I believe I have Vundo

I have tried using Vundofix but it did not detect anything. Here is my log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:16:32 AM, on 21/12/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\WINDOWS\system32\HPZipm12.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\system32\nULMi2Wy.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
C:\Program Files\Logitech\ImageStudio\LogiTray.exe
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDET.EXE
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Program Files\AVG\AVG8\avgui.exe
C:\Program Files\AVG\AVG8\avgscanx.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Doris\Desktop\hijackgpthis.exe
C:\WINDOWS\SYSTEM32\notepad.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://ca.search.yahoo.com/search?fr=mcafee&p=%s
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) - {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - C:\WINDOWS\system32\opnnnLCv.dll
O2 - BHO: {0ed21cd2-5cbe-507b-2f34-4ff12b332257} - {752233b2-1ff4-43f2-b705-ebc52dc12de0} - C:\WINDOWS\system32\xcztqx.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {9569F869-BD11-42CE-BA06-CA303DE13202} - C:\WINDOWS\system32\efcYSlJC.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Program Files\Logitech\ImageStudio\LogiTray.exe
O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\ImageStudio\ISStart.exe
O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTDVDDET] "C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDET.EXE"
O4 - HKLM\..\Run: [bitslistdebugadmin] C:\Documents and Settings\All Users\Application Data\Pilecompbitslist\Ford Tons.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [prunnet] "C:\WINDOWS\system32\prunnet.exe"
O4 - HKLM\..\Run: [94685161] rundll32.exe "C:\WINDOWS\system32\bwsidmmf.dll",b
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [prunnet] "C:\WINDOWS\system32\prunnet.exe"
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MI1933~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MI1933~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {2A0B9B82-D5C8-4D3D-8338-AD55B23662B1} (F5 Networks CacheCleaner) - https://employees.cpr.ca/vdesk/cachecleaner.cab#version=6020,2008,0212,2003
O16 - DPF: {45B69029-F3AB-4204-92DE-D5140C3E8E74} (F5 Networks Auto Update) - C:\DOCUME~1\Stan\LOCALS~1\Temp\IXP000.TMP\InstallerControl.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,84/mcinsctl.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,21/mcgdmgr.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O20 - AppInit_DLLs: xcztqx.dll,avgrsstx.dll
O20 - Winlogon Notify: opnnnLCv - C:\WINDOWS\SYSTEM32\opnnnLCv.dll
O23 - Service: McAfee Application Installer Cleanup (0313821229840921) (0313821229840921mcinstcleanup) - McAfee, Inc. - C:\DOCUME~1\Doris\LOCALS~1\Temp\031382~1.EXE
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe

--
End of file - 13112 bytes



Any help is appreciated!

sorry that took so long, but here is that log.

ComboFix 08-12-20.05 - Doris 2008-12-21 11:37:06.1 - NTFSx86
Running from: c:\documents and settings\Doris\Desktop\ComboFix.exe
* Resident AV is active

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Stan\Application Data\gadcom
c:\documents and settings\Stan\Local Settings\Temporary Internet Files\fbk.sts
c:\program files\MalwareAlarm
c:\program files\MalwareAlarm\MalwareAlarm.lic
c:\windows\system32\axvvlguw.dll
c:\windows\system32\bcgkxxen.ini
c:\windows\system32\bwsidmmf.dll
c:\windows\system32\CJlSYcfe.ini
c:\windows\system32\CJlSYcfe.ini2
c:\windows\system32\efcYSlJC.dll
c:\windows\system32\fmmdiswb.ini
c:\windows\system32\jlfukakb.dll
c:\windows\system32\mcrh.tmp
c:\windows\system32\msxml71.dll
c:\windows\system32\nexxkgcb.dll
c:\windows\system32\nULMi2Wy.exe.a_a
c:\windows\system32\prunnet.exe
c:\windows\system32\quyttq.dll
c:\windows\system32\xcztqx.dll

.
((((((((((((((((((((((((( Files Created from 2008-11-21 to 2008-12-21 )))))))))))))))))))))))))))))))
.

2008-12-21 11:11 . 2008-12-21 11:12 d--h----- C:\$AVG8.VAULT$
2008-12-21 10:57 . 2008-12-21 10:59 d-------- c:\windows\SYSTEM32\DRIVERS\Avg
2008-12-21 10:57 . 2008-12-21 10:57 97,928 --a------ c:\windows\SYSTEM32\DRIVERS\avgldx86.sys
2008-12-21 10:57 . 2008-12-21 10:57 10,520 --a------ c:\windows\SYSTEM32\avgrsstx.dll
2008-12-21 10:56 . 2008-12-21 10:56 d-------- c:\program files\AVG
2008-12-21 10:56 . 2008-12-21 10:56 d-------- c:\documents and settings\All Users\Application Data\avg8
2008-12-21 10:36 . 2008-12-21 10:36 268 --ah----- C:\sqmdata10.sqm
2008-12-21 10:36 . 2008-12-21 10:36 244 --ah----- C:\sqmnoopt10.sqm
2008-12-21 03:22 . 2008-04-13 18:12 116,224 --a------ c:\windows\SYSTEM32\DLLCACHE\xrxwiadr.dll
2008-12-21 03:22 . 2001-08-17 22:36 23,040 --a------ c:\windows\SYSTEM32\DLLCACHE\xrxwbtmp.dll
2008-12-21 03:22 . 2008-04-13 18:12 18,944 --a------ c:\windows\SYSTEM32\DLLCACHE\xrxscnui.dll
2008-12-21 03:21 . 2001-08-17 22:37 99,865 --a------ c:\windows\SYSTEM32\DLLCACHE\xlog.exe
2008-12-21 03:21 . 2004-08-04 05:00 28,288 --a------ c:\windows\SYSTEM32\DLLCACHE\xjis.nls
2008-12-21 03:21 . 2001-08-17 22:37 27,648 --a------ c:\windows\SYSTEM32\DLLCACHE\xrxftplt.exe
2008-12-21 03:21 . 2004-08-03 22:29 19,455 --a------ c:\windows\SYSTEM32\DLLCACHE\wvchntxx.sys
2008-12-21 03:21 . 2001-08-17 12:11 16,970 --a------ c:\windows\SYSTEM32\DLLCACHE\xem336n5.sys
2008-12-21 03:21 . 2004-08-03 22:29 12,063 --a------ c:\windows\SYSTEM32\DLLCACHE\wsiintxx.sys
2008-12-21 03:21 . 2008-04-13 18:12 8,192 --a------ c:\windows\SYSTEM32\DLLCACHE\wshirda.dll
2008-12-21 03:21 . 2001-08-17 22:37 4,608 --a------ c:\windows\SYSTEM32\DLLCACHE\xrxflnch.exe
2008-12-21 03:19 . 2001-08-17 13:28 604,253 --a------ c:\windows\SYSTEM32\DLLCACHE\vmodem.sys
2008-12-21 03:18 . 2001-08-17 13:28 794,654 --a------ c:\windows\SYSTEM32\DLLCACHE\usr1801.sys
2008-12-21 03:18 . 2001-08-17 13:28 794,399 --a------ c:\windows\SYSTEM32\DLLCACHE\usr1806v.sys
2008-12-21 03:18 . 2001-08-17 13:28 793,598 --a------ c:\windows\SYSTEM32\DLLCACHE\usr1806.sys
2008-12-21 03:18 . 2001-08-17 13:28 765,884 --a------ c:\windows\SYSTEM32\DLLCACHE\usrti.sys
2008-12-21 03:18 . 2001-08-17 13:28 687,999 --a------ c:\windows\SYSTEM32\DLLCACHE\usrwdxjs.sys
2008-12-21 03:18 . 2001-08-17 13:28 224,802 --a------ c:\windows\SYSTEM32\DLLCACHE\usr1807a.sys
2008-12-21 03:18 . 2001-08-17 13:28 113,762 --a------ c:\windows\SYSTEM32\DLLCACHE\usrpda.sys
2008-12-21 03:18 . 2001-08-17 22:36 94,720 --a------ c:\windows\SYSTEM32\DLLCACHE\umaxud32.dll
2008-12-21 03:18 . 2004-08-03 22:31 32,384 --a------ c:\windows\SYSTEM32\DLLCACHE\usb101et.sys
2008-12-21 03:18 . 2008-04-13 12:45 26,112 --a------ c:\windows\SYSTEM32\DLLCACHE\usbser.sys
2008-12-21 03:18 . 2008-04-13 12:45 17,152 --a------ c:\windows\SYSTEM32\DLLCACHE\usbohci.sys
2008-12-21 03:18 . 2001-08-17 13:28 7,556 --a------ c:\windows\SYSTEM32\DLLCACHE\usroslba.sys
2008-12-21 03:16 . 2001-08-17 14:56 440,576 --a------ c:\windows\SYSTEM32\DLLCACHE\tridkb.dll
2008-12-21 03:16 . 2001-08-17 14:56 315,520 --a------ c:\windows\SYSTEM32\DLLCACHE\trid3d.dll
2008-12-21 03:16 . 2001-08-17 14:01 241,664 --a------ c:\windows\SYSTEM32\DLLCACHE\tosdvd02.sys
2008-12-21 03:16 . 2001-08-17 14:02 230,912 --a------ c:\windows\SYSTEM32\DLLCACHE\tosdvd03.sys
2008-12-21 03:16 . 2001-08-17 12:51 222,336 --a------ c:\windows\SYSTEM32\DLLCACHE\trid3dm.sys
2008-12-21 03:16 . 2004-08-04 05:00 185,344 --a------ c:\windows\SYSTEM32\DLLCACHE\thawbrkr.dll
2008-12-21 03:16 . 2001-08-17 12:51 159,232 --a------ c:\windows\SYSTEM32\DLLCACHE\tridkbm.sys
2008-12-21 03:16 . 2001-08-17 12:14 123,995 --a------ c:\windows\SYSTEM32\DLLCACHE\tjisdn.sys
2008-12-21 03:16 . 2008-04-13 18:12 82,944 --a------ c:\windows\SYSTEM32\DLLCACHE\tp4mon.exe
2008-12-21 03:16 . 2001-08-17 22:35 42,496 --a------ c:\windows\SYSTEM32\DLLCACHE\tp4res.dll
2008-12-21 03:16 . 2001-08-17 12:12 34,375 --a------ c:\windows\SYSTEM32\DLLCACHE\tpro4.sys
2008-12-21 03:16 . 2001-08-17 22:36 31,744 --a------ c:\windows\SYSTEM32\DLLCACHE\tp4.dll
2008-12-21 03:16 . 2001-08-17 12:10 28,232 --a------ c:\windows\SYSTEM32\DLLCACHE\tos4mo.sys
2008-12-21 03:14 . 2001-08-17 12:18 285,760 --a------ c:\windows\SYSTEM32\DLLCACHE\stlnata.sys
2008-12-21 03:14 . 2001-08-17 22:36 155,648 --a------ c:\windows\SYSTEM32\DLLCACHE\stlnprop.dll
2008-12-21 03:14 . 2004-08-04 05:00 101,376 --a------ c:\windows\SYSTEM32\DLLCACHE\srusbusd.dll
2008-12-21 03:14 . 2001-08-17 22:36 99,328 --a------ c:\windows\SYSTEM32\DLLCACHE\srusd.dll
2008-12-21 03:14 . 2001-08-17 13:51 61,824 --a------ c:\windows\SYSTEM32\DLLCACHE\speed.sys
2008-12-21 03:14 . 2001-08-17 22:36 53,760 --a------ c:\windows\SYSTEM32\DLLCACHE\sw_wheel.dll
2008-12-21 03:14 . 2001-08-17 22:36 53,248 --a------ c:\windows\SYSTEM32\DLLCACHE\stlncoin.dll
2008-12-21 03:14 . 2001-08-17 12:11 48,736 --a------ c:\windows\SYSTEM32\DLLCACHE\srwlnd5.sys
2008-12-21 03:14 . 2001-08-17 22:36 41,472 --a------ c:\windows\SYSTEM32\DLLCACHE\sw_effct.dll
2008-12-21 03:14 . 2001-08-17 22:36 24,660 --a------ c:\windows\SYSTEM32\DLLCACHE\spxupchk.dll
2008-12-21 03:14 . 2001-08-17 13:51 16,896 --a------ c:\windows\SYSTEM32\DLLCACHE\stcusb.sys
2008-12-21 03:14 . 2001-08-17 22:36 10,240 --a------ c:\windows\SYSTEM32\DLLCACHE\swpidflt.dll
2008-12-21 03:14 . 2001-08-17 22:36 10,240 --a------ c:\windows\SYSTEM32\DLLCACHE\swpdflt2.dll
2008-12-21 03:12 . 2001-08-17 22:36 238,592 --a------ c:\windows\SYSTEM32\DLLCACHE\sisgrv.dll
2008-12-21 03:11 . 2001-08-17 22:36 386,560 --a------ c:\windows\SYSTEM32\DLLCACHE\sgiul50.dll
2008-12-21 03:11 . 2001-08-17 14:56 252,032 --a------ c:\windows\SYSTEM32\DLLCACHE\sis300iv.dll
2008-12-21 03:11 . 2001-07-21 14:29 161,568 --a------ c:\windows\SYSTEM32\DLLCACHE\sgsmusb.sys
2008-12-21 03:11 . 2001-08-17 14:56 150,144 --a------ c:\windows\SYSTEM32\DLLCACHE\sis6306v.dll
2008-12-21 03:11 . 2001-08-17 12:50 101,760 --a------ c:\windows\SYSTEM32\DLLCACHE\sis300ip.sys
2008-12-21 03:11 . 2001-08-17 12:51 98,080 --a------ c:\windows\SYSTEM32\DLLCACHE\sgiulnt5.sys
2008-12-21 03:11 . 2001-08-17 12:50 68,608 --a------ c:\windows\SYSTEM32\DLLCACHE\sis6306p.sys
2008-12-21 03:11 . 2001-08-17 12:19 36,480 --a------ c:\windows\SYSTEM32\DLLCACHE\sfmanm.sys
2008-12-21 03:11 . 2001-08-17 22:36 26,112 --a------ c:\windows\SYSTEM32\DLLCACHE\EXCH_seos.dll
2008-12-21 03:11 . 2004-08-04 05:00 18,944 --a------ c:\windows\SYSTEM32\DLLCACHE\simptcp.dll
2008-12-21 03:11 . 2001-07-21 14:29 18,400 --a------ c:\windows\SYSTEM32\DLLCACHE\sgsmld.sys
2008-12-21 03:11 . 2001-08-17 13:48 17,664 --a------ c:\windows\SYSTEM32\DLLCACHE\sermouse.sys
2008-12-21 03:11 . 2001-08-17 13:53 6,784 --a------ c:\windows\SYSTEM32\DLLCACHE\serscan.sys
2008-12-21 03:09 . 2001-08-17 14:56 210,496 --a------ c:\windows\SYSTEM32\DLLCACHE\s3mvirge.dll
2008-12-21 03:08 . 2001-08-17 13:28 899,146 --a------ c:\windows\SYSTEM32\DLLCACHE\r2mdkxga.sys
2008-12-21 03:08 . 2001-08-17 13:28 714,762 --a------ c:\windows\SYSTEM32\DLLCACHE\r2mdmkxx.sys
2008-12-21 03:08 . 2001-08-17 22:36 86,097 --a------ c:\windows\SYSTEM32\DLLCACHE\reslog32.dll
2008-12-21 03:08 . 2008-04-13 12:40 79,104 --a------ c:\windows\SYSTEM32\DLLCACHE\rocket.sys
2008-12-21 03:08 . 2001-08-17 22:36 41,472 --a------ c:\windows\SYSTEM32\DLLCACHE\qvusd.dll
2008-12-21 03:08 . 2001-08-17 12:12 37,563 --a------ c:\windows\SYSTEM32\DLLCACHE\rlnet5.sys
2008-12-21 03:08 . 2001-08-17 22:36 23,040 --a------ c:\windows\SYSTEM32\DLLCACHE\EXCH_regtrace.exe
2008-12-21 03:08 . 2001-08-17 13:51 19,584 --a------ c:\windows\SYSTEM32\DLLCACHE\rasirda.sys
2008-12-21 03:08 . 2004-08-04 05:00 14,848 --a------ c:\windows\SYSTEM32\DLLCACHE\register.exe
2008-12-21 03:08 . 2001-08-17 12:19 3,840 --a------ c:\windows\SYSTEM32\DLLCACHE\rpfun.sys
2008-12-21 03:08 . 2001-08-17 13:53 3,328 --a------ c:\windows\SYSTEM32\DLLCACHE\qv2kux.sys
2008-12-21 03:06 . 2008-04-13 18:10 259,328 --a------ c:\windows\SYSTEM32\DLLCACHE\perm3dd.dll
2008-12-21 03:05 . 2001-08-17 14:05 351,616 --a------ c:\windows\SYSTEM32\DLLCACHE\ovcodek2.sys
2008-12-21 03:04 . 2001-08-17 12:50 198,144 --a------ c:\windows\SYSTEM32\DLLCACHE\nv3.sys
2008-12-21 03:04 . 2004-08-03 22:31 132,695 --a------ c:\windows\SYSTEM32\DLLCACHE\netwlan5.sys
2008-12-21 03:04 . 2001-08-17 12:20 126,080 --a------ c:\windows\SYSTEM32\DLLCACHE\nm5a2wdm.sys
2008-12-21 03:04 . 2001-08-17 22:36 123,776 --a------ c:\windows\SYSTEM32\DLLCACHE\nv3.dll
2008-12-21 03:04 . 2001-08-17 12:20 87,040 --a------ c:\windows\SYSTEM32\DLLCACHE\nm6wdm.sys
2008-12-21 03:04 . 2001-08-17 12:20 54,528 --a------ c:\windows\SYSTEM32\DLLCACHE\opl3sax.sys
2008-12-21 03:04 . 2001-08-17 12:49 51,552 --a------ c:\windows\SYSTEM32\DLLCACHE\ntgrip.sys
2008-12-21 03:04 . 2001-08-17 22:36 38,912 --a------ c:\windows\SYSTEM32\DLLCACHE\EXCH_ntfsdrv.dll
2008-12-21 03:04 . 2001-08-17 12:12 32,840 --a------ c:\windows\SYSTEM32\DLLCACHE\ngrpci.sys
2008-12-21 03:04 . 2008-04-13 12:54 28,672 --a------ c:\windows\SYSTEM32\DLLCACHE\nscirda.sys
2008-12-21 03:04 . 2001-08-17 13:47 9,344 --a------ c:\windows\SYSTEM32\DLLCACHE\ntapm.sys
2008-12-21 03:04 . 2001-08-17 13:53 7,552 --a------ c:\windows\SYSTEM32\DLLCACHE\nsmmc.sys
2008-12-21 03:02 . 2004-08-04 05:00 1,875,968 --a------ c:\windows\SYSTEM32\DLLCACHE\msir3jp.lex
2008-12-21 03:02 . 2001-08-17 12:50 103,296 --a------ c:\windows\SYSTEM32\DLLCACHE\mtxvideo.sys
2008-12-21 03:02 . 2004-08-04 05:00 98,304 --a------ c:\windows\SYSTEM32\DLLCACHE\msir3jp.dll
2008-12-21 03:02 . 2008-04-13 12:46 49,024 --a------ c:\windows\SYSTEM32\DLLCACHE\mstape.sys
2008-12-21 03:02 . 2001-08-17 14:02 35,200 --a------ c:\windows\SYSTEM32\DLLCACHE\msgame.sys
2008-12-21 03:02 . 2008-04-13 12:54 22,016 --a------ c:\windows\SYSTEM32\DLLCACHE\msircomm.sys
2008-12-21 03:02 . 2001-08-17 13:48 12,416 --a------ c:\windows\SYSTEM32\DLLCACHE\msriffwv.sys
2008-12-21 03:02 . 2001-08-17 14:00 2,944 --a------ c:\windows\SYSTEM32\DLLCACHE\msmpu401.sys
2008-12-21 03:01 . 2001-08-17 12:50 320,384 --a------ c:\windows\SYSTEM32\DLLCACHE\mgaum.sys
2008-12-21 03:01 . 2001-08-17 14:56 235,648 --a------ c:\windows\SYSTEM32\DLLCACHE\mgaud.dll
2008-12-21 03:01 . 2004-08-04 05:00 92,416 --a------ c:\windows\SYSTEM32\DLLCACHE\mga.sys
2008-12-21 03:01 . 2004-08-04 05:00 92,032 --a------ c:\windows\SYSTEM32\DLLCACHE\mga.dll
2008-12-21 03:01 . 2008-04-13 18:12 56,832 --a------ c:\windows\SYSTEM32\DLLCACHE\msdvbnp.ax
2008-12-21 03:01 . 2008-04-13 12:46 51,200 --a------ c:\windows\SYSTEM32\DLLCACHE\msdv.sys
2008-12-21 03:01 . 2004-08-04 05:00 34,304 --a------ c:\windows\SYSTEM32\DLLCACHE\migisol.exe
2008-12-21 03:01 . 2008-04-13 12:41 26,112 --a------ c:\windows\SYSTEM32\DLLCACHE\memstpci.sys
2008-12-21 03:01 . 2008-04-13 12:46 15,232 --a------ c:\windows\SYSTEM32\DLLCACHE\mpe.sys
2008-12-21 03:01 . 2001-08-17 13:52 6,528 --a------ c:\windows\SYSTEM32\DLLCACHE\miniqic.sys
2008-12-21 03:01 . 2001-08-17 13:48 6,016 --a------ c:\windows\SYSTEM32\DLLCACHE\msfsio.sys
2008-12-21 02:59 . 2004-08-04 05:00 1,158,818 --a------ c:\windows\SYSTEM32\DLLCACHE\korwbrkr.lex
2008-12-21 02:58 . 2004-08-04 05:00 471,102 --a------ c:\windows\SYSTEM32\DLLCACHE\imskdic.dll
2008-12-21 02:57 . 2001-08-17 22:36 372,824 --a------ c:\windows\SYSTEM32\DLLCACHE\iconf32.dll
2008-12-21 02:56 . 2004-08-04 05:00 10,129,408 --a------ c:\windows\SYSTEM32\DLLCACHE\hwxkor.dll
2008-12-21 02:55 . 2001-08-17 22:36 324,608 --a------ c:\windows\SYSTEM32\DLLCACHE\hpojwia.dll
2008-12-21 02:54 . 2001-08-17 14:56 1,733,120 --a------ c:\windows\SYSTEM32\DLLCACHE\g400d.dll
2008-12-21 02:53 . 2001-08-17 13:28 595,647 --a------ c:\windows\SYSTEM32\DLLCACHE\es56cvmp.sys
2008-12-21 02:52 . 2001-08-17 13:28 634,134 --a------ c:\windows\SYSTEM32\DLLCACHE\el656ct5.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-21 17:54 292,352 ----a-w c:\windows\SYSTEM32\mlJAsRHy.dll
2008-12-21 06:27 --------- d-----w c:\program files\McAfee
2008-12-21 06:04 --------- d-----w c:\program files\Java
2008-12-20 23:17 --------- d-----w c:\documents and settings\LocalService\Application Data\SACore
2008-12-13 06:40 3,593,216 ----a-w c:\windows\SYSTEM32\DLLCACHE\mshtml.dll
2008-12-13 03:41 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2008-12-13 03:41 --------- d-----w c:\program files\Shockwave.com
2008-12-12 09:05 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2008-12-10 04:15 31 ----a-w c:\documents and settings\Zachary\jagex_runescape_preferences.dat
2008-12-06 14:06 --------- d-----w c:\program files\Apple Software Update
2008-12-06 14:05 --------- d-----w c:\program files\iPod
2008-12-06 14:05 --------- d-----w c:\program files\Common Files\Apple
2008-12-06 13:52 --------- d-----w c:\program files\Safari
2008-12-05 17:09 --------- d-----w c:\documents and settings\Stan\Application Data\AdobeUM
2008-11-16 03:25 --------- d-----w c:\documents and settings\All Users\Application Data\McAfee
2008-11-16 02:32 --------- d-----w c:\program files\Real
2008-11-16 02:32 --------- d-----w c:\program files\Common Files\Real
2008-11-16 02:19 --------- d-----w c:\program files\MSN Messenger
2008-11-16 02:19 --------- d-----w c:\program files\Messenger Plus! Live
2008-11-16 02:18 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-16 02:10 --------- d-----w c:\program files\Microsoft Visual Studio 9.0
2008-11-16 01:39 --------- d-----w c:\program files\Google
2008-11-09 18:27 --------- d-----w c:\documents and settings\NetworkService\Application Data\SACore
2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-24 11:21 455,296 ----a-w c:\windows\SYSTEM32\DLLCACHE\mrxsmb.sys
2008-10-23 12:36 286,720 ----a-w c:\windows\SYSTEM32\gdi32.dll
2008-10-23 12:36 286,720 ----a-w c:\windows\SYSTEM32\DLLCACHE\gdi32.dll
2008-10-22 17:27 --------- d-----w c:\program files\Microsoft Silverlight
2008-10-21 02:01 --------- d-----w c:\documents and settings\Doris\Application Data\AdobeUM
2008-10-16 20:13 202,776 ----a-w c:\windows\SYSTEM32\wuweb.dll
2008-10-16 20:13 202,776 ----a-w c:\windows\SYSTEM32\DLLCACHE\wuweb.dll
2008-10-16 20:13 1,809,944 ----a-w c:\windows\SYSTEM32\wuaueng.dll
2008-10-16 20:13 1,809,944 ----a-w c:\windows\SYSTEM32\DLLCACHE\wuaueng.dll
2008-10-16 20:12 561,688 ----a-w c:\windows\SYSTEM32\wuapi.dll
2008-10-16 20:12 561,688 ----a-w c:\windows\SYSTEM32\DLLCACHE\wuapi.dll
2008-10-16 20:12 323,608 ----a-w c:\windows\SYSTEM32\wucltui.dll
2008-10-16 20:12 323,608 ----a-w c:\windows\SYSTEM32\DLLCACHE\wucltui.dll
2008-10-16 20:09 92,696 ----a-w c:\windows\SYSTEM32\DLLCACHE\cdm.dll
2008-10-16 20:09 92,696 ----a-w c:\windows\SYSTEM32\cdm.dll
2008-10-16 20:09 51,224 ----a-w c:\windows\SYSTEM32\wuauclt.exe
2008-10-16 20:09 51,224 ----a-w c:\windows\SYSTEM32\DLLCACHE\wuauclt.exe
2008-10-16 20:09 43,544 ----a-w c:\windows\SYSTEM32\wups2.dll
2008-10-16 20:08 34,328 ----a-w c:\windows\SYSTEM32\wups.dll
2008-10-16 20:08 34,328 ----a-w c:\windows\SYSTEM32\DLLCACHE\wups.dll
2008-10-16 20:06 268,648 ----a-w c:\windows\SYSTEM32\mucltui.dll
2008-10-16 20:06 208,744 ----a-w c:\windows\SYSTEM32\muweb.dll
2008-10-16 13:11 70,656 ----a-w c:\windows\SYSTEM32\DLLCACHE\ie4uinit.exe
2008-10-16 13:11 13,824 ------w c:\windows\SYSTEM32\DLLCACHE\ieudinit.exe
2008-10-15 16:34 337,408 ----a-w c:\windows\SYSTEM32\DLLCACHE\netapi32.dll
2008-10-15 07:06 633,632 ----a-w c:\windows\SYSTEM32\DLLCACHE\iexplore.exe
2008-10-15 07:04 161,792 ----a-w c:\windows\SYSTEM32\DLLCACHE\ieakui.dll
2008-10-03 10:02 247,326 ----a-w c:\windows\SYSTEM32\strmdll.dll
2008-10-03 10:02 247,326 ----a-w c:\windows\SYSTEM32\DLLCACHE\strmdll.dll
2008-09-30 22:43 1,286,152 ----a-w c:\windows\SYSTEM32\msxml4.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0E5632CD-EEC2-4E72-A2B3-2A85C254D21D}]
2008-12-21 11:54 292352 --a------ c:\windows\system32\mlJAsRHy.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{56292c6b-f4aa-4bcb-8ed7-17ae963b885c}]
2008-12-21 11:55 135680 --a------ c:\windows\system32\zfavtw.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C}]
2008-12-20 23:16 57856 --a------ c:\windows\system32\opnnnLCv.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LDM"="c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2007-02-26 67128]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2004-01-07 110592]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-21 136600]
"MMTray"="c:\program files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe" [2004-04-19 131072]
"Microsoft Works Update Detection"="c:\program files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2003-06-03 50688]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2007-11-01 582992]
"LVCOMS"="c:\program files\Common Files\Logitech\QCDriver3\LVCOMS.EXE" [2002-12-10 127022]
"LogitechImageStudioTray"="c:\program files\Logitech\ImageStudio\LogiTray.exe" [2002-12-10 61440]
"LogitechGalleryRepair"="c:\program files\Logitech\ImageStudio\ISStart.exe" [2002-12-10 155648]
"IntelMeM"="c:\program files\Intel\Modem Event Monitor\IntelMEM.exe" [2003-09-03 221184]
"IAAnotif"="c:\program files\Intel\Intel Application Accelerator\iaanotif.exe" [2004-03-23 135168]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-16 49152]
"HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2005-01-12 241664]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-08-23 57344]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-08-13 122939]
"CTSysVol"="c:\program files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe" [2003-09-17 57344]
"CTDVDDET"="c:\program files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDET.EXE" [2003-06-18 45056]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-08-25 339968]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2008-12-21 1261336]
"94685161"="c:\windows\system32\hhxxwqna.dll" [2008-12-21 95744]
"CTHelper"="CTHELPER.EXE" [2004-03-11 c:\windows\SYSTEM32\CTHELPER.EXE]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-05-28 241664]
HP Image Zone Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2004-05-28 53248]
Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-02-26 67128]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C}"= "c:\windows\system32\opnnnLCv.dll" [2008-12-20 57856]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\opnnnLCv]
2008-12-20 23:16 57856 c:\windows\SYSTEM32\opnnnLCv.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=xcztqx.dll,avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.mxmc"= MimicICM.DLL

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 c:\windows\system32\mlJAsRHy

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Documents and Settings\\All Users\\Documents\\LimeWire\\LimeWire.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"c:\\StubInstaller.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"6881:TCP"= 6881:TCP:Blizzard Downloader: 6881
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2008-12-21 97928]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-12-21 231704]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;"c:\program files\McAfee\SiteAdvisor\McSACore.exe" [2008-09-29 206096]
S2 0313821229840921mcinstcleanup;McAfee Application Installer Cleanup (0313821229840921);c:\docume~1\Doris\LOCALS~1\Temp\031382~1.EXE c:\progra~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service []
S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;"c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE" [2008-07-10 47128]
S4 RsFx0102;RsFx0102 Driver;c:\windows\system32\DRIVERS\RsFx0102.sys [2008-07-10 242712]
S4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);"c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE" -i SQLEXPRESS [2008-07-10 369688]
.
Contents of the 'Scheduled Tasks' folder

2008-12-19 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]

2008-12-21 c:\windows\Tasks\At1.job
- c:\windows\system32\nULMi2Wy.exe [2008-12-20 22:56]

2008-12-21 c:\windows\Tasks\At10.job
- c:\windows\system32\nULMi2Wy.exe [2008-12-20 22:56]

2008-12-21 c:\windows\Tasks\At11.job
- c:\windows\system32\nULMi2Wy.exe [2008-12-20 22:56]

2008-12-21 c:\windows\Tasks\At12.job
- c:\windows\system32\nULMi2Wy.exe [2008-12-20 22:56]

2008-12-21 c:\windows\Tasks\At13.job
- c:\windows\system32\nULMi2Wy.exe [2008-12-20 22:56]

2008-12-21 c:\windows\Tasks\At14.job
- c:\windows\system32\nULMi2Wy.exe [2008-12-20 22:56]

2008-12-21 c:\windows\Tasks\At15.job
- c:\windows\system32\nULMi2Wy.exe [2008-12-20 22:56]

2008-12-21 c:\windows\Tasks\At16.job
- c:\windows\system32\nULMi2Wy.exe [2008-12-20 22:56]

2008-12-21 c:\windows\Tasks\At17.job
- c:\windows\system32\nULMi2Wy.exe [2008-12-20 22:56]

2008-12-21 c:\windows\Tasks\At18.job
- c:\windows\system32\nULMi2Wy.exe [2008-12-20 22:56]

2008-12-21 c:\windows\Tasks\At19.job
- c:\windows\system32\nULMi2Wy.exe [2008-12-20 22:56]

2008-12-21 c:\windows\Tasks\At2.job
- c:\windows\system32\nULMi2Wy.exe [2008-12-20 22:56]

2008-12-21 c:\windows\Tasks\At20.job
- c:\windows\system32\nULMi2Wy.exe [2008-12-20 22:56]

2008-12-21 c:\windows\Tasks\At21.job
- c:\windows\system32\nULMi2Wy.exe [2008-12-20 22:56]

2008-12-21 c:\windows\Tasks\At22.job
- c:\windows\system32\nULMi2Wy.exe [2008-12-20 22:56]

2008-12-21 c:\windows\Tasks\At23.job
- c:\windows\system32\nULMi2Wy.exe [2008-12-20 22:56]

2008-12-21 c:\windows\Tasks\At24.job
- c:\windows\system32\nULMi2Wy.exe [2008-12-20 22:56]

2008-12-21 c:\windows\Tasks\At3.job
- c:\windows\system32\nULMi2Wy.exe [2008-12-20 22:56]

2008-12-21 c:\windows\Tasks\At4.job
- c:\windows\system32\nULMi2Wy.exe [2008-12-20 22:56]

2008-12-21 c:\windows\Tasks\At5.job
- c:\windows\system32\nULMi2Wy.exe [2008-12-20 22:56]

2008-12-21 c:\windows\Tasks\At6.job
- c:\windows\system32\nULMi2Wy.exe [2008-12-20 22:56]

2008-12-21 c:\windows\Tasks\At7.job
- c:\windows\system32\nULMi2Wy.exe [2008-12-20 22:56]

2008-12-21 c:\windows\Tasks\At8.job
- c:\windows\system32\nULMi2Wy.exe [2008-12-20 22:56]

2008-12-21 c:\windows\Tasks\At9.job
- c:\windows\system32\nULMi2Wy.exe [2008-12-20 22:56]

2008-12-21 c:\windows\Tasks\ecjpzddy.job
- c:\windows\system32\rundll32.exe [2008-04-13 18:12]

2008-12-15 c:\windows\Tasks\McDefragTask.job
- c:\program files\mcafee\mqc\QcConsol.exe [2007-12-04 13:32]

2008-12-01 c:\windows\Tasks\McQcTask.job
- c:\program files\mcafee\mqc\QcConsol.exe [2007-12-04 13:32]

2008-12-21 c:\windows\Tasks\vsyfuwvk.job
- c:\windows\system32\rundll32.exe [2008-04-13 18:12]
.
- - - - ORPHANS REMOVED - - - -

BHO-{9569F869-BD11-42CE-BA06-CA303DE13202} - c:\windows\system32\efcYSlJC.dll
HKCU-Run-prunnet - c:\windows\system32\prunnet.exe
HKLM-Run-PCMService - c:\program files\Dell\Media Experience\PCMService.exe
HKLM-Run-bitslistdebugadmin - c:\documents and settings\All Users\Application Data\Pilecompbitslist\Ford Tons.exe
HKLM-Run-prunnet - c:\windows\system32\prunnet.exe


.
------- Supplementary Scan -------
.
uInternet Settings,ProxyOverride = localhost
uSearchURL,(Default) = hxxp://ca.search.yahoo.com/search?fr=mcafee&p=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
FF - ProfilePath - c:\documents and settings\Doris\Application Data\Mozilla\Firefox\Profiles\xukjw8zt.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://start.mozilla.org/firefox?client=firefox-a&rls=org.mozilla:en-US:official
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - component: c:\program files\McAfee\SiteAdvisor\components\McFFPlg.dll
FF - plugin: c:\program files\Microsoft Silverlight\2.0.31005.0\npctrl.1.0.30716.0.dll
FF - plugin: c:\program files\Microsoft Silverlight\2.0.31005.0\npctrl.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll

ATTENTION: FIREFOX POLICES IS IN FORCE
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("general.useragent.vendorComment", "ax");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("security.xpconnect.activex.global.hosting_flags", 9);
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("security.classID.allowByDefault", false);
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID6BF52A52-394A-11D3-B153-00C04F79FAA6", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID22D6F312-B0F6-11D0-94AB-0080C74C7E95", "AllAccess");
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-21 11:47:57
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


c:\windows\TEMP\mcafee_0t7JNVVjzHrdfex 0 bytes

scan completed successfully
hidden files: 1

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(720)
c:\windows\system32\opnnnLCv.dll

- - - - - - - > 'explorer.exe'(2932)
c:\program files\McAfee\SiteAdvisor\saHook.dll
c:\windows\system32\hhxxwqna.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\SYSTEM32\ati2evxx.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\SYSTEM32\CTSVCCDA.EXE
c:\program files\Intel\Intel Application Accelerator\IAANTmon.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\progra~1\McAfee\MSC\mcmscsvc.exe
c:\program files\Common Files\McAfee\MNA\McNASvc.exe
c:\progra~1\COMMON~1\McAfee\McProxy\McProxy.exe
c:\progra~1\McAfee\VIRUSS~1\Mcshield.exe
c:\windows\SYSTEM32\HPZipm12.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\progra~1\McAfee\VIRUSS~1\mcsysmon.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\HP\Digital Imaging\bin\hpqgalry.exe
c:\program files\McAfee\MPF\MpfSrv.exe
c:\windows\SYSTEM32\msiexec.exe
c:\program files\AVG\AVG8\avgrsx.exe
c:\program files\AVG\AVG8\avgrsx.exe
c:\program files\AVG\AVG8\avgrsx.exe
.
**************************************************************************
.
Completion time: 2008-12-21 11:59:26 - machine was rebooted [Doris]
ComboFix-quarantined-files.txt 2008-12-21 17:59:09

Pre-Run: 206,697,304,064 bytes free
Post-Run: 208,577,667,072 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

442 --- E O F --- 2008-12-18 09:00:56

Hello.

I see you have Viewpoint Manager installed, this is considered as foistware instead of malware since it is installed without users approval but doesn't spy or do anything "bad". Read this article: http://www.clickz.com/news/article.php/3561546

Additional info: http://vil.nai.com/vil/content/v_137262.htm

I suggest you remove the program now.

Go to Start > Control Panel > Add/Remove Programs and remove the following programs if present.

• Viewpoint
  
• Viewpoint Manager
  
• Viewpoint Media Player
  
• Viewpoint Toolbar
  
• Mcafee Anti-virus <== Will explain below
  

You are also running two AV's (Anti-virus), Mcafee and AVG8. Running two AV's is a bad idea, they will conflict and cause more problems for you, so uninstall Mcafee also.


Now open a new notepad file.
Input this into the notepad file:

KILLALL::

Driver::
0313821229840921mcinstcleanup

File::
C:\sqmdata10.sqm
C:\sqmnoopt10.sqm
c:\windows\SYSTEM32\mlJAsRHy.dll
c:\windows\system32\zfavtw.dll
c:\windows\system32\opnnnLCv.dll
c:\windows\system32\hhxxwqna.dll
c:\windows\system32\nULMi2Wy.exe
c:\windows\Tasks\vsyfuwvk.job
c:\windows\Tasks\At1.job
c:\windows\Tasks\At2.job
c:\windows\Tasks\At3.job
c:\windows\Tasks\At4.job
c:\windows\Tasks\At5.job
c:\windows\Tasks\At6.job
c:\windows\Tasks\At7.job
c:\windows\Tasks\At8.job
c:\windows\Tasks\At9.job
c:\windows\Tasks\At10.job
c:\windows\Tasks\At11.job
c:\windows\Tasks\At12.job
c:\windows\Tasks\At13.job
c:\windows\Tasks\At14.job
c:\windows\Tasks\At15.job
c:\windows\Tasks\At16.job
c:\windows\Tasks\At17.job
c:\windows\Tasks\At18.job
c:\windows\Tasks\At19.job
c:\windows\Tasks\At20.job
c:\windows\Tasks\At21.job
c:\windows\Tasks\At22.job
c:\windows\Tasks\At23.job
c:\windows\Tasks\At24.job
c:\windows\Tasks\McDefragTask.job
c:\windows\Tasks\McQcTask.job

Folder::
c:\program files\Viewpoint
c:\documents and settings\All Users\Application Data\McAfee
c:\program files\McAfee.com
c:\program files\mcafee

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0E5632CD-EEC2-4E72-A2B3-2A85C254D21D}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{56292c6b-f4aa-4bcb-8ed7-17ae963b885c}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"94685161"=-
"mcagent_exe"=-
[-hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\opnnnLCv]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=""
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"="msv1_0"

Save this as CFscript.txt, save it to your desktop also.
Then drag and drop CFscript.txt into combofix as seen below:


This will open combofix.exe again, agree to it's terms and allow it to run, it may want to reboot after it's done. Post the resulting log back here.

Due to lack of feedback, this topic is closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter.

Everyone else, please open a new topic for your questions.