HijackThis Log: Please help Diagnose

I am unable install any AV or access any AV sites and microsoft sites of online help. I am using a 32 bit Vista machine. this is the HijackThis log


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:02:49, on 02-09-2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18813)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\IDT\WDM\sttray.exe
C:\Program Files\Hewlett-Packard\Media\DVD\DVDAgent.exe
C:\Program Files\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe
C:\Program Files\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe
C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe
C:\Program Files\DigitalPersona\Bin\DpAgent.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\Media\TV\TVAgent.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Windows\vkl_1251893498
C:\Users\chsmanideep\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\DllHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...ion&pf=cnnb
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O1 - Hosts: ::1 localhost
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: AOL Toolbar BHO - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [SysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe
O4 - HKLM\..\Run: [DVDAgent] "C:\Program Files\Hewlett-Packard\Media\DVD\DVDAgent.exe"
O4 - HKLM\..\Run: [TSMAgent] "C:\Program Files\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe"
O4 - HKLM\..\Run: [CLMLServer for HP TouchSmart] "C:\Program Files\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe"
O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\Hewlett-Packard\Media\Webcam" update "Software\Hewlett-Packard\Media\Webcam"
O4 - HKLM\..\Run: [SmartMenu] %ProgramFiles%\Hewlett-Packard\HP MediaSmart\SmartMenu.exe
O4 - HKLM\..\Run: [UpdateLBPShortCut] "C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\LabelPrint" UpdateWithCreateOnce "Software\CyberLink\LabelPrint\2.5"
O4 - HKLM\..\Run: [UpdatePSTShortCut] "C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\DVD Suite" UpdateWithCreateOnce "Software\CyberLink\PowerStarter"
O4 - HKLM\..\Run: [DpAgent] C:\Program Files\DigitalPersona\Bin\dpagent.exe
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [QlbCtrl.exe] C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [UpdateP2GoShortCut] "C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0"
O4 - HKLM\..\Run: [UpdatePDIRShortCut] "C:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\PowerDirector" UpdateWithCreateOnce "SOFTWARE\CyberLink\PowerDirector\7.0"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [TVAgent] "C:\Program Files\Hewlett-Packard\Media\TV\TVAgent.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [sysldtray] c:\windows\ld14.exe
O4 - HKLM\..\Run: [OneCareUI] "C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe"
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [cdloader] "C:\Users\chsmanideep\AppData\Roaming\mjusbsp\cdloader2.exe" MAGICJACK
O4 - HKCU\..\Run: [Google Update] "C:\Users\chsmanideep\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [Cognac] C:\Users\CHSMAN~1\AppData\Local\Temp\d.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [] (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [] (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [] (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [] (User 'Default user')
O4 - Global Startup: Bluetooth.lnk = ?
O8 - Extra context menu item: &AOL Toolbar Search - C:\ProgramData\AOL\ieToolbar\resources\en-IN\local\search.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send image to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Send page to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O13 - Gopher Prefix:
O17 - HKLM\System\CCS\Services\Tcpip\..\{D8B7E2B3-24EF-43E9-B3D9-075F7D938DD8}: NameServer = 10.0.0.1
O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_e7ea6efc\aestsrv.exe
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: Com4QLBEx - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
O23 - Service: Darkness - Unknown owner - C:\Windows\system\svchost.exe
O23 - Service: @C:\Program Files\DigitalPersona\Bin\DpHostW.exe,-128 (DpHost) - DigitalPersona, Inc. - C:\Program Files\DigitalPersona\Bin\DpHostW.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: HP Service (hpsrv) - Hewlett-Packard Corporation - C:\Windows\system32\Hpservice.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Windows Live OneCare Health Monitor (OcHealthMon) - Unknown owner - C:\Program Files\Microsoft Windows OneCare Live\OcHealthMon.exe (file missing)
O23 - Service: OneCare AntiSpyware and AntiVirus (OneCareMP) - Unknown owner - C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MsMpEng.exe (file missing)
O23 - Service: Recovery Service for Windows - Unknown owner - C:\Program Files\SMINST\BLService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: Audio Service (STacSV) - IDT, Inc. - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_e7ea6efc\STacSV.exe
O23 - Service: TV Background Capture Service (TVBCS) (TVCapSvc) - Unknown owner - C:\Program Files\Hewlett-Packard\Media\TV\Kernel\TV\TVCapSvc.exe
O23 - Service: TV Task Scheduler (TVTS) (TVSched) - Unknown owner - C:\Program Files\Hewlett-Packard\Media\TV\Kernel\TV\TVSched.exe
O23 - Service: Validity Fingerprint Service (vfsFPService) - Validity Sensors, Inc. - C:\Windows\system32\vfsFPService.exe
O23 - Service: Windows Live OneCare (winss) - Unknown owner - C:\Program Files\Microsoft Windows OneCare Live\winss.exe (file missing)

--
End of file - 12278 bytes

please help me

please help ... my laptop is getting slow ...

This is my combofix log... please help me



ComboFix 09-01-21.02 - chsmanideep 2009-09-02 23:21:38.1 - NTFSx86
Microsoft® Windows Vistaâ„¢ Home Basic 6.0.6001.1.1252.1.1033.18.3035.1637 [GMT 5.5:30]
Running from: c:\users\chsmanideep\Desktop\Fix.exe
* Created a new restore point
.
- REDUCED FUNCTIONALITY MODE -
.

((((((((((((((((((((((((( Files Created from 2009-08-02 to 2009-09-02 )))))))))))))))))))))))))))))))
.

2009-09-02 22:20 . 2004-08-04 08:00 506,368 --a------ c:\windows\System32\msxml.dll
2009-09-02 22:08 . 2009-09-02 22:08 <DIR> d-------- c:\users\chsmanideep\AppData\Roaming\Malwarebytes
2009-09-02 22:08 . 2009-09-02 22:08 <DIR> d-------- c:\users\CHSMAN~1\AppData\Roaming\Malwarebytes
2009-09-02 22:08 . 2009-08-03 13:36 38,160 --a------ c:\windows\System32\drivers\mbamswissarmy.sys
2009-09-02 22:07 . 2009-09-02 22:07 <DIR> d-------- c:\users\All Users\Malwarebytes
2009-09-02 22:07 . 2009-09-02 22:08 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-09-02 22:07 . 2009-09-02 22:07 <DIR> d-------- c:\progra~2\Malwarebytes
2009-09-02 22:07 . 2009-08-03 13:36 19,096 --a------ c:\windows\System32\drivers\mbam.sys
2009-09-02 20:04 . 2009-09-02 21:02 <DIR> d-------- c:\users\chsmanideep\AppData\Roaming\BitDefender Deployment Tool
2009-09-02 20:04 . 2009-09-02 21:02 <DIR> d-------- c:\users\CHSMAN~1\AppData\Roaming\BitDefender Deployment Tool
2009-09-02 19:27 . 2009-09-02 19:27 <DIR> d-------- c:\users\chsmanideep\AppData\Roaming\Simply Super Software
2009-09-02 19:27 . 2009-09-02 19:27 <DIR> d-------- c:\users\CHSMAN~1\AppData\Roaming\Simply Super Software
2009-09-02 17:55 . 2009-09-02 17:55 <DIR> d-------- c:\program files\Trend Micro
2009-09-02 14:25 . 2009-09-02 14:25 <DIR> d-------- c:\program files\Common Files\PX Storage Engine
2009-09-02 14:24 . 2009-09-02 14:24 <DIR> d----c--- c:\windows\System32\DRVSTORE
2009-09-02 14:24 . 2008-05-15 16:15 53,168 --a------ c:\windows\System32\drivers\MpFilter.sys
2009-09-02 00:49 . 2009-09-02 00:49 128 --a------ c:\windows\System32\drivers\kmxzone.u2k1
2009-09-02 00:49 . 2009-09-02 00:49 128 --a------ c:\windows\System32\drivers\kmxzone.u2k0
2009-09-02 00:49 . 2009-09-02 00:49 28 --a------ c:\windows\System32\drivers\kmxzone.u2k7
2009-09-02 00:49 . 2009-09-02 00:49 28 --a------ c:\windows\System32\drivers\kmxzone.u2k6
2009-09-02 00:49 . 2009-09-02 00:49 28 --a------ c:\windows\System32\drivers\kmxzone.u2k5
2009-09-02 00:49 . 2009-09-02 00:49 28 --a------ c:\windows\System32\drivers\kmxzone.u2k4
2009-09-02 00:49 . 2009-09-02 00:49 28 --a------ c:\windows\System32\drivers\kmxzone.u2k3
2009-09-02 00:49 . 2009-09-02 00:49 28 --a------ c:\windows\System32\drivers\kmxzone.u2k2
2009-09-02 00:44 . 2009-09-02 00:44 <DIR> d-------- c:\windows\rnapxs
2009-09-02 00:38 . 2009-09-02 00:38 <DIR> d-------- c:\users\All Users\Logs
2009-09-02 00:38 . 2009-09-02 00:38 <DIR> d-------- c:\progra~2\Logs
2009-09-01 13:29 . 2009-09-01 13:32 <DIR> d-------- C:\f0ba96b0d6a4d10ffd
2009-08-31 23:22 . 2009-08-31 23:22 <DIR> d-------- c:\program files\DDnsFilter
2009-08-31 23:22 . 2009-08-31 23:22 37,760 --a------ c:\windows\System32\drivers\Filter.sys
2009-08-31 23:20 . 2009-08-31 23:20 2 --a------ c:\windows\010112010146101105.te
2009-08-31 22:52 . 2009-08-31 22:52 <DIR> d--hs---- c:\windows\System32\%APPDATA%
2009-08-31 22:30 . 2009-08-31 23:59 <DIR> d-------- c:\users\All Users\avg8
2009-08-31 22:30 . 2009-08-31 22:30 <DIR> d-------- c:\program files\AVG
2009-08-31 22:30 . 2009-08-31 23:59 <DIR> d-------- c:\progra~2\avg8
2009-08-26 19:33 . 2009-06-22 15:52 2,048 --a------ c:\windows\System32\tzres.dll
2009-08-26 19:32 . 2009-06-05 18:04 28,672 --a------ c:\windows\System32\Apphlpdm.dll
2009-08-26 19:31 . 2009-06-05 15:38 4,240,384 --a------ c:\windows\System32\GameUXLegacyGDFs.dll
2009-08-26 19:09 . 2009-08-26 19:12 <DIR> d-------- c:\users\chsmanideep\AppData\Roaming\SSH
2009-08-26 19:09 . 2009-08-26 19:12 <DIR> d-------- c:\users\CHSMAN~1\AppData\Roaming\SSH
2009-08-26 19:07 . 2009-08-26 19:07 <DIR> d-------- c:\program files\SSH Communications Security
2009-08-19 16:22 . 2009-08-19 16:22 <DIR> d-------- c:\program files\Force 2.0
2009-08-18 11:36 . 2009-08-18 11:36 <DIR> d-------- c:\users\All Users\WindowsSearch
2009-08-18 11:36 . 2009-08-18 11:36 <DIR> d-------- c:\progra~2\WindowsSearch
2009-08-12 11:52 . 2009-06-10 17:42 160,256 --a------ c:\windows\System32\wkssvc.dll
2009-08-12 11:45 . 2009-07-17 20:05 71,680 --a------ c:\windows\System32\atl.dll
2009-08-12 11:35 . 2009-06-04 18:04 2,066,432 --a------ c:\windows\System32\mstscax.dll
2009-08-12 11:35 . 2009-06-15 20:53 1,256,448 --a------ c:\windows\System32\lsasrv.dll
2009-08-12 11:35 . 2009-06-15 20:51 499,712 --a------ c:\windows\System32\kerberos.dll
2009-08-12 11:35 . 2009-06-15 23:50 439,896 --a------ c:\windows\System32\drivers\ksecdd.sys
2009-08-12 11:35 . 2009-06-15 20:54 270,848 --a------ c:\windows\System32\schannel.dll
2009-08-12 11:35 . 2009-06-15 20:52 213,504 --a------ c:\windows\System32\msv1_0.dll
2009-08-12 11:35 . 2009-06-15 20:54 175,104 --a------ c:\windows\System32\wdigest.dll
2009-08-12 11:35 . 2009-06-10 17:37 91,136 --a------ c:\windows\System32\avifil32.dll
2009-08-12 11:35 . 2009-06-15 20:54 72,704 --a------ c:\windows\System32\secur32.dll
2009-08-12 11:35 . 2009-06-15 18:27 9,728 --a------ c:\windows\System32\lsass.exe
2009-08-12 11:34 . 2009-07-14 16:29 8,147,456 --a------ c:\windows\System32\wmploc.DLL
2009-08-12 11:34 . 2009-07-14 18:30 313,344 --a------ c:\windows\System32\wmpdxm.dll
2009-08-12 11:34 . 2009-07-14 14:00 43,520 --a------ c:\windows\System32\msdxm.tlb
2009-08-12 11:34 . 2009-07-14 14:00 18,432 --a------ c:\windows\System32\amcompat.tlb
2009-08-12 11:34 . 2009-07-14 18:28 7,680 --a------ c:\windows\System32\spwmp.dll
2009-08-12 11:34 . 2009-07-14 18:29 4,096 --a------ c:\windows\System32\msdxm.ocx
2009-08-12 11:34 . 2009-07-14 18:29 4,096 --a------ c:\windows\System32\dxmasf.dll
2009-08-11 17:06 . 2009-08-11 17:06 <DIR> d-------- C:\W30C6F14

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-02 16:55 --------- d---a-w c:\progra~2\Temp
2009-09-02 14:17 --------- d-----w c:\users\chsmanideep\AppData\Roaming\mjusbsp
2009-09-02 14:17 --------- d-----w c:\users\CHSMAN~1\AppData\Roaming\mjusbsp
2009-09-01 20:17 --------- d-----w c:\progra~2\Symantec
2009-08-31 16:55 --------- d-----w c:\progra~2\Norton
2009-08-26 13:37 --------- d--h--w c:\program files\InstallShield Installation Information
2009-08-26 13:36 --------- d-----w c:\program files\Common Files\InstallShield
2009-08-12 12:03 --------- d-----w c:\program files\Windows Mail
2009-08-10 15:02 --------- d-----w c:\users\chsmanideep\AppData\Roaming\Hewlett-Packard
2009-08-10 15:02 --------- d-----w c:\users\CHSMAN~1\AppData\Roaming\Hewlett-Packard
2009-08-10 15:01 --------- d-----w c:\progra~2\Hewlett-Packard
2009-07-28 21:24 --------- d-----w c:\users\chsmanideep\AppData\Roaming\GTek
2009-07-28 21:24 --------- d-----w c:\users\CHSMAN~1\AppData\Roaming\GTek
2009-07-27 13:34 --------- d-----w c:\program files\Common Files\Adobe
2009-07-21 21:52 915,456 ----a-w c:\windows\System32\wininet.dll
2009-07-21 21:47 71,680 ----a-w c:\windows\System32\iesetup.dll
2009-07-21 21:47 109,056 ----a-w c:\windows\System32\iesysprep.dll
2009-07-21 20:13 153,600 ----a-w c:\windows\System32\ieUnatt.exe
2009-07-20 14:20 --------- d-----w c:\progra~2\WildTangent
2009-07-16 13:10 --------- d-----w c:\users\chsmanideep\AppData\Roaming\PeerNetworking
2009-07-16 13:10 --------- d-----w c:\users\CHSMAN~1\AppData\Roaming\PeerNetworking
2009-07-14 08:55 --------- d-----w c:\program files\Microsoft SQL Server
2009-07-13 16:59 --------- d-----w c:\program files\Microsoft Small Business
2009-07-13 12:01 --------- d-----w c:\program files\Softland
2009-07-13 11:32 --------- d-----w c:\program files\gfortran
2009-07-13 11:19 --------- d-----w c:\users\chsmanideep\AppData\Roaming\vlc
2009-07-13 11:19 --------- d-----w c:\users\CHSMAN~1\AppData\Roaming\vlc
2009-07-13 11:14 --------- d-----w c:\program files\VideoLAN
2009-07-13 08:55 --------- d-----w c:\progra~2\A-PDF
2009-07-12 14:20 --------- d-----w c:\program files\Microsoft ActiveSync
2009-07-12 14:19 --------- d-----w c:\progra~2\{174892B1-CBE7-44F5-86FF-AB555EFD73A3}
2009-07-12 14:16 --------- d-----w c:\progra~2\Microsoft Help
2009-07-10 18:00 --------- d-----w c:\progra~2\CyberLink
2009-07-04 06:42 --------- d-----w c:\progra~2\Yahoo! Companion
2009-07-03 19:15 --------- d-----w c:\program files\Yahoo!
2009-07-03 19:11 --------- d-----w c:\progra~2\Yahoo!
2009-07-03 17:16 --------- d-----w c:\users\chsmanideep\AppData\Roaming\CyberLink
2009-07-03 17:16 --------- d-----w c:\users\CHSMAN~1\AppData\Roaming\CyberLink
2009-07-03 12:37 --------- d-----w c:\users\chsmanideep\AppData\Roaming\PlayFirst
2009-07-03 12:37 --------- d-----w c:\users\CHSMAN~1\AppData\Roaming\PlayFirst
2009-07-03 12:37 --------- d-----w c:\progra~2\PlayFirst
2009-07-03 05:46 --------- d-----w c:\program files\MSXML 4.0
2009-07-02 18:00 --------- d-----w c:\users\chsmanideep\AppData\Roaming\funkitron
2009-07-02 18:00 --------- d-----w c:\users\CHSMAN~1\AppData\Roaming\funkitron
2009-07-02 17:59 --------- d-----w c:\users\chsmanideep\AppData\Roaming\WildTangent
2009-07-02 17:59 --------- d-----w c:\users\CHSMAN~1\AppData\Roaming\WildTangent
2009-07-02 10:40 --------- d-----w c:\users\chsmanideep\AppData\Roaming\FloodLightGames
2009-07-02 10:40 --------- d-----w c:\users\CHSMAN~1\AppData\Roaming\FloodLightGames
2009-07-02 10:40 --------- d-----w c:\progra~2\FloodLightGames
2009-06-30 09:06 18,696 ----a-w c:\windows\Help\OEM\scripts\HC_BatteryReplaceNew.exe
2009-06-30 08:40 18,696 ----a-w c:\windows\Help\OEM\scripts\HC_BatteryNoTravel.exe
2009-06-30 08:33 18,696 ----a-w c:\windows\Help\OEM\scripts\HC_BatteryAccessories.exe
2009-06-30 06:14 18,184 ----a-w c:\windows\Help\OEM\scripts\HC_BatteryWeakNew.exe
2009-06-26 12:06 18,184 ----a-w c:\windows\Help\OEM\scripts\HC_BatteryUpgrade.exe
2009-06-15 15:24 156,672 ----a-w c:\windows\System32\t2embed.dll
2009-06-15 15:20 72,704 ----a-w c:\windows\System32\fontsub.dll
2009-06-15 15:20 10,240 ----a-w c:\windows\System32\dciman32.dll
2009-06-15 12:52 289,792 ----a-w c:\windows\System32\atmfd.dll
2009-06-05 12:34 173,056 ----a-w c:\windows\AppPatch\AcXtrnal.dll
2009-06-05 12:33 541,696 ----a-w c:\windows\AppPatch\AcLayers.dll
2009-06-05 12:33 459,776 ----a-w c:\windows\AppPatch\AcSpecfc.dll
2009-06-05 12:33 2,153,984 ----a-w c:\windows\AppPatch\AcGenral.dll
2008-01-21 02:57 174 --sha-w c:\program files\desktop.ini
.

------- Sigcheck -------

2006-11-02 15:15 28672 b5ba0588a845043d9ef4957eb86a96f3 c:\windows\System32\ctfmon.exe
2006-11-02 15:15 28672 b5ba0588a845043d9ef4957eb86a96f3 c:\windows\winsxs\x86_microsoft-windows-t..cesframework-ctfmon_31bf3856ad364e35_6.0.6000.16386_none_9af9cad793a67953\ctfmon.exe

2008-01-21 08:04 45056 c6080fc83314f2b327cf7ee8d20c89e1 c:\windows\System32\userinit.exe
2008-01-21 08:04 45056 c6080fc83314f2b327cf7ee8d20c89e1 c:\windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-06-09 2383872]
"cdloader"="c:\users\chsmanideep\AppData\Roaming\mjusbsp\cdloader2.exe" [2009-08-01 50520]
"Google Update"="c:\users\chsmanideep\AppData\Local\Google\Update\GoogleUpdate.exe" [2009-07-02 133104]
"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-05-26 4351216]
"RegistryMechanic"="c:\program files\Registry Mechanic\RMTray.exe" [2008-07-03 812952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-09-09 150040]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-09-09 178712]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-09-09 154136]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2008-01-21 237568]
"SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2008-09-11 466944]
"DVDAgent"="c:\program files\Hewlett-Packard\Media\DVD\DVDAgent.exe" [2008-09-26 1148200]
"TSMAgent"="c:\program files\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe" [2008-09-26 1152296]
"CLMLServer for HP TouchSmart"="c:\program files\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe" [2008-09-26 189736]
"UCam_Menu"="c:\program files\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216]
"SmartMenu"="c:\program files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe" [2008-09-24 912688]
"UpdateLBPShortCut"="c:\program files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216]
"UpdatePSTShortCut"="c:\program files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" [2008-09-26 210216]
"DpAgent"="c:\program files\DigitalPersona\Bin\dpagent.exe" [2008-07-15 831488]
"QlbCtrl.exe"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2008-08-02 202032]
"UpdateP2GoShortCut"="c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216]
"UpdatePDIRShortCut"="c:\program files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-06-16 75008]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-09 54840]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2008-04-16 488752]
"TVAgent"="c:\program files\Hewlett-Packard\Media\TV\TVAgent.exe" [2009-04-22 206120]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]

c:\progra~2\MICROS~1\Windows\STARTM~1\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2008-06-20 727592]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3codecp"= l3codecp.acm

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli DPPWDFLT

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\OneCareMP]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{2D487FDB-2819-4E63-A012-C635B0F0B86B}"= c:\program files\CyberLink\PowerDirector\PDR.EXE:CyberLink PowerDirector
"{67339B49-1D50-4D13-AAD9-C2BB90ECE145}"= c:\program files\Hewlett-Packard\Media\DVD\HPTouchSmartMusic.exe:HP TouchSmart Music
"{C119BAD8-B865-40E3-AB49-3A85689758CB}"= c:\program files\Hewlett-Packard\Media\DVD\HPTouchSmartPhoto.exe:HP TouchSmart Photo
"{C349F946-DB69-452F-A500-C3977A20C1E7}"= c:\program files\Hewlett-Packard\Media\DVD\HPTouchSmartVideo.exe:HP TouchSmart Video
"{CD78D919-3B27-4826-8D1A-5387A282017B}"= c:\program files\Hewlett-Packard\Media\DVD\TSMAgent.exe:HP TouchSmart Media Resident Program
"{01D454D0-DC64-40A4-B13B-89608A791B4A}"= c:\program files\Hewlett-Packard\Media\DVD\Kernel\CLML\CLMLSvc.exe:CyberLink Media Service
"{6F8BDFC3-0D62-4A8A-BA2D-1DC765274E75}"= c:\program files\Hewlett-Packard\Media\DVD\HPDVDSmart.exe:HP MediaSmart DVD
"{DE971EC6-9996-48A6-ADBA-FBD1E69E2D2E}"= c:\program files\Hewlett-Packard\TouchSmart\Media\HPTouchSmartMusic.exe:HP TouchSmart Music
"{C22C4874-9FD0-4833-95BD-00DCF8422D17}"= c:\program files\Hewlett-Packard\TouchSmart\Media\HPTouchSmartPhoto.exe:HP TouchSmart Photo
"{E84B606D-1265-42B4-BB60-8BEA0B2FCC24}"= c:\program files\Hewlett-Packard\TouchSmart\Media\HPTouchSmartVideo.exe:HP TouchSmart Video
"{A4A8B8DF-24E6-4851-9486-02700E56255A}"= c:\program files\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe:HP TouchSmart Media Resident Program
"{FEB7AE59-D468-45E2-9725-1F169B7CA9C7}"= c:\program files\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe:CyberLink Media Service
"{A0BC3889-625A-4445-BB57-C3F545355BD1}"= UDP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{AAC57A94-C68F-4B37-AD18-55590780155F}"= TCP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{CF3C3B3E-83EF-494C-9C7E-35A8F21C421C}"= c:\program files\Hewlett-Packard\Media\TV\QP.exe:Quick Play
"{C64322FD-734C-4056-B224-2202C494BCDC}"= c:\program files\Hewlett-Packard\Media\TV\QPService.exe:Quick Play Resident Program
"TCP Query User{4ADB4764-01B2-4E18-89E5-D1B685F7BE89}c:\\users\\chsmanideep\\appdata\\roaming\\mjusbsp\\magicjack.exe"= UDP:c:\users\chsmanideep\appdata\roaming\mjusbsp\magicjack.exe:magicjack.exe
"UDP Query User{4494A538-CF21-4A16-A0FC-CDF786725E37}c:\\users\\chsmanideep\\appdata\\roaming\\mjusbsp\\magicjack.exe"= TCP:c:\users\chsmanideep\appdata\roaming\mjusbsp\magicjack.exe:magicjack.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Windows\\system32\\winlogon.exe"= c:\windows\system32\winlogon.exe:*:enabled:@shell32.dll,-1
"c:\\Windows\\system32\\wininit.exe"= c:\windows\system32\wininit.exe:*:enabled:@shell32.dll,-1
"\\"= c:\windows\system\svchost.exe:*:Enabled:KL

R?4 ddnsfilter;ddnsfilter;c:\windows\sySTEM32\svchost.exe -k ddnsfilter [2008-01-21 21504]
R1 Filter;Filter;c:\windows\System32\drivers\Filter.sys [2009-08-31 37760]
R3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2008-10-27 193840]
R3 enecir;ENE CIR Receiver;c:\windows\System32\drivers\enecir.sys [2008-04-29 54784]
R3 IntcHdmiAddService;Intel® High Definition Audio HDMI;c:\windows\System32\drivers\IntcHdmi.sys [2008-07-15 112128]
R3 vfs101x;vfs101x;c:\windows\System32\drivers\vfs101x.sys [2008-09-17 40752]
R4 {55662437-DA8C-40c0-AADA-2C816A897A49};{55662437-DA8C-40c0-AADA-2C816A897A49};c:\program files\Hewlett-Packard\Media\DVD\000.fcl [2008-09-26 16:06:34 59376]
R4 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt.inf_e7ea6efc\AEstSrv.exe [2009-02-09 77824]
R4 hpsrv;HP Service;c:\windows\System32\hpservice.exe [2008-03-19 19456]
R4 MSSQL$MSSMLBIZ;SQL Server (MSSMLBIZ);c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2008-11-24 29263712]
R4 Recovery Service for Windows;Recovery Service for Windows;c:\program files\SMINST\BLService.exe [2008-10-27 365952]
R4 TVCapSvc;TV Background Capture Service (TVBCS);c:\program files\Hewlett-Packard\Media\TV\Kernel\TV\TVCapSvc.exe [2009-04-22 296320]
R4 TVSched;TV Task Scheduler (TVTS);c:\program files\Hewlett-Packard\Media\TV\Kernel\TV\TVSched.exe [2009-04-22 116104]
R4 vfsFPService;Validity Fingerprint Service;c:\windows\System32\vfsFPService.exe [2008-09-17 599344]
S3 JMCR;JMCR;c:\windows\System32\drivers\jmcr.sys [2008-07-21 100184]
S4 OcHealthMon;Windows Live OneCare Health Monitor; [x]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
bthsvcs REG_MULTI_SZ BthServ
ddnsfilter REG_MULTI_SZ ddnsfilter

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
\shell\AutoRun\command - G:\autorun.exe
\shell\phone\command - G:\autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0ba209ef-671b-11de-9cbc-00235a267b7c}]
\shell\AutoRun\command - G:\autorun.exe
\shell\phone\command - G:\autorun.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"c:\program files\Common Files\LightScribe\LSRunOnce.exe"
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
mStart Page = hxxp://www.yahoo.com/
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
IE: &AOL Toolbar Search - c:\programdata\AOL\ieToolbar\resources\en-IN\local\search.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Send image to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
TCP: {D8B7E2B3-24EF-43E9-B3D9-075F7D938DD8} = 10.0.0.1
FF - ProfilePath - c:\users\CHSMAN~1\AppData\Roaming\Mozilla\Firefox\Profiles\2v2u0p6q.default\
FF - prefs.js: browser.startup.homepage - hxxp://10.0.0.1/
FF - plugin: c:\users\chsmanideep\AppData\Local\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\users\chsmanideep\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-02 23:22:26
Windows 6.0.6001 Service Pack 1 NTFS

detected NTDLL code modification:
ZwOpenFile

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
AppInit_DLLs = ????????????

scanning hidden files ...

scan completed successfully
hidden files:

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'lsass.exe'(724)
c:\windows\system32\DPPWDFLT.dll

- - - - - - - > 'Explorer.exe'(4808)
c:\program files\DigitalPersona\Bin\DpoFeedb.dll
c:\windows\system32\btmmhook.dll
c:\program files\DigitalPersona\Bin\DpoSet.dll
.
Completion time: 2009-09-02 23:27:26
ComboFix-quarantined-files.txt 2009-09-02 17:57:16

Pre-Run: 191,060,303,872 bytes free
Post-Run: 191,212,707,840 bytes free

337 --- E O F --- 2009-08-26 14:04:42

===========

Hello

While we understand your frustration at having to wait, please note that Bleeping Computer deals with several hundred requests for assistance such as yours on a daily basis. As a result, our backlog is quite large as are other comparable sites that help others with malware issues. Although our HJT Team members work on hundreds of requests each day, they are all volunteers who work logs when they can and are able to do so. No one is paid by Bleeping Computer for their assistance to our members.

Further, our malware removal staff is comprised of team members with various levels of skill and expertise to deal with thousands of malware variants, some more complex than others. Although we try to take DDS/HJT logs in order (starting with the oldest), it is often the skill level of the particular helper and sometimes the operating system that dictates which logs get selected first. Some infections are more complicated than others and require a higher skill level to remove. Without that skill level attempted removal could result in disastrous results. In other instances, the helper may not be familiar with the operating system that you are using, since they use another. In either case, neither of us want someone to assist you who is not familiar with your issue and attempt to fix it.

We ask that once you have posted your log and are waiting, please DO NOT "bump" your thread or make further replies until it has been responded to by a member of the HJT Team. The reason we ask this or do not respond to your requests is because that would remove you from the active queue that Techs and Staff have access to. The malware staff checks the forum for postings that have 0 replies as this makes it easier for them to identify those who have not been helped. If you post another response, there will be 1 reply. A team member, looking for a new log to work may assume another HJT Team member is already assisting you and not open the thread to respond.

That is why I have made an edit to your last post, instead of a reply. Please do not multiple post here, as that only pushes you further down the queue and causes confusion to the staff.

Please be patient. It may take a while to get a response but your log will be reviewed and answered as soon as possible.

Thank you for understanding.

Orange Blossom ~ forum moderator

Edited by Orange Blossom, 02 September 2009 - 05:47 PM.

Hello and welcome to Bleeping Computer

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.

If you have already posted a DDS log, please do so again, as your situation may have changed.
Use the 'Add Reply' and add the new log to this thread.


Thanks and again sorry for the delay.

We need to see some information about what is happening in your machine. Please perform the following scan:

• Download DDS by sUBs from one of the following links. Save it to your desktop.
  • DDS.scr
  • DDS.pif
• Double click on the DDS icon, allow it to run.
• A small box will open, with an explaination about the tool. No input is needed, the scan is running.
• Notepad will open with the results.
• Follow the instructions that pop up for posting the results.
• Close the program window, and delete the program from your desktop.

Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE

Due to the lack of feedback this Topic is closed.

If you need this topic reopened, please request this by sending the moderating team a PM with the address of the thread. This applies only to the original topic starter.

Everyone else please begin a New Topic