malware/trojan infection keeps reappearing

[liferasta]

Ok, I ran Combofix in safe mode checking all avg & spyware programs are not running with task manager, note its says avg, spybot (teatimer/resident shield deselected)  & ad-aware (uninstalled) are still running, however Combofix has not removed the two reported trojans as they are still in the windows/sytem32 folder, see attachment for log

[Derek]

I am almost certain they are part of video get & you need to uninstall that beofre we can get super antispyware to remove them

I am getting conflicting reports from antivirus companies & some say malicious but soem say innocent

looking at the files they are definitely soemthing to do with video downloading

[liferasta]

I have uninstalled Videoget & used Superanti Spyware to remove the trojans, Ill wait & see if they come back without Videoget

[Derek]

let me know what happens

[liferasta]

The files have returned in the same folder as before & this is without Videoget installed, if you think its to do with code for downloading video then it could belong to Realplayer Browser Record Plugin thats added to my Mozilla browser, other than that my guess is that when i had Avira installed it was blocking an installation everyday claiming to be Microsofts Windows Malicious Tool which should only be downloaded in a Windows update once a month, Combofix did remove some Windows Installers the last time I ran it, see below

Trojan.Agent/Gen-ModuleR[N]
   C:\WINDOWS\SYSTEM32\BELEIVEFG.DLL

Trojan.Agent/Gen-Mondlike-STS
   C:\WINDOWS\SYSTEM32\RCADNATU.DLL

ComboFix 09-09-09.04 - User 10/09/2009  6:04.8.2 - NTFSx86
Microsoft® Windows Vista™ Home Premium   6.0.6001.1.1252.44.1033.18.3326.2141 [GMT 1:00]
Running from: c:\users\User\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
SP: AVG Anti-Virus Free *enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
SP: Lavasoft Ad-Watch Live! *enabled* (Updated) {67844DAE-4F77-4D69-9457-98E8CFFDAA22}
SP: Spybot - Search and Destroy *disabled* (Updated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\Installer\1675397.msi
c:\windows\Installer\3edc3f.msi
c:\windows\Installer\3ee6e0.msi
c:\windows\Installer\44d07f.msi
c:\windows\Installer\51b7d.msi

.
(((((((((((((((((((((((((   Files Created from 2009-08-10 to 2009-09-10  )))))))))))))))))))))))))))))))
.

2009-09-10 05:08 . 2009-09-10 05:08   --------   d-----w-   c:\users\User\AppData\Local\temp
2009-09-10 05:08 . 2009-09-10 05:08   --------   d-----w-   c:\users\Public\AppData\Local\temp
2009-09-10 05:08 . 2009-09-10 05:08   --------   d-----w-   c:\users\kay\AppData\Local\temp
2009-09-10 05:08 . 2009-09-10 05:08   --------   d-----w-   c:\users\Guest\AppData\Local\temp
2009-09-10 05:08 . 2009-09-10 05:08   --------   d-----w-   c:\users\Default\AppData\Local\temp
2009-09-10 03:28 . 2009-09-10 03:28   --------   d-----w-   c:\program files\SUPERAntiSpyware
2009-09-09 18:35 . 2009-09-10 04:23   --------   d-----w-   c:\users\User\AppData\Local\temp(64)
2009-09-09 18:35 . 2009-09-09 19:53   --------   d-----w-   C:\$RECYCLE(0).BIN
2009-09-08 23:48 . 2009-09-08 23:48   --------   d-----w-   c:\program files\NVIDIA Corporation
2009-09-08 23:46 . 2009-09-10 13:49   --------   d-----w-   c:\windows\system32\AGEIA
2009-09-08 23:46 . 2009-09-10 13:49   --------   d-----w-   c:\program files\AGEIA Technologies
2009-09-08 03:48 . 2009-09-08 03:48   --------   d-----w-   c:\users\User\AppData\Roaming\acccore
2009-09-08 03:48 . 2009-09-08 03:48   --------   d-----w-   c:\users\User\AppData\Local\AOL OCP
2009-09-08 03:48 . 2009-09-08 03:48   --------   d-----w-   c:\program files\Viewpoint
2009-09-08 03:48 . 2009-09-08 03:48   --------   d-----w-   c:\programdata\Viewpoint
2009-09-08 03:48 . 2009-09-08 03:48   --------   d-----w-   c:\programdata\acccore
2009-09-08 03:46 . 2009-09-08 03:48   --------   d-----w-   c:\program files\AIM6
2009-09-08 02:41 . 2009-09-08 02:41   --------   d-----w-   c:\users\User\AppData\Roaming\Yahoo!
2009-09-05 02:44 . 2009-09-10 13:49   --------   d-----w-   c:\programdata\Spybot - Search & Destroy
2009-09-05 02:44 . 2009-09-05 02:45   --------   d-----w-   c:\program files\Spybot - Search & Destroy
2009-09-05 01:58 . 2009-09-05 01:58   --------   d-----w-   c:\program files\Microsoft
2009-09-05 01:58 . 2009-09-05 01:59   --------   d-----w-   c:\program files\Windows Live
2009-09-05 01:58 . 2009-09-05 01:58   --------   d-----w-   c:\windows\PCHEALTH
2009-09-05 00:27 . 2009-09-10 04:27   --------   d-----w-   c:\users\kay\Tracing
2009-09-03 02:29 . 2009-09-08 05:40   --------   d-----w-   c:\users\User\AppData\Roaming\dvdcss
2009-09-03 02:28 . 2009-09-10 13:49   --------   d-----w-   c:\users\User\AppData\Roaming\vlc
2009-09-03 02:28 . 2009-09-03 02:28   --------   d-----w-   c:\program files\VideoLAN
2009-09-03 01:39 . 2009-07-03 14:49   15688   ----a-w-   c:\windows\system32\lsdelete.exe
2009-09-03 01:22 . 2009-09-10 05:00   --------   d-----w-   c:\program files\isposure
2009-09-03 01:22 . 2009-09-10 04:51   --------   d-----w-   c:\programdata\Epitiro
2009-09-03 01:22 . 2009-09-03 01:22   --------   d-----w-   c:\program files\thinkbroadband.com
2009-09-03 01:16 . 2009-09-03 01:16   --------   dc----w-   c:\windows\system32\DRVSTORE
2009-09-03 01:16 . 2009-07-03 14:49   64160   ----a-w-   c:\windows\system32\drivers\Lbd.sys
2009-09-03 00:56 . 2008-01-08 15:43   769536   ----a-w-   c:\temp\SFDNWIN.exe
2009-09-03 00:02 . 2009-09-10 01:12   0   ----a-w-   c:\users\User\AppData\Local\prvlcl.dat
2009-09-02 21:44 . 2009-08-28 12:39   28672   ----a-w-   c:\windows\system32\Apphlpdm.dll
2009-09-02 21:44 . 2009-08-28 10:15   4240384   ----a-w-   c:\windows\system32\GameUXLegacyGDFs.dll
2009-09-02 21:42 . 2007-12-26 16:00   2097152   ----a-w-   c:\temp\autorun.bin
2009-09-02 21:42 . 2008-05-20 09:49   1570816   ----a-w-   c:\temp\TSDNWIN.exe
2009-09-02 19:12 . 2009-09-02 19:12   --------   d-----w-   c:\programdata\Hagel Technologies
2009-08-31 06:52 . 2009-08-31 06:52   --------   d-----w-   C:\My Music
2009-08-31 06:37 . 2009-08-31 06:37   --------   d-----w-   c:\program files\Real
2009-08-27 21:17 . 2009-08-27 21:17   --------   d-----w-   c:\users\User\AppData\Local\AVG Security Toolbar
2009-08-27 21:15 . 2009-08-27 21:15   --------   d-----w-   c:\program files\AVG
2009-08-27 21:12 . 2009-08-27 21:12   --------   d-----w-   c:\users\User\AppData\Roaming\AVG8
2009-08-27 15:12 . 2009-08-27 15:12   --------   d-----w-   c:\windows\system32\EventProviders
2009-08-27 14:50 . 2009-08-27 14:50   --------   d-----w-   c:\windows\CheckSur
2009-08-26 05:50 . 2009-06-22 10:22   2048   ----a-w-   c:\windows\system32\tzres.dll
2009-08-18 20:10 . 2009-08-18 20:10   --------   d-----w-   c:\users\kay\AppData\Local\Apps
2009-08-17 01:42 . 2009-08-17 01:42   2505248   ----a-w-   c:\windows\system32\nvcpluir.dll
2009-08-17 01:42 . 2009-08-17 01:42   2173472   ----a-w-   c:\windows\system32\nvcplui.exe
2009-08-17 01:42 . 2009-08-17 01:42   1411616   ----a-w-   c:\windows\system32\nvsvsr.dll
2009-08-17 01:42 . 2009-08-17 01:42   1346080   ----a-w-   c:\windows\system32\nvsvs.dll
2009-08-17 01:02 . 2009-08-20 03:46   --------   d-----w-   c:\users\User\AppData\Roaming\skypePM
2009-08-17 00:59 . 2009-08-20 06:40   --------   d-----w-   c:\users\User\AppData\Roaming\Skype
2009-08-16 23:57 . 2009-08-16 23:57   9545152   ----a-w-   c:\windows\system32\drivers\nvlddmkm.sys
2009-08-16 23:57 . 2009-08-16 23:57   485920   ----a-w-   c:\windows\system32\nvudisp.exe
2009-08-16 23:57 . 2009-08-16 23:57   3298304   ----a-w-   c:\windows\system32\nvwgf2um.dll
2009-08-16 23:57 . 2009-08-16 23:57   2169376   ----a-w-   c:\windows\system32\nvcuvid.dll
2009-08-16 23:57 . 2009-08-16 23:57   1985536   ----a-w-   c:\windows\system32\nvcuda.dll
2009-08-16 23:57 . 2009-08-16 23:57   1706528   ----a-w-   c:\windows\system32\nvcuvenc.dll
2009-08-16 23:57 . 2009-08-16 23:57   155648   ----a-w-   c:\windows\system32\nvcod162.dll
2009-08-16 23:57 . 2009-08-16 23:57   155648   ----a-w-   c:\windows\system32\nvcod.dll
2009-08-16 23:57 . 2009-08-16 23:57   10858496   ----a-w-   c:\windows\system32\nvoglv32.dll
2009-08-16 10:16 . 2009-09-10 04:27   --------   d-----w-   c:\users\kay\AppData\Roaming\skypePM
2009-08-16 10:16 . 2009-08-16 10:16   56   ---ha-w-   c:\windows\system32\ezsidmv.dat
2009-08-16 10:12 . 2009-09-10 04:28   --------   d-----w-   c:\users\kay\AppData\Roaming\Skype
2009-08-16 10:11 . 2009-08-16 10:12   --------   d-----r-   c:\program files\Skype
2009-08-16 10:11 . 2009-08-16 10:11   --------   d-----w-   c:\program files\Common Files\Skype
2009-08-16 10:11 . 2009-08-16 10:11   --------   d-----w-   c:\programdata\Skype
2009-08-16 10:09 . 2009-08-16 10:09   --------   d-----w-   c:\users\kay\AppData\Local\Apple
2009-08-16 10:00 . 2009-08-16 10:00   --------   d-----w-   c:\users\kay\AppData\Local\LogiShrd
2009-08-14 12:36 . 2009-08-14 12:36   70936   ----a-w-   c:\windows\system32\PhysXLoader.dll
2009-08-13 10:43 . 2009-06-15 18:20   439896   ----a-w-   c:\windows\system32\drivers\ksecdd.sys
2009-08-13 10:43 . 2009-06-15 15:24   175104   ----a-w-   c:\windows\system32\wdigest.dll
2009-08-13 10:43 . 2009-06-15 15:24   270848   ----a-w-   c:\windows\system32\schannel.dll
2009-08-13 10:43 . 2009-06-15 15:23   1256448   ----a-w-   c:\windows\system32\lsasrv.dll
2009-08-13 10:43 . 2009-06-15 15:22   213504   ----a-w-   c:\windows\system32\msv1_0.dll
2009-08-13 10:43 . 2009-06-15 15:21   499712   ----a-w-   c:\windows\system32\kerberos.dll
2009-08-13 10:43 . 2009-06-15 15:24   72704   ----a-w-   c:\windows\system32\secur32.dll
2009-08-13 10:43 . 2009-06-15 12:57   9728   ----a-w-   c:\windows\system32\lsass.exe
2009-08-13 01:17 . 2009-07-17 14:35   71680   ----a-w-   c:\windows\system32\atl.dll
2009-08-13 01:17 . 2009-06-10 12:12   160256   ----a-w-   c:\windows\system32\wkssvc.dll
2009-08-13 01:17 . 2009-06-04 12:34   2066432   ----a-w-   c:\windows\system32\mstscax.dll
2009-08-13 01:17 . 2009-06-10 12:07   91136   ----a-w-   c:\windows\system32\avifil32.dll
2009-08-13 01:17 . 2009-07-14 13:00   313344   ----a-w-   c:\windows\system32\wmpdxm.dll
2009-08-13 01:17 . 2009-07-14 12:59   4096   ----a-w-   c:\windows\system32\dxmasf.dll
2009-08-13 01:17 . 2009-07-14 12:58   7680   ----a-w-   c:\windows\system32\spwmp.dll
2009-08-13 01:17 . 2009-07-14 10:59   8147456   ----a-w-   c:\windows\system32\wmploc.DLL
2009-08-11 05:48 . 2008-09-16 19:23   168448   ----a-w-   c:\windows\system32\unrar.dll
2009-08-11 05:48 . 2004-01-25 16:18   217088   ----a-w-   c:\windows\system32\yv12vfw.dll
2009-08-11 05:48 . 2009-05-01 21:02   90112   ----a-w-   c:\windows\system32\dpl100.dll
2009-08-11 05:48 . 2009-05-01 21:02   685056   ----a-w-   c:\windows\system32\divx.dll
2009-08-11 05:48 . 2008-11-06 16:37   3596288   ----a-w-   c:\windows\system32\qt-dx331.dll
2009-08-11 05:48 . 2009-09-03 15:00   --------   d-----w-   c:\program files\K-Lite Codec Pack
2009-08-11 05:48 . 2009-06-02 16:11   85504   ----a-w-   c:\windows\system32\ff_vfw.dll
2009-08-11 05:48 . 2009-01-07 18:14   60273   ----a-w-   c:\windows\system32\pthreadGC2.dll

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-10 04:58 . 2009-09-08 23:51   32784   ----a-w-   c:\programdata\nvModes.dat
2009-09-10 04:57 . 2008-06-23 12:27   --------   d-----w-   c:\programdata\NVIDIA
2009-09-10 04:57 . 2009-07-28 02:36   0   ----a-w-   c:\windows\system32\drivers\lvuvc.hs
2009-09-10 04:56 . 2008-08-04 18:07   12   ----a-w-   c:\windows\bthservsdp.dat
2009-09-10 04:24 . 2009-09-10 04:24   1356   ----a-w-   c:\users\User\AppData\Local\d3d9caps.tmp
2009-09-10 03:28 . 2009-08-08 11:01   --------   d-----w-   c:\users\User\AppData\Roaming\SUPERAntiSpyware.com
2009-09-10 03:28 . 2009-08-07 13:47   --------   d-----w-   c:\program files\Common Files\Wise Installation Wizard
2009-09-10 03:27 . 2008-12-19 05:50   --------   d-----w-   c:\users\User\AppData\Roaming\Any Video Converter
2009-09-08 06:29 . 2009-04-14 23:52   --------   d-----w-   c:\program files\Yahoo!
2009-09-08 03:46 . 2008-11-07 07:23   --------   d-----w-   c:\programdata\AOL
2009-09-08 02:57 . 2009-04-14 23:52   --------   d-----w-   c:\programdata\Yahoo!
2009-09-08 02:34 . 2008-12-22 00:58   --------   d-----w-   c:\users\User\AppData\Roaming\uTorrent
2009-09-03 15:00 . 2009-02-22 19:09   --------   d-----w-   c:\users\User\AppData\Roaming\Any DVD Converter Professional
2009-09-03 15:00 . 2008-07-25 19:49   --------   d-----w-   c:\programdata\WLInstaller
2009-09-03 15:00 . 2006-11-02 12:37   --------   d-----w-   c:\program files\Windows Defender
2009-09-03 02:50 . 2008-08-03 05:16   --------   d-----w-   c:\program files\Common Files\Real
2009-09-02 19:28 . 2008-06-23 12:13   --------   d--h--w-   c:\program files\InstallShield Installation Information
2009-09-02 19:25 . 2009-04-20 18:10   --------   d-----w-   c:\program files\MSECACHE
2009-09-02 19:12 . 2006-11-02 12:37   --------   d-----w-   c:\program files\Windows Sidebar
2009-09-01 11:00 . 2008-12-16 20:28   --------   d-----w-   c:\users\kay\AppData\Roaming\Spyware Terminator
2009-08-22 21:33 . 2008-08-25 22:23   --------   d-----w-   c:\users\User\AppData\Roaming\Smart Recorder
2009-08-16 23:57 . 2009-08-16 23:57   4224   ----a-w-   c:\windows\system32\drivers\nvBridge.kmd
2009-08-16 23:57 . 2008-05-02 21:46   7569920   ----a-w-   c:\windows\system32\nvd3dum.dll
2009-08-16 23:57 . 2008-05-02 21:46   1044992   ----a-w-   c:\windows\system32\nvapi.dll
2009-08-13 06:01 . 2006-11-02 11:18   --------   d-----w-   c:\program files\Windows Mail
2009-08-11 11:35 . 2008-06-23 12:24   485920   ----a-w-   c:\windows\system32\NVUNINST.EXE
2009-08-11 00:36 . 2009-08-11 00:36   --------   d-----w-   c:\users\User\AppData\Roaming\NCH Software
2009-08-11 00:36 . 2009-07-16 02:20   --------   d-----w-   c:\program files\NCH Software
2009-08-11 00:28 . 2009-08-11 00:28   --------   d-----w-   c:\programdata\NCH Swift Sound
2009-08-10 14:56 . 2008-07-21 20:51   --------   d-----w-   c:\program files\Common Files\Stardock
2009-08-10 00:54 . 2009-08-10 00:54   --------   d-----w-   c:\users\kay\AppData\Roaming\IObit
2009-08-10 00:39 . 2009-08-10 00:39   --------   d-----w-   c:\users\kay\AppData\Roaming\OnlineArmor
2009-08-10 00:36 . 2008-09-12 01:08   --------   d-----w-   c:\users\User\AppData\Roaming\Winamp
2009-08-10 00:36 . 2008-11-29 18:20   --------   d-----w-   c:\users\kay\AppData\Roaming\Winamp
2009-08-10 00:36 . 2009-04-18 17:09   --------   d-----w-   c:\users\kay\AppData\Roaming\TuneUp Software
2009-08-10 00:36 . 2009-03-17 23:18   --------   d-----w-   c:\users\kay\AppData\Roaming\Audacity
2009-08-10 00:36 . 2008-12-13 06:44   --------   d-----w-   c:\users\kay\AppData\Roaming\OpenOffice.org
2009-08-10 00:36 . 2008-12-07 00:33   --------   d-----w-   c:\users\kay\AppData\Roaming\Sega
2009-08-10 00:36 . 2008-12-06 02:45   --------   d-----w-   c:\users\kay\AppData\Roaming\InstallShield
2009-08-10 00:36 . 2008-11-01 21:04   --------   d-----w-   c:\users\kay\AppData\Roaming\GlarySoft
2009-08-10 00:36 . 2008-09-10 16:37   --------   d-----w-   c:\users\kay\AppData\Roaming\SUPERAntiSpyware.com
2009-08-10 00:36 . 2008-08-01 21:28   --------   d-----w-   c:\users\kay\AppData\Roaming\OpenOffice.org2
2009-08-10 00:36 . 2009-07-18 15:35   --------   d-----w-   c:\program files\Windows Live SkyDrive
2009-08-08 15:23 . 2009-08-08 15:23   --------   d-----w-   c:\program files\Sun
2009-08-08 15:23 . 2009-08-08 09:48   411368   ----a-w-   c:\windows\system32\deploytk.dll
2009-08-08 15:23 . 2008-07-21 02:01   --------   d-----w-   c:\program files\Java
2009-08-08 10:49 . 2009-08-07 03:50   54808   ----a-w-   c:\windows\system32\GDIPFONTCACHEV1.DAT
2009-08-08 10:15 . 2009-08-08 10:15   --------   d-----w-   c:\users\User\AppData\Roaming\Malwarebytes
2009-08-08 10:15 . 2009-08-08 10:15   --------   d-----w-   c:\program files\Malwarebytes' Anti-Malware
2009-08-08 10:15 . 2009-08-08 10:15   --------   d-----w-   c:\programdata\Malwarebytes
2009-08-08 09:52 . 2009-08-08 09:52   --------   d-----w-   c:\users\User\AppData\Roaming\OpenOffice.org
2009-08-08 09:50 . 2009-08-08 09:50   --------   d-----w-   c:\program files\JRE
2009-08-08 09:50 . 2009-08-08 09:50   --------   d-----w-   c:\program files\OpenOffice.org 3
2009-08-07 13:51 . 2009-08-07 04:09   --------   d-----w-   c:\program files\SpywareBlaster
2009-08-05 21:31 . 2009-07-27 04:02   --------   d-----w-   c:\users\User\AppData\Roaming\IObit
2009-08-05 21:31 . 2009-07-27 04:02   --------   d-----w-   c:\program files\IObit
2009-08-03 12:36 . 2009-08-08 10:15   38160   ----a-w-   c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-03 12:36 . 2009-08-08 10:15   19096   ----a-w-   c:\windows\system32\drivers\mbam.sys
2009-07-29 03:05 . 2009-07-29 03:05   --------   d-----w-   c:\program files\Microsoft CAPICOM 2.1.0.2
2009-07-28 15:33 . 2009-08-10 01:55   55656   ----a-w-   c:\windows\system32\drivers\avgntflt.sys
2009-07-28 03:26 . 2008-06-23 11:48   1356   ----a-r-   c:\users\User\AppData\Local\d3d9caps.dat
2009-07-28 02:37 . 2008-07-20 17:28   --------   d-----w-   c:\program files\Logitech
2009-07-28 02:36 . 2009-06-09 14:36   --------   d-----w-   c:\program files\Common Files\Logishrd
2009-07-28 02:35 . 2008-07-20 17:28   --------   d-----w-   c:\programdata\LogiShrd
2009-07-27 03:35 . 2008-08-21 00:49   --------   d-----w-   c:\programdata\Movavi Video Converter 6
2009-07-27 03:06 . 2009-07-27 03:06   24521728   ----a-w-   c:\windows\system32\imageres.dll
2009-07-27 02:49 . 2009-07-27 02:49   --------   d-----w-   c:\programdata\Stardock
2009-07-27 02:49 . 2008-07-21 20:51   --------   d-----w-   c:\program files\Stardock
2009-07-26 15:44 . 2009-07-26 15:44   48448   ----a-w-   c:\windows\system32\sirenacm.dll
2009-07-25 04:06 . 2008-09-17 05:17   43008   ----a-w-   c:\programdata\FDNupdater.exe
2009-07-21 21:52 . 2009-07-29 01:59   915456   ----a-w-   c:\windows\system32\wininet.dll
2009-07-21 21:47 . 2009-07-29 01:59   109056   ----a-w-   c:\windows\system32\iesysprep.dll
2009-07-21 21:47 . 2009-07-29 01:59   71680   ----a-w-   c:\windows\system32\iesetup.dll
2009-07-21 20:13 . 2009-07-29 01:59   133632   ----a-w-   c:\windows\system32\ieUnatt.exe
2009-07-16 04:16 . 2009-07-16 04:16   --------   d-----w-   c:\program files\Conduit
2009-07-16 02:22 . 2009-07-16 02:22   --------   d-----w-   c:\programdata\NCH Software
2009-07-15 04:18 . 2008-09-12 01:08   --------   d-----w-   c:\program files\Winamp
2009-07-15 01:25 . 2009-07-15 01:16   --------   d-----w-   c:\program files\Nero
2009-07-15 01:18 . 2009-04-04 19:56   --------   d-----w-   c:\program files\Common Files\Nero
2009-07-15 01:16 . 2009-07-15 01:16   --------   d-----w-   c:\programdata\Nero
2009-07-14 21:40 . 2008-07-24 20:05   882144   ----a-w-   c:\windows\system32\drivers\tcpip.sys
2009-06-15 15:24 . 2009-07-14 20:32   156672   ----a-w-   c:\windows\system32\t2embed.dll
2009-06-15 15:20 . 2009-07-14 20:32   72704   ----a-w-   c:\windows\system32\fontsub.dll
2009-06-15 15:20 . 2009-07-14 20:32   10240   ----a-w-   c:\windows\system32\dciman32.dll
2009-06-15 12:52 . 2009-07-14 20:32   289792   ----a-w-   c:\windows\system32\atmfd.dll
2009-06-10 00:23 . 2009-06-10 00:12   546   ----a-w-   c:\program files\CoreTemp.ini
2008-07-22 14:03 . 2008-12-13 02:17   1638400   ----a-w-   c:\program files\ImgBurn.exe
.

------- Sigcheck -------

[7] 2009-08-15 . 2512B4D1353370D6688B1AF1F5AFA1CF . 816640 . . [6.0.6000.21108] . . c:\windows\SoftwareDistribution\Download\b635b7a7651f5dd1a95f6d85f3bb620f\x86_microsoft-windows-tcpip_31bf3856ad364e35_6.0.6000.21108_none_6030d425ab49af00\tcpip.sys
[7] 2009-08-14 . 8A7AD2A214233F684242F289ED83EBC3 . 897608 . . [6.0.6001.18311] . . c:\windows\SoftwareDistribution\Download\b635b7a7651f5dd1a95f6d85f3bb620f\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.18311_none_b3144862666d6db3\tcpip.sys
[7] 2009-08-14 . 2608E71AAD54564647D4BB984E1925AA . 900168 . . [6.0.6001.22497] . . c:\windows\SoftwareDistribution\Download\b635b7a7651f5dd1a95f6d85f3bb620f\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22497_none_b34d67897fc6850f\tcpip.sys
[7] 2009-08-14 . FF71856BD4CD6D4367F9FD84BE79A874 . 905784 . . [6.0.6002.22200] . . c:\windows\SoftwareDistribution\Download\b635b7a7651f5dd1a95f6d85f3bb620f\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.22200_none_b58e289d7caa2a80\tcpip.sys
[7] 2009-08-14 . 65877AA1B6A7CB797488E831698973E9 . 904776 . . [6.0.6002.18091] . . c:\windows\SoftwareDistribution\Download\b635b7a7651f5dd1a95f6d85f3bb620f\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.18091_none_b4a43aea63d4a25f\tcpip.sys
[7] 2009-08-14 . 300208927321066EA53761FDC98747C6 . 813568 . . [6.0.6000.16908] . . c:\windows\SoftwareDistribution\Download\b635b7a7651f5dd1a95f6d85f3bb620f\x86_microsoft-windows-tcpip_31bf3856ad364e35_6.0.6000.16908_none_5fa75f38922bdbf4\tcpip.sys
[-] 2009-07-14 . A2AA23A716A9CAF4D418F8DA55257C9C . 882144 . . [6.0.6001.18063] . . c:\windows\System32\drivers\tcpip.sys
[7] 2009-04-10 . 0E6B0885C3D5E4643ED2D043DE3433D8 . 897000 . . [6.0.6002.18005] . . c:\windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.18005_none_b5098b5e63880c42\tcpip.sys
[7] 2008-04-26 . 82E266BEE5F0167E41C6ECFDD2A79C02 . 891448 . . [6.0.6001.18063] . . c:\windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.18063_none_b2e033a8669434a1\tcpip.sys
[7] 2008-04-26 . 01EC1E92595F839BEE70D439C46796E3 . 891448 . . [6.0.6001.22167] . . c:\windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22167_none_b36dd19b7fae39c7\tcpip.sys
[7] 2008-01-21 . FC6E2835D667774D409C7C7021EAF9C4 . 891448 . . [6.0.6001.18000] . . c:\windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.18000_none_b31e1252666640f6\tcpip.sys
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-07-24 1090816]

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2009-07-24 08:55   1090816   ----a-w-   c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-07-24 1090816]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"Yahoo! Pager"="c:\users\User\Program Files\Messenger\YahooMessenger.exe" [2006-07-27 4617720]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"tbbMeter"="c:\program files\thinkbroadband.com\tbbMeter\tbbmeter.exe" [2009-09-03 521736]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DevconDefaultDB"="c:\windows\system32\READREG" [X]

c:\users\kay\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Stardock ObjectDock.lnk - c:\program files\Stardock\ObjectDock\ObjectDock.exe [2009-8-10 3450608]

c:\users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Stardock ObjectDock.lnk - c:\program files\Stardock\ObjectDock\ObjectDock.exe [2009-8-10 3450608]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"EnableShellExecuteHooks"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux4"=wdmaud.drv

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute   REG_MULTI_SZ      autocheck autochk /r \??\h:\0autocheck autochk *\0\0lsdelete

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Logitech SetPoint.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Logitech SetPoint.lnk
backup=c:\windows\pss\Logitech SetPoint.lnk.CommonStartup
backupExtension=.CommonStartup

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ISUSPM Startup"=c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe"  -osboot

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-3337818152-979807-2931746225-1000]
"EnableNotificationsRef"=dword:0000000a

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-3337818152-979807-2931746225-1002]
"EnableNotificationsRef"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{87CFFDAF-BBE3-4FC9-8A59-1E9121C46879}"= UDP:c:\program files\Creative\Shared Files\Software Update\AutoUpdate.exe:Creative Software AutoUpdate
"{42554D9E-186E-4BA9-9FC8-0F2F982469DE}"= TCP:c:\program files\Creative\Shared Files\Software Update\AutoUpdate.exe:Creative Software AutoUpdate
"{FD2F9AAE-1902-440B-9D45-9D695FFF7643}"= UDP:c:\program files\Internet Explorer\iexplore.exe:Internet Explorer
"{93F9368E-A666-469F-BED6-36202119583F}"= TCP:c:\program files\Internet Explorer\iexplore.exe:Internet Explorer
"{292B7F08-EBF7-4B90-B058-269CC89F4256}"= UDP:c:\program files\SAMSUNG\FW LiveUpdate\FWManager.exe:ODD Firmware LiveUpdate
"{272F3476-6111-4B42-AC24-9173930FB9FC}"= TCP:c:\program files\SAMSUNG\FW LiveUpdate\FWManager.exe:ODD Firmware LiveUpdate
"{19F5A18E-7408-4563-BC02-F4A711C4F622}"= UDP:c:\program files\Windows Defender\MSASCui.exe:Windows Defender
"{F139B813-5500-4336-B13E-7615504268E4}"= TCP:c:\program files\Windows Defender\MSASCui.exe:Windows Defender
"{AC2A33A3-293F-4D55-8673-8F3C298B050D}"= UDP:c:\program files\Windows Calendar\WinCal.exe:Windows Calendar
"{C0E7E954-1055-448D-8EC9-FCDCD220E053}"= TCP:c:\program files\Windows Calendar\WinCal.exe:Windows Calendar
"{3D3443CB-B400-4C0E-A59A-C913C6C09E63}"= UDP:c:\program files\DNA\btdna.exe:DNA (TCP-In)
"{03EC8279-EFDA-435A-8743-018992EB0E85}"= TCP:c:\program files\DNA\btdna.exe:DNA (UDP-In)
"{513722B8-0918-4A09-B1BC-155ED093DCE6}"= UDP:21063:user
"TCP Query User{45683B31-72FB-48AF-9C29-ABB097E8BD84}c:\\program files\\dna\\btdna.exe"= UDP:c:\program files\dna\btdna.exe:DNA
"UDP Query User{FFF9ADA8-7251-4152-BE3A-BC9D27C7EDE0}c:\\program files\\dna\\btdna.exe"= TCP:c:\program files\dna\btdna.exe:DNA
"TCP Query User{B315878D-4C9B-44A9-A86C-64911C97952C}e:\\autorun.exe"= UDP:E:\autorun.exe:CD navigator
"UDP Query User{B8A010F4-DFE6-4BE0-A301-E80F4F66070F}e:\\autorun.exe"= TCP:E:\autorun.exe:CD navigator
"{59B0CA9F-33C5-4CB0-BB14-2BDE7D7CD2A4}"= UDP:c:\program files\DNA\btdna.exe:DNA
"{0CB04A51-CE7C-4243-A47D-C63CB0CC9F28}"= TCP:c:\program files\DNA\btdna.exe:DNA
"{05DC9388-9756-42BD-A16F-43F8E726FAE4}"= UDP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{17B1D189-26C6-4954-B77C-6C40C7BC7B9F}"= TCP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{ADF07D04-2654-44F4-9F6A-3DF1E9B5C5DB}"= UDP:c:\program files\Windows Mail\WinMail.exe:Windows Mail
"{67275207-06C1-4559-A168-B127238341BF}"= TCP:c:\program files\Windows Mail\WinMail.exe:Windows Mail
"{66113F87-88DF-48FB-8EC0-64E92028C812}"= UDP:c:\program files\Malwarebytes' Anti-Malware\mbam.exe:Malwarebytes' Anti-Malware
"{E69AADD3-F593-4392-B7B1-703AC302D4B0}"= TCP:c:\program files\Malwarebytes' Anti-Malware\mbam.exe:Malwarebytes' Anti-Malware
"{446C2C16-292E-4931-A0A2-8EAD6EAE69DD}"= UDP:c:\windows\System32\wercon.exe:Problem Reports and Solutions
"{015DAFB3-AF0F-4980-96A3-9554DE0C62A3}"= TCP:c:\windows\System32\wercon.exe:Problem Reports and Solutions
"{33DA079B-5F98-4A9B-B467-50498298A68E}"= UDP:c:\program files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe:Volume Panel
"{EEC1F9E6-FE2B-4340-8535-0B7FC8F4782D}"= TCP:c:\program files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe:Volume Panel
"{0502D0A5-41BC-4871-840A-E9EB786FC6A4}"= UDP:c:\windows\System32\WindowsAnytimeUpgrade.exe:Windows Anytime Upgrade
"{49C2CE4A-5132-4BED-BF57-286252B750DB}"= TCP:c:\windows\System32\WindowsAnytimeUpgrade.exe:Windows Anytime Upgrade
"TCP Query User{2334AB77-A0DC-4717-9377-9DFDA882B0BC}c:\\program files\\common files\\nero\\nero web\\setupx.exe"= UDP:c:\program files\common files\nero\nero web\setupx.exe:Nero Installer
"UDP Query User{2CFB7EDE-2F44-4530-9403-73E40DB5745A}c:\\program files\\common files\\nero\\nero web\\setupx.exe"= TCP:c:\program files\common files\nero\nero web\setupx.exe:Nero Installer
"{AF8210BC-C12D-494A-99FA-49F02F4C857A}"= TCP:55641:Utorrent
"{74BF318A-A341-4A92-BD33-4CD95DD7CC9B}"= UDP:c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe:ISUSPM
"{FAE091F6-05A4-4B2A-B47B-74E52C033653}"= TCP:c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe:ISUSPM
"{277FDF48-C99E-42C7-8F14-6356125D753B}"= UDP:c:\program files\InstallShield Installation Information\{11F5D779-7BD9-465A-BBC4-10701386BCB9}\setup.exe:Uninstall
"{161FBA4A-EF33-48B6-BA68-B25D29F4108D}"= TCP:c:\program files\InstallShield Installation Information\{11F5D779-7BD9-465A-BBC4-10701386BCB9}\setup.exe:Uninstall
"{0C23841B-558E-4C26-A101-36ACAA72A90E}"= c:\program files\AVG\AVG8\avgemc.exe:avgemc.exe
"{AD47C92D-8898-4DF2-B6E8-7C897A0BD7C4}"= c:\program files\AVG\AVG8\avgupd.exe:avgupd.exe
"{002CD0A3-5662-46C2-8AB2-DF41EF3AC3AE}"= c:\program files\AVG\AVG8\avgnsx.exe:avgnsx.exe
"{9A5D22C2-0F77-41C8-883A-880FF7552260}"= UDP:55641:Utorrent
"TCP Query User{8B0039ED-DDA6-4986-B56D-895BD076C1FF}c:\\program files\\nero\\nero8\\nero home\\nerohome.exe"= UDP:c:\program files\nero\nero8\nero home\nerohome.exe:Nero Home
"UDP Query User{8AA73EDE-BE39-493A-BA2A-CC0B84ECC460}c:\\program files\\nero\\nero8\\nero home\\nerohome.exe"= TCP:c:\program files\nero\nero8\nero home\nerohome.exe:Nero Home
"{968BF958-4A32-49A7-85E7-AF6BC49F00A4}"= UDP:c:\users\User\Program Files\uTorrent.exe:µTorrent (TCP-In)
"{87F0C669-6513-44D2-8FDE-0EB391E314CB}"= TCP:c:\users\User\Program Files\uTorrent.exe:µTorrent (UDP-In)
"TCP Query User{0FC62E66-2BB8-4C0F-A4CD-E86F13A8BB89}c:\\users\\user\\program files\\utorrent.exe"= UDP:c:\users\user\program files\utorrent.exe:utorrent.exe
"UDP Query User{FCD829D8-1FF5-41F1-9C7E-450B2DCEBC12}c:\\users\\user\\program files\\utorrent.exe"= TCP:c:\users\user\program files\utorrent.exe:utorrent.exe
"{1A6E17BF-1FB4-4153-8CD1-AD0C9FEDA4F1}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{C299E4B0-140A-4DD6-A477-0467AFD93D4C}"= UDP:c:\program files\Logitech\Logitech Vid\Vid.exe:Logitech Vid
"{D215C85E-9431-4D71-9B2B-D180D98E0BEE}"= TCP:c:\program files\Logitech\Logitech Vid\Vid.exe:Logitech Vid
"{78F2306B-66BC-4497-BDD9-305B92E3A1AF}"= UDP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{D3B98E8F-CE3F-410E-B896-871FE17C9C37}"= TCP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{7600D862-D9A8-4965-BC34-9160D8AAD223}"= UDP:c:\program files\AIM6\aim6.exe:AIM
"{ECAA63B7-FE8E-4E84-A2F5-9BCA144BEE7A}"= TCP:c:\program files\AIM6\aim6.exe:AIM
"{4F78444B-883C-4385-8532-EC56F50A9DB3}"= UDP:c:\users\User\Program Files\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{C7B0B584-14D7-4A4B-A9E6-CC89E3FB2376}"= TCP:c:\users\User\Program Files\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{FBA915C4-8177-49E1-8ECB-55A0DF41DE28}"= UDP:c:\users\User\Program Files\Messenger\YServer.exe:Yahoo! FT Server
"{4264ACD9-9503-4D00-9BCD-4E2449B9769C}"= TCP:c:\users\User\Program Files\Messenger\YServer.exe:Yahoo! FT Server
"TCP Query User{6B55299E-6279-452B-BBEA-20F25D64A7BC}c:\\users\\user\\program files\\messenger\\yahoomessenger.exe"= UDP:c:\users\user\program files\messenger\yahoomessenger.exe:yahoomessenger.exe
"UDP Query User{5864DE77-596F-4F6F-A3C9-236F35284BB4}c:\\users\\user\\program files\\messenger\\yahoomessenger.exe"= TCP:c:\users\user\program files\messenger\yahoomessenger.exe:yahoomessenger.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

R0 Lbd;Lbd;c:\windows\System32\drivers\Lbd.sys [03/09/2009 02:16 64160]
R1 RtlProt;Realtke RtlProt WLAN Utility Protocol Driver;c:\windows\System32\drivers\RtlProt.sys [23/04/2007 11:50 25896]
R2 isposure_svc;IsposureAgent;c:\program files\isposure\IsposureAgent.exe [23/10/2008 08:43 761856]
R2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [05/09/2009 03:44 1153368]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [17/08/2009 01:32 239648]
R3 CT20XUT.SYS;CT20XUT.SYS;c:\windows\System32\drivers\CT20XUT.sys [08/10/2008 02:21 171032]
R3 CTEXFIFX.SYS;CTEXFIFX.SYS;c:\windows\System32\drivers\CTEXFIFX.sys [08/10/2008 02:21 1324056]
R3 CTHWIUT.SYS;CTHWIUT.SYS;c:\windows\System32\drivers\CTHWIUT.sys [08/10/2008 02:21 72728]
R3 netr28u;Linksys USB Wireless LAN Card Driver for Vista;c:\windows\System32\drivers\netr28u.sys [14/12/2007 18:16 570880]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;"c:\program files\Lavasoft\Ad-Aware\AAWService.exe" --> c:\program files\Lavasoft\Ad-Aware\AAWService.exe [?]
S3 AsAudioDevice_351;AsAudioDevice_351;c:\windows\System32\drivers\AsAudioDevice_351.sys [31/12/2008 09:38 16640]
S3 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service;c:\program files\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [25/08/2008 23:03 79360]
S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [25/08/2008 23:13 79360]
S3 CT20XUT;CT20XUT;c:\windows\System32\drivers\CT20XUT.sys [08/10/2008 02:21 171032]
S3 CTEXFIFX;CTEXFIFX;c:\windows\System32\drivers\CTEXFIFX.sys [08/10/2008 02:21 1324056]
S3 CTHWIUT;CTHWIUT;c:\windows\System32\drivers\CTHWIUT.sys [08/10/2008 02:21 72728]
S3 RTL8187B;NETGEAR WG111v3 54Mbps Wireless USB 2.0 Adapter Vista Driver;c:\windows\System32\drivers\wg111v3.sys [24/12/2008 05:27 289280]
S3 WinRing0_1_2_0;WinRing0_1_2_0;c:\program files\RealTemp\WinRing0.sys [10/06/2009 01:25 14416]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs   REG_MULTI_SZ      BthServ

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"c:\program files\Common Files\LightScribe\LSRunOnce.exe"
.
Contents of the 'Scheduled Tasks' folder

2009-09-03 c:\windows\Tasks\SmartDefrag.job
- c:\program files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe [2009-08-05 08:22]

2009-09-07 c:\windows\Tasks\Spybot - Search & Destroy -  Scheduled Task.job
- c:\program files\Spybot - Search & Destroy\SpybotSD.exe [2009-09-05 14:31]

2009-09-07 c:\windows\Tasks\Spybot - Search & Destroy Updater -  Scheduled Task.job
- c:\program files\Spybot - Search & Destroy\SDUpdate.exe [2009-09-05 14:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.co.uk/
uSearchURL,(Default) = hxxp://www.google.com/
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Send image to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
TCP: {43017A33-670A-4217-922B-85049C821E78} = 62.24.199.13,62.24.199.23
TCP: {88915BA0-3BE1-4E52-ACD3-6410C6BC7FC4} = 62.24.199.13,62.24.199.23
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
FF - ProfilePath - c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\zsjqihtb.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.uk/
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils2.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\xpavgtbapi.dll
FF - component: c:\program files\Real\RealPlayer\browserrecord\firefox\ext\components\nprpffbrowserrecordext.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
FF - user.js: browser.cache.memory.capacity - 65536
FF - user.js: browser.chrome.favicons - fales
FF - user.js: browser.display.show_image_placeholders - true
FF - user.js: browser.turbo.enabled - true
FF - user.js: browser.urlbar.autocomplete.enabled - true
FF - user.js: browser.urlbar.autofill - true
FF - user.js: content.interrupt.parsing - true
FF - user.js: content.max.tokenizing.time - 2250000
FF - user.js: content.notify.backoffcount - 5
FF - user.js: content.notify.interval - 750000
FF - user.js: content.notify.ontimer - true
FF - user.js: content.switch.threshold - 750000
FF - user.js: network.http.max-connections - 48
FF - user.js: network.http.max-connections-per-server - 16
FF - user.js: network.http.max-persistent-connections-per-proxy - 16
FF - user.js: network.http.max-persistent-connections-per-server - 8
FF - user.js: network.http.pipelining - true
FF - user.js: network.http.pipelining.firstrequest - true
FF - user.js: network.http.pipelining.maxrequests - 8
FF - user.js: network.http.proxy.pipelining - true
FF - user.js: network.http.request.max-start-delay - 0
FF - user.js: nglayout.initialpaint.delay - 0
FF - user.js: plugin.expose_full_path - true
FF - user.js: ui.submenuDelay - 0
FF - user.js: yahoo.homepage.dontask - true
.
- - - - ORPHANS REMOVED - - - -

SharedTaskScheduler-{7BD8B754-5FE7-4B5F-B224-AE0463A43C1A} - (no file)



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-10 06:08
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes ... 

scanning hidden autostart entries ...

scanning hidden files ... 

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10c.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"

[HKEY_LOCAL_MACHINE\software\Classes\TypeLib\{03842966-D7B9-4FD8-B58E-588CA023EF0E}\1.0\0\win32]
@DACL=(02 0000)
@="c:\\Windows\\system32\\rcadnatu.dll"
.
Completion time: 2009-09-10  6:10
ComboFix-quarantined-files.txt  2009-09-10 05:10
ComboFix2.txt  2009-09-09 18:35

Pre-Run: 238,441,189,376 bytes free
Post-Run: 238,296,571,904 bytes free

459   --- E O F ---   2009-09-08 05:50

[Derek]

it must be a not very popular program, otherwise we would see more hits on it in search engines

I doubt it is real player downloadrer but it is a possibilty

I really can't see anything in the files & nor can anyone else to determine where it comes from apart from it appears to be connected to video downloads or conversuions & seems to track usage on some video sites


I think as SAS seems to be the main program that detects it, you should ask on their support forum, see what idea they have
I am still getting analysts to examine the files and see if anything else can be worked out
http://forums.superantispyware.com/

[liferasta]

The only other programs i have installed for converting media files are Any Video Convertor (this has a URL connection for downloading from Youtube, Google, metacafe, Nico video sites), Format Factory (no URL downloader just media convertor) Movavi Video (no URL downloader just media convertor) & Filedownloader (P2P file downloader for rapidshare), aswell as my Skype, Logitech Webcam Software & Nero 8.

I took a look at the Forums at SuperAntiSpyware but to sign up for an account its asking me to get a guardian to sign and
date an email message then fax it (no address given), Im 35 Lol, I really dont have the time or a fax machine to mess about trying to get an account validated to satisfy COPPA whoever they are, after searching their website for those two trojans there are a couple with the same name in the same folder but given different .Dll file names but no solution, all it suggests is to update to the latest version then scan in safemode & restart & scan again

http://forums.superantispyware.com/viewtopic.php?f=2&t=3301&p=17087&hilit=Mondlike#p17087

[Derek]

ok lets see what this will show

download the free trial of http://www.prevx.com/freescan.asp 

Double click the file to install it

scan with it

if it finds a  rootkit it will offer to fix it, let it do the fix. if it finds anything else, report what it finds please

It is only free to deal with rootkits and some  adwares but will suggest you buy it to fix anything else

before you do that ( if you decide to ) post its report so we can  advise if it is necessary or whether we can deal with it another way

to get the report

right click the prevx icon in sys tray

select configure monitoring, then select the tools tab & save scan results

attach that file here to your next reply ( it might be too big to attach so zip it first)

[liferasta]

hi, yes it found 3 threats including those two trojans & a third registry threat that Superantispyware did not pick up, but I will need a licence to cleanup, shall i remove the believeFG class registry file manually including the folder its kept in & let Superanti remove the trojans afterwards? is the registry threat the reason the trojans keep comming back?

[Derek]

I don't know how we are going to cure this one without a full format & reinstall

it must be a what we think of as  a legitimate program on your computer that keeps putting this one back every time it is removed

I have absolutely no idea what program and we are wasting our time keeping removing it until we can find out the program

[Would you do all this for nothing?]

You have come to The Spykiller for help because your Antivirus or Antispyware hasn't been able to fix your problem.

Modern Malware has become so involved and difficult to fix that it takes a very long time and a lot of hard work to read all the logs posted here and research and prepare the fixes for you. In many cases each part of the fix takes about 30 minutes to prepare, so a large part of my time is spent helping you

Would you do all this for nothing?

The reason I run this site is to raise funds for Hedgehog Rescue

Please donate if I have helped you or you have found this site useful.

You can donate safely and securely by using the paypal service, just click on one of the buttons below.

To donate in UK £

To donate in US$

To donate in Euro €

Any amount no matter how small is gratefully accepted and needed to ensure we keep the Rescue Centre running

To donate via paypal when the button doesn't appear or the link doesn't work: just go to www.paypal.com or your country's paypal log in page and chose send money and use help@thehedgehog.co.uk as recipient email address and select other service as the option. then follow prompts

[Information]

  
  Information
   Security & Protection Blog
   Prevention
   Using Autoruns
     System Restore
  Rss feeds
     Microsoft at Home
     MSRC
     Malware blog

Take the Kaspersky Challenge: See what your current antivirus is missing. Our free online virus scanner is a great way to find out if you have any viruses or spyware on your machine without having to uninstall your current antivirus software or install a new one.

Kaspersky Online Scanner

Most importantly, you can see what viruses your current antivirus software let slip through! Now works with ANY Java enabled browser