bk
C:\WINDOWS\system32\tmp4_255264483901.bk
C:\WINDOWS\system32\tmp4_26384889955.bk
C:\WINDOWS\system32\tmp4_26801380412.bk
C:\WINDOWS\system32\tmp4_275436671503.bk
C:\WINDOWS\system32\tmp4_310009690982.bk
C:\WINDOWS\system32\tmp4_314244399634.bk
C:\WINDOWS\system32\tmp4_320762859906.bk
C:\WINDOWS\system32\tmp4_324976617824.bk
C:\WINDOWS\system32\tmp4_355850851430.bk
C:\WINDOWS\system32\tmp4_369112636476.bk
C:\WINDOWS\system32\tmp4_375044391844.bk
C:\WINDOWS\system32\tmp4_375531150319.bk
C:\WINDOWS\system32\tmp4_381646165026.bk
C:\WINDOWS\system32\tmp4_382209358023.bk
C:\WINDOWS\system32\tmp4_386223256.bk
C:\WINDOWS\system32\tmp4_395393656310.bk
C:\WINDOWS\system32\tmp4_395601354791.bk
C:\WINDOWS\system32\tmp4_401223827624.bk
C:\WINDOWS\system32\tmp4_409249796659.bk
C:\WINDOWS\system32\tmp4_41681518984.bk
C:\WINDOWS\system32\tmp4_429809406107.bk
C:\WINDOWS\system32\tmp4_44178255497.bk
C:\WINDOWS\system32\tmp4_445904647729.bk
C:\WINDOWS\system32\tmp4_457049425877.bk
C:\WINDOWS\system32\tmp4_45961226908.bk
C:\WINDOWS\system32\tmp4_461708778703.bk
C:\WINDOWS\system32\tmp4_463256484221.bk
C:\WINDOWS\system32\tmp4_476910550859.bk
C:\WINDOWS\system32\tmp4_479499441144.bk
C:\WINDOWS\system32\tmp4_488689237747.bk
C:\WINDOWS\system32\tmp4_489966687496.bk
C:\WINDOWS\system32\tmp4_490714367200.bk
C:\WINDOWS\system32\tmp4_511504281053.bk
C:\WINDOWS\system32\tmp4_517614312271.bk
C:\WINDOWS\system32\tmp4_53781836738.bk
C:\WINDOWS\system32\tmp4_53868531722.bk
C:\WINDOWS\system32\tmp4_540971793301.bk
C:\WINDOWS\system32\tmp4_555328513770.bk
C:\WINDOWS\system32\tmp4_557291568051.bk
C:\WINDOWS\system32\tmp4_558957267690.bk
C:\WINDOWS\system32\tmp4_568976851446.bk
C:\WINDOWS\system32\tmp4_575058294355.bk
C:\WINDOWS\system32\tmp4_57641521374.bk
C:\WINDOWS\system32\tmp4_585791771165.bk
C:\WINDOWS\system32\tmp4_599969863763.bk
C:\WINDOWS\system32\tmp4_605972697524.bk
C:\WINDOWS\system32\tmp4_609797341738.bk
C:\WINDOWS\system32\tmp4_624792424725.bk
C:\WINDOWS\system32\tmp4_629535187224.bk
C:\WINDOWS\system32\tmp4_630312804261.bk
C:\WINDOWS\system32\tmp4_636268580384.bk
C:\WINDOWS\system32\tmp4_640355465211.bk
C:\WINDOWS\system32\tmp4_643588605146.bk
C:\WINDOWS\system32\tmp4_644203226187.bk
C:\WINDOWS\system32\tmp4_64559738722.bk
C:\WINDOWS\system32\tmp4_653172891451.bk
C:\WINDOWS\system32\tmp4_670647272262.bk
C:\WINDOWS\system32\tmp4_67083436425.bk
C:\WINDOWS\system32\tmp4_677760541950.bk
C:\WINDOWS\system32\tmp4_678387185940.bk
C:\WINDOWS\system32\tmp4_67971853346.bk
C:\WINDOWS\system32\tmp4_684743691425.bk
C:\WINDOWS\system32\tmp4_687948595228.bk
C:\WINDOWS\system32\tmp4_691759119358.bk
C:\WINDOWS\system32\tmp4_694753163335.bk
C:\WINDOWS\system32\tmp4_695755613286.bk
C:\WINDOWS\system32\tmp4_700291280111.bk
C:\WINDOWS\system32\tmp4_70183932177.bk
C:\WINDOWS\system32\tmp4_703596363609.bk
C:\WINDOWS\system32\tmp4_706424547196.bk
C:\WINDOWS\system32\tmp4_70806392037.bk
C:\WINDOWS\system32\tmp4_71290377886.bk
C:\WINDOWS\system32\tmp4_71969530895.bk
C:\WINDOWS\system32\tmp4_72247561528.bk
C:\WINDOWS\system32\tmp4_748254289683.bk
C:\WINDOWS\system32\tmp4_760060808640.bk
C:\WINDOWS\system32\tmp4_765569578011.bk
C:\WINDOWS\system32\tmp4_775127781506.bk
C:\WINDOWS\system32\tmp4_79576516539.bk
C:\WINDOWS\system32\tmp4_799209489212.bk
C:\WINDOWS\system32\tmp4_809724404249.bk
C:\WINDOWS\system32\tmp4_820601433670.bk
C:\WINDOWS\system32\tmp4_825346345990.bk
C:\WINDOWS\system32\tmp4_825549483506.bk
C:\WINDOWS\system32\tmp4_8282838736.bk
C:\WINDOWS\system32\tmp4_828591771643.bk
C:\WINDOWS\system32\tmp4_835369238930.bk
C:\WINDOWS\system32\tmp4_839266175732.bk
C:\WINDOWS\system32\tmp4_85981361522.bk
C:\WINDOWS\system32\tmp4_860490770014.bk
C:\WINDOWS\system32\tmp4_866255726509.bk
C:\WINDOWS\system32\tmp4_867871655404.bk
C:\WINDOWS\system32\tmp4_879403805152.bk
C:\WINDOWS\system32\tmp4_881378342798.bk
C:\WINDOWS\system32\tmp4_884392727513.bk
C:\WINDOWS\system32\tmp4_88702802270.bk
C:\WINDOWS\system32\tmp4_899127352970.bk
C:\WINDOWS\system32\tmp4_98387219062.bk
C:\WINDOWS\system32\WServing.exe

[sharkskinman]

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_AFINDING
-------\Legacy_PERFMONS
-------\Legacy_ROUTING
-------\Legacy_WSERVING
-------\Service_AFinding
-------\Service_perfmons
-------\Service_WServing


((((((((((((((((((((((((( Files Created from 2008-05-27 to 2008-06-27 )))))))))))))))))))))))))))))))
.

2008-06-27 19:33 . 2008-06-27 19:33 <DIR> d-------- C:\Program Files\Common Files\xing shared
2008-06-27 15:23 . 2008-06-27 15:23 <DIR> d-------- C:\Program Files\MSConfig CleanUp
2008-06-27 11:32 . 2008-06-27 11:33 664 --a------ C:\WINDOWS\system32\d3d9caps.dat
2008-06-27 11:31 . 2008-06-27 11:31 <DIR> d-------- C:\Documents and Settings\Administrator
2008-06-27 10:30 . 2008-06-27 10:30 <DIR> d-------- C:\Program Files\CCleaner
2008-06-27 10:18 . 2008-06-27 10:18 <DIR> d-------- C:\VundoFix Backups
2008-06-26 20:08 . 2008-06-26 20:08 <DIR> d-------- C:\Program Files\Trend Micro
2008-06-26 18:35 . 2008-06-26 18:35 <DIR> d-------- C:\Program Files\SourceTec
2008-06-26 16:28 . 2008-06-27 14:04 8,192 --ahs---- C:\WINDOWS\Thumbs.db
2008-06-16 00:53 . 2008-06-16 00:53 <DIR> d-------- C:\Program Files\ScrollBar
2008-06-16 00:53 . 2008-06-16 00:53 <DIR> d-------- C:\Documents and Settings\Project Mayhem\Application Data\Sam Francke
2008-06-16 00:01 . 2008-02-14 14:30 17,542 --a------ C:\WINDOWS\SothinkScroller.ico
2008-06-16 00:00 . 2008-06-26 17:34 <DIR> d-------- C:\Program Files\Common Files\SourceTec
2008-06-16 00:00 . 2008-02-14 14:30 140,288 --a------ C:\WINDOWS\system32\COMDLG32.OCX
2008-06-16 00:00 . 2008-02-14 14:30 44,544 --a------ C:\WINDOWS\system32\msxml4a.dll
2008-06-12 03:23 . 2008-06-12 03:23 268 --ah----- C:\sqmdata17.sqm
2008-06-12 03:23 . 2008-06-12 03:23 244 --ah----- C:\sqmnoopt17.sqm
2008-06-11 11:01 . 2008-06-11 11:01 <DIR> d-------- C:\Program Files\QuickTime
2008-06-11 09:49 . 2008-06-11 09:49 268 --ah----- C:\sqmdata16.sqm
2008-06-11 09:49 . 2008-06-11 09:49 244 --ah----- C:\sqmnoopt16.sqm
2008-06-11 04:27 . 2008-06-13 14:10 272,128 --------- C:\WINDOWS\system32\drivers\bthport.sys
2008-06-11 04:27 . 2008-06-13 14:10 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
2008-06-10 14:12 . 2008-06-10 14:12 268 --ah----- C:\sqmdata15.sqm
2008-06-10 14:12 . 2008-06-10 14:12 244 --ah----- C:\sqmnoopt15.sqm
2008-05-28 12:50 . 2008-06-17 20:20 <DIR> d-------- C:\Program Files\Opera

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
.
2008-06-27 18:38 --------- d-----w C:\Program Files\Steam
2008-06-27 18:33 --------- d-----w C:\Program Files\Common Files\Real
2008-06-27 15:27 --------- d-----w C:\Program Files\Mozilla Thunderbird
2008-06-27 15:26 --------- d-----w C:\Documents and Settings\All Users\Application Data\avg8
2008-06-27 14:52 --------- d-----w C:\Documents and Settings\Project Mayhem\Application Data\uTorrent
2008-06-14 00:09 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-06-11 10:21 --------- d-----w C:\Documents and Settings\All Users\Application Data\FLEXnet
2008-06-11 02:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-06-09 11:09 --------- d-----w C:\Documents and Settings\Project Mayhem\Application Data\eBookPro6
2008-06-03 11:58 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-03 11:58 --------- d-----w C:\Program Files\GlobalSCAPE
2008-06-03 11:14 --------- d-----w C:\Program Files\SmartFTP Client 3.0 Setup Files
2008-05-26 11:15 --------- d-----w C:\Documents and Settings\All Users\Application Data\CyberLink
2008-05-26 11:14 --------- d-----w C:\Program Files\CyberLink
2008-05-26 11:14 --------- d-----w C:\Documents and Settings\Project Mayhem\Application Data\CyberLink
2008-05-20 22:50 --------- d-----w C:\Program Files\DivX
2008-05-20 13:39 --------- d-----w C:\Program Files\Alwil Software
2008-05-15 12:42 --------- d-----w C:\Documents and Settings\Project Mayhem\Application Data\GlobalSCAPE
2008-05-15 12:42 --------- d-----w C:\Documents and Settings\All Users\Application Data\GlobalSCAPE
2008-05-13 20:01 --------- d-----w C:\Documents and Settings\Project Mayhem\Application Data\Vso
2008-05-08 22:02 --------- d-----w C:\Documents and Settings\LocalService\Application Data\Thunderbird
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
2008-01-26 10:49 47,360 ----a-w C:\Documents and Settings\Project Mayhem\Application Data\pcouffin.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
"CTSyncU.exe"="C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe" [2007-04-10 09:15 868352]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-27 20:03 152872]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-02-28 13:00 15360]
"Steam"="C:\Program Files\Steam\Steam.exe" [2008-03-31 20:33 1271032]
"µTorrent"="C:\Documents and Settings\Project Mayhem\Desktop\utorrent.exe" [2008-03-23 18:01 219952]
"NVIDIA nTune"="C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" [2007-09-04 20:25 81920]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 12:34 5724184]
"uTorrent"="C:\Documents and Settings\Project Mayhem\Desktop\utorrent.exe" [2008-03-23 18:01 219952]
"DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-04-01 10:39 486856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 02:41 8523776]
"nwiz"="nwiz.exe" [2007-12-05 02:41 1626112 C:\WINDOWS\system32\nwiz.exe]
"CTHelper"="CTHELPER.EXE" [2006-08-17 11:32 17920 C:\WINDOWS\CTHELPER.EXE]
"CTxfiHlp"="CTXFIHLP.EXE" [2006-08-17 11:32 18944 C:\WINDOWS\system32\CTXFIHLP.EXE]
"UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 01:00 90112]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [ ]
"Lachesis"="C:\Program Files\Razer\Lachesis\razerhid.exe" [2007-09-12 12:52 172032]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 16:57 153136]
"ISUSPM"="C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-03-20 18:34 213936]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray. dll" [2007-12-05 02:41 81920]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 01:47 31016]
"RemoteControl8"="C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe" [2008-02-18 18:33 77824]
"PDVD8LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe" [2007-12-14 11:36 50472]
"BDRegion"="C:\Program Files\Cyberlink\Shared Files\brs.exe" [2007-11-14 23:10 91432]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-06-27 19:33 185896]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Cur rentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2006-02-28 13:00 15360]

C:\Documents and Settings\Project Mayhem\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 19:16:50 113664]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
InterVideo WinCinema Manager.lnk - C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe [2007-08-30 12:41:43 278528]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.ac3filter"= ac3filter.acm

[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Documents and Settings\\Project Mayhem\\Desktop\\utorrent.exe"=
"C:\\Program Files\\InterVideo\\DVD7\\WinDVD.exe"=
"C:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"C:\\Program Files\\Soulseek\\slsk.exe"=
"C:\\Documents and Settings\\Project Mayhem\\Desktop\\My Work\\RatioKing\\RatioMaster.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Steam\\SteamApps\\hewhohasissues\\team fortress 2\\hl2.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"C:\\Program Files\\GlobalSCAPE\\CuteFTP 8 Professional\\ftpte.exe"=
"C:\\kav\\kav7.0\\english\\setup.exe"=
"C:\\Program Files\\CyberLink\\PowerDVD8\\PowerDVD8.exe"=
"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=

R2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};C:\Program Files\CyberLink\PowerDVD8\000.fcl [2008-02-01 17:24]
R3 ha20x2k;Creative 20X HAL Driver;C:\WINDOWS\system32\drivers\ha20x2k.sys [2006-08-17 11:16]
R3 LachesisFltr;Lachesis Mouse Driver;C:\WINDOWS\system32\drivers\Lachesis.sys [2007-08-08 12:04]

.
************************************************** ************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-27 19:37:58
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

************************************************** ************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{ FE4C91E7-22C2-4D0C-9F6B-82F1B7742054}]
"ImagePath"="\??\C:\Program Files\CyberLink\PowerDVD8\000.fcl"
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTSVCCDA.EXE
C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
C:\WINDOWS\system32\CTXFISPI.EXE
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Razer\Lachesis\OSD.exe
C:\Program Files\Razer\Lachesis\razertra.exe
C:\Program Files\Razer\Lachesis\razerofa.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\system32\wscntfy.exe
.
************************************************** ************************
.
Completion time: 2008-06-27 19:41:51 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-27 18:41:48

Pre-Run: 39,166,046,208 bytes free
Post-Run: 41,071,407,104 bytes free

672 --- E O F --- 2008-06-21 02:00:47

[Mak213]

Hello,

How is the machine running now? I do not see anything on your logs. But you might want to do as i suggest below. They are experts. I am not.

I suggest you take your log to the malware doctors found in this forum.
Please make sure that you read this before posting anything in the malware forum.

If you're still having problems after the malware doctors declare your log clean feel free to post back here and we'll help you to the best of our knowledge!

Cheers,
Mak

[sharkskinman]

Many thanks for your time and help

yeah everything seems fine now after ComboFix rebooted my comp - I had just uninstalled Avast anti-virus aswell so that might have helped!

cheers