Evesham Notebook - XP Home SP2.

Done sfc /scannow, etc, etc ..
As part of my "doing things" the name "steelwerx" occurred.

So I'm way out of my depth on this one, can't now even get to Event Manager or Device manager................

HJT & Combo Logs attached

As always looking forward to the voices of wisdom!


ComboFix 08-07-15.4 - Tegwen H 2008-07-16 18:16:45.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.559 [GMT 1:00]
Running from: C:\Documents and Settings\Tegwen H\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\1.tmp

.
((((((((((((((((((((((((( Files Created from 2008-06-16 to 2008-07-16 )))))))))))))))))))))))))))))))
.

2008-07-16 18:09 . 2004-08-04 00:56 116,224 --a--c--- C:\WINDOWS\system32\dllcache\xrxwiadr.dll
2008-07-16 18:09 . 2001-08-17 22:37 27,648 --a--c--- C:\WINDOWS\system32\dllcache\OLDF46.tmp
2008-07-16 18:09 . 2001-08-17 22:36 23,040 --a--c--- C:\WINDOWS\system32\dllcache\OLDF4E.tmp
2008-07-16 18:09 . 2001-08-17 22:36 17,408 --a--c--- C:\WINDOWS\system32\dllcache\OLDF4A.tmp
2008-07-16 18:08 . 2001-08-17 22:37 99,865 --a--c--- C:\WINDOWS\system32\dllcache\OLDF3E.tmp
2008-07-16 18:08 . 2004-08-04 13:00 28,288 --a--c--- C:\WINDOWS\system32\dllcache\OLDF3A.tmp
2008-07-16 18:08 . 2004-08-03 22:29 19,455 --a--c--- C:\WINDOWS\system32\dllcache\wvchntxx.sys
2008-07-16 18:08 . 2001-08-17 12:11 16,970 --a--c--- C:\WINDOWS\system32\dllcache\OLDF37.tmp
2008-07-16 18:08 . 2004-08-03 22:29 12,063 --a--c--- C:\WINDOWS\system32\dllcache\wsiintxx.sys
2008-07-16 18:08 . 2004-08-03 23:07 8,832 --a--c--- C:\WINDOWS\system32\dllcache\OLDF2B.tmp
2008-07-16 18:08 . 2004-08-04 00:56 8,192 --a--c--- C:\WINDOWS\system32\dllcache\OLDF2F.tmp
2008-07-16 18:08 . 2001-08-17 22:37 4,608 --a--c--- C:\WINDOWS\system32\dllcache\OLDF42.tmp
2008-07-16 18:06 . 2001-08-17 13:28 64,605 --a--c--- C:\WINDOWS\system32\dllcache\OLDEBA.tmp
2008-07-16 18:05 . 2001-08-17 13:28 765,884 --a--c--- C:\WINDOWS\system32\dllcache\OLDE96.tmp
2008-07-16 18:05 . 2001-08-17 13:28 687,999 --a--c--- C:\WINDOWS\system32\dllcache\OLDE9A.tmp
2008-07-16 18:05 . 2001-08-17 13:28 604,253 --a--c--- C:\WINDOWS\system32\dllcache\OLDEAC.tmp
2008-07-16 18:05 . 2004-08-04 13:00 426,041 --a--c--- C:\WINDOWS\system32\dllcache\OLDEAF.tmp
2008-07-16 18:05 . 2001-08-17 13:28 397,502 --a--c--- C:\WINDOWS\system32\dllcache\OLDEB6.tmp
2008-07-16 18:05 . 2001-08-17 12:14 249,402 --a--c--- C:\WINDOWS\system32\dllcache\OLDEA8.tmp
2008-07-16 18:05 . 2004-08-04 13:00 86,073 --a--c--- C:\WINDOWS\system32\dllcache\OLDEB2.tmp
2008-07-16 18:05 . 2004-08-03 23:07 42,240 --a--c--- C:\WINDOWS\system32\dllcache\OLDEA0.tmp
2008-07-16 18:05 . 2001-08-17 13:49 24,576 --a--c--- C:\WINDOWS\system32\dllcache\OLDEA4.tmp
2008-07-16 18:05 . 2004-08-04 00:56 11,325 --a--c--- C:\WINDOWS\system32\dllcache\vchnt5.dll
2008-07-16 18:04 . 2001-08-17 13:28 794,654 --a--c--- C:\WINDOWS\system32\dllcache\OLDE7E.tmp
2008-07-16 18:04 . 2001-08-17 13:28 794,399 --a--c--- C:\WINDOWS\system32\dllcache\OLDE86.tmp
2008-07-16 18:04 . 2001-08-17 13:28 793,598 --a--c--- C:\WINDOWS\system32\dllcache\OLDE82.tmp
2008-07-16 18:04 . 2001-08-17 13:28 224,802 --a--c--- C:\WINDOWS\system32\dllcache\OLDE8A.tmp
2008-07-16 18:04 . 2001-08-17 13:28 113,762 --a--c--- C:\WINDOWS\system32\dllcache\OLDE92.tmp
2008-07-16 18:04 . 2004-08-03 23:10 78,464 --a--c--- C:\WINDOWS\system32\dllcache\OLDE7A.tmp
2008-07-16 18:04 . 2004-08-03 23:08 25,600 --a--c--- C:\WINDOWS\system32\dllcache\OLDE76.tmp
2008-07-16 18:04 . 2001-08-17 13:28 7,556 --a--c--- C:\WINDOWS\system32\dllcache\OLDE8E.tmp
2008-07-16 18:02 . 2001-08-17 22:36 216,064 --a--c--- C:\WINDOWS\system32\dllcache\OLDE42.tmp
2008-07-16 18:02 . 2001-08-17 22:36 211,968 --a--c--- C:\WINDOWS\system32\dllcache\OLDE46.tmp
2008-07-16 18:02 . 2001-08-17 12:51 166,784 --a--c--- C:\WINDOWS\system32\dllcache\OLDE33.tmp
2008-07-16 18:02 . 2001-08-17 22:36 47,616 --a--c--- C:\WINDOWS\system32\dllcache\OLDE4A.tmp
2008-07-16 18:02 . 2001-08-17 13:52 36,736 --a--c--- C:\WINDOWS\system32\dllcache\OLDE3E.tmp
2008-07-16 18:02 . 2004-08-04 13:00 14,336 --a--c--- C:\WINDOWS\system32\dllcache\OLDE36.tmp
2008-07-16 18:02 . 2001-08-17 13:48 11,520 --a--c--- C:\WINDOWS\system32\dllcache\OLDE3A.tmp
2008-07-16 18:01 . 2001-08-17 22:36 525,568 --a--c--- C:\WINDOWS\system32\dllcache\OLDE2F.tmp
2008-07-16 18:01 . 2001-08-17 14:56 440,576 --a--c--- C:\WINDOWS\system32\dllcache\OLDE27.tmp
2008-07-16 18:01 . 2001-08-17 14:56 315,520 --a--c--- C:\WINDOWS\system32\dllcache\OLDE1F.tmp
2008-07-16 18:01 . 2001-08-17 12:51 222,336 --a--c--- C:\WINDOWS\system32\dllcache\OLDE23.tmp
2008-07-16 18:01 . 2001-08-17 12:51 159,232 --a--c--- C:\WINDOWS\system32\dllcache\OLDE2B.tmp
2008-07-16 18:01 . 2001-08-17 22:35 42,496 --a--c--- C:\WINDOWS\system32\dllcache\OLDE17.tmp
2008-07-16 18:01 . 2001-08-17 12:12 34,375 --a--c--- C:\WINDOWS\system32\dllcache\OLDE1B.tmp
2008-07-16 17:59 . 2001-08-17 14:56 172,768 --a--c--- C:\WINDOWS\system32\dllcache\OLDDC3.tmp
2008-07-16 17:59 . 2004-08-03 23:00 149,376 --a--c--- C:\WINDOWS\system32\dllcache\tffsport.sys
2008-07-16 17:59 . 2001-08-17 14:56 81,408 --a--c--- C:\WINDOWS\system32\dllcache\OLDDE6.tmp
2008-07-16 17:59 . 2001-08-17 12:13 37,961 --a--c--- C:\WINDOWS\system32\dllcache\OLDDD9.tmp
2008-07-16 17:59 . 2001-08-17 12:50 36,640 --a--c--- C:\WINDOWS\system32\dllcache\OLDDC7.tmp
2008-07-16 17:59 . 2001-08-17 13:49 30,464 --a--c--- C:\WINDOWS\system32\dllcache\OLDDCF.tmp
2008-07-16 17:59 . 2004-08-04 13:00 21,896 --a--c--- C:\WINDOWS\system32\dllcache\OLDDD5.tmp
2008-07-16 17:59 . 2004-08-04 13:00 19,464 --a--c--- C:\WINDOWS\system32\dllcache\OLDDE0.tmp
2008-07-16 17:59 . 2001-08-17 12:13 17,129 --a--c--- C:\WINDOWS\system32\dllcache\OLDDDD.tmp
2008-07-16 17:59 . 2004-08-04 13:00 13,192 --a--c--- C:\WINDOWS\system32\dllcache\OLDDD2.tmp
2008-07-16 17:59 . 2001-08-17 13:52 7,040 --a--c--- C:\WINDOWS\system32\dllcache\OLDDCB.tmp
2008-07-16 17:58 . 2001-08-17 13:50 103,936 --a--c--- C:\WINDOWS\system32\dllcache\OLDDAB.tmp
2008-07-16 17:58 . 2001-08-17 22:36 94,293 --a--c--- C:\WINDOWS\system32\dllcache\OLDDAF.tmp
2008-07-16 17:58 . 2001-08-17 14:07 32,640 --a--c--- C:\WINDOWS\system32\dllcache\OLDDBF.tmp
2008-07-16 17:58 . 2001-08-17 14:07 30,688 --a--c--- C:\WINDOWS\system32\dllcache\OLDDB7.tmp
2008-07-16 17:58 . 2001-08-17 14:07 28,384 --a--c--- C:\WINDOWS\system32\dllcache\OLDDB3.tmp
2008-07-16 17:58 . 2001-08-17 14:07 16,256 --a--c--- C:\WINDOWS\system32\dllcache\OLDDBB.tmp
2008-07-16 17:58 . 2001-08-17 14:02 3,968 --a--c--- C:\WINDOWS\system32\dllcache\OLDDA7.tmp
2008-07-16 17:57 . 2001-08-17 12:18 285,760 --a--c--- C:\WINDOWS\system32\dllcache\OLDD8B.tmp
2008-07-16 17:57 . 2001-08-17 22:36 155,648 --a--c--- C:\WINDOWS\system32\dllcache\OLDD93.tmp
2008-07-16 17:57 . 2001-08-17 22:36 53,760 --a--c--- C:\WINDOWS\system32\dllcache\OLDD9B.tmp
2008-07-16 17:57 . 2001-08-17 22:36 53,248 --a--c--- C:\WINDOWS\system32\dllcache\OLDD8F.tmp
2008-07-16 17:57 . 2001-08-17 22:36 41,472 --a--c--- C:\WINDOWS\system32\dllcache\OLDD97.tmp
2008-07-16 17:57 . 2001-08-17 13:51 16,896 --a--c--- C:\WINDOWS\system32\dllcache\OLDD87.tmp
2008-07-16 17:57 . 2001-08-17 22:36 10,240 --a--c--- C:\WINDOWS\system32\dllcache\OLDDA3.tmp
2008-07-16 17:57 . 2001-08-17 22:36 10,240 --a--c--- C:\WINDOWS\system32\dllcache\OLDD9F.tmp
2008-07-16 17:56 . 2001-08-17 22:36 106,584 --a--c--- C:\WINDOWS\system32\dllcache\OLDD70.tmp
2008-07-16 17:56 . 2004-08-04 13:00 101,376 --a--c--- C:\WINDOWS\system32\dllcache\OLDD7B.tmp
2008-07-16 17:56 . 2001-08-17 22:36 99,328 --a--c--- C:\WINDOWS\system32\dllcache\OLDD7F.tmp
2008-07-16 17:56 . 2001-08-17 13:51 61,824 --a--c--- C:\WINDOWS\system32\dllcache\OLDD74.tmp
2008-07-16 17:56 . 2001-08-17 12:11 48,736 --a--c--- C:\WINDOWS\system32\dllcache\OLDD83.tmp
2008-07-16 17:56 . 2001-08-17 22:36 24,660 --a--c--- C:\WINDOWS\system32\dllcache\OLDD78.tmp
2008-07-16 17:56 . 2001-08-17 14:07 19,072 --a--c--- C:\WINDOWS\system32\dllcache\OLDD6C.tmp
2008-07-16 17:56 . 2001-08-17 13:56 7,552 --a--c--- C:\WINDOWS\system32\dllcache\OLDD68.tmp
2008-07-16 17:54 . 2004-08-04 13:00 236,544 --a--c--- C:\WINDOWS\system32\dllcache\OLDD15.tmp
2008-07-16 17:53 . 2004-08-03 22:41 404,990 --a--c--- C:\WINDOWS\system32\dllcache\slntamr.sys
2008-07-16 17:52 . 2001-08-17 14:56 252,032 --a--c--- C:\WINDOWS\system32\dllcache\OLDC7F.tmp
2008-07-16 17:52 . 2001-08-17 22:36 238,592 --a--c--- C:\WINDOWS\system32\dllcache\OLDC93.tmp
2008-07-16 17:52 . 2001-07-21 14:29 161,568 --a--c--- C:\WINDOWS\system32\dllcache\OLDC70.tmp
2008-07-16 17:52 . 2001-08-17 14:56 150,144 --a--c--- C:\WINDOWS\system32\dllcache\OLDC87.tmp
2008-07-16 17:52 . 2001-08-17 12:50 104,064 --a--c--- C:\WINDOWS\system32\dllcache\OLDC8F.tmp
2008-07-16 17:52 . 2001-08-17 12:50 101,760 --a--c--- C:\WINDOWS\system32\dllcache\OLDC7B.tmp
2008-07-16 17:52 . 2001-08-17 12:50 68,608 --a--c--- C:\WINDOWS\system32\dllcache\OLDC83.tmp
2008-07-16 17:52 . 2004-08-03 23:07 41,088 --a--c--- C:\WINDOWS\system32\dllcache\sisagp.sys
2008-07-16 17:52 . 2004-08-03 22:31 32,768 --a--c--- C:\WINDOWS\system32\dllcache\sisnic.sys
2008-07-16 17:52 . 2004-08-04 13:00 18,944 --a--c--- C:\WINDOWS\system32\dllcache\OLDC77.tmp
2008-07-16 17:52 . 2004-08-04 00:56 3,901 --a--c--- C:\WINDOWS\system32\dllcache\OLDC74.tmp
2008-07-16 17:51 . 2001-08-17 22:36 386,560 --a--c--- C:\WINDOWS\system32\dllcache\OLDC5E.tmp
2008-07-16 17:51 . 2001-08-17 12:51 98,080 --a--c--- C:\WINDOWS\system32\dllcache\OLDC62.tmp
2008-07-16 17:51 . 2001-08-17 12:19 36,480 --a--c--- C:\WINDOWS\system32\dllcache\OLDC5A.tmp
2008-07-16 17:51 . 2001-08-17 22:36 26,112 --a--c--- C:\WINDOWS\system32\dllcache\OLDC4F.tmp
2008-07-16 17:51 . 2001-07-21 14:29 18,400 --a--c--- C:\WINDOWS\system32\dllcache\OLDC66.tmp
2008-07-16 17:51 . 2001-08-17 13:48 17,664 --a--c--- C:\WINDOWS\system32\dllcache\OLDC53.tmp
2008-07-16 17:51 . 2001-08-17 13:53 6,912 --a--c--- C:\WINDOWS\system32\dllcache\OLDC4B.tmp
2008-07-16 17:50 . 2001-08-17 22:36 495,616 --a--c--- C:\WINDOWS\system32\dllcache\OLDC29.tmp
2008-07-16 17:50 . 2001-08-17 22:36 57,856 --a--c--- C:\WINDOWS\system32\dllcache\OLDC3F.tmp
2008-07-16 17:50 . 2004-08-03 22:59 43,136 --a--c--- C:\WINDOWS\system32\dllcache\sbp2port.sys
2008-07-16 17:50 . 2001-08-17 13:51 23,936 --a--c--- C:\WINDOWS\system32\dllcache\OLDC33.tmp
2008-07-16 17:50 . 2001-08-17 13:51 23,936 --a--c--- C:\WINDOWS\system32\dllcache\OLDC2F.tmp
2008-07-16 17:50 . 2001-08-17 13:51 17,280 --a--c--- C:\WINDOWS\system32\dllcache\OLDC3B.tmp
2008-07-16 17:50 . 2001-08-17 13:51 16,640 --a--c--- C:\WINDOWS\system32\dllcache\OLDC37.tmp
2008-07-16 17:50 . 2001-08-17 13:52 11,648 --a--c--- C:\WINDOWS\system32\dllcache\OLDC43.tmp
2008-07-16 17:50 . 2001-08-17 13:53 10,880 --a--c--- C:\WINDOWS\system32\dllcache\OLDC47.tmp
2008-07-16 17:49 . 2001-08-17 14:56 245,632 --a--c--- C:\WINDOWS\system32\dllcache\OLDC21.tmp
2008-07-16 17:49 . 2001-08-17 14:56 210,496 --a--c--- C:\WINDOWS\system32\dllcache\OLDC0D.tmp
2008-07-16 17:49 . 2001-08-17 14:56 198,400 --a--c--- C:\WINDOWS\system32\dllcache\OLDC19.tmp
2008-07-16 17:49 . 2001-08-17 14:56 179,264 --a--c--- C:\WINDOWS\system32\dllcache\OLDC11.tmp
2008-07-16 17:49 . 2001-08-17 12:50 77,824 --a--c--- C:\WINDOWS\system32\dllcache\OLDC1D.tmp
2008-07-16 17:49 . 2001-08-17 12:50 75,392 --a--c--- C:\WINDOWS\system32\dllcache\OLDC25.tmp
2008-07-16 17:49 . 2001-08-17 22:36 62,496 --a--c--- C:\WINDOWS\system32\dllcache\OLDC09.tmp
2008-07-16 17:49 . 2001-08-17 12:50 61,504 --a--c--- C:\WINDOWS\system32\dllcache\OLDC15.tmp
2008-07-16 17:49 . 2001-08-17 12:50 41,216 --a--c--- C:\WINDOWS\system32\dllcache\OLDC05.tmp
2008-07-16 17:47 . 2001-08-17 22:36 86,097 --a--c--- C:\WINDOWS\system32\dllcache\OLDBB6.tmp
2008-07-16 17:46 . 2001-08-17 13:28 899,146 --a--c--- C:\WINDOWS\system32\dllcache\OLDB98.tmp
2008-07-16 17:45 . 2004-08-04 00:56 159,232 --a--c--- C:\WINDOWS\system32\dllcache\ptpusd.dll
2008-07-16 17:45 . 2001-08-17 13:28 130,942 --a--c--- C:\WINDOWS\system32\dllcache\OLDB6D.tmp
2008-07-16 17:45 . 2001-08-17 13:28 128,286 --a--c--- C:\WINDOWS\system32\dllcache\OLDB65.tmp
2008-07-16 17:45 . 2001-08-17 13:28 112,574 --a--c--- C:\WINDOWS\system32\dllcache\OLDB69.tmp
2008-07-16 17:45 . 2001-08-17 13:52 45,312 --a--c--- C:\WINDOWS\system32\dllcache\OLDB7B.tmp
2008-07-16 17:45 . 2001-08-17 13:52 40,320 --a--c--- C:\WINDOWS\system32\dllcache\OLDB73.tmp

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
.
2008-07-16 15:30 --------- d-----w C:\Program Files\Google
2008-07-16 10:27 --------- d-----w C:\Documents and Settings\All Users\Application Data\avg8
2008-07-15 20:00 2,428 ----a-w C:\Documents and Settings\Tegwen H\Application Data\wklnhst.dat
2008-06-28 14:38 --------- d-----w C:\Documents and Settings\Tegwen H\Application Data\AdobeUM
2008-06-24 08:01 90,112 ----a-w C:\WINDOWS\DUMP5ca6.tmp
2008-06-15 15:12 --------- d-----w C:\Documents and Settings\Tegwen H\Application Data\Skype
2008-06-13 13:10 272,128 ------w C:\WINDOWS\system32\drivers\bthport.sys
2008-06-11 17:02 --------- d-----w C:\Documents and Settings\Tegwen H\Application Data\skypePM
2008-06-10 16:16 90,112 ----a-w C:\WINDOWS\DUMP65de.tmp
2008-05-07 05:18 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
2008-04-21 06:56 666,624 ----a-w C:\WINDOWS\system32\wininet.dll
2007-12-25 21:08 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-12-12 16:20 21686568]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 13:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-04-07 09:48 761946]
"DMXLauncher"="C:\Program Files\Roxio\CinePlayer\DMXLauncher.exe" [2006-11-06 02:07 102400]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\I SUSPM.exe" [2006-08-25 12:11 221184]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2006-08-25 12:11 81920]
"Easy-PrintToolBox"="C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE" [2004-01-14 02:10 409600]
"VX1000"="C:\WINDOWS\vVX1000.exe" [2006-06-30 00:42 707376]
"LifeCam"="C:\Program Files\Microsoft LifeCam\LifeExp.exe" [2006-06-30 00:54 269104]
"HP Software Update"="c:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2004-09-13 16:49 49152]
"VTTimer"="VTTimer.exe" [2006-09-21 09:36 53248 C:\WINDOWS\system32\VTTimer.exe]
"S3Trayp"="S3trayp.exe" [2006-10-09 22:14 176128 C:\WINDOWS\system32\S3Trayp.exe]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-07 18:07 61952 C:\WINDOWS\system32\HdAShCut.exe]
"RTHDCPL"="RTHDCPL.EXE" [2006-11-14 10:21 16270848 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 11:04 2879488 C:\WINDOWS\SkyTel.exe]
"Protect"="SHVRTF.EXE" [2005-02-04 11:58 1011712 C:\WINDOWS\system32\SHVRTF.EXE]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-04 20:28:24 258048]
HP Image Zone Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-04 20:50:52 53248]

[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=
"C:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

R2 MSCamSvc;MSCamSvc;C:\Program Files\Microsoft LifeCam\MSCamSvc.exe [2006-06-30 00:54]
R3 S3GIGP;S3GIGP;C:\WINDOWS\system32\DRIVERS\S3gIGPm. sys [2006-11-15 02:38]
S3 MEMSWEEP2;MEMSWEEP2;C:\WINDOWS\system32\2.tmp []
S3 SIS163u;SiS163 USB Wireless LAN Adapter Driver;C:\WINDOWS\system32\DRIVERS\sis163u.sys [2006-05-29 19:04]
S3 VX1000;VX-1000;C:\WINDOWS\system32\DRIVERS\VX1000.sys [2006-06-30 00:42]

[HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{88f2e43e-2ccb-11dc-a387-001060a1af25}]
\Shell\AutoRun\command - G:\ek.com
\Shell\explore\Command - G:\ek.com
\Shell\open\Command - G:\ek.com

[HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{c86bef4c-d244-11db-a072-806d6172696f}]
\Shell\AutoRun\command - D:\PcAngel.exe

*Newly Created Service* - PROCEXP90
.
Contents of the 'Scheduled Tasks' folder
"2008-07-16 16:39:02 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
.
************************************************** ************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-16 18:18:21
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

************************************************** ************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\M EMSWEEP2]
"ImagePath"="\??\C:\WINDOWS\system32\2.tmp"
.
Completion time: 2008-07-16 18:19:12
ComboFix-quarantined-files.txt 2008-07-16 17:19:06

Pre-Run: 104,169,611,264 bytes free
Post-Run: 104,217,157,632 bytes free

217 --- E O F --- 2008-07-15 20:04:19


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:25:18, on 16/07/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Microsoft LifeCam\MSCamSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\S3trayp.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Roxio\CinePlayer\DMXLauncher.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\explorer.exe
E:\8 may\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [S3Trayp] S3trayp.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [DMXLauncher] "C:\Program Files\Roxio\CinePlayer\DMXLauncher.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [Protect] SHVRTF.EXE
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [VX1000] C:\WINDOWS\vVX1000.exe
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [HP Software Update] "c:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.evesham.com/
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/de...e/HPDEXAXO.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe

--
End of file - 5985 bytes

Attached Files

	combolog.txt (17.1 KB, 2 views)
	hijackthis.log (5.8 KB, 3 views)

Please download the OTMoveIt2 by OldTimer. http://download.bleepingcomputer.com.../OTMoveIt2.exe

Save it to your desktop.
Please double-click OTMoveIt2.exe to run it.
Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):


C:\WINDOWS\system32\2.tmp
C:\WINDOWS\DUMP5ca6.tmp
C:\WINDOWS\DUMP65de.tmp

Return to OTMoveIt2, right click on the "Paste List of Files/Folders to be moved" window and choose Paste.
Click the red Moveit! button.
OTMoveit2 will create a log of moved files in the C:\_OTMoveIt\MovedFiles folder. The log's name will appear as the date and time it was created, with the format mmddyyyy_hhmmss.log. Open this log in Notepad and post its contents in your next reply.
Close OTMoveIt2
If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

=====================================


Clear out you temp files in the dllcache.

Go to RUN copy and paste this sfc /purgecache .A DOS box will appear and stay untill the cache is clean.It will close.

You can change the size of the cache folder if you wish. Type sfc /cachesize=x (where x equals the maximum size, in megabytes, you’d like the dllcache to be. For example, I used cachesize=150)

When done reboot and do another scan with Combofix and post the log.

Move it and Combofix logs attached.

BTW did an XP repair before reading your post

thanks

ComboFix 08-07-15.4 - Tegwen H 2008-07-17 9:39:07.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.511 [GMT 1:00]
Running from: C:\Documents and Settings\Tegwen H\Desktop\ComboFix.exe
.

((((((((((((((((((((((((( Files Created from 2008-06-17 to 2008-07-17 )))))))))))))))))))))))))))))))
.

2008-07-17 09:20 . 2008-07-17 09:20 <DIR> d-------- C:\_OTMoveIt
2008-07-16 21:23 . 2008-07-17 09:17 <DIR> d-------- C:\WINDOWS\system32\drivers\Avg
2008-07-16 21:23 . 2008-07-16 21:23 96,520 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys
2008-07-16 21:23 . 2008-07-16 21:23 76,040 --a------ C:\WINDOWS\system32\drivers\avgtdix.sys
2008-07-16 21:23 . 2008-07-16 21:23 12,936 --a------ C:\WINDOWS\system32\drivers\avgrkx86.sys
2008-07-16 21:23 . 2008-07-16 21:23 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll
2008-07-16 21:13 . 2008-07-16 21:13 <DIR> d-------- C:\Program Files\COMODO
2008-07-16 21:13 . 2008-07-16 21:13 <DIR> d-------- C:\Documents and Settings\Tegwen H\Application Data\Comodo
2008-07-16 21:13 . 2008-07-16 21:16 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\comodo
2008-07-16 21:13 . 2008-07-16 21:13 143,104 --a------ C:\WINDOWS\system32\guard32.dll
2008-07-16 21:13 . 2008-07-16 21:13 87,056 --a------ C:\WINDOWS\system32\drivers\cmdguard.sys
2008-07-16 21:13 . 2008-07-16 21:13 24,208 --a------ C:\WINDOWS\system32\drivers\cmdhlp.sys
2008-07-16 21:03 . 2008-07-16 21:03 12,598 --a------ C:\WINDOWS\system32\wpa.bak
2008-07-16 20:37 . 2004-08-04 13:00 1,086,058 -ra------ C:\WINDOWS\SET4A.tmp
2008-07-16 20:37 . 2004-08-04 13:00 1,042,903 -ra------ C:\WINDOWS\SET47.tmp
2008-07-16 20:37 . 2004-08-04 13:00 13,753 -ra------ C:\WINDOWS\SET56.tmp
2008-07-16 20:19 . 2008-04-14 05:42 4,274,816 --a------ C:\WINDOWS\system32\OLD4C5.tmp
2008-07-16 20:19 . 2008-04-14 05:42 1,737,856 --a------ C:\WINDOWS\system32\OLD4B9.tmp
2008-07-16 20:19 . 2004-08-04 13:00 252,928 --a------ C:\WINDOWS\system32\OLD4B2.tmp
2008-07-16 20:19 . 2008-04-14 05:42 91,136 --a------ C:\WINDOWS\system32\OLD4A3.tmp
2008-07-16 20:19 . 2008-04-14 00:16 85,248 --a------ C:\WINDOWS\system32\drivers\OLD4C0.tmp
2008-07-16 20:19 . 2008-04-14 05:42 61,952 --a------ C:\WINDOWS\system32\OLD4A0.tmp
2008-07-16 20:19 . 2008-04-14 05:42 43,008 --a------ C:\WINDOWS\system32\OLD4A6.tmp
2008-07-16 20:19 . 2008-04-14 00:13 12,672 --a------ C:\WINDOWS\system32\drivers\OLD4BD.tmp
2008-07-16 20:19 . 2008-04-14 00:09 5,504 --a------ C:\WINDOWS\system32\drivers\OLD4B5.tmp
2008-07-16 20:18 . 2008-04-14 00:06 46,464 --a------ C:\WINDOWS\system32\drivers\OLD44D.tmp
2008-07-16 20:18 . 2008-04-14 05:41 32,285 --a------ C:\WINDOWS\system32\OLD456.tmp
2008-07-16 20:18 . 2008-04-14 00:15 19,200 --a------ C:\WINDOWS\system32\drivers\OLD452.tmp
2008-07-16 20:16 . 2008-04-14 05:41 4,255 --a------ C:\WINDOWS\system32\drivers\OLD378.tmp
2008-07-16 20:16 . 2008-04-14 05:41 3,967 --a------ C:\WINDOWS\system32\drivers\OLD37B.tmp
2008-07-16 20:14 . 2008-07-16 20:48 749 -rah----- C:\WINDOWS\WindowsShell.Manifest
2008-07-16 20:14 . 2008-07-16 20:48 749 -rah----- C:\WINDOWS\system32\wuaucpl.cpl.manifest
2008-07-16 20:14 . 2008-07-16 20:48 749 -rah----- C:\WINDOWS\system32\sapi.cpl.manifest
2008-07-16 20:14 . 2008-07-16 20:48 749 -rah----- C:\WINDOWS\system32\ncpa.cpl.manifest
2008-07-16 20:14 . 2008-07-16 20:48 488 -rah----- C:\WINDOWS\system32\logonui.exe.manifest
2008-07-16 19:57 . 2004-08-04 13:00 24,661 --a------ C:\WINDOWS\system32\spxcoins.dll
2008-07-16 19:57 . 2004-08-04 13:00 13,753 -ra------ C:\WINDOWS\SET6F.tmp
2008-07-16 19:57 . 2004-08-04 13:00 13,312 --a------ C:\WINDOWS\system32\irclass.dll
2008-07-16 19:56 . 2004-08-04 13:00 1,086,058 -ra------ C:\WINDOWS\SET63.tmp
2008-07-16 19:56 . 2004-08-04 13:00 1,042,903 -ra------ C:\WINDOWS\SET60.tmp
2008-07-16 19:09 . 2008-04-14 05:42 1,306,624 --a------ C:\WINDOWS\system32\msxml6.dll
2008-07-16 19:09 . 2008-04-13 22:57 79,872 --a------ C:\WINDOWS\system32\msxml6r.dll
2008-07-16 19:06 . 2008-07-16 19:09 <DIR> d-------- C:\WINDOWS\ServicePackFiles
2008-07-16 19:01 . 2006-12-29 00:31 19,569 --a------ C:\WINDOWS\002986_.tmp
2008-07-16 18:57 . 2008-07-16 18:57 <DIR> d-------- C:\WINDOWS\EHome
2008-07-16 16:50 . 2008-07-16 16:50 <DIR> d-------- C:\Program Files\Belarc
2008-07-16 16:50 . 2005-04-07 16:18 3,840 --a------ C:\WINDOWS\system32\drivers\BANTExt.sys
2008-07-16 15:58 . 2008-07-16 19:20 51,228 --a------ C:\WINDOWS\setupapi.old
2008-07-16 15:45 . 2008-07-16 15:45 0 --a------ C:\WINDOWS\nsreg.dat
2008-07-16 14:48 . 2008-07-16 14:48 2,768 --a------ C:\WINDOWS\system32\tmp.reg
2008-07-16 14:39 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-07-16 14:39 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-07-16 14:39 . 2008-05-27 13:54 86,528 --a------ C:\WINDOWS\system32\VACFix.exe
2008-07-16 14:39 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-07-16 14:39 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\404Fix.exe
2008-07-16 14:39 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-07-16 14:39 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-07-16 14:39 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-07-16 14:26 . 2008-07-16 14:26 <DIR> d-------- C:\WINDOWS\ERUNT
2008-07-16 14:22 . 2008-07-16 14:38 <DIR> d-------- C:\SDFix
2008-07-16 11:05 . 2008-07-16 11:05 <DIR> d-------- C:\Program Files\AVG
2008-07-15 20:46 . 2008-07-15 20:46 <DIR> d-------- C:\Program Files\Sophos

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
.
2008-07-16 20:51 2,428 ----a-w C:\Documents and Settings\Tegwen H\Application Data\wklnhst.dat
2008-07-16 20:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\avg8
2008-07-16 19:47 1,663 ----a-w C:\WINDOWS\inf\COMC9.tmp
2008-07-16 17:48 --------- d-----w C:\Program Files\Windows Live Toolbar
2008-07-16 15:30 --------- d-----w C:\Program Files\Google
2008-06-28 14:38 --------- d-----w C:\Documents and Settings\Tegwen H\Application Data\AdobeUM
2008-06-15 15:12 --------- d-----w C:\Documents and Settings\Tegwen H\Application Data\Skype
2008-06-11 17:02 --------- d-----w C:\Documents and Settings\Tegwen H\Application Data\skypePM
2007-12-25 21:08 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-12-12 16:20 21686568]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 13:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-04-07 09:48 761946]
"DMXLauncher"="C:\Program Files\Roxio\CinePlayer\DMXLauncher.exe" [2006-11-06 02:07 102400]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\I SUSPM.exe" [2006-08-25 12:11 221184]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2006-08-25 12:11 81920]
"Easy-PrintToolBox"="C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE" [2004-01-14 02:10 409600]
"VX1000"="C:\WINDOWS\vVX1000.exe" [2006-06-30 00:42 707376]
"LifeCam"="C:\Program Files\Microsoft LifeCam\LifeExp.exe" [2006-06-30 00:54 269104]
"HP Software Update"="c:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2004-09-13 16:49 49152]
"COMODO Firewall Pro"="C:\Program Files\COMODO\Firewall\cfp.exe" [2008-07-16 21:13 1655552]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-07-16 21:23 1232152]
"VTTimer"="VTTimer.exe" [2006-09-21 09:36 53248 C:\WINDOWS\system32\VTTimer.exe]
"S3Trayp"="S3trayp.exe" [2006-10-09 22:14 176128 C:\WINDOWS\system32\S3Trayp.exe]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-07 18:07 61952 C:\WINDOWS\system32\HdAShCut.exe]
"RTHDCPL"="RTHDCPL.EXE" [2006-11-14 10:21 16270848 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 11:04 2879488 C:\WINDOWS\SkyTel.exe]
"Protect"="SHVRTF.EXE" [2005-02-04 11:58 1011712 C:\WINDOWS\system32\SHVRTF.EXE]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-04 20:28:24 258048]
HP Image Zone Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-04 20:50:52 53248]

[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=
"C:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=

R0 AvgRkx86;avgrkx86.sys;C:\WINDOWS\system32\Drivers\ avgrkx86.sys [2008-07-16 21:23]
R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-07-16 21:23]
R1 cmdGuard;COMODO Firewall Pro Sandbox Driver;C:\WINDOWS\system32\DRIVERS\cmdguard.sys [2008-07-16 21:13]
R1 cmdHlp;COMODO Firewall Pro Helper Driver;C:\WINDOWS\system32\DRIVERS\cmdhlp.sys [2008-07-16 21:13]
R2 avg8emc;AVG8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-07-16 21:23]
R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-07-16 21:23]
R2 AvgTdiX;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-07-16 21:23]
R2 MSCamSvc;MSCamSvc;C:\Program Files\Microsoft LifeCam\MSCamSvc.exe [2006-06-30 00:54]
R3 S3GIGP;S3GIGP;C:\WINDOWS\system32\DRIVERS\S3gIGPm. sys [2006-11-15 02:38]
S3 MEMSWEEP2;MEMSWEEP2;C:\WINDOWS\system32\9.tmp []
S3 SIS163u;SiS163 USB Wireless LAN Adapter Driver;C:\WINDOWS\system32\DRIVERS\sis163u.sys [2006-05-29 19:04]
S3 VX1000;VX-1000;C:\WINDOWS\system32\DRIVERS\VX1000.sys [2006-06-30 00:42]

[HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\F]
\Shell\AutoRun\command - Info.exe folder.htt 480 480

[HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{88f2e43e-2ccb-11dc-a387-001060a1af25}]
\Shell\AutoRun\command - G:\ek.com
\Shell\explore\Command - G:\ek.com
\Shell\open\Command - G:\ek.com

[HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{c86bef4c-d244-11db-a072-806d6172696f}]
\Shell\AutoRun\command - D:\PcAngel.exe
.
Contents of the 'Scheduled Tasks' folder
"2008-07-16 22:09:00 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
.
************************************************** ************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-17 09:41:41
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

************************************************** ************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\M EMSWEEP2]
"ImagePath"="\??\C:\WINDOWS\system32\9.tmp"
.
Completion time: 2008-07-17 9:42:48
ComboFix-quarantined-files.txt 2008-07-17 08:42:42
ComboFix2.txt 2008-07-17 08:31:23
ComboFix3.txt 2008-07-16 17:19:13

Pre-Run: 107,076,935,680 bytes free
Post-Run: 107,067,162,624 bytes free

162 --- E O F --- 2008-07-16 22:14:40


File/Folder not found.
File/Folder C:\WINDOWS\system32\2.tmp not found.
C:\WINDOWS\DUMP5ca6.tmp moved successfully.
C:\WINDOWS\DUMP65de.tmp moved successfully.

OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 07172008_092035

Attached Files

	ComboFix.txt (11.6 KB, 1 views)
	07172008_092035.log (482 Bytes, 2 views)

Please copy this page to *Notepad* and save to your desktop for reference as you will not have any browsers open while you are carrying out portions of these instructions.

It's IMPORTANT to carry out the instructions in the sequence listed below.
1. Close any open browsers.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Open *notepad* and copy/paste the text in the quotebox below into it:

Save this as CFScript.txt, in the same location as ComboFix.exe which is on the Desktop.




Refering to the picture above, drag CFScript.txt into ComboFix.exe


When finished, it shall produce a log for you at C:\ComboFix.txt

Please copy and paste the ComboFix.txt along with a fresh HijackThis log in your next reply please.


*Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall.Altering this script in any way could damage your computer*

Combo & HJT logs attached

ComboFix 08-07-15.4 - Tegwen H 2008-07-17 10:20:27.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.500 [GMT 1:00]
Running from: C:\Documents and Settings\Tegwen H\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Tegwen H\Desktop\CFScript.txt
* Created a new restore point

FILE ::
C:\WINDOWS\002986_.tmp
C:\WINDOWS\SET47.tmp
C:\WINDOWS\SET4A.tmp
C:\WINDOWS\SET56.tmp
C:\WINDOWS\SET60.tmp
C:\WINDOWS\SET63.tmp
C:\WINDOWS\SET6F.tmp
C:\WINDOWS\system32\404Fix.exe
C:\WINDOWS\system32\9.tmp
C:\WINDOWS\system32\drivers\OLD378.tmp
C:\WINDOWS\system32\drivers\OLD37B.tmp
C:\WINDOWS\system32\drivers\OLD44D.tmp
C:\WINDOWS\system32\drivers\OLD452.tmp
C:\WINDOWS\system32\drivers\OLD4B5.tmp
C:\WINDOWS\system32\drivers\OLD4BD.tmp
C:\WINDOWS\system32\drivers\OLD4C0.tmp
C:\WINDOWS\system32\IEDFix.exe
C:\WINDOWS\system32\OLD456.tmp
C:\WINDOWS\system32\OLD4A0.tmp
C:\WINDOWS\system32\OLD4A3.tmp
C:\WINDOWS\system32\OLD4A6.tmp
C:\WINDOWS\system32\OLD4B2.tmp
C:\WINDOWS\system32\OLD4B9.tmp
C:\WINDOWS\system32\OLD4C5.tmp
C:\WINDOWS\system32\tmp.reg
C:\WINDOWS\system32\VACFix.exe
C:\WINDOWS\system32\WS2Fix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\002986_.tmp
C:\WINDOWS\SET47.tmp
C:\WINDOWS\SET4A.tmp
C:\WINDOWS\SET56.tmp
C:\WINDOWS\SET60.tmp
C:\WINDOWS\SET63.tmp
C:\WINDOWS\SET6F.tmp
C:\WINDOWS\system32\404Fix.exe
C:\WINDOWS\system32\drivers\OLD378.tmp
C:\WINDOWS\system32\drivers\OLD37B.tmp
C:\WINDOWS\system32\drivers\OLD44D.tmp
C:\WINDOWS\system32\drivers\OLD452.tmp
C:\WINDOWS\system32\drivers\OLD4B5.tmp
C:\WINDOWS\system32\drivers\OLD4BD.tmp
C:\WINDOWS\system32\drivers\OLD4C0.tmp
C:\WINDOWS\system32\IEDFix.exe
C:\WINDOWS\system32\OLD456.tmp
C:\WINDOWS\system32\OLD4A0.tmp
C:\WINDOWS\system32\OLD4A3.tmp
C:\WINDOWS\system32\OLD4A6.tmp
C:\WINDOWS\system32\OLD4B2.tmp
C:\WINDOWS\system32\OLD4B9.tmp
C:\WINDOWS\system32\OLD4C5.tmp
C:\WINDOWS\system32\tmp.reg
C:\WINDOWS\system32\VACFix.exe
C:\WINDOWS\system32\WS2Fix.exe

.
((((((((((((((((((((((((( Files Created from 2008-06-17 to 2008-07-17 )))))))))))))))))))))))))))))))
.

2008-07-16 21:23 . 2008-07-17 09:17 <DIR> d-------- C:\WINDOWS\system32\drivers\Avg
2008-07-16 21:23 . 2008-07-16 21:23 96,520 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys
2008-07-16 21:23 . 2008-07-16 21:23 76,040 --a------ C:\WINDOWS\system32\drivers\avgtdix.sys
2008-07-16 21:23 . 2008-07-16 21:23 12,936 --a------ C:\WINDOWS\system32\drivers\avgrkx86.sys
2008-07-16 21:23 . 2008-07-16 21:23 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll
2008-07-16 21:13 . 2008-07-16 21:13 <DIR> d-------- C:\Program Files\COMODO
2008-07-16 21:13 . 2008-07-16 21:13 <DIR> d-------- C:\Documents and Settings\Tegwen H\Application Data\Comodo
2008-07-16 21:13 . 2008-07-16 21:16 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\comodo
2008-07-16 21:13 . 2008-07-16 21:13 143,104 --a------ C:\WINDOWS\system32\guard32.dll
2008-07-16 21:13 . 2008-07-16 21:13 87,056 --a------ C:\WINDOWS\system32\drivers\cmdguard.sys
2008-07-16 21:13 . 2008-07-16 21:13 24,208 --a------ C:\WINDOWS\system32\drivers\cmdhlp.sys
2008-07-16 21:03 . 2008-07-16 21:03 12,598 --a------ C:\WINDOWS\system32\wpa.bak
2008-07-16 20:17 . 2008-04-14 05:41 1,888,992 --a------ C:\WINDOWS\system32\OLD3AE.tmp
2008-07-16 20:14 . 2008-07-16 20:48 749 -rah----- C:\WINDOWS\WindowsShell.Manifest
2008-07-16 20:14 . 2008-07-16 20:48 749 -rah----- C:\WINDOWS\system32\wuaucpl.cpl.manifest
2008-07-16 20:14 . 2008-07-16 20:48 749 -rah----- C:\WINDOWS\system32\sapi.cpl.manifest
2008-07-16 20:14 . 2008-07-16 20:48 749 -rah----- C:\WINDOWS\system32\ncpa.cpl.manifest
2008-07-16 20:14 . 2008-07-16 20:48 488 -rah----- C:\WINDOWS\system32\logonui.exe.manifest
2008-07-16 19:57 . 2004-08-04 13:00 24,661 --a------ C:\WINDOWS\system32\spxcoins.dll
2008-07-16 19:57 . 2004-08-04 13:00 13,312 --a------ C:\WINDOWS\system32\irclass.dll
2008-07-16 19:09 . 2008-04-14 05:42 1,306,624 --a------ C:\WINDOWS\system32\msxml6.dll
2008-07-16 19:09 . 2008-04-13 22:57 79,872 --a------ C:\WINDOWS\system32\msxml6r.dll
2008-07-16 19:06 . 2008-07-16 19:09 <DIR> d-------- C:\WINDOWS\ServicePackFiles
2008-07-16 18:57 . 2008-07-16 18:57 <DIR> d-------- C:\WINDOWS\EHome
2008-07-16 16:50 . 2008-07-16 16:50 <DIR> d-------- C:\Program Files\Belarc
2008-07-16 16:50 . 2005-04-07 16:18 3,840 --a------ C:\WINDOWS\system32\drivers\BANTExt.sys
2008-07-16 15:58 . 2008-07-16 19:20 51,228 --a------ C:\WINDOWS\setupapi.old
2008-07-16 15:45 . 2008-07-16 15:45 0 --a------ C:\WINDOWS\nsreg.dat
2008-07-16 14:39 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-07-16 14:39 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-07-16 14:39 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-07-16 14:39 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-07-16 14:26 . 2008-07-16 14:26 <DIR> d-------- C:\WINDOWS\ERUNT
2008-07-16 11:05 . 2008-07-16 11:05 <DIR> d-------- C:\Program Files\AVG
2008-07-15 20:46 . 2008-07-15 20:46 <DIR> d-------- C:\Program Files\Sophos

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
.
2008-07-16 20:51 2,428 ----a-w C:\Documents and Settings\Tegwen H\Application Data\wklnhst.dat
2008-07-16 20:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\avg8
2008-07-16 19:47 1,663 ----a-w C:\WINDOWS\inf\COMC9.tmp
2008-07-16 17:48 --------- d-----w C:\Program Files\Windows Live Toolbar
2008-07-16 15:30 --------- d-----w C:\Program Files\Google
2008-06-28 14:38 --------- d-----w C:\Documents and Settings\Tegwen H\Application Data\AdobeUM
2008-06-15 15:12 --------- d-----w C:\Documents and Settings\Tegwen H\Application Data\Skype
2008-06-11 17:02 --------- d-----w C:\Documents and Settings\Tegwen H\Application Data\skypePM
2007-12-25 21:08 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-12-12 16:20 21686568]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 13:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-04-07 09:48 761946]
"DMXLauncher"="C:\Program Files\Roxio\CinePlayer\DMXLauncher.exe" [2006-11-06 02:07 102400]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\I SUSPM.exe" [2006-08-25 12:11 221184]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2006-08-25 12:11 81920]
"Easy-PrintToolBox"="C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE" [2004-01-14 02:10 409600]
"VX1000"="C:\WINDOWS\vVX1000.exe" [2006-06-30 00:42 707376]
"LifeCam"="C:\Program Files\Microsoft LifeCam\LifeExp.exe" [2006-06-30 00:54 269104]
"HP Software Update"="c:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2004-09-13 16:49 49152]
"COMODO Firewall Pro"="C:\Program Files\COMODO\Firewall\cfp.exe" [2008-07-16 21:13 1655552]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-07-16 21:23 1232152]
"VTTimer"="VTTimer.exe" [2006-09-21 09:36 53248 C:\WINDOWS\system32\VTTimer.exe]
"S3Trayp"="S3trayp.exe" [2006-10-09 22:14 176128 C:\WINDOWS\system32\S3Trayp.exe]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-07 18:07 61952 C:\WINDOWS\system32\HdAShCut.exe]
"RTHDCPL"="RTHDCPL.EXE" [2006-11-14 10:21 16270848 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 11:04 2879488 C:\WINDOWS\SkyTel.exe]
"Protect"="SHVRTF.EXE" [2005-02-04 11:58 1011712 C:\WINDOWS\system32\SHVRTF.EXE]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-04 20:28:24 258048]
HP Image Zone Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-04 20:50:52 53248]

[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=
"C:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=

R0 AvgRkx86;avgrkx86.sys;C:\WINDOWS\system32\Drivers\ avgrkx86.sys [2008-07-16 21:23]
R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-07-16 21:23]
R1 cmdGuard;COMODO Firewall Pro Sandbox Driver;C:\WINDOWS\system32\DRIVERS\cmdguard.sys [2008-07-16 21:13]
R1 cmdHlp;COMODO Firewall Pro Helper Driver;C:\WINDOWS\system32\DRIVERS\cmdhlp.sys [2008-07-16 21:13]
R2 avg8emc;AVG8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-07-16 21:23]
R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-07-16 21:23]
R2 AvgTdiX;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-07-16 21:23]
R2 MSCamSvc;MSCamSvc;C:\Program Files\Microsoft LifeCam\MSCamSvc.exe [2006-06-30 00:54]
R3 S3GIGP;S3GIGP;C:\WINDOWS\system32\DRIVERS\S3gIGPm. sys [2006-11-15 02:38]
S3 MEMSWEEP2;MEMSWEEP2;C:\WINDOWS\system32\9.tmp []
S3 SIS163u;SiS163 USB Wireless LAN Adapter Driver;C:\WINDOWS\system32\DRIVERS\sis163u.sys [2006-05-29 19:04]
S3 VX1000;VX-1000;C:\WINDOWS\system32\DRIVERS\VX1000.sys [2006-06-30 00:42]

[HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\F]
\Shell\AutoRun\command - Info.exe folder.htt 480 480

[HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{88f2e43e-2ccb-11dc-a387-001060a1af25}]
\Shell\AutoRun\command - G:\ek.com
\Shell\explore\Command - G:\ek.com
\Shell\open\Command - G:\ek.com

[HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{c86bef4c-d244-11db-a072-806d6172696f}]
\Shell\AutoRun\command - D:\PcAngel.exe
.
Contents of the 'Scheduled Tasks' folder
"2008-07-17 09:09:04 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
.
************************************************** ************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-17 10:23:04
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

************************************************** ************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\M EMSWEEP2]
"ImagePath"="\??\C:\WINDOWS\system32\9.tmp"
.
Completion time: 2008-07-17 10:24:26
ComboFix-quarantined-files.txt 2008-07-17 09:24:20
ComboFix2.txt 2008-07-17 08:42:49
ComboFix3.txt 2008-07-17 08:31:23
ComboFix4.txt 2008-07-16 17:19:13

Pre-Run: 107,050,246,144 bytes free
Post-Run: 107,041,484,800 bytes free

195 --- E O F --- 2008-07-16 22:14:40


===========

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:25:38, on 17/07/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\COMODO\Firewall\cmdagent.exe
C:\Program Files\Microsoft LifeCam\MSCamSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\S3trayp.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Roxio\CinePlayer\DMXLauncher.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\COMODO\Firewall\cfp.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\explorer.exe
E:\8 may\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ww.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [S3Trayp] S3trayp.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [DMXLauncher] "C:\Program Files\Roxio\CinePlayer\DMXLauncher.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [Protect] SHVRTF.EXE
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [VX1000] C:\WINDOWS\vVX1000.exe
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [HP Software Update] "c:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra con