My hijackthis log

[smiffy2006]

alright glaswegian here is the log from combofix

smiffy - 06-10-06 23:12:30.92 Service Pack 2
ComboFix 06.09.28 - Running from: "F:\Documents and Settings\smiffy\Desktop"

((((((((((((((((((((((((((((((( Files Created from 2006-09-06 to 2006-10-06 ))))))))))))))))))))))))))))))))))


2006-10-06 17:25 8,704 --a------ F:\WINDOWS\system32\kbdjpn.dll
2006-10-06 17:25 8,192 --a------ F:\WINDOWS\system32\kbdkor.dll
2006-10-06 17:25 6,144 --a------ F:\WINDOWS\system32\kbd106.dll
2006-10-06 17:25 6,144 --a------ F:\WINDOWS\system32\kbd101c.dll
2006-10-06 17:25 6,144 --a------ F:\WINDOWS\system32\kbd101b.dll
2006-10-06 17:25 5,632 --a------ F:\WINDOWS\system32\kbd103.dll
2006-10-05 16:01 3,968 --a------ F:\WINDOWS\system32\drivers\AvgAsCln.sys
2006-10-02 23:01 76,560 --a------ F:\WINDOWS\system32\drivers\tmcomm.sys
2006-09-30 18:56 47,360 --a------ F:\WINDOWS\system32\drivers\pcouffin.sys
2006-09-26 19:24 24,816 --a------ F:\WINDOWS\system32\mdimon.dll
2006-09-25 12:06 7,168 --a------ F:\WINDOWS\lq.dll
2006-09-25 12:06 468,480 --a------ F:\WINDOWS\system32\NMDll.dll
2006-09-25 12:06 208,896 --a------ F:\WINDOWS\system32\HDBHO.dll
2006-09-25 12:06 20,480 --a------ F:\WINDOWS\yhl.dll
2006-09-24 21:25 737,280 --a------ F:\WINDOWS\iun6002.exe
2006-09-06 18:28 34,308 --a------ F:\WINDOWS\system32\BASSMOD.dll


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2006-10-06 23:10 -------- d-------- F:\Program Files\Mozilla Firefox
2006-10-06 17:51 -------- d-------- F:\Documents and Settings\smiffy\Application Data\Vso
2006-10-06 15:13 -------- d-------- F:\Program Files\HiDownload
2006-10-06 13:09 -------- d-------- F:\Program Files\Common Files\Microsoft Shared
2006-10-06 10:33 -------- d-------- F:\Program Files\SpywareBlaster
2006-10-06 09:19 -------- d-------- F:\Program Files\Hello
2006-10-05 16:01 -------- d-------- F:\Program Files\Grisoft
2006-10-04 19:15 -------- d-------- F:\Program Files\WinRAR
2006-10-04 19:11 -------- d-------- F:\Program Files\Internet Explorer
2006-10-04 18:14 -------- d-------- F:\Program Files\Full Speed
2006-10-04 18:13 -------- d--h----- F:\Program Files\InstallShield Installation Information
2006-10-04 18:12 -------- d-------- F:\Program Files\SatelliteTVforPC
2006-10-04 18:12 -------- d-------- F:\Program Files\RegistryRepair
2006-10-04 18:12 -------- d-------- F:\Program Files\RapidLeecher
2006-10-04 18:12 -------- d-------- F:\Program Files\RapidCheck
2006-10-04 18:10 -------- d-------- F:\Program Files\WM Recorder 10
2006-10-04 18:10 -------- d-------- F:\Program Files\WM Recorder
2006-10-04 16:26 -------- d-------- F:\Program Files\CleanUp!
2006-10-02 22:43 -------- d-------- F:\Program Files\Windows Defender
2006-10-02 20:51 -------- d---s---- F:\Documents and Settings\smiffy\Application Data\Microsoft
2006-09-30 18:57 34 --a------ F:\Documents and Settings\smiffy\Application Data\pcouffin.log
2006-09-30 18:56 81920 --a------ F:\Documents and Settings\smiffy\Application Data\ezpinst.exe
2006-09-30 18:56 7176 --a------ F:\Documents and Settings\smiffy\Application Data\pcouffin.cat
2006-09-30 18:56 47360 --a------ F:\Documents and Settings\smiffy\Application Data\pcouffin.sys
2006-09-30 18:56 1144 --a------ F:\Documents and Settings\smiffy\Application Data\pcouffin.inf
2006-09-30 18:56 -------- d-------- F:\Program Files\vso
2006-09-30 12:20 -------- d-------- F:\Documents and Settings\smiffy\Application Data\BitTorrent
2006-09-30 12:19 -------- d-------- F:\Program Files\Viewpoint
2006-09-30 12:19 -------- d-------- F:\Program Files\Common Files\aolshare
2006-09-30 12:19 -------- d-------- F:\Documents and Settings\smiffy\Application Data\acccore
2006-09-30 12:18 -------- d-------- F:\Program Files\Microsoft ActiveSync
2006-09-30 12:18 -------- d-------- F:\Program Files\Common Files\DESIGNER
2006-09-30 12:16 -------- d-------- F:\Program Files\WinPcap
2006-09-30 12:16 -------- d-------- F:\Program Files\FrameShots
2006-09-30 12:16 -------- d-------- F:\Program Files\Common Files\AOL
2006-09-30 12:16 -------- d-------- F:\Program Files\CoCSoft Stream Down
2006-09-30 12:15 -------- d-------- F:\Program Files\AOL
2006-09-29 19:33 -------- d-------- F:\Program Files\Common Files\Nullsoft
2006-09-29 19:33 -------- d-------- F:\Program Files\Common Files
2006-09-29 19:32 -------- d-------- F:\Documents and Settings\smiffy\Application Data\Mozilla
2006-09-26 19:20 -------- d-------- F:\Program Files\Microsoft Office
2006-09-26 19:20 -------- d-------- F:\Program Files\Common Files\System
2006-09-25 12:12 -------- d-------- F:\Program Files\Teleport Ultra
2006-09-25 12:09 -------- d-------- F:\Program Files\Magellass
2006-09-25 00:19 -------- d-------- F:\Program Files\Sytexis Software
2006-09-24 21:24 -------- d-------- F:\Program Files\WMR11
2006-09-24 21:17 -------- d-------- F:\Program Files\Download Plugin
2006-09-24 17:04 -------- d-------- F:\Program Files\BitTorrent
2006-09-06 18:55 -------- d-------- F:\Documents and Settings\smiffy\Application Data\XericDesign
2006-09-06 18:28 -------- d-------- F:\Program Files\XericDesign
2006-09-05 22:02 -------- d-------- F:\Program Files\VVSN
2006-09-01 16:30 -------- d-------- F:\Documents and Settings\smiffy\Application Data\Ahead
2006-08-31 20:29 -------- d-------- F:\Program Files\Common Files\Ahead
2006-08-31 20:26 -------- d-------- F:\Program Files\Nero
2006-08-27 14:03 -------- d-------- F:\Program Files\LimeWire
2006-08-25 19:34 -------- d-------- F:\Documents and Settings\smiffy\Application Data\EPSON
2006-08-25 19:01 -------- d-------- F:\Program Files\Common Files\InstallShield
2006-08-25 18:54 -------- d-------- F:\Program Files\EPSON Print CD
2006-08-25 18:54 -------- d-------- F:\Program Files\EPSON
2006-08-23 16:53 -------- d-------- F:\Program Files\Logitech
2006-08-23 16:53 -------- d-------- F:\Program Files\Common Files\FotoWire
2006-08-23 16:53 -------- d-------- F:\Documents and Settings\smiffy\Application Data\FotoWire
2006-08-23 16:49 81920 -r------- F:\WINDOWS\bwUnin-6.1.4.68-8876480L.exe
2006-08-23 16:48 -------- d-------- F:\Program Files\Common Files\Logitech
2006-08-21 13:21 16896 --a------ F:\WINDOWS\system32\fltlib.dll
2006-08-21 10:14 23040 --a------ F:\WINDOWS\system32\fltmc.exe
2006-08-21 10:14 128896 --------- F:\WINDOWS\system32\drivers\fltmgr.sys
2006-08-19 10:18 -------- d-------- F:\Documents and Settings\smiffy\Application Data\RapidGet
2006-08-18 19:43 -------- d-------- F:\Program Files\My-Proxy
2006-08-14 17:55 -------- d-------- F:\Program Files\AresP2P_WhenUSave_Installer
2006-08-08 18:30 -------- d-------- F:\Program Files\Analog Devices
2006-08-08 17:54 -------- d-------- F:\Documents and Settings\smiffy\Application Data\VersionTracker Pro
2006-08-08 09:57 -------- d-------- F:\Documents and Settings\smiffy\Application Data\Real
2006-08-08 09:53 -------- d-------- F:\Program Files\Real
2006-08-08 09:53 -------- d-------- F:\Program Files\Common Files\xing shared
2006-08-08 09:53 -------- d-------- F:\Program Files\Common Files\Real
2006-08-06 12:16 -------- d-------- F:\Documents and Settings\smiffy\Application Data\Help
2006-08-06 12:08 -------- d-------- F:\Program Files\Turtle Beach
2006-07-27 14:24 679424 --a------ F:\WINDOWS\system32\inetcomm.dll
2006-07-22 10:02 274432 --a------ F:\WINDOWS\system32\imon.dll
2006-07-21 09:24 72704 --a------ F:\WINDOWS\system32\hlink.dll
2006-07-20 18:52 62 --ahs---- F:\Documents and Settings\smiffy\Application Data\desktop.ini


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="\"F:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background"
"Yahoo! Pager"="\"F:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe\" -quiet"
"BitTorrent"="\"F:\\Program Files\\BitTorrent\\bittorrent.exe\" --force_start_minimized"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="RUNDLL32.EXE F:\\WINDOWS\\System32\\NvCpl.dll,NvStartup"
"kis"="\"F:\\Program Files\\Kaspersky Lab\\Kaspersky Internet Security 6.0\\avp.exe\""
"TkBellExe"="\"F:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"SoundMAXPnP"="F:\\Program Files\\Analog Devices\\Core\\smax4pnp.exe"
"LVCOMSX"="F:\\WINDOWS\\system32\\LVCOMSX.EXE"
"!AVG Anti-Spyware"="\"F:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,e6,00,00,00,00,00,00,00,9a,03,00,00,3e,03,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\
00,00,01,00,00,00

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="F:\\WINDOWS\\System32\\CTFMON.EXE"

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="F:\\WINDOWS\\System32\\CTFMON.EXE"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
"WPDShServiceObj"="{AAA288BA-9A4C-45B0-95D7-94D524869DB5}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder\F:^Documents and Settings^All Users^Start Menu^Programs^Startup^Broadband Desktop Help.lnk]
"path"="F:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\Broadband Desktop Help.lnk"
"backup"="F:\\WINDOWS\\pss\\Broadband Desktop Help.lnkCommon Startup"
"location"="Common Startup"
"command"="F:\\PROGRA~1\\BTBROA~1\\Help\\bin\\matcli.exe -boot"
"item"="Broadband Desktop Help"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder\F:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech Desktop Messenger.lnk]
"path"="F:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\Logitech Desktop Messenger.lnk"
"backup"="F:\\WINDOWS\\pss\\Logitech Desktop Messenger.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~2\\Logitech\\DESKTO~1\\8876480\\Program\\LDMConf.exe /start"
"item"="Logitech Desktop Messenger"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder\F:^Documents and Settings^smiffy^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
"path"="F:\\Documents and Settings\\smiffy\\Start Menu\\Programs\\Startup\\LimeWire On Startup.lnk"
"backup"="F:\\WINDOWS\\pss\\LimeWire On Startup.lnkStartup"
"location"="Startup"
"command"="F:\\PROGRA~1\\LimeWire\\LimeWire.exe -startup"
"item"="LimeWire On Startup"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"=""
"hkey"="HKLM"
"command"=""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\Aim6]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="AOLLaunch"
"hkey"="HKCU"
"command"="\"F:\\Program Files\\Common Files\\AOL\\Launch\\AOLLaunch.exe\" /d locale=en-GB ee://aol/imApp"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\ares lite]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Ares"
"hkey"="HKCU"
"command"="\"F:\\Program Files\\ARES\\Ares.exe\" -h"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NMBgMonitor"
"hkey"="HKCU"
"command"="\"F:\\Program Files\\Common Files\\Ahead\\lib\\NMBgMonitor.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\BitTorrent]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="bittorrent"
"hkey"="HKCU"
"command"="\"F:\\Program Files\\BitTorrent\\bittorrent.exe\" --force_start_minimized"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\Crazaa]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Crazaa"
"hkey"="HKCU"
"command"="F:\\Program Files\\Crazaa\\Crazaa.exe /hide"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\CTFMON.EXE]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ctfmon"
"hkey"="HKCU"
"command"="F:\\WINDOWS\\System32\\ctfmon.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\HostManager]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="AOLSoftware"
"hkey"="HKLM"
"command"="F:\\Program Files\\Common Files\\AOL\\1159554764\\ee\\AOLSoftware.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\IPHSend]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="IPHSend"
"hkey"="HKLM"
"command"="F:\\Program Files\\Common Files\\AOL\\IPHSend\\IPHSend.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\iTunesHelper]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="iTunesHelper"
"hkey"="HKLM"
"command"="\"F:\\Program Files\\iTunes\\iTunesHelper.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\KCeasy]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="KCeasy"
"hkey"="HKCU"
"command"="F:\\Program Files\\KCeasy\\KCeasy.exe /hide"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\LogitechSoftwareUpdate]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ManifestEngine"
"hkey"="HKCU"
"command"="\"F:\\Program Files\\Logitech\\Video\\ManifestEngine.exe\" boot"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\LogitechVideoRepair]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ISStart"
"hkey"="HKLM"
"command"="F:\\Program Files\\Logitech\\Video\\ISStart.exe "
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\LogitechVideoTray]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="LogiTray"
"hkey"="HKLM"
"command"="F:\\Program Files\\Logitech\\Video\\LogiTray.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\Motive SmartBridge]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="BTHelpNotifier"
"hkey"="HKLM"
"command"="F:\\PROGRA~1\\BTBROA~1\\Help\\SMARTB~1\\BTHelpNotifier.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\MSMSGS]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="msmsgs"
"hkey"="HKCU"
"command"="\"F:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\MsnMsgr]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="msnmsgr"
"hkey"="HKCU"
"command"="\"F:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\NeroFilterCheck]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NeroCheck"
"hkey"="HKLM"
"command"="F:\\WINDOWS\\system32\\NeroCheck.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\NvCplDaemon]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NvCpl"
"hkey"="HKLM"
"command"="RUNDLL32.EXE F:\\WINDOWS\\System32\\NvCpl.dll,NvStartup"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\NvMediaCenter]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NVMCTRAY"
"hkey"="HKCU"
"command"="RUNDLL32.EXE F:\\WINDOWS\\System32\\NVMCTRAY.DLL,NvTaskbarInit"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\nwiz]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="nwiz"
"hkey"="HKLM"
"command"="nwiz.exe /install"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\QuickTime Task]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="qttask"
"hkey"="HKLM"
"command"="\"F:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\RapidCheck]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="RapidCheck"
"hkey"="HKCU"
"command"="F:\\Program Files\\RapidCheck\\RapidCheck.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\SSC_UserPrompt]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="UsrPrmpt"
"hkey"="HKLM"
"command"="F:\\Program Files\\Common Files\\Symantec Shared\\Security Center\\UsrPrmpt.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\SunJavaUpdateSched]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="jusched"
"hkey"="HKLM"
"command"="F:\\Program Files\\Java\\jre1.5.0_03\\bin\\jusched.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\Symantec NetDriver Monitor]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="SNDMon"
"hkey"="HKLM"
"command"="F:\\PROGRA~1\\SYMNET~1\\SNDMon.exe /Consumer"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\Windows Defender]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="MSASCui"
"hkey"="HKLM"
"command"="\"F:\\Program Files\\Windows Defender\\MSASCui.exe\" -hide"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\Yahoo! Pager]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="YahooMessenger"
"hkey"="HKCU"
"command"="\"F:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe\" -quiet"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\YBrowser]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ybrwicon"
"hkey"="HKLM"
"command"="F:\\PROGRA~1\\Yahoo!\\browser\\ybrwicon.exe"
"inimapping"="0"


HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders
securityproviders REG_SZ msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll


Contents of the 'Scheduled Tasks' folder
F:\WINDOWS\tasks\Symantec NetDetect.job

Completion time: 06/10/2006 23:14:08.57
ComboFix.txt

my system might look pretty clean but firefox.exe/explorer.exe,and svchost.exe still show high in memory useage in processes

firefox even when i have just one browser open,and not even using it,the mem usage is 39.444

[Glaswegian]

Hi smiffy

I would suggest that your P2P applications and Bittorrent are soaking up much of your CPU. While I’m not here to pass judgement, I will say that you are leaving yourself open to infection. And, by the looks of it, abuse of your CPU capacity.


There are a couple of deletions to do:

Delete the following Files indicated in RED and Folders indicated in BLUE if they still exist.

F:\Program Files\Viewpoint
F:\Program Files\AresP2P_WhenUSave_Installer


Other than that, there’s no evidence of any malware. My suggestion would be to uninstall your P2P apps, especially Bittorrent and see if that makes any difference. If it does then that’s your answer. If not, then I can only point you back to the XP forum, advise them you’ve been cleared for malware and let one of their experts help you out, certainly more than I can.


We’ll just tidy up here and I’ll let you go, along with my recommendations for staying safe and secure.

You can go ahead and delete any special tools we used (SmitRem, SmitfraudFix, ComboFix, etc). They won't serve a future purpose and are replaced with updated versions frequently, so the copies you have are probably already out of date and there is therefore no need to keep them.


Reset Hidden/System Files
To reset your hidden and system files:

• Click Start.
• Open My Computer.
• Select the Tools menu and click Folder Options.
• Select the View tab.
• Deselect the Show hidden files and folders option.
• Select the Hide file extensions for known types option.
• Select the Hide protected operating system files option.
• Click Yes to confirm.
• Click OK.

System Restore
To turn off System Restore click Start > Right Click My Computer > Properties. Click the System Restore tab and Check "Turn off System Restore" or "Turn off System Restore on all drives" Click Apply. When turning off System Restore, the existing restore points will be deleted. Click Yes to do this then Click OK.

To turn on System Restore by Clicking Start. Right-click My Computer, and then click Properties. Click the System Restore tab. Uncheck "Turn off System Restore" or "Turn off System Restore on all drives." Click Apply, and then OK.

This will create a new Restore Point.



IMPORTANT!!!
Please ensure that Windows is patched against the WMF exploit. This is a dangerous vulnerability that opens the door to multiple infections. Visit Window's Update to get the KB912919 patch if you have not already done so.



Now that you are clean, to help protect your computer in the future I recommend that you get the following free programs:

Spyware Blaster to help prevent spyware from installing in the first place.
Spyware Guard to catch and block spyware before it can execute.
Spybot - Search & Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with the program on a regular basis just as you would an antivirus software. A tutorial on installing & using this product can be found here.


Ad-aware
Download and install Ad-Aware. You should use this program to scan your computer on a regular basis just as you would an antivirus software in conjunction with Spybot. A tutorial on installing & using this product can be found here.


IE-SPYAD
IE-Spyad places more than 4000 dubious websites and domains in the IE Restricted list. This severely impairs attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites. A tutorial on installing this product can be found here.


SnoopFree
SnoopFree is a real time monitor that notifies you when a programme wants to record your keystrokes or read your screen. Note that SnoopFree is only for XP systems.


MVPS Hosts File
The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer. Note that if you use a company provided HOSTS file you should not use the MVPS HOSTS file.


Alternate Browsers
Try the following free alternate browsers rather than Internet Explorer
Firefox
Opera
Maxthon



Firewalls
A good firewall will monitor incoming and outgoing traffic. NOTE: Microsoft's Firewall does not monitor outgoing traffic. If you do not have a firewall, here are 3 free ones available for personal use:
Sygate Personal Firewall
ZoneAlarm
Tiny Personal Firewall


Anti Virus Software
It is very important that you have anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future. See this link for a listing of some online antivirus scanners:
Anti-Spyware Tutorial

Here are two very good free Antivirus products which are available:
Avast!
AVG

It is imperative that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.


Other Protection
Winpatrol - Download and install the free version of Winpatrol. A tutorial for this product is located here:
Using Winpatrol to protect your computer.


In light of your recent troubles, I'm sure you'll like to avoid any future infections. Please take a look at these well written articles

PC Safety & Security - What Do I Need?.
Making Internet Explorer Safer.

Keep clean and safe and enjoy your computing!

Please respond to this thread one more time so we can mark this thread as resolved.

[smiffy2006]

i thin i will probably do a fresh install of xp,cus i am rebuilding my pc soon,within a week,to a 3.4 dual core this pc is about 3 years old now,so i will just reinstall xp when i swop my hard drive into the new one.

thanx for all your help,it is running better but something is still hogging the cpu at times.