Brand new computer - running slowly with various pop-ups

[Kondora]

Hello again,

I've just recently (in the last 3 days) got a brand new computer. Already it appears to be infected with Spyware/Malware, I've sorted myself with Firewalls etc, including Win Defender, Ad-Aware, and I have all the windows updates including SP2.

My specs are as follows:

Asus P5N-E SLi nForce 650 (Socket 775) PCI-Express DDR2 Motherboard
Intel Core 2 Duo E6550 "LGA775 Conroe" 2.33GHz
Seagate Barracuda 7200.10 250GB SATA-II 16MB Cache
BFG GeForce 8800 GT OC 512MB GDDR3 HDTV/Dual DVI
Creative Sound Blaster X-Fi Xtreme Audio 7.1 Sound Card
OCZ GameXStream 600w Silent SLI Ready ATX2 Power Supply
GeIL 2GB (2x1GB) PC2-6400C4 800MHz Ultra Low Latency DDR2 Dual Channel

And here's my HJT Log (Normal):

Logfile of HijackThis v1.99.1
Scan saved at 17:45:57, on 02/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\mmc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [P17Helper] Rundll32 SPIRun.dll,RunDLLEntry
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1199129618901
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1199285434718
O17 - HKLM\System\CCS\Services\Tcpip\..\{AFBE4B11-EE14-4F37-B1C8-0E46CD28BB7E}: NameServer = 212.139.132.53 212.139.132.52
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Any help greatly appreciated, quite annoying I got infected on my new system!

Cheers

[Kondora]

Thought I'd add:

I often get this pop-up when loading websites;

"A buffer overrun has been detected which has corrupted the program's internal state. The program cannot safely continue execution and must now be terminated."

Also, I have an object detected as Malware by Ad-Aware called "Virtumonde", every time I remove this, it just comes back.

Lastly, I have this pop-up (see screenshot attachment):

After "OK'ing" the pop-up (or cancel, makes no difference) I get a couple of follow-up pop-ups telling me to "SCAN NOW YOU'RE PC IS SLOW!!", "DOWNLOAD THIS!" etc.

[MoralTerror]

Hi Kondora

Your version of HijackThis is outdated. Please delete your copy of HijackThis then please download HijackThis . Double-click on the file you just downloaded. Click on the "Unzip" button to install. It will by default install to the directory - C:\Program Files\Trend Micro\HijackThis.

Close HijackThis

--------------------------

Download Combofix from any of the links below, and save it to your desktop.

Link 1
Link 2
Link 3


**Note: It is important that it is saved directly to your desktop**

--------------------------------------------------------------------

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

--------------------------------------------------------------------

Double click on combofix.exe & follow the prompts.

• When finished, it will produce a report for you.
• Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.

Note:
Do not mouseclick combofix's window while it's running. That may cause it to stall

[Kondora]

Hi there, thanks for your assistance thus far, sorry I didn't realise the HJT was out-dated.

ComboFix 08-01-04.1 - Greg 2008-01-04 22:40:16.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1607 [GMT 0:00]
Running from: C:\Documents and Settings\Greg\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\ffhkj.ini
C:\WINDOWS\system32\ffhkj.ini2
C:\WINDOWS\system32\jkhff.dll
C:\WINDOWS\system32\tmp40.tmp

.
((((((((((((((((((((((((( Files Created from 2007-12-04 to 2008-01-04 )))))))))))))))))))))))))))))))
.

2008-01-04 22:38 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-04 22:35 . 2008-01-04 22:35 <DIR> d-------- C:\Program Files\Trend Micro
2008-01-04 14:46 . 2008-01-04 14:46 <DIR> d-------- C:\Documents and Settings\Greg\Application Data\InstallShield Installation Information
2008-01-04 14:35 . 2008-01-04 14:35 <DIR> d-------- C:\Program Files\Unreal Tournament 3
2008-01-04 14:34 . 2008-01-04 14:34 <DIR> d-------- C:\WINDOWS\system32\AGEIA
2008-01-04 14:34 . 2008-01-04 14:34 <DIR> d-------- C:\Program Files\AGEIA Technologies
2008-01-04 13:46 . 2007-06-13 10:08 1,174,528 --a------ C:\WINDOWS\system32\drivers\P17xfi.sys
2008-01-04 13:46 . 2006-06-02 11:08 197,632 --a------ C:\WINDOWS\SF32.exe
2008-01-04 13:46 . 2003-04-02 07:13 139,264 --a------ C:\WINDOWS\system32\EAX.DLL
2008-01-04 13:46 . 2006-01-25 14:55 137,728 --a------ C:\WINDOWS\system32\P17res.dll
2008-01-04 13:46 . 2003-10-02 18:48 53,248 --a------ C:\WINDOWS\system32\P17CPI.dll
2008-01-04 13:46 . 2006-07-03 12:55 53,248 --a------ C:\WINDOWS\resdef.exe
2008-01-04 13:46 . 2004-12-22 19:58 8,704 --a------ C:\WINDOWS\system32\drivers\Pfmodnt.sys
2008-01-04 13:46 . 2006-08-23 18:47 8,251 --a------ C:\WINDOWS\sfsyn.ini
2008-01-03 15:24 . 2008-01-03 15:24 <DIR> d-------- C:\Documents and Settings\Greg\Application Data\Talkback
2008-01-03 15:24 . 2008-01-03 15:24 0 --a------ C:\WINDOWS\nsreg.dat
2008-01-03 14:41 . 2006-11-28 02:14 782,336 -ra------ C:\WINDOWS\system32\tmp3D.tmp
2008-01-02 19:56 . 2008-01-02 19:56 <DIR> d-------- C:\WINDOWS\system32\Futuremark
2008-01-02 19:56 . 2004-10-25 20:02 21,664 --a------ C:\WINDOWS\system32\drivers\Entech.sys
2008-01-02 19:56 . 1999-11-02 10:01 6,173 --a------ C:\WINDOWS\system32\drivers\Entech.vxd
2008-01-02 19:56 . 2004-06-22 15:44 5,632 --a------ C:\WINDOWS\system32\drivers\Entech64.sys
2008-01-02 19:56 . 2001-11-19 19:05 3,972 --a------ C:\WINDOWS\system32\drivers\PciBus.sys
2008-01-02 19:55 . 2008-01-02 19:55 <DIR> d-------- C:\Program Files\Futuremark
2008-01-02 18:19 . 2006-11-28 02:14 782,336 -ra------ C:\WINDOWS\system32\tmp3C.tmp
2008-01-02 17:32 . 1999-09-22 23:18 2,167,684 --a------ C:\WINDOWS\system32\CT2MGM.SF2
2008-01-02 17:32 . 2008-01-04 14:55 584 --a------ C:\WINDOWS\system32\settingsbkup.sfm
2008-01-02 17:32 . 2008-01-04 14:55 584 --a------ C:\WINDOWS\system32\settings.sfm
2008-01-02 17:31 . 2008-01-04 13:48 <DIR> d-------- C:\Program Files\Creative
2008-01-02 17:31 . 2008-01-04 14:49 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Creative
2008-01-02 17:31 . 2006-11-28 02:14 782,336 -ra------ C:\WINDOWS\system32\tmp3E.tmp
2008-01-02 17:31 . 2006-11-28 02:14 782,336 -ra------ C:\WINDOWS\OALInst.exe
2008-01-02 17:31 . 2007-05-08 08:59 137,216 --a------ C:\WINDOWS\system32\OemSpi.dll
2008-01-02 17:31 . 2002-04-11 01:41 65,536 --a--c--- C:\WINDOWS\system32\dllcache\a3d.dll
2008-01-02 17:31 . 2002-04-11 01:41 65,536 --a------ C:\WINDOWS\system32\A3d.dll
2008-01-02 17:31 . 2005-06-15 11:07 11,264 --a------ C:\WINDOWS\InRes.DLL
2008-01-02 17:31 . 2006-07-03 12:43 10,752 --a------ C:\WINDOWS\system32\SPIRun.dll
2008-01-02 17:31 . 2007-07-02 11:45 990 --a------ C:\WINDOWS\SB0790.reg
2008-01-02 17:31 . 2007-07-02 11:45 986 --a------ C:\WINDOWS\SB0792.reg
2008-01-02 17:31 . 2008-01-04 13:47 935 -rah----- C:\WINDOWS\ctfile.rfc
2008-01-02 17:02 . 2008-01-02 17:02 <DIR> d-------- C:\Program Files\NVIDIA Corporation
2008-01-02 16:47 . 2008-01-02 16:47 <DIR> d-------- C:\Program Files\Windows Defender
2008-01-02 14:46 . 2008-01-02 14:46 13,646 --a------ C:\WINDOWS\system32\wpa.bak
2008-01-02 14:38 . 2008-01-02 14:38 <DIR> d-------- C:\Program Files\Lavasoft
2008-01-02 14:38 . 2008-01-04 14:34 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-01-02 14:38 . 2008-01-02 14:38 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-01-01 23:41 . 2008-01-01 23:41 24,288 --a------ C:\WINDOWS\system32\fccdbcd.dll
2008-01-01 02:07 . 2001-08-17 13:59 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys
2008-01-01 02:06 . 2004-08-03 22:59 57,472 --a------ C:\WINDOWS\system32\drivers\redbook.sys
2008-01-01 02:04 . 2007-12-31 21:10 <DIR> dr------- C:\Documents and Settings\All Users\Documents
2008-01-01 02:04 . 2006-02-28 12:00 176,157 --a--c--- C:\WINDOWS\system32\dllcache\dgrpsetu.dll
2008-01-01 02:03 . 2006-02-28 12:00 14,573 -ra------ C:\WINDOWS\SET25.tmp
2008-01-01 02:01 . 2007-12-31 18:19 261 --a------ C:\WINDOWS\system32\$winnt$.inf
2008-01-01 02:01 . 2007-12-31 18:13 211 ---hs---- C:\boot.ini
2007-12-31 23:05 . 2007-12-31 23:05 <DIR> d-------- C:\WINDOWS\system32\Lang
2007-12-31 23:05 . 2007-12-31 23:05 940,794 --a------ C:\WINDOWS\system32\LoopyMusic.wav
2007-12-31 23:05 . 2007-12-31 23:05 146,650 --a------ C:\WINDOWS\system32\BuzzingBee.wav
2007-12-31 22:44 . 2007-12-31 22:44 <DIR> d-------- C:\Program Files\Common Files\Blizzard Entertainment
2007-12-31 22:43 . 2007-12-31 22:44 <DIR> d-------- C:\WINDOWS\system32\RTCOM
2007-12-31 22:43 . 2007-12-31 22:43 <DIR> d-------- C:\Program Files\Realtek
2007-12-31 22:26 . 2007-12-31 23:51 <DIR> d-------- C:\Program Files\World of Warcraft
2007-12-31 22:17 . 2004-08-03 23:10 61,056 --a------ C:\WINDOWS\system32\drivers\ohci1394.sys
2007-12-31 22:17 . 2004-08-03 23:10 61,056 --a--c--- C:\WINDOWS\system32\dllcache\ohci1394.sys
2007-12-31 22:17 . 2004-08-03 23:10 53,248 --a------ C:\WINDOWS\system32\drivers\1394bus.sys
2007-12-31 22:17 . 2004-08-03 23:10 53,248 --a--c--- C:\WINDOWS\system32\dllcache\1394bus.sys
2007-12-31 22:17 . 2001-08-17 13:46 6,400 --a------ C:\WINDOWS\system32\drivers\enum1394.sys
2007-12-31 22:17 . 2001-08-17 13:46 6,400 --a--c--- C:\WINDOWS\system32\dllcache\enum1394.sys
2007-12-31 21:42 . 2006-12-08 15:20 10,528,768 --a------ C:\WINDOWS\system32\RTLCPL.exe
2007-12-31 21:42 . 2007-10-26 11:20 4,124,352 -ra------ C:\WINDOWS\system32\drivers\alcxwdm.sys
2007-12-31 21:42 . 2005-09-21 02:25 299,008 --a------ C:\WINDOWS\system32\ALSndMgr.Cpl
2007-12-31 21:42 . 2002-02-05 13:54 141,016 --a------ C:\WINDOWS\system32\alsndmgr.wav
2007-12-31 21:42 . 2006-07-21 08:14 86,016 --a------ C:\WINDOWS\SoundMan.exe
2007-12-31 21:42 . 2006-08-01 07:02 49,152 --a------ C:\WINDOWS\system32\ChCfg.exe
2007-12-31 21:39 . 2007-12-31 21:39 <DIR> d-------- C:\Program Files\Realtek AC97
2007-12-31 21:39 . 2006-07-31 11:19 315,392 --a------ C:\WINDOWS\alcupd.exe
2007-12-31 21:39 . 2006-07-31 11:27 217,088 --a------ C:\WINDOWS\alcrmv.exe
2007-12-31 20:53 . 2007-12-31 20:53 <DIR> d-------- C:\WINDOWS\nview
2007-12-31 20:53 . 2007-12-31 20:53 <DIR> d-------- C:\NVIDIA
2007-12-31 20:53 . 2007-12-05 01:41 356,352 --a------ C:\WINDOWS\system32\nvudisp.exe
2007-12-31 20:53 . 2008-01-04 14:57 163,353 --a------ C:\WINDOWS\system32\nvapps.xml
2007-12-31 20:53 . 2007-12-05 01:41 17,737 --a------ C:\WINDOWS\system32\nvdisp.nvu
2007-12-31 20:37 . 2008-01-04 22:44 1,798,176 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2007-12-31 20:37 . 2008-01-04 22:44 21,692 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2007-12-31 20:35 . 2007-12-31 20:35 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\MailFrontier
2007-12-31 20:34 . 2008-01-01 23:06 <DIR> d-------- C:\Documents and Settings\Greg\Contacts
2007-12-31 20:01 . 2008-01-04 14:34 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
2007-12-31 19:56 . 2007-12-31 20:01 <DIR> d-------- C:\Program Files\Windows Live
2007-12-31 19:56 . 2007-12-31 20:01 <DIR> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller
2007-12-31 19:56 . 2007-12-31 19:56 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
2007-12-31 19:36 . 2005-06-28 10:21 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2007-12-31 19:34 . 2007-07-30 19:19 43,352 --a------ C:\WINDOWS\system32\wups2.dll
2007-12-31 19:34 . 2007-07-30 19:18 34,136 --a------ C:\WINDOWS\system32\wucltui.dll.mui
2007-12-31 19:34 . 2007-07-30 19:19 25,944 --a------ C:\WINDOWS\system32\wuaucpl.cpl.mui
2007-12-31 19:34 . 2007-07-30 19:19 25,944 --a------ C:\WINDOWS\system32\wuapi.dll.mui
2007-12-31 19:34 . 2007-07-30 19:18 20,312 --a------ C:\WINDOWS\system32\wuaueng.dll.mui
2007-12-31 19:33 . 2007-12-31 19:33 <DIR> d---s---- C:\Documents and Settings\Greg\UserData
2007-12-31 19:27 . 2007-12-31 19:27 <DIR> d-------- C:\Program Files\Thomson
2007-12-31 19:27 . 2008-01-04 13:46 <DIR> d--h----- C:\Program Files\InstallShield Installation Information
2007-12-31 19:27 . 2003-12-08 11:53 70,688 --a------ C:\WINDOWS\system32\drivers\alcaudsl.sys
2007-12-31 19:27 . 2003-12-08 11:53 53,600 --a------ C:\WINDOWS\system32\drivers\alcan5wn.sys
2007-12-31 19:27 . 2003-12-08 11:53 5,606 --a------ C:\WINDOWS\system32\stci.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-04 13:47 409,600 ----a-w C:\WINDOWS\system32\wrap_oal.dll
2008-01-04 13:47 114,688 ----a-w C:\WINDOWS\system32\OpenAL32.dll
2008-01-02 17:01 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-01-02 15:51 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-01-01 17:08 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-12-31 18:53 --------- d-----w C:\Program Files\MSBuild
2007-12-31 18:53 --------- d-----w C:\Program Files\Microsoft Works
2007-12-31 18:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\WinZip
2007-12-31 18:17 --------- d-----w C:\Program Files\microsoft frontpage
2007-12-05 02:53 356,352 ----a-w C:\WINDOWS\system32\NVUNINST.EXE
2007-12-05 01:41 81,920 ----a-w C:\WINDOWS\system32\nvwddi.dll
2007-12-05 01:41 81,920 ----a-w C:\WINDOWS\system32\nvmctray.dll
2007-12-05 01:41 8,523,776 ----a-w C:\WINDOWS\system32\nvcpl.dll
2007-12-05 01:41 753,664 ----a-w C:\WINDOWS\system32\nvcplui.exe
2007-12-05 01:41 7,435,392 ----a-w C:\WINDOWS\system32\drivers\nv4_mini.sys
2007-12-05 01:41 6,901,760 ----a-w C:\WINDOWS\system32\nvoglnt.dll
2007-12-05 01:41 6,549,504 ----a-w C:\WINDOWS\system32\nvdisps.dll
2007-12-05 01:41 5,773,568 ----a-w C:\WINDOWS\system32\nv4_disp.dll
2007-12-05 01:41 5,611,520 ----a-w C:\WINDOWS\system32\nvdispsr.dll
2007-12-05 01:41 466,944 ----a-w C:\WINDOWS\system32\nvshell.dll
2007-12-05 01:41 458,752 ----a-w C:\WINDOWS\system32\nvmccssr.dll
2007-12-05 01:41 45,056 ----a-w C:\WINDOWS\system32\nvmccsrs.dll
2007-12-05 01:41 442,368 ----a-w C:\WINDOWS\system32\nvappbar.exe
2007-12-05 01:41 425,984 ----a-w C:\WINDOWS\system32\keystone.exe
2007-12-05 01:41 385,024 ----a-w C:\WINDOWS\system32\nvapi.dll
2007-12-05 01:41 35,328 ----a-w C:\WINDOWS\system32\nvcodins.dll
2007-12-05 01:41 35,328 ----a-w C:\WINDOWS\system32\nvcod.dll
2007-12-05 01:41 335,872 ----a-w C:\WINDOWS\system32\nvwrses.dll
2007-12-05 01:41 335,872 ----a-w C:\WINDOWS\system32\nvwrsel.dll
2007-12-05 01:41 327,680 ----a-w C:\WINDOWS\system32\nvwrsfr.dll
2007-12-05 01:41 327,680 ----a-w C:\WINDOWS\system32\nvwrsesm.dll
2007-12-05 01:41 327,680 ----a-w C:\WINDOWS\system32\nvrshe.dll
2007-12-05 01:41 327,680 ----a-w C:\WINDOWS\system32\nvrsar.dll
2007-12-05 01:41 323,584 ----a-w C:\WINDOWS\system32\nvwrspt.dll
2007-12-05 01:41 323,584 ----a-w C:\WINDOWS\system32\nvwrsit.dll
2007-12-05 01:41 319,488 ----a-w C:\WINDOWS\system32\nvwrsptb.dll
2007-12-05 01:41 319,488 ----a-w C:\WINDOWS\system32\nvwrsnl.dll
2007-12-05 01:41 315,392 ----a-w C:\WINDOWS\system32\nvwrsru.dll
2007-12-05 01:41 315,392 ----a-w C:\WINDOWS\system32\nvwrshu.dll
2007-12-05 01:41 311,296 ----a-w C:\WINDOWS\system32\nvwrsde.dll
2007-12-05 01:41 307,200 ----a-w C:\WINDOWS\system32\nvexpbar.dll
2007-12-05 01:41 303,104 ----a-w C:\WINDOWS\system32\nvwrstr.dll
2007-12-05 01:41 303,104 ----a-w C:\WINDOWS\system32\nvwrssl.dll
2007-12-05 01:41 303,104 ----a-w C:\WINDOWS\system32\nvwrsfi.dll
2007-12-05 01:41 3,715,072 ----a-w C:\WINDOWS\system32\nvvitvsr.dll
2007-12-05 01:41 3,710,976 ----a-w C:\WINDOWS\system32\nvvitvs.dll
2007-12-05 01:41 3,420,160 ----a-w C:\WINDOWS\system32\nvgames.dll
2007-12-05 01:41 3,334,144 ----a-w C:\WINDOWS\system32\nvgamesr.dll
2007-12-05 01:41 299,008 ----a-w C:\WINDOWS\system32\nvwrssk.dll
2007-12-05 01:41 299,008 ----a-w C:\WINDOWS\system32\nvwrsno.dll
2007-12-05 01:41 294,912 ----a-w C:\WINDOWS\system32\nvwrssv.dll
2007-12-05 01:41 294,912 ----a-w C:\WINDOWS\system32\nvwrspl.dll
2007-12-05 01:41 294,912 ----a-w C:\WINDOWS\system32\nvwrsda.dll
2007-12-05 01:41 290,816 ----a-w C:\WINDOWS\system32\nvwrsth.dll
2007-12-05 01:41 286,720 ----a-w C:\WINDOWS\system32\nvwrseng.dll
2007-12-05 01:41 286,720 ----a-w C:\WINDOWS\system32\nvwrscs.dll
2007-12-05 01:41 286,720 ----a-w C:\WINDOWS\system32\nvnt4cpl.dll
2007-12-05 01:41 282,624 ----a-w C:\WINDOWS\system32\nvwrsar.dll
2007-12-05 01:41 282,624 ----a-w C:\WINDOWS\system32\nvrsfr.dll
2007-12-05 01:41 282,624 ----a-w C:\WINDOWS\system32\nvrses.dll
2007-12-05 01:41 282,624 ----a-w C:\WINDOWS\system32\nvrsel.dll
2007-12-05 01:41 278,528 ----a-w C:\WINDOWS\system32\nvwrshe.dll
2007-12-05 01:41 278,528 ----a-w C:\WINDOWS\system32\nvrsit.dll
2007-12-05 01:41 278,528 ----a-w C:\WINDOWS\system32\nvrsde.dll
2007-12-05 01:41 274,432 ----a-w C:\WINDOWS\system32\nvrspt.dll
2007-12-05 01:41 274,432 ----a-w C:\WINDOWS\system32\nvrsnl.dll
2007-12-05 01:41 274,432 ----a-w C:\WINDOWS\system32\nvrsesm.dll
2007-12-05 01:41 270,336 ----a-w C:\WINDOWS\system32\nvrsru.dll
2007-12-05 01:41 266,240 ----a-w C:\WINDOWS\system32\nvrsptb.dll
2007-12-05 01:41 266,240 ----a-w C:\WINDOWS\system32\nvrsja.dll
2007-12-05 01:41 258,048 ----a-w C:\WINDOWS\system32\nvrstr.dll
2007-12-05 01:41 258,048 ----a-w C:\WINDOWS\system32\nvrssl.dll
2007-12-05 01:41 258,048 ----a-w C:\WINDOWS\system32\nvrssk.dll
2007-12-05 01:41 258,048 ----a-w C:\WINDOWS\system32\nvrsko.dll
2007-12-05 01:41 258,048 ----a-w C:\WINDOWS\system32\nvrshu.dll
2007-12-05 01:41 253,952 ----a-w C:\WINDOWS\system32\nvrsth.dll
2007-12-05 01:41 253,952 ----a-w C:\WINDOWS\system32\nvrssv.dll
2007-12-05 01:41 253,952 ----a-w C:\WINDOWS\system32\nvrspl.dll
2007-12-05 01:41 253,952 ----a-w C:\WINDOWS\system32\nvrsno.dll
2007-12-05 01:41 253,952 ----a-w C:\WINDOWS\system32\nvrsda.dll
2007-12-05 01:41 249,856 ----a-w C:\WINDOWS\system32\nvrsfi.dll
2007-12-05 01:41 249,856 ----a-w C:\WINDOWS\system32\nvrscs.dll
2007-12-05 01:41 245,760 ----a-w C:\WINDOWS\system32\nvrseng.dll
2007-12-05 01:41 229,376 ----a-w C:\WINDOWS\system32\nvmccs.dll
2007-12-05 01:41 225,280 ----a-w C:\WINDOWS\system32\nvrszhc.dll
2007-12-05 01:41 212,992 ----a-w C:\WINDOWS\system32\nvwrsja.dll
2007-12-05 01:41 2,854,912 ----a-w C:\WINDOWS\system32\nvmoblsr.dll
2007-12-05 01:41 2,519,040 ----a-w C:\WINDOWS\system32\nvwssr.dll
2007-12-05 01:41 2,498,560 ----a-w C:\WINDOWS\system32\nvwss.dll
2007-12-05 01:41 196,608 ----a-w C:\WINDOWS\system32\nvwrsko.dll
2007-12-05 01:41 188,416 ----a-w C:\WINDOWS\system32\nvmccss.dll
2007-12-05 01:41 167,936 ----a-w C:\WINDOWS\system32\nvwrszht.dll
2007-12-05 01:41 163,840 ----a-w C:\WINDOWS\system32\nvwrszhc.dll
2007-12-05 01:41 155,716 ----a-w C:\WINDOWS\system32\nvsvc32.exe
2007-12-05 01:41 147,456 ----a-w C:\WINDOWS\system32\nvcolor.exe
2007-12-05 01:41 126,976 ----a-w C:\WINDOWS\system32\nvrszht.dll
2007-12-05 01:41 1,703,936 ----a-w C:\WINDOWS\system32\nvwdmcpl.dll
2007-12-05 01:41 1,626,112 ----a-w C:\WINDOWS\system32\nwiz.exe
2007-12-05 01:41 1,474,560 ----a-w C:\WINDOWS\system32\nview.dll
2007-12-05 01:41 1,339,392 ----a-w C:\WINDOWS\system32\nvdspsch.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C}]
2008-01-01 23:41 24288 --a------ C:\WINDOWS\system32\fccdbcd.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2006-02-28 12:00 15360]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 16:24 1694208]
"NVIDIA nTune"="C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" [2007-07-03 12:32 81920]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 07:00 33648]
"SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 11:38 866816]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-11-14 16:05 919016]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776]
"nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920]
"RTHDCPL"="RTHDCPL.EXE" [2006-11-14 09:21 16270848 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 10:04 2879488 C:\WINDOWS\SkyTel.exe]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20 866584]
"P17Helper"="SPIRun.dll" [2006-07-03 12:43 10752 C:\WINDOWS\system32\SPIRun.dll]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2006-02-28 12:00 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C}"= C:\WINDOWS\system32\fccdbcd.dll [2008-01-01 23:41 24288]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\fccdbcd]
fccdbcd.dll 2008-01-01 23:41 24288 C:\WINDOWS\system32\fccdbcd.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 C:\WINDOWS\system32\jkhff.dll

R3 P17xfi;Sound Blaster X-Fi Xtreme Audio;C:\WINDOWS\system32\drivers\P17xfi.sys [2007-06-13 10:08]
R3 p17xfilt;p17xfilt;C:\WINDOWS\system32\drivers\p17xfilt.sys [2007-08-20 13:35]

.
Contents of the 'Scheduled Tasks' folder
"2008-01-04 14:56:11 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-04 22:46:32
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\fccdbcd.dll

PROCESS: C:\WINDOWS\Explorer.EXE [6.00.2900.3156]
-> C:\WINDOWS\system32\fccdbcd.dll
.
Completion time: 2008-01-04 22:47:48 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-04 22:47:44


---


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:50:34, on 04/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - C:\WINDOWS\system32\fccdbcd.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [P17Helper] Rundll32 SPIRun.dll,RunDLLEntry
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1199129618901
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1199285434718
O17 - HKLM\System\CCS\Services\Tcpip\..\{AFBE4B11-EE14-4F37-B1C8-0E46CD28BB7E}: NameServer = 212.139.132.53 212.139.132.52
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O20 - Winlogon Notify: fccdbcd - C:\WINDOWS\SYSTEM32\fccdbcd.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 5124 bytes

[MoralTerror]

Hi Kondora

I see no evidence of an Anti-virus program on board. Please install update and run an Anti-virus (or if you do have 1 make sure it is enabled). Do not continue until the Antivirus problem has been resolved. Here are some links for anti-virus software.

AVG
Avast
BitDefender Free Edition v7.2

------------------------------------
*NOTE: Remember to disable anti virus and anti-spyware programs so they do not interfere with ComboFix

1. Close any open browsers.

2. Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\WINDOWS\system32\fccdbcd.dll
C:\WINDOWS\system32\tmp3D.tmp
C:\WINDOWS\system32\tmp3C.tmp
C:\WINDOWS\system32\tmp3E.tmp
Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C}]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C}"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\fccdbcd]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"Authentication Packages"=-
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"Authentication Packages"=hex(7):6d,73,76,31,5f,30,00,00

Save this as CFScript.txt, in the same location as ComboFix.exe




Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at "C:\ComboFix.txt"

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

------------------------------------

Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner

Answer Yes, when prompted to install an ActiveX component.

• The program will then begin downloading the latest definition files.
• Once the files have been downloaded click on NEXT
• Locate the Scan Settings button & configure to:
  • Scan using the following Anti-Virus database:
    • Extended
  • Scan Options:
    • Scan Archives
    • Scan Mail Bases
• Click OK & have it scan My Computer
• Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
• Click the Save as Text button to save the file to your desktop so that you may post it in your next reply

* Turn off the real time scanner of any existing antivirus program while performing the online scan

Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license has been accepted, reset to 100%.

------------------------------------
Required Logs

c:\combofix.txt
Kaspersky report
a new HijackThis log


Please also provide an update on system behaviour

[Kondora]

ComboFix 08-01-04.1 - Greg 2008-01-05 2:57:38.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1515 [GMT 0:00]
Running from: C:\Documents and Settings\Greg\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Greg\Desktop\CFScript.txt
* Created a new restore point

FILE
C:\WINDOWS\system32\fccdbcd.dll
C:\WINDOWS\system32\tmp3C.tmp
C:\WINDOWS\system32\tmp3D.tmp
C:\WINDOWS\system32\tmp3E.tmp
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\fccdbcd.dll
C:\WINDOWS\system32\jkklk.dll
C:\WINDOWS\system32\klkkj.ini
C:\WINDOWS\system32\klkkj.ini2
C:\WINDOWS\system32\tmp3C.tmp
C:\WINDOWS\system32\tmp3D.tmp
C:\WINDOWS\system32\tmp3E.tmp

.
((((((((((((((((((((((((( Files Created from 2007-12-05 to 2008-01-05 )))))))))))))))))))))))))))))))
.

2008-01-05 02:51 . 2008-01-05 02:51 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\AVG7
2008-01-05 02:51 . 2008-01-05 02:52 <DIR> d-------- C:\Documents and Settings\Greg\Application Data\AVG7
2008-01-05 02:51 . 2008-01-05 02:51 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-01-05 02:51 . 2008-01-05 02:52 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg7
2008-01-04 22:38 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-04 22:35 . 2008-01-04 22:35 <DIR> d-------- C:\Program Files\Trend Micro
2008-01-04 14:46 . 2008-01-04 14:46 <DIR> d-------- C:\Documents and Settings\Greg\Application Data\InstallShield Installation Information
2008-01-04 14:35 . 2008-01-04 14:35 <DIR> d-------- C:\Program Files\Unreal Tournament 3
2008-01-04 14:34 . 2008-01-04 14:34 <DIR> d-------- C:\WINDOWS\system32\AGEIA
2008-01-04 14:34 . 2008-01-04 14:34 <DIR> d-------- C:\Program Files\AGEIA Technologies
2008-01-04 13:46 . 2007-06-13 10:08 1,174,528 --a------ C:\WINDOWS\system32\drivers\P17xfi.sys
2008-01-04 13:46 . 2006-06-02 11:08 197,632 --a------ C:\WINDOWS\SF32.exe
2008-01-04 13:46 . 2003-04-02 07:13 139,264 --a------ C:\WINDOWS\system32\EAX.DLL
2008-01-04 13:46 . 2006-01-25 14:55 137,728 --a------ C:\WINDOWS\system32\P17res.dll
2008-01-04 13:46 . 2003-10-02 18:48 53,248 --a------ C:\WINDOWS\system32\P17CPI.dll
2008-01-04 13:46 . 2006-07-03 12:55 53,248 --a------ C:\WINDOWS\resdef.exe
2008-01-04 13:46 . 2004-12-22 19:58 8,704 --a------ C:\WINDOWS\system32\drivers\Pfmodnt.sys
2008-01-04 13:46 . 2006-08-23 18:47 8,251 --a------ C:\WINDOWS\sfsyn.ini
2008-01-03 15:24 . 2008-01-03 15:24 <DIR> d-------- C:\Documents and Settings\Greg\Application Data\Talkback
2008-01-03 15:24 . 2008-01-03 15:24 0 --a------ C:\WINDOWS\nsreg.dat
2008-01-02 19:56 . 2008-01-02 19:56 <DIR> d-------- C:\WINDOWS\system32\Futuremark
2008-01-02 19:56 . 2004-10-25 20:02 21,664 --a------ C:\WINDOWS\system32\drivers\Entech.sys
2008-01-02 19:56 . 1999-11-02 10:01 6,173 --a------ C:\WINDOWS\system32\drivers\Entech.vxd
2008-01-02 19:56 . 2004-06-22 15:44 5,632 --a------ C:\WINDOWS\system32\drivers\Entech64.sys
2008-01-02 19:56 . 2001-11-19 19:05 3,972 --a------ C:\WINDOWS\system32\drivers\PciBus.sys
2008-01-02 19:55 . 2008-01-02 19:55 <DIR> d-------- C:\Program Files\Futuremark
2008-01-02 17:32 . 1999-09-22 23:18 2,167,684 --a------ C:\WINDOWS\system32\CT2MGM.SF2
2008-01-02 17:32 . 2008-01-04 14:55 584 --a------ C:\WINDOWS\system32\settingsbkup.sfm
2008-01-02 17:32 . 2008-01-04 14:55 584 --a------ C:\WINDOWS\system32\settings.sfm
2008-01-02 17:31 . 2008-01-04 13:48 <DIR> d-------- C:\Program Files\Creative
2008-01-02 17:31 . 2008-01-04 14:49 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Creative
2008-01-02 17:31 . 2006-11-28 02:14 782,336 -ra------ C:\WINDOWS\OALInst.exe
2008-01-02 17:31 . 2007-05-08 08:59 137,216 --a------ C:\WINDOWS\system32\OemSpi.dll
2008-01-02 17:31 . 2002-04-11 01:41 65,536 --a--c--- C:\WINDOWS\system32\dllcache\a3d.dll
2008-01-02 17:31 . 2002-04-11 01:41 65,536 --a------ C:\WINDOWS\system32\A3d.dll
2008-01-02 17:31 . 2005-06-15 11:07 11,264 --a------ C:\WINDOWS\InRes.DLL
2008-01-02 17:31 . 2006-07-03 12:43 10,752 --a------ C:\WINDOWS\system32\SPIRun.dll
2008-01-02 17:31 . 2007-07-02 11:45 990 --a------ C:\WINDOWS\SB0790.reg
2008-01-02 17:31 . 2007-07-02 11:45 986 --a------ C:\WINDOWS\SB0792.reg
2008-01-02 17:31 . 2008-01-04 13:47 935 -rah----- C:\WINDOWS\ctfile.rfc
2008-01-02 17:02 . 2008-01-02 17:02 <DIR> d-------- C:\Program Files\NVIDIA Corporation
2008-01-02 16:47 . 2008-01-02 16:47 <DIR> d-------- C:\Program Files\Windows Defender
2008-01-02 14:46 . 2008-01-02 14:46 13,646 --a------ C:\WINDOWS\system32\wpa.bak
2008-01-02 14:38 . 2008-01-02 14:38 <DIR> d-------- C:\Program Files\Lavasoft
2008-01-02 14:38 . 2008-01-04 14:34 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-01-02 14:38 . 2008-01-02 14:38 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-01-01 02:07 . 2001-08-17 13:59 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys
2008-01-01 02:06 . 2004-08-03 22:59 57,472 --a------ C:\WINDOWS\system32\drivers\redbook.sys
2008-01-01 02:04 . 2007-12-31 21:10 <DIR> dr------- C:\Documents and Settings\All Users\Documents
2008-01-01 02:04 . 2006-02-28 12:00 176,157 --a--c--- C:\WINDOWS\system32\dllcache\dgrpsetu.dll
2008-01-01 02:03 . 2006-02-28 12:00 14,573 -ra------ C:\WINDOWS\SET25.tmp
2008-01-01 02:01 . 2007-12-31 18:19 261 --a------ C:\WINDOWS\system32\$winnt$.inf
2008-01-01 02:01 . 2007-12-31 18:13 211 ---hs---- C:\boot.ini
2007-12-31 23:05 . 2007-12-31 23:05 <DIR> d-------- C:\WINDOWS\system32\Lang
2007-12-31 23:05 . 2007-12-31 23:05 940,794 --a------ C:\WINDOWS\system32\LoopyMusic.wav
2007-12-31 23:05 . 2007-12-31 23:05 146,650 --a------ C:\WINDOWS\system32\BuzzingBee.wav
2007-12-31 22:44 . 2007-12-31 22:44 <DIR> d-------- C:\Program Files\Common Files\Blizzard Entertainment
2007-12-31 22:43 . 2007-12-31 22:44 <DIR> d-------- C:\WINDOWS\system32\RTCOM
2007-12-31 22:43 . 2007-12-31 22:43 <DIR> d-------- C:\Program Files\Realtek
2007-12-31 22:26 . 2007-12-31 23:51 <DIR> d-------- C:\Program Files\World of Warcraft
2007-12-31 22:17 . 2004-08-03 23:10 61,056 --a------ C:\WINDOWS\system32\drivers\ohci1394.sys
2007-12-31 22:17 . 2004-08-03 23:10 61,056 --a--c--- C:\WINDOWS\system32\dllcache\ohci1394.sys
2007-12-31 22:17 . 2004-08-03 23:10 53,248 --a------ C:\WINDOWS\system32\drivers\1394bus.sys
2007-12-31 22:17 . 2004-08-03 23:10 53,248 --a--c--- C:\WINDOWS\system32\dllcache\1394bus.sys
2007-12-31 22:17 . 2001-08-17 13:46 6,400 --a------ C:\WINDOWS\system32\drivers\enum1394.sys
2007-12-31 22:17 . 2001-08-17 13:46 6,400 --a--c--- C:\WINDOWS\system32\dllcache\enum1394.sys
2007-12-31 21:42 . 2006-12-08 15:20 10,528,768 --a------ C:\WINDOWS\system32\RTLCPL.exe
2007-12-31 21:42 . 2007-10-26 11:20 4,124,352 -ra------ C:\WINDOWS\system32\drivers\alcxwdm.sys
2007-12-31 21:42 . 2005-09-21 02:25 299,008 --a------ C:\WINDOWS\system32\ALSndMgr.Cpl
2007-12-31 21:42 . 2002-02-05 13:54 141,016 --a------ C:\WINDOWS\system32\alsndmgr.wav
2007-12-31 21:42 . 2006-07-21 08:14 86,016 --a------ C:\WINDOWS\SoundMan.exe
2007-12-31 21:42 . 2006-08-01 07:02 49,152 --a------ C:\WINDOWS\system32\ChCfg.exe
2007-12-31 21:39 . 2007-12-31 21:39 <DIR> d-------- C:\Program Files\Realtek AC97
2007-12-31 21:39 . 2006-07-31 11:19 315,392 --a------ C:\WINDOWS\alcupd.exe
2007-12-31 21:39 . 2006-07-31 11:27 217,088 --a------ C:\WINDOWS\alcrmv.exe
2007-12-31 20:53 . 2007-12-31 20:53 <DIR> d-------- C:\WINDOWS\nview
2007-12-31 20:53 . 2007-12-31 20:53 <DIR> d-------- C:\NVIDIA
2007-12-31 20:53 . 2007-12-05 01:41 356,352 --a------ C:\WINDOWS\system32\nvudisp.exe
2007-12-31 20:53 . 2008-01-04 14:57 163,353 --a------ C:\WINDOWS\system32\nvapps.xml
2007-12-31 20:53 . 2007-12-05 01:41 17,737 --a------ C:\WINDOWS\system32\nvdisp.nvu
2007-12-31 20:37 . 2008-01-05 03:03 1,818,656 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2007-12-31 20:37 . 2008-01-05 03:01 22,340 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2007-12-31 20:35 . 2007-12-31 20:35 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\MailFrontier
2007-12-31 20:34 . 2008-01-01 23:06 <DIR> d-------- C:\Documents and Settings\Greg\Contacts
2007-12-31 20:01 . 2008-01-04 14:34 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
2007-12-31 19:56 . 2007-12-31 20:01 <DIR> d-------- C:\Program Files\Windows Live
2007-12-31 19:56 . 2007-12-31 20:01 <DIR> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller
2007-12-31 19:56 . 2007-12-31 19:56 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
2007-12-31 19:36 . 2005-06-28 10:21 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2007-12-31 19:34 . 2007-07-30 19:19 43,352 --a------ C:\WINDOWS\system32\wups2.dll
2007-12-31 19:34 . 2007-07-30 19:18 34,136 --a------ C:\WINDOWS\system32\wucltui.dll.mui
2007-12-31 19:34 . 2007-07-30 19:19 25,944 --a------ C:\WINDOWS\system32\wuaucpl.cpl.mui
2007-12-31 19:34 . 2007-07-30 19:19 25,944 --a------ C:\WINDOWS\system32\wuapi.dll.mui
2007-12-31 19:34 . 2007-07-30 19:18 20,312 --a------ C:\WINDOWS\system32\wuaueng.dll.mui
2007-12-31 19:33 . 2007-12-31 19:33 <DIR> d---s---- C:\Documents and Settings\Greg\UserData
2007-12-31 19:27 . 2007-12-31 19:27 <DIR> d-------- C:\Program Files\Thomson
2007-12-31 19:27 . 2008-01-04 13:46 <DIR> d--h----- C:\Program Files\InstallShield Installation Information
2007-12-31 19:27 . 2003-12-08 11:53 70,688 --a------ C:\WINDOWS\system32\drivers\alcaudsl.sys
2007-12-31 19:27 . 2003-12-08 11:53 53,600 --a------ C:\WINDOWS\system32\drivers\alcan5wn.sys
2007-12-31 19:27 . 2003-12-08 11:53 5,606 --a------ C:\WINDOWS\system32\stci.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-04 13:47 409,600 ----a-w C:\WINDOWS\system32\wrap_oal.dll
2008-01-04 13:47 114,688 ----a-w C:\WINDOWS\system32\OpenAL32.dll
2008-01-02 17:01 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-01-02 15:51 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-01-01 17:08 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-12-31 18:53 --------- d-----w C:\Program Files\MSBuild
2007-12-31 18:53 --------- d-----w C:\Program Files\Microsoft Works
2007-12-31 18:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\WinZip
2007-12-31 18:17 --------- d-----w C:\Program Files\microsoft frontpage
2007-12-05 02:53 356,352 ----a-w C:\WINDOWS\system32\NVUNINST.EXE
2007-12-05 01:41 81,920 ----a-w C:\WINDOWS\system32\nvwddi.dll
2007-12-05 01:41 81,920 ----a-w C:\WINDOWS\system32\nvmctray.dll
2007-12-05 01:41 8,523,776 ----a-w C:\WINDOWS\system32\nvcpl.dll
2007-12-05 01:41 753,664 ----a-w C:\WINDOWS\system32\nvcplui.exe
2007-12-05 01:41 7,435,392 ----a-w C:\WINDOWS\system32\drivers\nv4_mini.sys
2007-12-05 01:41 6,901,760 ----a-w C:\WINDOWS\system32\nvoglnt.dll
2007-12-05 01:41 6,549,504 ----a-w C:\WINDOWS\system32\nvdisps.dll
2007-12-05 01:41 5,773,568 ----a-w C:\WINDOWS\system32\nv4_disp.dll
2007-12-05 01:41 5,611,520 ----a-w C:\WINDOWS\system32\nvdispsr.dll
2007-12-05 01:41 466,944 ----a-w C:\WINDOWS\system32\nvshell.dll
2007-12-05 01:41 458,752 ----a-w C:\WINDOWS\system32\nvmccssr.dll
2007-12-05 01:41 45,056 ----a-w C:\WINDOWS\system32\nvmccsrs.dll
2007-12-05 01:41 442,368 ----a-w C:\WINDOWS\system32\nvappbar.exe
2007-12-05 01:41 425,984 ----a-w C:\WINDOWS\system32\keystone.exe
2007-12-05 01:41 385,024 ----a-w C:\WINDOWS\system32\nvapi.dll
2007-12-05 01:41 35,328 ----a-w C:\WINDOWS\system32\nvcodins.dll
2007-12-05 01:41 35,328 ----a-w C:\WINDOWS\system32\nvcod.dll
2007-12-05 01:41 335,872 ----a-w C:\WINDOWS\system32\nvwrses.dll
2007-12-05 01:41 335,872 ----a-w C:\WINDOWS\system32\nvwrsel.dll
2007-12-05 01:41 327,680 ----a-w C:\WINDOWS\system32\nvwrsfr.dll
2007-12-05 01:41 327,680 ----a-w C:\WINDOWS\system32\nvwrsesm.dll
2007-12-05 01:41 327,680 ----a-w C:\WINDOWS\system32\nvrshe.dll
2007-12-05 01:41 327,680 ----a-w C:\WINDOWS\system32\nvrsar.dll
2007-12-05 01:41 323,584 ----a-w C:\WINDOWS\system32\nvwrspt.dll
2007-12-05 01:41 323,584 ----a-w C:\WINDOWS\system32\nvwrsit.dll
2007-12-05 01:41 319,488 ----a-w C:\WINDOWS\system32\nvwrsptb.dll
2007-12-05 01:41 319,488 ----a-w C:\WINDOWS\system32\nvwrsnl.dll
2007-12-05 01:41 315,392 ----a-w C:\WINDOWS\system32\nvwrsru.dll
2007-12-05 01:41 315,392 ----a-w C:\WINDOWS\system32\nvwrshu.dll
2007-12-05 01:41 311,296 ----a-w C:\WINDOWS\system32\nvwrsde.dll
2007-12-05 01:41 307,200 ----a-w C:\WINDOWS\system32\nvexpbar.dll
2007-12-05 01:41 303,104 ----a-w C:\WINDOWS\system32\nvwrstr.dll
2007-12-05 01:41 303,104 ----a-w C:\WINDOWS\system32\nvwrssl.dll
2007-12-05 01:41 303,104 ----a-w C:\WINDOWS\system32\nvwrsfi.dll
2007-12-05 01:41 3,715,072 ----a-w C:\WINDOWS\system32\nvvitvsr.dll
2007-12-05 01:41 3,710,976 ----a-w C:\WINDOWS\system32\nvvitvs.dll
2007-12-05 01:41 3,420,160 ----a-w C:\WINDOWS\system32\nvgames.dll
2007-12-05 01:41 3,334,144 ----a-w C:\WINDOWS\system32\nvgamesr.dll
2007-12-05 01:41 299,008 ----a-w C:\WINDOWS\system32\nvwrssk.dll
2007-12-05 01:41 299,008 ----a-w C:\WINDOWS\system32\nvwrsno.dll
2007-12-05 01:41 294,912 ----a-w C:\WINDOWS\system32\nvwrssv.dll
2007-12-05 01:41 294,912 ----a-w C:\WINDOWS\system32\nvwrspl.dll
2007-12-05 01:41 294,912 ----a-w C:\WINDOWS\system32\nvwrsda.dll
2007-12-05 01:41 290,816 ----a-w C:\WINDOWS\system32\nvwrsth.dll
2007-12-05 01:41 286,720 ----a-w C:\WINDOWS\system32\nvwrseng.dll
2007-12-05 01:41 286,720 ----a-w C:\WINDOWS\system32\nvwrscs.dll
2007-12-05 01:41 286,720 ----a-w C:\WINDOWS\system32\nvnt4cpl.dll
2007-12-05 01:41 282,624 ----a-w C:\WINDOWS\system32\nvwrsar.dll
2007-12-05 01:41 282,624 ----a-w C:\WINDOWS\system32\nvrsfr.dll
2007-12-05 01:41 282,624 ----a-w C:\WINDOWS\system32\nvrses.dll
2007-12-05 01:41 282,624 ----a-w C:\WINDOWS\system32\nvrsel.dll
2007-12-05 01:41 278,528 ----a-w C:\WINDOWS\system32\nvwrshe.dll
2007-12-05 01:41 278,528 ----a-w C:\WINDOWS\system32\nvrsit.dll
2007-12-05 01:41 278,528 ----a-w C:\WINDOWS\system32\nvrsde.dll
2007-12-05 01:41 274,432 ----a-w C:\WINDOWS\system32\nvrspt.dll
2007-12-05 01:41 274,432 ----a-w C:\WINDOWS\system32\nvrsnl.dll
2007-12-05 01:41 274,432 ----a-w C:\WINDOWS\system32\nvrsesm.dll
2007-12-05 01:41 270,336 ----a-w C:\WINDOWS\system32\nvrsru.dll
2007-12-05 01:41 266,240 ----a-w C:\WINDOWS\system32\nvrsptb.dll
2007-12-05 01:41 266,240 ----a-w C:\WINDOWS\system32\nvrsja.dll
2007-12-05 01:41 258,048 ----a-w C:\WINDOWS\system32\nvrstr.dll
2007-12-05 01:41 258,048 ----a-w C:\WINDOWS\system32\nvrssl.dll
2007-12-05 01:41 258,048 ----a-w C:\WINDOWS\system32\nvrssk.dll
2007-12-05 01:41 258,048 ----a-w C:\WINDOWS\system32\nvrsko.dll
2007-12-05 01:41 258,048 ----a-w C:\WINDOWS\system32\nvrshu.dll
2007-12-05 01:41 253,952 ----a-w C:\WINDOWS\system32\nvrsth.dll
2007-12-05 01:41 253,952 ----a-w C:\WINDOWS\system32\nvrssv.dll
2007-12-05 01:41 253,952 ----a-w C:\WINDOWS\system32\nvrspl.dll
2007-12-05 01:41 253,952 ----a-w C:\WINDOWS\system32\nvrsno.dll
2007-12-05 01:41 253,952 ----a-w C:\WINDOWS\system32\nvrsda.dll
2007-12-05 01:41 249,856 ----a-w C:\WINDOWS\system32\nvrsfi.dll
2007-12-05 01:41 249,856 ----a-w C:\WINDOWS\system32\nvrscs.dll
2007-12-05 01:41 245,760 ----a-w C:\WINDOWS\system32\nvrseng.dll
2007-12-05 01:41 229,376 ----a-w C:\WINDOWS\system32\nvmccs.dll
2007-12-05 01:41 225,280 ----a-w C:\WINDOWS\system32\nvrszhc.dll
2007-12-05 01:41 212,992 ----a-w C:\WINDOWS\system32\nvwrsja.dll
2007-12-05 01:41 2,854,912 ----a-w C:\WINDOWS\system32\nvmoblsr.dll
2007-12-05 01:41 2,519,040 ----a-w C:\WINDOWS\system32\nvwssr.dll
2007-12-05 01:41 2,498,560 ----a-w C:\WINDOWS\system32\nvwss.dll
2007-12-05 01:41 196,608 ----a-w C:\WINDOWS\system32\nvwrsko.dll
2007-12-05 01:41 188,416 ----a-w C:\WINDOWS\system32\nvmccss.dll
2007-12-05 01:41 167,936 ----a-w C:\WINDOWS\system32\nvwrszht.dll
2007-12-05 01:41 163,840 ----a-w C:\WINDOWS\system32\nvwrszhc.dll
2007-12-05 01:41 155,716 ----a-w C:\WINDOWS\system32\nvsvc32.exe
2007-12-05 01:41 147,456 ----a-w C:\WINDOWS\system32\nvcolor.exe
2007-12-05 01:41 126,976 ----a-w C:\WINDOWS\system32\nvrszht.dll
2007-12-05 01:41 1,703,936 ----a-w C:\WINDOWS\system32\nvwdmcpl.dll
2007-12-05 01:41 1,626,112 ----a-w C:\WINDOWS\system32\nwiz.exe
2007-12-05 01:41 1,474,560 ----a-w C:\WINDOWS\system32\nview.dll
2007-12-05 01:41 1,339,392 ----a-w C:\WINDOWS\system32\nvdspsch.exe
.

((((((((((((((((((((((((((((( snapshot@2008-01-04_22.47.21.04 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-01-05 02:51:09 821,856 ----a-w C:\WINDOWS\system32\drivers\avg7core.sys
+ 2008-01-05 02:51:12 4,224 ----a-w C:\WINDOWS\system32\drivers\avg7rsw.sys
+ 2008-01-05 02:51:13 27,776 ----a-w C:\WINDOWS\system32\drivers\avg7rsxp.sys
+ 2008-01-05 02:51:13 10,760 ----a-w C:\WINDOWS\system32\drivers\avgclean.sys
+ 2008-01-05 02:51:13 26,952 ----a-w C:\WINDOWS\system32\drivers\avgmfx86.sys
- 2008-01-04 14:57:57 40,452 ----a-w C:\WINDOWS\system32\perfc009.dat
+ 2008-01-04 22:50:13 40,452 ----a-w C:\WINDOWS\system32\perfc009.dat
- 2008-01-04 14:57:57 312,616 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2008-01-04 22:50:13 312,616 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2008-01-05 03:03:00 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_128.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2006-02-28 12:00 15360]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 16:24 1694208]
"NVIDIA nTune"="C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" [2007-07-03 12:32 81920]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 07:00 33648]
"SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 11:38 866816]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-11-14 16:05 919016]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776]
"nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920]
"RTHDCPL"="RTHDCPL.EXE" [2006-11-14 09:21 16270848 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 10:04 2879488 C:\WINDOWS\SkyTel.exe]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20 866584]
"P17Helper"="SPIRun.dll" [2006-07-03 12:43 10752 C:\WINDOWS\system32\SPIRun.dll]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-01-05 02:51 579072]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2006-02-28 12:00 15360]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-01-05 02:51 219136]

R3 P17xfi;Sound Blaster X-Fi Xtreme Audio;C:\WINDOWS\system32\drivers\P17xfi.sys [2007-06-13 10:08]
R3 p17xfilt;p17xfilt;C:\WINDOWS\system32\drivers\p17xfilt.sys [2007-08-20 13:35]

.
Contents of the 'Scheduled Tasks' folder
"2008-01-05 02:27:21 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-05 03:03:31
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-05 3:04:29 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-05 03:04:26
ComboFix2.txt 2008-01-04 22:47:49


--

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Saturday, January 05, 2008 12:16:09 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 5/01/2008
Kaspersky Anti-Virus database records: 502957
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\

Scan Statistics:
Total number of scanned objects: 31334
Number of viruses found: 0
Number of infected objects: 0
Number of suspicious objects: 0
Duration of the scan process: 00:28:09

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Support\MPLog-01022008-164747.log Object is locked skipped
C:\Documents and Settings\Greg\Application Data\Mozilla\Firefox\Profiles\o77fml37.default\cert8.db Object is locked skipped
C:\Documents and Settings\Greg\Application Data\Mozilla\Firefox\Profiles\o77fml37.default\history.dat Object is locked skipped
C:\Documents and Settings\Greg\Application Data\Mozilla\Firefox\Profiles\o77fml37.default\key3.db Object is locked skipped
C:\Documents and Settings\Greg\Application Data\Mozilla\Firefox\Profiles\o77fml37.default\parent.lock Object is locked skipped
C:\Documents and Settings\Greg\Application Data\Mozilla\Firefox\Profiles\o77fml37.default\search.sqlite Object is locked skipped
C:\Documents and Settings\Greg\Application Data\Mozilla\Firefox\Profiles\o77fml37.default\urlclassifier2.sqlite Object is locked skipped
C:\Documents and Settings\Greg\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Greg\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Greg\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Greg\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{FBA7CDE9-2407-4249-A2B2-F4D9427F2D86} Object is locked skipped
C:\Documents and Settings\Greg\Local Settings\Application Data\Mozilla\Firefox\Profiles\o77fml37.default\Cache\_CACHE_001_ Object is locked skipped
C:\Documents and Settings\Greg\Local Settings\Application Data\Mozilla\Firefox\Profiles\o77fml37.default\Cache\_CACHE_002_ Object is locked skipped
C:\Documents and Settings\Greg\Local Settings\Application Data\Mozilla\Firefox\Profiles\o77fml37.default\Cache\_CACHE_003_ Object is locked skipped
C:\Documents and Settings\Greg\Local Settings\Application Data\Mozilla\Firefox\Profiles\o77fml37.default\Cache\_CACHE_MAP_ Object is locked skipped
C:\Documents and Settings\Greg\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Greg\Local Settings\History\History.IE5\MSHist012008010520080106\index.dat Object is locked skipped
C:\Documents and Settings\Greg\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Greg\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Greg\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Greg\UserData\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{F147754A-8D31-43E9-A141-A4A8D1D2631C}\RP26\A0005838.dll Object is locked skipped
C:\System Volume Information\_restore{F147754A-8D31-43E9-A141-A4A8D1D2631C}\RP30\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\Internet Logs\CILITBANG.ldb Object is locked skipped
C:\WINDOWS\Internet Logs\fwdbglog.txt Object is locked skipped
C:\WINDOWS\Internet Logs\fwpktlog.txt Object is locked skipped
C:\WINDOWS\Internet Logs\IAMDB.RDB Object is locked skipped
C:\WINDOWS\Internet Logs\tvDebug.log Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\ODiag.evt Object is locked skipped
C:\WINDOWS\system32\config\OSession.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\drivers\fidbox.dat Object is locked skipped
C:\WINDOWS\system32\drivers\fidbox.idx Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\Temp\Perflib_Perfdata_710.dat Object is locked skipped
C:\WINDOWS\Temp\ZLT04b68.TMP Object is locked skipped
C:\WINDOWS\Temp\ZLT051ef.TMP Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.

--

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:17:10, on 05/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [P17Helper] Rundll32 SPIRun.dll,RunDLLEntry
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1199129618901
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1199285434718
O17 - HKLM\System\CCS\Services\Tcpip\..\{AFBE4B11-EE14-4F37-B1C8-0E46CD28BB7E}: NameServer = 212.139.132.53 212.139.132.52
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 5662 bytes


I'm now using AVG 7.5. I didn't have an Anti-Virus before, kind of slipped my mind for things to do when installing my new machine.

PC is running smoother, no longer getting that pop-up I showed a screenshot of, and I'm using Firefox as opposed to previous IE6, which seems more secure.

Can I ask, do you know what caused the problems with my PC? :) Just I didn't really expect any issues with it.

[MoralTerror]

Originally Posted by Kondora

Can I ask, do you know what caused the problems with my PC?

I'm pretty certain it was this

Originally Posted by Kondora

I didn't have an Anti-Virus before, kind of slipped my mind for things to do when installing my new machine.

It's digital suicide even connecting without an Anti-Virus. but give yourself gold star for installing Firefox. Almost every exploit is crafted to target an IE weakness so Firefox is more secure.

You were infected by Vundo trojan aka Virtumonde. Vundo may have allowed remote access or keylogging to take place. It would be a good idea to change all your passwords from a clean computer (preferably not this 1). Especially if you do online banking or shopping etc.

Your logs are clean. If there are no more issues you should be good to go.

Kindly follow these simple steps in order to keep your computer clean and secure:

1. UNINSTALL COMBOFIX
   This process will also perform some final cleanup steps
   Click Start > Run and type ComboFix /u
   
   
   
2. ANTIVIRUS SOFTWARE
   It is very important that you have anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future.
   
   See this link for a listing of some online & their stand-alone antivirus programs:
   
   Virus, Spyware, and Malware Protection and Removal Resources
   
   It is imperative that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
   
   
   
3. FIREWALL
   Without a firewall your computer is succeptible to being hacked and taken over. Simply using a Firewall in its default configuration can lower your risk greatly. A tutorial on Firewalls and a listing of some available ones can be found here.
   
   
   
4. Microsoft Windows Update
   Visit windowsupdate.com regularly. This will ensure your computer always has the latest security updates. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
   
   
   
5. SPYBOT - SEARCH & DESTROY
   Download and install Spybot - Search & Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with the program on a regular basis just as you would an antivirus software. A tutorial on installing & using this product can be found here
   
   
   
6. AD-AWARE
   Download and install Ad-Aware. You should use this program to scan your computer on a regular basis just as you would an antivirus software in conjunction with Spybot. A tutorial on installing & using this product can be found here

Update all these programs regularly. Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.

Follow this list and your potential for being infected again will reduce dramatically. Here are some additional utilities that will further enhance your safety.

• Trillian or Miranda-IM - These are Malware free Instant Messenger programs which allow you to connect to multiple IM services in one program! (AOL, Yahoo, ICQ, IRC, MSN)
  
  
• Firefox - Use this alternate browser. Whilst Internet Explorer is not a bad browser, almost every exploit crafted is targeted to take advantage of an IE weakness.
  
  
• Sun's Java - It's much more secure than Microsoft's Java Virtual Machine.
  
  
• Google Toolbar - Get the free google toolbar to help stop pop up windows.
  
  
• CleanUP! - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.
  
  
• ERUNT - A useful freeware utility for users of Windows 2000/XP. It's made up of two parts - ERUNT & NTREGOPT.
  
  ERUNT will create daily complete backups of your computer's Registry. Whilst System Restore does the same thing, a corrupt registry file may prevent Windows from booting & this effectively renders disables System Restore. With ERUNT, you're able to restore the damaged Registry.
  
  NTREGOPT works by recreating each registry hive "from scratch", thus removing any slack space that may be left from previously modified or deleted keys. In other words, it compacts the Registry to a small size which allows Windows to load & perform faster.
  
  
• Winpatrol - Download and install the free version of Winpatrol.
  A tutorial for this product is located here:
  Using Winpatrol to protect your computer from malicious software

To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections you can read this article by Tony Klein

After doing all these, your system will be optimised against future threats.

It's okay to delete the Hijack This folder in a couple weeks if everything is working okay.
Have a safe & happy computing day.

Please respond to this thread one more time so we can mark this thread as resolved.

[Kondora]

Thank you, works perfectly again. Will continue to use the Anti-Virus plus what I was already using, pretty certain I'll stay safe now.

Thanks again.