virus

ogfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:13:26 AM, on 10/17/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Electronic Arts\EADM\Core.exe
C:\WINDOWS\system32\ctfmon.exe
C:\program files\ncsoft\launcher\NCLauncher.exe
C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\CinemaNow\CinemaNow Media Manager\CinemanowSvc.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\msiexec.exe
C:\Documents and Settings\Daniel\Desktop\scanner.exe.exe
C:\WINDOWS\system32\wuauclt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ask.com/?o=101760&l=dis
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedirect?o=101757&gct=&gc=1&q=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedirect?o=101757&gct=&gc=1&q=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://toolbar.ask.com/toolbarv/askRedirect?o=101757&gct=&gc=1&q=%s
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: (no name) - *{C94E154B-1459-4A47-966B-4B843BEFC7DB} - (no file)
O1 - Hosts: ::1 localhost
O1 - Hosts: 91.212.127.226 osguardpro.microsoft.com
O1 - Hosts: 91.212.127.226 os-guardpro.com
O1 - Hosts: 91.212.127.226 www.os-guardpro.com
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [EA Core] "C:\Program Files\Electronic Arts\EADM\Core.exe" -silent
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NCsoft Launcher] C:\program files\ncsoft\launcher\NCLauncher.exe /Minimized
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O15 - Trusted Zone: http://*.cinemanow.com
O16 - DPF: {BC18E6DF-BE57-4580-93E8-F228F9A133AA} (MaxisSimCity4LotTeleX Control) - http://simcity.ea.com/exchange/lots/teleport/MaxisSimCity4LotTeleX.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll

Hello.

• Open HijackThis
  
• Choose "Do a system scan only"
  
• Check the boxes in front of these lines:
  
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ask.com/?o=101760&l=dis
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedirect?o=101757&gct=&gc=1&q=
  R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedirect?o=101757&gct=&gc=1&q=
  R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://toolbar.ask.com/toolbarv/askRedirect?o=101757&gct=&gc=1&q=%s
  R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
  R3 - URLSearchHook: (no name) - *{C94E154B-1459-4A47-966B-4B843BEFC7DB} - (no file)
  O1 - Hosts: ::1 localhost
  O1 - Hosts: 91.212.127.226 osguardpro.microsoft.com
  O1 - Hosts: 91.212.127.226 os-guardpro.com
  O1 - Hosts: 91.212.127.226 www.os-guardpro.com
  O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
  
  
  
• Press "Fix Checked"
  
• Close Hijack This.
  

Please download and run this tool.

Download Malwarebytes' Anti-Malware from Here

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
  
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  

Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.

Post the contents of the MBAM Log.

Malwarebytes' Anti-Malware 1.40
Database version: 2675
Windows 5.1.2600 Service Pack 3

10/17/2009 3:35:27 PM
mbam-log-2009-10-17 (15-35-27).txt

Scan type: Quick Scan
Objects scanned: 102089
Time elapsed: 7 minute(s), 46 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Please re-open Malwarebytes, click the Update tab, and click Check for Updates. Then, click the Scanner tab, select Perform Quick Scan, and press Scan.

Malwarebytes' Anti-Malware 1.41
Database version: 2977
Windows 5.1.2600 Service Pack 3

10/17/2009 6:13:23 PM
mbam-log-2009-10-17 (18-13-23).txt

Scan type: Quick Scan
Objects scanned: 109491
Time elapsed: 5 minute(s), 31 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

deleted

Last edited by Danimal on 18th October 2009, 4:38 pm; edited 1 time in total

DDS (Ver_09-10-13.01) - NTFSx86
Run by Daniel at 9:35:48.42 on Sun 10/18/2009
Internet Explorer: 6.0.2900.5512
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1149 [GMT -7:00]

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Electronic Arts\EADM\Core.exe
C:\WINDOWS\system32\ctfmon.exe
C:\program files\ncsoft\launcher\NCLauncher.exe
svchost.exe
C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\CinemaNow\CinemaNow Media Manager\CinemanowSvc.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\iTunes\iTunes.exe
C:\Program Files\Steam\Steam.exe
C:\Documents and Settings\Daniel\Desktop\dds.scr

============== Pseudo HJT Report ===============

mStart Page = hxxp://www.google.com
uURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg8\toolbar\IEToolbar.dll
mURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg8\toolbar\IEToolbar.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg8\toolbar\IEToolbar.dll
TB: {A057A204-BACC-4D26-9990-79A187E2698E} - No File
TB: Ask Toolbar: {3041d03e-fd4b-44e0-b742-2d9b88305f98} - c:\program files\askbardis\bar\bin\askBar.dll
uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\daemon.exe" -autorun
uRun: [EA Core] "c:\program files\electronic arts\eadm\Core.exe" -silent
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [PlayNC Launcher]
uRun: [NCsoft Launcher] c:\program files\ncsoft\launcher\NCLauncher.exe /Minimized
mRun: [PWRISOVM.EXE] c:\program files\poweriso\PWRISOVM.EXE
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [NeroFilterCheck] c:\program files\common files\ahead\lib\NeroCheck.exe
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"
mRunOnce: [Malwarebytes' Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent
IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office12\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0004-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_04\bin\ssv.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~4\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office12\REFIEBAR.DLL
Trusted Zone: cinemanow.com
Trusted Zone: microsoft.com
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_04-windows-i586.cab
DPF: {BC18E6DF-BE57-4580-93E8-F228F9A133AA} - hxxp://simcity.ea.com/exchange/lots/teleport/MaxisSimCity4LotTeleX.cab
DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_04-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_04-windows-i586.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
Notify: avgrsstarter - avgrsstx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\daniel\applic~1\mozilla\firefox\profiles\3wr807un.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - component: c:\program files\avg\avg8\firefox\components\avgssff.dll
FF - component: c:\program files\avg\avg8\toolbar\firefox\avg@igeared\components\IGeared_tavgp_xputils2.dll
FF - component: c:\program files\avg\avg8\toolbar\firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll
FF - component: c:\program files\avg\avg8\toolbar\firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll
FF - component: c:\program files\avg\avg8\toolbar\firefox\avg@igeared\components\xpavgtbapi.dll
FF - plugin: c:\documents and settings\daniel\application data\move networks\plugins\npqmp071504000001.dll
FF - plugin: c:\documents and settings\daniel\application data\mozilla\firefox\profiles\3wr807un.default\extensions\{3112ca9c-de6d-4884-a869-9855de680400}\plugins\npCinemaNowPlugin.dll
FF - plugin: c:\documents and settings\daniel\application data\mozilla\firefox\profiles\3wr807un.default\extensions\moveplayer@movenetworks.com\platform\winnt_x86-msvc\plugins\npmnqmp071303000004.dll
FF - plugin: c:\program files\google\update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npViewpoint.dll
FF - hȋdden: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}

============= SERVICES / DRIVERS ===============

R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-6-1 335240]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-6-1 108552]
R2 AdobeActiveFileMonitor6.0;Adobe Active File Monitor V6;c:\program files\adobe\photoshop elements 6.0\PhotoshopElementsFileAgent.exe [2007-9-11 124832]
R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe [2008-9-15 908056]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2008-9-15 297752]
R2 CinemaNow Service;CinemaNow Service;c:\program files\cinemanow\cinemanow media manager\CinemaNowSvc.exe [2009-1-30 125304]
R3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2007-11-6 34064]
S2 gupdate1c9c6635fea52a;Google Update Service (gupdate1c9c6635fea52a);c:\program files\google\update\GoogleUpdate.exe [2009-4-26 133104]

=============== Created Last 30 ================


==================== Find3M ====================

2009-09-12 10:27 189,480 a------- c:\windows\system32\PnkBstrB.exe
2009-09-12 10:20 137,544 a------- c:\windows\system32\drivers\PnkBstrK.sys
2009-09-10 14:54 38,224 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-10 14:53 19,160 a------- c:\windows\system32\drivers\mbam.sys
2009-08-30 02:15 499,712 a------- c:\windows\system32\msvcp71.dll
2009-08-30 02:15 348,160 a------- c:\windows\system32\msvcr71.dll
2009-08-25 19:34 79,373 a------- c:\windows\War3Unin.dat
2009-08-18 20:47 16,998 a------- c:\docume~1\alluse~1\applic~1\higax.pif
2009-08-18 20:47 15,394 a------- c:\windows\system32\lola.vbs
2009-08-18 20:47 14,832 a------- c:\windows\kobo.dat
2009-08-18 20:47 11,618 a------- c:\windows\ibacysid.sys
2009-08-18 20:47 10,777 a------- c:\docume~1\alluse~1\applic~1\sidojonyc.com
2009-08-18 20:47 14,452 a------- c:\docume~1\alluse~1\applic~1\wimifu.dat
2009-08-17 23:42 18,409 a------- c:\windows\system32\taresedu.bat
2009-08-17 23:42 17,794 a------- c:\program files\common files\ihywycaxe.inf
2009-08-17 23:42 15,866 a------- c:\windows\iwudelomoh.bin
2009-08-17 23:42 15,673 a------- c:\docume~1\daniel\applic~1\kabe.pif
2009-08-17 23:42 12,387 a------- c:\windows\omyradeku.reg
2009-08-17 23:42 10,410 a------- c:\windows\ybobo.reg
2009-08-17 23:42 10,112 a------- c:\windows\piburigi.scr
2009-08-17 23:33 1,193,832 a------- c:\windows\system32\FM20.DLL
2009-08-17 19:15 11,952 a------- c:\windows\system32\avgrsstx.dll
2009-08-06 19:23 274,288 a------- c:\windows\system32\mucltui.dll
2009-08-06 19:23 215,920 a------- c:\windows\system32\muweb.dll
2009-07-15 23:50 139,152 a------- c:\docume~1\daniel\applic~1\PnkBstrK.sys
2009-02-06 19:14 3,143 a------- c:\program files\images.jpeg

============= FINISH: 9:36:25.42 ===============

Hello.

Please download the OTMoveIt by OldTimer.

• Save it to your desktop.
  
• Please double-click OTM.exe to run it.
  
• Copy the bolded text below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  
  :files
  c:\docume~1\alluse~1\applic~1\higax.pif
  c:\windows\system32\lola.vbs
  c:\windows\kobo.dat
  c:\windows\ibacysid.sys
  c:\docume~1\alluse~1\applic~1\sidojonyc.com
  c:\docume~1\alluse~1\applic~1\wimifu.dat
  c:\windows\system32\taresedu.bat
  c:\program files\common files\ihywycaxe.inf
  c:\windows\iwudelomoh.bin
  c:\docume~1\daniel\applic~1\kabe.pif
  c:\windows\omyradeku.reg
  c:\windows\ybobo.reg
  c:\windows\piburigi.scr
  
  
  
• Return to OTMoveIt, right click in the "Paste instructions for items to be Moved" window (under the light blue bar) and choose Paste.
  
• Click the red Moveit! button.
  
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  
• Close OTMoveIt
  

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

Please post the OTMoveIt log.

========== FILES ==========
c:\docume~1\alluse~1\applic~1\higax.pif moved successfully.
c:\windows\system32\lola.vbs moved successfully.
c:\windows\kobo.dat moved successfully.
c:\windows\ibacysid.sys moved successfully.
c:\docume~1\alluse~1\applic~1\sidojonyc.com moved successfully.
c:\docume~1\alluse~1\applic~1\wimifu.dat moved successfully.
c:\windows\system32\taresedu.bat moved successfully.
c:\program files\common files\ihywycaxe.inf moved successfully.
c:\windows\iwudelomoh.bin moved successfully.
c:\docume~1\daniel\applic~1\kabe.pif moved successfully.
c:\windows\omyradeku.reg moved successfully.
c:\windows\ybobo.reg moved successfully.
c:\windows\piburigi.scr moved successfully.

OTM by OldTimer - Version 3.0.0.6 log created on 10182009_145543

Hello.
Please post attach.txt now.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-10-13.01)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 12/17/2007 10:57:00 PM
System Uptime: 10/18/2009 2:58:48 PM (1 hours ago)

Motherboard: Gigabyte Technology Co., Ltd. | | P35-DS3L
Processor: Intel(R) Core(TM)2 Quad CPU Q6600 @ 2.40GHz | Socket 775 | 2400/266mhz

==== Disk Partitions =========================

A: is Removable
C: is fȋxed (NTFS) - 298 GiB total, 66.205 GiB free.
D: is CDROM (CDFS)
E: is CDROM ()

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP1: 8/23/2009 9:21:36 AM - System Checkpoint
RP2: 8/23/2009 9:23:23 AM - Software Distribution Service 3.0
RP3: 8/24/2009 6:45:43 AM - Software Distribution Service 3.0
RP4: 8/25/2009 6:08:35 AM - Software Distribution Service 3.0
RP5: 8/26/2009 6:14:07 AM - Software Distribution Service 3.0
RP6: 8/27/2009 11:52:24 AM - Software Distribution Service 3.0
RP7: 8/28/2009 6:10:36 AM - Software Distribution Service 3.0
RP8: 8/29/2009 9:20:03 AM - Software Distribution Service 3.0
RP9: 8/30/2009 3:00:24 AM - Software Distribution Service 3.0
RP10: 8/31/2009 7:20:17 AM - Software Distribution Service 3.0
RP11: 8/31/2009 11:53:07 PM - Software Distribution Service 3.0
RP12: 9/2/2009 8:19:16 AM - Software Distribution Service 3.0
RP13: 9/2/2009 3:33:58 PM - Software Distribution Service 3.0
RP14: 9/3/2009 7:29:53 AM - Software Distribution Service 3.0
RP15: 9/4/2009 7:24:34 AM - Software Distribution Service 3.0
RP16: 9/5/2009 3:00:48 AM - Software Distribution Service 3.0
RP17: 9/6/2009 8:20:23 AM - Software Distribution Service 3.0
RP18: 9/7/2009 3:00:33 AM - Software Distribution Service 3.0
RP19: 9/8/2009 1:31:13 PM - Software Distribution Service 3.0
RP20: 9/9/2009 1:32:45 PM - System Checkpoint
RP21: 9/10/2009 8:23:13 AM - Software Distribution Service 3.0
RP22: 9/11/2009 7:32:28 AM - Software Distribution Service 3.0
RP23: 9/12/2009 3:00:32 AM - Software Distribution Service 3.0
RP24: 9/13/2009 3:00:26 AM - Software Distribution Service 3.0
RP25: 9/14/2009 6:47:12 AM - Software Distribution Service 3.0
RP26: 9/15/2009 6:43:34 AM - Software Distribution Service 3.0
RP27: 9/16/2009 6:26:06 AM - Software Distribution Service 3.0
RP28: 9/17/2009 6:56:18 AM - Software Distribution Service 3.0
RP29: 9/18/2009 6:50:33 AM - Software Distribution Service 3.0
RP30: 9/18/2009 11:50:49 PM - Software Distribution Service 3.0
RP31: 9/19/2009 12:35:26 AM - Software Distribution Service 3.0
RP32: 9/19/2009 7:11:16 AM - Software Distribution Service 3.0
RP33: 9/19/2009 4:28:21 PM - Software Distribution Service 3.0
RP34: 9/19/2009 4:42:25 PM - Software Distribution Service 3.0
RP35: 9/19/2009 4:55:59 PM - Installed Windows Installer Clean Up
RP36: 9/19/2009 4:57:49 PM - Software Distribution Service 3.0
RP37: 9/19/2009 5:03:57 PM - Installed NCsoft Launcher
RP38: 9/20/2009 3:00:34 AM - Software Distribution Service 3.0
RP39: 9/21/2009 7:19:53 AM - Software Distribution Service 3.0
RP40: 9/22/2009 8:00:55 AM - System Checkpoint
RP41: 9/23/2009 9:19:21 AM - System Checkpoint
RP42: 9/24/2009 9:23:08 AM - System Checkpoint
RP43: 9/25/2009 9:43:29 AM - System Checkpoint
RP44: 9/26/2009 7:45:44 PM - System Checkpoint
RP45: 9/29/2009 7:58:50 AM - System Checkpoint
RP46: 9/30/2009 8:13:45 AM - System Checkpoint
RP47: 10/1/2009 8:47:24 AM - System Checkpoint
RP48: 10/2/2009 9:29:21 AM - System Checkpoint
RP49: 10/3/2009 11:58:02 AM - System Checkpoint
RP50: 10/5/2009 7:59:59 AM - System Checkpoint
RP51: 10/6/2009 11:33:36 AM - Avg8 Update
RP52: 10/6/2009 11:35:24 AM - Avg8 Update
RP53: 10/7/2009 11:15:20 AM - Avg8 Update
RP54: 10/8/2009 11:38:43 AM - System Checkpoint
RP55: 10/9/2009 11:39:50 AM - System Checkpoint
RP56: 10/10/2009 1:26:50 PM - System Checkpoint
RP57: 10/11/2009 3:25:17 PM - System Checkpoint
RP58: 10/13/2009 1:30:37 PM - System Checkpoint
RP59: 10/14/2009 12:11:12 AM - Software Distribution Service 3.0
RP60: 10/15/2009 8:17:34 AM - System Checkpoint
RP61: 10/16/2009 9:00:03 AM - System Checkpoint
RP62: 10/17/2009 7:06:38 AM - Software Distribution Service 3.0
RP63: 10/17/2009 9:57:25 AM - Avg8 Update

==== Installed Programs ======================

AAC Decoder
AC3Filter 1.61b
Adobe Flash Player 10 Plugin
Adobe Flash Player ActiveX
Adobe Photoshop Elements 6.0
Adobe Reader 8.1.2
Age of Chivalry
Age of Empires III
Age of Empires III - The WarChiefs
AIM 6
Aion
America's Army 3
Apple Software Update
Ask Toolbar
AutoUpdate
Avery Wizard 3.1
AVG Free 8.5
AVIcodec (remove only)
Call of Combat
Canon iP1800 series
Canon iP1800 series User Registration
Canon My Printer
Canon Utilities Easy-LayoutPrint
Canon Utilities Easy-PhotoPrint
CinemaNow Media Manager
Counter-Strike
Counter-Strike: Source
Critical Update for Windows Media Player 11 (KB959772)
Day of Defeat
Day of Defeat: Source
DivX Codec
DivX Converter
DivX Player

Hello.
I think the log got cut off, please post the full log.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-10-13.01)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 12/17/2007 10:57:00 PM
System Uptime: 10/18/2009 3:47:29 PM (0 hours ago)

Motherboard: Gigabyte Technology Co., Ltd. | | P35-DS3L
Processor: Intel(R) Core(TM)2 Quad CPU Q6600 @ 2.40GHz | Socket 775 | 2400/266mhz

==== Disk Partitions =========================

A: is Removable
C: is fȋxed (NTFS) - 298 GiB total, 70.428 GiB free.
D: is CDROM (CDFS)
E: is CDROM ()

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP1: 8/23/2009 9:21:36 AM - System Checkpoint
RP2: 8/23/2009 9:23:23 AM - Software Distribution Service 3.0
RP3: 8/24/2009 6:45:43 AM - Software Distribution Service 3.0
RP4: 8/25/2009 6:08:35 AM - Software Distribution Service 3.0
RP5: 8/26/2009 6:14:07 AM - Software Distribution Service 3.0
RP6: 8/27/2009 11:52:24 AM - Software Distribution Service 3.0
RP7: 8/28/2009 6:10:36 AM - Software Distribution Service 3.0
RP8: 8/29/2009 9:20:03 AM - Software Distribution Service 3.0
RP9: 8/30/2009 3:00:24 AM - Software Distribution Service 3.0
RP10: 8/31/2009 7:20:17 AM - Software Distribution Service 3.0
RP11: 8/31/2009 11:53:07 PM - Software Distribution Service 3.0
RP12: 9/2/2009 8:19:16 AM - Software Distribution Service 3.0
RP13: 9/2/2009 3:33:58 PM - Software Distribution Service 3.0
RP14: 9/3/2009 7:29:53 AM - Software Distribution Service 3.0
RP15: 9/4/2009 7:24:34 AM - Software Distribution Service 3.0
RP16: 9/5/2009 3:00:48 AM - Software Distribution Service 3.0
RP17: 9/6/2009 8:20:23 AM - Software Distribution Service 3.0
RP18: 9/7/2009 3:00:33 AM - Software Distribution Service 3.0
RP19: 9/8/2009 1:31:13 PM - Software Distribution Service 3.0
RP20: 9/9/2009 1:32:45 PM - System Checkpoint
RP21: 9/10/2009 8:23:13 AM - Software Distribution Service 3.0
RP22: 9/11/2009 7:32:28 AM - Software Distribution Service 3.0
RP23: 9/12/2009 3:00:32 AM - Software Distribution Service 3.0
RP24: 9/13/2009 3:00:26 AM - Software Distribution Service 3.0
RP25: 9/14/2009 6:47:12 AM - Software Distribution Service 3.0
RP26: 9/15/2009 6:43:34 AM - Software Distribution Service 3.0
RP27: 9/16/2009 6:26:06 AM - Software Distribution Service 3.0
RP28: 9/17/2009 6:56:18 AM - Software Distribution Service 3.0
RP29: 9/18/2009 6:50:33 AM - Software Distribution Service 3.0
RP30: 9/18/2009 11:50:49 PM - Software Distribution Service 3.0
RP31: 9/19/2009 12:35:26 AM - Software Distribution Service 3.0
RP32: 9/19/2009 7:11:16 AM - Software Distribution Service 3.0
RP33: 9/19/2009 4:28:21 PM - Software Distribution Service 3.0
RP34: 9/19/2009 4:42:25 PM - Software Distribution Service 3.0
RP35: 9/19/2009 4:55:59 PM - Installed Windows Installer Clean Up
RP36: 9/19/2009 4:57:49 PM - Software Distribution Service 3.0
RP37: 9/19/2009 5:03:57 PM - Installed NCsoft Launcher
RP38: 9/20/2009 3:00:34 AM - Software Distribution Service 3.0
RP39: 9/21/2009 7:19:53 AM - Software Distribution Service 3.0
RP40: 9/22/2009 8:00:55 AM - System Checkpoint
RP41: 9/23/2009 9:19:21 AM - System Checkpoint
RP42: 9/24/2009 9:23:08 AM - System Checkpoint
RP43: 9/25/2009 9:43:29 AM - System Checkpoint
RP44: 9/26/2009 7:45:44 PM - System Checkpoint
RP45: 9/29/2009 7:58:50 AM - System Checkpoint
RP46: 9/30/2009 8:13:45 AM - System Checkpoint
RP47: 10/1/2009 8:47:24 AM - System Checkpoint
RP48: 10/2/2009 9:29:21 AM - System Checkpoint
RP49: 10/3/2009 11:58:02 AM - System Checkpoint
RP50: 10/5/2009 7:59:59 AM - System Checkpoint
RP51: 10/6/2009 11:33:36 AM - Avg8 Update
RP52: 10/6/2009 11:35:24 AM - Avg8 Update
RP53: 10/7/2009 11:15:20 AM - Avg8 Update
RP54: 10/8/2009 11:38:43 AM - System Checkpoint
RP55: 10/9/2009 11:39:50 AM - System Checkpoint
RP56: 10/10/2009 1:26:50 PM - System Checkpoint
RP57: 10/11/2009 3:25:17 PM - System Checkpoint
RP58: 10/13/2009 1:30:37 PM - System Checkpoint
RP59: 10/14/2009 12:11:12 AM - Software Distribution Service 3.0
RP60: 10/15/2009 8:17:34 AM - System Checkpoint
RP61: 10/16/2009 9:00:03 AM - System Checkpoint
RP62: 10/17/2009 7:06:38 AM - Software Distribution Service 3.0
RP63: 10/17/2009 9:57:25 AM - Avg8 Update

==== Installed Programs ======================

AAC Decoder
AC3Filter 1.61b
Adobe Flash Player 10 Plugin
Adobe Flash Player ActiveX
Adobe Photoshop Elements 6.0
Adobe Reader 8.1.2
Age of Chivalry
Age of Empires III
Age of Empires III - The WarChiefs
AIM 6
Aion
America's Army 3
Apple Software Update
Ask Toolbar
AutoUpdate
Avery Wizard 3.1
AVG Free 8.5
AVIcodec (remove only)
Call of Combat
Canon iP1800 series
Canon iP1800 series User Registration
Canon My Printer
Canon Utilities Easy-LayoutPrint
Canon Utilities Easy-PhotoPrint
CCleaner (remove only)
CinemaNow Media Manager
Counter-Strike
Counter-Strike: Source
Critical Update for Windows Media Player 11 (KB959772)
Day of Defeat
Day of Defeat: Source
DivX Codec
DivX Converter
DivX Player
DivX Plus DirectShow Filters
DivX Version Checker
DivX Web Player
EA Download Manager
Empire: Total War
EVGA Display Driver
Google Chrome
Google Update Helper
H.264 Decoder
Half-Life 2
Half-Life 2: Episode One
Heroes of Might and Magic V Collector Edition
High Definition Audio Driver Package - KB888111
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB952287)
iTunes
J2SE Runtime Environment 5.0 Update 11
Java(TM) 6 Update 4
Magic ISO Maker v5.5 (build 0273)
Malwarebytes' Anti-Malware
Microsoft .NET Framework 1.1
Microsoft .NET Framework 2.0
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Software Update for Web Folders (English) 12
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
MKV Splitter
Mount&Blade
Move Media Player
Mozilla Firefox (3.0.14)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
NCsoft Launcher
Nero 7 Essentials
neroxml
NVIDIA Drivers
NVIDIA PhysX
Octoshape add-in for Adobe Flash Player
PowerISO
PunkBuster Services
QuickTime
Railroad Tycoon 3
RealPlayer
REALTEK GbE & FE Ethernet PCI-E NIC Driver
Realtek High Definition Audio Driver
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB969679)
Security Update for Microsoft Office Excel 2007 (KB969682)
Security Update for Microsoft Office Outlook 2007 (KB972363)
Security Update for Microsoft Office PowerPoint 2007 (KB957789)
Security Update for Microsoft Office Publisher 2007 (KB969693)
Security Update for Microsoft Office system 2007 (972581)
Security Update for Microsoft Office system 2007 (KB969613)
Security Update for Microsoft Office system 2007 (KB974234)
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
Security Update for Microsoft Office Word 2007 (KB969604)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 9 (KB936782)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950759)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953838)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956390)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958215)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960714)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB963027)
Sid Meier's Civilization 4
SimCity 4 Deluxe
Smashball
Spybot - Search & Destroy
Star Wars: Knights of The Old Republic
Station LaunchPad
Steam
System Requirements Lab
Team Fortress 2
The Sims 2 Apartment Life
The Sims 2 Bon Voyage
The Sims 2 Double Deluxe
The Sims 2 FreeTime
The Sims 2 IKEA Home Stuff
The Sims 3
Update for 2007 Microsoft Office System (KB967642)
Update for Outlook 2007 Junk Email Filter (KB974810)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
VC80CRTRedist - 8.0.50727.762
Ventrilo Client
VirtuaGirl HD
Warcraft III: All Products
WC3Banlist
WebFldrs XP
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Installer Clean Up
Windows Media Format 11 runtime
Windows Media Player 11
Windows XP Service Pack 3
WinPcap 4.0.2
WinRAR archiver
World in Conflict

==== Event Viewer Messages From Past Week ========

10/18/2009 2:44:42 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: sptd
10/18/2009 2:44:36 PM, error: sptd [4] - Driver detected an internal error in its data structures for .
10/14/2009 11:43:34 PM, error: Dhcp [1002] - The IP address lease 76.95.141.39 for the Network Card with network address 001A4D503814 has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message).
10/12/2009 8:56:00 PM, error: Dhcp [1002] - The IP address lease 192.168.0.102 for the Network Card with network address 001A4D503814 has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message).

==== End Of File ===========================

Hello.

Go to Start > Control Panel > Add/Remove Programs and remove the following programs.

Ask Toolbar
J2SE Runtime Environment 5.0 Update 11
Java(TM) 6 Update 4

Please download Firefox 3.5.3 and install it. It will install over version 3.0 you currently have installed, so you won't lose any bookmarked websites.

How is the machine running now?

im getting BSOD :/ i cant even go into safe mode. Only debug mode works for me

Does the BSOD give you any information on why it happened? a file name maybe?