Malware Win32/Cryptor

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:11:19, on 2009.03.19
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\SYSTEM32\WISPTIS.EXE
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\system32\WTablet\Wacom_TabletUser.exe
C:\Windows\System32\nvraidservice.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe
C:\Windows\Philips\SPC500NC\Monitor.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Logitech\Gaming Software\LWEMon.exe
C:\Program Files\VistaFirewallControl\VistaFirewallControl.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
D:\Program Files\Adobe\Acrobat 9.0\Acrobat\acrotray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Users\sassan\AppData\Local\Google\Update\GoogleUpdate.exe
C:\Program Files\Creative\Shared Files\CTSched.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Extensis\Extensis Suitcase 11\Suitcase.exe
C:\Program Files\UltraMon\UltraMon.exe
B:\Program Files\Stickies\stickies.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
C:\Program Files\AVG\AVG8\avgui.exe
C:\Program Files\AVG\AVG8\avgscanx.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\Opera\opera.exe
C:\Users\sassan\Desktop\Hijack(GP)This.exe
C:\Program Files\Malwarebytes' Anti-Malware\something.exe
C:\Windows\System32\notepad.exe
C:\Users\sassan\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\sassan\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\sassan\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\sassan\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\sassan\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\sassan\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\SearchFilterHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\SnagIt 9\SnagitBHO.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {8a194578-81ea-4850-9911-13ba2d71efbd} - (no file)
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Snagit - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\SnagIt 9\SnagitIEAddin.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [NVRaidService] C:\Windows\system32\nvraidservice.exe
O4 - HKLM\..\Run: [P17RunE] RunDll32 P17RunE.dll,RunDLLEntry
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe
O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" /r
O4 - HKLM\..\Run: [SPC500NC_Monitor] C:\Windows\Philips\SPC500NC\Monitor.exe
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [Start WingMan Profiler] C:\Program Files\Logitech\Gaming Software\LWEMon.exe /noui
O4 - HKLM\..\Run: [OPSE reminder] "C:\Program Files\ScanSoft\OmniPageSE2.0\EregGer\Ereg.exe" -r "C:\Program Files\ScanSoft\OmniPageSE2.0\EregGer\ereg.ini"
O4 - HKLM\..\Run: [VistaFirewallControl] C:\Program Files\VistaFirewallControl\VistaFirewallControl.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "D:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "D:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear
O4 - HKCU\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKCU\..\Run: [Microsoft Update Machine] MSOFF07.exe
O4 - HKCU\..\Run: [Google Update] "C:\Users\sassan\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [CreativeTaskScheduler] "C:\Program Files\Creative\Shared Files\CTSched.exe" /logon
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')
O4 - Startup: Stickies.lnk = B:\Program Files\Stickies\stickies.exe
O4 - Startup: WinMySQLadmin.lnk = D:\Program Files\xampp\mysql\bin\winmysqladmin.exe
O4 - Global Startup: Suitcase 11.0.lnk = ?
O4 - Global Startup: UltraMon.lnk = ?
O8 - Extra context menu item: An vorhandene PDF-Datei anfügen - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: In Adobe PDF konvertieren - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Linkziel in Adobe PDF konvertieren - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Sothink SWF Catcher - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: Convert to PDF - {410C30C7-098A-4090-928E-F1D356D34C7F} - C:\Program Files\Two Pilots\CHM2PDF Pilot\IEPlugin.dll (HKCU)
O9 - Extra 'Tools' menuitem: Convert to PDF using HTML2PDF Pilot... - {410C30C7-098A-4090-928E-F1D356D34C7F} - C:\Program Files\Two Pilots\CHM2PDF Pilot\IEPlugin.dll (HKCU)
O13 - Gopher Prefix:
O15 - Trusted Zone: http://asia.msi.com.tw
O15 - Trusted Zone: http://global.msi.com.tw
O15 - Trusted Zone: http://www.msi.com.tw
O17 - HKLM\System\CCS\Services\Tcpip\..\{8B9B412C-420E-46E1-AD81-1CA6CA632039}: NameServer = 85.255.112.129,85.255.112.84
O17 - HKLM\System\CCS\Services\Tcpip\..\{E14B6377-D205-4D27-B41B-4531E39DACC9}: NameServer = 85.255.112.129,85.255.112.84
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.129,85.255.112.84
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.129,85.255.112.84
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: avgrsstx.dll
O22 - SharedTaskScheduler: Windows DreamScene - {E31004D1-A431-41B8-826F-E902F9D95C81} - C:\Windows\System32\DreamScene.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apache2.2 - Unknown owner - D:\Program Files\xampp\apache\bin\apache.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: mysql - Unknown owner - D:\Program Files\xampp\mysql\bin\mysqld.exe (file missing)
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\Windows\system32\PSIService.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SPM License Server (spmd) - mental images GmbH - C:\spm\spmdib.exe
O23 - Service: TabletServiceWacom - Wacom Technology, Corp. - C:\Windows\system32\Wacom_Tablet.exe
O23 - Service: VistaFirewallService - Sphinx Software - C:\Program Files\VistaFirewallControl\VistaFirewallService.exe

--
End of file - 13301 bytes

*sorry about not paying attention to the rules and posting in lekhite's thread!!!*

Hello.
It's okay, we all make mistakes.

• Open HijackThis
  
• Choose "Do a system scan only"
  
• Check the boxes in front of these lines:
  
  
  O2 - BHO: (no name) - {8a194578-81ea-4850-9911-13ba2d71efbd} - (no file)
  O4 - HKCU\..\Run: [Microsoft Update Machine] MSOFF07.exe
  O15 - Trusted Zone: http://asia.msi.com.tw
  O15 - Trusted Zone: http://global.msi.com.tw
  O15 - Trusted Zone: http://www.msi.com.tw
  O17 - HKLM\System\CCS\Services\Tcpip\..\{8B9B412C-420E-46E1-AD81-1CA6CA632039}: NameServer = 85.255.112.129,85.255.112.84
  O17 - HKLM\System\CCS\Services\Tcpip\..\{E14B6377-D205-4D27-B41B-4531E39DACC9}: NameServer = 85.255.112.129,85.255.112.84
  O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.129,85.255.112.84
  O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.129,85.255.112.84
  
  
  
• Press "Fix Checked"
  
• Close Hijack This.
  

Please download and run this tool.

Download Malwarebytes' Anti-Malware from Here

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
  
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  

Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.

Post the contents of the MBAM Log.

i did everything up to being able to run Malwarebytes' Anti-Malware.

after installing it with both checkboxes checked, everything seems as if it went normally, but when i try to run Malwarebytes' Anti-Malware, it crashes.



this is why i changed the name of the .exe. it was the only way i could get Malwarebytes' Anti-Malware to run.

should i do that again and then continue with the 'Quick Scan' ?

Yes, rename it and do the scan.
Does the database update fine?

If not, there is a manual download link for the database.

http://www.gt500.org/malwarebytes/database.jsp

Run the executable file and it will update the database manually rather than downloading it via the MBAM window. See if that will get the scan going. If you can't update, run the scan anyway with no update if that's possible for you.

ok, thanks, yes, i had to download the update externally ... installed ok ... starting my 'Quick Scan' ...

*to be continued*

now i've got to restart ... brb.

log contents:
==================================================
Malwarebytes' Anti-Malware 1.34
Database version: 1749
Windows 6.0.6001 Service Pack 1

2009.03.19 15:08:24
mbam-log-2009-03-19 (15-08-24).txt

Scan type: Quick Scan
Objects scanned: 68044
Time elapsed: 4 minute(s), 13 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 3
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{8b9b412c-420e-46e1-ad81-1ca6ca632039}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.112.129,85.255.112.84 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{8b9b412c-420e-46e1-ad81-1ca6ca632039}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.112.129,85.255.112.84 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{8b9b412c-420e-46e1-ad81-1ca6ca632039}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.112.129,85.255.112.84 -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Windows\System32\nvs2.inf (Adware.EGDAccess) -> Quarantined and deleted successfully.

Hello.
I want to go deeper, the EGDAccess sometimes appears with more of it's friends.

• Please download DDS by sUBs to your Desktop (Important!!) from one of these locations:
  Link 1
  Link 2
  Link 3
  
• Double click DDS.scr to run
  
• When complete, DDS.txt will open.
  
• Save the report to your Desktop.
  
• Copy and paste DDS.txt back here, I don't need to see attach.txt.
  

DDS (Ver_09-03-16.01) - NTFSx86
Run by sassan at 15:16:22,66 on 2009.03.19
Internet Explorer: 7.0.6001.18000 BrowserJavaVersion: 1.6.0_11
Microsoft Windows Vista Ultimate 6.0.6001.1.1252.49.1031.18.3070.1906 [GMT 1:00]

FW: Vista Firewall Control *enabled*

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\rundll32.exe
C:\Windows\SYSTEM32\WISPTIS.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\PSIService.exe
C:\spm\spmdib.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\Wacom_Tablet.exe
C:\Program Files\VistaFirewallControl\VistaFirewallService.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\nfsclnt.exe
C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\SYSTEM32\WISPTIS.EXE
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Windows\system32\WTablet\Wacom_TabletUser.exe
C:\Windows\system32\Wacom_Tablet.exe
C:\Windows\Explorer.EXE
C:\Windows\servicing\TrustedInstaller.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\System32\nvraidservice.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe
C:\Windows\Philips\SPC500NC\Monitor.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Logitech\Gaming Software\LWEMon.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\VistaFirewallControl\VistaFirewallControl.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Windows\System32\rundll32.exe
D:\Program Files\Adobe\Acrobat 9.0\Acrobat\acrobat_sl.exe
C:\Windows\system32\wbem\unsecapp.exe
D:\Program Files\Adobe\Acrobat 9.0\Acrobat\acrotray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Users\sassan\AppData\Local\Google\Update\GoogleUpdate.exe
C:\Program Files\Creative\Shared Files\CTSched.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Extensis\Extensis Suitcase 11\Suitcase.exe
C:\Program Files\UltraMon\UltraMon.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Users\sassan\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\sassan\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\sassan\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\sassan\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\sassan\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\sassan\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\sassan\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\sassan\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\sassan\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = about:blank
uInternet Settings,ProxyOverride = *.local
BHO: SnagIt Toolbar Loader: {00c6482d-c502-44c8-8409-fce54ad9c208} - c:\program files\snagit 9\SnagitBHO.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll
BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\4.1.805.4472\swg.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: SmartSelect Class: {f4971ee7-daa0-4053-9964-665d8ee6a077} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
TB: Snagit: {8ff5e183-abde-46eb-b09e-d2aab95cabe3} - c:\program files\snagit 9\SnagitIEAddin.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
TB: {8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - No File
uRun: [NVIDIA nTune] "c:\program files\nvidia corporation\ntune\nTuneCmd.exe" clear
uRun: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\ISUSPM.exe -startup
uRun: [Google Update] "c:\users\sassan\appdata\local\google\update\GoogleUpdate.exe" /c
uRun: [CreativeTaskScheduler] "c:\program files\creative\shared files\CTSched.exe" /logon
uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\daemon.exe" -autorun
uRun: [AdobeBridge]
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [NVRaidService] c:\windows\system32\nvraidservice.exe
mRun: [P17RunE] RunDll32 P17RunE.dll,RunDLLEntry
mRun: [JMB36X IDE Setup] c:\windows\raidtool\xInsIDE.exe
mRun: [VolPanel] "c:\program files\creative\sound blaster x-fi\volume panel\VolPanlu.exe" /r
mRun: [SPC500NC_Monitor] c:\windows\philips\spc500nc\Monitor.exe
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [Start WingMan Profiler] c:\program files\logitech\gaming software\LWEMon.exe /noui
mRun: [OPSE reminder] "c:\program files\scansoft\omnipagese2.0\eregger\ereg.exe" -r "c:\program files\scansoft\omnipagese2.0\eregger\ereg.ini"
mRun: [VistaFirewallControl] c:\program files\vistafirewallcontrol\VistaFirewallControl.exe
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [AdobeCS4ServiceManager] "c:\program files\common files\adobe\cs4servicemanager\CS4ServiceManager.exe" -launchedbylogin
mRun: [Adobe Acrobat Speed Launcher] "d:\program files\adobe\acrobat 9.0\acrobat\Acrobat_sl.exe"
mRun: []
mRun: [Acrobat Assistant 8.0] "d:\program files\adobe\acrobat 9.0\acrobat\Acrotray.exe"
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
StartupFolder: c:\users\sassan\appdata\roaming\micros~1\windows\startm~1\programs\startup\stickies.lnk - b:\program files\stickies\stickies.exe
StartupFolder: c:\users\sassan\appdata\roaming\micros~1\windows\startm~1\programs\startup\winmys~1.lnk - d:\program files\xampp\mysql\bin\winmysqladmin.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\suitca~1.lnk - c:\windows\installer\{7451c9b5-3e10-4e59-ad37-ab7438d84288}\_01D57C9244869186542E24.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\ultramon.lnk - c:\windows\installer\{af0fa6d7-96f3-468a-abb7-28be006ea8e9}\IcoUltraMon.ico
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: An vorhandene PDF-Datei anfügen - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppend.html
IE: E&xport to Microsoft Excel - d:\progra~1\micros~1\office12\EXCEL.EXE/3000
IE: In Adobe PDF konvertieren - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECapture.html
IE: Linkziel an vorhandene PDF-Datei anhängen - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Linkziel in Adobe PDF konvertieren - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Sothink SWF Catcher - c:\program files\common files\sourcetec\swf catcher\InternetExplorer.htm
IE: {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - c:\program files\common files\sourcetec\swf catcher\InternetExplorer.htm
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
AppInit_DLLs: avgrsstx.dll
STS: Windows DreamScene: {e31004d1-a431-41b8-826f-e902f9d95c81} - %SystemRoot%\System32\DreamScene.dll

================= FIREFOX ===================

FF - ProfilePath - c:\users\sassan\appdata\roaming\mozilla\firefox\profiles\obfb6kp3.default\
FF - prefs.js: browser.startup.homepage - about:blank
FF - component: c:\users\sassan\appdata\roaming\mozilla\firefox\profiles\obfb6kp3.default\extensions\{aaaf6f83-cc82-446a-87dc-aa885107a48e}\components\HTML2PDF_FFPlugin.dll
FF - component: c:\users\sassan\appdata\roaming\mozilla\firefox\profiles\obfb6kp3.default\extensions\piclens@cooliris.com\components\coolirisstub.dll
FF - plugin: c:\program files\google\google updater\2.4.1368.5602\npCIDetect13.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npPandoWebInst.dll
FF - plugin: c:\program files\opera\program\plugins\npdivx32.dll
FF - plugin: c:\programdata\nexonus\ngm\npNxGameUS.dll
FF - plugin: c:\users\sassan\appdata\local\google\update\1.2.141.5\npGoogleOneClick7.dll
FF - plugin: d:\program files\adobe\acrobat 8.0\acrobat\browser\nppdf32.dll
FF - plugin: d:\program files\adobe\acrobat 9.0\acrobat\browser\nppdf32.dll

============= SERVICES / DRIVERS ===============

R0 nvrd32;NVIDIA nForce RAID Driver;c:\windows\system32\drivers\nvrd32.sys [2008-6-16 131616]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-3-18 325640]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-3-18 107912]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe [2009-3-18 908056]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-3-18 298264]
R2 NfsClnt;Client für NFS;c:\windows\system32\nfsclnt.exe [2008-12-6 50688]
R2 SBSDWSCService;SBSD Security Center Service;c:\program files\spybot - search & destroy\SDWinSec.exe [2009-3-19 1153368]
R2 TabletServiceWacom;TabletServiceWacom;c:\windows\system32\Wacom_Tablet.exe [2008-6-10 1373480]
R2 VistaFirewallService;VistaFirewallService;c:\program files\vistafirewallcontrol\VistaFirewallService.exe [2008-10-10 286720]
R3 NfsRdr;Client für NFS-Redirector;c:\windows\system32\drivers\nfsrdr.sys [2008-12-6 195072]
R3 RpcXdr;Server für NFS Open RPC (ONCRPC);c:\windows\system32\drivers\rpcxdr.sys [2008-12-6 74240]
R3 SPC500NC;Philips SPC500NC Webcam;c:\windows\system32\drivers\SPC500NC.SYS [2007-6-21 409600]
S2 Apache2.2;Apache2.2;"d:\program files\xampp\apache\bin\apache.exe" -k runservice --> d:\program files\xampp\apache\bin\apache.exe [?]
S3 UKS11LDR;M-Audio USB Keystation Loader;c:\windows\system32\drivers\uks11ldr.sys [2008-7-9 20168]

=============== Created Last 30 ================

2009-03-19 13:08 15,504 a------- c:\windows\system32\drivers\mbam.sys
2009-03-19 13:08 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-03-19 13:08 --d----- c:\program files\Malwarebytes' Anti-Malware
2009-03-19 12:03 --d----- c:\users\sassan\appdata\roaming\Malwarebytes
2009-03-19 07:48 --d----- c:\program files\SUPERAntiSpyware
2009-03-19 07:48 --d----- c:\users\sassan\appdata\roaming\SUPERAntiSpyware.com
2009-03-19 07:13 --d----- c:\programdata\Malwarebytes
2009-03-19 07:13 --d----- c:\progra~2\Malwarebytes
2009-03-19 07:12 --d----- c:\programdata\Spybot - Search & Destroy
2009-03-19 07:12 --d----- c:\program files\Spybot - Search & Destroy
2009-03-19 07:12 --d----- c:\progra~2\Spybot - Search & Destroy
2009-03-19 00:26 --d-h--- C:\$AVG8.VAULT$
2009-03-18 23:31 325,640 a------- c:\windows\system32\drivers\avgldx86.sys
2009-03-18 23:31 107,912 a------- c:\windows\system32\drivers\avgtdix.sys
2009-03-18 23:31 10,520 a------- c:\windows\system32\avgrsstx.dll
2009-03-18 23:31 --d----- c:\windows\system32\drivers\Avg
2009-03-17 22:32 22,872 a----r-- c:\windows\system32\AdobePDFUI.dll
2009-03-17 17:10 318 ---shr-- C:\autorun.inf
2009-03-13 21:29 107,368 a------- c:\windows\system32\GEARAspi.dll
2009-03-13 21:29 23,848 a------- c:\windows\system32\drivers\GEARAspiWDM.sys
2009-03-13 21:29 --d----- c:\program files\iPod
2009-03-13 21:29 --d----- c:\programdata\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
2009-03-13 21:29 --d----- c:\program files\iTunes
2009-03-13 21:29 --d----- c:\progra~2\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
2009-03-13 19:50 --d----- c:\programdata\Digsby
2009-03-13 19:50 --d----- c:\progra~2\Digsby
2009-03-06 11:23 --d----- c:\users\sassan\appdata\roaming\Red Alert 3
2009-03-06 11:12 --d----- c:\programdata\Electronic Arts
2009-03-06 11:12 --d----- c:\progra~2\Electronic Arts
2009-03-04 13:29 21 a------- c:\windows\SurCode.INI
2009-03-04 13:26 --d----- c:\users\sassan\Library
2009-03-03 06:18 --d----- C:\Python30
2009-03-03 05:55 --d----- C:\Engine
2009-03-02 17:46 45,392 a------- c:\windows\system32\AdobePDF.dll
2009-03-02 14:09 --d----- c:\users\sassan\appdata\roaming\Digsby
2009-03-02 14:08 --d----- c:\program files\Digsby
2009-02-24 16:42 545 a------- c:\windows\my.ini

==================== Find3M ====================

2009-03-19 12:00 410,984 a------- c:\windows\system32\deploytk.dll
2009-03-13 21:27 143,360 a------- c:\windows\inf\infstrng.dat
2009-03-13 21:27 86,016 a------- c:\windows\inf\infstor.dat
2009-03-13 21:27 86,016 a------- c:\windows\inf\infpub.dat
2009-03-03 01:38 634,030 a------- c:\windows\system32\perfh007.dat
2009-03-03 01:38 129,274 a------- c:\windows\system32\perfc007.dat
2009-02-13 20:05 2,027,008 a------- c:\windows\system32\python30.dll
2009-01-11 20:17 49,152 a------- c:\windows\system32\SearchRequire.dll
2009-01-05 01:01 444,952 a------- c:\windows\system32\wrap_oal.dll
2009-01-05 01:01 109,080 a------- c:\windows\system32\OpenAL32.dll
2008-12-27 22:50 126,976 a------- c:\windows\system32\Interop.SHDocVw.dll
2008-12-06 23:21 174 a--sh--- c:\program files\desktop.ini
2008-12-06 23:09 665,600 a------- c:\windows\inf\drvindex.dat
2008-10-21 23:39 1,024 a------- c:\programdata\imgpdf2.dll
2008-10-21 23:39 1,024 a------- c:\progra~2\imgpdf2.dll
2008-09-23 14:09 568,385 a------- c:\program files\dxf_viewer.jar
2008-06-16 02:19 287,440 a------- c:\windows\inf\perflib\0409\perfi.dat
2008-06-16 02:19 287,440 a------- c:\windows\inf\perflib\0409\perfh.dat
2008-06-16 02:19 30,674 a------- c:\windows\inf\perflib\0409\perfd.dat
2008-06-16 02:19 30,674 a------- c:\windows\inf\perflib\0409\perfc.dat
2007-02-01 17:02 313,344 a------- c:\program files\hjsplit.exe
2006-11-02 16:45 290,748 a------- c:\windows\inf\perflib\0407\perfi.dat
2006-11-02 16:45 290,748 a------- c:\windows\inf\perflib\0407\perfh.dat
2006-11-02 16:45 36,916 a------- c:\windows\inf\perflib\0407\perfd.dat
2006-11-02 16:45 36,916 a------- c:\windows\inf\perflib\0407\perfc.dat
2006-11-02 10:20 287,440 a------- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 10:20 287,440 a------- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 10:20 30,674 a------- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 10:20 30,674 a------- c:\windows\inf\perflib\0000\perfc.dat

============= FINISH: 15:17:01,03 ===============

*apologies - was too long for one post*

It's okay. No rule against using as many posts as needed to post longer logs.
Just a leftover to get.

Please download the OTMoveIt3 by OldTimer.

• Save it to your desktop.
  
• Please right-click OTMoveIt3.exe > Run as administrator to run it.
  
• Copy the bolded text below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  
  :files
  C:\autorun.inf
  
  
  
• Return to OTMoveIt3, right click in the "Paste instructions for items to be Moved" window (under the light blue bar) and choose Paste.
  
• Click the red Moveit! button.
  
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  
• Close OTMoveIt3
  

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

Please post the OTMoveIt log.

========== FILES ==========
C:\autorun.inf moved successfully.

OTMoveIt3 by OldTimer - Version 1.0.9.0 log created on 03192009_153138

Hello.
How is the machine now?

i don't even know how to check, right now ... what do i use? should i restart first?

Sure.
What i mean by that is this.

Compare the machine now to when we first started? does it run smoother?

ok, i went to http://free.avg.com/download-update and got the .bin files to update my AVG-Free. i updated my AVG-Free from these files without update from a server (because it still won't work).

then i started Firefox and got this:



then i clicked 'Remove selected infections' and got this:



now what?

Hmm.
I didn't know this DNS hijacker rootkit worked on Vista. Thanks for letting me know, you've probably helped me figure out the next few people who come in with this.

1. Please download The Avenger by Swandog46 to your Desktop
Link: HERE or HERE.

• Click on Avenger.zip to open the file
  
• Extract avenger.exe to your desktop
  

2. Now, start The Avenger program by clicking on its icon on your desktop.

• Leave the script box empty.
  
• Leave the ticked box "Scan for rootkit" ticked.
  
• Then tick "Disable any rootkits found"
  
• Now click on the Execute to begin execution of the script.
  
• Answer "Yes" twice when prompted.
  
  The Avenger will automatically do the following:
  
  
• It will Restart your computer.
  
• On reboot, it will briefly open a black command window on your desktop, this is normal.
  
• After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
  
• The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
  

3. Please copy/paste the content of c:\avenger.txt into your reply.

ok, after the restart i got a warning with the avenger.txt ... the warning:



and here's the avenger.txt:
============================================
Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows Vista

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.

Hidden driver "gaopdxserv.sys" found!
ImagePath: \systemroot\system32\drivers\gaopdxsojcswixxpxuinhxcovptotqbqxvvcwp.sys
Driver disabled successfully.

Rootkit scan completed.


Completed script processing.

*******************

Finished! Terminate.

ok ... i think that did it.

Firefox ran no bugs or ticks (i mean there was an AdBrite thing that AVG-Free as warning showed me - i had it moved to the Vault).

AVG-Free could update from the server again no problems.

I even changed the .exe name back to 'mbam.exe' for Malwarebytes' Anti-Malware and it runs without crashing and can even update the database from the server, no sweat.

thanks very much !!!

damn!

maybe i spoke too soon:




i've tried using 'Heal' and 'Move to Vault' on this. but it keeps popping up when i start Firefox ...

uh, what next?

Hello.
No problem with the warning, it's because the avenger has disabled the malicious driver and now AVG is going crazy because it's finding the rootkits files.
Tell AVG to ignore them because I don't want it to interfere with our work.

2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):

Drivers to delete:
gaopdxserv.sys

Files to delete:
C:\WINDOWS\system32\drivers\gaopdxsojcswixxpxuinhxcovptotqbqxvvcwp.sys

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, start The Avenger program by clicking on its icon on your desktop.

• Under "Input script here:", paste in the script from the quote box above.
  
• Leave the ticked box "Scan for rootkit" ticked.
  
• Then tick "Disable any rootkits found"
  
• Now click on the Execute to begin execution of the script.
  
• Answer "Yes" twice when prompted.
  
  The Avenger will automatically do the following:
  
  
• It will Restart your computer.
  
• On reboot, it will briefly open a black command window on your desktop, this is normal.
  
• After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
  
• The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
  

4. Please copy/paste the content of c:\avenger.txt into your reply.

ok after the reboot from Avenger, i got a blue screen and then after the dump, was taken to the choices of startup - where i chose start windows normally.

vista opens up to the Avenger log, but again, there comes this warning:



which came up again 2x after clicking 'Cancel'.

ok, there wasn't any balking from AVG-Free resident shield as i started up Firefox this time .... here's the Avenger log:
========================================
Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows Vista

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

Driver "gaopdxserv.sys" deleted successfully.
File "C:\WINDOWS\system32\drivers\gaopdxsojcswixxpxuinhxcovptotqbqxvvcwp.sys" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

Hello.
The error on boot is caused by something plugged into a USB slot, or another internal drive conflicting with the OS drive. If you have anything plugged into a USB slot during boot (USB printer cable), unplug while the machine boots and the error should go away.

Run MBAM again, it should pick up the rootkits files now.

Quick Scan or Full Scan?

Quick scan please.

Malwarebytes' Anti-Malware 1.34
Database version: 1870
Windows 6.0.6001 Service Pack 1

2009.03.19 18:42:27
mbam-log-2009-03-19 (18-42-27).txt

Scan type: Quick Scan
Objects scanned: 71218
Time elapsed: 4 minute(s), 31 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Windows\System32\gaopdxcounter (Trojan.Agent) -> Quarantined and deleted successfully.

Can you run DDS one final time now.

http://www.geekpolice.net/virus-spyware-malware-removal-f11/malware-win32-cryptor-t7605.htm#46812

Post the new log when done.

DDS (Ver_09-03-16.01) - NTFSx86
Run by sassan at 20:05:04,06 on 2009.03.19
Internet Explorer: 7.0.6001.18000 BrowserJavaVersion: 1.6.0_11
Microsoft Windows Vista Ultimate 6.0.6001.1.1252.49.1031.18.3070.1072 [GMT 1:00]

FW: Vista Firewall Control *enabled*

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\rundll32.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\SYSTEM32\WISPTIS.EXE
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
C:\Windows\system32\taskeng.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
C:\Windows\system32\taskeng.exe
C:\Windows\SYSTEM32\WISPTIS.EXE
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\PSIService.exe
C:\spm\spmdib.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\Wacom_Tablet.exe
C:\Program Files\VistaFirewallControl\VistaFirewallService.exe
C:\Windows\system32\WTablet\Wacom_TabletUser.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\Wacom_Tablet.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Windows\system32\nfsclnt.exe
C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\System32\nvraidservice.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe
C:\Windows\Philips\SPC500NC\Monitor.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Logitech\Gaming Software\LWEMon.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\VistaFirewallControl\VistaFirewallControl.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Windows\System32\rundll32.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
D:\Program Files\Adobe\Acrobat 9.0\Acrobat\acrotray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Users\sassan\AppData\Local\Google\Update\GoogleUpdate.exe
C:\Program Files\Creative\Shared Files\CTSched.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Extensis\Extensis Suitcase 11\Suitcase.exe
C:\Program Files\UltraMon\UltraMon.exe
B:\Program Files\Stickies\stickies.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\WUDFHost.exe
B:\Program Files\THQ\Dawn Of War 2\dow2.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\sassan\Desktop\dds.scr
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = about:blank
uInternet Settings,ProxyOverride = *.local
BHO: SnagIt Toolbar Loader: {00c6482d-c502-44c8-8409-fce54ad9c208} - c:\program files\snagit 9\SnagitBHO.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll
BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\4.1.805.4472\swg.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: SmartSelect Class: {f4971ee7-daa0-4053-9964-665d8ee6a077} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
TB: Snagit: {8ff5e183-abde-46eb-b09e-d2aab95cabe3} - c:\program files\snagit 9\SnagitIEAddin.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
TB: {8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - No File
uRun: [NVIDIA nTune] "c:\program files\nvidia corporation\ntune\nTuneCmd.exe" clear
uRun: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\ISUSPM.exe -startup
uRun: [Google Update] "c:\users\sassan\appdata\local\google\update\GoogleUpdate.exe" /c
uRun: [CreativeTaskScheduler] "c:\program files\creative\shared files\CTSched.exe" /logon
uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\daemon.exe" -autorun
uRun: [AdobeBridge]
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [NVRaidService] c:\windows\system32\nvraidservice.exe
mRun: [P17RunE] RunDll32 P17RunE.dll,RunDLLEntry
mRun: [JMB36X IDE Setup] c:\windows\raidtool\xInsIDE.exe
mRun: [VolPanel] "c:\program files\creative\sound blaster x-fi\volume panel\VolPanlu.exe" /r
mRun: [SPC500NC_Monitor] c:\windows\philips\spc500nc\Monitor.exe
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [Start WingMan Profiler] c:\program files\logitech\gaming software\LWEMon.exe /noui
mRun: [OPSE reminder] "c:\program files\scansoft\omnipagese2.0\eregger\ereg.exe" -r "c:\program files\scansoft\omnipagese2.0\eregger\ereg.ini"
mRun: [VistaFirewallControl] c:\program files\vistafirewallcontrol\VistaFirewallControl.exe
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [AdobeCS4ServiceManager] "c:\program files\common files\adobe\cs4servicemanager\CS4ServiceManager.exe" -launchedbylogin
mRun: [Adobe Acrobat Speed Launcher] "d:\program files\adobe\acrobat 9.0\acrobat\Acrobat_sl.exe"
mRun: []
mRun: [Acrobat Assistant 8.0] "d:\program files\adobe\acrobat 9.0\acrobat\Acrotray.exe"
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
StartupFolder: c:\users\sassan\appdata\roaming\micros~1\windows\startm~1\programs\startup\stickies.lnk - b:\program files\stickies\stickies.exe
StartupFolder: c:\users\sassan\appdata\roaming\micros~1\windows\startm~1\programs\startup\winmys~1.lnk - d:\program files\xampp\mysql\bin\winmysqladmin.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\suitca~1.lnk - c:\windows\installer\{7451c9b5-3e10-4e59-ad37-ab7438d84288}\_01D57C9244869186542E24.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\ultramon.lnk - c:\windows\installer\{af0fa6d7-96f3-468a-abb7-28be006ea8e9}\IcoUltraMon.ico
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: An vorhandene PDF-Datei anfügen - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppend.html
IE: E&xport to Microsoft Excel - d:\progra~1\micros~1\office12\EXCEL.EXE/3000
IE: In Adobe PDF konvertieren - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECapture.html
IE: Linkziel an vorhandene PDF-Datei anhängen - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Linkziel in Adobe PDF konvertieren - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Sothink SWF Catcher - c:\program files\common files\sourcetec\swf catcher\InternetExplorer.htm
IE: {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - c:\program files\common files\sourcetec\swf catcher\InternetExplorer.htm
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
AppInit_DLLs: avgrsstx.dll
STS: Windows DreamScene: {e31004d1-a431-41b8-826f-e902f9d95c81} - %SystemRoot%\System32\DreamScene.dll

================= FIREFOX ===================

FF - ProfilePath - c:\users\sassan\appdata\roaming\mozilla\firefox\profiles\obfb6kp3.default\
FF - prefs.js: browser.startup.homepage - about:blank
FF - component: c:\program files\avg\avg8\firefox\components\avgssff.dll
FF - component: c:\users\sassan\appdata\roaming\mozilla\firefox\profiles\obfb6kp3.default\extensions\{aaaf6f83-cc82-446a-87dc-aa885107a48e}\components\HTML2PDF_FFPlugin.dll
FF - component: c:\users\sassan\appdata\roaming\mozilla\firefox\profiles\obfb6kp3.default\extensions\piclens@cooliris.com\components\coolirisstub.dll
FF - plugin: c:\program files\google\google updater\2.4.1368.5602\npCIDetect13.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npPandoWebInst.dll
FF - plugin: c:\program files\opera\program\plugins\npdivx32.dll
FF - plugin: c:\programdata\nexonus\ngm\npNxGameUS.dll
FF - plugin: c:\users\sassan\appdata\local\google\update\1.2.141.5\npGoogleOneClick7.dll
FF - plugin: d:\program files\adobe\acrobat 8.0\acrobat\browser\nppdf32.dll
FF - plugin: d:\program files\adobe\acrobat 9.0\acrobat\browser\nppdf32.dll

============= SERVICES / DRIVERS ===============

R0 nvrd32;NVIDIA nForce RAID Driver;c:\windows\system32\drivers\nvrd32.sys [2008-6-16 131616]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-3-18 325640]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-3-18 107912]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe [2009-3-18 908056]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-3-18 298264]
R2 NfsClnt;Client für NFS;c:\windows\system32\nfsclnt.exe [2008-12-6 50688]
R2 SBSDWSCService;SBSD Security Center Service;c:\program files\spybot - search & destroy\SDWinSec.exe [2009-3-19 1153368]
R2 TabletServiceWacom;TabletServiceWacom;c:\windows\system32\Wacom_Tablet.exe [2008-6-10 1373480]
R2 VistaFirewallService;VistaFirewallService;c:\program files\vistafirewallcontrol\VistaFirewallService.exe [2008-10-10 286720]
R3 NfsRdr;Client für NFS-Redirector;c:\windows\system32\drivers\nfsrdr.sys [2008-12-6 195072]
R3 RpcXdr;Server für NFS Open RPC (ONCRPC);c:\windows\system32\drivers\rpcxdr.sys [2008-12-6 74240]
S2 Apache2.2;Apache2.2;"d:\program files\xampp\apache\bin\apache.exe" -k runservice --> d:\program files\xampp\apache\bin\apache.exe [?]
S3 SPC500NC;Philips SPC500NC Webcam;c:\windows\system32\drivers\SPC500NC.SYS [2007-6-21 409600]
S3 UKS11LDR;M-Audio USB Keystation Loader;c:\windows\system32\drivers\uks11ldr.sys [2008-7-9 20168]

=============== Created Last 30 ================

2009-03-19 15:31 --d----- C:\_OTMoveIt
2009-03-19 13:08 15,504 a------- c:\windows\system32\drivers\mbam.sys
2009-03-19 13:08 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-03-19 13:08 --d----- c:\program files\Malwarebytes' Anti-Malware
2009-03-19 12:03 --d----- c:\users\sassan\appdata\roaming\Malwarebytes
2009-03-19 07:48 --d----- c:\program files\SUPERAntiSpyware
2009-03-19 07:48 --d----- c:\users\sassan\appdata\roaming\SUPERAntiSpyware.com
2009-03-19 07:13 --d----- c:\programdata\Malwarebytes
2009-03-19 07:13 --d----- c:\progra~2\Malwarebytes
2009-03-19 07:12 --d----- c:\programdata\Spybot - Search & Destroy
2009-03-19 07:12 --d----- c:\program files\Spybot - Search & Destroy
2009-03-19 07:12 --d----- c:\progra~2\Spybot - Search & Destroy
2009-03-19 00:26 --d-h--- C:\$AVG8.VAULT$
2009-03-18 23:31 325,640 a------- c:\windows\system32\drivers\avgldx86.sys
2009-03-18 23:31 107,912 a------- c:\windows\system32\drivers\avgtdix.sys
2009-03-18 23:31 10,520 a------- c:\windows\system32\avgrsstx.dll
2009-03-18 23:31 --d----- c:\windows\system32\drivers\Avg
2009-03-17 22:32 22,872 a----r-- c:\windows\system32\AdobePDFUI.dll
2009-03-13 21:29 107,368 a------- c:\windows\system32\GEARAspi.dll
2009-03-13 21:29 23,848 a------- c:\windows\system32\drivers\GEARAspiWDM.sys
2009-03-13 21:29 --d----- c:\program files\iPod
2009-03-13 21:29 --d----- c:\programdata\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
2009-03-13 21:29 --d----- c:\program files\iTunes
2009-03-13 21:29 --d----- c:\progra~2\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
2009-03-13 19:50 --d----- c:\programdata\Digsby
2009-03-13 19:50 --d----- c:\progra~2\Digsby
2009-03-06 11:23 --d----- c:\users\sassan\appdata\roaming\Red Alert 3
2009-03-06 11:12 --d----- c:\programdata\Electronic Arts
2009-03-06 11:12 --d----- c:\progra~2\Electronic Arts
2009-03-04 13:29 21 a------- c:\windows\SurCode.INI
2009-03-04 13:26 --d----- c:\users\sassan\Library
2009-03-03 06:18 --d----- C:\Python30
2009-03-03 05:55 --d----- C:\Engine
2009-03-02 17:46 45,392 a------- c:\windows\system32\AdobePDF.dll
2009-03-02 14:09 --d----- c:\users\sassan\appdata\roaming\Digsby
2009-03-02 14:08 --d----- c:\program files\Digsby
2009-02-24 16:42 545 a------- c:\windows\my.ini

==================== Find3M ====================

2009-03-19 12:00 410,984 a------- c:\windows\system32\deploytk.dll
2009-03-13 21:27 143,360 a------- c:\windows\inf\infstrng.dat
2009-03-13 21:27 86,016 a------- c:\windows\inf\infstor.dat
2009-03-13 21:27 86,016 a------- c:\windows\inf\infpub.dat
2009-03-03 01:38 634,030 a------- c:\windows\system32\perfh007.dat
2009-03-03 01:38 129,274 a------- c:\windows\system32\perfc007.dat
2009-02-13 20:05 2,027,008 a------- c:\windows\system32\python30.dll
2009-01-11 20:17 49,152 a------- c:\windows\system32\SearchRequire.dll
2009-01-05 01:01 444,952 a------- c:\windows\system32\wrap_oal.dll
2009-01-05 01:01 109,080 a------- c:\windows\system32\OpenAL32.dll
2008-12-27 22:50 126,976 a------- c:\windows\system32\Interop.SHDocVw.dll
2008-12-06 23:21 174 a--sh--- c:\program files\desktop.ini
2008-12-06 23:09 665,600 a------- c:\windows\inf\drvindex.dat
2008-10-21 23:39 1,024 a------- c:\programdata\imgpdf2.dll
2008-10-21 23:39 1,024 a------- c:\progra~2\imgpdf2.dll
2008-09-23 14:09 568,385 a------- c:\program files\dxf_viewer.jar
2008-06-16 02:19 287,440 a------- c:\windows\inf\perflib\0409\perfi.dat
2008-06-16 02:19 287,440 a------- c:\windows\inf\perflib\0409\perfh.dat
2008-06-16 02:19 30,674 a------- c:\windows\inf\perflib\0409\perfd.dat
2008-06-16 02:19 30,674 a------- c:\windows\inf\perflib\0409\perfc.dat
2007-02-01 17:02 313,344 a------- c:\program files\hjsplit.exe
2006-11-02 16:45 290,748 a------- c:\windows\inf\perflib\0407\perfi.dat
2006-11-02 16:45 290,748 a------- c:\windows\inf\perflib\0407\perfh.dat
2006-11-02 16:45 36,916 a------- c:\windows\inf\perflib\0407\perfd.dat
2006-11-02 16:45 36,916 a------- c:\windows\inf\perflib\0407\perfc.dat
2006-11-02 10:20 287,440 a------- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 10:20 287,440 a------- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 10:20 30,674 a------- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 10:20 30,674 a------- c:\windows\inf\perflib\0000\perfc.dat

============= FINISH: 20:06:03,61 ===============

Hello.
This looks okay now, how's the machine running?

We need to remove the tools we have used.

Please download the OTMoveIt3 by OldTimer.

• Save it to your desktop.
  
• Please double-click OTMoveIt3.exe to run it again.
  
• Press the green CleanUp! button.
  
• Press Yes to the reboot prompt, no need to post anymore logs.
  

first thing i did was start Firefox and AVG-Free's Res Shield popped up a warning saying Accessed file has a warning

File name: C:\Users\sassan\AppData\Roaming\Mozilla\Firefox\Profiles\obfb6kp3.default\cookies.sqlite

Threat name: Found Tracking cookie.Statcounter
Detected on open.

Process name: C:\Program Files\Mozilla Firefox\firefox.exe
Process ID: 5544

They are only cookies, not really a threat. We can clean them with this.

Download ATF Cleaner

• Double-click ATF-Cleaner.exe to run the program.
  
• Click Select All found at the bottom of the list.
  
• Click the Empty Selected button.
  

If you use Firefox browser, do this also:

• Click Firefox at the top and choose Select All from the list.
  
• Click the Empty Selected button.
  
• NOTE : If you would like to keep your saved passwords, please click No at the prompt.
  

If you use Opera browser, do this also:

• Click Opera at the top and choose Select All from the list.
  
• Click the Empty Selected button.
  
• NOTE : If you would like to keep your saved passwords, please click No at the prompt.
  

Click Exit on the Main menu to close the program.

i did all that but the warning just popped-up again as soon as i started Firefox ... this time Process ID: 2196

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoDriveTypeAutoRun"=dword:000000FF
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoDriveTypeAutoRun"=dword:000000FF

I would consider switching from AVG to Avira, AVG is known to have false positives.

If you choose to follow my recommendation then follow these instructions.

• Click Start >> Control Panel.
  
• Under the Programs click Uninstall a Program
  
• Highlight AVG8 Free
  
• Click on the Uninstall/Change button at the top.
  

Please install Avira antivirus otherwise you won't be protected.

1) Antivir PersonalEditionClassic
-Free anti-virus software for Windows.
-Detects and removes more than 50,000 viruses. Free support.

It is strongly recommended that you run only one antivirus program at a time. Having more than one antivirus program active in memory uses additional resources and can result in program conflicts and false virus alerts.