heres my HJLog from normal mode. if you need one from safemode as well i have that:
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 3:57:26 PM, on 11/4/2010
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16671)
Boot mode: Normal
Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Hp\HP Software Update\hpwuschd2.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Jason\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe
C:\Program Files\DivX\DivX Update\DivXUpdate.exe
C:\Windows\System32\bcd2kcpan.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Windows\services.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Windows\avp32.exe
C:\Windows\Temp\hexdump.exe
C:\Windows\Temp\win32.exe
C:\Windows\Temp\f7h4f.exe
C:\Windows\Temp\cmd.exe
C:\Windows\mdm.exe
C:\Windows\Temp\nvsvc32.exe
C:\Windows\cmd.exe
C:\Windows\lsass.exe
C:\Windows\System32\rundll32.exe
C:\Windows\Temp\urlecxk.exe
C:\Windows\Temp\services.exe
C:\Windows\winamp.exe
C:\Windows\Temp\login.exe
C:\Windows\Temp\user.exe
C:\Windows\Temp\avp32.exe
C:\Windows\smss.exe
C:\Windows\svchost.exe
C:\Windows\nvsvc32.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Windows\System32\rundll32.exe
C:\Users\Jason\AppData\Local\Temp\smss.exe
C:\Users\Jason\AppData\Local\Temp\win16.exe
C:\Users\Jason\AppData\Local\Temp\avp32.exe
C:\Users\Jason\AppData\Local\Temp\nvsvc32.exe
C:\Windows\System32\rundll32.exe
C:\Windows\avp32.exe
C:\Windows\services.exe
C:\Windows\Temp\win32.exe
C:\Windows\Temp\hexdump.exe
C:\Windows\Temp\f7h4f.exe
C:\Windows\cmd.exe
C:\Windows\Temp\cmd.exe
C:\Windows\mdm.exe
C:\Windows\Temp\nvsvc32.exe
C:\Windows\lsass.exe
C:\Users\Jason\AppData\Local\Temp\882920140.exe
C:\Users\Jason\AppData\Local\Temp\mdm.exe
C:\Users\Jason\AppData\Local\Temp\drweb.exe
C:\Users\Jason\AppData\Local\Temp\cmd.exe
C:\Users\Jason\AppData\Local\Temp\spoolsv.exe
C:\Users\Jason\AppData\Local\Temp\gdi32.exe
C:\Users\Jason\AppData\Local\Temp\wininst.exe
C:\Users\Jason\AppData\Local\Temp\avp.exe
C:\Users\Jason\AppData\Local\Temp\sysedit.exe
C:\Users\Jason\AppData\Local\Temp\services.exe
C:\Users\Jason\AppData\Local\Temp\winamp.exe
C:\Users\Jason\AppData\Local\Temp\iexplarer.exe
C:\Users\Jason\AppData\Local\Temp\system.exe
C:\Users\Jason\AppData\Local\Temp\taskmgr.exe
C:\Users\Jason\AppData\Local\Temp\csrss.exe
C:\Windows\Temp\urlecxk.exe
C:\Windows\Temp\services.exe
C:\Windows\System32\rundll32.exe
C:\Windows\Temp\avp32.exe
C:\Windows\winamp.exe
C:\Windows\Temp\user.exe
C:\Windows\Temp\login.exe
C:\Windows\smss.exe
C:\Windows\nvsvc32.exe
C:\Windows\svchost.exe
C:\Users\Jason\AppData\Local\Temp\lsass.exe
C:\Users\Jason\AppData\Local\Temp\hexdump.exe
C:\Users\Jason\AppData\Local\Temp\3946665671.exe
C:\Program Files\PacketiX VPN Client English\vpnclient.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe
C:\Users\Jason\AppData\Local\Temp\Low\debug.exe
C:\Users\Jason\AppData\Local\Temp\Low\system.exe
C:\Windows\system32\Macromed\Flash\FlashUtil10k_ActiveX.exe
C:\Jason\Program Files\iTunes\iTunes.exe
C:\Program Files\Common Files\Java\Java Update\jucheck.exe
C:\Windows\System32\taskmgr.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceHelper.exe
C:\Windows\system32\conhost.exe
C:\Program Files\Common Files\Apple\Apple Application Support\distnoted.exe
C:\Windows\system32\conhost.exe
C:\Users\Jason\Downloads\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=C:\Windows\system32\userinit.exe
O1 - Hosts: 74.208.10.249 gs.apple.com
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton 360\Engine\3.8.0.41\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton 360\Engine\3.8.0.41\IPSBHO.DLL
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: C:\Windows\system32\ostg54so.dll - {B6BA40C1-A501-59BD-F413-03B03A2C8952} - C:\Windows\system32\ostg54so.dll
O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\3.8.0.41\coIEPlg.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Foxit Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Jason\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [XboxStat] "C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe" silentrun
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [ATICustomerCare] "C:\Program Files\ATI\ATICustomerCare\ATICustomerCare.exe"
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKLM\..\Run: [BCD2000] %SystemRoot%\system32\bcd2kcpan.exe
O4 - HKLM\..\Run: [uPc+kt0NknMCxl] rundll32.exe C:\Windows\system32\bngdlhd5.dll, SystemServer
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [uPc+kt0NlyTaXms] rundll32.exe C:\Windows\system32\gocmwmxxp6.dll, SystemServer
O4 - HKLM\..\Run: [Mquta] C:\Windows\services.exe
O4 - HKLM\..\Run: [MqpSc] C:\Windows\avp32.exe
O4 - HKLM\..\Run: [MqmPqg] C:\Windows\TEMP\hexdump.exe
O4 - HKLM\..\Run: [MqmPgP] C:\Windows\TEMP\win32.exe
O4 - HKLM\..\Run: [MqmPOc] C:\Windows\TEMP\f7h4f.exe
O4 - HKLM\..\Run: [MqmPY] C:\Windows\TEMP\cmd.exe
O4 - HKLM\..\Run: [MqsZ] C:\Windows\mdm.exe
O4 - HKLM\..\Run: [MqmPz9] C:\Windows\TEMP\nvsvc32.exe
O4 - HKLM\..\Run: [MqqZ] C:\Windows\cmd.exe
O4 - HKLM\..\Run: [Mqsuc] C:\Windows\lsass.exe
O4 - HKLM\..\Run: [uPc+kt0NpfkaXms] rundll32.exe C:\Windows\system32\yans0bxtyw.dll, SystemServer
O4 - HKLM\..\Run: [MqmPud] C:\Windows\TEMP\urlecxk.exe
O4 - HKLM\..\Run: [MqmPwpc] C:\Windows\TEMP\services.exe
O4 - HKLM\..\Run: [Mqvpe] C:\Windows\winamp.exe
O4 - HKLM\..\Run: [MqmPqe] C:\Windows\TEMP\login.exe
O4 - HKLM\..\Run: [MqmPvc] C:\Windows\TEMP\user.exe
O4 - HKLM\..\Run: [MqmPeP] C:\Windows\TEMP\avp32.exe
O4 - HKLM\..\Run: [Mqug] C:\Windows\smss.exe
O4 - HKLM\..\Run: [Vxijegozavo] rundll32.exe "C:\Windows\system32\config\systemprofile\AppData\Local\utoxitig.dll",Startup
O4 - HKLM\..\Run: [Mquvc] C:\Windows\setup.exe
O4 - HKLM\..\Run: [Mquse] C:\Windows\svchost.exe
O4 - HKLM\..\Run: [Mqtw+] C:\Windows\nvsvc32.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [Aim] "C:\Program Files\AIM\aim.exe" /d locale=en-US
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe"
O4 - HKCU\..\Run: [Audiogalaxy] "C:\Users\Jason\AppData\Local\Audiogalaxy\Audiogalaxy.exe" /startup
O4 - HKCU\..\Run: [uPc+kt0NknMCxl] rundll32.exe C:\Windows\system32\bngdlhd5.dll, SystemServer
O4 - HKCU\..\Run: [Lveehfngre] C:\Users\Jason\AppData\Local\Temp\smss.exe
O4 - HKCU\..\Run: [LveehfngrA] C:\Users\Jason\AppData\Local\Temp\win16.exe
O4 - HKCU\..\Run: [LveehfngoA] C:\Users\Jason\AppData\Local\Temp\avp32.exe
O4 - HKCU\..\Run: [LveehfngsfP] C:\Users\Jason\AppData\Local\Temp\nvsvc32.exe
O4 - HKCU\..\Run: [uPc+kt0NlyTaXms] rundll32.exe C:\Windows\system32\gocmwmxxp6.dll, SystemServer
O4 - HKCU\..\Run: [MqpSc] C:\Windows\avp32.exe
O4 - HKCU\..\Run: [Mquta] C:\Windows\services.exe
O4 - HKCU\..\Run: [MqmngP] C:\Windows\Temp\win32.exe
O4 - HKCU\..\Run: [Mqmnqg] C:\Windows\Temp\hexdump.exe
O4 - HKCU\..\Run: [MqmnOc] C:\Windows\Temp\f7h4f.exe
O4 - HKCU\..\Run: [MqqZ] C:\Windows\cmd.exe
O4 - HKCU\..\Run: [MqmnY] C:\Windows\Temp\cmd.exe
O4 - HKCU\..\Run: [MqsZ] C:\Windows\mdm.exe
O4 - HKCU\..\Run: [Mqmnz9] C:\Windows\Temp\nvsvc32.exe
O4 - HKCU\..\Run: [Mqsuc] C:\Windows\lsass.exe
O4 - HKCU\..\Run: [LveehfngPzwson\AppData\Local\Temp\882920140.exe] C:\Users\Jason\AppData\Local\Temp\882920140.exe
O4 - HKCU\..\Run: [Lveehfngne] C:\Users\Jason\AppData\Local\Temp\mdm.exe
O4 - HKCU\..\Run: [Lveehfngob] C:\Users\Jason\AppData\Local\Temp\drweb.exe
O4 - HKCU\..\Run: [Lveehfngnb] C:\Users\Jason\AppData\Local\Temp\cmd.exe
O4 - HKCU\..\Run: [Lveehfngrvg] C:\Users\Jason\AppData\Local\Temp\spoolsv.exe
O4 - HKCU\..\Run: [Lveehfngl/] C:\Users\Jason\AppData\Local\Temp\gdi32.exe
O4 - HKCU\..\Run: [Lveehfngruf] C:\Users\Jason\AppData\Local\Temp\wininst.exe
O4 - HKCU\..\Run: [Lveehfngoe] C:\Users\Jason\AppData\Local\Temp\avp.exe
O4 - HKCU\..\Run: [Lveehfngupf] C:\Users\Jason\AppData\Local\Temp\sysedit.exe
O4 - HKCU\..\Run: [Lveehfngpta] C:\Users\Jason\AppData\Local\Temp\services.exe
O4 - HKCU\..\Run: [Lveehfngrrc] C:\Users\Jason\AppData\Local\Temp\winamp.exe
O4 - HKCU\..\Run: [Lveehfngmtd] C:\Users\Jason\AppData\Local\Temp\iexplarer.exe
O4 - HKCU\..\Run: [Lveehfnguuc] C:\Users\Jason\AppData\Local\Temp\system.exe
O4 - HKCU\..\Run: [Lveehfngosf] C:\Users\Jason\AppData\Local\Temp\taskmgr.exe
O4 - HKCU\..\Run: [Lveehfngoh] C:\Users\Jason\AppData\Local\Temp\csrss.exe
O4 - HKCU\..\Run: [Mqmnud] C:\Windows\Temp\urlecxk.exe
O4 - HKCU\..\Run: [Mqmnwpc] C:\Windows\Temp\services.exe
O4 - HKCU\..\Run: [uPc+kt0NpfkaXms] rundll32.exe C:\Windows\system32\yans0bxtyw.dll, SystemServer
O4 - HKCU\..\Run: [MqmneP] C:\Windows\Temp\avp32.exe
O4 - HKCU\..\Run: [Mqvpe] C:\Windows\winamp.exe
O4 - HKCU\..\Run: [Mqmnvc] C:\Windows\Temp\user.exe
O4 - HKCU\..\Run: [Mqmnqe] C:\Windows\Temp\login.exe
O4 - HKCU\..\Run: [Mqug] C:\Windows\smss.exe
O4 - HKCU\..\Run: [Mqtw+] C:\Windows\nvsvc32.exe
O4 - HKCU\..\Run: [Mquse] C:\Windows\svchost.exe
O4 - HKCU\..\Run: [Lveehfngqd] C:\Users\Jason\AppData\Local\Temp\lsass.exe
O4 - HKCU\..\Run: [Lveehfngmve] C:\Users\Jason\AppData\Local\Temp\hexdump.exe
O4 - HKCU\..\Run: [LveehfngO10con\AppData\Local\Temp\3946665671.exe] C:\Users\Jason\AppData\Local\Temp\3946665671.exe
O4 - HKUS\S-1-5-18\..\Run: [Vmusinebagoga] rundll32.exe "C:\Windows\system32\config\systemprofile\AppData\Local\adond95.dll",Startup (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [uPc+kt0NknMCxl] rundll32.exe C:\Windows\system32\bngdlhd5.dll, SystemServer (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [uPc+kt0NlyTaXms] rundll32.exe C:\Windows\system32\gocmwmxxp6.dll, SystemServer (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Mquta] C:\Windows\services.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [MqpSc] C:\Windows\avp32.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [MqmPqg] C:\Windows\TEMP\hexdump.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [MqmPgP] C:\Windows\TEMP\win32.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [MqmPOc] C:\Windows\TEMP\f7h4f.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [MqmPY] C:\Windows\TEMP\cmd.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [MqsZ] C:\Windows\mdm.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [MqmPz9] C:\Windows\TEMP\nvsvc32.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [MqqZ] C:\Windows\cmd.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Mqsuc] C:\Windows\lsass.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [uPc+kt0NpfkaXms] rundll32.exe C:\Windows\system32\yans0bxtyw.dll, SystemServer (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [MqmPud] C:\Windows\TEMP\urlecxk.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [MqmPwpc] C:\Windows\TEMP\services.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Mqvpe] C:\Windows\winamp.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [MqmPqe] C:\Windows\TEMP\login.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [MqmPvc] C:\Windows\TEMP\user.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [MqmPeP] C:\Windows\TEMP\avp32.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Mqug] C:\Windows\smss.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Mquvc] C:\Windows\setup.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Mquse] C:\Windows\svchost.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Mqtw+] C:\Windows\nvsvc32.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [iPeOb02001] C:\ProgramData\iPeOb02001\iPeOb02001.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Vmusinebagoga] rundll32.exe "C:\Windows\system32\config\systemprofile\AppData\Local\adond95.dll",Startup (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [iPeOb02001] C:\ProgramData\iPeOb02001\iPeOb02001.exe (User 'Default user')
O4 - Startup: Dropbox.lnk = Jason\AppData\Roaming\Dropbox\bin\Dropbox.exe
O4 - Global Startup: PacketiX VPN Client Task Tray.lnk = C:\Program Files\PacketiX VPN Client English\vpncmgr.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O16 - DPF: {D915AE88-270D-479D-8AC1-B3CDD62DBCBF} (CsWebGameController Class) - http://www.cosmicbreak.com/start/cswebgamelauncher.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files\Norton 360\Engine\3.8.0.41\coIEPlg.dll
O23 - Service: AMD External Events Utility - AMD - C:\Windows\system32\atiesrxx.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Axiom Audio Device Monitor (AxiomAudioDevMon) - M-Audio - C:\Program Files\M-Audio\Axiom\AudioDevMon.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton 360 (N360) - Symantec Corporation - C:\Program Files\Norton 360\Engine\3.8.0.41\ccSvcHst.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\Windows\system32\GameMon.des.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: PacketiX VPN Client (vpnclient) - SoftEther Corporation - C:\Program Files\PacketiX VPN Client English\vpnclient.exe
--
End of file - 18263 bytes
i also see a lot of processes in my temp running that were said to be associated with AVS2010 which i have already removed once during the intial purge of AVS2010
Thank you for any help!
sorry about originally posting this in the wrong area, this is my first time here and i was in a rush to post it before work.
EDIT: Posts merged ~BP
Edited by Budapest, 07 November 2010 - 04:01 PM.
Moved from Win 7 to Malware Removal Logs ~ Hamluis.