slow pc

salt_and_pepper

Hi i would be grateful for any help as our pc is running very slow- i'm no expert so if you could keep it in simple terms please. Its a vista, 2gb. I have got rid of programmes that we don't use, defragged, gone through c clean, nothing shows up on anti virus- virgin pc guard. run windows defender. What should i do next? oh and we usually use mozilla

thanks in advance

aliEnRIK

First up ~ PC Guard is absolutely awful

Anyways ~
Download MALWAREBYTES (Make sure you click 'DOWNLOAD NOW')
http://www.download.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html
UPDATE and FULL SCAN
Post the log here AFTER youve deleted everything it finds


reboot

Download HIJACK THIS (Make sure you click 'DOWNLOAD LATEST VERSION')
http://www.filehippo.com/download_hijackthis/
Click DO A SCAN AND SAVE A LOGFILE (Takes seconds) then post the log so we can see whats running
(do NOT do anything else with Hijack but scan and post the FULL log)

salt_and_pepper

i Malwarebytes' Anti-Malware 1.36
Database version: 2144
Windows 6.0.6001 Service Pack 1

17/05/2009 12:08:48
mbam-log-2009-05-17 (12-08-48).txt

Scan type: Full Scan (C:\|D:\|E:\|F:\|G:\|H:\|I:\|)
Objects scanned: 390361
Time elapsed: 2 hour(s), 26 minute(s), 25 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 6
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 4

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3ba4271e-5c1e-48e2-b432-d8bf420dd31d} (Rogue.DeusCleaner) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1a93c934-025b-4c3a-b38e-9654a7003239} (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6f282b65-56bf-4bd1-a8b2-a4449a05863d} (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmds (Malware.Trace) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Users\greg\Local Settings\Application Data\qcfxbf_navps.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
C:\Users\greg\Local Settings\Application Data\qcfxbf_nav.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
C:\Users\greg\Local Settings\Application Data\qcfxbf.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
C:\Users\greg\Local Settings\Application Data\qcfxbf.exe (Adware.Navipromo.H) -> Quarantined and deleted successfully.
have done the first one.

salt_and_pepper

i can't post the 2nd log as it has links in it. i can't send it by ping as it is too long. Any ideas?

aliEnRIK

change the links to hXXp

salt_and_pepper

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:26:57, on 17/05/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18226)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\WindowsMobile\wmdc.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Creative\SBAudigy\Volume Panel\VolPanlu.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Lexmark 1200 Series\LXCZbmgr.exe
C:\Program Files\Virgin Broadband\advisor\Broadbandadvisor.exe
C:\Program Files\Virgin Broadband\PCguard\RPS.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\Lexmark 1200 Series\lxczbmon.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Virgin Broadband\advisor\BroadbandadvisorComHandler.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by Dell
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O1 - Hosts: ::1 localhost
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: PopKill Class - {3C060EA2-E6A9-4E49-A530-D4657B8C449A} - C:\Program Files\Virgin Broadband\PCguard\pkR.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\SBAudigy\Volume Panel\VolPanlu.exe" /r
O4 - HKLM\..\Run: [UpdReg] C:\Windows\UpdReg.EXE
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [lxczbmgr.exe] "C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe"
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [Broadbandadvisor.exe] "C:\Program Files\Virgin Broadband\advisor\Broadbandadvisor.exe" /AUTORUN
O4 - HKLM\..\Run: [PCguard] "C:\Program Files\Virgin Broadband\PCguard\Rps.exe"
O4 - HKLM\..\Run: [-FreedomNeedsReboot] "C:\Program Files\Virgin Broadband\PCguard\ZkRunOnceR.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [MSServer] rundll32.exe C:\Users\greg\AppData\Local\Temp\pmnnKBRj.dll,#1
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\RunOnce: [IndexCleaner] "C:\Program Files\Virgin Broadband\PCguard\IdxClnR.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix:
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\Windows\system32\CTsvcCDA.exe
O23 - Service: CopySafe Helper Service (CSHelper) - Unknown owner - C:\Windows\system32\CSHelper.exe
O23 - Service: DvpApi (dvpapi) - Authentium, Inc. - C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.vista.exe
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
O23 - Service: lxcz_device - - C:\Windows\system32\lxczcoms.exe
O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: Virgin Broadband PCguard Update Service (RPSUpdaterR) - Radialpoint Inc. - C:\Program Files\Virgin Broadband\PCguard\rpsupdaterR.exe
O23 - Service: PCguard Firewall (RP_FWS) - Virgin Media - C:\Program Files\Virgin Broadband\PCguard\Fws.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe

--
End of file - 11861 bytes

i have had to delete the links- putting hXXp wouldn't work either

aliEnRIK

TICK these in hijack then FIX them ~
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = *.local
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKCU\..\Run: [MSServer] rundll32.exe C:\Users\greg\AppData\Local\Temp\pmnnKBRj.dll,#1

Then run a KASPERSKY ONLINE SCAN (click to scan 'MY COMPUTER')
http://www.kaspersky.co.uk/virusscanner
Please post the complete log it creates

salt_and_pepper

eventually i have ran the kaspersky through. the PC is already running faster. This is the logSunday, May 17, 2009
Operating System: Microsoft Windows Vista Home Premium Edition, 32-bit Service Pack 1 (build 6001)
Kaspersky Online Scanner version: 7.0.26.13
Program database last update: Sunday, May 17, 2009 15:07:02
Records in database: 2188320

Scan settings Scan using the following database extended Scan archives yes Scan mail databases yes
Scan area My Computer C:\
\
E:\
F:\
G:\
H:\
I:\
Scan statistics Files scanned 303152 Threat name 3 Infected objects 12 Suspicious objects 0 Duration of the scan 03:45:08
File name Threat name Threats count C:\Program Files\Circle Developement\Uninstall.exeInfected: Trojan.Win32.Obfuscated.abcn1

C:\Program Files\Shockwave.com\Fashion Craze\Fashion Craze.exeInfected: Backdoor.Win32.Rbot.aaar1

C:\ProgramData\exit size\Filmplatformfunk.exeInfected: Trojan.Win32.Swizzor.a1

C:\ProgramData\exit size\iqanunvn.exeInfected: Trojan.Win32.Swizzor.a1

C:\ProgramData\exit size\list peak 4 pile.exeInfected: Trojan.Win32.Swizzor.a1

C:\ProgramData\exit size\rvwjrpaq.exeInfected: Trojan.Win32.Swizzor.a1

C:\ProgramData\Part Hide Grey Pop\cool support.exeInfected: Trojan.Win32.Swizzor.a1

C:\Users\All Users\exit size\Filmplatformfunk.exeInfected: Trojan.Win32.Swizzor.a1

C:\Users\All Users\exit size\iqanunvn.exeInfected: Trojan.Win32.Swizzor.a1

C:\Users\All Users\exit size\list peak 4 pile.exeInfected: Trojan.Win32.Swizzor.a1

C:\Users\All Users\exit size\rvwjrpaq.exeInfected: Trojan.Win32.Swizzor.a1

C:\Users\All Users\Part Hide Grey Pop\cool support.exeInfected: Trojan.Win32.Swizzor.a1

The selected area was scanned.

aliEnRIK

Download COMBOFIX


Open notepad and copy/paste the text in RED below

File::
C:\Program Files\Circle Developement\Uninstall.exe
C:\Program Files\Shockwave.com\Fashion Craze\Fashion Craze.exe
C:\ProgramData\exit size\Filmplatformfunk.exe
C:\ProgramData\exit size\iqanunvn.exe
C:\ProgramData\exit size\list peak 4 pile.exe
C:\ProgramData\exit size\rvwjrpaq.exe
C:\ProgramData\Part Hide Grey Pop\cool support.exe
C:\Users\All Users\exit size\Filmplatformfunk.exe
C:\Users\All Users\exit size\iqanunvn.exe
C:\Users\All Users\exit size\list peak 4 pile.exe
C:\Users\All Users\exit size\rvwjrpaq.exe
C:\Users\All Users\Part Hide Grey Pop\cool support.exe

Save this as "CFScript"

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.




This will start ComboFix. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply

Combofix should never take more that 20 minutes including the reboot if malware is detected.
If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.

GunJack

....and remember to turn off Spybot's TeaTimer facility..that'll help

salt_and_pepper

ComboFix 09-05-17.03 - greg 18/05/2009 7:18.5 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.44.1033.18.2046.1045 [GMT 1:00]
Running from: c:\users\greg\Downloads\ComboFix.exe
Command switches used :: c:\users\greg\Documents\cfscript.txt
AV: PCguard Anti-Virus *On-access scanning disabled* (Updated) {5B5A3BD7-8573-4672-AEA8-C9BB713B6755}
FW: PCguard Firewall *disabled* {80593BF4-D969-4EC5-ADAE-A22F2DFC7A22}
SP: PCguard Anti-Spyware *disabled* (Updated) {307352C6-1CBD-11DB-8AF6-B622A1EF5492}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

FILE ::
c:\program files\Circle Developement\Uninstall.exe
c:\program files\Shockwave.com\Fashion Craze\Fashion Craze.exe
c:\programdata\exit size\Filmplatformfunk.exe
c:\programdata\exit size\iqanunvn.exe
c:\programdata\exit size\list peak 4 pile.exe
c:\programdata\exit size\rvwjrpaq.exe
c:\programdata\Part Hide Grey Pop\cool support.exe
c:\users\All Users\exit size\Filmplatformfunk.exe
c:\users\All Users\exit size\iqanunvn.exe
c:\users\All Users\exit size\list peak 4 pile.exe
c:\users\All Users\exit size\rvwjrpaq.exe
c:\users\All Users\Part Hide Grey Pop\cool support.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Circle Developement\Uninstall.exe
c:\program files\Shockwave.com\Fashion Craze\Fashion Craze.exe
c:\programdata\exit size\Filmplatformfunk.exe
c:\programdata\exit size\iqanunvn.exe
c:\programdata\exit size\list peak 4 pile.exe
c:\programdata\exit size\rvwjrpaq.exe
c:\programdata\Part Hide Grey Pop\cool support.exe

.
((((((((((((((((((((((((( Files Created from 2009-04-18 to 2009-05-18 )))))))))))))))))))))))))))))))
.

2009-05-18 05:31 . 2009-05-18 05:31

---

d

---

w C:\32788R22FWJFW.0.tmp
2009-05-17 11:25 . 2009-05-17 11:25

---

d

---

w c:\program files\Trend Micro
2009-05-17 08:36 . 2009-05-17 08:36

---

d

---

w c:\users\greg\AppData\Roaming\Malwarebytes
2009-05-17 08:36 . 2009-04-06 14:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-05-17 08:36 . 2009-04-06 14:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-17 08:36 . 2009-05-17 08:36

---

d

---

w c:\programdata\Malwarebytes
2009-05-17 08:36 . 2009-05-17 08:36

---

d

---

w c:\users\All Users\Malwarebytes
2009-05-17 08:36 . 2009-05-17 08:36

---

d

---

w c:\program files\Malwarebytes' Anti-Malware
2009-05-16 18:27 . 2008-04-12 03:32 784896 ----a-w c:\windows\system32\rpcrt4.dll
2009-05-16 18:27 . 2008-04-26 08:26 891448 ----a-w c:\windows\system32\drivers\tcpip.sys
2009-05-16 18:27 . 2008-04-05 01:21 72192 ----a-w c:\windows\system32\drivers\pacer.sys
2009-05-16 18:27 . 2008-04-05 03:34 15360 ----a-w c:\windows\system32\pacerprf.dll
2009-05-16 18:26 . 2008-06-26 03:29 565248 ----a-w c:\windows\system32\emdmgmt.dll
2009-05-16 18:26 . 2008-08-02 01:01 625152 ----a-w c:\windows\system32\drivers\dxgkrnl.sys
2009-05-16 18:26 . 2008-06-26 03:29 45056 ----a-w c:\windows\system32\dataclen.dll
2009-05-16 18:26 . 2008-05-20 02:07 148480 ----a-w c:\windows\system32\drivers\nwifi.sys
2009-05-16 18:26 . 2008-08-02 03:26 36864 ----a-w c:\windows\system32\cdd.dll
2009-05-16 18:06 . 2008-09-18 04:56 147456 ----a-w c:\windows\system32\Faultrep.dll
2009-05-16 18:06 . 2008-09-18 04:56 125952 ----a-w c:\windows\system32\wersvc.dll
2009-05-16 18:05 . 2008-05-08 21:59 430080 ----a-w c:\windows\system32\vbscript.dll
2009-05-16 18:05 . 2008-05-08 21:59 90112 ----a-w c:\windows\system32\wshext.dll
2009-05-16 18:05 . 2008-05-08 21:59 155648 ----a-w c:\windows\system32\wscript.exe
2009-05-16 18:05 . 2008-05-08 21:58 135168 ----a-w c:\windows\system32\cscript.exe
2009-05-16 18:05 . 2008-05-08 21:59 180224 ----a-w c:\windows\system32\scrobj.dll
2009-05-16 18:05 . 2008-05-08 21:59 172032 ----a-w c:\windows\system32\scrrun.dll
2009-05-16 12:05 . 2009-05-16 12:05

---

d

---

w C:\PerfLogs
2009-04-26 10:49 . 2009-04-26 10:49

---

d

---

w c:\programdata\WEBREG
2009-04-26 10:49 . 2009-04-26 10:49

---

d

---

w c:\users\All Users\WEBREG
2009-04-26 10:46 . 2009-04-26 10:46

---

d

---

w c:\users\greg\AppData\Roaming\HP
2009-04-26 10:46 . 2009-04-26 10:46

---

d

---

w c:\programdata\HPSSUPPLY
2009-04-26 10:46 . 2009-04-26 10:46

---

d

---

w c:\users\All Users\HPSSUPPLY
2009-04-26 10:40 . 2009-04-26 10:40

---

d

---

w c:\program files\Common Files\Hewlett-Packard
2009-04-26 10:40 . 2009-04-26 10:40

---

d

---

w c:\program files\Hewlett-Packard
2009-04-26 10:39 . 2009-04-26 10:44

---

d

---

w c:\program files\Common Files\HP
2009-04-26 10:34 . 2006-12-16 07:19 675840 ----a-w c:\windows\system32\hpowiav1.dll
2009-04-26 10:34 . 2006-12-16 07:19 573440 ----a-w c:\windows\system32\hpotscl1.dll
2009-04-26 10:34 . 2006-12-16 07:19 303104 ----a-w c:\windows\system32\hpovst01.dll
2009-04-26 10:32 . 2006-11-20 22:36 258048 ----a-w c:\windows\system32\hpzids01.dll
2009-04-26 10:32 . 2009-04-26 10:46

---

d

---

w c:\program files\HP
2009-04-26 10:31 . 2009-04-26 10:49 148995 ----a-w c:\windows\hpoins19.dat
2009-04-26 10:31 . 2009-04-27 06:36

---

d

---

w c:\programdata\HP
2009-04-26 10:31 . 2009-04-27 06:36

---

d

---

w c:\users\All Users\HP
2009-04-19 09:00 . 2009-04-19 09:01

---

d

---

w c:\users\greg\AppData\Local\MigWiz

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-18 06:18 . 2008-12-07 17:23

---

d

---

w c:\program files\Circle Developement
2009-05-18 05:39 . 2008-01-09 12:24 12 ----a-w c:\windows\bthservsdp.dat
2009-05-18 05:14 . 2008-03-25 14:19

---

d

---

w c:\program files\Spybot - Search & Destroy
2009-05-17 17:07 . 2008-11-17 20:07

---

d

---

w c:\program files\Last.fm
2009-05-16 13:28 . 2008-10-16 06:16

---

d

---

w c:\program files\Yahoo! Games
2009-05-16 13:24 . 2008-09-07 13:23

---

d

---

w c:\program files\GamesBar
2009-05-16 13:22 . 2008-09-04 05:20

---

d

---

w c:\program files\Shockwave.com
2009-05-16 13:21 . 2008-01-09 12:36

---

d

---

w c:\program files\Google
2009-05-16 13:15 . 2008-09-07 13:23

---

d

---

w c:\program files\Gamenext
2009-05-16 13:09 . 2008-01-09 12:25

---

d--h--w c:\program files\InstallShield Installation Information
2009-05-16 12:52 . 2008-03-19 14:56

---

d

---

w c:\program files\Common Files\Adobe
2009-05-16 12:51 . 2008-12-25 14:47

---

d

---

w c:\program files\Amazon
2009-05-16 12:50 . 2008-01-12 16:24

---

d

---

w c:\program files\Windows Live
2009-05-16 12:38 . 2008-02-08 23:11

---

d

---

w c:\program files\Kontiki
2009-05-16 12:19 . 2006-11-02 12:50 174 --sha-w c:\program files\desktop.ini
2009-05-16 12:09 . 2006-11-02 12:37

---

d

---

w c:\program files\Windows Sidebar
2009-05-16 12:09 . 2006-11-02 12:37

---

d

---

w c:\program files\Windows Calendar
2009-05-16 12:09 . 2006-11-02 11:18

---

d

---

w c:\program files\Windows Mail
2009-05-16 12:09 . 2006-11-02 12:37

---

d

---

w c:\program files\Windows Collaboration
2009-05-16 12:09 . 2006-11-02 12:37

---

d

---

w c:\program files\Windows Journal
2009-05-16 12:09 . 2006-11-02 12:37

---

d

---

w c:\program files\Windows Photo Gallery
2009-05-16 12:09 . 2006-11-02 12:37

---

d

---

w c:\program files\Windows Defender
2009-05-16 11:30 . 2006-11-02 10:32 101888 ----a-w c:\windows\system32\ifxcardm.dll
2009-05-16 11:30 . 2006-11-02 10:32 82432 ----a-w c:\windows\system32\axaltocm.dll
2009-05-15 17:01 . 2008-01-23 19:07

---

d

---

w c:\program files\Common Files\Symantec Shared
2009-04-11 13:41 . 2008-10-15 18:46

---

d

---

w c:\program files\Oberon Media
2009-04-11 13:22 . 2008-10-24 16:45

---

d

---

w c:\program files\GameHouse
2009-04-11 13:22 . 2008-03-22 21:16

---

d

---

w c:\program files\StepMania
2009-04-11 13:14 . 2008-08-29 06:45

---

d

---

w c:\program files\WildGames
2009-03-26 14:58 . 2009-02-25 15:59

---

d

---

w c:\program files\NOS
2009-03-21 18:49 . 2009-03-21 18:49

---

d

---

w c:\program files\Sony
2009-03-17 03:38 . 2009-04-16 07:59 13824 ----a-w c:\windows\system32\apilogen.dll
2009-03-17 03:38 . 2009-04-16 07:59 24064 ----a-w c:\windows\system32\amxread.dll
2009-03-15 12:29 . 2009-03-15 12:29 0 ----a-w c:\users\greg\AppData\Roaming\wklnhst.dat
2009-03-04 07:14 . 2009-03-04 07:14 266240 ----a-w c:\windows\system32\CSHelper.exe
2009-03-04 07:14 . 2009-03-04 07:14 225280 ----a-w c:\windows\system32\CSInstru.DLL
2009-03-03 04:46 . 2009-04-16 07:59 3599328 ----a-w c:\windows\system32\ntkrnlpa.exe
2009-03-03 04:46 . 2009-04-16 07:59 3547632 ----a-w c:\windows\system32\ntoskrnl.exe
2009-03-03 04:40 . 2009-04-16 07:58 827392 ----a-w c:\windows\system32\wininet.dll
2009-03-03 04:39 . 2009-04-16 07:59 183296 ----a-w c:\windows\system32\sdohlp.dll
2009-03-03 04:39 . 2009-04-16 07:59 551424 ----a-w c:\windows\system32\rpcss.dll
2009-03-03 04:39 . 2009-04-16 07:59 26112 ----a-w c:\windows\system32\printfilterpipelineprxy.dll
2009-03-03 04:37 . 2009-04-16 07:58 78336 ----a-w c:\windows\system32\ieencode.dll
2009-03-03 04:37 . 2009-04-16 07:59 98304 ----a-w c:\windows\system32\iasrecst.dll
2009-03-03 04:37 . 2009-04-16 07:59 44032 ----a-w c:\windows\system32\iasdatastore.dll
2009-03-03 04:37 . 2009-04-16 07:59 54784 ----a-w c:\windows\system32\iasads.dll
2009-03-03 03:04 . 2009-04-16 07:59 666624 ----a-w c:\windows\system32\printfilterpipelinesvc.exe
2009-03-03 02:38 . 2009-04-16 07:59 17408 ----a-w c:\windows\system32\iashost.exe
2009-03-03 02:28 . 2009-04-16 07:58 26624 ----a-w c:\windows\system32\ieUnatt.exe
2008-12-27 23:38 . 2008-12-27 23:38 122880 ----a-w c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
2008-01-09 20:05 . 2008-01-09 19:56 8192 --sha-w c:\windows\Users\Default\NTUSER.DAT
.

((((((((((((((((((((((((((((( SnapShot@2009-05-18_05.26.17 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-01-09 12:25 . 2009-05-18 05:43 85650 c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2006-11-02 13:05 . 2009-05-18 05:43 69184 c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2008-01-11 14:07 . 2009-05-18 05:43 15912 c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-853197089-1528823042-1266614186-1000_UserData.bin
- 2008-01-11 14:07 . 2009-05-18 05:19 15912 c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-853197089-1528823042-1266614186-1000_UserData.bin
- 2006-11-02 13:02 . 2009-05-18 05:19 32768 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2006-11-02 13:02 . 2009-05-18 05:43 32768 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2006-11-02 13:02 . 2009-05-18 05:43 65536 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2006-11-02 13:02 . 2009-05-18 05:19 65536 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-01-09 12:45 . 2009-05-18 05:43 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2008-01-09 12:45 . 2009-05-18 05:19 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2006-11-02 10:33 . 2009-05-18 05:47 599942 c:\windows\System32\perfh009.dat
- 2006-11-02 10:33 . 2009-05-18 05:23 599942 c:\windows\System32\perfh009.dat
+ 2006-11-02 10:33 . 2009-05-18 05:47 105448 c:\windows\System32\perfc009.dat
- 2006-11-02 10:33 . 2009-05-18 05:23 105448 c:\windows\System32\perfc009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-01-09 68856]
"WindowsWelcomeCenter"="oobefldr.dll" - c:\windows\System32\oobefldr.dll [2008-01-19 2153472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 132496]
"VolPanel"="c:\program files\Creative\SBAudigy\Volume Panel\VolPanlu.exe" [2006-11-27 180224]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2006-10-03 81920]
"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2006-11-05 221184]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-12-27 29744]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2006-10-03 221184]
"lxczbmgr.exe"="c:\program files\Lexmark 1200 Series\lxczbmgr.exe" [2007-02-08 74672]
"FaxCenterServer"="c:\program files\Lexmark Fax Solutions\fm3032.exe" [2007-02-08 295856]
"Broadbandadvisor.exe"="c:\program files\Virgin Broadband\advisor\Broadbandadvisor.exe" [2007-08-07 2061552]
"PCguard"="c:\program files\Virgin Broadband\PCguard\Rps.exe" [2007-09-05 310000]
"-FreedomNeedsReboot"="c:\program files\Virgin Broadband\PCguard\ZkRunOnceR.exe" [2007-09-05 13552]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-06-09 185896]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-11-07 111936]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 49152]
"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2007-09-24 4452352]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-1-2 210520]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~2\GoogleDesktopNetwork3.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ PDBoot.exe\0autocheck autochk *\0lsdelete

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{60153CD8-2A46-4184-A255-FFB1FD128E15}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{B003D427-7B13-4B10-9574-4469539ABF01}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{FC7C78E6-84B2-4CA0-AEBA-95CEAB7A0912}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{9EB0C31C-DC4A-457F-A90C-BB381CF66903}"= UDP:c:\windows\System32\lxczcoms.exe:Lexmark Communications System
"{7728FACD-6B52-439A-8EDC-FA7043FBC725}"= TCP:c:\windows\System32\lxczcoms.exe:Lexmark Communications System
"{3A7A35D0-6BAA-40AB-87D0-2653A7872868}"= UDP:c:\windows\System32\spool\drivers\w32x86\3\lxczpswx.exe:Printer Status Window
"{46E06F86-EFFC-4A18-AB95-C838BCA90B62}"= TCP:c:\windows\System32\spool\drivers\w32x86\3\lxczpswx.exe:Printer Status Window
"{0BEC2250-1098-48A9-8B17-DE2822C307EC}"= UDP:c:\program files\Abbyy FineReader 6.0 Sprint\Scan\ScanMan6.exe:FineScanManager
"{9FB8A770-4D96-42AE-B665-8E258B8DB814}"= TCP:c:\program files\Abbyy FineReader 6.0 Sprint\Scan\ScanMan6.exe:FineScanManager
"{5FCA0032-E123-469B-B8CC-4B8D5294E394}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"TCP Query User{489330AF-7E54-4D89-AF2E-7938AE95DBB7}c:\\program files\\utorrent\\utorrent.exe"= UDP:c:\program files\utorrent\utorrent.exe:uTorrent
"UDP Query User{D63C4DFB-9308-49AE-83C7-DBB11DA292F4}c:\\program files\\utorrent\\utorrent.exe"= TCP:c:\program files\utorrent\utorrent.exe:uTorrent
"{AE906656-0345-4269-B00F-5BB9E1323643}"= UDP:c:\program files\Kontiki\KService.exe:Delivery Manager Service
"{E93EF28D-3F83-45AB-B9D3-0ABE03CF84F8}"= TCP:c:\program files\Kontiki\KService.exe:Delivery Manager Service
"{1829A4BE-B571-4E63-83FC-288FABA45F86}"= UDP:c:\program files\Kontiki\KService.exe:Delivery Manager Service
"{110E9E10-C746-4142-8058-54123269F111}"= TCP:c:\program files\Kontiki\KService.exe:Delivery Manager Service
"{718E2990-5960-4530-BD0A-05E83053CF8B}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{36E1E022-5257-4A46-9861-C23FD045DDF3}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"TCP Query User{03149985-4E2F-4AF5-8DCD-F09A1DE7AF4D}c:\\program files\\real\\realplayer\\realplay.exe"= UDP:c:\program files\real\realplayer\realplay.exe:RealPlayer
"UDP Query User{55BC0A70-9F33-473F-833C-BD9BC2155173}c:\\program files\\real\\realplayer\\realplay.exe"= TCP:c:\program files\real\realplayer\realplay.exe:RealPlayer
"TCP Query User{AF634ACC-2554-4190-8880-9662873460C1}c:\\program files\\internet explorer\\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{7DBEB918-2F0B-470D-B980-D964FA7491BF}c:\\program files\\internet explorer\\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"{F36360A5-A98F-47A1-961D-77743EFC2FA7}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{2DA301BE-2262-4196-A006-11C1F3C4A09D}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{AE00CEEF-CE2B-47EE-862D-9ED1EFA18229}"= UDP:c:\program files\Sports Interactive\Football Manager 2009\fm.exe:Football Manager 2009
"{605BAB2F-62AE-401B-97E9-22BF0A255B0D}"= TCP:c:\program files\Sports Interactive\Football Manager 2009\fm.exe:Football Manager 2009
"{1187576D-42FB-403A-9117-B830FF757FFD}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{0E25D2A2-4E7C-4702-8DD1-4CE0EB0B2DCC}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"{4DAED31A-2376-4E46-A612-DFA8F7C978C9}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{94358AAA-EF85-464A-81F0-F985250A424A}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour

R2 CSHelper;CopySafe Helper Service;c:\windows\System32\CSHelper.exe [04/03/2009 08:14 266240]
S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [09/01/2008 13:36 29744]
S3 Radialpoint Security Services;Virgin Broadband PCguard;c:\windows\System32\dllhost.exe [02/11/2006 09:50 7168]
S3 rt70x86;Belkin Wireless G USB Network Adapter Driver for Vista;c:\windows\System32\drivers\netr70.sys [09/10/2007 06:43 291840]
S3 s816bus;Sony Ericsson Device 816 driver (WDM);c:\windows\System32\drivers\s816bus.sys [19/06/2007 08:51 81832]
S3 s816mdfl;Sony Ericsson Device 816 USB WMC Modem Filter;c:\windows\System32\drivers\s816mdfl.sys [19/06/2007 08:51 13864]
S3 s816mdm;Sony Ericsson Device 816 USB WMC Modem Driver;c:\windows\System32\drivers\s816mdm.sys [19/06/2007 08:51 107304]
S3 s816mgmt;Sony Ericsson Device 816 USB WMC Device Management Drivers (WDM);c:\windows\System32\drivers\s816mgmt.sys [19/06/2007 08:51 99112]
S3 s816nd5;Sony Ericsson Device 816 USB Ethernet Emulation SEMCMR7 (NDIS);c:\windows\System32\drivers\s816nd5.sys [19/06/2007 08:51 21928]
S3 s816obex;Sony Ericsson Device 816 USB WMC OBEX Interface;c:\windows\System32\drivers\s816obex.sys [19/06/2007 08:51 97320]
S3 s816unic;Sony Ericsson Device 816 USB Ethernet Emulation SEMCMR7 (WDM);c:\windows\System32\drivers\s816unic.sys [19/06/2007 08:51 97704]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder

2009-05-18 c:\windows\Tasks\RegCure Program Check.job
- c:\program files\RegCure\RegCure.exe [2007-08-02 16:20]

2008-03-26 c:\windows\Tasks\RegCure.job
- c:\program files\RegCure\RegCure.exe [2007-08-02 16:20]

2009-05-17 c:\windows\Tasks\WebReg Officejet 4300 series.job
- c:\program files\HP\Digital Imaging\bin\hpqwrg.exe [2006-12-10 20:36]
.
.

---

Supplementary Scan

---

.
uStart Page = hxxp://www.google.co.uk/ig/dell?hl=en&client=dell-usuk&channel=uk&ibd=1080109
mStart Page = hxxp://uk.yahoo.com
FF - ProfilePath - c:\users\greg\AppData\Roaming\Mozilla\Firefox\Profiles\sqmctljf.default\
FF - prefs.js: browser.startup.homepage - hxxp://start.gamenext.com
FF - component: c:\program files\Mozilla Firefox\components\GoogleDesktopMozilla.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npArtistScope42.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npArtistScopeDRM11.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npzylomgamesplayer.dll
FF - plugin: c:\users\greg\AppData\Roaming\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-18 07:20
Windows 6.0.6001 Service Pack 1 NTFS
Done it- eventually.