Hi Gringo,
Combofix log below.
ComboFix 10-12-16.01 - tim 16/12/2010 22:01:02.2.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.44.1033.18.2046.1178 [GMT 0:00]
Running from: c:\users\tim\Desktop\ComboFix.exe
Command switches used :: c:\users\tim\Desktop\CFScript.txt
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FILE ::
"c:\program files\Ares\WinRAR v2.9 Final Español\Español.exe"
"c:\program files\MSN Messenger\riched20.dll"
"c:\program files\Windows Live\Messenger\msimg32.dll"
"c:\program files\Windows Live\Messenger\riched20.dll"
"c:\users\Adam\Videos\filth skream (320k stereo).mp3"
"c:\users\Adam\Videos\filth skream.mp3"
"c:\users\Adam\Videos\the terminator caspa (hot new track).au"
"c:\users\Adam\Videos\Yellowcard - View from Heaven.mp3"
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\program files\MSN Messenger\riched20.dll
c:\program files\Windows Live\Messenger\msimg32.dll
c:\program files\Windows Live\Messenger\riched20.dll
c:\users\Adam\Videos\filth skream (320k stereo).mp3
c:\users\Adam\Videos\filth skream.mp3
c:\users\Adam\Videos\the terminator caspa (hot new track).au
c:\users\Adam\Videos\Yellowcard - View from Heaven.mp3
c:\users\tim\AppData\Roaming\Blitware
c:\users\tim\AppData\Roaming\Blitware\DriverRobot\downloads\active_downloads.dat
c:\users\tim\AppData\Roaming\Blitware\DriverRobot\downloads\downloads.dat
c:\users\tim\AppData\Roaming\Blitware\DriverRobot\downloads\install_log.dat
c:\users\tim\AppData\Roaming\Blitware\DriverRobot\logs\2009-09-13_04.44.00.704000.log
c:\users\tim\AppData\Roaming\Blitware\DriverRobot\logs\2009-09-13_04.44.00.704000.meta
c:\users\tim\AppData\Roaming\Blitware\DriverRobot\logs\2009-09-13_04.44.00.704000.signal
c:\users\tim\AppData\Roaming\Blitware\DriverRobot\updates\3e9a384994003e6daed892e3f8d7c957\3e9a384994003e6daed892e3f8d7c957
c:\users\tim\AppData\Roaming\Blitware\DriverRobot\updates\3e9a384994003e6daed892e3f8d7c957\DriverRobot_Setup.exe
c:\users\tim\AppData\Roaming\Blitware\DriverRobot\updates\downloads.dat
.
((((((((((((((((((((((((( Files Created from 2010-11-16 to 2010-12-16 )))))))))))))))))))))))))))))))
.
2010-12-16 22:12 . 2010-12-16 22:12 -------- d-----w- c:\users\tim\AppData\Local\temp
2010-12-16 22:12 . 2010-12-16 22:12 -------- d-----w- c:\users\Mcx2\AppData\Local\temp
2010-12-16 22:12 . 2010-12-16 22:12 -------- d-----w- c:\users\Mcx1\AppData\Local\temp
2010-12-16 22:12 . 2010-12-16 22:12 -------- d-----w- c:\users\lester\AppData\Local\temp
2010-12-16 22:12 . 2010-12-16 22:12 -------- d-----w- c:\users\IUSR_NMPR\AppData\Local\temp
2010-12-16 22:12 . 2010-12-16 22:12 -------- d-----w- c:\users\Dianne\AppData\Local\temp
2010-12-16 22:12 . 2010-12-16 22:12 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-12-16 22:12 . 2010-12-16 22:12 -------- d-----w- c:\users\Adam\AppData\Local\temp
2010-12-16 18:31 . 2010-12-16 18:31 -------- d-----w- c:\program files\ESET
2010-12-16 11:14 . 2010-12-16 11:14 388096 ----a-r- c:\users\tim\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-12-16 11:14 . 2010-12-16 11:14 -------- d-----w- c:\program files\Trend Micro
2010-12-16 10:45 . 2010-12-16 10:45 -------- d-----w- c:\users\tim\AppData\Roaming\Malwarebytes
2010-12-16 10:45 . 2010-11-29 17:42 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-12-16 10:45 . 2010-12-16 10:45 -------- d-----w- c:\programdata\Malwarebytes
2010-12-16 10:45 . 2010-12-16 10:45 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-12-16 10:45 . 2010-11-29 17:42 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-12-15 13:22 . 2010-11-03 10:51 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat
2010-12-14 09:12 . 2010-12-14 09:12 -------- d-----w- c:\users\Dianne\AppData\Roaming\AVG10
2010-12-13 21:45 . 2010-12-13 21:45 -------- d-----w- c:\users\tim\AppData\Roaming\AVG10
2010-12-13 21:44 . 2010-12-13 21:44 -------- d--h--w- c:\programdata\Common Files
2010-12-10 13:15 . 2010-11-10 04:33 6273872 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{F4B1C41D-454A-4C31-983E-7D3E8C951EBF}\mpengine.dll
2010-12-07 18:59 . 2010-12-07 18:59 -------- d-----w- c:\windows\Internet Logs
2010-12-07 10:00 . 2010-12-13 12:06 -------- d-----w- C:\$AVG8.VAULT$
2010-12-05 15:17 . 2010-12-05 15:17 -------- d-----w- c:\programdata\PC Tools
2010-12-02 13:35 . 2010-12-02 13:35 -------- d-----w- c:\users\Dianne\AppData\Roaming\CheckPoint
2010-12-01 17:11 . 2010-12-01 17:11 -------- d-----w- c:\users\Adam\AppData\Roaming\CheckPoint
2010-11-29 22:03 . 2010-11-29 22:03 -------- d-----w- c:\users\tim\AppData\Roaming\CheckPoint
2010-11-29 22:02 . 2010-11-29 22:02 -------- d-----w- c:\program files\Conduit
2010-11-29 22:02 . 2010-11-29 22:02 -------- d-----w- c:\program files\CheckPoint
2010-11-29 22:02 . 2010-04-05 20:00 221568 ----a-w- c:\windows\system32\drivers\netio.sys
2010-11-29 22:00 . 2010-11-29 22:00 -------- d-----w- c:\programdata\CheckPoint
2010-11-24 09:05 . 2010-10-19 04:27 7680 ----a-w- c:\program files\Internet Explorer\iecompat.dll
2010-11-21 15:12 . 2010-12-12 18:40 -------- d-sh--w- c:\programdata\E4A3ED4321DBCE1FF814FF890A902266
2010-11-18 13:25 . 2010-11-18 13:25 -------- d-----w- c:\program files\iPod
2010-11-18 13:21 . 2010-11-18 13:21 -------- d-----w- c:\program files\Bonjour
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-28 17:52 . 2006-07-11 17:35 348160 ----a-w- c:\windows\system32\msvcr71.dll
2010-10-19 10:41 . 2009-10-02 16:55 222080 ------w- c:\windows\system32\MpSigStub.exe
2010-10-07 12:23 . 2010-10-07 12:23 91424 ----a-w- c:\windows\system32\dnssd.dll
2010-10-07 12:23 . 2010-10-07 12:23 75040 ----a-w- c:\windows\system32\jdns_sd.dll
2010-10-07 12:23 . 2010-10-07 12:23 197920 ----a-w- c:\windows\system32\dnssdX.dll
2010-10-07 12:23 . 2010-10-07 12:23 107808 ----a-w- c:\windows\system32\dns-sd.exe
2010-10-03 22:43 . 2010-10-03 22:43 59240 ----a-w- c:\windows\system32\drivers\RapportKELL.sys
2010-09-22 23:47 . 2010-09-22 23:47 49016 ----a-w- c:\windows\system32\sirenacm.dll
2010-09-22 23:32 . 2010-09-22 23:32 301936 ----a-w- c:\windows\WLXPGSS.SCR
2010-09-22 23:21 . 2010-10-25 20:35 39272 ----a-w- c:\windows\system32\drivers\fssfltr.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0974BA1E-64EC-11DE-B2A5-E43756D89593}]
2009-12-20 09:51 87480 ----a-w- c:\progra~1\BEARSH~1\MediaBar\ToolBar\BearshareMediabarDx.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{74322BF9-DF26-493f-B0DA-6D2FC5E6429E}]
2010-10-19 12:53 585136 ----a-w- c:\progra~1\BEARSH~1\MediaBar\Datamngr\IEBHO.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{0974BA1E-64EC-11DE-B2A5-E43756D89593}"= "c:\progra~1\BEARSH~1\MediaBar\ToolBar\BearshareMediabarDx.dll" [2009-12-20 87480]
[HKEY_CLASSES_ROOT\clsid\{0974ba1e-64ec-11de-b2a5-e43756d89593}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2007-10-25 4702208]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152]
"snpstd"="c:\windows\vsnpstd.exe" [2005-10-11 339968]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-06-26 13789728]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2008-06-02 178712]
"HsdClient.exe"="c:\program files\Virgin Media\Chat Extension\HsdClient.exe" [2010-03-02 2045168]
"hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2006-09-28 65536]
"DigitalHomeSupport.exe"="c:\program files\Virgin Media\Digital Home Support\DigitalHomeSupport.exe" [2010-03-12 4314352]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-10-28 202256]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-10-08 47904]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-09-08 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-11-11 421160]
c:\users\Adam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
LimeWire On Startup.lnk - c:\program files\LimeWire\LimeWire.exe [N/A]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2008-3-25 214360]
NETGEAR WG111v3 Smart Wizard.lnk - c:\program files\NETGEAR\WG111v3\WG111v3.exe [2007-9-14 1695744]
VTAgentReboot.exe [2001-10-7 143360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer1"=wdmaud.drv
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
2005-06-06 22:46 57344 ----a-w- c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
2010-10-08 17:04 47904 ----a-w- c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Domino]
2006-08-18 15:58 49152 ----a-w- c:\windows\Domino.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KBD]
2006-12-08 15:16 65536 ----a-w- c:\hp\KBD\KbdStub.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2010-09-22 23:47 4240760 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-09-08 10:17 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Companion]
2010-04-19 12:12 405712 ----a-w- c:\program files\Sony Ericsson\Sony Ericsson PC Companion\PCCompanion.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2008-12-19 22:37 39408 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ZSSnp211]
2006-08-19 10:37 49152 ----a-w- c:\windows\ZSSnp211.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 CryptSvc32;Cryptographic Services ;c:\windows\system32\mswsock32.exe [x]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-01-30 135664]
R2 IntelDHSvcConf;Intel DH Service;c:\program files\Intel\IntelDH\Intel Media Server\Tools\IntelDHSvcConf.exe [2006-05-10 29696]
R3 Sony Ericsson PCCompanion;Sony Ericsson PCCompanion;c:\program files\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe [2010-06-08 153808]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]
S0 RapportKELL;RapportKELL;c:\windows\System32\Drivers\RapportKELL.sys [2010-10-03 59240]
S1 RapportBuka;RapportBuka;c:\windows\system32\drivers\RapportBuka.sys [2010-02-25 390528]
S1 RapportCerberus_19917;RapportCerberus_19917;c:\programdata\Trusteer\Rapport\store\exts\RapportCerberus\19917\RapportCerberus_19917.sys [2010-10-03 34792]
S1 RapportPG;RapportPG;c:\program files\Trusteer\Rapport\bin\RapportPG.sys [2010-10-03 169320]
S2 DQLWinService;DQLWinService;c:\program files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe [2006-09-03 208896]
S2 HsdService;HsdService;c:\program files\Virgin Media\Chat Extension\HsdService.exe [2010-03-02 1410288]
S2 RapportMgmtService;Rapport Management Service;c:\program files\Trusteer\Rapport\bin\RapportMgmtService.exe [2010-10-03 767208]
S2 ServicepointService;ServicepointService;c:\program files\Virgin Media\Digital Home Support\ServicepointService.exe [2010-03-12 689392]
S3 3xHybrid;ASUSTek SAA713x PCI Card;c:\windows\system32\DRIVERS\3xHybrid.sys [2007-01-26 2831232]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
HPService REG_MULTI_SZ HPSLPSVC
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]
2009-03-08 11:32 128512 ----a-w- c:\windows\System32\advpack.dll
.
Contents of the 'Scheduled Tasks' folder
2010-12-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-30 12:38]
2010-12-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-30 12:38]
2010-12-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-499370088-1744875061-2987850715-1003Core.job
- c:\users\tim\AppData\Local\Google\Update\GoogleUpdate.exe [2010-11-29 22:00]
2010-12-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-499370088-1744875061-2987850715-1003UA.job
- c:\users\tim\AppData\Local\Google\Update\GoogleUpdate.exe [2010-11-29 22:00]
2010-12-16 c:\windows\Tasks\User_Feed_Synchronization-{548F5663-4640-47EC-8631-C3C64AD26710}.job
- c:\windows\system32\msfeedssync.exe [2010-12-15 04:25]
2010-12-16 c:\windows\Tasks\User_Feed_Synchronization-{69318581-B9C8-4C4B-A135-0F06FD038F24}.job
- c:\windows\system32\msfeedssync.exe [2010-12-15 04:25]
2010-12-16 c:\windows\Tasks\User_Feed_Synchronization-{DD8C5295-69D1-43D4-BFC3-32F22E2C54A4}.job
- c:\windows\system32\msfeedssync.exe [2010-12-15 04:25]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.virginmedia.com/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_GB&c=71&bd=Pavilion&pf=desktop
uInternet Settings,ProxyOverride = *.local
Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} -
DPF: {678940D3-080C-4FCE-A54D-D443E1177F01} - hxxps://beta.coolroom.com/ActiveX/ax.dll
DPF: {BA162249-F2C5-4851-8ADC-FC58CB424243} - hxxp://www.profileheaven.com/images/multi-upload/ImageUploader2.cab
.
- - - - ORPHANS REMOVED - - - -
HKLM-Run-SunJavaUpdateSched - c:\program files\Java\jre6\bin\jusched.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2010-12-16 22:12
Windows 6.0.6002 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
c:\users\tim\AppData\Local\Temp\catchme.dll 53248 bytes executable
scan completed successfully
hidden files: 1
**************************************************************************
.
Completion time: 2010-12-16 22:19:31
ComboFix-quarantined-files.txt 2010-12-16 22:19
ComboFix2.txt 2010-12-13 21:25
Pre-Run: 134,116,155,392 bytes free
Post-Run: 132,957,351,936 bytes free
- - End Of File - - 8E246C2920850A2280A793349FCDD027