Darn spyware,viruses,rootkits,malware...

Whizzkid_amerWhizzkid_amer
edited March 2008 in Spyware & Virus Removal
I found a load of spyware and a virus on my pc and removed the spyware with Ad-Aware 2007 and AVG. Ad-Aware removed it and AVG "healed" it but me pc is still running as slow as hell. IS there anything thats still lurking about? I've enclosed my hijackthis log file.

Which, for some retarded reason, isn't uploading to this thread no matter what format it is.:confused:

Comments

  • Whizzkid_amerWhizzkid_amer
    edited January 2008
    Ahh finally. Had to be done as a zip.:D
  • Whizzkid_amerWhizzkid_amer
    edited January 2008
    Come on, someone must have some knowledge on how to fix PCs. Help me!

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 18:30:28, on 23/01/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16574)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Ahead\InCD\InCDsrv.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
    C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\WINDOWS\system32\CTsvcCDA.exe
    C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\HPZipm12.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindService.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\MimarSinan Rubber Ducky\RubberDucky.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
    C:\Program Files\MSN Messenger\usnsvc.exe
    C:\Program Files\MSN Messenger\livecall.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Program Files\Common Files\Symantec Shared\NMain.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    C:\Program Files\Norton Internet Security\CfgWiz.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/ig?hl=en
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.co.uk/0SEENGB/SAOS01?FORM=TOOLBR
    O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - (no file)
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: SpywareBlock Class - {0A87E45F-537A-40B4-B812-E2544C21A09F} - C:\Program Files\GhostSurf Platinum\SCActiveBlock.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
    O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll
    O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
    O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
    O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
    O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
    O4 - HKCU\..\Run: [Symantec Integrator115] C:\Program Files\Common Files\Symantec Shared\NMAIN.EXE
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MimarSinan Rubber Ducky] "C:\Program Files\MimarSinan Rubber Ducky\RubberDucky.exe"
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
    O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
    O8 - Extra context menu item: Download video with Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm
    O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra button: Upload - {FD4E2FF8-973C-4A19-89BD-8E86B3CFCFE1} - C:\Program Files\Free Download Manager\FUM\fumiebtn.dll
    O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/MSDcode.cab
    O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
    O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
    O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.6.108.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by124w.bay124.mail.live.com/mail/resources/MsnPUpld.cab
    O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-GB/a-UNO1/GAME_UNO1.cab
    O16 - DPF: {61628958-4627-48F4-99FD-30719188568D} (XCheck Control) - http://www.ifrontiers.com/ActiveX/XCheck.CAB
    O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1162042953562
    O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/software/launch/alaunch.cab
    O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://atv.disney.go.com/global/download/otoy/OTOYAX29b.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O16 - DPF: {97E71027-0BA2-44F2-97DB-F84D808ED0B6} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab55762.cab
    O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
    O16 - DPF: {AEF76437-F960-4EBC-97EA-7BBB4230CF38} (OcarptMain Class) - https://oca.microsoft.com/en/secure/ocarpt.CAB
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
    O20 - AppInit_DLLs: secuload.dll
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
    O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
    O23 - Service: GRTXNCIIUXAMY - Sysinternals - www.sysinternals.com - C:\DOCUME~1\Amer\LOCALS~1\Temp\GRTXNCIIUXAMY.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: IMZJQ - Sysinternals - www.sysinternals.com - C:\DOCUME~1\Amer\LOCALS~1\Temp\IMZJQ.exe
    O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
    O23 - Service: InCD Helper (read only) (InCDsrvR) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: IPRJXWYNGPUF - Sysinternals - www.sysinternals.com - C:\DOCUME~1\Amer\LOCALS~1\Temp\IPRJXWYNGPUF.exe
    O23 - Service: IXA - Sysinternals - www.sysinternals.com - C:\DOCUME~1\Amer\LOCALS~1\Temp\IXA.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
    O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
    O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: PHIQ - Sysinternals - www.sysinternals.com - C:\DOCUME~1\Amer\LOCALS~1\Temp\PHIQ.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
    O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindService.exe
    O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

    --
    End of file - 16403 bytes
  • KatanaKatana
    edited January 2008
    Hello and welcome to the forums

    My name is Katana and I will be helping you to remove any infection(s) that you may have.

    Please observe these rules while we work:
    1. If you don't know, stop and ask! Don't keep going on.
    2. Please reply to this thread. Do not start a new topic.
    3. Please continue to respond until I give you the "All Clear"
    (Just because you can't see a problem doesn't mean it isn't there)

    If you can do those three things, everything should go smoothly :D

    I apologize for the delay in responding, but as you can probably see the forums are quite busy
    and helpers look for posts with zero replies.
    Unfortunately there are far more people needing help than there are helpers.

    If you still require help please post a fresh Hijack This log to this thread.
    I will be notified and I will get back to you ASAP.
    Please note that all instructions given are customised for this computer only, the tools used may cause damage if used on a computer with different infections.

    If you think you have similar problems, please post a log in the HJT forum and wait for help.
  • Whizzkid_amerWhizzkid_amer
    edited February 2008
    I too apologize for the delay as I had not recieved an e-mail telling me if someone had posted to this thread. I had been forced to re-format my PC as many programs had stopped working and, after finding the virus and removing it, found it had done a lot of damage. However, after re-installing Windows XP, some programs refuse to install but do install on other PCs. I have enclosed a new Hijackthis log file. Is there any chance the virus could have survived the re-format?

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 13:30:19, on 02/02/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16574)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\PROGRA~1\SPEEDB~1\VideoAcceleratorService.exe
    C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
    C:\WINDOWS\system32\vmnat.exe
    C:\WINDOWS\system32\vmnetdhcp.exe
    C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
    C:\Program Files\VMware\VMware Workstation\vmware-tray.exe
    C:\Program Files\VMware\VMware Workstation\hqtray.exe
    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
    C:\Program Files\MimarSinan Rubber Ducky\RubberDucky.exe
    C:\PROGRA~1\SPEEDB~1\VideoAcceleratorEngine.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\Program Files\Grisoft\AVG7\avgcc.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Teamspeak2_RC2\TeamSpeak.exe
    C:\Program Files\DAP\DAP.EXE
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
    O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
    O4 - HKLM\..\Run: [vmware-tray] C:\Program Files\VMware\VMware Workstation\vmware-tray.exe
    O4 - HKLM\..\Run: [VMware hqtray] "C:\Program Files\VMware\VMware Workstation\hqtray.exe"
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
    O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MimarSinan Rubber Ducky] "C:\Program Files\MimarSinan Rubber Ducky\RubberDucky.exe"
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
    O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
    O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1201362841984
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
    O23 - Service: VMware Agent Service (ufad-ws60) - VMware, Inc. - C:\Program Files\VMware\VMware Workstation\vmware-ufad.exe
    O23 - Service: VideoAcceleratorService - Speedbit Ltd. - C:\PROGRA~1\SPEEDB~1\VideoAcceleratorService.exe
    O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
    O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe
    O23 - Service: VMware Virtual Mount Manager Extended (vmount2) - VMware, Inc. - C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
    O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

    --
    End of file - 7401 bytes
  • KatanaKatana
    edited February 2008
    There is no malware showing in your log, which programs are you having trouble with ?

    Kaspersky Online Scanner .
    Your Antivirus and/or Antispyware may give a warning during the scan. This is perfectly normal
    Go Here http://www.kaspersky.com/kos/eng/partner/default/kavwebscan.html

    Read the Requirements and limitations before you click Accept.
    Allow the ActiveX download if necessary
    Once the database has downloaded, click Next.
    Click Scan Settings and change the "Scan using the following antivirus database" from standard to extended and then click OK.
    Click on "My Computer" and then put the kettle on!
    When the scan has completed, click Save Report As...
    Enter a name for the file in the Filename: text box and then click the down arrow to the right of Save as type: and select text file (*.txt)
    Click Save - by default the file will be saved to your Desktop, but you can change this if you wish.

    Please post the Kaspersky log in reply
  • Whizzkid_amerWhizzkid_amer
    edited February 2008
    Its my games that I'm having trouble with: Age of Empires, Command and Conquer 3, The Sims 2. There might be more but I havent had a chance to try to install them all yet. The kapersky scanner said it found no malware.
  • KatanaKatana
    edited February 2008
    I am very sorry for the delay, the notifications don't seem to be working.
    I will check this thread everyday until we are finished.

    What error do you get when you try to install ?


    : Malwarebytes' Anti-Malware :

    Please download Malwarebytes' Anti-Malware to your desktop.
    • Double-click mbam-setup.exe and follow the prompts to install the program.
    • At the end, be sure a checkmark is placed next to
      • Update Malwarebytes' Anti-Malware
      • and Launch Malwarebytes' Anti-Malware
    • then click Finish.
    • If an update is found, it will download and install the latest version.
    • Once the program has loaded, select Perform full scan, then click Scan.
    • When the scan is complete, click OK, then Show Results to view the results.
    • Be sure that everything is checked, and click Remove Selected.
    • When completed, a log will open in Notepad. please copy and paste the log into your next reply
      • If you accidently close it, the log file is saved here and will be named like this:
      • C:\\Documents and Settings\\Username\\Application Data\\Malwarebytes\\Malwarebytes' Anti-Malware\\Logs\\mbam-log-date (time).txt
  • Whizzkid_amerWhizzkid_amer
    edited February 2008
    With AoE 3 , it has a problem initializing setup i.e. it finds some problem with installs shield. Command and Conquer finds an error while installing and Itunes doesn't even manage to start installing, but says setup encountered a problem and could not be installed.Oh, and Sims 2 finds a problem with a file while installing.
  • KatanaKatana
    edited February 2008
    Download Deckard's System Scanner (DSS) to your Desktop. Note: You must be logged onto an account with administrator privileges.
    1. Close all applications and windows.
    2. Double-click on dss.exe to run it, and follow the prompts.
    3. When the scan is complete, two text files will open - main.txt <- this one will be maximized and extra.txt<-this one will be minimized
    4. Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of main.txt and the extra.txt to your post. in your reply
  • Whizzkid_amerWhizzkid_amer
    edited February 2008
    This is the info from the main.txt log:

    Deckard's System Scanner v20071014.68
    Run by Amer Qaiyum on 2008-02-09 17:31:17
    Computer is in Normal Mode.

    -- System Restore

    Successfully created a Deckard's System Scanner Restore Point.


    -- Last 5 Restore Point(s) --
    33: 2008-02-09 17:31:22 UTC - RP33 - Deckard's System Scanner Restore Point
    32: 2008-02-04 17:55:40 UTC - RP32 - Configured Creative ZEN V Series (R2)
    31: 2008-02-04 17:34:00 UTC - RP31 - Installed Creative ZEN V Series (R2)
    30: 2008-02-02 21:11:54 UTC - RP30 - Software Distribution Service 3.0
    29: 2008-02-02 13:06:34 UTC - RP29 - System Checkpoint


    -- First Restore Point --
    1: 2008-01-26 14:53:01 UTC - RP1 - System Checkpoint


    Backed up registry hives.
    Performed disk cleanup.



    -- HijackThis (run as Amer Qaiyum.exe)

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 17:32:23, on 09/02/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16574)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Documents and Settings\Amer Qaiyum\Desktop\dss.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\PROGRA~1\TRENDM~1\HIJACK~1\Amer Qaiyum.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
    O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
    O4 - HKLM\..\Run: [vmware-tray] C:\Program Files\VMware\VMware Workstation\vmware-tray.exe
    O4 - HKLM\..\Run: [VMware hqtray] "C:\Program Files\VMware\VMware Workstation\hqtray.exe"
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
    O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MimarSinan Rubber Ducky] "C:\Program Files\MimarSinan Rubber Ducky\RubberDucky.exe"
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
    O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
    O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1201362841984
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
    O23 - Service: VMware Agent Service (ufad-ws60) - VMware, Inc. - C:\Program Files\VMware\VMware Workstation\vmware-ufad.exe
    O23 - Service: VideoAcceleratorService - Speedbit Ltd. - C:\PROGRA~1\SPEEDB~1\VideoAcceleratorService.exe
    O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
    O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe
    O23 - Service: VMware Virtual Mount Manager Extended (vmount2) - VMware, Inc. - C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
    O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

    --
    End of file - 6558 bytes

    -- File Associations

    All associations okay.


    -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled

    R2 sbbotdi - c:\program files\speedbit video accelerator\sbbotdi.sys <Not Verified; SpeedBit Ltd.; Speedbit TDI Driver>


    -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled

    All services whitelisted.


    -- Device Manager: Disabled

    Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
    Description: NVIDIA nForce Networking Controller
    Device ID: PCI\VEN_10DE&DEV_0066&SUBSYS_1C06147B&REV_A1\3&13C0B0C5&0&20
    Manufacturer: Nvidia
    Name: NVIDIA nForce Networking Controller
    PNP Device ID: PCI\VEN_10DE&DEV_0066&SUBSYS_1C06147B&REV_A1\3&13C0B0C5&0&20
    Service: NVENET

    Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
    Description: Wireless-G PCI Adapter
    Device ID: PCI\VEN_14E4&DEV_4320&SUBSYS_00131737&REV_03\4&3B1D9AB8&0&3040
    Manufacturer: Linksys, A Division of Cisco Systems, Inc.
    Name: Wireless-G PCI Adapter
    PNP Device ID: PCI\VEN_14E4&DEV_4320&SUBSYS_00131737&REV_03\4&3B1D9AB8&0&3040
    Service: BCM43XX


    -- Scheduled Tasks

    2008-01-26 16:05:32 308 --a
    C:\WINDOWS\Tasks\MimarSinan Rubber Ducky Updates.job


    -- Files created between 2008-01-09 and 2008-02-09

    2008-02-04 17:42:25 41984
    n--- C:\WINDOWS\Ctregrun.exe <Not Verified; Creative Technology Ltd; Creative On-line Registration System>
    2008-02-04 17:36:55 0 d
    C:\WINDOWS\Sun
    2008-02-04 17:36:55 0 d
    C:\Documents and Settings\Amer Qaiyum\Application Data\Sun
    2008-02-04 17:35:04 0 d
    C:\Program Files\Creative
    2008-02-02 18:19:52 0 d
    C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
    2008-02-02 18:19:51 0 d
    C:\WINDOWS\system32\Kaspersky Lab
    2008-02-02 13:24:49 0 d
    C:\Program Files\Trend Micro
    2008-02-02 12:48:45 0 d
    C:\WINDOWS\pss
    2008-01-31 20:52:31 0 d
    C:\Program Files\MSXML 4.0
    2008-01-31 20:51:41 0 d
    C:\Program Files\Microsoft Games
    2008-01-30 18:21:58 0 d
    C:\Program Files\Call of Duty
    2008-01-29 17:16:28 0 d
    C:\Documents and Settings\Amer Qaiyum\Application Data\InstallShield
    2008-01-27 19:13:46 0 d
    C:\Program Files\MSECache
    2008-01-27 18:55:02 0 dr-h
    C:\$VAULT$.AVG
    2008-01-27 18:07:12 0 d
    C:\Program Files\GameSpy Arcade
    2008-01-27 14:43:08 442368 -ra
    C:\WINDOWS\system32\vp6vfw.dll <Not Verified; On2.com; On2_VP6>
    2008-01-27 11:52:54 0 d
    c- C:\WINDOWS\system32\DRVSTORE
    2008-01-27 11:21:21 0 d
    C:\Program Files\Microsoft Silverlight
    2008-01-27 11:21:03 0 d
    C:\WINDOWS\nview
    2008-01-26 22:17:00 0 d--hs--c- C:\Program Files\Common Files\WindowsLiveInstaller
    2008-01-26 22:16:48 0 d
    C:\Program Files\Windows Live
    2008-01-26 22:16:23 0 d
    C:\Documents and Settings\All Users\Application Data\WLInstaller
    2008-01-26 22:08:34 0 d
    C:\Documents and Settings\Amer Qaiyum\Application Data\Macromedia
    2008-01-26 22:05:45 0 d
    C:\Documents and Settings\Amer Qaiyum\Application Data\Adobe
    2008-01-26 21:45:52 0 d
    C:\Program Files\MSXML 6.0
    2008-01-26 17:52:27 0 d
    C:\Program Files\Java
    2008-01-26 17:48:54 0 d
    C:\Program Files\Common Files\Java
    2008-01-26 17:46:46 0 d
    C:\WINDOWS\network diagnostic
    2008-01-26 17:41:16 0 d
    C:\Program Files\MSBuild
    2008-01-26 17:38:06 0 d
    C:\WINDOWS\system32\XPSViewer
    2008-01-26 17:37:44 0 d
    C:\Program Files\Reference Assemblies
    2008-01-26 17:37:01 0 d
    C:\086efc8897ec70ae6e
    2008-01-26 17:34:18 0 d
    C:\Program Files\Windows Media Connect 2
    2008-01-26 17:32:49 0 d
    C:\WINDOWS\system32\LogFiles
    2008-01-26 17:32:49 0 d
    C:\WINDOWS\system32\drivers\UMDF
    2008-01-26 17:23:39 0 d
    C:\WINDOWS\RegisteredPackages
    2008-01-26 17:20:40 0 d
    C:\WINDOWS\system32\URTTemp
    2008-01-26 16:21:13 0 d
    C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
    2008-01-26 16:19:48 0 d
    C:\Program Files\WarRock
    2008-01-26 16:17:47 0 d
    C:\Documents and Settings\Amer Qaiyum\Application Data\teamspeak2
    2008-01-26 16:17:33 0 d
    C:\Program Files\Teamspeak2_RC2
    2008-01-26 16:16:17 0 d
    C:\Program Files\Lavasoft
    2008-01-26 16:16:17 0 d
    C:\Documents and Settings\All Users\Application Data\Lavasoft
    2008-01-26 16:15:57 0 d
    C:\Program Files\Common Files\Wise Installation Wizard
    2008-01-26 16:10:51 0 d
    C:\Program Files\SpeedBit Video Accelerator
    2008-01-26 16:08:37 0 d
    C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
    2008-01-26 16:06:47 0 d-a
    C:\Documents and Settings\All Users\Application Data\TEMP
    2008-01-26 16:06:40 50688 --a
    C:\WINDOWS\system32\wbhelp2.dll <Not Verified; Stardock.Net, Inc; WindowBlinds for Win32 x86 machines>
    2008-01-26 16:06:39 0 d
    C:\Program Files\DAP
    2008-01-26 16:03:22 5933088 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
    2008-01-26 16:01:14 0 d
    C:\Program Files\ZoneAlarmSB
    2008-01-26 16:00:41 0 d
    C:\WINDOWS\system32\PreInstall
    2008-01-26 16:00:39 0 d--h
    C:\WINDOWS\$hf_mig$
    2008-01-26 16:00:27 0 d
    C:\Documents and Settings\All Users\Application Data\MailFrontier
    2008-01-26 16:00:21 4212 ---h
    C:\WINDOWS\system32\zllictbl.dat
    2008-01-26 16:00:17 11264 --a
    C:\WINDOWS\system32\SpOrder.dll <Not Verified; Microsoft Corporation; Microsoft(R) Windows NT(TM) Operating System>
    2008-01-26 16:00:01 0 d
    C:\WINDOWS\system32\ZoneLabs
    2008-01-26 15:55:24 0 d
    C:\WINDOWS\system32\SoftwareDistribution
    2008-01-26 15:53:14 0 d--hs---- C:\Documents and Settings\Amer Qaiyum\UserData
    2008-01-26 15:46:25 0 d
    C:\Documents and Settings\Amer Qaiyum\Application Data\WinRAR
    2008-01-26 15:44:18 0 d
    C:\WINDOWS\system32\ReinstallBackups
    2008-01-26 15:44:04 0 d
    C:\Program Files\Common Files\InstallShield
    2008-01-26 15:43:59 0 d
    C:\NVIDIA
    2008-01-26 15:43:55 0 d
    C:\Program Files\Common Files\NVIDIA Shared
    2008-01-26 15:43:54 0 d
    C:\Program Files\NVIDIA Corporation
    2008-01-26 15:43:54 0 d--h
    C:\Program Files\InstallShield Installation Information
    2008-01-26 15:43:47 41856 --a
    C:\WINDOWS\system32\drivers\ousbehci.sys <Not Verified; OrangeWare Corporation; USB 2.0 Enhanced Host Controller Driver>
    2008-01-26 15:43:47 55552 --a
    C:\WINDOWS\system32\drivers\ousb2hub.sys <Not Verified; OrangeWare Corporation; USB 2.0 Hub Driver>
    2008-01-26 15:43:47 0 d
    C:\WINDOWS\Drivers
    2008-01-26 15:43:27 0 d
    C:\Documents and Settings\Amer Qaiyum\Application Data\AVG7
    2008-01-26 15:43:22 0 d
    C:\Documents and Settings\LocalService\Application Data\AVG7
    2008-01-26 15:43:14 0 d
    C:\Documents and Settings\All Users\Application Data\Grisoft
    2008-01-26 15:43:14 0 d
    C:\Documents and Settings\All Users\Application Data\avg7
    2008-01-26 15:19:01 0 d
    C:\Documents and Settings\Amer Qaiyum\Application Data\VMware
    2008-01-26 15:15:08 0 d
    C:\Documents and Settings\LocalService\Application Data\VMware
    2008-01-26 15:14:04 0 d
    C:\Documents and Settings\All Users\Application Data\VMware
    2008-01-26 15:13:54 0 d
    C:\Program Files\VMware
    2008-01-26 15:13:54 0 d
    C:\Program Files\Common Files\VMware
    2008-01-26 15:12:04 0 d
    C:\WINDOWS\ServicePackFiles
    2008-01-26 15:11:44 0 d
    C:\WINDOWS\EHome
    2008-01-26 14:55:59 0 d
    C:\WINDOWS\Internet Logs
    2008-01-26 14:55:41 0 d
    C:\Program Files\MimarSinan Rubber Ducky
    2008-01-26 14:55:40 0 d
    C:\Documents and Settings\All Users\Application Data\{C357FF4B-BB69-4DC2-9869-55F052974DA8}
    2008-01-26 14:52:52 0 d
    C:\Documents and Settings\Amer Qaiyum\Application Data\Identities
    2008-01-26 14:52:46 0 d--h
    C:\Documents and Settings\Amer Qaiyum\Templates
    2008-01-26 14:52:46 0 dr
    C:\Documents and Settings\Amer Qaiyum\Start Menu
    2008-01-26 14:52:46 0 dr-h
    C:\Documents and Settings\Amer Qaiyum\SendTo
    2008-01-26 14:52:46 0 dr-h
    C:\Documents and Settings\Amer Qaiyum\Recent
    2008-01-26 14:52:46 0 d--h
    C:\Documents and Settings\Amer Qaiyum\PrintHood
    2008-01-26 14:52:46 3145728 --ah
    C:\Documents and Settings\Amer Qaiyum\NTUSER.DAT
    2008-01-26 14:52:46 0 d--h
    C:\Documents and Settings\Amer Qaiyum\NetHood
    2008-01-26 14:52:46 0 dr
    C:\Documents and Settings\Amer Qaiyum\My Documents
    2008-01-26 14:52:46 0 d--h
    C:\Documents and Settings\Amer Qaiyum\Local Settings
    2008-01-26 14:52:46 0 dr
    C:\Documents and Settings\Amer Qaiyum\Favorites
    2008-01-26 14:52:46 0 d
    C:\Documents and Settings\Amer Qaiyum\Desktop
    2008-01-26 14:52:46 0 d--hs---- C:\Documents and Settings\Amer Qaiyum\Cookies
    2008-01-26 14:52:46 0 dr-h
    C:\Documents and Settings\Amer Qaiyum\Application Data
    2008-01-26 14:51:47 0 d
    C:\WINDOWS\SoftwareDistribution
    2008-01-26 14:51:46 0 d---s---- C:\WINDOWS\system32\Microsoft
    2008-01-26 14:51:46 0 d
    C:\WINDOWS\Prefetch
    2008-01-26 14:51:45 1572864 --ah
    C:\Documents and Settings\LocalService\NTUSER.DAT
    2008-01-26 14:51:45 0 d--h
    C:\Documents and Settings\LocalService\Local Settings
    2008-01-26 14:51:45 0 d--hs---- C:\Documents and Settings\LocalService\Cookies
    2008-01-26 14:51:45 0 d
    C:\Documents and Settings\LocalService\Application Data
    2008-01-26 14:51:45 0 d---s---- C:\Documents and Settings\LocalService\Application Data\Microsoft
    2008-01-26 14:51:39 1572864 --ah
    C:\Documents and Settings\NetworkService\NTUSER.DAT
    2008-01-26 14:51:39 0 d--h
    C:\Documents and Settings\NetworkService\Local Settings
    2008-01-26 14:51:39 0 d--hs---- C:\Documents and Settings\NetworkService\Cookies
    2008-01-26 14:51:39 0 d
    C:\Documents and Settings\NetworkService\Application Data
    2008-01-26 14:51:39 0 d---s---- C:\Documents and Settings\NetworkService\Application Data\Microsoft
    2008-01-26 14:45:47 0 d
    C:\WINDOWS\system32\xircom
    2008-01-26 14:45:47 0 d
    C:\Program Files\microsoft frontpage
    2008-01-26 14:45:46 229376 ---h
    C:\Documents and Settings\Default User\NTUSER.DAT
    2008-01-26 14:45:44 0 -rahs---- C:\MSDOS.SYS
    2008-01-26 14:45:44 0 -rahs---- C:\IO.SYS
    2008-01-26 14:45:44 0 --a
    C:\CONFIG.SYS
    2008-01-26 14:45:44 0 --a
    C:\AUTOEXEC.BAT
    2008-01-26 14:45:00 0 d--hs---- C:\Documents and Settings\All Users\DRM
    2008-01-26 14:44:49 0 dr
    C:\WINDOWS\Offline Web Pages
    2008-01-26 14:44:49 0 d---s---- C:\WINDOWS\Downloaded Program Files
    2008-01-26 14:44:39 0 d--h
    C:\Program Files\WindowsUpdate
    2008-01-26 14:44:25 0 d
    C:\WINDOWS\system32\DirectX
    2008-01-26 14:43:54 0 d---s---- C:\WINDOWS\Tasks
    2008-01-26 14:43:53 0 d
    C:\Program Files\Common Files\MSSoap
    2008-01-26 14:43:50 0 d
    C:\WINDOWS\srchasst
    2008-01-26 14:43:49 0 d
    C:\WINDOWS\system32\Macromed
    2008-01-26 14:43:41 0 d
    C:\Program Files\Movie Maker
    2008-01-26 14:43:34 0 d
    C:\WINDOWS\system32\Restore
    2008-01-26 14:43:15 21640 --a
    C:\WINDOWS\system32\emptyregdb.dat
    2008-01-26 14:43:11 0 d
    C:\WINDOWS\Registration
    2008-01-26 14:42:54 0 d
    C:\Program Files\Online Services
    2008-01-26 14:42:50 0 d
    C:\Program Files\Messenger
    2008-01-26 14:42:47 0 d
    C:\Program Files\MSN Gaming Zone
    2008-01-26 14:42:12 0 d
    C:\Program Files\Windows NT
    2008-01-26 14:42:09 0 d
    C:\WINDOWS\system32\MsDtc
    2008-01-26 14:42:07 0 d
    C:\WINDOWS\system32\Com
    2008-01-26 08:58:43 0 d--hs---- C:\WINDOWS\Installer
    2008-01-26 08:58:43 0 d
    C:\Program Files\Common Files\ODBC
    2008-01-26 08:58:40 0 d
    C:\Program Files\Common Files\SpeechEngines
    2008-01-26 08:58:39 0 dr
    C:\Program Files
    2008-01-26 08:58:39 0 d
    C:\Program Files\Common Files
    2008-01-26 08:58:34 6144 -ra
    C:\WINDOWS\system32\kbdhela2.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
    2008-01-26 08:58:20 0 d--h
    C:\Documents and Settings\Default User\Templates
    2008-01-26 08:58:20 0 dr
    C:\Documents and Settings\Default User\Start Menu
    2008-01-26 08:58:20 0 dr-h
    C:\Documents and Settings\Default User\SendTo
    2008-01-26 08:58:20 0 d--h
    C:\Documents and Settings\Default User\Recent
    2008-01-26 08:58:20 0 d--h
    C:\Documents and Settings\Default User\PrintHood
    2008-01-26 08:58:20 0 d--h
    C:\Documents and Settings\Default User\NetHood
    2008-01-26 08:58:20 0 d
    C:\Documents and Settings\Default User\My Documents
    2008-01-26 08:58:20 0 dr-h
    C:\Documents and Settings\Default User\Local Settings
    2008-01-26 08:58:20 0 d
    C:\Documents and Settings\Default User\Favorites
    2008-01-26 08:58:20 0 d
    C:\Documents and Settings\Default User\Desktop
    2008-01-26 08:58:20 0 d---s---- C:\Documents and Settings\Default User\Cookies
    2008-01-26 08:58:20 0 d--h
    C:\Documents and Settings\All Users\Templates
    2008-01-26 08:58:20 0 dr
    C:\Documents and Settings\All Users\Start Menu
    2008-01-26 08:58:20 0 d
    C:\Documents and Settings\All Users\Favorites
    2008-01-26 08:58:20 0 dr
    C:\Documents and Settings\All Users\Documents
    2008-01-26 08:58:20 0 d
    C:\Documents and Settings\All Users\Desktop
    2008-01-26 08:58:07 0 d
    C:\WINDOWS\system32\CatRoot2
    2008-01-26 08:58:07 0 d
    C:\WINDOWS\system32\CatRoot
    2008-01-26 08:58:02 0 dr-h
    C:\Documents and Settings\Default User\Application Data
    2008-01-26 08:58:02 0 d---s---- C:\Documents and Settings\Default User\Application Data\Microsoft
    2008-01-26 08:58:01 0 dr-h
    C:\Documents and Settings\All Users\Application Data
    2008-01-26 08:58:01 0 d---s---- C:\Documents and Settings\All Users\Application Data\Microsoft
    2008-01-26 08:57:40 0 d
    C:\Documents and Settings
    2008-01-26 08:57:39 0 d--hs---- C:\System Volume Information
    2008-01-26 08:51:29 0 d
    C:\WINDOWS\OemDir
    2008-01-26 08:51:27 0 d
    C:\WINDOWS
    2008-01-26 08:51:27 0 d
    C:\WINDOWS\WinSxS
    2008-01-26 08:51:27 0 dr
    C:\WINDOWS\Web
    2008-01-26 08:51:27 0 d
    C:\WINDOWS\twain_32
    2008-01-26 08:51:27 0 d
    C:\WINDOWS\system32
    2008-01-26 08:51:27 0 d
    C:\WINDOWS\system32\wins
    2008-01-26 08:51:27 0 d
    C:\WINDOWS\system32\wbem
    2008-01-26 08:51:27 0 d
    C:\WINDOWS\system32\usmt
    2008-01-26 08:51:27 0 d
    C:\WINDOWS\system32\spool
    2008-01-26 08:51:27 0 d
    C:\WINDOWS\system32\ShellExt
    2008-01-26 08:51:27 0 d
    C:\WINDOWS\system32\Setup
    2008-01-26 08:51:27 0 d
    C:\WINDOWS\system32\ras
    2008-01-26 08:51:27 0 d
    C:\WINDOWS\system32\oobe
    2008-01-26 08:51:27 0 d
    C:\WINDOWS\system32\npp
    2008-01-26 08:51:27 0 d
    C:\WINDOWS\system32\mui
    2008-01-26 08:51:27 0 d
    C:\WINDOWS\system32\inetsrv
    2008-01-26 08:51:27 0 d
    C:\WINDOWS\system32\IME
    2008-01-26 08:51:27 0 d
    C:\WINDOWS\system32\icsxml
    2008-01-26 08:51:27 0 d
    C:\WINDOWS\system32\ias
    2008-01-26 08:51:27 0 d
    C:\WINDOWS\system32\export
    2008-01-26 08:51:27 0 d
    C:\WINDOWS\system32\drivers
    2008-01-26 08:51:27 0 d
    C:\WINDOWS\system32\drivers\etc
    2008-01-26 08:51:27 0 d
    C:\WINDOWS\system32\drivers\disdn
    2008-01-26 08:51:27 0 dr-hs--c- C:\WINDOWS\system32\dllcache
    2008-01-26 08:51:27 0 d
    C:\WINDOWS\system32\dhcp
    2008-01-26 08:51:27 0 d
    C:\WINDOWS\system32\config
    2008-01-26 08:51:27 0 d
    C:\WINDOWS\system32\3com_dmi
    2008-01-26 08:51:27 0 d
    C:\WINDOWS\system32\3076
    2008-01-26 08:51:27 0 d
    C:\WINDOWS\system32\2052
    2008-01-26 08:51:27 0 d
    C:\WINDOWS\system32\1054
    2008-01-26 08:51:27 0 d
    C:\WINDOWS\system32\1042
    2008-01-26 08:51:27 0 d
    C:\WINDOWS\system32\1041
    2008-01-26 08:51:27 0 d
    C:\WINDOWS\system32\1037
    2008-01-26 08:51:27 0 d
    C:\WINDOWS\system32\1033
    2008-01-26 08:51:27 0 d
    C:\WINDOWS\system32\1031
    2008-01-26 08:51:27 0 d
    C:\WINDOWS\system32\1028
    2008-01-26 08:51:27 0 d
    C:\WINDOWS\system32\1025
    2008-01-26 08:51:27 0 d
    C:\WINDOWS\system
    2008-01-26 08:51:27 0 d
    C:\WINDOWS\security
    2008-01-26 08:51:27 0 d
    C:\WINDOWS\Resources
    2008-01-26 08:51:27 0 d
    C:\WINDOWS\repair
    2008-01-26 08:51:27 0 d
    C:\WINDOWS\Provisioning
    2008-01-26 08:51:27 0 d
    C:\WINDOWS\PeerNet
    2008-01-26 08:51:27 0 d
    C:\WINDOWS\pchealth
    2008-01-26 08:51:27 0 d
    C:\WINDOWS\mui
    2008-01-26 08:51:27 0 d
    C:\WINDOWS\msapps
    2008-01-26 08:51:27 0 d
    C:\WINDOWS\msagent
    2008-01-26 08:51:27 0 d
    C:\WINDOWS\Media
    2008-01-26 08:51:27 0 d
    C:\WINDOWS\java
    2008-01-26 08:51:27 0 d--h
    C:\WINDOWS\inf
    2008-01-26 08:51:27 0 d
    C:\WINDOWS\ime
    2008-01-26 08:51:27 0 d
    C:\WINDOWS\Help
    2008-01-26 08:51:27 0 dr--s---- C:\WINDOWS\Fonts
    2008-01-26 08:51:27 0 d
    C:\WINDOWS\Driver Cache
    2008-01-26 08:51:27 0 d
    C:\WINDOWS\Debug
    2008-01-26 08:51:27 0 d
    C:\WINDOWS\Cursors
    2008-01-26 08:51:27 0 d
    C:\WINDOWS\Connection Wizard
    2008-01-26 08:51:27 0 d
    C:\WINDOWS\Config
    2008-01-26 08:51:27 0 d
    C:\WINDOWS\AppPatch
    2008-01-26 08:51:27 0 d
    C:\WINDOWS\addins


    -- Find3M Report

    2008-01-26 08:58:20 62 --ahs---- C:\Documents and Settings\Amer Qaiyum\Application Data\desktop.ini


    -- Registry Dump

    *Note* empty entries & legit default entries are not shown


    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA}]
    26/01/2008 16:01 262144 --a
    C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
    "{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}"= C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL [26/01/2008 16:01 262144]

    [-HKEY_CLASSES_ROOT\CLSID\{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [04/08/2004 12:00]
    "PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [04/08/2004 12:00]
    "PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [04/08/2004 12:00]
    "vmware-tray"="C:\Program Files\VMware\VMware Workstation\vmware-tray.exe" [08/10/2007 09:27]
    "VMware hqtray"="C:\Program Files\VMware\VMware Workstation\hqtray.exe" [08/10/2007 09:26]
    "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [26/01/2008 15:43]
    "NVMixerTray"="C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" [03/06/2004 20:51]
    "ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [14/11/2007 16:05]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [25/09/2007 01:11]
    "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [28/07/2003 15:19]
    "nwiz"="nwiz.exe" [28/07/2003 15:19 C:\WINDOWS\system32\nwiz.exe]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [04/08/2004 12:00]
    "MimarSinan Rubber Ducky"="C:\Program Files\MimarSinan Rubber Ducky\RubberDucky.exe" [22/09/2006 06:45]
    "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [13/10/2004 16:24]
    "CTSyncU.exe"="C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe" [07/08/2006 10:06]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
    @=&quot;Service"

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DownloadAccelerator]
    "C:\Program Files\DAP\DAP.EXE" /STARTUP

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpeedBitVideoAccelerator]
    "C:\Program Files\SpeedBit Video Accelerator\VideoAccelerator.exe"


    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b9d90441-cbec-11dc-ba10-806d6172696f}]
    AutoRun\command- D:\autorun.exe
    directx\command- D:\DirectX9\dxsetup.exe
    setup\command- D:\setup.exe




    -- Hosts

    127.0.0.1 007guard.com
    127.0.0.1 www.007guard.com
    127.0.0.1 008i.com
    127.0.0.1 008k.com
    127.0.0.1 www.008k.com
    127.0.0.1 00hq.com
    127.0.0.1 www.00hq.com
    127.0.0.1 010402.com
    127.0.0.1 032439.com
    127.0.0.1 www.032439.com

    7873 more entries in hosts file.


    -- End of Deckard's System Scanner: finished at 2008-02-09 17:33:42

    And this the the info from the extra.txt log:

    Deckard's System Scanner v20071014.68
    Extra logfile - please post this as an attachment with your post.

    -- System Information

    Microsoft Windows XP Home Edition (build 2600) SP 2.0
    Architecture: X86; Language: English

    CPU 0: AMD Athlon(tm) XP 3200+
    Percentage of Memory in Use: 25%
    Physical Memory (total/avail): 1535.48 MiB / 1140.21 MiB
    Pagefile Memory (total/avail): 3434.76 MiB / 3235.83 MiB
    Virtual Memory (total/avail): 2047.88 MiB / 1912.52 MiB

    A: is Removable (No Media)
    C: is Fixed (NTFS) - 189.91 GiB total, 80.35 GiB free.
    D: is CDROM (No Media)

    \\.\PHYSICALDRIVE0 - Maxtor 6 B200M0 SCSI Disk Device - 189.92 GiB - 1 partition
    \PARTITION0 (bootable) - Installable File System - 189.91 GiB - C:



    -- Security Center

    AUOptions is scheduled to auto-install.
    Windows Internal Firewall is disabled.

    FirstRunDisabled is set.

    FW: ZoneAlarm Firewall v7.0.462.000 (Check Point, LTD.) Disabled
    AV: AVG 7.5.516 v7.5.516 (Grisoft)

    [HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

    [HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
    "C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"="C:\\Program Files\\Grisoft\\AVG7\\avginet.exe:*:Enabled:avginet.exe"
    "C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe:*:Enabled:avgamsvr.exe"
    "C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe:*:Enabled:avgcc.exe"
    "C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe:*:Enabled:avgemc.exe"
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
    "C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"


    -- Environment Variables

    ALLUSERSPROFILE=C:\Documents and Settings\All Users
    APPDATA=C:\Documents and Settings\Amer Qaiyum\Application Data
    CLIENTNAME=Console
    CommonProgramFiles=C:\Program Files\Common Files
    COMPUTERNAME=SUPERPC
    ComSpec=C:\WINDOWS\system32\cmd.exe
    FP_NO_HOST_CHECK=NO
    HOMEDRIVE=C:
    HOMEPATH=\Documents and Settings\Amer Qaiyum
    LOGONSERVER=\\SUPERPC
    NUMBER_OF_PROCESSORS=1
    OS=Windows_NT
    Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
    PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
    PROCESSOR_ARCHITECTURE=x86
    PROCESSOR_IDENTIFIER=x86 Family 6 Model 10 Stepping 0, AuthenticAMD
    PROCESSOR_LEVEL=6
    PROCESSOR_REVISION=0a00
    ProgramFiles=C:\Program Files
    PROMPT=$P$G
    SESSIONNAME=Console
    SystemDrive=C:
    SystemRoot=C:\WINDOWS
    TEMP=C:\DOCUME~1\AMERQA~1\LOCALS~1\Temp
    TMP=C:\DOCUME~1\AMERQA~1\LOCALS~1\Temp
    tvdumpflags=8
    USERDOMAIN=SUPERPC
    USERNAME=Amer Qaiyum
    USERPROFILE=C:\Documents and Settings\Amer Qaiyum
    windir=C:\WINDOWS


    -- User Profiles

    Amer Qaiyum (admin)


    -- Add/Remove Programs

    --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{19822917-61F6-4221-B1D0-1C3B8A06BE60}\setup.exe" -l0x9
    --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{19822917-61F6-4221-B1D0-1C3B8A06BE60}\setup.exe" -l0x9 /remove
    --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{57FA4E0F-82C9-417D-87BC-0186D6CB7A44}\setup.exe" -l0x9
    --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{63A317D0-60A6-43FC-848A-9FE4A53B29CE}\setup.exe" -l0x9
    --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{7C9F6AF4-E9D9-47FE-BE4B-E637C2FCB410}\setup.exe" -l0x9
    --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{7C9F6AF4-E9D9-47FE-BE4B-E637C2FCB410}\setup.exe" -l0x9 /remove
    --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{98181885-5B28-4280-9B56-452FF877D5B9}\setup.exe" -l0x9
    --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{98181885-5B28-4280-9B56-452FF877D5B9}\setup.exe" -l0x9 /remove
    --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9A0B5225-B59B-4D72-B3FE-71AAA693A8E2}\setup.exe" -l0x9
    --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9A0B5225-B59B-4D72-B3FE-71AAA693A8E2}\setup.exe" -l0x9 /remove
    --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A9BB081B-C020-4D02-A763-D32204D2563D}\setup.exe" -l0x9
    --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A9BB081B-C020-4D02-A763-D32204D2563D}\setup.exe" -l0x9 /remove
    --> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
    Ad-Aware 2007 --> MsiExec.exe /I{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}
    Adobe Flash Player ActiveX --> C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
    Adobe Shockwave Player --> C:\WINDOWS\system32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~1\Install.log
    AVG 7.5 --> C:\Program Files\Grisoft\AVG7\setup.exe /UNINSTALL
    Call of Duty --> C:\PROGRA~1\CALLOF~1\Uninstall\Unwise.exe /u C:\PROGRA~1\CALLOF~1\Uninstall\Install.log
    Creative Removable Disk Manager --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{57FA4E0F-82C9-417D-87BC-0186D6CB7A44}\setup.exe" -l0x9 /remove
    Creative System Information --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{63A317D0-60A6-43FC-848A-9FE4A53B29CE}\setup.exe" -l0x9 /remove
    Creative ZEN V Series (R2) --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9862E0CB-4727-4FFC-963A-E22A9E9EC10C}\SETUP.EXE" -l0x9 /remove
    Download Accelerator Plus (DAP) --> C:\PROGRA~1\DAP\DAPREMOVE.EXE
    GameSpy Arcade --> C:\PROGRA~1\GAMESP~1\UNWISE.EXE C:\PROGRA~1\GAMESP~1\INSTALL.LOG
    HijackThis 2.0.2 --> "C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
    Hotfix for Windows Media Format 11 SDK (KB929399) --> "C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
    Java(TM) 6 Update 3 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160030}
    Kaspersky Online Scanner --> C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe
    Microsoft Base Smart Card Cryptographic Service Provider Package --> "C:\WINDOWS\$NtUninstallbasecsp$\spuninst\spuninst.exe"
    Microsoft Compression Client Pack 1.0 for Windows XP --> "C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
    Microsoft Halo Trial --> "C:\Program Files\Microsoft Games\Halo Trial\UNINSTAL.EXE" /runtemp /addremove
    Microsoft Kernel-Mode Driver Framework Feature Pack 1.5 --> "C:\WINDOWS\$NtUninstallWdf01005$\spuninst\spuninst.exe"
    Microsoft Save as PDF or XPS Add-in for 2007 Microsoft Office programs --> MsiExec.exe /X{90120000-00B2-0409-0000-0000000FF1CE}
    Microsoft Silverlight --> MsiExec.exe /I{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
    Microsoft User-Mode Driver Framework Feature Pack 1.0 --> "C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
    MimarSinan Rubber Ducky --> "C:\Documents and Settings\All Users\Application Data\{C357FF4B-BB69-4DC2-9869-55F052974DA8}\Rubber Ducky.exe" REMOVE=TRUE MODIFY=FALSE
    MSXML 6.0 Parser (KB933579) --> MsiExec.exe /I{0A869A65-8C94-4F7C-A5C7-972D3C8CED9E}
    NVIDIA Drivers --> C:\WINDOWS\system32\NVUNINST.EXE UninstallGUI
    NVIDIA Windows 2000/XP Display Drivers --> rundll32.exe C:\WINDOWS\system32\nvinstnt.dll,NvUninstallNT4 nv4_disp.inf
    NvMixer --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D7A6C517-11F2-419F-B5BB-27772B939698}\Setup.exe" -uninstall
    SpeedBit Video Accelerator --> C:\PROGRA~1\SPEEDB~1\UNWISE.EXE C:\PROGRA~1\SPEEDB~1\INSTALL.LOG
    TeamSpeak 2 RC2 --> "C:\Program Files\Teamspeak2_RC2\unins000.exe"
    VMware Workstation --> MsiExec.exe /I{A3FF5CB2-FB35-4658-8751-9EDE1D65B3AA}
    WarRock --> C:\Program Files\InstallShield Installation Information\{00D15456-F679-4AD4-8BD2-56450D4C3F72}\setup.exe -runfromtemp -l0x0009 -removeonly
    Windows Imaging Component --> "C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe"
    Windows Live installer --> MsiExec.exe /X{A7E4ECCA-4A8E-4258-8EC8-2DCCF5B11320}
    Windows Live Mail --> MsiExec.exe /I{184E7118-0295-43C4-B72C-1D54AA75AAF7}
    Windows Live Sign-in Assistant --> MsiExec.exe /I{AFA4E5FD-ED70-4D92-99D0-162FD56DC986}
    Windows Media Format 11 runtime --> "C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
    Windows Media Format SDK Hotfix - KB891122 --> "C:\WINDOWS\$NtUninstallKB891122$\spuninst\spuninst.exe"
    Windows Presentation Foundation --> MsiExec.exe /X{BAF78226-3200-4DB4-BE33-4D922A799840}
    WinRAR archiver --> C:\Program Files\WinRAR\uninstall.exe
    XML Paper Specification Shared Components Pack 1.0 -->
    ZoneAlarm --> C:\Program Files\Zone Labs\ZoneAlarm\zauninst.exe
    ZoneAlarm Spy Blocker --> rundll32 C:\PROGRA~1\ZONEAL~1\bar\1.bin\SpyBlock.dll,O


    -- Application Event Log

    Event Record #/Type628 / Error
    Event Submitted/Written: 02/09/2008 04:02:12 PM
    Event ID/Source: 100 / vmauthd
    Event Description:
    Cannot connect to VMX: C:\Documents and Settings\Amer Qaiyum\My Documents\My Virtual Machines\Windows Vista\Windows Vista.vmx

    Event Record #/Type627 / Error
    Event Submitted/Written: 02/09/2008 04:01:49 PM
    Event ID/Source: 100 / vmauthd
    Event Description:
    Cannot connect to VMX: C:\Documents and Settings\Amer Qaiyum\My Documents\My Virtual Machines\Windows Vista\Windows Vista.vmx

    Event Record #/Type626 / Error
    Event Submitted/Written: 02/09/2008 11:15:13 AM
    Event ID/Source: 100 / vmauthd
    Event Description:
    Cannot connect to VMX: C:\Documents and Settings\Amer Qaiyum\My Documents\My Virtual Machines\Windows Vista\Windows Vista.vmx

    Event Record #/Type625 / Error
    Event Submitted/Written: 02/09/2008 11:15:03 AM
    Event ID/Source: 100 / vmauthd
    Event Description:
    Cannot connect to VMX: C:\Documents and Settings\Amer Qaiyum\My Documents\My Virtual Machines\Windows Vista\Windows Vista.vmx

    Event Record #/Type617 / Error
    Event Submitted/Written: 02/08/2008 06:43:52 PM
    Event ID/Source: 100 / vmauthd
    Event Description:
    Cannot connect to VMX: C:\Documents and Settings\Amer Qaiyum\My Documents\My Virtual Machines\Windows Vista\Windows Vista.vmx



    -- Security Event Log

    No Errors/Warnings found.


    -- System Event Log

    Event Record #/Type3203 / Error
    Event Submitted/Written: 02/09/2008 05:31:03 PM
    Event ID/Source: 7034 / Service Control Manager
    Event Description:
    The VMware Authorization Service service terminated unexpectedly. It has done this 1 time(s).

    Event Record #/Type3202 / Error
    Event Submitted/Written: 02/09/2008 05:31:03 PM
    Event ID/Source: 7034 / Service Control Manager
    Event Description:
    The VMware DHCP Service service terminated unexpectedly. It has done this 1 time(s).

    Event Record #/Type3201 / Error
    Event Submitted/Written: 02/09/2008 05:31:02 PM
    Event ID/Source: 7034 / Service Control Manager
    Event Description:
    The VMware Virtual Mount Manager Extended service terminated unexpectedly. It has done this 1 time(s).

    Event Record #/Type3200 / Error
    Event Submitted/Written: 02/09/2008 05:31:01 PM
    Event ID/Source: 7034 / Service Control Manager
    Event Description:
    The VMware NAT Service service terminated unexpectedly. It has done this 1 time(s).

    Event Record #/Type3199 / Error
    Event Submitted/Written: 02/09/2008 05:30:58 PM
    Event ID/Source: 7034 / Service Control Manager
    Event Description:
    The AVG7 Update Service service terminated unexpectedly. It has done this 1 time(s).



    -- End of Deckard's System Scanner: finished at 2008-02-09 17:33:42

    Please, man, find a solution.:rolleyes:
  • Whizzkid_amerWhizzkid_amer
    edited February 2008
    I've run Malwarebyte's aswell. It didnt find anything.

    Malwarebytes' Anti-Malware 1.02
    Database version: 331

    Scan type: Full Scan (C:\|)
    Objects scanned: 71903
    Time elapsed: 20 minute(s), 57 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 0

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    (No malicious items detected)
  • KatanaKatana
    edited February 2008
    Well, there is nothing showing that would cause problems.
    Let's try one last scan



    Download and Run ComboFix (by sUBs)
    Please visit this webpage for instructions for downloading and running ComboFix:

    http://www.bleepingcomputer.com/combofix/how-to-use-combofix

    Post the log from ComboFix when you've accomplished that, along with a new HijackThis log.
  • Whizzkid_amerWhizzkid_amer
    edited February 2008
    Done. Could it possibly be a process running in the background thats causing this problem?
  • KatanaKatana
    edited February 2008
    Well, there is no malware there and there doesn't appear to be anything running that would cause problems.
    The only thing I can suggest is that you create a new account on the machine and see if the games will install on that.
    If they do, then obviously something is happening in the normal account that is blocking them.
    If they still won't install, then something is corrupted and you will need to speak to a Tech person and see if they have any ideas
  • TroganTrogan London, UK
    edited March 2008
    This topic is now closed.

    If you are not the user who started this thread, you must start your own Thread instead (grin)
Sign In or Register to comment.