WinBlue Soft Got me

I have no idea how it even got on my pc its my dads computer and i really need to fix this before he gets home i cant open the hijack file so i just e-mailed it to myself and sendiing the contents of the file back via e-mail ill copy and paste it as soon as i can

Also i installed malwarebytes it wont even run it says: Run time error '0' or Run Time error '440' automation error

Heres the hijackthis file from my email

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:39:51, on 03/06/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Sony\WALKMAN Launcher\WMAAD.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\RunDll32.exe
C:\PROGRA~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe
C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
C:\Program Files\WinBlueSoft Software\WinBlueSoft\WinBlueSoft.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
C:\WINDOWS\system32\tempo-setup2.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Program Files\CASIO\Photo Loader\Plauto.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Documents and Settings\john\Desktop\hijackgpthis.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.skybroadband.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/sb/*http://uk.docs.yahoo.com/info/bt_side.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/sp/*http://uk.search.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.profootballweekly.com/PFW/default.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/su/*http://uk.search.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/sb/*http://uk.docs.yahoo.com/info/bt_side.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/sp/*http://uk.search.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/su/*http://uk.search.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer Provided By Sky Broadband
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;*.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\bar\1.bin\MWSSRCAS.DLL
O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\bar\1.bin\MWSSRCAS.DLL
O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\Scriptcl.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O3 - Toolbar: My Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [GhostStartTrayApp] C:\Program Files\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [WMAAD] C:\Program Files\Sony\WALKMAN Launcher\WMAAD.exe
O4 - HKLM\..\Run: [btbb_McciTrayApp] C:\Program Files\BT Broadband Desktop Help\bin\BTHelpNotifier.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [CmUsbSound] RunDll32 cmcnfgu.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [MyWebSearch Plugin] rundll32 C:\PROGRA~1\MYWEBS~1\bar\1.bin\M3PLUGIN.DLL,UPF
O4 - HKLM\..\Run: [My Web Search Bar Search Scope Monitor] "C:\PROGRA~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe" /m=2 /w
O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [WinBlueSoft] C:\Program Files\WinBlueSoft Software\WinBlueSoft\WinBlueSoft.exe -min
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe
O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"

O4 - HKCU\..\Run: [EA Core] "C:\Program Files\Electronic Arts\EADM\Core.exe" -silent
O4 - HKCU\..\Run: [BTAgile] C:\Program Files\BT Broadband Talk Softphone\BTAgile.exe
O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [PlayNC Launcher] C:\program files\ncsoft\launcher\NCLauncher.exe /Minimized
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [tempo-setup2.exe] C:\WINDOWS\system32\tempo-setup2.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Registration Heroes of Might & Magic 5.LNK = C:\Program Files\Ubisoft\Heroes of Might and Magic V\registration\RegistrationReminder.exe
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: NETGEAR WG111T Smart Wizard.lnk = ?
O4 - Global Startup: Photo Loader supervisory.lnk = C:\Program Files\CASIO\Photo Loader\Plauto.exe
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZUxdm554YYGB
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Transfer by Image Converter 3 - C:\PROGRAM FILES\SONY\IMAGE CONVERTER 3\menu.htm
O9 - Extra button: Sky - {08E730A4-FB02-45BD-A900-01E4AD8016F6} - http://www.skybroadband.com (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: RileysPoker - {94EDF7B4-4272-4af3-8F8B-4E2F68E225B7} - C:\PROGRA~1\RILEYS~1\rileyspoker.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei-4/MyFunCardsInitialSetup1.0.1.1.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://dev.srtest.com/srl_bin/sysreqlab3.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1174640658031
O16 - DPF: {65E8E2DC-186A-4AAC-9E56-FDC683055A9E} (CNetOnlineInstall Control) - http://www.download.com/html/dl/bug211623/CNetOnlineInstall.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {C044CD87-DFB0-4130-A5E4-49361106FBC8} (HanSetupCtrl1010 Class) - http://id.hangame.com/common/HanSetup1020.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O20 - AppInit_DLLs: blocker.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: GhostStartService - Symantec Corporation - C:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe
O23 - Service: Google Update Service (gupdate1c9b860dfcbbd94) (gupdate1c9b860dfcbbd94) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Image Converter SCSI Service (ICScsiSV) - Sony Corporation - C:\Program Files\Sony\IMAGE CONVERTER 3\ICScsiSV.exe
O23 - Service: IcVzMonLauncher - Sony Corporation - C:\Program Files\Sony\IMAGE CONVERTER 3\IcVzMonLauncher.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Image Converter video recording monitor for VAIO Entertainment - Sony Corporation - C:\Program Files\Sony\IMAGE CONVERTER 3\IcVzMon.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: My Web Search Service (MyWebSearchService) - MyWebSearch.com - C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwssvc.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SonicStage Back-End Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SsBeSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
--

• Open HijackThis.
  
• When Hijack This opens, click "Open the Misc Tools section"
  
• Then select "Delete a file on reboot..."
  
• Then find and select this file: C:\windows\system32\blocker.dll
  
• Select okay and select yes to reboot.
  

After reboot,

• Open HijackThis again.
  
• When Hijack This opens, click "Open the Misc Tools section"
  
• Then select "Open Uninstall Manager"
  
• Click on "Save List..." (generates uninstall_list.txt)
  
• Click Save, copy and paste the results in your next post.
  

after rebooting i can open my files now here is my list

??? ?? ????
Acoustica Effects Pack
Acoustica Mixcraft 4.2
Acrobat.com
Adobe AIR
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Reader 9.1
Adobe Shockwave Player 11
Antares Auto-Tune Evo VST
AnyDVD
Apple Mobile Device Support
Apple Software Update
ArcSoft PhotoImpression 5
ASIO4ALL
AudibleManager
Bonjour
BT Broadband Talk Softphone 3.1
CDDRV_Installer
CloneDVD2
Collab
Creative MediaSource 5
Creative Removable Disk Manager
Creative System Information
Creative ZEN V Series (R2)
Critical Update for Windows Media Player 11 (KB959772)
Disc2Phone
DivX Web Player
EA Download Manager
erLT
Express Burn
FL Studio 8
Game Jackal v3.2.0.6 (32 bit)
Google Earth
Google Earth
Google Update Helper
Google Updater
Heroes of Might & Magic V: Hammers of Fate
Heroes of Might and Magic V
High Definition Audio Driver Package - KB888111
HijackThis 2.0.2
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB952287)
hp instant support
HP Memories Disc
HP Photo and Imaging 2.0 - All-in-One
HP Photo and Imaging 2.0 - All-in-One Drivers
HP Photo and Imaging 2.0 - hp psc 2170 series
HP Product Detection
hp psc 2170 series
IL Download Manager
Image Converter 3
Interlok driver setup x32
iTunes
J2SE Runtime Environment 5.0 Update 11
Japanese Language Support
Java DB 10.4.1.3
Java(TM) 6 Update 13
Java(TM) 6 Update 3
Java(TM) 6 Update 5
Java(TM) 6 Update 7
Java(TM) SE Development Kit 6 Update 13
Java(TM) SE Runtime Environment 6 Update 1
JavaFX(TM) 1.1 SDK
KhalInstallWrapper
K-Lite Codec Pack
Korean Language Support
Learn2 Player (Uninstall Only)
LimeWire 4.16.6
Logitech SetPoint
Malwarebytes' Anti-Malware
McAfee VirusScan Enterprise
MegaCam
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
Microsoft National Language Support Downlevel APIs
Microsoft Office Professional Edition 2003
Microsoft Plus! for Windows XP
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Monster Hunter Frontier Online
MS Access 97 SP2
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
My Web Search (My Fun Cards)
Nero 7 Ultra Edition
NETGEAR WG111T 108Mbps Wireless USB2.0 Adapter
Norton Ghost
NVIDIA Drivers
OpenMG Limited Patch 4.7-07-14-05-01
OpenMG Secure Module 4.7.00
OpenOffice.org Installer 1.0
Ovann USB Audio
Pacific Poker
PDF Manual NW-A800 Series
Photo Loader 2.1E
Photohands 1.0E
Pivot Stickfigure Animator
PlayNC Launcher
PluginVideo
PoiZone
PowerDVD
QuickTime
RealPlayer Basic
REALTEK GbE & FE Ethernet PCI NIC Driver
Realtek High Definition Audio Driver
RileysPoker
Security Update for Windows Internet Explorer 7 (KB928090)
Security Update for Windows Internet Explorer 7 (KB931768)
Security Update for Windows Internet Explorer 7 (KB933566)
Security Update for Windows Internet Explorer 7 (KB937143)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 9 (KB917734)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB961373)
Shockwave
Sky Broadband
SonicStage 4.3
Sony Video Shared Library
Steam
System Requirements Lab
TeamSpeak 2 RC2
TortoiseSVN 1.6.2.16344 (32 bit)
Toxic Biohazard
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
USB CASIO Digital Camera Device Driver
VC80CRTRedist - 8.0.50727.762
VeohTV BETA
VIA Platform Device Manager
Video Downloader
Viewpoint Media Player
WALKMAN Launcher
WavePad Sound Editor
Windows Live Messenger
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 10 Hotfix - KB895316
Windows Media Player 11
Windows Media Player 11
Windows XP Service Pack 3
WinRAR archiver
World of Warcraft
Xfire (remove only)
ZENcast Organizer

Hello.

I see that you are running Limewire.
P2P(Peer to peer) applications are designed to help you easily share and distribute files between you and a group of people. But they can also be used to distribute malware, and thus are not considered safe.
The removal of these programs is optional, but highly recommended.

If Limewire is not removed, then I won't help you.

Go to Start > Control Panel > Add/Remove Programs and remove the following programs.

J2SE Runtime Environment 5.0 Update 11
Java(TM) 6 Update 13
Java(TM) 6 Update 3
Java(TM) 6 Update 5
Java(TM) 6 Update 7
Java(TM) SE Runtime Environment 6 Update 1
LimeWire 4.16.6
My Web Search (My Fun Cards)
Norton Ghost
Viewpoint Media Player

Next

• Download combofix from here
  Link 1
  Link 2
  
• We need to disable your local AV (Anti-virus) before running Combofix.
  
• See HERE for how to disable your AV. (Mcafee)
  
• Double click on ComboFix.exe.
  
• Follow the prompts. NOTE:
  
• ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
  ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***
  
  **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will automatically proceed with its scan.
  
  
  
• The Recovery Console provides a recovery/repair mode should a problem occur during a Combofix run.
  
  
  
  
• Allow ComboFix to download the Recovery Console.
  
• Accept the End-User License Agreement.
  
• The Recovery Console will be installed.
  
• You will then get this next prompt that asks if you want to continue the malware scan, select yes
  
  
  
  
• Allow combofix to run
  
• Post C:\combofix.txt back here.
  
  Note:
  Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
  

Hiya its my Dads pc so im not sure if he would let me get rid of limewire ill take it off now but is it ok if i put it back on afterwards?

If you do, and the infection comes back, I can refuse refuse to help you.

fair enough ok im uninstalling everything now by the way thanks for the help so far = )

ComboFix 09-06-01.03 - john 03/06/2009 17:51.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18.2046.1446 [GMT 1:00]
Running from: c:\documents and settings\john\Desktop\ComboFix.exe
.
ADS - WINDOWS: deleted 24 bytes in 1 streams.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\autorun.inf
c:\documents and settings\john\Local Settings\Temporary Internet Files\01d00098f732f640c6a5c8d431515b46.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\049497fd8947e722ae04b02eab871c18.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\067a9fd1541da872bb757c3da6a33d92.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\0783fa07a21528ab730a1df23334399c.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\0999dc9d92e75202025b885f39592438.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\0ba4ed06c78b5997716890d067fe2f51.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\0bb985ae9fc3a38262b3fd4c5cb03a3e.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\0ccc70e9bd23465e9e97d9445314fa13.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\0d5b5b246d05342352b6c776e1cf5212.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\11e75649feaf8ef009c4ed99aafe8310.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\1ba01a94a454af76ad1d723478b7127d.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\1ec397e7e85d3c521dc4c849c4e3ea0f.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\1f840d5d0d14655c624d157818b7003d.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\24c8b24d8a5c9889dac59d968fa1b8d8.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\251f27bb0e06e757f562bc1dc84a615f.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\25e9c02c9d769d249732f66e042c290e.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\28358b19588cf08bbb5de8b51850fe3a.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\288a0b7430370eb282f72b7e015c3c9a.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\28e51fb50e37beadbd134e4ae50e8f63.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\2a066ba87c16f28ec9819e3285252403.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\2c5a2cabd3b78548df720c3ee90efb41.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\2c86ccbe1c6e19b40bb8de244b0ba1e7.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\2d0afc3654f0a438f23598fb84be758c.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\2dfb42d5ca2c7ccc627743d095dfbac9.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\2eacacaddf4a71fe74de2b3f14074ac6.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\354c633ff9bf6fb3ecfad0ad65113c47.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\366a8f1bc352313a1074df76fdbce056.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\393e4d90773d8bbc9b905d903b618bdf.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\397bc65516fb1e815aa106a3d14d5305.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\3c1498e5ef362e757dc43d17482960f3.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\3ca41046bcb79924498d631f343d4371.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\461b3a8e7cfacb0c812e36aed9447c6d.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\46ceb001bfdc384ffe00657d8c567973.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\46eb2cd25804a00a1f22c69c4020c7e5.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\47d1dba34092ceb5412ac6f70c51e606.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\485d27cb769c9983f17e3d9eb5d03c5c.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\4b377d6eea3966e34c9a3ac2c647e5e5.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\4e216d83dc7da9779966ea4d31e236dd.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\4e6865e0bf7cf90244ce414917cc6556.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\51303604fcc7ede3ff317e6daac0c19a.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\52b483be9d71439ea530fb17638e5382.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\56613b7bd5cb1c3e01ecaa7a811022a9.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\59a83ef1238e50bddcc7caeb618d1824.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\59d3e0ea0c210c7674fea90f5382090c.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\5af1fa38e21413b7b2f5c6371f706543.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\5c5edcfe25ff895bc5c6a8d734710c5c.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\5f45a68915125fa8ad11a60ebffe29ee.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\6166b09fdf1ac1eaa1ae57a6eb20c03b.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\63eb5d17d60101356a7bbfdaae9afa57.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\654f8818ae39026c29f34808452fb02f.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\69482b1568b01b43c70d0ace76055f7e.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\6ab204a5ef9f916fe93d527a421ffdda.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\741983fb8768fa4d118c8ca59f82bb83.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\7cef98e862160d452cf773da8f4e2064.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\7f1d8b588793a67a9e8271b309c497c8.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\82724e37ddf746e5c798c9541a83d990.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\877d5ef68d1b6d7922fd09e955289803.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\8abcdf24b4bfa351f3b767c4232c6d02.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\91a1315c3d05215b1504e5899d32b936.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\9a40bf533c72981026081869543bbde2.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\9a846edeab464b62f0f2a74c54059f0b.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\9c5178781b9775c8036205fa67727330.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\9f9c2aa3ed1b1b0f922524c5a5260d1c.bmp

c:\documents and settings\john\Local Settings\Temporary Internet Files\a26ba057241a8c2ae219a8db7335f51c.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\a67e0c2d6a842bf89983192c7e42d7c7.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\a9583053db1a9b326763e99e2321c517.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\ad63fa05a8e976a9e0939831eb5ba308.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\b2c8a6ebad81932fcbe8461599d71865.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\b527594c48bbaad67924ced89a416e20.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\b86745632d1223fab788478c41828d9a.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\b88e5980318f9688b4348228079f4f04.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\c25b7660062dfaf312f7142d2126cf2e.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\c2a9bad2a6f3c5b8aba800c2646abbf0.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\c36f2f770b74dd9e49947e924f85eeea.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\c636b5bf68f8ea6811c91dd569143b63.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\c73959eceda75ddf82609033ed2756e9.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\ccbebc209ee7342ed2a62b6d6e996645.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\d0d1583aaf54f587014b422167bddd89.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\d41d8cd98f00b204e9800998ecf8427e.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\d7c0d1ef6446382c3f7bb71308ba122f.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\d8c72d47eaed4bf47aa5d4f291a7c350.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\d909bf9e40d3de9bfa779059a90ff834.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\dc973701a6a9f218f60e389f479684db.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\dcc3ea4461b925db5858951892b5fa12.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\df0ea822d926c8fa5e9401e70f2cea67.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\e09d50f5972f50e03ca6be41cf66e0b5.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\e261f32b2da3462f5a3f10d0e3cb11c7.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\e52ee3c662672a47bf85d717ebb4ae8e.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\e5c061252396f14b1dca59f288bf9c20.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\ebc4635e6aeb6c62f3801a378bdfaa4d.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\ecb246b7273dc7466b406d7b8b10c09e.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\f63720489499e58792f33295e3dfbf29.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\f9531b586c797615c6b11c5d9e8b7302.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\fd44d831ab115f692f560f8ea07c9868.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\fe5046d3ac6595d8f385d8a45126456e.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\fe6d388665fbc8cdfabaa8dc587839f7.bmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\mcc1E.tmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\mcc4.tmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\mcc5.tmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\mcc6.tmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\mcc7.tmp
c:\documents and settings\john\Local Settings\Temporary Internet Files\mcc8.tmp
c:\program files\Internet Explorer\msimg32.dll
c:\program files\MyWebSearch
c:\program files\MyWebSearch\bar\1.bin\F3HTMLMU.DLL
c:\program files\MyWebSearch\bar\1.bin\MWSBAR.DLL
c:\program files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
c:\program files\MyWebSearch\bar\1.bin\MWSOESTB.DLL
c:\program files\MyWebSearch\bar\1.bin\MWSSRCAS.DLL
c:\program files\MyWebSearch\bar\History\search3
c:\program files\Uninstall Fun Web Products.dll
c:\windows\10845spz9bot581.cpl
c:\windows\10963vi95z59c.ocx
c:\windows\10z51spa9bot3d6.dll
c:\windows\11094zo592d4.dll
c:\windows\1168dzwnload9r1952.bin
c:\windows\11873zot9a-vir5s232.bin
c:\windows\11985za5ktool599.bin
c:\windows\11e5ir9218z.cpl
c:\windows\12846wz9m459.exe
c:\windows\12e5zteal59.dll
c:\windows\12z39troj5b8.cpl
c:\windows\1319baczdoor1075.bin
c:\windows\135cspzwa95359.exe
c:\windows\13642hazk5ool6159.bin
c:\windows\1369virus1z95.bin
c:\windows\13976vir5s61az.exe
c:\windows\1415h9cktool6z1.ocx
c:\windows\1417z5roj4c9.exe
c:\windows\14594viruszca.dll
c:\windows\14z0thi9f9765.bin
c:\windows\15096vi5zs936.cpl
c:\windows\1519thzef26845.bin
c:\windows\15229zorm11.dll
c:\windows\15233viruz4b19.cpl
c:\windows\15368s5amb9tz51.ocx

c:\windows\15408no9za-virus713.dll
c:\windows\155z9s5y4369.ocx
c:\windows\15659zyware5089.ocx
c:\windows\15bcba9kz5or2364.cpl
c:\windows\15f5downloa9er2z15.ocx
c:\windows\16456h9cktoz547f.cpl
c:\windows\1646zs5y4c9.cpl
c:\windows\16512v9zu512c.exe
c:\windows\165esp59sez75.bin
c:\windows\1695nzt5a-virus496.bin
c:\windows\16z32not-a-vir59587.cpl
c:\windows\1705dow9zoader22315.exe
c:\windows\17277n9tza-5irus4fb.bin
c:\windows\17609zp9mbo56f6.exe
c:\windows\17650worm9az.exe
c:\windows\17834spambo958z.exe
c:\windows\17953spambot570z.bin
c:\windows\1825z9pambo535a.dll
c:\windows\183029izus4985.dll
c:\windows\18602hac9tozl4685.exe
c:\windows\18792vzru52a9.exe
c:\windows\18945ownloadzr724.exe
c:\windows\18z855orm1d9.bin
c:\windows\19369troj459z.exe
c:\windows\193steal25z9.ocx
c:\windows\19572szy7d5.dll
c:\windows\19770viruz6549.dll
c:\windows\19bfzir2995.exe
c:\windows\19z45sp9595.exe
c:\windows\1b50spa9se44z5.ocx
c:\windows\1bz9spars517569.cpl
c:\windows\1d9cback5oor4z.ocx
c:\windows\1f0szars52390.bin
c:\windows\1f1ds9arse5615z.dll
c:\windows\1f75thi9z59.ocx
c:\windows\1z099s5y61b.dll
c:\windows\1z3caddwar53209.dll
c:\windows\1z4vi91505.bin
c:\windows\1z5aadd9are252.dll
c:\windows\2045adzwa9e2209.cpl
c:\windows\20465trz917a.bin
c:\windows\20607ha9ktool4dz5.dll
c:\windows\21166tr5z937.exe
c:\windows\213z5irus3029.cpl
c:\windows\22351hack5o9l45cz.ocx
c:\windows\22569s9am5ot4d5z.dll
c:\windows\22895vi95s48z.bin
c:\windows\22a995ywarz1145.dll
c:\windows\23679wor95z5.exe
c:\windows\23z98troj3fc5.cpl
c:\windows\24544vzru9f95.exe
c:\windows\24695worm7zc.exe
c:\windows\24798troj78z5.dll
c:\windows\2502downlo5der155z9.bin
c:\windows\25299spz458.cpl
c:\windows\25539hief3247z.exe
c:\windows\25539hzcktool1e95.exe
c:\windows\2565spambzt67e9.dll
c:\windows\25759spambot69z.dll
c:\windows\2613a9z5are694.dll
c:\windows\261529pamzot68c.dll
c:\windows\26395wz9m659.cpl
c:\windows\265athreat185z9.dll
c:\windows\2691s5zware9936.exe
c:\windows\271625a9ktzol294.dll
c:\windows\274z6not-5-viru9314.bin
c:\windows\27999wzrm2f65.ocx
c:\windows\279z4virus5da5.dll
c:\windows\27z945py73.dll
c:\windows\28683h9zkt5ol4e4.cpl
c:\windows\2871ztro9725.dll
c:\windows\28846z9ambot75c.ocx

c:\windows\28846z9ambot75c.ocx
c:\windows\2897zwor9356.exe
c:\windows\28b9spzwar91359.exe
c:\windows\28e9zack9o5r3242.bin
c:\windows\28z965irusb3.cpl
c:\windows\29056spa5bz962d.cpl
c:\windows\291b9parsez2445.exe
c:\windows\29426worz45f5.bin
c:\windows\2951z59cktool5fd.ocx
c:\windows\2959sp5rsz507.dll
c:\windows\29683n5t9azvirus243.exe
c:\windows\2986v9r5z4d5.dll
c:\windows\298zv5r90.bin
c:\windows\29c3addwzre2522.ocx
c:\windows\29z53viru529e.cpl
c:\windows\2a6bt5r9at5130z.bin
c:\windows\2b265dd9are2744z.exe
c:\windows\2bb9z5arse1039.exe
c:\windows\2c4athre5tz7979.cpl
c:\windows\2dz59ir1557.dll
c:\windows\2z273spamb9t755.cpl
c:\windows\2z518wo9m4525.dll
c:\windows\2z5459py13f.exe
c:\windows\2z848n95-a-virus7e5.ocx
c:\windows\301z5wo956f4.dll
c:\windows\30614vi9us5z5.exe
c:\windows\30885tealz989.dll
c:\windows\30962spambot5z7.bin
c:\windows\309cdo5nloader553z.ocx
c:\windows\309dow5lozder9128.bin
c:\windows\312185irusz59.bin
c:\windows\31229wo5913z.dll
c:\windows\31559tro9z54.ocx
c:\windows\31965pambot6ze.ocx
c:\windows\31z975roj339.cpl
c:\windows\32197vzru54da.bin
c:\windows\32259n5t-a-virus5ze.bin
c:\windows\32273not-a5virusz949.bin
c:\windows\32398noz-9-virus45b.bin
c:\windows\32459zirus952.ocx
c:\windows\3365azdware5119.cpl
c:\windows\347c5tz9l932.bin
c:\windows\3539threzt97572.bin
c:\windows\35656spam9ot30z.ocx
c:\windows\358fsparse2609z.bin
c:\windows\35czsp9rse2278.bin
c:\windows\367h9cztoo5bb.dll
c:\windows\36885hizf911.exe
c:\windows\370s59az1460.bin
c:\windows\39077s5yz8.exe
c:\windows\3919backdo5r2294z.dll
c:\windows\3959vir158z.cpl
c:\windows\3a9d5i92406z.dll
c:\windows\3e92v5z2550.exe
c:\windows\3ed8thzeat32965.dll
c:\windows\3f4zsparse1595.dll
c:\windows\3ff6down9ozder1554.exe
c:\windows\3z50v9r2005.cpl
c:\windows\3z7249roj54b.dll
c:\windows\3z788vi9us5e7.cpl
c:\windows\3zb75pyware9924.ocx
c:\windows\40bbthi5f9538z.exe
c:\windows\4244zot-5-9irus751.dll
c:\windows\424zh95ktool3ca.dll
c:\windows\427dz5ea91295.cpl
c:\windows\42daadd5are97z2.dll
c:\windows\438zb9ckdoor159.bin
c:\windows\43ead9zar52829.bin
c:\windows\44b5t9ie53z51.bin
c:\windows\4669spywarz2235.bin
c:\windows\4669t9oz2a5.exe
c:\windows\4691st9z5853.dll
c:\windows\476azo9nload5r3177.bin

c:\windows\479stzal2858.bin
c:\windows\4915szarse535.bin
c:\windows\498zst5al2824.cpl
c:\windows\49d9teal1815z.ocx
c:\windows\49eavirz75.exe
c:\windows\4b539ownloadzr1101.bin
c:\windows\4b6bba5kdoorz909.bin
c:\windows\4e70zddware29365.dll
c:\windows\4ez0t9reat31589.exe
c:\windows\4f9e5zie93076.exe
c:\windows\4fc15pzrse3039.exe
c:\windows\4z68spars52972.ocx
c:\windows\4zb9thre5t22348.exe
c:\windows\501athiez9575.cpl
c:\windows\507fstzal3958.dll
c:\windows\50879orm7z9.dll
c:\windows\5089stzal60.bin
c:\windows\509vi5us649z.exe
c:\windows\50z4wor9255.ocx
c:\windows\50z8downloade9512.dll
c:\windows\5129zpy99.exe
c:\windows\513bthiez1095.exe
c:\windows\51708t9ojz8a.bin
c:\windows\52320not-azviru9398.bin
c:\windows\5269ot-a-zirus2a2.ocx
c:\windows\5286downloader50z9.exe
c:\windows\52897sp94b2z.dll
c:\windows\52b559eal3122z.ocx
c:\windows\52z37spy903.dll
c:\windows\53059wo9m45cz.cpl
c:\windows\53299worm5zb.ocx
c:\windows\546f9hr5at118z7.cpl
c:\windows\54czthief429.cpl
c:\windows\54d5t9ief184z.ocx
c:\windows\5505spz997.cpl
c:\windows\5551threat6829z.dll
c:\windows\5590spyware990z.dll
c:\windows\55a9dware224z.dll
c:\windows\55b29zr1664.dll
c:\windows\55c19ddwaze41.dll
c:\windows\55dc9hiez441.dll
c:\windows\5602azd5are979.exe
c:\windows\5608vir9s692z.dll
c:\windows\5617st5zl2089.dll
c:\windows\56a7bzc9door26695.bin
c:\windows\5899zo5m1b6.ocx
c:\windows\58a5thrzat60915.ocx
c:\windows\5909d5wnloadzr1804.ocx
c:\windows\59ee5hre9tz992.dll
c:\windows\59f0t5rzat14628.exe
c:\windows\59spzrse17459.bin
c:\windows\59z39ackdoor578.cpl
c:\windows\5a5bspyware9z57.bin
c:\windows\5bbfs95alz200.exe
c:\windows\5c09ir25z3.cpl
c:\windows\5c13zhie9528.ocx
c:\windows\5cae9azkdoor8115.exe
c:\windows\5d93vir2z59.cpl
c:\windows\5e93zddwar52959.bin
c:\windows\5ez9th9ef7.cpl
c:\windows\5f849ackdoor1330z.dll
c:\windows\5f9zvir10565.ocx
c:\windows\5z25teal30199.dll
c:\windows\6028zhief95925.bin
c:\windows\60abdown5z9der73.dll
c:\windows\617wz59650.bin
c:\windows\62edst9zl9845.ocx
c:\windows\62fcthie53z9.ocx
c:\windows\6599virus33z9.dll
c:\windows\66spywa9z856.dll
c:\windows\67b4thzef3995.ocx
c:\windows\689as5ywaze9538.exe

c:\windows\6902sza5s91858.exe
c:\windows\695zvi5764.exe
c:\windows\69c9steal99z75.dll
c:\windows\69z3th5ef9026.ocx
c:\windows\69z5downloader489.dll
c:\windows\6a1s5eal5z29.ocx
c:\windows\6a7s59rse1258z.bin
c:\windows\6af6zhre5t914.dll
c:\windows\6b7a5p9zare442.bin
c:\windows\6b95spzr5e3088.cpl
c:\windows\6c56sparse59z.ocx
c:\windows\6e00spywa5e154z9.exe
c:\windows\6f82bzckdoor94115.ocx
c:\windows\6z51thief1595.dll
c:\windows\6z55v9r277.exe
c:\windows\6z99s9eal11595.dll
c:\windows\7155tzie9336.cpl
c:\windows\71ab9hzef531.ocx
c:\windows\72595pambot67cz.bin
c:\windows\7265azd9are2580.dll
c:\windows\72945parse9z59.ocx
c:\windows\731e5hreaz29996.ocx
c:\windows\741zsparse25159.ocx
c:\windows\7465thiez3955.dll
c:\windows\7566st9alz17.bin
c:\windows\75ecthrzat972.dll
c:\windows\75z2thie93254.dll
c:\windows\7606thzeat18259.dll
c:\windows\7689szarse11595.ocx
c:\windows\76d7back9ozr16695.cpl
c:\windows\78559zyware715.dll
c:\windows\78f1sp9zar5835.dll
c:\windows\797zsp9rse598.cpl
c:\windows\79ads5zal1861.ocx
c:\windows\7a9zsteal20915.ocx
c:\windows\7ab8virz195.dll
c:\windows\7b00bac5doo91686z.exe
c:\windows\7czv95481.ocx
c:\windows\7ff2th9eaz3485.exe
c:\windows\8289wozm1875.exe
c:\windows\8534zo5m9d7.bin
c:\windows\893zvirus5755.cpl
c:\windows\8d8back9o5rz73.dll
c:\windows\9092spam95t4zb.cpl
c:\windows\918z2v5rus5c1.cpl
c:\windows\929adzware11589.bin
c:\windows\93135irus569z.bin
c:\windows\9375hacktooz6b8.cpl
c:\windows\93z5troj5d9.bin
c:\windows\94025hackzool48c.dll
c:\windows\94247not5a-zirusbe.dll
c:\windows\9464sp9mbot5z.dll
c:\windows\9473vzrus659.exe
c:\windows\94a7spywzre2356.dll
c:\windows\94z4t5oj1ae9.exe
c:\windows\953vi9uszfc.ocx
c:\windows\95692hacktooz7e5.cpl
c:\windows\95961worm335z.bin
c:\windows\959adz5are900.ocx
c:\windows\95z23s5y571.bin
c:\windows\9884szy585.dll
c:\windows\9983ztroj5fd5.cpl
c:\windows\9995zpyware2528.dll
c:\windows\9a97doznl5ader805.dll
c:\windows\9af6dow5loadez1475.cpl
c:\windows\9b90virz57.bin
c:\windows\9bf5hief3z18.cpl
c:\windows\9fa95ddwzre562.ocx
c:\windows\9z15irus1b1.ocx
c:\windows\9z275spamb5t70d.dll
c:\windows\9z595parse2202.exe
c:\windows\9z63down5oader1493.ocx

c:\windows\9z8t5oj765.dll
c:\windows\a3zstea52395.ocx
c:\windows\a52sparze1921.ocx
c:\windows\b975p9rsez036.bin
c:\windows\c97szarse12545.exe
c:\windows\ce8add59re2537z.dll
c:\windows\d9dspywzre985.ocx
c:\windows\de9spa5se9z59.dll
c:\windows\ee5steal15z59.cpl
c:\windows\f62sze5l3249.exe
c:\windows\system32\10145o9mz3.exe
c:\windows\system32\10247not5azvirus96c.dll
c:\windows\system32\10254spambot59z.bin
c:\windows\system32\10298n5t-a-vir9z30b.dll
c:\windows\system32\11230n95-a-virus4az.bin
c:\windows\system32\11495worm57z5.cpl
c:\windows\system32\1175spyzar92997.bin
c:\windows\system32\11998s5y50dz.bin
c:\windows\system32\12z95worm10a.bin
c:\windows\system32\13539szambot57d.exe
c:\windows\system32\13668wo5m982z.cpl
c:\windows\system32\13929s5azb9t744.dll
c:\windows\system32\13a79own5ozder3196.ocx
c:\windows\system32\1426wo5z595.bin
c:\windows\system32\14790hzc5t9ol338.ocx
c:\windows\system32\148329ozm7b85.bin
c:\windows\system32\149855azktool92e.dll
c:\windows\system32\14cbst9alz445.exe
c:\windows\system32\15055spyz59.ocx
c:\windows\system32\15079spamboz541.bin
c:\windows\system32\15097spz5bo94c7.cpl
c:\windows\system32\15280hack5o9l43z.dll
c:\windows\system32\15294z9rus155.ocx
c:\windows\system32\152downloadez9332.bin
c:\windows\system32\15399hack9oolez.dll
c:\windows\system32\1556ste9lz14.exe
c:\windows\system32\156129zo5241.ocx
c:\windows\system32\1569vi9952z.bin
c:\windows\system32\156fspyw9re213z.dll
c:\windows\system32\15716hackto9l2cz.exe
c:\windows\system32\15729spamzot197.bin
c:\windows\system32\15847spzmbot1b29.cpl
c:\windows\system32\15869hreat1z857.cpl
c:\windows\system32\15955hazk9ool4da5.bin
c:\windows\system32\15d25hi9fz669.dll
c:\windows\system32\165dspa9se2265z.exe
c:\windows\system32\170905pz57d.cpl
c:\windows\system32\170dd9znloader518.cpl
c:\windows\system32\17529zroj74a.dll
c:\windows\system32\1764h5ckto9z622.bin
c:\windows\system32\17658n5t-a-vizus929.exe
c:\windows\system32\17a4t9iez645.dll
c:\windows\system32\18135a9ztool6da.dll
c:\windows\system32\18787worm9e5z.bin
c:\windows\system32\18815v9rusza0.cpl
c:\windows\system32\18878no9-5zvirus186.exe
c:\windows\system32\18981not-a-virzs657.cpl
c:\windows\system32\18bcspyw5ze393.bin
c:\windows\system32\19526hzcktool65e.dll
c:\windows\system32\19839zackto5l34.cpl
c:\windows\system32\19d3spzrse15709.cpl
c:\windows\system32\19ecspars5195z.bin
c:\windows\system32\1a5fbackdo9r952z.dll
c:\windows\system32\1c295ddw9re15z5.ocx
c:\windows\system32\1c9zsparse28159.cpl
c:\windows\system32\1cd8s95zare2208.bin
c:\windows\system32\1cdea9dwzre5405.cpl
c:\windows\system32\1db9vi52577z.cpl
c:\windows\system32\1dfcvi5z932.ocx
c:\windows\system32\1e7cste5l1599z.dll
c:\windows\system32\1e8avir99z55.ocx
c:\windows\system32\1f40thie5922z.dll

c:\windows\system32\1f6zdow5loader12979.dll
c:\windows\system32\1z029sp5109.cpl
c:\windows\system32\1z150vir95772.bin
c:\windows\system32\1z30backdoo52596.cpl
c:\windows\system32\1z359s9y5a5.ocx
c:\windows\system32\1z6395py93.cpl
c:\windows\system32\1z7509orm594.exe
c:\windows\system32\1z79bac5door101.bin
c:\windows\system32\1z929wormb55.ocx
c:\windows\system32\1ze4threa53459.dll
c:\windows\system32\20569zpy34e.dll
c:\windows\system32\20857nzt-a-vi5us691.exe
c:\windows\system32\21760ha5zt9ol3d3.exe
c:\windows\system32\21971spz653.exe
c:\windows\system32\22243not-a-viru9z75.bin
c:\windows\system32\22489wo5m3ze.exe
c:\windows\system32\22615s5azbot5f69.cpl
c:\windows\system32\228z9v5rus5ec.bin
c:\windows\system32\2291zir3578.bin
c:\windows\system32\231195z5ec.exe
c:\windows\system32\23369p5rse260z.ocx
c:\windows\system32\23785hackz5o9398.dll
c:\windows\system32\23859sp5zbot1b2.ocx
c:\windows\system32\23963not-azvir9588.exe
c:\windows\system32\23z905py47c.exe
c:\windows\system32\241z1s5y689.ocx
c:\windows\system32\245379roz590.bin
c:\windows\system32\24862not-a-vi59z196.dll
c:\windows\system32\24z9v5r3165.cpl
c:\windows\system32\2501v9r2z38.ocx
c:\windows\system32\25042zr5j2f09.cpl
c:\windows\system32\25142spyza19.exe
c:\windows\system32\2549hacztool3bb.exe
c:\windows\system32\2557z9orm1b9.dll
c:\windows\system32\255fthreat39263z.dll
c:\windows\system32\256zhack59ol12c.cpl
c:\windows\system32\25929v5ruz5fe.dll
c:\windows\system32\25935spzmbot739.exe
c:\windows\system32\2593viz93395.dll
c:\windows\system32\25995hreaz7808.ocx
c:\windows\system32\25z66tr9j362.bin
c:\windows\system32\25z85s9y759.cpl
c:\windows\system32\26209z5rus1ea.exe
c:\windows\system32\26316v5ru954ez.bin
c:\windows\system32\264739iru565fz.dll
c:\windows\system32\268zth5eat13499.dll
c:\windows\system32\26902worm4z95.ocx
c:\windows\system32\2750spambot195z.dll
c:\windows\system32\275z6no9-a-virus556.exe
c:\windows\system32\2857wo5m1f9z.bin
c:\windows\system32\287z69roj5655.cpl
c:\windows\system32\28z09wor95f55.ocx
c:\windows\system32\294ds5arse94z.cpl
c:\windows\system32\295019py2z3.dll
c:\windows\system32\2956395y1z0.dll
c:\windows\system32\2970zspy358.dll
c:\windows\system32\297spa9b5t3z0.exe
c:\windows\system32\29f0vzr2455.dll
c:\windows\system32\2b62b95kdoorz9.exe
c:\windows\system32\2d02azdwar94175.dll
c:\windows\system32\2d14zac5do9r635.ocx
c:\windows\system32\2dcdt95eat1003z.dll
c:\windows\system32\2fb395arse2237z.cpl
c:\windows\system32\2z545spy796.cpl
c:\windows\system32\2z980viru5b59.cpl
c:\windows\system32\30693v5rus1z2.ocx
c:\windows\system32\30985wzrm5c5.dll
c:\windows\system32\3136zir9985.bin
c:\windows\system32\315spyware23z9.ocx
c:\windows\system32\3198zwor5192.cpl
c:\windows\system32\31e7a9dwar5118z.dll
c:\windows\system32\3211zs5y792.bin

c:\windows\system32\32793vi5zs5bd.ocx
c:\windows\system32\3288s5arsz9754.bin
c:\windows\system32\333zth5ef1292.cpl
c:\windows\system32\339ethi5f151z9.bin
c:\windows\system32\3495addzare2715.exe
c:\windows\system32\35065p924z.bin
c:\windows\system32\351z5spambo97f3.bin
c:\windows\system32\352z4no9-a-virus353.ocx
c:\windows\system32\35945p9ware42z.cpl
c:\windows\system32\3787not9z-virus345.bin
c:\windows\system32\37z3sp5rse2970.exe
c:\windows\system32\38f19ackd5oz522.dll
c:\windows\system32\39132vi5us600z.ocx
c:\windows\system32\39324worz52.cpl
c:\windows\system32\3935no9-a-viruzcf.bin
c:\windows\system32\3945thizf650.cpl
c:\windows\system32\39b5vir174z.exe
c:\windows\system32\3a38t9ief5101z.cpl
c:\windows\system32\3a47backzoor23955.cpl
c:\windows\system32\3ac9s5eal32z4.bin
c:\windows\system32\3c3eaddwar954z6.dll
c:\windows\system32\3c56z9r2575.exe
c:\windows\system32\3e3bback5ozr9060.bin
c:\windows\system32\3f52backdoo9535z.bin
c:\windows\system32\3f85backdzor987.bin
c:\windows\system32\3z95t95j2ad.cpl
c:\windows\system32\3zba9hrea519713.bin
c:\windows\system32\4027backdoor9951z.ocx
c:\windows\system32\41d9a9zw5re1128.exe
c:\windows\system32\426z5hreat29389.ocx
c:\windows\system32\42a59hizf3179.exe
c:\windows\system32\42b5addwarez6829.dll
c:\windows\system32\43c2s9arze514.ocx
c:\windows\system32\4415spy5arez4069.cpl
c:\windows\system32\4463spyw5rz1519.bin
c:\windows\system32\44ff9pywa5e2z60.cpl
c:\windows\system32\4534v5z9694.cpl
c:\windows\system32\453a5pyw9re84z.dll
c:\windows\system32\4559spywarz25295.dll
c:\windows\system32\45bcbacz9oor1954.dll
c:\windows\system32\45bdspaz5e2986.exe
c:\windows\system32\45fzthr5at9975.cpl
c:\windows\system32\45z1spar952262.dll
c:\windows\system32\465dv9r2z55.ocx
c:\windows\system32\469spywaze2511.exe
c:\windows\system32\46bzspy95re232.cpl
c:\windows\system32\48135rzj5119.dll
c:\windows\system32\4875zr9554.ocx
c:\windows\system32\4895threa9292z8.dll
c:\windows\system32\48z2sp95085.dll
c:\windows\system32\490fdowzl5ader1376.exe
c:\windows\system32\4922hac5zool5ea.cpl
c:\windows\system32\49eaaddw5re1z55.ocx
c:\windows\system32\4adfsp5w9re49z.dll
c:\windows\system32\4b3fsza5se419.exe
c:\windows\system32\4c5ad95nloadzr2710.cpl
c:\windows\system32\4c6zs9eal915.exe
c:\windows\system32\4d32zhi5f2579.bin
c:\windows\system32\4d9zste5l1025.cpl
c:\windows\system32\4e9fd5wnloaderz482.bin
c:\windows\system32\4f655hre9t8z04.ocx
c:\windows\system32\4f9cvir1z955.dll
c:\windows\system32\4fd9s9ar5e200z.cpl
c:\windows\system32\4z70spa59e495.bin
c:\windows\system32\502atzief1990.ocx
c:\windows\system32\5038tz5j791.ocx
c:\windows\system32\5059spazse982.cpl
c:\windows\system32\50ba9ownload5z1945.ocx
c:\windows\system32\5194tr9jz1c.cpl
c:\windows\system32\51d2spzrs91682.bin
c:\windows\system32\522dbazkdoor1971.dll
c:\windows\system32\5241spa9bot16z.cpl

c:\windows\system32\5241spa9bot16z.cpl
c:\windows\system32\5241szyw95e2733.ocx
c:\windows\system32\5248hack9ozl62b.ocx
c:\windows\system32\5277st5al4z9.ocx
c:\windows\system32\5295azdware1454.bin
c:\windows\system32\52f8z5arse917.exe
c:\windows\system32\539athzeat7500.dll
c:\windows\system32\53b5t9rezt71415.cpl
c:\windows\system32\53z7steal956.cpl
c:\windows\system32\5462nzt-a59irus135.exe
c:\windows\system32\550ezparse1915.ocx
c:\windows\system32\5549zp952c.cpl
c:\windows\system32\55928trojz91.dll
c:\windows\system32\55973szy5b5.exe
c:\windows\system32\55a7zir549.exe
c:\windows\system32\55ccbaczdo9r1442.cpl
c:\windows\system32\55ccthre9t2504z.cpl
c:\windows\system32\5605download9r1775z.ocx
c:\windows\system32\56191trzj12b9.dll
c:\windows\system32\5663zownloade52069.dll
c:\windows\system32\5672tzief15519.bin
c:\windows\system32\56990tr9z30f.cpl
c:\windows\system32\569v9ruz3f5.exe
c:\windows\system32\571asteal9z.ocx
c:\windows\system32\5739n9z-a-virus57d.bin
c:\windows\system32\5759vir3z825.cpl
c:\windows\system32\5795threat1219z.dll
c:\windows\system32\58099py7a1z.dll
c:\windows\system32\5853v9r215z.dll
c:\windows\system32\58892z9rus5b1.dll
c:\windows\system32\58z1vir979.dll
c:\windows\system32\58z8addw9re2952.dll
c:\windows\system32\593dthreat2581z.exe
c:\windows\system32\5949threat6z36.exe
c:\windows\system32\594ds5arse2951z.ocx
c:\windows\system32\597z0spamb9t556.bin
c:\windows\system32\59849roz148.ocx
c:\windows\system32\5997spzware27809.cpl
c:\windows\system32\59bzsteal515.bin
c:\windows\system32\59dazteal1909.bin
c:\windows\system32\59z7vir56819.cpl
c:\windows\system32\5a70a9dwzre2652.cpl
c:\windows\system32\5a85thiefz894.exe
c:\windows\system32\5ad5t9rzat21383.cpl
c:\windows\system32\5af2t9reaz31344.cpl
c:\windows\system32\5bc9thz5f1299.ocx
c:\windows\system32\5c7a9h5ef8z8.cpl
c:\windows\system32\5c93threaz18204.cpl
c:\windows\system32\5ceethreat1z975.dll
c:\windows\system32\5ec5addwarz6219.cpl
c:\windows\system32\5f77sp5rsz1091.dll
c:\windows\system32\5fa7stezl2963.dll
c:\windows\system32\5fe0bac9door231z.dll
c:\windows\system32\5z565p953.cpl
c:\windows\system32\5z5fsteal29129.bin
c:\windows\system32\6148sz5al399.dll
c:\windows\system32\6154d9wnloaderz414.dll
c:\windows\system32\63409ot5a-viruz3b2.cpl
c:\windows\system32\649spyware15z35.dll
c:\windows\system32\64eezir2985.exe
c:\windows\system32\653z9hreat6936.ocx
c:\windows\system32\65cb5zckdoor21759.cpl
c:\windows\system32\66159py185z.dll
c:\windows\system32\67915hrzat4948.bin
c:\windows\system32\6902thief20z5.ocx
c:\windows\system32\6922bzckdoor5734.exe
c:\windows\system32\6975troj9zf5.dll
c:\windows\system32\6988s5yware241z.exe
c:\windows\system32\69a5spywarez195.exe
c:\windows\system32\69z9spars51903.exe
c:\windows\system32\6ab0addwar51z59.exe
c:\windows\system32\6b89hreat1z951.ocx
c:\windows\system32\6cdadzw9re5736.dll

c:\windows\system32\6d1bspa5sz9872.cpl
c:\windows\system32\6e2z5ddware1980.bin
c:\windows\system32\6eafaddwa9e253z5.ocx
c:\windows\system32\6z69spars915555.cpl
c:\windows\system32\70295hreat190z2.exe
c:\windows\system32\7050zorm490.dll
c:\windows\system32\7108hackt5ol3z9.exe
c:\windows\system32\714bspz9a5e547.cpl
c:\windows\system32\71z8sp59are192.exe
c:\windows\system32\7225troj2z9.ocx
c:\windows\system32\7254down9oazer12865.ocx
c:\windows\system32\7357hack5oo97ez.ocx
c:\windows\system32\735fadd5are9z49.ocx
c:\windows\system32\73ecspywaze32559.ocx
c:\windows\system32\7493downl59der131z.exe
c:\windows\system32\74d5downzoa9er810.bin
c:\windows\system32\7547not-5-virusz59.exe
c:\windows\system32\7561t9rzat31039.bin
c:\windows\system32\75e6azdwar92382.cpl
c:\windows\system32\75efdzwnloa9er2362.dll
c:\windows\system32\7750no5-z-virus7369.exe
c:\windows\system32\779csp5rsz2157.dll
c:\windows\system32\78e0spywa5ez4779.cpl
c:\windows\system32\791zspar5e1216.ocx
c:\windows\system32\793addw95ez727.cpl
c:\windows\system32\7967spazbot4415.dll
c:\windows\system32\7975viruz5ee.ocx
c:\windows\system32\7996tr5j19z.bin
c:\windows\system32\79c1zownloade95365.exe
c:\windows\system32\7d69steal3z5.dll
c:\windows\system32\7dd3azdware97955.bin
c:\windows\system32\7f0f9zwnloade5623.exe
c:\windows\system32\7fz9bac5door2255.dll
c:\windows\system32\7z199parse20935.bin
c:\windows\system32\7z42sp5rse899.cpl
c:\windows\system32\80zorm985.exe
c:\windows\system32\8135zir9s510.bin
c:\windows\system32\81919p5mboz7c3.bin
c:\windows\system32\8799hacktoolzf05.exe
c:\windows\system32\8957spam5oz240.dll
c:\windows\system32\90901spy6z15.dll
c:\windows\system32\90fbvirz7875.cpl
c:\windows\system32\917wzr91cb5.ocx
c:\windows\system32\92595spy3z3.bin
c:\windows\system32\9320spa5se1606z.dll
c:\windows\system32\932z8hacktool1d5.dll
c:\windows\system32\934v9rus235z.ocx
c:\windows\system32\93513not-a-viruz2695.dll
c:\windows\system32\9353h9cztool315.cpl
c:\windows\system32\938ztro590.exe
c:\windows\system32\952thiez51.cpl
c:\windows\system32\9565zworm75a.bin
c:\windows\system32\96059spz149.ocx
c:\windows\system32\9642addware25z0.cpl
c:\windows\system32\9659wormz6.dll
c:\windows\system32\97z7spar5e93.exe
c:\windows\system32\99z55hacktool5d5.dll
c:\windows\system32\9b2z5hreat10908.cpl
c:\windows\system32\9b90spyware3z05.ocx
c:\windows\system32\9b93thre5z30074.bin
c:\windows\system32\9cz5steal3086.bin
c:\windows\system32\9e44szyware582.ocx
c:\windows\system32\9edfba5kdozr995.bin
c:\windows\system32\9z4fspa5se2196.exe
c:\windows\system32\a409ownzoade51149.ocx
c:\windows\system32\a9athzeat28885.bin
c:\windows\system32\b4abackdz5r22829.dll
c:\windows\system32\bz55teal2915.exe
c:\windows\system32\db2addw9ze456.ocx
c:\windows\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
c:\windows\system32\drivers\Msft_Kernel_LUsbFilt_01005.Wdf
c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf

c:\windows\system32\e54z5reat99582.cpl
c:\windows\system32\e5baddware39z3.exe
c:\windows\system32\nvs2.inf
c:\windows\system32\z03255pambot559.ocx
c:\windows\system32\z0502spy797.dll
c:\windows\system32\z0955worm3f.cpl
c:\windows\system32\z0bv5r1798.exe
c:\windows\system32\z228s5y59b.bin
c:\windows\system32\z239thie5256.exe
c:\windows\system32\z29thre5t3289.exe
c:\windows\system32\z3891virus515.bin
c:\windows\system32\z3912viru55d6.cpl
c:\windows\system32\z414do9nloader2455.ocx
c:\windows\system32\z55685pyf9.exe
c:\windows\system32\z57159orm221.bin
c:\windows\system32\z59f9ddware1790.exe
c:\windows\system32\z64795rm1c1.ocx
c:\windows\system32\z6898viru551.cpl
c:\windows\system32\z7651s5y9e5.bin
c:\windows\system32\z959dow5loader1777.cpl
c:\windows\system32\z96edo9nloader75.exe
c:\windows\system32\z9acsteal29715.exe
c:\windows\system32\zb985ir1188.ocx
c:\windows\system32\zd47ste5l9092.bin
c:\windows\system32\zd64thief3599.cpl
c:\windows\z0487hacktool9f35.bin
c:\windows\z05199ro5635.bin
c:\windows\z075d9w5loader1709.exe
c:\windows\z0b095ief173.ocx
c:\windows\z1290tro56a19.dll
c:\windows\z1859ir1847.dll
c:\windows\z2559virus554.ocx
c:\windows\z2641tr5j5b59.cpl
c:\windows\z322not-a-v5rus19f.cpl
c:\windows\z449troj356.cpl
c:\windows\z457vir9203.exe
c:\windows\z4934troj6415.dll
c:\windows\z511downloader3967.cpl
c:\windows\z54vi9us341.cpl
c:\windows\z5797virus787.cpl
c:\windows\z5esteal15359.exe
c:\windows\z645st9al350.dll
c:\windows\z669thi5f161.cpl
c:\windows\z69935pambot64a.exe
c:\windows\z86559py716.dll
c:\windows\z94bdownloader28579.ocx
c:\windows\z959w9rm5c1.exe
c:\windows\z9799s5y7c9.ocx
c:\windows\z9bethi5f14129.ocx
c:\windows\za95threat19700.exe
c:\windows\zb07thief1569.ocx
c:\windows\zb8dspar591975.bin
c:\windows\zc9cs5eal3004.cpl
c:\windows\zd1steal52049.ocx
c:\windows\zf5t9ief1559.bin
D:\Autorun.inf

((((((((((((((((((((((((( Files Created from 2009-05-03 to 2009-06-03 )))))))))))))))))))))))))))))))
.

2009-06-03 20:21 . 2009-06-03 20:21 18400 ----a-w- c:\windows\system32\16z99ac5tool6.dll
2009-06-03 15:28 . 2009-05-26 12:20 40160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-03 15:28 . 2009-06-03 15:28 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-06-03 15:28 . 2009-06-03 15:41 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-06-03 15:28 . 2009-05-26 12:19 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-06-03 00:56 . 2009-06-03 00:56 13286 ----a-w- c:\windows\110179pam5zt7.dll
2009-06-03 00:56 . 2009-06-03 00:56 361472 ----a-w- c:\windows\system32\tempo-setup2.exe
2009-06-03 00:55 . 2009-06-03 00:55 -------- d-----w- c:\program files\PluginVideo
2009-05-29 17:22 . 2009-05-29 17:22 -------- d-----w- c:\documents and settings\All Users\Application Data\TEMP
2009-05-29 17:21 . 2009-05-29 17:21 -------- d-----w- c:\program files\LSoft Technologies
2009-05-28 22:33 . 2009-05-28 22:33 -------- d-----w- c:\program files\BitTorrent
2009-05-21 07:36 . 2009-05-21 07:36 -------- d-----w- C:\.jagex_cache_32
2009-05-17 10:27 . 2009-05-17 10:27 -------- d-----w- c:\program files\JavaFX
2009-05-17 09:41 . 2009-05-17 09:41 -------- d-----w- c:\documents and settings\john\Application Data\TortoiseSVN
2009-05-17 09:41 . 2009-05-17 09:41 -------- d-----w- c:\documents and settings\john\Application Data\Subversion
2009-05-17 09:40 . 2009-06-02 17:35 -------- d-----w- c:\documents and settings\john\Local Settings\Application Data\TSVNCache
2009-05-17 09:40 . 2009-05-17 09:40 -------- d-----w- c:\program files\TortoiseSVN
2009-05-17 09:40 . 2009-05-17 09:40 -------- d-----w- c:\program files\Common Files\TortoiseOverlays
2009-05-16 12:12 . 2009-05-16 12:12 -------- d-----w- c:\program files\Common Files\HanGameAvatar
2009-05-09 23:40 . 2009-05-09 23:40 103872 ----a-w- c:\windows\system32\drivers\AnyDVD.sys
2009-05-09 17:05 . 2009-05-09 17:05 -------- d-----w- c:\program files\Common Files\DivX Shared
2009-05-04 17:31 . 2009-05-04 17:31 17801 ----a-w- c:\windows\system32\drivers\AegisP.sys
2009-05-04 17:29 . 2003-07-24 11:10 17149 ----a-w- c:\windows\system32\DNINDIS5.sys
2009-05-04 17:29 . 2005-08-05 05:00 192512 ----a-r- c:\windows\system32\AegisI5.exe
2009-05-04 17:29 . 2004-04-18 15:43 147456 ----a-w- c:\windows\system32\ssleay32.dll
2009-05-04 17:29 . 2004-04-18 15:43 651264 ----a-w- c:\windows\system32\libeay32.dll
2009-05-04 17:29 . 2003-07-24 11:10 94208 ----a-w- c:\windows\system32\DNIN50.dll
2009-05-04 17:29 . 2009-05-04 17:29 -------- d-----w- c:\program files\NETGEAR

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-03 16:50 . 2008-02-29 16:47 -------- d-----w- c:\documents and settings\john\Application Data\DNA
2009-06-03 16:37 . 2007-04-09 01:15 -------- d-----w- c:\program files\Java
2009-06-03 16:30 . 2008-04-01 18:43 -------- d-----w- c:\program files\LimeWire
2009-06-03 16:29 . 2007-03-28 21:06 -------- d-----w- c:\program files\Symantec
2009-06-03 16:28 . 2007-03-28 21:06 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-06-03 16:28 . 2007-04-13 12:54 -------- d-----w- c:\program files\MSN Messenger
2009-06-03 16:27 . 2007-03-30 17:47 -------- d-----w- c:\documents and settings\All Users\Application Data\Viewpoint
2009-06-03 16:27 . 2008-02-21 14:34 -------- d-----w- c:\program files\World of Warcraft
2009-06-03 16:14 . 2008-07-02 02:44 34 ----a-w- c:\documents and settings\john\jagex_runescape_preferences.dat
2009-06-03 16:11 . 2008-11-14 08:49 -------- d-----w- c:\program files\Steam
2009-06-03 16:10 . 2008-02-29 16:47 -------- d-----w- c:\program files\DNA
2009-06-03 00:58 . 2008-02-29 16:47 -------- d-----w- c:\documents and settings\john\Application Data\BitTorrent
2009-06-02 17:35 . 2009-04-08 15:43 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater
2009-05-31 17:12 . 2009-01-24 21:25 -------- d-----w- c:\program files\Warcraft III
2009-05-21 19:31 . 2008-04-08 11:04 -------- d-----w- c:\documents and settings\john\Application Data\LimeWire
2009-05-17 10:25 . 2008-12-25 10:47 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-05-09 17:05 . 2007-08-30 12:29 -------- d-----w- c:\program files\DivX
2009-05-04 17:29 . 2007-03-23 08:39 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-04-27 14:08 . 2008-12-08 17:27 -------- d-----w- c:\program files\Curse
2009-04-10 09:01 . 2009-04-10 09:01 -------- d-----w- c:\program files\Ubisoft
2009-04-08 15:44 . 2007-07-30 08:49 -------- d-----w- c:\program files\Google
2009-04-03 18:29 . 2007-03-23 10:28 47152 ----a-w- c:\documents and settings\john\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-01 04:42 . 2009-02-03 11:25 42632 ----a-w- c:\windows\system32\drivers\maploml.sys
2009-04-01 04:41 . 2008-02-07 18:50 40584 ----a-w- c:\windows\system32\drivers\maplom.sys
2009-03-26 09:47 . 2009-03-27 22:42 151552 ----a-w- c:\windows\system32\PubPlugin.dll
2009-03-20 21:26 . 2009-02-14 01:09 23383 ----a-w- c:\windows\War3Unin.dat
2009-03-11 14:42 . 2009-03-11 14:42 152576 ----a-w- c:\documents and settings\john\Application Data\Sun\Java\jre1.6.0_12\lzma.dll
2009-03-06 14:22 . 2004-08-03 23:56 284160 ----a-w- c:\windows\system32\pdh.dll
2007-09-19 14:46 . 2007-09-19 14:45 24 --sh--w- c:\windows\SF64EDC35.tmp
.

------- Sigcheck -------

[-] 2004-08-03 23:56 14336 8F078AE4ED187AAABC0A305146DE6716 c:\windows\$NtServicePackUninstall$\svchost.exe
[-] 2008-04-14 00:12 14336 27C6D03BCDB8CFEB96B716F3D8BE3E18 c:\windows\ServicePackFiles\i386\svchost.exe
[-] 2008-04-14 00:12 14336 27C6D03BCDB8CFEB96B716F3D8BE3E18 c:\windows\system32\svchost.exe

[-] 2005-03-02 18:19 577024 1800F293BCCC8EDE8A70E12B88D80036 c:\windows\$hf_mig$\KB890859\SP2QFE\user32.dll
[-] 2007-03-08 15:48 578048 7AA4F6C00405DFC4B70ED4214E7D687B c:\windows\$hf_mig$\KB925902\SP2QFE\user32.dll
[-] 2007-03-08 15:36 577536 B409909F6E2E8A7067076ED748ABF1E7 c:\windows\$NtServicePackUninstall$\user32.dll
[-] 2004-08-03 23:56 577024 C72661F8552ACE7C5C85E16A3CF505C4 c:\windows\$NtUninstallKB890859$\user32.dll
[-] 2005-03-02 18:09 577024 DE2DB164BBB35DB061AF0997E4499054 c:\windows\$NtUninstallKB925902$\user32.dll
[-] 2008-04-14 00:12 578560 B26B135FF1B9F60C9388B4A7D16F600B c:\windows\ServicePackFiles\i386\user32.dll
[-] 2008-04-14 00:12 578560 B26B135FF1B9F60C9388B4A7D16F600B c:\windows\system32\user32.dll

[-] 2004-08-03 23:56 82944 2ED0B7F12A60F90092081C50FA0EC2B2 c:\windows\$NtServicePackUninstall$\ws2_32.dll
[-] 2008-04-14 00:12 82432 2CCC474EB85CEAA3E1FA1726580A3E5A c:\windows\ServicePackFiles\i386\ws2_32.dll
[-] 2008-04-14 00:12 82432 2CCC474EB85CEAA3E1FA1726580A3E5A c:\windows\system32\ws2_32.dll

[-] 2006-04-20 12:18 360576 B2220C618B42A2212A59D91EBD6FC4B4 c:\windows\$hf_mig$\KB917953\SP2QFE\tcpip.sys
[-] 2007-10-30 16:53 360832 64798ECFA43D78C7178375FCDD16D8C8 c:\windows\$hf_mig$\KB941644\SP2QFE\tcpip.sys
[-] 2008-06-20 10:44 360960 744E57C99232201AE98C49168B918F48 c:\windows\$hf_mig$\KB951748\SP2QFE\tcpip.sys
[-] 2008-06-20 11:51 361600 9AEFA14BD6B182D61E3119FA5F436D3D c:\windows\$hf_mig$\KB951748\SP3GDR\tcpip.sys
[-] 2008-06-20 11:59 361600 AD978A1B783B5719720CFF204B666C8E c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
[-] 2008-06-20 10:45 360320 2A5554FC5B1E04E131230E3CE035C3F9 c:\windows\$NtServicePackUninstall$\tcpip.sys
[-] 2004-08-03 22:14 359040 9F4B36614A0FC234525BA224957DE55C c:\windows\$NtUninstallKB917953$\tcpip.sys
[-] 2006-04-20 11:51 359808 1DBF125862891817F374F407626967F4 c:\windows\$NtUninstallKB941644$\tcpip.sys
[-] 2008-04-13 19:20 361344 93EA8D04EC73A85DB02EB8805988F733 c:\windows\$NtUninstallKB951748$\tcpip.sys
[-] 2007-10-30 17:20 360064 90CAFF4B094573449A0872A0F919B178 c:\windows\$NtUninstallKB951748_0$\tcpip.sys
[-] 2008-04-13 19:20 361344 93EA8D04EC73A85DB02EB8805988F733 c:\windows\ServicePackFiles\i386\tcpip.sys
[-] 2008-06-20 11:51 361600 9AEFA14BD6B182D61E3119FA5F436D3D c:\windows\system32\dllcache\tcpip.sys
[-] 2008-06-20 11:51 361600 9AEFA14BD6B182D61E3119FA5F436D3D c:\windows\system32\drivers\tcpip.sys

[-] 2004-08-03 23:56 502272 01C3346C241652F43AED8E2149881BFE c:\windows\$NtServicePackUninstall$\winlogon.exe
[-] 2008-04-14 00:12 507904 ED0EF0A136DEC83DF69F04118870003E c:\windows\ServicePackFiles\i386\winlogon.exe
[-] 2008-04-14 00:12 507904 ED0EF0A136DEC83DF69F04118870003E c:\windows\system32\winlogon.exe

[-] 2004-08-03 22:14 182912 558635D3AF1C7546D26067D5D9B6959E c:\windows\$NtServicePackUninstall$\ndis.sys
[-] 2008-04-13 19:20 182656 1DF7F42665C94B825322FAE71721130D c:\windows\ServicePackFiles\i386\ndis.sys

[-] 2008-04-13 19:20 182656 1DF7F42665C94B825322FAE71721130D c:\windows\ServicePackFiles\i386\ndis.sys
[-] 2008-04-13 19:20 182656 1DF7F42665C94B825322FAE71721130D c:\windows\system32\drivers\ndis.sys

[-] 2004-08-03 22:00 29056 4448006B6BC60E6C027932CFC38D6855 c:\windows\$NtServicePackUninstall$\ip6fw.sys
[-] 2008-04-13 18:53 36608 3BB22519A194418D5FEC05D800A19AD0 c:\windows\ServicePackFiles\i386\ip6fw.sys
[-] 2008-04-13 18:53 36608 3BB22519A194418D5FEC05D800A19AD0 c:\windows\system32\drivers\ip6fw.sys

[-] 2008-04-14 00:12 1033728 12896823FB95BFB3DC9B46BCAEDC9923 c:\windows\explorer.exe
[-] 2007-06-13 11:26 1033216 7712DF0CDDE3A5AC89843E61CD5B3658 c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
[-] 2007-06-13 10:23 1033216 97BD6515465659FF8F3B7BE375B2EA87 c:\windows\$NtServicePackUninstall$\explorer.exe
[-] 2004-08-03 23:56 1032192 A0732187050030AE399B241436565E64 c:\windows\$NtUninstallKB938828$\explorer.exe
[-] 2008-04-14 00:12 1033728 12896823FB95BFB3DC9B46BCAEDC9923 c:\windows\ServicePackFiles\i386\explorer.exe

[-] 2004-08-03 23:56 13312 84885F9B82F4D55C6146EBF6065D75D2 c:\windows\$NtServicePackUninstall$\lsass.exe
[-] 2008-04-14 00:12 13312 BF2466B3E18E970D8A976FB95FC1CA85 c:\windows\ServicePackFiles\i386\lsass.exe
[-] 2008-04-14 00:12 13312 BF2466B3E18E970D8A976FB95FC1CA85 c:\windows\system32\lsass.exe

[-] 2004-08-03 23:56 15360 24232996A38C0B0CF151C2140AE29FC8 c:\windows\$NtServicePackUninstall$\ctfmon.exe
[-] 2008-04-14 00:12 15360 5F1D5F88303D4A4DBC8E5F97BA967CC3 c:\windows\ServicePackFiles\i386\ctfmon.exe
[-] 2008-04-14 00:12 15360 5F1D5F88303D4A4DBC8E5F97BA967CC3 c:\windows\system32\ctfmon.exe

[-] 2005-06-11 00:17 57856 AD3D9D191AEA7B5445FE1D82FFBB4788 c:\windows\$hf_mig$\KB896423\SP2QFE\spoolsv.exe
[-] 2005-06-10 23:53 57856 DA81EC57ACD4CDC3D4C51CF3D409AF9F c:\windows\$NtServicePackUninstall$\spoolsv.exe
[-] 2004-08-03 23:56 57856 7435B108B935E42EA92CA94F59C8E717 c:\windows\$NtUninstallKB896423$\spoolsv.exe
[-] 2008-04-14 00:12 57856 D8E14A61ACC1D4A6CD0D38AEBAC7FA3B c:\windows\ServicePackFiles\i386\spoolsv.exe
[-] 2008-04-14 00:12 57856 D8E14A61ACC1D4A6CD0D38AEBAC7FA3B c:\windows\system32\spoolsv.exe

[-] 2004-08-03 23:56 24576 39B1FFB03C2296323832ACBAE50D2AFF c:\windows\$NtServicePackUninstall$\userinit.exe
[-] 2008-04-14 00:12 26112 A93AEE1928A9D7CE3E16D24EC7380F89 c:\windows\ServicePackFiles\i386\userinit.exe
[-] 2008-04-14 00:12 26112 A93AEE1928A9D7CE3E16D24EC7380F89 c:\windows\system32\userinit.exe

[-] 2004-08-03 23:56 295424 B60C877D16D9C880B952FDA04ADF16E6 c:\windows\$NtServicePackUninstall$\termsrv.dll
[-] 2008-04-14 00:12 295424 FF3477C03BE7201C294C35F684B3479F c:\windows\ServicePackFiles\i386\termsrv.dll
[-] 2008-04-14 00:12 295424 FF3477C03BE7201C294C35F684B3479F c:\windows\system32\termsrv.dll

[-] 2004-08-03 23:56 17408 1B5F6923ABB450692E9FE0672C897AED c:\windows\$NtServicePackUninstall$\powrprof.dll
[-] 2008-04-14 00:12 17408 50A166237A0FA771261275A405646CC0 c:\windows\ServicePackFiles\i386\powrprof.dll
[-] 2008-04-14 00:12 17408 50A166237A0FA771261275A405646CC0 c:\windows\system32\powrprof.dll

[-] 2004-08-03 23:56 110080 87CA7CE6469577F059297B9D6556D66D c:\windows\$NtServicePackUninstall$\imm32.dll
[-] 2008-04-14 00:11 110080 0DA85218E92526972A821587E6A8BF8F c:\windows\ServicePackFiles\i386\imm32.dll
[-] 2008-04-14 00:11 110080 0DA85218E92526972A821587E6A8BF8F c:\windows\system32\imm32.dll

[-] 2004-08-03 23:56 1580544 30A609E00BD1D4FFC49D6B5A432BE7F2 c:\windows\$NtServicePackUninstall$\sfcfiles.dll
[-] 2008-04-14 00:12 1614848 9DD07AF82244867CA36681EA2D29CE79 c:\windows\ServicePackFiles\i386\sfcfiles.dll
[-] 2008-04-14 00:12 1614848 9DD07AF82244867CA36681EA2D29CE79 c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal]
@="{C5994560-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}]
2008-11-02 08:26 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified]
@="{C5994561-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}]
2008-11-02 08:26 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict]
@="{C5994562-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}]
2008-11-02 08:26 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked]
@="{C5994563-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}]
2008-11-02 08:26 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

@="{C5994563-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}]
2008-11-02 08:26 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly]
@="{C5994564-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}]
2008-11-02 08:26 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted]
@="{C5994565-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}]
2008-11-02 08:26 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded]
@="{C5994566-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}]
2008-11-02 08:26 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored]
@="{C5994567-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}]
2008-11-02 08:26 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned]
@="{C5994568-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}]
2008-11-02 08:26 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-04-21 94208]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"AnyDVD"="c:\program files\SlySoft\AnyDVD\AnyDVDtray.exe" [2009-05-10 4021184]
"CTSyncU.exe"="c:\program files\Creative\Sync Manager Unicode\CTSyncU.exe" [2006-06-12 700416]
"EA Core"="c:\program files\Electronic Arts\EADM\Core.exe" [2009-02-06 3325952]
"BTAgile"="c:\program files\BT Broadband Talk Softphone\BTAgile.exe" [2007-06-18 61440]
"Veoh"="c:\program files\Veoh Networks\Veoh\VeohClient.exe" [2008-08-28 3660848]
"Steam"="c:\program files\Steam\Steam.exe" [2009-05-20 1217784]
"PlayNC Launcher"="c:\program files\ncsoft\launcher\NCLauncher.exe" [2009-06-03 38136]
"BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2009-05-28 321344]
"tempo-setup2.exe"="c:\windows\system32\tempo-setup2.exe" [2009-06-03 361472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-03 13529088]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696]
"RealTray"="c:\program files\Real\RealPlayer\RealPlay.exe" [2007-03-30 26112]
"WMAAD"="c:\program files\Sony\WALKMAN Launcher\WMAAD.exe" [2007-02-16 110592]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-11 81920]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-03 86016]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2006-08-14 16050176]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2008-05-03 1630208]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" - c:\windows\KHALMNPR.Exe [2007-09-21 55824]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2005-04-25 36040]

c:\documents and settings\john\Start Menu\Programs\Startup\
Registration Heroes of Might & Magic 5.LNK - c:\program files\Ubisoft\Heroes of Might and Magic V\registration\RegistrationReminder.exe [2009-4-10 868352]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
hp psc 2000 Series.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe [2003-4-6 323646]
hpoddt01.exe.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2003-4-6 28672]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2008-12-16 784912]
NETGEAR WG111T Smart Wizard.lnk - c:\program files\NETGEAR\WG111T\wlan111t.exe [2009-5-4 884840]
Photo Loader supervisory.lnk - c:\program files\CASIO\Photo Loader\Plauto.exe [2007-8-24 217088]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"NoDispBackgroundPage"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2007-11-15 10:10 72208 ----a-w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\BT Broadband Talk Softphone\\BTSoftphone.exe"=
"c:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Program Files\\Electronic Arts\\EADM\\Core.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Warcraft III\\Warcraft III.exe"=
"c:\\Program Files\\Nero\\Nero 7\\Nero Home\\NeroHome.exe"=
"c:\\Program Files\\NCsoft\\Exteel (US)\\System\\Exteel.exe"=
"c:\\Program Files\\Steam\\SteamApps\\common\\football manager 2009\\fm.exe"=
"d:\\Program Files (x86)\\Warcraft III\\Warcraft III.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724
"8088:UDP"= 8088:UDP:Battle of middle lol

R0 xfilt;VIA SATA IDE Hot-plug Driver;c:\windows\system32\drivers\xfilt.sys [09/06/2007 15:05 11264]
S2 gupdate1c9b860dfcbbd94;Google Update Service (gupdate1c9b860dfcbbd94);c:\program files\Google\Update\GoogleUpdate.exe [08/04/2009 16:44 133104]
S3 ALLOW-IO;ALLOW-IO;\??\d:\allow-io.sys --> d:\ALLOW-IO.sys [?]
S3 DNINDIS5;DNINDIS5 NDIS Protocol Driver;c:\windows\system32\DNINDIS5.sys [04/05/2009 18:29 17149]
S3 gel90xne;gel90xne;\??\c:\docume~1\pete\LOCALS~1\Temp\gel90xne.sys --> c:\docume~1\pete\LOCALS~1\Temp\gel90xne.sys [?]
S3 ICScsiSV;Image Converter SCSI Service;c:\program files\Sony\IMAGE CONVERTER 3\ICScsiSV.exe [06/10/2007 15:11 75952]
S3 IcVzMonLauncher;IcVzMonLauncher;c:\program files\Sony\IMAGE CONVERTER 3\IcVzMonLauncher.exe [06/10/2007 15:11 67760]
S3 MaplomL;MaplomL;c:\windows\system32\drivers\maploml.sys [03/02/2009 12:25 42632]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]

--- Other Services/Drivers In Memory ---

*Deregistered* - GhPciScan
.
Contents of the 'Scheduled Tasks' folder

2009-05-02 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]

2008-02-16 c:\windows\Tasks\FRU Task 2003-04-06 08:52ewlett-Packard2003-04-06 08:52p psc 2170 series5E771253C1676EBED677BF361FDFC537825E15B8194622014.job
- c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2003-04-06 00:52]

2009-06-03 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-04-08 15:43]

2009-06-03 c:\windows\Tasks\GoogleUpdateTaskMachine.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-08 15:44]
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-eyeBeam SIP Client - (no file)
HKLM-Run-btbb_McciTrayApp - c:\program files\BT Broadband Desktop Help\bin\BTHelpNotifier.exe
HKLM-Run-ISUSPM Startup - c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe
HKLM-Run-WinBlueSoft - c:\program files\WinBlueSoft Software\WinBlueSoft\WinBlueSoft.exe
HKLM-Run-CmUsbSound - cmcnfgu.cpl
SafeBoot-procexp90.Sys

.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.profootballweekly.com/PFW/default.htm
mSearch Bar = hxxp://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/sb/*http://uk.docs.yahoo.com/info/bt_side.html
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = 127.0.0.1;*.local
uSearchURL,(Default) = hxxp://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/su/*http://uk.search.yahoo.com/
IE: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZUxdm554YYGB
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Transfer by Image Converter 3 - c:\program files\SONY\IMAGE CONVERTER 3\menu.htm
IE: {{08E730A4-FB02-45BD-A900-01E4AD8016F6} - http://www.skybroadband.com
DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
DPF: {65E8E2DC-186A-4AAC-9E56-FDC683055A9E} - hxxp://www.download.com/html/dl/bug211623/CNetOnlineInstall.cab
DPF: {C044CD87-DFB0-4130-A5E4-49361106FBC8} - hxxp://id.hangame.com/common/HanSetup1020.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-03 17:58
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(704)
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
c:\program files\common files\logishrd\bluetooth\LBTServ.dll
.
Completion time: 2009-06-03 18:00
ComboFix-quarantined-files.txt 2009-06-03 17:00

Pre-Run: 97,812,156,416 bytes free
Post-Run: 103,644,389,376 bytes free

1154 --- E O F --- 2009-05-17 09:14

Thats all of it

the 2 pop ups were still popping up whilst i was pasting that although my desktop image has gone back to normal and there isnt an icon for it in the bottom right hand corner ill post again if they come again

Ye the security center alert is still popping up on both sides

Now open a new notepad file.
Input this into the notepad file:

KILLALL::

Driver::
gel90xne
npggsvc

File::
c:\windows\system32\16z99ac5tool6.dll
c:\windows\110179pam5zt7.dll
c:\windows\system32\tempo-setup2.exe
c:\windows\SF64EDC35.tmp

Folder::
c:\program files\BitTorrent
c:\program files\DNA
c:\program files\LimeWire
c:\documents and settings\john\Application Data\DNA
c:\documents and settings\john\Application Data\LimeWire
c:\documents and settings\john\Application Data\BitTorrent

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BitTorrent DNA"=-
"tempo-setup2.exe"=-
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"NoDispBackgroundPage"=-
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=-
"FirewallOverride"=-
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\DNA\\btdna.exe"=-
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=-
[-HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]

Save this as CFScript.txt, save it to your desktop also.
Then drag and drop CFScript.txt into combofix as seen below:


This will open combofix again, agree to it's terms and allow it to run.
It may want to reboot after it's done. (It will warn you if it wants to)
Post the resulting log back here.

ComboFix 09-06-01.03 - john 03/06/2009 18:13.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18.2046.1444 [GMT 1:00]
Running from: c:\documents and settings\john\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\john\Desktop\CFScript.txt

FILE ::
"c:\windows\110179pam5zt7.dll"
"c:\windows\SF64EDC35.tmp"
"c:\windows\system32\16z99ac5tool6.dll"
"c:\windows\system32\tempo-setup2.exe"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\john\Application Data\BitTorrent

c:\documents and settings\john\Application Data\DNA
c:\documents and settings\john\Application Data\DNA\dht.dat
c:\documents and settings\john\Application Data\DNA\dht.dat.old
c:\documents and settings\john\Application Data\DNA\dna.lng
c:\documents and settings\john\Application Data\DNA\resume.dat
c:\documents and settings\john\Application Data\DNA\resume.dat.old
c:\documents and settings\john\Application Data\DNA\rss.dat
c:\documents and settings\john\Application Data\DNA\rss.dat.old
c:\documents and settings\john\Application Data\DNA\settings.dat
c:\documents and settings\john\Application Data\DNA\settings.dat.old
c:\documents and settings\john\Application Data\LimeWire
c:\documents and settings\john\Application Data\LimeWire\active.mojito
c:\documents and settings\john\Application Data\LimeWire\createtimes.cache
c:\documents and settings\john\Application Data\LimeWire\fileurns.bak
c:\documents and settings\john\Application Data\LimeWire\fileurns.cache
c:\documents and settings\john\Application Data\LimeWire\filters.props
c:\documents and settings\john\Application Data\LimeWire\gnutella.net
c:\documents and settings\john\Application Data\LimeWire\installation.props
c:\documents and settings\john\Application Data\LimeWire\library.dat
c:\documents and settings\john\Application Data\LimeWire\limewire.props
c:\documents and settings\john\Application Data\LimeWire\mojito.props
c:\documents and settings\john\Application Data\LimeWire\passive.mojito
c:\documents and settings\john\Application Data\LimeWire\questions.props
c:\documents and settings\john\Application Data\LimeWire\responses.cache
c:\documents and settings\john\Application Data\LimeWire\simpp.xml
c:\documents and settings\john\Application Data\LimeWire\spam.dat
c:\documents and settings\john\Application Data\LimeWire\tables.props
c:\documents and settings\john\Application Data\LimeWire\themes\windows_theme.lwtp
c:\documents and settings\john\Application Data\LimeWire\themes\windows_theme\01_star.gif
c:\documents and settings\john\Application Data\LimeWire\themes\windows_theme\02_star.gif
c:\documents and settings\john\Application Data\LimeWire\themes\windows_theme\03_star.gif
c:\documents and settings\john\Application Data\LimeWire\themes\windows_theme\04_star.gif
c:\documents and settings\john\Application Data\LimeWire\themes\windows_theme\05_star.gif
c:\documents and settings\john\Application Data\LimeWire\themes\windows_theme\chat.gif
c:\documents and settings\john\Application Data\LimeWire\themes\windows_theme\forward_dn.gif
c:\documents and settings\john\Application Data\LimeWire\themes\windows_theme\forward_up.gif
c:\documents and settings\john\Application Data\LimeWire\themes\windows_theme\kill.gif
c:\documents and settings\john\Application Data\LimeWire\themes\windows_theme\kill_on.gif
c:\documents and settings\john\Application Data\LimeWire\themes\windows_theme\logo.png
c:\documents and settings\john\Application Data\LimeWire\themes\windows_theme\notsearching.png
c:\documents and settings\john\Application Data\LimeWire\themes\windows_theme\pause_dn.gif
c:\documents and settings\john\Application Data\LimeWire\themes\windows_theme\pause_up.gif
c:\documents and settings\john\Application Data\LimeWire\themes\windows_theme\play_dn.gif
c:\documents and settings\john\Application Data\LimeWire\themes\windows_theme\play_up.gif
c:\documents and settings\john\Application Data\LimeWire\themes\windows_theme\question.gif
c:\documents and settings\john\Application Data\LimeWire\themes\windows_theme\rewind_dn.gif
c:\documents and settings\john\Application Data\LimeWire\themes\windows_theme\rewind_up.gif
c:\documents and settings\john\Application Data\LimeWire\themes\windows_theme\searching.gif
c:\documents and settings\john\Application Data\LimeWire\themes\windows_theme\stop_dn.gif
c:\documents and settings\john\Application Data\LimeWire\themes\windows_theme\stop_up.gif
c:\documents and settings\john\Application Data\LimeWire\themes\windows_theme\theme.txt
c:\documents and settings\john\Application Data\LimeWire\themes\windows_theme\version.txt
c:\documents and settings\john\Application Data\LimeWire\themes\windows_theme\warning.gif
c:\documents and settings\john\Application Data\LimeWire\ttrees.cache
c:\documents and settings\john\Application Data\LimeWire\ttroot.cache
c:\documents and settings\john\Application Data\LimeWire\version.xml
c:\documents and settings\john\Application Data\LimeWire\xml\data\audio.sxml
c:\program files\BitTorrent
c:\program files\BitTorrent\bittorrent.exe
c:\program files\BitTorrent\BitTorrentIE.2.dll
c:\program files\BitTorrent\uninst.exe
c:\program files\DNA
c:\program files\DNA\btdna.exe
c:\program files\DNA\DNAcpl.cpl
c:\program files\DNA\plugins\npbtdna.dll
c:\program files\LimeWire
c:\program files\LimeWire\hs_err_pid2752.log
c:\program files\LimeWire\limewire.m3u petes music.m3u
c:\windows\110179pam5zt7.dll
c:\windows\SF64EDC35.tmp
c:\windows\system32\16z99ac5tool6.dll
c:\windows\system32\tempo-setup2.exe

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_GEL90XNE
-------\Service_gel90xne


((((((((((((((((((((((((( Files Created from 2009-05-03 to 2009-06-03 )))))))))))))))))))))))))))))))
.

2009-06-03 15:28 . 2009-05-26 12:20 40160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-03 15:28 . 2009-06-03 15:28 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-06-03 15:28 . 2009-06-03 15:41 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-06-03 15:28 . 2009-05-26 12:19 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-06-03 00:55 . 2009-06-03 00:55 -------- d-----w- c:\program files\PluginVideo
2009-05-29 17:22 . 2009-05-29 17:22 -------- d-----w- c:\documents and settings\All Users\Application Data\TEMP
2009-05-29 17:21 . 2009-05-29 17:21 -------- d-----w- c:\program files\LSoft Technologies
2009-05-21 07:36 . 2009-05-21 07:36 -------- d-----w- C:\.jagex_cache_32
2009-05-17 10:27 . 2009-05-17 10:27 -------- d-----w- c:\program files\JavaFX
2009-05-17 09:41 . 2009-05-17 09:41 -------- d-----w- c:\documents and settings\john\Application Data\TortoiseSVN
2009-05-17 09:41 . 2009-05-17 09:41 -------- d-----w- c:\documents and settings\john\Application Data\Subversion
2009-05-17 09:40 . 2009-06-02 17:35 -------- d-----w- c:\documents and settings\john\Local Settings\Application Data\TSVNCache
2009-05-17 09:40 . 2009-05-17 09:40 -------- d-----w- c:\program files\TortoiseSVN
2009-05-17 09:40 . 2009-05-17 09:40 -------- d-----w- c:\program files\Common Files\TortoiseOverlays
2009-05-16 12:12 . 2009-05-16 12:12 -------- d-----w- c:\program files\Common Files\HanGameAvatar
2009-05-09 23:40 . 2009-05-09 23:40 103872 ----a-w- c:\windows\system32\drivers\AnyDVD.sys
2009-05-09 17:05 . 2009-05-09 17:05 -------- d-----w- c:\program files\Common Files\DivX Shared
2009-05-04 17:31 . 2009-05-04 17:31 17801 ----a-w- c:\windows\system32\drivers\AegisP.sys
2009-05-04 17:29 . 2003-07-24 11:10 17149 ----a-w- c:\windows\system32\DNINDIS5.sys
2009-05-04 17:29 . 2005-08-05 05:00 192512 ----a-r- c:\windows\system32\AegisI5.exe
2009-05-04 17:29 . 2004-04-18 15:43 147456 ----a-w- c:\windows\system32\ssleay32.dll
2009-05-04 17:29 . 2004-04-18 15:43 651264 ----a-w- c:\windows\system32\libeay32.dll
2009-05-04 17:29 . 2003-07-24 11:10 94208 ----a-w- c:\windows\system32\DNIN50.dll
2009-05-04 17:29 . 2009-05-04 17:29 -------- d-----w- c:\program files\NETGEAR

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-03 17:20 . 2008-11-14 08:49 -------- d-----w- c:\program files\Steam
2009-06-03 16:37 . 2007-04-09 01:15 -------- d-----w- c:\program files\Java
2009-06-03 16:29 . 2007-03-28 21:06 -------- d-----w- c:\program files\Symantec
2009-06-03 16:28 . 2007-03-28 21:06 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-06-03 16:28 . 2007-04-13 12:54 -------- d-----w- c:\program files\MSN Messenger
2009-06-03 16:27 . 2007-03-30 17:47 -------- d-----w- c:\documents and settings\All Users\Application Data\Viewpoint
2009-06-03 16:27 . 2008-02-21 14:34 -------- d-----w- c:\program files\World of Warcraft
2009-06-03 16:14 . 2008-07-02 02:44 34 ----a-w- c:\documents and settings\john\jagex_runescape_preferences.dat
2009-06-02 17:35 . 2009-04-08 15:43 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater
2009-05-31 17:12 . 2009-01-24 21:25 -------- d-----w- c:\program files\Warcraft III
2009-05-17 10:25 . 2008-12-25 10:47 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-05-09 17:05 . 2007-08-30 12:29 -------- d-----w- c:\program files\DivX
2009-05-04 17:29 . 2007-03-23 08:39 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-04-27 14:08 . 2008-12-08 17:27 -------- d-----w- c:\program files\Curse
2009-04-10 09:01 . 2009-04-10 09:01 -------- d-----w- c:\program files\Ubisoft
2009-04-08 15:44 . 2007-07-30 08:49 -------- d-----w- c:\program files\Google
2009-04-03 18:29 . 2007-03-23 10:28 47152 ----a-w- c:\documents and settings\john\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-01 04:42 . 2009-02-03 11:25 42632 ----a-w- c:\windows\system32\drivers\maploml.sys
2009-04-01 04:41 . 2008-02-07 18:50 40584 ----a-w- c:\windows\system32\drivers\maplom.sys
2009-03-26 09:47 . 2009-03-27 22:42 151552 ----a-w- c:\windows\system32\PubPlugin.dll
2009-03-20 21:26 . 2009-02-14 01:09 23383 ----a-w- c:\windows\War3Unin.dat
2009-03-11 14:42 . 2009-03-11 14:42 152576 ----a-w- c:\documents and settings\john\Application Data\Sun\Java\jre1.6.0_12\lzma.dll
2009-03-06 14:22 . 2004-08-03 23:56 284160 ----a-w- c:\windows\system32\pdh.dll
.

------- Sigcheck -------

[-] 2004-08-03 23:56 14336 8F078AE4ED187AAABC0A305146DE6716 c:\windows\$NtServicePackUninstall$\svchost.exe
[-] 2008-04-14 00:12 14336 27C6D03BCDB8CFEB96B716F3D8BE3E18 c:\windows\ServicePackFiles\i386\svchost.exe
[-] 2008-04-14 00:12 14336 27C6D03BCDB8CFEB96B716F3D8BE3E18 c:\windows\system32\svchost.exe

[-] 2005-03-02 18:19 577024 1800F293BCCC8EDE8A70E12B88D80036 c:\windows\$hf_mig$\KB890859\SP2QFE\user32.dll
[-] 2007-03-08 15:48 578048 7AA4F6C00405DFC4B70ED4214E7D687B c:\windows\$hf_mig$\KB925902\SP2QFE\user32.dll
[-] 2007-03-08 15:36 577536 B409909F6E2E8A7067076ED748ABF1E7 c:\windows\$NtServicePackUninstall$\user32.dll
[-] 2004-08-03 23:56 577024 C72661F8552ACE7C5C85E16A3CF505C4 c:\windows\$NtUninstallKB890859$\user32.dll
[-] 2005-03-02 18:09 577024 DE2DB164BBB35DB061AF0997E4499054 c:\windows\$NtUninstallKB925902$\user32.dll
[-] 2008-04-14 00:12 578560 B26B135FF1B9F60C9388B4A7D16F600B c:\windows\ServicePackFiles\i386\user32.dll
[-] 2008-04-14 00:12 578560 B26B135FF1B9F60C9388B4A7D16F600B c:\windows\system32\user32.dll

[-] 2004-08-03 23:56 82944 2ED0B7F12A60F90092081C50FA0EC2B2 c:\windows\$NtServicePackUninstall$\ws2_32.dll
[-] 2008-04-14 00:12 82432 2CCC474EB85CEAA3E1FA1726580A3E5A c:\windows\ServicePackFiles\i386\ws2_32.dll
[-] 2008-04-14 00:12 82432 2CCC474EB85CEAA3E1FA1726580A3E5A c:\windows\system32\ws2_32.dll

[-] 2006-04-20 12:18 360576 B2220C618B42A2212A59D91EBD6FC4B4 c:\windows\$hf_mig$\KB917953\SP2QFE\tcpip.sys
[-] 2007-10-30 16:53 360832 64798ECFA43D78C7178375FCDD16D8C8 c:\windows\$hf_mig$\KB941644\SP2QFE\tcpip.sys
[-] 2008-06-20 10:44 360960 744E57C99232201AE98C49168B918F48 c:\windows\$hf_mig$\KB951748\SP2QFE\tcpip.sys
[-] 2008-06-20 11:51 361600 9AEFA14BD6B182D61E3119FA5F436D3D c:\windows\$hf_mig$\KB951748\SP3GDR\tcpip.sys
[-] 2008-06-20 11:59 361600 AD978A1B783B5719720CFF204B666C8E c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
[-] 2008-06-20 10:45 360320 2A5554FC5B1E04E131230E3CE035C3F9 c:\windows\$NtServicePackUninstall$\tcpip.sys
[-] 2004-08-03 22:14 359040 9F4B36614A0FC234525BA224957DE55C c:\windows\$NtUninstallKB917953$\tcpip.sys
[-] 2006-04-20 11:51 359808 1DBF125862891817F374F407626967F4 c:\windows\$NtUninstallKB941644$\tcpip.sys
[-] 2008-04-13 19:20 361344 93EA8D04EC73A85DB02EB8805988F733 c:\windows\$NtUninstallKB951748$\tcpip.sys
[-] 2007-10-30 17:20 360064 90CAFF4B094573449A0872A0F919B178 c:\windows\$NtUninstallKB951748_0$\tcpip.sys
[-] 2008-04-13 19:20 361344 93EA8D04EC73A85DB02EB8805988F733 c:\windows\ServicePackFiles\i386\tcpip.sys
[-] 2008-06-20 11:51 361600 9AEFA14BD6B182D61E3119FA5F436D3D c:\windows\system32\dllcache\tcpip.sys
[-] 2008-06-20 11:51 361600 9AEFA14BD6B182D61E3119FA5F436D3D c:\windows\system32\drivers\tcpip.sys

[-] 2004-08-03 23:56 502272 01C3346C241652F43AED8E2149881BFE c:\windows\$NtServicePackUninstall$\winlogon.exe
[-] 2008-04-14 00:12 507904 ED0EF0A136DEC83DF69F04118870003E c:\windows\ServicePackFiles\i386\winlogon.exe
[-] 2008-04-14 00:12 507904 ED0EF0A136DEC83DF69F04118870003E c:\windows\system32\winlogon.exe

[-] 2004-08-03 22:14 182912 558635D3AF1C7546D26067D5D9B6959E c:\windows\$NtServicePackUninstall$\ndis.sys
[-] 2008-04-13 19:20 182656 1DF7F42665C94B825322FAE71721130D c:\windows\ServicePackFiles\i386\ndis.sys
[-] 2008-04-13 19:20 182656 1DF7F42665C94B825322FAE71721130D c:\windows\system32\drivers\ndis.sys

[-] 2004-08-03 22:00 29056 4448006B6BC60E6C027932CFC38D6855 c:\windows\$NtServicePackUninstall$\ip6fw.sys
[-] 2008-04-13 18:53 36608 3BB22519A194418D5FEC05D800A19AD0 c:\windows\ServicePackFiles\i386\ip6fw.sys
[-] 2008-04-13 18:53 36608 3BB22519A194418D5FEC05D800A19AD0 c:\windows\system32\drivers\ip6fw.sys

[-] 2008-04-14 00:12 1033728 12896823FB95BFB3DC9B46BCAEDC9923 c:\windows\explorer.exe
[-] 2007-06-13 11:26 1033216 7712DF0CDDE3A5AC89843E61CD5B3658 c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
[-] 2007-06-13 10:23 1033216 97BD6515465659FF8F3B7BE375B2EA87 c:\windows\$NtServicePackUninstall$\explorer.exe
[-] 2004-08-03 23:56 1032192 A0732187050030AE399B241436565E64 c:\windows\$NtUninstallKB938828$\explorer.exe
[-] 2008-04-14 00:12 1033728 12896823FB95BFB3DC9B46BCAEDC9923 c:\windows\ServicePackFiles\i386\explorer.exe

[-] 2004-08-03 23:56 13312 84885F9B82F4D55C6146EBF6065D75D2 c:\windows\$NtServicePackUninstall$\lsass.exe
[-] 2008-04-14 00:12 13312 BF2466B3E18E970D8A976FB95FC1CA85 c:\windows\ServicePackFiles\i386\lsass.exe
[-] 2008-04-14 00:12 13312 BF2466B3E18E970D8A976FB95FC1CA85 c:\windows\system32\lsass.exe

[-] 2004-08-03 23:56 15360 24232996A38C0B0CF151C2140AE29FC8 c:\windows\$NtServicePackUninstall$\ctfmon.exe
[-] 2008-04-14 00:12 15360 5F1D5F88303D4A4DBC8E5F97BA967CC3 c:\windows\ServicePackFiles\i386\ctfmon.exe
[-] 2008-04-14 00:12 15360 5F1D5F88303D4A4DBC8E5F97BA967CC3 c:\windows\system32\ctfmon.exe

[-] 2005-06-11 00:17 57856 AD3D9D191AEA7B5445FE1D82FFBB4788 c:\windows\$hf_mig$\KB896423\SP2QFE\spoolsv.exe
[-] 2005-06-10 23:53 57856 DA81EC57ACD4CDC3D4C51CF3D409AF9F c:\windows\$NtServicePackUninstall$\spoolsv.exe
[-] 2004-08-03 23:56 57856 7435B108B935E42EA92CA94F59C8E717 c:\windows\$NtUninstallKB896423$\spoolsv.exe
[-] 2008-04-14 00:12 57856 D8E14A61ACC1D4A6CD0D38AEBAC7FA3B c:\windows\ServicePackFiles\i386\spoolsv.exe
[-] 2008-04-14 00:12 57856 D8E14A61ACC1D4A6CD0D38AEBAC7FA3B c:\windows\system32\spoolsv.exe

[-] 2004-08-03 23:56 24576 39B1FFB03C2296323832ACBAE50D2AFF c:\windows\$NtServicePackUninstall$\userinit.exe
[-] 2008-04-14 00:12 26112 A93AEE1928A9D7CE3E16D24EC7380F89 c:\windows\ServicePackFiles\i386\userinit.exe
[-] 2008-04-14 00:12 26112 A93AEE1928A9D7CE3E16D24EC7380F89 c:\windows\system32\userinit.exe

[-] 2004-08-03 23:56 295424 B60C877D16D9C880B952FDA04ADF16E6 c:\windows\$NtServicePackUninstall$\termsrv.dll
[-] 2008-04-14 00:12 295424 FF3477C03BE7201C294C35F684B3479F c:\windows\ServicePackFiles\i386\termsrv.dll
[-] 2008-04-14 00:12 295424 FF3477C03BE7201C294C35F684B3479F c:\windows\system32\termsrv.dll

[-] 2004-08-03 23:56 17408 1B5F6923ABB450692E9FE0672C897AED c:\windows\$NtServicePackUninstall$\powrprof.dll
[-] 2008-04-14 00:12 17408 50A166237A0FA771261275A405646CC0 c:\windows\ServicePackFiles\i386\powrprof.dll
[-] 2008-04-14 00:12 17408 50A166237A0FA771261275A405646CC0 c:\windows\system32\powrprof.dll

[-] 2004-08-03 23:56 110080 87CA7CE6469577F059297B9D6556D66D c:\windows\$NtServicePackUninstall$\imm32.dll
[-] 2008-04-14 00:11 110080 0DA85218E92526972A821587E6A8BF8F c:\windows\ServicePackFiles\i386\imm32.dll
[-] 2008-04-14 00:11 110080 0DA85218E92526972A821587E6A8BF8F c:\windows\system32\imm32.dll

[-] 2004-08-03 23:56 1580544 30A609E00BD1D4FFC49D6B5A432BE7F2 c:\windows\$NtServicePackUninstall$\sfcfiles.dll
[-] 2008-04-14 00:12 1614848 9DD07AF82244867CA36681EA2D29CE79 c:\windows\ServicePackFiles\i386\sfcfiles.dll
[-] 2008-04-14 00:12 1614848 9DD07AF82244867CA36681EA2D29CE79 c:\windows\system32\sfcfiles.dll

(((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal]
@="{C5994560-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}]
2008-11-02 08:26 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified]
@="{C5994561-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}]
2008-11-02 08:26 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict]
@="{C5994562-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}]
2008-11-02 08:26 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked]
@="{C5994563-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}]
2008-11-02 08:26 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly]
@="{C5994564-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}]
2008-11-02 08:26 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted]
@="{C5994565-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}]
2008-11-02 08:26 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded]
@="{C5994566-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}]
2008-11-02 08:26 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored]
@="{C5994567-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}]
2008-11-02 08:26 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned]
@="{C5994568-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}]
2008-11-02 08:26 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-04-21 94208]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"AnyDVD"="c:\program files\SlySoft\AnyDVD\AnyDVDtray.exe" [2009-05-10 4021184]
"CTSyncU.exe"="c:\program files\Creative\Sync Manager Unicode\CTSyncU.exe" [2006-06-12 700416]
"EA Core"="c:\program files\Electronic Arts\EADM\Core.exe" [2009-02-06 3325952]
"BTAgile"="c:\program files\BT Broadband Talk Softphone\BTAgile.exe" [2007-06-18 61440]
"Veoh"="c:\program files\Veoh Networks\Veoh\VeohClient.exe" [2008-08-28 3660848]
"Steam"="c:\program files\Steam\Steam.exe" [2009-05-20 1217784]
"PlayNC Launcher"="c:\program files\ncsoft\launcher\NCLauncher.exe" [2009-06-03 38136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-03 13529088]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696]
"RealTray"="c:\program files\Real\RealPlayer\RealPlay.exe" [2007-03-30 26112]
"WMAAD"="c:\program files\Sony\WALKMAN Launcher\WMAAD.exe" [2007-02-16 110592]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-11 81920]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-03 86016]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2006-08-14 16050176]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2008-05-03 1630208]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" - c:\windows\KHALMNPR.Exe [2007-09-21 55824]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2005-04-25 36040]

c:\documents and settings\john\Start Menu\Programs\Startup\
Registration Heroes of Might & Magic 5.LNK - c:\program files\Ubisoft\Heroes of Might and Magic V\registration\RegistrationReminder.exe [2009-4-10 868352]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
hp psc 2000 Series.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe [2003-4-6 323646]
hpoddt01.exe.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2003-4-6 28672]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2008-12-16 784912]
NETGEAR WG111T Smart Wizard.lnk - c:\program files\NETGEAR\WG111T\wlan111t.exe [2009-5-4 884840]
Photo Loader supervisory.lnk - c:\program files\CASIO\Photo Loader\Plauto.exe [2007-8-24 217088]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2007-11-15 10:10 72208 ----a-w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\BT Broadband Talk Softphone\\BTSoftphone.exe"=
"c:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"=
"c:\\Program Files\\Electronic Arts\\EADM\\Core.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Warcraft III\\Warcraft III.exe"=
"c:\\Program Files\\Nero\\Nero 7\\Nero Home\\NeroHome.exe"=
"c:\\Program Files\\NCsoft\\Exteel (US)\\System\\Exteel.exe"=
"c:\\Program Files\\Steam\\SteamApps\\common\\football manager 2009\\fm.exe"=
"d:\\Program Files (x86)\\Warcraft III\\Warcraft III.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724
"8088:UDP"= 8088:UDP:Battle of middle lol

R0 xfilt;VIA SATA IDE Hot-plug Driver;c:\windows\system32\drivers\xfilt.sys [09/06/2007 15:05 11264]
S2 gupdate1c9b860dfcbbd94;Google Update Service (gupdate1c9b860dfcbbd94);c:\program files\Google\Update\GoogleUpdate.exe [08/04/2009 16:44 133104]
S3 ALLOW-IO;ALLOW-IO;\??\d:\allow-io.sys --> d:\ALLOW-IO.sys [?]
S3 DNINDIS5;DNINDIS5 NDIS Protocol Driver;c:\windows\system32\DNINDIS5.sys [04/05/2009 18:29 17149]
S3 ICScsiSV;Image Converter SCSI Service;c:\program files\Sony\IMAGE CONVERTER 3\ICScsiSV.exe [06/10/2007 15:11 75952]
S3 IcVzMonLauncher;IcVzMonLauncher;c:\program files\Sony\IMAGE CONVERTER 3\IcVzMonLauncher.exe [06/10/2007 15:11 67760]
S3 MaplomL;MaplomL;c:\windows\system32\drivers\maploml.sys [03/02/2009 12:25 42632]
.
Contents of the 'Scheduled Tasks' folder

2009-05-02 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]

2008-02-16 c:\windows\Tasks\FRU Task 2003-04-06 08:52ewlett-Packard2003-04-06 08:52p psc 2170 series5E771253C1676EBED677BF361FDFC537825E15B8194622014.job
- c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2003-04-06 00:52]

2009-06-03 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-04-08 15:43]

2009-06-03 c:\windows\Tasks\GoogleUpdateTaskMachine.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-08 15:44]

------- Supplementary Scan -------
.
uStart Page = hxxp://www.profootballweekly.com/PFW/default.htm
mSearch Bar = hxxp://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/sb/*http://uk.docs.yahoo.com/info/bt_side.html
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = 127.0.0.1;*.local
uSearchURL,(Default) = hxxp://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/su/*http://uk.search.yahoo.com/
IE: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZUxdm554YYGB
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Transfer by Image Converter 3 - c:\program files\SONY\IMAGE CONVERTER 3\menu.htm
IE: {{08E730A4-FB02-45BD-A900-01E4AD8016F6} - http://www.skybroadband.com
DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
DPF: {65E8E2DC-186A-4AAC-9E56-FDC683055A9E} - hxxp://www.download.com/html/dl/bug211623/CNetOnlineInstall.cab
DPF: {C044CD87-DFB0-4130-A5E4-49361106FBC8} - hxxp://id.hangame.com/common/HanSetup1020.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-03 18:17
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(696)
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
c:\program files\common files\logishrd\bluetooth\LBTServ.dll

- - - - - - - > 'explorer.exe'(2816)
c:\program files\SlySoft\AnyDVD\ADvdDiscHlp.dll
c:\program files\Logitech\SetPoint\GameHook.dll
c:\program files\Logitech\SetPoint\lgscroll.dll
c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
c:\program files\TortoiseSVN\bin\TortoiseStub.dll
c:\program files\TortoiseSVN\bin\TortoiseSVN.dll
c:\program files\TortoiseSVN\bin\intl3_tsvn.dll
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\ArcSoft\PhotoImpression 5\share\pihook.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Symantec\LiveUpdate\AluSchedulerSvc.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\CTSVCCDA.EXE
c:\windows\system32\nvsvc32.exe
c:\windows\system32\wscntfy.exe
c:\program files\TortoiseSVN\bin\TSVNCache.exe
c:\windows\system32\rundll32.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
c:\program files\Common Files\Logishrd\KHAL2\KHALMNPR.exe
c:\docume~1\john\LOCALS~1\temp\EAD5.exe
.
**************************************************************************
.
Completion time: 2009-06-03 18:25 - machine was rebooted
ComboFix-quarantined-files.txt 2009-06-03 17:25
ComboFix2.txt 2009-06-03 17:00

Pre-Run: 103,670,530,048 bytes free
Post-Run: 103,535,054,848 bytes free

412 --- E O F --- 2009-05-17 09:14

There seems to be no sign of it on my pc = ) thank you so much

Hello.
There's one leftover I wan to to kill.

Post a new Hijack This log.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:46:39, on 03/06/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Sony\WALKMAN Launcher\WMAAD.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe
C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
C:\Program Files\Veoh Networks\Veoh\VeohClient.exe
C:\Program Files\Steam\Steam.exe
C:\program files\ncsoft\launcher\NCLauncher.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\NETGEAR\WG111T\wlan111t.exe
C:\Program Files\CASIO\Photo Loader\Plauto.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Documents and Settings\john\Desktop\hijackgpthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.profootballweekly.com/PFW/default.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/sb/*http://uk.docs.yahoo.com/info/bt_side.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/su/*http://uk.search.yahoo.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;*.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [WMAAD] C:\Program Files\Sony\WALKMAN Launcher\WMAAD.exe
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe
O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
O4 - HKCU\..\Run: [EA Core] "C:\Program Files\Electronic Arts\EADM\Core.exe" -silent
O4 - HKCU\..\Run: [BTAgile] C:\Program Files\BT Broadband Talk Softphone\BTAgile.exe
O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [PlayNC Launcher] C:\program files\ncsoft\launcher\NCLauncher.exe /Minimized
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Registration Heroes of Might & Magic 5.LNK = C:\Program Files\Ubisoft\Heroes of Might and Magic V\registration\RegistrationReminder.exe
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: NETGEAR WG111T Smart Wizard.lnk = ?
O4 - Global Startup: Photo Loader supervisory.lnk = C:\Program Files\CASIO\Photo Loader\Plauto.exe
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZUxdm554YYGB
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Transfer by Image Converter 3 - C:\PROGRAM FILES\SONY\IMAGE CONVERTER 3\menu.htm
O9 - Extra button: Sky - {08E730A4-FB02-45BD-A900-01E4AD8016F6} - http://www.skybroadband.com (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://dev.srtest.com/srl_bin/sysreqlab3.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1174640658031
O16 - DPF: {65E8E2DC-186A-4AAC-9E56-FDC683055A9E} (CNetOnlineInstall Control) - http://www.download.com/html/dl/bug211623/CNetOnlineInstall.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {C044CD87-DFB0-4130-A5E4-49361106FBC8} (HanSetupCtrl1010 Class) - http://id.hangame.com/common/HanSetup1020.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Google Update Service (gupdate1c9b860dfcbbd94) (gupdate1c9b860dfcbbd94) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Image Converter SCSI Service (ICScsiSV) - Sony Corporation - C:\Program Files\Sony\IMAGE CONVERTER 3\ICScsiSV.exe
O23 - Service: IcVzMonLauncher - Sony Corporation - C:\Program Files\Sony\IMAGE CONVERTER 3\IcVzMonLauncher.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Image Converter video recording monitor for VAIO Entertainment - Sony Corporation - C:\Program Files\Sony\IMAGE CONVERTER 3\IcVzMon.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SonicStage Back-End Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SsBeSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe

--
End of file - 11925 bytes

Hello.

• Open HijackThis
  
• Choose "Do a system scan only"
  
• Check the boxes in front of these lines:
  
  
  O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZUxdm554YYGB
  
  
  
• Press "Fix Checked"
  
• Close Hijack This.
  

Click Start > Run and copy/paste the following bolded text into the Run box and click OK:

ComboFix /u



This will also reset your restore points.

How is the machine running now?

its running perfectly thank you if i was old enough to donate id definatley do it = ) thank you so much u saved me getting grilled by my dad and you saved my pc thanks so much

Below I have included a number of recommendations for how to protect your computer in order to prevent future malware infections. Please take these recommendations seriously; these few simple steps can stave off the vast majority of spyware problems. As happy as we are to help you, for your sake we would rather not have repeat customers.

1) Please navigate to http://windowsupdate.microsoft.com and download all the "critical updates" for Windows. This can patch many of the security holes through which attackers can gain access to your computer.

Please either enable Automatic Updates under Start -> Control Panel -> Automatic Updates , or get into the habit of checking for Windows updates regularly. I cannot stress enough how important this is.

2) In order to protect yourself against spyware, you should consider installing and running the following free programs:

Ad-Aware SE
A tutorial on using Ad-Aware to remove spyware from your computer may be found here.

Spybot-Search & Destroy
A tutorial on using Spybot to remove spyware from your computer may be found here. Please also remember to enable Spybot's "Immunize" and "TeaTimer" features.

SpywareBlaster
A tutorial on using SpywareBlaster to prevent spyware from ever installing on your computer may be found here.

SpywareGuard
A tutorial on using SpywareGuard for realtime protection against spyware and hijackers may be found here.

Make sure to keep these programs up-to-date and to run them regularly, as this can prevent a great deal of spyware hassle.

3) Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in popup blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from here:
http://www.mozilla.org/products/firefox/
I also recommand the following add-ons for Firefox, they will help keep you safe from malicious scripts or activeX exploits.
https://addons.mozilla.org/en-US/firefox/addon/722
https://addons.mozilla.org/en-US/firefox/addon/1865
https://addons.mozilla.org/en-US/firefox/addon/433

4) Also make sure to run your antivirus software regularly, and to keep it up-to-date.

To help you keep your software updated, please considering using this free software program that will check for program updates.
Update Checker

5) Finally, consider maintaining a firewall. Some good free firewalls are Kerio, or
Outpost
A tutorial on understanding and using firewalls may be found here.

Please also read Tony Klein's excellent article: How I got Infected in the First Place

If you would take a moment to fill out our feedback form, we would appreciate it.
The link can be found here.

Hopefully this should take care of your problems! Good luck.

My pc has firefox and i always check for updates its just i managed to corrupt my motherboard somehow so i had to send it back to overclockers should be getting a new 1 soon than kyou for the tips tho = )