Okay i did the Combofix and it said restart, so i did and then the blue screen popped up again saying it was creating the log but it just said it for hours then went off... and also the start bar has dissapeared at the bottom of the screen... and i dont know where the log is located, if there is one.

That should have finished faster than that.Can you run it again and make sure you anti virus is disabled.If you have the same problem then run it in safe mode.

ComboFix 08-07-21.2 - Narna 2008-07-23 10:20:05.2 - NTFSx86

Running from: C:\Documents and Settings\Narna\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
C:\Documents and Settings\Guest\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
C:\WINDOWS\kvxqmtre.dll
C:\WINDOWS\system32\_000005_.tmp.dll
C:\WINDOWS\system32\auttyx.dll
C:\WINDOWS\system32\biawvi.dll
C:\WINDOWS\system32\drivers\npf.sys
C:\WINDOWS\system32\eprsktkk.dll
C:\WINDOWS\system32\ksfnmvji.dll
C:\WINDOWS\system32\packet.dll
C:\WINDOWS\system32\pthreadVC.dll
C:\WINDOWS\system32\whrfftwp.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_NPF


((((((((((((((((((((((((( Files Created from 2008-06-23 to 2008-07-23 )))))))))))))))))))))))))))))))
.

2008-07-21 14:58 . 2008-07-21 14:58 <DIR> d-------- C:\Deckard
2008-07-20 17:58 . 2008-07-20 17:58 <DIR> d-------- C:\Documents and Settings\Narna\Application Data\Malwarebytes
2008-07-20 17:47 . 2008-07-20 17:58 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-07-20 17:47 . 2008-07-20 17:47 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-07-20 17:47 . 2008-07-07 17:35 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-07-20 17:47 . 2008-07-07 17:35 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-07-20 17:08 . 2008-07-17 03:14 155,648 --a------ C:\WINDOWS\agpqlrfm.exe
2008-07-06 10:11 . 2008-07-06 10:11 <DIR> d-------- C:\Documents and Settings\Narna\Application Data\Sony Corporation

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
.
2008-07-21 15:00 --------- d-----w C:\Documents and Settings\Narna\Application Data\AVG7
2008-06-28 23:16 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kontiki
2008-06-24 11:13 --------- d-----w C:\Program Files\IGZones
2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-19 16:55 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-17 18:49 --------- d-----w C:\Documents and Settings\All Users\Application Data\Channel4
2008-06-13 13:10 272,128 ----a-w C:\WINDOWS\system32\drivers\bthport.sys
2008-06-07 05:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\MGS
2008-06-05 04:28 --------- d-----w C:\Documents and Settings\Narna\Application Data\LimeWire
2008-05-30 23:05 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-05-07 05:18 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
2007-10-02 16:19 6,016,952 -c--a-w C:\Program Files\Firefox Setup 2.0.0.7.exe
2007-05-19 20:50 774,144 -c--a-w C:\Program Files\RngInterstitial.dll
2007-04-29 22:29 6,820,520 -c--a-w C:\Program Files\FirefoxGoogleToolbarSetup.exe
2006-12-19 16:04 36,808,256 -c--a-w C:\Program Files\iTunesSetup.exe
2006-05-08 04:26 794,624 -c--a-w C:\WINDOWS\inf\OTHER\audio3d.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-09-20 10:35 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-09-20 10:32 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-09-20 10:36 114688]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
"OpwareSE2"="C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" [2003-05-08 11:00 49152]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 15:42 1404928]
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 18:17 159744]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41 282624]
"SNPT513"="C:\WINDOWS\vsnpt513.exe" [2003-08-12 19:21 32768]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 00:56 110592 C:\WINDOWS\system32\bthprops.cpl]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Cur rentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgw. exe" [2007-11-09 22:44 219136]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Cur rentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2004-08-04 05:00 53760 C:\WINDOWS\system32\narrator.exe]

C:\Documents and Settings\BABA\Start Menu\Programs\Startup\
Cyber-shot Viewer Media Check Tool.lnk - C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe [2006-07-08 12:28:02 155648]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Belkin 802.11g Wireless PCI Card Configuration Utility.lnk - C:\Program Files\Belkin\Belkin 802.11g Wireless PCI Card Configuration Utility\utility.exe [2007-06-18 19:49:31 327765]
Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2005-10-09 01:16:54 610365]
DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2007-07-27 07:35:50 962661]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\contro l\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, zwebauth.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Bluetooth.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Bluetooth.lnk
backup=C:\WINDOWS\pss\Bluetooth.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^PalTalk.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\PalTalk.lnk
backup=C:\WINDOWS\pss\PalTalk.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Narna^Start Menu^Programs^Startup^Adobe Gamma.lnk]
path=C:\Documents and Settings\Narna\Start Menu\Programs\Startup\Adobe Gamma.lnk
backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Narna^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
path=C:\Documents and Settings\Narna\Start Menu\Programs\Startup\LimeWire On Startup.lnk
backup=C:\WINDOWS\pss\LimeWire On Startup.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeUpdater]
--a------ 2007-02-28 23:06 2321600 C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC]
--a------ 2008-07-20 17:29 579584 C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2007-06-01 16:51 257088 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
--a------ 2007-10-18 12:34 5724184 C:\Program Files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Tunebite]
--a------ 2008-04-03 12:16 6321456 C:\Program Files\RapidSolution\Tunebite\Tunebite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Microsoft Games\\Age of Empires III\\age3.exe"=


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{582610B8-E496-4813-993C-4B027173FE38}]
C:\Program Files\PixiePack Codec Pack\InstallerHelper.exe
.
- - - - ORPHANS REMOVED - - - -

BHO-{812AE34E-162C-4C94-BAA1-A2C0431AEC84} - C:\WINDOWS\kgxmotapktx.dll
Toolbar-{3FCAEB7D-F8AE-4A67-AE6C-57EE1416BB6D} - C:\WINDOWS\qndsfmao.dll
HKLM-Run-C-Media Speaker Configuration - C:\Documents and Settings\BABA\Desktop\NG180_WDM\Setup.exe
HKLM-Run-Adobe Photo Downloader - C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
HKLM-Run-WinLogin - C:\WINDOWS\winlogin.exe
HKLM-Run-adiras - adiras.exe
SSODL-kvxqmtre-{6400F73D-52C1-4AA2-AA71-0AFD283611F0} - C:\WINDOWS\kvxqmtre.dll
SSODL-evgratsm-{F0013857-007F-4411-BCAB-A70CBFB40DEE} - C:\WINDOWS\evgratsm.dll
MSConfigStartUp-Skype - C:\Program Files\Skype\Phone\Skype.exe


.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://www.google.com/
R1 -: HKCU-Internet Settings,ProxyOverride = *.local
O8 -: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 -: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm

O16 -: {29710C4C-4F0F-4A36-8312-CB5614829804} - hxxp://www.drivershq.com/files/cab/nonmember/DriverDetective-nm.cab
C:\WINDOWS\Downloaded Program Files\DriverDetective-nm.INF
C:\WINDOWS\Downloaded Program Files\DriverDetective-nm.ocx

O16 -: {A243F6C2-34D2-4549-BCCD-A7BEF759B236} - hxxp://img.funtigo.com/images/uploader/ssiPictureUploader.cab
C:\WINDOWS\Downloaded Program Files\ssiPictureUploader.inf
C:\WINDOWS\Downloaded Program Files\ssiPictureUploader.ocx

O16 -: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} - hxxps://secure.gopetslive.com/dev/GoPetsWeb.cab
C:\WINDOWS\Downloaded Program Files\GoPetsWeb.inf
C:\WINDOWS\Downloaded Program Files\GoPetsWeb.ocx


************************************************** ************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-23 10:24:04
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


************************************************** ************************
.
Completion time: 2008-07-23 10:29:27
ComboFix-quarantined-files.txt 2008-07-23 17:28:24

Pre-Run: 45,159,411,712 bytes free
Post-Run: 45,145,944,064 bytes free

162 --- E O F --- 2008-07-09 21:02:54

Nearly done....

Please copy this page to *Notepad* and save to your desktop for reference as you will not have any browsers open while you are carrying out portions of these instructions.

It's IMPORTANT to carry out the instructions in the sequence listed below.
1. Close any open browsers.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Open *notepad* and copy/paste the text in the quotebox below into it:

Save this as CFScript.txt, in the same location as ComboFix.exe which is on the Desktop.




Refering to the picture above, drag CFScript.txt into ComboFix.exe


When finished, it shall produce a log for you at C:\ComboFix.txt

Please copy and paste the ComboFix.txt along with a fresh HijackThis log in your next reply please.


*Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall.Altering this script in any way could damage your computer*

ComboFix 08-07-21.2 - Narna 2008-07-23 11:25:37.3 - NTFSx86

Running from: C:\Documents and Settings\Narna\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Narna\Desktop\CFScript.txt

FILE ::
C:\WINDOWS\agpqlrfm.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Narna\Application Data\LimeWire
C:\Documents and Settings\Narna\Application Data\LimeWire\.NetworkShare\LimeWireWin4.14.10.exe
C:\Documents and Settings\Narna\Application Data\LimeWire\412splashfree.png
C:\Documents and Settings\Narna\Application Data\LimeWire\414splashpro.png
C:\Documents and Settings\Narna\Application Data\LimeWire\active.mojito
C:\Documents and Settings\Narna\Application Data\LimeWire\certificate\limewire.keystore
C:\Documents and Settings\Narna\Application Data\LimeWire\createtimes.cache
C:\Documents and Settings\Narna\Application Data\LimeWire\data.ser
C:\Documents and Settings\Narna\Application Data\LimeWire\downloads.dat
C:\Documents and Settings\Narna\Application Data\LimeWire\fileurns.bak
C:\Documents and Settings\Narna\Application Data\LimeWire\fileurns.cache
C:\Documents and Settings\Narna\Application Data\LimeWire\filters.props
C:\Documents and Settings\Narna\Application Data\LimeWire\gnutella.net
C:\Documents and Settings\Narna\Application Data\LimeWire\installation.props
C:\Documents and Settings\Narna\Application Data\LimeWire\library.dat
C:\Documents and Settings\Narna\Application Data\LimeWire\limewire.props
C:\Documents and Settings\Narna\Application Data\LimeWire\mojito.props
C:\Documents and Settings\Narna\Application Data\LimeWire\passive.mojito
C:\Documents and Settings\Narna\Application Data\LimeWire\promotion\promodb.backup
C:\Documents and Settings\Narna\Application Data\LimeWire\promotion\promodb.data
C:\Documents and Settings\Narna\Application Data\LimeWire\promotion\promodb.properties
C:\Documents and Settings\Narna\Application Data\LimeWire\promotion\promodb.script
C:\Documents and Settings\Narna\Application Data\LimeWire\pub1.key
C:\Documents and Settings\Narna\Application Data\LimeWire\public.key
C:\Documents and Settings\Narna\Application Data\LimeWire\questions.props
C:\Documents and Settings\Narna\Application Data\LimeWire\responses.cache
C:\Documents and Settings\Narna\Application Data\LimeWire\secureMessage.key
C:\Documents and Settings\Narna\Application Data\LimeWire\simpp.xml
C:\Documents and Settings\Narna\Application Data\LimeWire\spam.dat
C:\Documents and Settings\Narna\Application Data\LimeWire\tables.props
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\black_theme.lwtp
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\black_theme\01_star.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\black_theme\02_star.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\black_theme\03_star.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\black_theme\04_star.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\black_theme\05_star.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\black_theme\chat.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\black_theme\dir_closed.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\black_theme\dir_open.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\black_theme\forward_dn.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\black_theme\forward_up.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\black_theme\kill.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\black_theme\kill_on.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\black_theme\lime.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\black_theme\logo.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\black_theme\notsearching.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\black_theme\pause_dn.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\black_theme\pause_up.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\black_theme\play_dn.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\black_theme\play_up.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\black_theme\question.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\black_theme\rewind_dn.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\black_theme\rewind_up.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\black_theme\searching.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\black_theme\splash.png
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\black_theme\splashpro.png
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\black_theme\stop_dn.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\black_theme\stop_up.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\black_theme\theme.txt
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\black_theme\warning.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\classic_theme.lwtp
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\classic_theme\01_star.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\classic_theme\02_star.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\classic_theme\03_star.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\classic_theme\04_star.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\classic_theme\05_star.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\classic_theme\chat.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\classic_theme\dir_closed.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\classic_theme\dir_open.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\classic_theme\forward_dn.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\classic_theme\forward_up.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\classic_theme\kill.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\classic_theme\logo.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\classic_theme\notsearching.gi f
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\classic_theme\pause_dn.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\classic_theme\pause_up.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\classic_theme\play_dn.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\classic_theme\play_up.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\classic_theme\question.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\classic_theme\rewind_dn.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\classic_theme\rewind_up.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\classic_theme\search.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\classic_theme\searching.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\classic_theme\splash.png
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\classic_theme\splashpro.png
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\classic_theme\stop_dn.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\classic_theme\stop_up.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\classic_theme\theme.txt
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\classic_theme\warning.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\limewire_theme.lwtp
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\limewire_theme\01_star.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\limewire_theme\02_star.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\limewire_theme\03_star.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\limewire_theme\04_star.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\limewire_theme\05_star.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\limewire_theme\chat.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\limewire_theme\dir_closed.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\limewire_theme\dir_open.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\limewire_theme\forward_dn.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\limewire_theme\forward_up.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\limewire_theme\kill.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\limewire_theme\kill_on.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\limewire_theme\lime.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\limewire_theme\logo.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\limewire_theme\notsearching.g if
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\limewire_theme\pause_dn.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\limewire_theme\pause_up.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\limewire_theme\play_dn.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\limewire_theme\play_up.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\limewire_theme\question.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\limewire_theme\rewind_dn.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\limewire_theme\rewind_up.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\limewire_theme\searching.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\limewire_theme\splash.png
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\limewire_theme\splashpro.png
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\limewire_theme\stop_dn.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\limewire_theme\stop_up.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\limewire_theme\theme.txt
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\limewire_theme\warning.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\limewirePro_theme.lwtp
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\limewirePro_theme\01_star.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\limewirePro_theme\02_star.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\limewirePro_theme\03_star.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\limewirePro_theme\04_star.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\limewirePro_theme\05_star.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\limewirePro_theme\chat.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\limewirePro_theme\dir_closed. gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\limewirePro_theme\dir_open.gi f
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\limewirePro_theme\forward_dn. gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\limewirePro_theme\forward_up. gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\limewirePro_theme\kill.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\limewirePro_theme\kill_on.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\limewirePro_theme\lime.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\limewirePro_theme\logo.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\limewirePro_theme\notsearchin g.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\limewirePro_theme\pause_dn.gi f
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\limewirePro_theme\pause_up.gi f
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\limewirePro_theme\play_dn.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\limewirePro_theme\play_up.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\limewirePro_theme\question.gi f
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\limewirePro_theme\rewind_dn.g if
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\limewirePro_theme\rewind_up.g if
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\limewirePro_theme\searching.g if
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\limewirePro_theme\splash.png
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\limewirePro_theme\splashpro.p ng
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\limewirePro_theme\stop_dn.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\limewirePro_theme\stop_up.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\limewirePro_theme\theme.txt
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\limewirePro_theme\version.txt
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\limewirePro_theme\warning.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\other_theme.lwtp
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\other_theme\01_star.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\other_theme\02_star.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\other_theme\03_star.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\other_theme\04_star.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\other_theme\05_star.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\other_theme\chat.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\other_theme\forward_dn.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\other_theme\forward_up.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\other_theme\kill.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\other_theme\kill_on.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\other_theme\logo.png
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\other_theme\notsearching.png
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\other_theme\pause_dn.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\other_theme\pause_up.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\other_theme\play_dn.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\other_theme\play_up.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\other_theme\question.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\other_theme\rewind_dn.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\other_theme\rewind_up.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\other_theme\searching.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\other_theme\splash.png
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\other_theme\splashpro.png
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\other_theme\stop_dn.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\other_theme\stop_up.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\other_theme\theme.txt
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\other_theme\warning.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\windows_theme.lwtp
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\windows_theme\01_star.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\windows_theme\02_star.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\windows_theme\03_star.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\windows_theme\04_star.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\windows_theme\05_star.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\windows_theme\chat.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\windows_theme\forward_dn.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\windows_theme\forward_up.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\windows_theme\kill.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\windows_theme\kill_on.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\windows_theme\logo.png
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\windows_theme\notsearching.pn g
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\windows_theme\pause_dn.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\windows_theme\pause_up.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\windows_theme\play_dn.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\windows_theme\play_up.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\windows_theme\question.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\windows_theme\rewind_dn.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\windows_theme\rewind_up.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\windows_theme\searching.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\windows_theme\splash.png
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\windows_theme\splashpro.png
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\windows_theme\stop_dn.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\windows_theme\stop_up.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\windows_theme\theme.txt
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\windows_theme\version.txt
C:\Documents and Settings\Narna\Application Data\LimeWire\themes\windows_theme\warning.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\ttree.cache
C:\Documents and Settings\Narna\Application Data\LimeWire\ttrees.cache
C:\Documents and Settings\Narna\Application Data\LimeWire\ttroot.cache
C:\Documents and Settings\Narna\Application Data\LimeWire\update.xml
C:\Documents and Settings\Narna\Application Data\LimeWire\version.key
C:\Documents and Settings\Narna\Application Data\LimeWire\version.xml
C:\Documents and Settings\Narna\Application Data\LimeWire\versions.props
C:\Documents and Settings\Narna\Application Data\LimeWire\xml\data\delete_me
C:\Documents and Settings\Narna\Application Data\LimeWire\xml\misc\application.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\xml\misc\audio.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\xml\misc\document.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\xml\misc\image.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\xml\misc\video.gif
C:\Documents and Settings\Narna\Application Data\LimeWire\xml\schemas\application.xsd
C:\Documents and Settings\Narna\Application Data\LimeWire\xml\schemas\audio.xsd
C:\Documents and Settings\Narna\Application Data\LimeWire\xml\schemas\document.xsd
C:\Documents and Settings\Narna\Application Data\LimeWire\xml\schemas\image.xsd
C:\Documents and Settings\Narna\Application Data\LimeWire\xml\schemas\video.xsd
C:\WINDOWS\agpqlrfm.exe

.
((((((((((((((((((((((((( Files Created from 2008-06-23 to 2008-07-23 )))))))))))))))))))))))))))))))
.

2008-07-21 14:58 . 2008-07-21 14:58 <DIR> d-------- C:\Deckard
2008-07-20 17:58 . 2008-07-20 17:58 <DIR> d-------- C:\Documents and Settings\Narna\Application Data\Malwarebytes
2008-07-20 17:47 . 2008-07-20 17:58 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-07-20 17:47 . 2008-07-20 17:47 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-07-20 17:47 . 2008-07-07 17:35 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-07-20 17:47 . 2008-07-07 17:35 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-07-06 10:11 . 2008-07-06 10:11 <DIR> d-------- C:\Documents and Settings\Narna\Application Data\Sony Corporation

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
.
2008-07-21 15:00 --------- d-----w C:\Documents and Settings\Narna\Application Data\AVG7
2008-07-21 00:17 --------- d-----w C:\Documents and Settings\Narna\Application Data\Azureus
2008-06-28 23:16 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kontiki
2008-06-24 11:13 --------- d-----w C:\Program Files\IGZones
2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-19 16:55 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-17 18:49 --------- d-----w C:\Documents and Settings\All Users\Application Data\Channel4
2008-06-13 13:10 272,128 ----a-w C:\WINDOWS\system32\drivers\bthport.sys
2008-06-07 05:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\MGS
2008-05-30 23:05 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-05-07 05:18 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
2007-10-02 16:19 6,016,952 -c--a-w C:\Program Files\Firefox Setup 2.0.0.7.exe
2007-05-19 20:50 774,144 -c--a-w C:\Program Files\RngInterstitial.dll
2007-04-29 22:29 6,820,520 -c--a-w C:\Program Files\FirefoxGoogleToolbarSetup.exe
2006-12-19 16:04 36,808,256 -c--a-w C:\Program Files\iTunesSetup.exe
2006-05-08 04:26 794,624 -c--a-w C:\WINDOWS\inf\OTHER\audio3d.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-09-20 10:35 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-09-20 10:32 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-09-20 10:36 114688]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
"OpwareSE2"="C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" [2003-05-08 11:00 49152]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 15:42 1404928]
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 18:17 159744]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41 282624]
"SNPT513"="C:\WINDOWS\vsnpt513.exe" [2003-08-12 19:21 32768]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 00:56 110592 C:\WINDOWS\system32\bthprops.cpl]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Cur rentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgw. exe" [2007-11-09 22:44 219136]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Cur rentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2004-08-04 05:00 53760 C:\WINDOWS\system32\narrator.exe]

C:\Documents and Settings\BABA\Start Menu\Programs\Startup\
Cyber-shot Viewer Media Check Tool.lnk - C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe [2006-07-08 12:28:02 155648]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Belkin 802.11g Wireless PCI Card Configuration Utility.lnk - C:\Program Files\Belkin\Belkin 802.11g Wireless PCI Card Configuration Utility\utility.exe [2007-06-18 19:49:31 327765]
Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2005-10-09 01:16:54 610365]
DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2007-07-27 07:35:50 962661]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\contro l\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, zwebauth.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Bluetooth.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Bluetooth.lnk
backup=C:\WINDOWS\pss\Bluetooth.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^PalTalk.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\PalTalk.lnk
backup=C:\WINDOWS\pss\PalTalk.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Narna^Start Menu^Programs^Startup^Adobe Gamma.lnk]
path=C:\Documents and Settings\Narna\Start Menu\Programs\Startup\Adobe Gamma.lnk
backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Narna^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
path=C:\Documents and Settings\Narna\Start Menu\Programs\Startup\LimeWire On Startup.lnk
backup=C:\WINDOWS\pss\LimeWire On Startup.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeUpdater]
--a------ 2007-02-28 23:06 2321600 C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC]
--a------ 2008-07-20 17:29 579584 C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2007-06-01 16:51 257088 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
--a------ 2007-10-18 12:34 5724184 C:\Program Files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Tunebite]
--a------ 2008-04-03 12:16 6321456 C:\Program Files\RapidSolution\Tunebite\Tunebite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Microsoft Games\\Age of Empires III\\age3.exe"=


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{582610B8-E496-4813-993C-4B027173FE38}]
C:\Program Files\PixiePack Codec Pack\InstallerHelper.exe
.
************************************************** ************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-23 11:28:09
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


************************************************** ************************
.
Completion time: 2008-07-23 11:31:38
ComboFix-quarantined-files.txt 2008-07-23 18:30:35
ComboFix2.txt 2008-07-23 17:29:29

Pre-Run: 45,197,692,928 bytes free
Post-Run: 45,177,774,080 bytes free

345 --- E O F --- 2008-07-09 21:02:54



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:33:03 AM, on 7/23/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\vsnpt513.exe
C:\Program Files\Belkin\Belkin 802.11g Wireless PCI Card Configuration Utility\utility.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\WINDOWS\system32\rsvp.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Narna\Desktop\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Live Search
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Live Search
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = *.local
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SNPT513] C:\WINDOWS\vsnpt513.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User '?')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User '?')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User '?')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User '?')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Global Startup: Belkin 802.11g Wireless PCI Card Configuration Utility.lnk = ?
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab31267.cab
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10...I.cab46479.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab56986.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary...r.cab31267.cab
O16 - DPF: {29710C4C-4F0F-4A36-8312-CB5614829804} (DriverDetectiveNonMembers.nonmembers) - http://www.drivershq.com/files/cab/n...tective-nm.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} - http://us.chat1.yimg.com/us.yimg.com...45/yacscom.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (ZoneBuddy Class) - http://zone.msn.com/BinFrameWork/v10...y.cab32846.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.co.uk/SnapfishUKActivia.cab
O16 - DPF: {4A85DBE0-BFB2-4119-8401-186A7C6EB653} - http://messenger.zone.msn.com/binary/MJSS.cab69309.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://kissesfrmnarna.spaces.msn.com...d/MsnPUpld.cab
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10...t.cab32846.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary...n.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-GB/.../GAME_UNO1.cab
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab
O16 - DPF: {A243F6C2-34D2-4549-BCCD-A7BEF759B236} (Seekford Solutions, Inc.'s ssiPictureUploader Control) - http://img.funtigo.com/images/upload...reUploader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary...o.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin3.valueactive.com/Regi...18/flashax.cab
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (StadiumProxy Class) - http://zone.msn.com/binframework/v10...y.cab41227.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary...r.cab56986.cab
O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab
O16 - DPF: {FF3C5A9F-5A91-4930-80E8-4709194C2AD3} (CheckersZPA Object) - http://zone.msn.com/bingame/zpagames...A.cab40641.cab
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\Pacsptisvr.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\Sptisrv.exe
O24 - Desktop Component 0: Privacy Protection - (no file)

--
End of file - 9943 bytes

Ok.Thats it.Just fix this and your done..


Have "Hijack This" fix all the following items in the list below by placing a check in the appropriate boxes.Confirm that you have only the listed ones checked, then press <Fix checked> and Close HJT.


O24 - Desktop Component 0: Privacy Protection - (no file)

=================================

This will clear away any of the files and folders that were created by ComboFix.

Go to :
Start > Run then copy and paste the following highlighted text below into the box and click OK.



ComboFix /u





=============================



Now that you are clean,and If you wish to do so, here are a few things that you can do that will help keep your computer a bit more clean and secure..they can be done at your leisure.

Download and scan with CCleaner from CCleaner - Download

1. Starting with v1.27.260, CCleaner - Download installs the Yahoo Toolbar as an option which IS checkmarked by default during the installation. IF you do NOT want it, REMOVE the checkmark when provided with the option OR download the toolbar-free Basic or Slim versions instead of the Standard Build.

2. Before first use, select Options > Advanced and UNCHECK "Only delete files in Windows Temp folder older than 48 hours"

3. Then select the items you wish to clean up.

In the Windows Tab:
• Clean all entries in the "Internet Explorer" section except Cookies.
• Clean all the entries in the "Windows Explorer" section.
• Clean all entries in the "System" section.
• Clean all entries in the "Advanced" section.
• Clean any others that you choose.

In the Applications Tab:
• Clean all except cookies in the Firefox/Mozilla section if you use it.
• Clean all in the Opera section if you use it.
• Clean Sun Java in the Internet Section.
• Clean any others that you choose.

4. Click the "Run Cleaner" button.
5. A pop up box will appear advising this process will permanently delete files from your system.
6. Click "OK" and it will scan and clean your system.
7. Click "exit" when done.
__________________



=========================================

Is your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update to the latest version if required.

Before installing go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
Check any item with Java Runtime Environment (JRE or J2SE) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed.
Then install the newest version.

Updating Java:

Download the latest version of Java Runtime Environment (JRE) 6u6 (Java SE Downloads).



==============================================

UPDATING WINDOWS AND INTERNET EXPLORER

IMPORTANT: You Need to Update Windows and Internet Explorer to protect your computer from the malware that is around on the Internet. Please go to the windows update site (Microsoft Windows Update) to get the critical updates.

If you are running Microsoft Office, or any portion thereof, go to the Microsoft's Office Update site and make sure you have at least all the critical updates installed (Free) Microsoft Office Update.

Make your Internet Explorer more secure

This can be done by following these simple instructions:
From within Internet Explorer click on the Tools menu and then click on Options.
Click once on the Security tab
Click once on the Internet icon so it becomes highlighted.
Click once on the Custom Level button.
Change the Download signed ActiveX controls to Prompt
Change the Download unsigned ActiveX controls to Disable
Change the Initialize and script ActiveX controls not marked as safe to Disable
Change the Installation of desktop items to Prompt
Change the Launching programs and files in an IFRAME to Prompt
Change the Navigate sub-frames across different domains to Prompt
When all these settings have been made, click on the OK button.
If it prompts you as to whether or not you want to save the settings, press the Yes button.
Next press the Apply button and then the OK to exit the Internet Properties page.




================================================== ======

The following are recommended third party programs that are designed to keep your computer clean. A link as well as a brief description is included with each item.

Download SpywareBlaster
Spyware blaster is a program that stops known malicious activex controls from installing on your computer. It works by changing settings in your registry. It makes
kill bits in the registry, so that certain activex controls can't install.
If you don't know what activex controls are, see here (What is ActiveX control? - A Word Definition From the Webopedia Computer Dictionary)
You can download SpywareBlaster here here (MajorGeeks.Com - Contacting Download Site)
SpywareBlaster tutorial (Using SpywareBlaster to protect your computer from Spyware, Hijackers, and Malware)

Download iespyad
It puts many bad webpages on your restricted zones list. This means that you can still view the bad webpages, but the webpages cannot do certain things (such as use javascripts and cookies).

Download it here (http://www.spywarewarrior.com/uiuc/res/ie-spyad.exe)

Hosts file:
Every version of windows has a hosts file as part of them. In a very basic sense, they are used to locate webpages. We can customize a hosts file so that it blocks certain webpages. However, it can slow down certain computers. This is why using a hosts file is optional!!
Download it here (Blocking Unwanted Parasites with a Hosts File). Make sure you read the instructions on how to install the hosts file. There is a good tutorial here (The Hosts File and what it can do for you)
If you decide to download the hosts file, the slowdown problems can usually