[AmazingTrans]

Hi there,

Just now, i thought i received a link from my brother
ll! You have to watch this
apparently, its spywarez and etc. My firefox has a VIRUS ALERT! now on evrey files i download. My start button, i lost most of the things in there, run all gone. CTRL ALT DEL comes up with Task manager has been disable by my admin. My firefox page now. is all white, including my desktop background. Popups like windows security alert popsup, website page redirect to something else. I hope someone can help me with this... I'm trying to learn how to fix these problems and help peope if i could too.

Thanks. My Hijacklog is below.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:31: VIRUS ALERT!, on 8/21/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Rockwell\EventServer.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Rockwell Software\RSCommon\RSOBSERV.EXE
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\Program Files\Common Files\Rockwell\NmspHost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\Common Files\Rockwell\RdcyHost.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Common Files\Rockwell\RNADiagnosticsSrv.exe
C:\Program Files\Rockwell Software\RSView Enterprise\HMIDIAGNOSTICSLSTADAPT.exe
C:\PROGRA~1\ROCKWE~1\RSLinx\RSLINX.EXE
C:\Program Files\Common Files\Rockwell\RsvcHost.exe
C:\Program Files\Sprint\Sierra Wireless\Sprint PCS Connection Manager\SPCSUtilityService.exe
C:\WINDOWS\system32\StacSV.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\Program Files\Rexroth\IndraLogic\ENI Server\ENI.exe
C:\Program Files\Common Files\Rockwell\EventClientMultiplexer.exe
C:\Program Files\Common Files\Rockwell\RnaDirServer.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Common Files\Rockwell\RNADirMultiplexor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Apoint\ApMsgFwd.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Apoint\HidFind.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe
C:\WINDOWS\system32\KADxMain.exe
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\Rockwell Automation\Rockwell Automation USB CIP Driver Package\UsbCipHelper\UsbCipHelper.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Rexroth\IndraLogic\ENI Server\ENISysTray.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Logitech\QuickCam\Quickcam.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\FTSvrMgr.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Eraser\eraser.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Documents and Settings\All Users\Application Data\Skype\Plugins\Plugins\154C62C17BE84FACB2D22300D1A8FD25\WTP4Skype.exe
C:\Program Files\Hamachi\hamachi.exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
C:\WINDOWS\explorer.exe
C:\PROGRA~1\Grisoft\AVG7\avgwb.dat
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\AnVir Task Manager\AnVir.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\MSN Messenger\livecall.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\AOL\Loader\aolload.exe
C:\Program Files\Lavasoft\Ad-Aware\Ad-Aware.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=0071015
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarerefer...=...6Ojg5&lid=2
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=0071015
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O3 - Toolbar: rafbsvnx - {1B27DC3F-A487-486D-BBA8-CA45373B1457} - C:\WINDOWS\rafbsvnx.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,Start
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [Document Manager] C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe
O4 - HKLM\..\Run: [KADxMain] C:\WINDOWS\system32\KADxMain.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [UsbCipHelper] C:\Program Files\Rockwell Automation\Rockwell Automation USB CIP Driver Package\UsbCipHelper\UsbCipHelper.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [ENISysTray] "C:\Program Files\Rexroth\IndraLogic\ENI Server\ENISysTray.exe"
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [FTSvrMgr] C:\WINDOWS\system32\FTSvrMgr.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Eraser] C:\Program Files\Eraser\eraser.exe -hide
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O4 - Startup: Workrave.lnk = C:\Program Files\Workrave\lib\Workrave.exe
O4 - Global Startup: Bluetooth Manager.lnk = ?
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\Office12\REFIEBAR.DLL
O9 - Extra button: PPLive - {95B3F550-91C4-4627-BCC4-521288C52977} - C:\Program Files\PPLive\PPLive.exe
O9 - Extra 'Tools' menuitem: PPLive - {95B3F550-91C4-4627-BCC4-521288C52977} - C:\Program Files\PPLive\PPLive.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00134F72-5284-44F7-95A8-52A619F70751} (ObjWinNTCheck Class) - https://192.168.254....ll/WinNTChk.cab
O16 - DPF: {08D75BB0-D2B5-11D1-88FC-0080C859833B} (OfficeScan Corp Edition Web-Deployment SetupINICtrl Class) - https://192.168.254....ll/setupini.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zon...kr.cab56986.cab
O16 - DPF: {254AA86E-5655-4518-AA87-185D7CC41801} (LogMeIn Rescue Technician Console) - https://secure.logme...scueControl.cab
O16 - DPF: {3D3BF1F8-9696-4A5E-B4F1-49101C997B70} (VaxSIPUserAgentCAB Control) - http://labs.jaduka.c...serAgentCAB.cab
O16 - DPF: {5EFE8CB1-D095-11D1-88FC-0080C859833B} (OfficeScan Corp Edition Web-Deployment ObjRemoveCtrl Class) - https://192.168.254..../RemoveCtrl.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebo...otoUploader.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.mi...b?1192837145421
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/p...owserPlugin.cab
O16 - DPF: {70EE0AA4-5A3A-4052-8FFA-2EEDA43F7942} - http://www.innotive....cibrowser11.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zon...nt.cab56907.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logme...trl.cab?lmi=100
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: wxvault.dll C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL lufccn.dll
O21 - SSODL: vtqnxfko - {F6F3C01D-24FE-47EA-9781-8AE70D540B04} - C:\WINDOWS\vtqnxfko.dll
O21 - SSODL: tsxngabr - {9220257B-7B0F-442A-880D-4725CF8E67B3} - C:\WINDOWS\tsxngabr.dll
O23 - Service: 1784-PCIDS DeviceNet - Rockwell Automation - C:\Program Files\Rockwell Software\RSLogix Emulate 5000\PcidsService.exe
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Broadcom ASF IP and SMBIOS Mailbox Monitor (ASFIPmon) - Broadcom Corporation - C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: dnWhoDisp - Rockwell Automation, Inc. - C:\Program Files\Rockwell Software\RSLINX\dnwhodisp.exe
O23 - Service: EmuLogix 5868 Slot1 - Rockwell Automation - C:\Program Files\Rockwell Software\RSLogix Emulate 5000\\V16\EmuLogix5868.exe
O23 - Service: EmuLogix 5868 Slot10 - Rockwell Automation - C:\Program Files\Rockwell Software\RSLogix Emulate 5000\V15\EmuLogix5868.exe
O23 - Service: EmuLogix 5868 Slot11 - Rockwell Automation - C:\Program Files\Rockwell Software\RSLogix Emulate 5000\V15\EmuLogix5868.exe
O23 - Service: EmuLogix 5868 Slot12 - Rockwell Automation - C:\Program Files\Rockwell Software\RSLogix Emulate 5000\V15\EmuLogix5868.exe
O23 - Service: EmuLogix 5868 Slot13 - Rockwell Automation - C:\Program Files\Rockwell Software\RSLogix Emulate 5000\V15\EmuLogix5868.exe
O23 - Service: EmuLogix 5868 Slot14 - Rockwell Automation - C:\Program Files\Rockwell Software\RSLogix Emulate 5000\V15\EmuLogix5868.exe
O23 - Service: EmuLogix 5868 Slot15 - Rockwell Automation - C:\Program Files\Rockwell Software\RSLogix Emulate 5000\V15\EmuLogix5868.exe
O23 - Service: EmuLogix 5868 Slot16 - Rockwell Automation - C:\Program Files\Rockwell Software\RSLogix Emulate 5000\V15\EmuLogix5868.exe
O23 - Service: EmuLogix 5868 Slot2 - Rockwell Automation - C:\Program Files\Rockwell Software\RSLogix Emulate 5000\V15\EmuLogix5868.exe
O23 - Service: EmuLogix 5868 Slot3 - Rockwell Automation - C:\Program Files\Rockwell Software\RSLogix Emulate 5000\\V16\EmuLogix5868.exe
O23 - Service: EmuLogix 5868 Slot4 - Rockwell Automation - C:\Program Files\Rockwell Software\RSLogix Emulate 5000\V15\EmuLogix5868.exe
O23 - Service: EmuLogix 5868 Slot5 - Rockwell Automation - C:\Program Files\Rockwell Software\RSLogix Emulate 5000\V15\EmuLogix5868.exe
O23 - Service: EmuLogix 5868 Slot6 - Rockwell Automation - C:\Program Files\Rockwell Software\RSLogix Emulate 5000\V15\EmuLogix5868.exe
O23 - Service: EmuLogix 5868 Slot7 - Rockwell Automation - C:\Program Files\Rockwell Software\RSLogix Emulate 5000\V15\EmuLogix5868.exe
O23 - Service: EmuLogix 5868 Slot8 - Rockwell Automation - C:\Program Files\Rockwell Software\RSLogix Emulate 5000\V15\EmuLogix5868.exe
O23 - Service: EmuLogix 5868 Slot9 - Rockwell Automation - C:\Program Files\Rockwell Software\RSLogix Emulate 5000\V15\EmuLogix5868.exe
O23 - Service: ENI Server - Bosch Rexroth AG - C:\Program Files\Rexroth\IndraLogic\ENI Server\ENI.exe
O23 - Service: Rockwell Event Multiplexer (EventClientMultiplexer) - Rockwell Automation, Inc. - C:\Program Files\Common Files\Rockwell\EventClientMultiplexer.exe
O23 - Service: Rockwell Event Server (EventServer) - Rockwell Automation, Inc. - C:\Program Files\Common Files\Rockwell\EventServer.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Harmony - Rockwell Automation, Inc. - C:\Program Files\Rockwell Software\RSCommon\RSOBSERV.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: IndraWorksService - Bosch Rexroth AG - C:\Program Files\Rexroth\IndraWorks\IndraWorks.Service.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LogReceiver - Unknown owner - C:\Program Files\Rockwell Software\RSLinx Enterprise\LogReceiver.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
O23 - Service: Rockwell Namespace Services (NmspHost) - Rockwell Automation, Inc. - C:\Program Files\Common Files\Rockwell\NmspHost.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ODM V3 (ODMV3) - Hilscher GmbH - C:\Program Files\Common Files\Hilscher\ODMV3\ODMV3.exe
O23 - Service: OpcEnum - Bosch Rexroth AG - C:\WINDOWS\system32\opcenum.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Rockwell Redundancy Services (RdcyHost) - Rockwell Automation, Inc. - C:\Program Files\Common Files\Rockwell\RdcyHost.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: FactoryTalk Diagnostics Local Reader (RNADiagnosticsService) - Rockwell Automation Inc. - C:\Program Files\Common Files\Rockwell\RNADiagnosticsSrv.exe
O23 - Service: FactoryTalk Diagnostics CE Receiver (RNADiagReceiver) - Rockwell Automation, Inc. - C:\Program Files\Common Files\Rockwell\RNADiagReceiver.exe
O23 - Service: Rockwell Directory Server (RNADirectory) - Rockwell Automation, Inc. - C:\Program Files\Common Files\Rockwell\RnaDirServer.exe
O23 - Service: Rockwell Directory Multiplexer (RNADirMultiplexor) - Rockwell Automation, Inc. - C:\Program Files\Common Files\Rockwell\RNADirMultiplexor.exe
O23 - Service: Rockwell HMI Diagnostics - Rockwell Automation, Inc. - C:\Program Files\Rockwell Software\RSView Enterprise\HMIDIAGNOSTICSLSTADAPT.exe
O23 - Service: Rockwell Tag Server - Rockwell Automation, Inc. - C:\Program Files\Rockwell Software\RSView Enterprise\TagSrv.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: RSLinx Classic (RSLinx) - Rockwell Automation, Inc. - C:\PROGRA~1\ROCKWE~1\RSLinx\RSLINX.EXE
O23 - Service: RSLinx Enterprise (RSLinxNG) - Rockwell Automation - C:\Program Files\Rockwell Software\RSLinx Enterprise\RSLinxNG.exe
O23 - Service: Rockwell Application Services (RsvcHost) - Rockwell Automation, Inc. - C:\Program Files\Common Files\Rockwell\RsvcHost.exe
O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SecureStorageService - Wave Systems Corp. - C:\Program Files\Wave Systems Corp\Secure Storage Manager\SecureStorageService.exe
O23 - Service: 1789-SIM Simulator Module (SimModuleService) - Unknown owner - C:\Program Files\Rockwell Software\RSLogix Emulate 5000\SimModuleService.exe
O23 - Service: SPCSUtilityService - Sprint Spectrum, L.L.C - C:\Program Files\Sprint\Sierra Wireless\Sprint PCS Connection Manager\SPCSUtilityService.exe
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\WINDOWS\system32\StacSV.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: NTRU TSS v1.2.1.12 TCS (tcsd_win32.exe) - Unknown owner - C:\Program Files\NTRU Cryptosystems\NTRU TCG Software Stack\bin\tcsd_win32.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: Intel® PROSet/Wireless SSO Service (WLANKEEPER) - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
O24 - Desktop Component 0: Privacy Protection - file:///C:\WINDOWS\privacy_danger\index.htm

--
End of file - 23969 bytes

Edited by Rorschach112, 22 August 2008 - 04:58 AM.

[Advertisements]

Hello

Before we begin, you should save these instructions in Notepad to your desktop, or print them, for easy reference. Much of our fix will be done in Safe mode, and you will be unable to access this thread at that time. If you have questions at any point, or are unsure of the instructions, feel free to post here and ask for clarification before proceeding.


Download SDFix and save it to your Desktop.

Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)

Please then reboot your computer in Safe Mode by doing the following :

• Restart your computer
• After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
• Instead of Windows loading as normal, the Advanced Options Menu should appear;
• Select the first option, to run Windows in Safe Mode, then press Enter.
• Choose your usual account.

• Open the extracted SDFix folder and double click RunThis.bat to start the script.
• Type Y to begin the cleanup process.
• It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
• Press any Key and it will restart the PC.
• When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
• Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
  (Report.txt will also be copied to Clipboard ready for posting back on the forum).
• Finally paste the contents of the Report.txt back on the forum.

Please visit this web page for instructions for downloading and running ComboFix

http://www.bleepingc...to-use-combofix

This includes installing the Windows XP Recovery Console in case you have not installed it yet.

For more information on the Windows XP Recovery Console read http://support.microsoft.com/kb/314058.

Once you install the Recovery Console, when you reboot your computer, you'll see the option for the Recovery Console now as well. Don't select Recovery Console as we don't need it. By default, your main OS is selected there. The screen stays for 2 seconds and then it proceeds to load Windows. That is normal.

Post the log from ComboFix when you've accomplished that, along with a new HijackThis log.

[Rorschach112]

Hello

Before we begin, you should save these instructions in Notepad to your desktop, or print them, for easy reference. Much of our fix will be done in Safe mode, and you will be unable to access this thread at that time. If you have questions at any point, or are unsure of the instructions, feel free to post here and ask for clarification before proceeding.


Download SDFix and save it to your Desktop.

Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)

Please then reboot your computer in Safe Mode by doing the following :

• Restart your computer
• After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
• Instead of Windows loading as normal, the Advanced Options Menu should appear;
• Select the first option, to run Windows in Safe Mode, then press Enter.
• Choose your usual account.

• Open the extracted SDFix folder and double click RunThis.bat to start the script.
• Type Y to begin the cleanup process.
• It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
• Press any Key and it will restart the PC.
• When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
• Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
  (Report.txt will also be copied to Clipboard ready for posting back on the forum).
• Finally paste the contents of the Report.txt back on the forum.

Please visit this web page for instructions for downloading and running ComboFix

http://www.bleepingc...to-use-combofix

This includes installing the Windows XP Recovery Console in case you have not installed it yet.

For more information on the Windows XP Recovery Console read http://support.microsoft.com/kb/314058.

Once you install the Recovery Console, when you reboot your computer, you'll see the option for the Recovery Console now as well. Don't select Recovery Console as we don't need it. By default, your main OS is selected there. The screen stays for 2 seconds and then it proceeds to load Windows. That is normal.

Post the log from ComboFix when you've accomplished that, along with a new HijackThis log.

[AmazingTrans]

Hi, Here is the report for SDFix.

SDFix: Version 1.218
Run by Johnny Heng on Fri 08/22/2008 at 11:23

Microsoft Windows XP [Version 5.1.2600]
Running From: C:\sdfix

Checking Services :


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


Checking Files :

No Trojan Files Found




Folder C:\Documents and Settings\Johnny Heng\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#w*w.redtube.com - Removed


Removing Temp Files

ADS Check :



Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-22 11:46:26
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:23,da,db,3c,af,b5,65,d2,96,c8,dc,99,ab,d9,13,8c,71,a3,f2,37,3c,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,70,c3,9b,dd,21,3c,20,67,28,72,2b,de,e4,6d,8c,5a,e6,..
"khjeh"=hex:59,ef,2b,a6,ac,bf,5a,bd,25,dc,65,57,4f,8f,3e,b2,a1,ca,69,c0,af,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:72,7b,30,d8,59,e8,ee,10,a2,0d,04,b1,00,48,39,29,5d,d0,39,5e,63,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:23,da,db,3c,af,b5,65,d2,96,c8,dc,99,ab,d9,13,8c,71,a3,f2,37,3c,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,70,c3,9b,dd,21,3c,20,67,28,72,2b,de,e4,6d,8c,5a,e6,..
"khjeh"=hex:59,ef,2b,a6,ac,bf,5a,bd,25,dc,65,57,4f,8f,3e,b2,a1,ca,69,c0,af,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:72,7b,30,d8,59,e8,ee,10,a2,0d,04,b1,00,48,39,29,5d,d0,39,5e,63,..

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts]
"ø\xbbÜ\xb4\x2026ºpÈ ?(?T?r?u?e?T?y?p?e?)?"="Mmj.ttf"

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services :




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Rockwell Software\\RSLogix 5000\\ENU\\v16\\Bin\\RS5000.Exe"="C:\\Program Files\\Rockwell Software\\RSLogix 5000\\ENU\\v16\\Bin\\RS5000.Exe:*:Enabled:RSLogix 5000 v16.00.00 "
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\\Program Files\\Google\\Google Talk\\googletalk.exe"="C:\\Program Files\\Google\\Google Talk\\googletalk.exe:*:Enabled:Google Talk"
"C:\\WINDOWS\\system32\\OpcEnum.exe"="C:\\WINDOWS\\system32\\OpcEnum.exe:*:Enabled:OPCEnum.exe"
"C:\\Program Files\\Rockwell Software\\RSLINX\\RSLINX.EXE"="C:\\Program Files\\Rockwell Software\\RSLINX\\RSLINX.EXE:*:Enabled:RSLinx.exe"
"C:\\Program Files\\Rockwell Software\\OPCTools\\OPCTest\\opctest.exe"="C:\\Program Files\\Rockwell Software\\OPCTools\\OPCTest\\opctest.exe:*:Enabled:OPCTestClient.exe"
"C:\\Program Files\\Common Files\\Rockwell\\EventClientMultiplexer.exe"="C:\\Program Files\\Common Files\\Rockwell\\EventClientMultiplexer.exe:*:Enabled:EventClientMultiplexer.exe"
"C:\\Program Files\\Common Files\\Rockwell\\RsvcHost.exe"="C:\\Program Files\\Common Files\\Rockwell\\RsvcHost.exe:*:Enabled:RsvcHost.exe"
"C:\\Program Files\\Common Files\\Rockwell\\RnaDirServer.exe"="C:\\Program Files\\Common Files\\Rockwell\\RnaDirServer.exe:*:Enabled:RnaDirServer.exe"
"C:\\Program Files\\Common Files\\Rockwell\\EventServer.exe"="C:\\Program Files\\Common Files\\Rockwell\\EventServer.exe:*:Enabled:EventServer.exe"
"C:\\Program Files\\Common Files\\Rockwell\\DaClient.exe"="C:\\Program Files\\Common Files\\Rockwell\\DaClient.exe:*:Enabled:DaClient.exe"
"C:\\Program Files\\Common Files\\Rockwell\\RNADiagReceiver.exe"="C:\\Program Files\\Common Files\\Rockwell\\RNADiagReceiver.exe:*:Enabled:RnaDiagReceiver.exe"
"C:\\Program Files\\Common Files\\Rockwell\\RNADiagnosticsSrv.exe"="C:\\Program Files\\Common Files\\Rockwell\\RNADiagnosticsSrv.exe:*:Enabled:RnaDiagnosticsSrv.exe"
"C:\\Program Files\\Common Files\\Rockwell\\VStudio.exe"="C:\\Program Files\\Common Files\\Rockwell\\VStudio.exe:*:Enabled:VStudio.exe"
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"="C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe:*:Enabled:AOL Loader"
"C:\\Program Files\\Rockwell Software\\RSLinx Enterprise\\RSLinxNG.exe"="C:\\Program Files\\Rockwell Software\\RSLinx Enterprise\\RSLinxNG.exe:*:Enabled:RSLinxNG.exe"
"C:\\Program Files\\Rockwell Software\\RSLinx Enterprise\\RSLinxShortcutAOA.exe"="C:\\Program Files\\Rockwell Software\\RSLinx Enterprise\\RSLinxShortcutAOA.exe:*:Enabled:RSLinxShortcutAOA.exe"
"C:\\Program Files\\Rockwell Software\\RSView\\sptddssv32.exe"="C:\\Program Files\\Rockwell Software\\RSView\\sptddssv32.exe:*:Enabled:RSView32OPCTagServer"
"C:\\Program Files\\Rockwell Software\\RSView\\SptFTServer.exe"="C:\\Program Files\\Rockwell Software\\RSView\\SptFTServer.exe:*:Enabled:RSView32FTTagServer"
"C:\\Program Files\\Rockwell Software\\RSView\\sptddeex32.exe"="C:\\Program Files\\Rockwell Software\\RSView\\sptddeex32.exe:*:Enabled:sptddeex32"
"C:\\Program Files\\Rockwell Software\\RDM\\Cmeopc32.exe"="C:\\Program Files\\Rockwell Software\\RDM\\Cmeopc32.exe:*:Enabled:CMEOPC32"
"C:\\Program Files\\Common Files\\Rockwell\\RSViewLogServer.exe"="C:\\Program Files\\Common Files\\Rockwell\\RSViewLogServer.exe:*:Enabled:RSViewLogServer"
"C:\\Program Files\\Common Files\\Rockwell\\RSVWHist.exe"="C:\\Program Files\\Common Files\\Rockwell\\RSVWHist.exe:*:Enabled:TrendXHistoryServer"
"C:\\WINDOWS\\system32\\netdde.exe"="C:\\WINDOWS\\system32\\netdde.exe:*:Enabled:NetDDEService"
"C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:æTorrent"
"C:\\Program Files\\Jaman Player\\jamdownloader.exe"="C:\\Program Files\\Jaman Player\\jamdownloader.exe:*:Enabled:Jaman Downloader"
"C:\\Program Files\\Jaman Player\\jaman-updater.exe"="C:\\Program Files\\Jaman Player\\jaman-updater.exe:*:Enabled:Jaman Updater"
"C:\\Program Files\\Rexroth\\IndraWorks\\DDP.EngineeringDesktop.exe"="C:\\Program Files\\Rexroth\\IndraWorks\\DDP.EngineeringDesktop.exe:*:Enabled:INDRAWORKS DDP.ENGINEERINGDESKTOP"
"C:\\Program Files\\Rexroth\\IndraWorks\\Drive\\Offline\\DriveServer_MPB03vrs.exe"="C:\\Program Files\\Rexroth\\IndraWorks\\Drive\\Offline\\DriveServer_MPB03vrs.exe:*:Enabled:INDRAWORKS DRIVESERVER_MPB03VRS"
"C:\\Program Files\\Rexroth\\IndraWorks\\Drive\\Offline\\DriveServer_MPD03vrs.exe"="C:\\Program Files\\Rexroth\\IndraWorks\\Drive\\Offline\\DriveServer_MPD03vrs.exe:*:Enabled:INDRAWORKS DRIVESERVER_MPD03VRS"
"C:\\Program Files\\Rexroth\\IndraWorks\\Drive\\Offline\\DriveServer_MPH03vrs.exe"="C:\\Program Files\\Rexroth\\IndraWorks\\Drive\\Offline\\DriveServer_MPH03vrs.exe:*:Enabled:INDRAWORKS DRIVESERVER_MPH03VRS"
"C:\\WINDOWS\\system32\\Gateway.exe"="C:\\WINDOWS\\system32\\Gateway.exe:*:Enabled:INDRAWORKS GATEWAY"
"C:\\Program Files\\Rexroth\\IndraWorks\\Drive\\Offline\\DriveServer_MPB04vrs.exe"="C:\\Program Files\\Rexroth\\IndraWorks\\Drive\\Offline\\DriveServer_MPB04vrs.exe:*:Enabled:INDRAWORKS DRIVESERVER_MPB04VRS"
"C:\\Program Files\\Rexroth\\IndraWorks\\Drive\\Offline\\DriveServer_MPD04vrs.exe"="C:\\Program Files\\Rexroth\\IndraWorks\\Drive\\Offline\\DriveServer_MPD04vrs.exe:*:Enabled:INDRAWORKS DRIVESERVER_MPD04VRS"
"C:\\Program Files\\Rexroth\\IndraWorks\\Drive\\Offline\\DriveServer_MPH04vrs.exe"="C:\\Program Files\\Rexroth\\IndraWorks\\Drive\\Offline\\DriveServer_MPH04vrs.exe:*:Enabled:INDRAWORKS DRIVESERVER_MPH04VRS"
"C:\\Program Files\\TurboTax\\Deluxe 2007\\32bit\\ttax.exe"="C:\\Program Files\\TurboTax\\Deluxe 2007\\32bit\\ttax.exe:LocalSubNet:Enabled:TurboTax"
"C:\\Program Files\\TurboTax\\Deluxe 2007\\32bit\\updatemgr.exe"="C:\\Program Files\\TurboTax\\Deluxe 2007\\32bit\\updatemgr.exe:LocalSubNet:Enabled:TurboTax Update Manager"
"C:\\Program Files\\Winamp Remote\\bin\\Orb.exe"="C:\\Program Files\\Winamp Remote\\bin\\Orb.exe:*:Enabled:Orb"
"C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"="C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe:*:Enabled:OrbTray"
"C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"="C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe:*:Enabled:Orb Stream Client"
"C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"="C:\\Program Files\\Grisoft\\AVG7\\avginet.exe:*:Enabled:avginet.exe"
"C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe:*:Enabled:avgamsvr.exe"
"C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe:*:Enabled:avgcc.exe"
"C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe:*:Enabled:avgemc.exe"
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"C:\\Documents and Settings\\All Users\\Application Data\\NexonUS\\NGM\\NGM.exe"="C:\\Documents and Settings\\All Users\\Application Data\\NexonUS\\NGM\\NGM.exe:*:Enabled:Nexon Game Manager"
"C:\\Nexon\\Combat Arms\\CombatArms.exe"="C:\\Nexon\\Combat Arms\\CombatArms.exe:*Enabled:CombatArms.exe"
"C:\\Nexon\\Combat Arms\\Engine.exe"="C:\\Nexon\\Combat Arms\\Engine.exe:*Enabled:Engine.exe"
"C:\\Nexon\\Combat Arms\\NMService.exe"="C:\\Nexon\\Combat Arms\\NMService.exe:*:Enabled:Nexon Messenger Core"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Common Files\\Rockwell\\RdcyHost.exe"="C:\\Program Files\\Common Files\\Rockwell\\RdcyHost.exe:*:Enabled:RdcyHost.exe"
"C:\\Program Files\\Common Files\\Rockwell\\NmspHost.exe"="C:\\Program Files\\Common Files\\Rockwell\\NmspHost.exe:*:Enabled:NmspHost.exe"
"C:\\Program Files\\Rexroth\\IndraWorks\\PDA.Server.exe"="C:\\Program Files\\Rexroth\\IndraWorks\\PDA.Server.exe:*:Enabled:INDRAWORKS PDA.SERVER"
"C:\\Program Files\\Rexroth\\IndraWorks\\SCPServer.exe"="C:\\Program Files\\Rexroth\\IndraWorks\\SCPServer.exe:*:Enabled:INDRAWORKS SCPSERVER"
"C:\\Program Files\\Rexroth\\IndraWorks\\Drive\\Offline\\DriveServer_MPB05vrs.exe"="C:\\Program Files\\Rexroth\\IndraWorks\\Drive\\Offline\\DriveServer_MPB05vrs.exe:*:Enabled:INDRAWORKS DRIVESERVER_MPB05VRS"
"C:\\Program Files\\Rexroth\\IndraWorks\\Drive\\Offline\\DriveServer_MPD05vrs.exe"="C:\\Program Files\\Rexroth\\IndraWorks\\Drive\\Offline\\DriveServer_MPD05vrs.exe:*:Enabled:INDRAWORKS DRIVESERVER_MPD05VRS"
"C:\\Program Files\\Rexroth\\IndraWorks\\Drive\\Offline\\DriveServer_MPH05vrs.exe"="C:\\Program Files\\Rexroth\\IndraWorks\\Drive\\Offline\\DriveServer_MPH05vrs.exe:*:Enabled:INDRAWORKS DRIVESERVER_MPH05VRS"
"C:\\Program Files\\Common Files\\Rockwell\\countermonitor.exe"="C:\\Program Files\\Common Files\\Rockwell\\countermonitor.exe:*:Enabled:CounterMonitor.exe"
"C:\\Program Files\\Rockwell Software\\RSView Enterprise\\MERuntime.exe"="C:\\Program Files\\Rockwell Software\\RSView Enterprise\\MERuntime.exe:*:Enabled:MERuntime.exe"
"C:\\Program Files\\Rockwell Software\\RSView Enterprise\\TagSrv.exe"="C:\\Program Files\\Rockwell Software\\RSView Enterprise\\TagSrv.exe:*:Enabled:TagSrv.exe"
"C:\\Program Files\\PPLive\\PPLive.exe"="C:\\Program Files\\PPLive\\PPLive.exe:*:Enabled:PPLive"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\\Nexon\\Combat Arms\\CombatArms.exe"="C:\\Nexon\\Combat Arms\\CombatArms.exe:*Enabled:CombatArms.exe"
"C:\\Nexon\\Combat Arms\\Engine.exe"="C:\\Nexon\\Combat Arms\\Engine.exe:*Enabled:Engine.exe"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Common Files\\Rockwell\\EventClientMultiplexer.exe"="C:\\Program Files\\Common Files\\Rockwell\\EventClientMultiplexer.exe:*:Enabled:EventClientMultiplexer.exe"
"C:\\Program Files\\Common Files\\Rockwell\\RsvcHost.exe"="C:\\Program Files\\Common Files\\Rockwell\\RsvcHost.exe:*:Enabled:RsvcHost.exe"
"C:\\Program Files\\Common Files\\Rockwell\\RdcyHost.exe"="C:\\Program Files\\Common Files\\Rockwell\\RdcyHost.exe:*:Enabled:RdcyHost.exe"
"C:\\Program Files\\Common Files\\Rockwell\\NmspHost.exe"="C:\\Program Files\\Common Files\\Rockwell\\NmspHost.exe:*:Enabled:NmspHost.exe"
"C:\\Program Files\\Common Files\\Rockwell\\RnaDirServer.exe"="C:\\Program Files\\Common Files\\Rockwell\\RnaDirServer.exe:*:Enabled:RnaDirServer.exe"
"C:\\Program Files\\Common Files\\Rockwell\\EventServer.exe"="C:\\Program Files\\Common Files\\Rockwell\\EventServer.exe:*:Enabled:EventServer.exe"
"C:\\Program Files\\Common Files\\Rockwell\\DaClient.exe"="C:\\Program Files\\Common Files\\Rockwell\\DaClient.exe:*:Enabled:DaClient.exe"
"C:\\Program Files\\Common Files\\Rockwell\\RNADiagReceiver.exe"="C:\\Program Files\\Common Files\\Rockwell\\RNADiagReceiver.exe:*:Enabled:RnaDiagReceiver.exe"
"C:\\Program Files\\Common Files\\Rockwell\\RNADiagnosticsSrv.exe"="C:\\Program Files\\Common Files\\Rockwell\\RNADiagnosticsSrv.exe:*:Enabled:RnaDiagnosticsSrv.exe"
"C:\\Program Files\\Common Files\\Rockwell\\VStudio.exe"="C:\\Program Files\\Common Files\\Rockwell\\VStudio.exe:*:Enabled:VStudio.exe"
"C:\\WINDOWS\\system32\\OPCEnum.exe"="C:\\WINDOWS\\system32\\OPCEnum.exe:*:Enabled:OPCEnum.exe"
"C:\\Program Files\\Rockwell Software\\RSLinx Enterprise\\RSLinxNG.exe"="C:\\Program Files\\Rockwell Software\\RSLinx Enterprise\\RSLinxNG.exe:*:Enabled:RSLinxNG.exe"
"C:\\Program Files\\Rockwell Software\\RSLinx Enterprise\\RSLinxShortcutAOA.exe"="C:\\Program Files\\Rockwell Software\\RSLinx Enterprise\\RSLinxShortcutAOA.exe:*:Enabled:RSLinxShortcutAOA.exe"
"C:\\Program Files\\Common Files\\Rockwell\\countermonitor.exe"="C:\\Program Files\\Common Files\\Rockwell\\countermonitor.exe:*:Enabled:CounterMonitor.exe"
"C:\\Program Files\\Rockwell Software\\RSView Enterprise\\MERuntime.exe"="C:\\Program Files\\Rockwell Software\\RSView Enterprise\\MERuntime.exe:*:Enabled:MERuntime.exe"
"C:\\Program Files\\Rockwell Software\\RSView Enterprise\\TagSrv.exe"="C:\\Program Files\\Rockwell Software\\RSView Enterprise\\TagSrv.exe:*:Enabled:TagSrv.exe"

Remaining Files :



Files with Hidden Attributes :

Tue 19 Feb 2008 21,040 ..SHR --- "C:\EVRSI.SYS"
Tue 10 Jun 2008 80 A..H. --- "C:\WINDOWS\mapcontacts.reg"
Thu 21 Aug 2008 103,424 ..SH. --- "C:\Documents and Settings\Johnny Heng\css.exe"
Thu 21 Aug 2008 134,144 ..SH. --- "C:\Documents and Settings\Johnny Heng\intelOP.exe"
Thu 21 Aug 2008 69,632 ..SH. --- "C:\Documents and Settings\Johnny Heng\MediaTubeCodec_ver1.1463.0.exe"
Thu 21 Aug 2008 147,456 ..SH. --- "C:\Documents and Settings\Johnny Heng\ppxcs.exe"
Thu 21 Aug 2008 103,936 ..SH. --- "C:\Documents and Settings\Johnny Heng\sccs.exe"
Thu 9 Nov 2006 20,480 A..H. --- "C:\Nexon\Combat Arms\HShield\4e59468.dll"
Thu 9 Nov 2006 20,480 A..H. --- "C:\Nexon\Combat Arms\HShield\a230c0.dll"
Tue 1 Jan 2008 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Fri 18 Apr 2003 1,233,920 A..H. --- "C:\Program Files\Rockwell Software\RSLogix 5000 Tools\RSLogix 5000 IEC61131-3 Translation Tool\msxml4.dll"
Thu 8 May 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\385cb67dda0ffd4dea8c0d990dc65796\BIT2.tmp"
Wed 23 Jul 2008 165,232 A..H. --- "C:\Documents and Settings\Johnny Heng\Application Data\Microsoft\Virtual PC\VPCKeyboard.dll"
Mon 12 Feb 2007 3,096,576 A..H. --- "C:\Documents and Settings\Johnny Heng\Application Data\U3\temp\Launchpad Removal.exe"
Mon 19 Jun 2006 5,239 A..H. --- "C:\Documents and Settings\Johnny Heng\Desktop\Johnnny\Work\Job\SW\setup\Redist\FTAP\FTAP 2_00 CPR7 Patch Installs 05Jan07\Utils\CHOICE.com"
Tue 30 Nov 1999 10,000 A..H. --- "C:\Documents and Settings\Johnny Heng\Desktop\Johnnny\Work\Job\SW\setup\Redist\FTAP\FTAP 2_00 CPR7 Patch Installs 05Jan07\Utils\kill.exe"
Thu 11 Nov 1999 63,248 A..H. --- "C:\Documents and Settings\Johnny Heng\Desktop\Johnnny\Work\Job\SW\setup\Redist\FTAP\FTAP 2_00 CPR7 Patch Installs 05Jan07\Utils\sc.exe"

Finished!

Hope to hear from you. Thanks.

[AmazingTrans]

Here is the ComboFix log along with HijackThis Log...
ComboFix 08-08-21.02 - Johnny Heng 2008-08-22 11:57:52.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1086 [GMT -4:00]
Running from: C:\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Johnny Heng\Application Data\macromedia\Flash Player\#SharedObjects\RUMZCXR9\interclick.com
C:\Documents and Settings\Johnny Heng\Application Data\macromedia\Flash Player\#SharedObjects\RUMZCXR9\interclick.com\ud.sol
C:\Documents and Settings\Johnny Heng\Application Data\macromedia\Flash Player\#SharedObjects\RUMZCXR9\static.youku.com
C:\Documents and Settings\Johnny Heng\Application Data\macromedia\Flash Player\#SharedObjects\RUMZCXR9\static.youku.com\v\swf\qplayer.swf\youku.sol
C:\Documents and Settings\Johnny Heng\Application Data\macromedia\Flash Player\#SharedObjects\RUMZCXR9\static.youku.com\v1.0.0187\v\swf\qplayer.swf\youku.sol
C:\Documents and Settings\Johnny Heng\Application Data\macromedia\Flash Player\#SharedObjects\RUMZCXR9\static.youku.com\v1.0.0232\v\swf\qplayer.swf\qplayer.sol
C:\Documents and Settings\Johnny Heng\Application Data\macromedia\Flash Player\#SharedObjects\RUMZCXR9\static.youku.com\v1.0.0233\v\swf\qplayer.swf\youku.sol
C:\Documents and Settings\Johnny Heng\Application Data\macromedia\Flash Player\#SharedObjects\RUMZCXR9\static.youku.com\v1.0.0281\v\swf\qplayer.swf\qplayer.sol
C:\Documents and Settings\Johnny Heng\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com
C:\Documents and Settings\Johnny Heng\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com\settings.sol
C:\Documents and Settings\Johnny Heng\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#static.youku.com
C:\Documents and Settings\Johnny Heng\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#static.youku.com\settings.sol
C:\WINDOWS\system32\_000005_.tmp.dll
C:\WINDOWS\system32\_000008_.tmp.dll
C:\WINDOWS\system32\cfx32.ocx
C:\WINDOWS\system32\dao350.dll
C:\WINDOWS\system32\lmTvvyxx.ini2
C:\WINDOWS\system32\lufccn.dll
C:\WINDOWS\system32\qmbsfuha.dll

.
((((((((((((((((((((((((( Files Created from 2008-07-22 to 2008-08-22 )))))))))))))))))))))))))))))))
.

2008-08-22 11:13 . 2008-08-22 11:14 <DIR> d-------- C:\WINDOWS\ERUNT
2008-08-22 11:13 . 2008-08-22 11:50 <DIR> d-------- C:\sdfix
2008-08-22 11:00 . 2008-08-22 11:01 2,720,466 -ra------ C:\ComboFix.exe
2008-08-22 10:58 . 2008-08-22 11:13 <DIR> d-------- C:\Documents and Settings\Johnny Heng\%systemdrive%
2008-08-22 02:10 . 2008-08-22 02:10 <DIR> d-------- C:\smitfraud
2008-08-22 01:16 . 2008-08-22 02:10 5,150 --a------ C:\WINDOWS\system32\tmp.reg
2008-08-22 01:13 . 2008-08-22 02:11 <DIR> d-------- C:\Documents and Settings\Johnny Heng\SmitfraudFix
2008-08-22 01:05 . 2008-08-22 01:06 <DIR> d-------- C:\bfu
2008-08-21 23:25 . 2008-08-21 23:25 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-08-21 23:25 . 2008-08-21 23:25 <DIR> d-------- C:\Documents and Settings\Johnny Heng\Application Data\Malwarebytes
2008-08-21 23:25 . 2008-08-21 23:25 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-21 23:25 . 2008-08-17 15:01 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-08-21 23:25 . 2008-08-17 15:01 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-08-21 23:23 . 2008-08-21 23:23 <DIR> d-------- C:\Program Files\Common Files\Download Manager
2008-08-21 23:20 . 2008-08-21 23:20 <DIR> d-------- C:\Program Files\ERUNT
2008-08-21 23:11 . 2008-08-21 23:11 <DIR> d-------- C:\Program Files\Trend Micro
2008-08-21 22:57 . 2008-08-22 05:31 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\services
2008-08-21 22:55 . 2008-08-21 22:55 147,456 ---hs---- C:\Documents and Settings\Johnny Heng\ppxcs.exe
2008-08-21 22:55 . 2008-08-21 22:55 134,144 ---hs---- C:\Documents and Settings\Johnny Heng\intelOP.exe
2008-08-21 22:55 . 2008-08-21 22:55 103,936 ---hs---- C:\Documents and Settings\Johnny Heng\sccs.exe
2008-08-21 22:55 . 2008-08-21 22:55 103,424 ---hs---- C:\Documents and Settings\Johnny Heng\css.exe
2008-08-21 22:55 . 2008-08-21 22:55 69,632 ---hs---- C:\Documents and Settings\Johnny Heng\MediaTubeCodec_ver1.1463.0.exe
2008-08-20 09:42 . 2008-08-20 09:45 <DIR> d-------- C:\Work
2008-08-19 11:19 . 2008-08-19 11:19 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-08-16 21:22 . 2008-08-16 21:30 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\PPLive
2008-08-16 21:22 . 2008-08-16 21:22 1,073,741,824 --a------ C:\pfsvoddata.bbv
2008-08-13 19:01 . 2008-05-01 10:30 331,776 --------- C:\WINDOWS\system32\dllcache\msadce.dll
2008-08-08 19:26 . 2008-08-08 19:26 <DIR> d-------- C:\WINDOWS\system32\PPLive
2008-08-08 17:46 . 2008-08-08 17:48 <DIR> d-------- C:\Documents and Settings\Johnny Heng\Application Data\PPLive
2008-08-08 17:45 . 2008-08-16 21:47 <DIR> d-------- C:\Program Files\PPLive
2008-08-08 10:41 . 2008-08-08 10:41 <DIR> d-------- C:\Program Files\Microsoft Silverlight
2008-07-31 16:47 . 2008-07-31 16:47 <DIR> d-------- C:\Program Files\Workrave
2008-07-31 16:47 . 2008-08-01 04:00 <DIR> d-------- C:\Documents and Settings\Johnny Heng\Application Data\Workrave
2008-07-29 16:48 . 2008-07-29 16:48 227 --a------ C:\WINDOWS\SlRegEDS.ini
2008-07-27 22:31 . 2008-07-27 22:31 <DIR> d-------- C:\Program Files\AnVir Task Manager
2008-07-22 00:04 . 2008-07-22 00:04 <DIR> d-------- C:\docs

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-22 15:53 --------- d-----w C:\Documents and Settings\Johnny Heng\Application Data\OpenOffice.org2
2008-08-22 14:53 --------- d-----w C:\Documents and Settings\Johnny Heng\Application Data\Skype
2008-08-22 14:06 --------- d-----w C:\Documents and Settings\Johnny Heng\Application Data\skypePM
2008-08-22 14:02 --------- d-----w C:\Program Files\Mozilla Thunderbird
2008-08-22 05:31 --------- d-----w C:\Documents and Settings\Johnny Heng\Application Data\Hamachi
2008-08-22 05:02 --------- d-----w C:\Documents and Settings\Johnny Heng\Application Data\Wave Systems Corp
2008-08-22 03:35 --------- d-----w C:\Documents and Settings\Johnny Heng\Application Data\AVG7
2008-08-21 05:14 --------- d-----w C:\Documents and Settings\Johnny Heng\Application Data\uTorrent
2008-08-20 13:23 --------- d-----w C:\Program Files\Hamachi
2008-08-20 13:22 25,280 ----a-w C:\WINDOWS\system32\drivers\hamachi.sys
2008-08-19 18:41 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater
2008-08-19 17:42 --------- d-----w C:\Program Files\Common Files\Rockwell
2008-08-19 16:45 --------- d-----w C:\Program Files\ProSoft Technology Inc
2008-08-19 16:45 --------- d-----w C:\Program Files\Common Files\Hilscher
2008-08-19 15:26 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-08-19 15:21 --------- d-----w C:\Program Files\Lavasoft
2008-08-10 01:02 --------- d-----w C:\Documents and Settings\Johnny.ENGINEER_BISHOP\Application Data\Wave Systems Corp
2008-08-09 14:09 --------- d-----w C:\Documents and Settings\Johnny.ENGINEER_BISHOP\Application Data\AVG7
2008-08-08 21:45 --------- d-----w C:\Program Files\MSN Messenger
2008-07-31 02:44 --------- d-----w C:\Program Files\Google
2008-07-29 20:48 --------- d-----w C:\Program Files\Rockwell Software
2008-07-26 20:46 --------- d-----w C:\Program Files\uTorrent
2008-07-24 16:58 --------- d-----w C:\Program Files\NeatReceipts Professional
2008-07-24 16:58 --------- d-----w C:\Documents and Settings\All Users\Application Data\NeatReceipts Professional
2008-07-24 16:57 --------- d-----w C:\Program Files\Common Files\NeatReceipts
2008-07-24 16:56 --------- d-----w C:\Program Files\Microsoft SQL Server
2008-07-24 16:54 --------- d-----w C:\Program Files\Microsoft.NET
2008-07-23 20:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\FLEXnet
2008-07-20 23:15 --------- d-----w C:\Documents and Settings\Johnny Heng\Application Data\ScanSoft
2008-07-20 23:13 --------- d-----w C:\Program Files\Skype
2008-07-20 23:13 --------- d-----w C:\Program Files\Common Files\Skype
2008-07-20 23:09 --------- d-----w C:\Documents and Settings\All Users\Application Data\ScanSoft
2008-07-19 04:20 --------- d-----w C:\Documents and Settings\Johnny Heng\Application Data\LogMeIn Rescue
2008-07-18 23:25 --------- d-----w C:\Program Files\WMR11
2008-07-18 23:25 --------- d-----w C:\Program Files\Free WMA to MP3 Converter
2008-07-17 19:50 --------- d-----w C:\Program Files\Allen-Bradley
2008-07-17 19:48 1,712 ----a-w C:\WINDOWS\system32\Rsvchost.reg
2008-07-17 19:48 1,678 ----a-w C:\WINDOWS\system32\RdcyReg.reg
2008-07-17 15:28 --------- d-----w C:\Program Files\GLOBEtrotter Software Inc
2008-07-17 01:24 --------- d-----w C:\Program Files\MSECACHE
2008-07-17 01:22 --------- d-----w C:\Program Files\Windows Installer Clean Up
2008-07-17 00:27 --------- d-----w C:\Program Files\Common Files\Rexroth
2008-07-17 00:26 --------- d-----w C:\Program Files\Rexroth
2008-07-17 00:26 --------- d-----w C:\Documents and Settings\All Users\Application Data\Rexroth
2008-07-16 20:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\Rockwell
2008-07-16 15:11 30,720 ----a-w C:\WINDOWS\system32\REGTLIB.exe
2008-07-13 16:52 --------- d-----w C:\Documents and Settings\Johnny Heng\Application Data\U3
2008-07-12 22:35 --------- d-----w C:\Documents and Settings\Johnny Heng\Application Data\Bosch Rexroth AG
2008-07-12 12:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\Macrovision
2008-07-11 20:10 6,656 ----a-w C:\WINDOWS\system32\haspvdd.dll
2008-07-11 20:10 47,616 ----a-w C:\WINDOWS\system32\drivers\Haspnt.sys
2008-07-11 20:09 --------- d-----w C:\Documents and Settings\All Users\Application Data\WFCU
2008-07-11 13:10 --------- d-----w C:\Documents and Settings\Johnny Heng\Application Data\VoipCheapCom
2008-07-07 20:32 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-07-07 20:32 253,952 ------w C:\WINDOWS\system32\dllcache\es.dll
2008-07-04 14:26 --------- d-----w C:\Program Files\UltraVNC
2008-07-02 13:18 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-02 04:09 --------- d-----w C:\Documents and Settings\All Users\Application Data\NexonUS
2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
2008-06-24 16:23 74,240 ------w C:\WINDOWS\system32\dllcache\mscms.dll
2008-06-24 15:57 3,592,192 ------w C:\WINDOWS\system32\dllcache\mshtml.dll
2008-06-23 09:20 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe
2008-06-23 09:20 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe
2008-06-23 09:20 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-06-21 05:23 161,792 ------w C:\WINDOWS\system32\dllcache\ieakui.dll
2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 17:41 245,248 ------w C:\WINDOWS\system32\dllcache\mswsock.dll
2008-06-20 17:41 148,992 ----a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\dllcache\tcpip.sys
2008-06-20 10:44 138,368 ------w C:\WINDOWS\system32\dllcache\afd.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\dllcache\tcpip6.sys
2008-06-15 19:03 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-06-14 01:22 50,887 ----a-w C:\Program Files\downloads.php.html
2008-06-13 13:10 272,128 ------w C:\WINDOWS\system32\dllcache\bthport.sys
2008-06-04 20:57 906,960 ----a-w C:\Program Files\Google Updater.exe
2008-02-19 01:11 5,363,496 ----a-w C:\Program Files\TRACTION_In-Game_Radio_Player_K2_setup.exe
2008-02-09 16:39 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
2008-02-07 22:30 12,448 ----a-w C:\Program Files\0clc
2007-04-17 01:49 5,812,653 ----a-w C:\Program Files\mapcontacts.exe
2005-11-15 02:01 532,480 ----a-w C:\Program Files\cwshredder.exe
2008-02-28 19:30 8,784 ----a-w C:\Program Files\mozilla firefox\plugins\ractrlkeyhook.dll
2008-02-28 19:33 245,408 ----a-w C:\Program Files\mozilla firefox\plugins\unicows.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-06-10 23:02 68856]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 13:54 5674352]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 06:00 15360]
"Eraser"="C:\Program Files\Eraser\eraser.exe" [2007-07-28 17:05 277328]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [2007-04-15 22:49 159744]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-05-31 16:50 8429568]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [2007-07-25 17:32 823296]
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2007-07-25 17:30 974848]
"Document Manager"="C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe" [2007-01-30 16:32 102400]
"KADxMain"="C:\WINDOWS\system32\KADxMain.exe" [2006-11-02 15:05 282624]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 17:50 221184]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 06:00 208952]
"IMEKRMIG6.1"="C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE" [2004-08-04 06:00 44032]
"MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 06:00 59392]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 06:00 455168]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 06:00 455168]
"googletalk"="C:\Program Files\Google\Google Talk\googletalk.exe" [2007-01-01 17:22 3739648]
"Acrobat Assistant 8.0"="C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2008-01-11 20:54 623992]
"UsbCipHelper"="C:\Program Files\Rockwell Automation\Rockwell Automation USB CIP Driver Package\UsbCipHelper\UsbCipHelper.exe" [2006-09-28 18:25 434176]
"ENISysTray"="C:\Program Files\Rexroth\IndraLogic\ENI Server\ENISysTray.exe" [2007-01-23 08:12 712704]
"LogMeIn GUI"="C:\Program Files\LogMeIn\x86\LogMeInSystray.exe" [2007-08-03 16:09 63048]
"LogitechCommunicationsManager"="C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-10-25 16:33 563984]
"LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam\Quickcam.exe" [2007-10-25 16:37 2178832]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-04-22 12:11 579584]
"FTSvrMgr"="C:\WINDOWS\system32\FTSvrMgr.exe" [2003-03-20 13:07 32768]
"Dell QuickSet"="C:\Program Files\Dell\QuickSet\quickset.exe" [2007-05-14 15:23 1191936]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-03-29 00:37 413696]
"nwiz"="nwiz.exe" [2007-05-31 16:50 1626112 C:\WINDOWS\system32\nwiz.exe]
"NVHotkey"="nvHotkey.dll" [2007-05-31 16:50 67584 C:\WINDOWS\system32\nvhotkey.dll]
"NvMediaCenter"="NvMCTray.dll" [2007-05-31 16:50 81920 C:\WINDOWS\system32\nvmctray.dll]
"SigmatelSysTrayApp"="stsystra.exe" [2007-02-19 00:26 303104 C:\WINDOWS\stsystra.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-04-02 16:43 219136]

C:\Documents and Settings\Johnny Heng\Start Menu\Programs\Startup\
OpenOffice.org 2.4.lnk - C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe [2008-01-21 16:41:28 393216]
Workrave.lnk - C:\Program Files\Workrave\lib\Workrave.exe [2007-09-14 22:23:03 2925568]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Bluetooth Manager.lnk - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2007-01-11 21:43:46 2150400]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"SENTINEL"= snti386.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 wvauth

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dllschannel.dlldigest.dllmsnsspc.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
backup=C:\WINDOWS\pss\Digital Line Detect.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
--a------ 2007-10-15 16:13 1862144 C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
--a------ 2004-07-27 17:50 81920 C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Orb]
--a------ 2008-03-24 22:59 507904 C:\Program Files\Winamp Remote\bin\OrbTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDVDDXSrv]
--------- 2006-10-20 18:23 118784 C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-03-29 00:37 413696 C:\Program Files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxioDragToDisc]
--a------ 2006-08-17 10:00 1116920 C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SecureUpgrade]
--a------ 2007-01-22 12:53 212992 C:\Program Files\Wave Systems Corp\SecureUpgrade.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2008-05-03 01:32 185896 C:\Program Files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Rockwell Software\\RSLogix 5000\\ENU\\v16\\Bin\\RS5000.Exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
"C:\\WINDOWS\\system32\\OpcEnum.exe"=
"C:\\Program Files\\Rockwell Software\\RSLINX\\RSLINX.EXE"=
"C:\\Program Files\\Rockwell Software\\OPCTools\\OPCTest\\opctest.exe"=
"C:\\Program Files\\Common Files\\Rockwell\\EventClientMultiplexer.exe"=
"C:\\Program Files\\Common Files\\Rockwell\\RsvcHost.exe"=
"C:\\Program Files\\Common Files\\Rockwell\\RnaDirServer.exe"=
"C:\\Program Files\\Common Files\\Rockwell\\EventServer.exe"=
"C:\\Program Files\\Common Files\\Rockwell\\DaClient.exe"=
"C:\\Program Files\\Common Files\\Rockwell\\RNADiagReceiver.exe"=
"C:\\Program Files\\Common Files\\Rockwell\\RNADiagnosticsSrv.exe"=
"C:\\Program Files\\Common Files\\Rockwell\\VStudio.exe"=
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"C:\\Program Files\\Rockwell Software\\RSLinx Enterprise\\RSLinxNG.exe"=
"C:\\Program Files\\Rockwell Software\\RSLinx Enterprise\\RSLinxShortcutAOA.exe"=
"C:\\Program Files\\Rockwell Software\\RSView\\sptddssv32.exe"=
"C:\\Program Files\\Rockwell Software\\RSView\\SptFTServer.exe"=
"C:\\Program Files\\Rockwell Software\\RSView\\sptddeex32.exe"=
"C:\\Program Files\\Rockwell Software\\RDM\\Cmeopc32.exe"=
"C:\\Program Files\\Common Files\\Rockwell\\RSViewLogServer.exe"=
"C:\\Program Files\\Common Files\\Rockwell\\RSVWHist.exe"=
"C:\\WINDOWS\\system32\\netdde.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Jaman Player\\jamdownloader.exe"=
"C:\\Program Files\\Jaman Player\\jaman-updater.exe"=
"C:\\Program Files\\Rexroth\\IndraWorks\\DDP.EngineeringDesktop.exe"=
"C:\\Program Files\\Rexroth\\IndraWorks\\Drive\\Offline\\DriveServer_MPB03vrs.exe"=
"C:\\Program Files\\Rexroth\\IndraWorks\\Drive\\Offline\\DriveServer_MPD03vrs.exe"=
"C:\\Program Files\\Rexroth\\IndraWorks\\Drive\\Offline\\DriveServer_MPH03vrs.exe"=
"C:\\WINDOWS\\system32\\Gateway.exe"=
"C:\\Program Files\\Rexroth\\IndraWorks\\Drive\\Offline\\DriveServer_MPB04vrs.exe"=
"C:\\Program Files\\Rexroth\\IndraWorks\\Drive\\Offline\\DriveServer_MPD04vrs.exe"=
"C:\\Program Files\\Rexroth\\IndraWorks\\Drive\\Offline\\DriveServer_MPH04vrs.exe"=
"C:\\Program Files\\Winamp Remote\\bin\\Orb.exe"=
"C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"=
"C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Documents and Settings\\All Users\\Application Data\\NexonUS\\NGM\\NGM.exe"=
"C:\Nexon\Combat Arms\CombatArms.exe"= C:\Nexon\Combat Arms\CombatArms.exe:*Enabled:CombatArms.exe
"C:\Nexon\Combat Arms\Engine.exe"= C:\Nexon\Combat Arms\Engine.exe:*Enabled:Engine.exe
"C:\\Nexon\\Combat Arms\\NMService.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Common Files\\Rockwell\\RdcyHost.exe"=
"C:\\Program Files\\Common Files\\Rockwell\\NmspHost.exe"=
"C:\\Program Files\\Rexroth\\IndraWorks\\PDA.Server.exe"=
"C:\\Program Files\\Rexroth\\IndraWorks\\SCPServer.exe"=
"C:\\Program Files\\Rexroth\\IndraWorks\\Drive\\Offline\\DriveServer_MPB05vrs.exe"=
"C:\\Program Files\\Rexroth\\IndraWorks\\Drive\\Offline\\DriveServer_MPD05vrs.exe"=
"C:\\Program Files\\Rexroth\\IndraWorks\\Drive\\Offline\\DriveServer_MPH05vrs.exe"=
"C:\\Program Files\\Common Files\\Rockwell\\countermonitor.exe"=
"C:\\Program Files\\Rockwell Software\\RSView Enterprise\\MERuntime.exe"=
"C:\\Program Files\\Rockwell Software\\RSView Enterprise\\TagSrv.exe"=
"C:\\Program Files\\PPLive\\PPLive.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"135:TCP"= 135:TCP:Port135
"10504:TCP"= 10504:TCP:BitComet 10504 TCP
"10504:UDP"= 10504:UDP:BitComet 10504 UDP

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R0 PBADRV;PBADRV;C:\WINDOWS\system32\DRIVERS\PBADRV.sys [2006-08-28 16:00]
R1 DLARTL_M;DLARTL_M;C:\WINDOWS\system32\Drivers\DLARTL_M.SYS [2006-08-11 11:35]
R1 VirtualBackplane;A-B Virtual Backplane;C:\WINDOWS\system32\drivers\VirtualBackplane.sys [2007-04-18 10:32]
R2 ASFIPmon;Broadcom ASF IP and SMBIOS Mailbox Monitor;C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe [2006-12-19 15:21]
R2 ENI Server;ENI Server;C:\Program Files\Rexroth\IndraLogic\ENI Server\ENI.exe [2007-01-23 08:00]
R2 LMIInfo;LogMeIn Kernel Information Provider;C:\Program Files\LogMeIn\x86\RaInfo.sys [2007-08-03 16:09]
R2 LMIRfsDriver;LogMeIn Remote File System Driver;C:\WINDOWS\system32\drivers\LMIRfsDriver.sys [2007-08-03 16:09]
R2 NmspHost;Rockwell Namespace Services;C:\Program Files\Common Files\Rockwell\NmspHost.exe [2007-09-18 00:57]
R2 ODMV3;ODM V3;C:\Program Files\Common Files\Hilscher\ODMV3\ODMV3.exe [2007-09-21 16:22]
R2 RdcyHost;Rockwell Redundancy Services;C:\Program Files\Common Files\Rockwell\RdcyHost.exe [2007-09-18 00:57]
R2 Viewpoint Manager Service;Viewpoint Manager Service;C:\Program Files\Viewpoint\Common\ViewpointService.exe [2007-01-04 17:38]
R2 vnccom;vnccom;C:\WINDOWS\system32\Drivers\vnccom.SYS [2004-06-26 13:22]
R2 Wave UCSPlus;Wave UCSPlus;C:\WINDOWS\system32\dllhost.exe [2004-08-04 06:00]
R3 DXEC01;DXEC01;C:\WINDOWS\system32\drivers\dxec01.sys [2006-11-02 13:32]
R3 EventServer;Rockwell Event Server;C:\Program Files\Common Files\Rockwell\EventServer.exe [2007-09-17 23:36]
R3 swmsflt;swmsflt;C:\WINDOWS\system32\drivers\swmsflt.sys [2007-08-10 12:08]
S2 SsfdcPp;Parallel Port Ssfdc Programmer Driver;C:\WINDOWS\system32\DRIVERS\SsfdcPp.sys [2001-11-26 10:42]
S3 1784-PCIDS DeviceNet;1784-PCIDS DeviceNet;C:\Program Files\Rockwell Software\RSLogix Emulate 5000\PcidsService.exe [2007-04-18 11:18]
S3 ABKTCX;Rockwell Automation 1784-KTC(X) Driver;C:\WINDOWS\system32\Drivers\ABKTCX.sys [2000-05-31 20:13]
S3 EmuLogix 5868 Slot1;EmuLogix 5868 Slot1;C:\Program Files\Rockwell Software\RSLogix Emulate 5000\\V16\EmuLogix5868.exe [2007-04-18 11:13]
S3 EmuLogix 5868 Slot10;EmuLogix 5868 Slot10;C:\Program Files\Rockwell Software\RSLogix Emulate 5000\V15\EmuLogix5868.exe [2005-07-08 07:21]
S3 EmuLogix 5868 Slot11;EmuLogix 5868 Slot11;C:\Program Files\Rockwell Software\RSLogix Emulate 5000\V15\EmuLogix5868.exe [2005-07-08 07:21]
S3 EmuLogix 5868 Slot12;EmuLogix 5868 Slot12;C:\Program Files\Rockwell Software\RSLogix Emulate 5000\V15\EmuLogix5868.exe [2005-07-08 07:21]
S3 EmuLogix 5868 Slot13;EmuLogix 5868 Slot13;C:\Program Files\Rockwell Software\RSLogix Emulate 5000\V15\EmuLogix5868.exe [2005-07-08 07:21]
S3 EmuLogix 5868 Slot14;EmuLogix 5868 Slot14;C:\Program Files\Rockwell Software\RSLogix Emulate 5000\V15\EmuLogix5868.exe [2005-07-08 07:21]
S3 EmuLogix 5868 Slot15;EmuLogix 5868 Slot15;C:\Program Files\Rockwell Software\RSLogix Emulate 5000\V15\EmuLogix5868.exe [2005-07-08 07:21]
S3 EmuLogix 5868 Slot16;EmuLogix 5868 Slot16;C:\Program Files\Rockwell Software\RSLogix Emulate 5000\V15\EmuLogix5868.exe [2005-07-08 07:21]
S3 EmuLogix 5868 Slot2;EmuLogix 5868 Slot2;C:\Program Files\Rockwell Software\RSLogix Emulate 5000\V15\EmuLogix5868.exe [2005-07-08 07:21]
S3 EmuLogix 5868 Slot3;EmuLogix 5868 Slot3;C:\Program Files\Rockwell Software\RSLogix Emulate 5000\\V16\EmuLogix5868.exe [2007-04-18 11:13]
S3 EmuLogix 5868 Slot4;EmuLogix 5868 Slot4;C:\Program Files\Rockwell Software\RSLogix Emulate 5000\V15\EmuLogix5868.exe [2005-07-08 07:21]
S3 EmuLogix 5868 Slot5;EmuLogix 5868 Slot5;C:\Program Files\Rockwell Software\RSLogix Emulate 5000\V15\EmuLogix5868.exe [2005-07-08 07:21]
S3 EmuLogix 5868 Slot6;EmuLogix 5868 Slot6;C:\Program Files\Rockwell Software\RSLogix Emulate 5000\V15\EmuLogix5868.exe [2005-07-08 07:21]
S3 EmuLogix 5868 Slot7;EmuLogix 5868 Slot7;C:\Program Files\Rockwell Software\RSLogix Emulate 5000\V15\EmuLogix5868.exe [2005-07-08 07:21]
S3 EmuLogix 5868 Slot8;EmuLogix 5868 Slot8;C:\Program Files\Rockwell Software\RSLogix Emulate 5000\V15\EmuLogix5868.exe [2005-07-08 07:21]
S3 EmuLogix 5868 Slot9;EmuLogix 5868 Slot9;C:\Program Files\Rockwell Software\RSLogix Emulate 5000\V15\EmuLogix5868.exe [2005-07-08 07:21]
S3 IndraWorksService;IndraWorksService;C:\Program Files\Rexroth\IndraWorks\IndraWorks.Service.exe [2007-03-09 17:56]
S3 LogReceiver;LogReceiver;C:\Program Files\Rockwell Software\RSLinx Enterprise\LogReceiver.exe [2007-07-09 10:47]
S3 LVPrcMon;Logitech LVPrcMon Driver;C:\WINDOWS\system32\drivers\LVPrcMon.sys [2005-12-09 16:37]
S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys [2007-01-25 13:31]
S3 PccWdm;%PccWdm.DeviceDesc%;C:\WINDOWS\system32\DRIVERS\PccWdm.sys [2000-06-15 16:32]
S3 pcidnt;pcidnt;C:\WINDOWS\system32\Drivers\pcidnt.sys []
S3 RS_SS_NT;RSLinx Classic S-S SD/SD2 Device Driver;C:\WINDOWS\system32\RS_SS_NT.SYS [1999-11-10 09:27]
S3 RSI-PKTX-A;RSI-PKTX-A;C:\WINDOWS\system32\drivers\RSI-PKTX-A.SYS [2002-11-13 14:38]
S3 RsiKtControl;RsiKtControl;C:\WINDOWS\system32\RSIKT.SYS [2006-01-18 11:33]
S3 RSLINXNGKtControl;RSLINXNGKtControl;C:\WINDOWS\system32\drivers\RSIKTNG.SYS [2002-04-23 19:02]
S3 RSSERIAL;RSLinx Classic Serial Driver;C:\WINDOWS\system32\RSSERIAL.SYS [1999-05-11 14:48]
S3 SecureStorageService;SecureStorageService;C:\Program Files\Wave Systems Corp\Secure Storage Manager\SecureStorageService.exe [2007-01-29 22:59]
S3 SimModuleService;1789-SIM Simulator Module;C:\Program Files\Rockwell Software\RSLogix Emulate 5000\SimModuleService.exe [2007-04-18 10:44]
S3 usbprint;Microsoft USB PRINTER Class;C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-04 00:01]
S3 wcsccdrv;wcsccdrv.sys;C:\WINDOWS\system32\wcsccdrv.sys []
S3 XDva090;XDva090;C:\WINDOWS\system32\XDva090.sys []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7e7be643-42bf-11dd-b525-001c23b57395}]
\Shell\AutoRun\command - E:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9593d702-2287-11dd-b50a-001c23b57395}]
\Shell\AutoRun\command - E:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b646a840-9625-11dc-b490-0019b988769a}]
\Shell\AutoRun\command - D:\setupSNK.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ca4d10eb-0fb3-11dd-b4ff-001c23b57395}]
\Shell\AutoRun\command - E:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e50cc250-e8e2-11dc-b4da-0019b988769a}]
\Shell\AutoRun\command - E:\LaunchU3.exe -a
.
- - - - ORPHANS REMOVED - - - -

Notify-LMIinit - LMIinit.dll
MSConfigStartUp-LogitechVideo[inspector] - C:\Program Files\Logitech\Video\InstallHelper.exe


.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\Johnny Heng\Application Data\Mozilla\Firefox\Profiles\wprefmi8.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://purelandlotus.blogspot.com/
FF -: plugin - C:\Documents and Settings\All Users\Application Data\NexonUS\NGM\npNxGameUS.dll
FF -: plugin - C:\Documents and Settings\Johnny Heng\Application Data\Mozilla\Firefox\Profiles\wprefmi8.default\extensions\[email protected]\platform\WINNT_x86-msvc\plugins\npmnqmp07076007.dll
FF -: plugin - C:\Program Files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll
FF -: plugin - C:\Program Files\DivX\DivX Content Uploader\npUpload.dll
FF -: plugin - C:\Program Files\Google\Google Updater\2.2.1249.1854\npCIDetect11.dll
FF -: plugin - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
FF -: plugin - c:\Program Files\Microsoft Silverlight\2.0.30523.8\npctrl.dll
FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\npRACtrl.dll
FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\npViewpoint.dll
FF -: plugin - C:\Program Files\Real\RhapsodyPlayerEngine\nprhapengine.dll
FF -: plugin - C:\Program Files\Veoh Networks\Veoh\Plugins\noreg\NPVeohVersion.dll
FF -: plugin - C:\Program Files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-22 12:04:43
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\WINDOWS\system32\scardsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Rockwell Software\RSCommon\RSOBSERV.EXE
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Dell\QuickSet\NicConfigSvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\hpzipm12.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Common Files\Rockwell\RNADiagnosticsSrv.exe
C:\Program Files\Rockwell Software\RSView Enterprise\HMIDIAGNOSTICSLSTADAPT.exe
C:\PROGRA~1\ROCKWE~1\RSLINX\RSLINX.EXE
C:\Program Files\Common Files\Rockwell\RsvcHost.exe
C:\Program Files\Sprint\Sierra Wireless\Sprint PCS Connection Manager\SPCSUtilityService.exe
C:\WINDOWS\system32\stacsv.exe
C:\Program Files\NTRU Cryptosystems\NTRU TCG Software Stack\bin\tcsd_win32.exe
C:\Program Files\Intel\Wireless\Bin\WLKEEPER.exe
C:\Program Files\Common Files\Rockwell\EventClientMultiplexer.exe
C:\Program Files\Common Files\Rockwell\RnaDirServer.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Common Files\Rockwell\RNADirMultiplexor.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Apoint\ApMsgFwd.exe
C:\Program Files\Apoint\hidfind.exe
C:\Program Files\Apoint\ApntEx.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHSP.exe
C:\Program Files\Common Files\LogiShrd\LQCVFX\COCIManager.exe
C:\Program Files\MSN Messenger\usnsvc.exe
.
**************************************************************************
.
Completion time: 2008-08-22 12:15:54 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-22 16:15:45

Pre-Run: 7,484,940,288 bytes free
Post-Run: 7,314,436,096 bytes free

446 --- E O F --- 2008-08-14 08:04:53


----------------------------------------------------------------------------------------------------------------
HijackThis log

alonLogfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:26:06, on 8/22/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Rockwell\EventServer.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Rockwell Software\RSCommon\RSOBSERV.EXE
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\Program Files\Common Files\Rockwell\NmspHost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\Hilscher\ODMV3\ODMV3.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\Common Files\Rockwell\RdcyHost.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Common Files\Rockwell\RNADiagnosticsSrv.exe
C:\Program Files\Rockwell Software\RSView Enterprise\HMIDIAGNOSTICSLSTADAPT.exe
C:\PROGRA~1\ROCKWE~1\RSLinx\RSLINX.EXE
C:\Program Files\Common Files\Rockwell\RsvcHost.exe
C:\Program Files\Sprint\Sierra Wireless\Sprint PCS Connection Manager\SPCSUtilityService.exe
C:\WINDOWS\system32\StacSV.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\Program Files\Rexroth\IndraLogic\ENI Server\ENI.exe
C:\Program Files\Common Files\Rockwell\EventClientMultiplexer.exe
C:\Program Files\Common Files\Rockwell\RnaDirServer.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Common Files\Rockwell\RNADirMultiplexor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe
C:\WINDOWS\system32\KADxMain.exe
C:\Program Files\Apoint\ApMsgFwd.exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\Program Files\Apoint\HidFind.exe
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Rockwell Automation\Rockwell Automation USB CIP Driver Package\UsbCipHelper\UsbCipHelper.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Rexroth\IndraLogic\ENI Server\ENISysTray.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\Logitech\QuickCam\Quickcam.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\FTSvrMgr.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Eraser\eraser.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=0071015
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,Start
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [Document Manager] C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe
O4 - HKLM\..\Run: [KADxMain] C:\WINDOWS\system32\KADxMain.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [UsbCipHelper] C:\Program Files\Rockwell Automation\Rockwell Automation USB CIP Driver Package\UsbCipHelper\UsbCipHelper.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [ENISysTray] "C:\Program Files\Rexroth\IndraLogic\ENI Server\ENISysTray.exe"
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [FTSvrMgr] C:\WINDOWS\system32\FTSvrMgr.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Eraser] C:\Program Files\Eraser\eraser.exe -hide
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O4 - Startup: Workrave.lnk = C:\Program Files\Workrave\lib\Workrave.exe
O4 - Global Startup: Bluetooth Manager.lnk = ?
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\Office12\REFIEBAR.DLL
O9 - Extra button: PPLive - {95B3F550-91C4-4627-BCC4-521288C52977} - C:\Program Files\PPLive\PPLive.exe
O9 - Extra 'Tools' menuitem: PPLive - {95B3F550-91C4-4627-BCC4-521288C52977} - C:\Program Files\PPLive\PPLive.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00134F72-5284-44F7-95A8-52A619F70751} (ObjWinNTCheck Class) - https://192.168.254....ll/WinNTChk.cab
O16 - DPF: {08D75BB0-D2B5-11D1-88FC-0080C859833B} (OfficeScan Corp Edition Web-Deployment SetupINICtrl Class) - https://192.168.254....ll/setupini.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zon...kr.cab56986.cab
O16 - DPF: {254AA86E-5655-4518-AA87-185D7CC41801} (LogMeIn Rescue Technician Console) - https://secure.logme...scueControl.cab
O16 - DPF: {3D3BF1F8-9696-4A5E-B4F1-49101C997B70} (VaxSIPUserAgentCAB Control) - http://labs.jaduka.c...serAgentCAB.cab
O16 - DPF: {5EFE8CB1-D095-11D1-88FC-0080C859833B} (OfficeScan Corp Edition Web-Deployment ObjRemoveCtrl Class) - https://192.168.254..../RemoveCtrl.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) -

[Rorschach112]

Hello

Now we need to reconfigure Windows XP to show hidden files:
Double-click the My Computer icon on the Windows desktop.
Select the Tools menu and click Folder Options. Select the View Tab.

Under the Hidden files and folders heading select "Show hidden files and folders".
Uncheck the "Hide protected operating system files (recommended)" option.
Uncheck the "Hide file extensions for known file types" option.
Click Yes to confirm. Click OK.

• Make sure to use Internet Explorer for this
• Please go to VirSCAN.org FREE on-line scan service
• Copy and paste the following file path into the "Suspicious files to scan" box on the top of the page:
  
  
  • C:\Documents and Settings\Johnny Heng\intelOP.exe
    
• Click on the Upload button
• Once the Scan is completed, click on the "Copy to Clipboard" button. This will copy the link of the report into the Clipboard.
• Paste the contents of the Clipboard in your next reply.

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the quotebox below into it:

File::

Folder::

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7e7be643-42bf-11dd-b525-001c23b57395}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9593d702-2287-11dd-b50a-001c23b57395}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b646a840-9625-11dc-b490-0019b988769a}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ca4d10eb-0fb3-11dd-b4ff-001c23b57395}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e50cc250-e8e2-11dc-b4da-0019b988769a}]

Driver::

Save this as CFScript.txt, in the same location as ComboFix.exe




Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.




Also post a new HJT log

[AmazingTrans]

Virus scan logs
VirSCAN.org Scanned Report :
Scanned time : 2008/08/22 11:41:33 (CDT)
Scanner results: All Scanners reported not find malware!
File Name : intelOP.exe
File Size : 134144 byte
File Type : PE32 executable for MS Windows (GUI) Intel 80386 32-bit
MD5 : 2bfed385f7b9967b221d688eff2f7036
SHA1 : 893b0d1fa6bb4640eda0e298bb9c6894cad129fc
Online report : http://virscan.org/r...634224f6d4.html

Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 3.5.0.22 2008.08.21 2008-08-21 2.45 -
AhnLab V3 2008.08.23.00 2008.08.23 2008-08-23 0.90 -
AntiVir 7.8.1.23 7.0.6.58 2008-08-22 2.22 -
Arcavir 1.0.5 200808211436 2008-08-21 1.21 -
AVAST! 3.0.1 080822-0 2008-08-22 0.01 -
AVG 7.5.51.442 270.6.6/1627 2008-08-22 1.54 -
BitDefender 7.60825.1571811 7.20626 2008-08-22 2.83 -
CA (VET) 9.0.0.143 31.6.6040 2008-08-22 5.42 -
ClamAV 0.93.3 8073 2008-08-22 0.04 -
Comodo 2.11 2.0.0.624 2008-08-22 0.43 -
CP Secure 1.1.0.715 2008.08.21 2008-08-21 6.24 -
Dr.Web 4.44.0.9170 2008.08.22 2008-08-22 3.12 -
ewido 4.0.0.2 2008.08.22 2008-08-22 2.80 -
F-Prot 4.4.4.56 20080821 2008-08-21 1.00 -
F-Secure 5.51.6100 2008.08.22.05 2008-08-22 3.08 -
Fortinet 2.81-3.11 9.460 2008-08-22 1.79 -
ViRobot 20080822 2008.08.22 2008-08-22 0.39 -
Ikarus T3.1.01.34 2008.08.22.71323 2008-08-22 3.47 -
JiangMin 11.0.706 2008.08.22 2008-08-22 1.29 -
Kaspersky 5.5.10 2008.08.22 2008-08-22 0.04 -
KingSoft 2008.1.14.15 2008.8.22.17 2008-08-22 0.58 -
McAfee 5.2.00 5367 2008-08-21 2.58 -
Microsoft 1.3807 2008.08.22 2008-08-22 4.32 -
mks_vir 2.01 2008.08.19 2008-08-19 2.65 -
Norman 5.93.01 5.93.00 2008-08-21 4.84 -
Panda 9.05.01 2008.08.22 2008-08-22 2.10 -
Trend Micro 8.700-1004 5.494.10 2008-08-22 0.03 -
Quick Heal 9.50 2008.08.21 2008-08-21 1.75 -
Rising 20.0 20.58.42.00 2008-08-22 0.76 -
Sophos 2.77.0 4.32 2008-08-22 1.96 -
Sunbelt 3.1.1571.1 2200 2008-08-21 0.42 -
Symantec 1.3.0.24 20080821.017 2008-08-21 0.05 -
nProtect 2008-08-22.00 1909009 2008-08-22 5.27 -
The Hacker 6.3.0.6 v00058 2008-08-21 0.41 -
VBA32 3.12.8.4 20080822.0823 2008-08-22 1.11 -
VirusBuster 4.5.11.10 10.84.8/598408 2008-08-22 1.12 -

ComboFix Logs
ComboFix 08-08-21.02 - Johnny Heng 2008-08-22 12:46:52.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1146 [GMT -4:00]
Running from: C:\ComboFix.exe
Command switches used :: C:\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-07-22 to 2008-08-22 )))))))))))))))))))))))))))))))
.

2008-08-22 11:13 . 2008-08-22 11:14 <DIR> d-------- C:\WINDOWS\ERUNT
2008-08-22 11:13 . 2008-08-22 11:50 <DIR> d-------- C:\sdfix
2008-08-22 11:00 . 2008-08-22 11:01 2,720,466 -ra------ C:\ComboFix.exe
2008-08-22 10:58 . 2008-08-22 11:13 <DIR> d-------- C:\Documents and Settings\Johnny Heng\%systemdrive%
2008-08-22 02:10 . 2008-08-22 02:10 <DIR> d-------- C:\smitfraud
2008-08-22 01:16 . 2008-08-22 02:10 5,150 --a------ C:\WINDOWS\system32\tmp.reg
2008-08-22 01:13 . 2008-08-22 02:11 <DIR> d-------- C:\Documents and Settings\Johnny Heng\SmitfraudFix
2008-08-22 01:05 . 2008-08-22 01:06 <DIR> d-------- C:\bfu
2008-08-21 23:25 . 2008-08-21 23:25 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-08-21 23:25 . 2008-08-21 23:25 <DIR> d-------- C:\Documents and Settings\Johnny Heng\Application Data\Malwarebytes
2008-08-21 23:25 . 2008-08-21 23:25 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-21 23:25 . 2008-08-17 15:01 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-08-21 23:25 . 2008-08-17 15:01 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-08-21 23:23 . 2008-08-21 23:23 <DIR> d-------- C:\Program Files\Common Files\Download Manager
2008-08-21 23:20 . 2008-08-21 23:20 <DIR> d-------- C:\Program Files\ERUNT
2008-08-21 23:11 . 2008-08-21 23:11 <DIR> d-------- C:\Program Files\Trend Micro
2008-08-21 22:57 . 2008-08-22 05:31 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\services
2008-08-21 22:55 . 2008-08-21 22:55 147,456 ---hs---- C:\Documents and Settings\Johnny Heng\ppxcs.exe
2008-08-21 22:55 . 2008-08-21 22:55 134,144 ---hs---- C:\Documents and Settings\Johnny Heng\intelOP.exe
2008-08-21 22:55 . 2008-08-21 22:55 103,936 ---hs---- C:\Documents and Settings\Johnny Heng\sccs.exe
2008-08-21 22:55 . 2008-08-21 22:55 103,424 ---hs---- C:\Documents and Settings\Johnny Heng\css.exe
2008-08-21 22:55 . 2008-08-21 22:55 69,632 ---hs---- C:\Documents and Settings\Johnny Heng\MediaTubeCodec_ver1.1463.0.exe
2008-08-20 09:42 . 2008-08-20 09:45 <DIR> d-------- C:\Work
2008-08-19 11:19 . 2008-08-19 11:19 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-08-16 21:22 . 2008-08-16 21:30 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\PPLive
2008-08-16 21:22 . 2008-08-16 21:22 1,073,741,824 --a------ C:\pfsvoddata.bbv
2008-08-13 19:01 . 2008-05-01 10:30 331,776 --------- C:\WINDOWS\system32\dllcache\msadce.dll
2008-08-08 19:26 . 2008-08-08 19:26 <DIR> d-------- C:\WINDOWS\system32\PPLive
2008-08-08 17:46 . 2008-08-08 17:48 <DIR> d-------- C:\Documents and Settings\Johnny Heng\Application Data\PPLive
2008-08-08 17:45 . 2008-08-16 21:47 <DIR> d-------- C:\Program Files\PPLive
2008-08-08 10:41 . 2008-08-08 10:41 <DIR> d-------- C:\Program Files\Microsoft Silverlight
2008-07-31 16:47 . 2008-07-31 16:47 <DIR> d-------- C:\Program Files\Workrave
2008-07-31 16:47 . 2008-08-01 04:00 <DIR> d-------- C:\Documents and Settings\Johnny Heng\Application Data\Workrave
2008-07-29 16:48 . 2008-07-29 16:48 227 --a------ C:\WINDOWS\SlRegEDS.ini
2008-07-27 22:31 . 2008-07-27 22:31 <DIR> d-------- C:\Program Files\AnVir Task Manager
2008-07-22 00:04 . 2008-07-22 00:04 <DIR> d-------- C:\docs

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-22 16:35 --------- d-----w C:\Program Files\Mozilla Thunderbird
2008-08-22 16:12 --------- d-----w C:\Documents and Settings\Johnny Heng\Application Data\OpenOffice.org2
2008-08-22 14:53 --------- d-----w C:\Documents and Settings\Johnny Heng\Application Data\Skype
2008-08-22 14:06 --------- d-----w C:\Documents and Settings\Johnny Heng\Application Data\skypePM
2008-08-22 05:31 --------- d-----w C:\Documents and Settings\Johnny Heng\Application Data\Hamachi
2008-08-22 05:02 --------- d-----w C:\Documents and Settings\Johnny Heng\Application Data\Wave Systems Corp
2008-08-22 03:35 --------- d-----w C:\Documents and Settings\Johnny Heng\Application Data\AVG7
2008-08-21 05:14 --------- d-----w C:\Documents and Settings\Johnny Heng\Application Data\uTorrent
2008-08-20 13:23 --------- d-----w C:\Program Files\Hamachi
2008-08-20 13:22 25,280 ----a-w C:\WINDOWS\system32\drivers\hamachi.sys
2008-08-19 18:41 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater
2008-08-19 17:42 --------- d-----w C:\Program Files\Common Files\Rockwell
2008-08-19 16:45 --------- d-----w C:\Program Files\ProSoft Technology Inc
2008-08-19 16:45 --------- d-----w C:\Program Files\Common Files\Hilscher
2008-08-19 15:26 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-08-19 15:21 --------- d-----w C:\Program Files\Lavasoft
2008-08-10 01:02 --------- d-----w C:\Documents and Settings\Johnny.ENGINEER_BISHOP\Application Data\Wave Systems Corp
2008-08-09 14:09 --------- d-----w C:\Documents and Settings\Johnny.ENGINEER_BISHOP\Application Data\AVG7
2008-08-08 21:45 --------- d-----w C:\Program Files\MSN Messenger
2008-07-31 02:44 --------- d-----w C:\Program Files\Google
2008-07-29 20:48 --------- d-----w C:\Program Files\Rockwell Software
2008-07-26 20:46 --------- d-----w C:\Program Files\uTorrent
2008-07-24 16:58 --------- d-----w C:\Program Files\NeatReceipts Professional
2008-07-24 16:58 --------- d-----w C:\Documents and Settings\All Users\Application Data\NeatReceipts Professional
2008-07-24 16:57 --------- d-----w C:\Program Files\Common Files\NeatReceipts
2008-07-24 16:56 --------- d-----w C:\Program Files\Microsoft SQL Server
2008-07-24 16:54 --------- d-----w C:\Program Files\Microsoft.NET
2008-07-23 20:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\FLEXnet
2008-07-20 23:15 --------- d-----w C:\Documents and Settings\Johnny Heng\Application Data\ScanSoft
2008-07-20 23:13 --------- d-----w C:\Program Files\Skype
2008-07-20 23:13 --------- d-----w C:\Program Files\Common Files\Skype
2008-07-20 23:09 --------- d-----w C:\Documents and Settings\All Users\Application Data\ScanSoft
2008-07-19 04:20 --------- d-----w C:\Documents and Settings\Johnny Heng\Application Data\LogMeIn Rescue
2008-07-18 23:25 --------- d-----w C:\Program Files\WMR11
2008-07-18 23:25 --------- d-----w C:\Program Files\Free WMA to MP3 Converter
2008-07-17 19:50 --------- d-----w C:\Program Files\Allen-Bradley
2008-07-17 19:48 1,712 ----a-w C:\WINDOWS\system32\Rsvchost.reg
2008-07-17 19:48 1,678 ----a-w C:\WINDOWS\system32\RdcyReg.reg
2008-07-17 15:28 --------- d-----w C:\Program Files\GLOBEtrotter Software Inc
2008-07-17 01:24 --------- d-----w C:\Program Files\MSECACHE
2008-07-17 01:22 --------- d-----w C:\Program Files\Windows Installer Clean Up
2008-07-17 00:27 --------- d-----w C:\Program Files\Common Files\Rexroth
2008-07-17 00:26 --------- d-----w C:\Program Files\Rexroth
2008-07-17 00:26 --------- d-----w C:\Documents and Settings\All Users\Application Data\Rexroth
2008-07-16 20:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\Rockwell
2008-07-16 15:11 30,720 ----a-w C:\WINDOWS\system32\REGTLIB.exe
2008-07-13 16:52 --------- d-----w C:\Documents and Settings\Johnny Heng\Application Data\U3
2008-07-12 22:35 --------- d-----w C:\Documents and Settings\Johnny Heng\Application Data\Bosch Rexroth AG
2008-07-12 12:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\Macrovision
2008-07-11 20:10 6,656 ----a-w C:\WINDOWS\system32\haspvdd.dll
2008-07-11 20:10 47,616 ----a-w C:\WINDOWS\system32\drivers\Haspnt.sys
2008-07-11 20:09 --------- d-----w C:\Documents and Settings\All Users\Application Data\WFCU
2008-07-11 13:10 --------- d-----w C:\Documents and Settings\Johnny Heng\Application Data\VoipCheapCom
2008-07-07 20:32 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-07-07 20:32 253,952 ------w C:\WINDOWS\system32\dllcache\es.dll
2008-07-04 14:26 --------- d-----w C:\Program Files\UltraVNC
2008-07-02 13:18 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-02 04:09 --------- d-----w C:\Documents and Settings\All Users\Application Data\NexonUS
2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
2008-06-24 16:23 74,240 ------w C:\WINDOWS\system32\dllcache\mscms.dll
2008-06-24 15:57 3,592,192 ------w C:\WINDOWS\system32\dllcache\mshtml.dll
2008-06-23 09:20 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe
2008-06-23 09:20 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe
2008-06-23 09:20 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-06-21 05:23 161,792 ------w C:\WINDOWS\system32\dllcache\ieakui.dll
2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 17:41 245,248 ------w C:\WINDOWS\system32\dllcache\mswsock.dll
2008-06-20 17:41 148,992 ----a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\dllcache\tcpip.sys
2008-06-20 10:44 138,368 ------w C:\WINDOWS\system32\dllcache\afd.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\dllcache\tcpip6.sys
2008-06-15 19:03 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-06-14 01:22 50,887 ----a-w C:\Program Files\downloads.php.html
2008-06-13 13:10 272,128 ------w C:\WINDOWS\system32\dllcache\bthport.sys
2008-06-04 20:57 906,960 ----a-w C:\Program Files\Google Updater.exe
2008-02-19 01:11 5,363,496 ----a-w C:\Program Files\TRACTION_In-Game_Radio_Player_K2_setup.exe
2008-02-09 16:39 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
2008-02-07 22:30 12,448 ----a-w C:\Program Files\0clc
2007-04-17 01:49 5,812,653 ----a-w C:\Program Files\mapcontacts.exe
2005-11-15 02:01 532,480 ----a-w C:\Program Files\cwshredder.exe
2008-02-28 19:30 8,784 ----a-w C:\Program Files\mozilla firefox\plugins\ractrlkeyhook.dll
2008-02-28 19:33 245,408 ----a-w C:\Program Files\mozilla firefox\plugins\unicows.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-06-10 23:02 68856]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 13:54 5674352]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 06:00 15360]
"Eraser"="C:\Program Files\Eraser\eraser.exe" [2007-07-28 17:05 277328]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [2007-04-15 22:49 159744]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-05-31 16:50 8429568]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [2007-07-25 17:32 823296]
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2007-07-25 17:30 974848]
"Document Manager"="C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe" [2007-01-30 16:32 102400]
"KADxMain"="C:\WINDOWS\system32\KADxMain.exe" [2006-11-02 15:05 282624]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 17:50 221184]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 06:00 208952]
"IMEKRMIG6.1"="C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE" [2004-08-04 06:00 44032]
"MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 06:00 59392]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 06:00 455168]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 06:00 455168]
"googletalk"="C:\Program Files\Google\Google Talk\googletalk.exe" [2007-01-01 17:22 3739648]
"Acrobat Assistant 8.0"="C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2008-01-11 20:54 623992]
"UsbCipHelper"="C:\Program Files\Rockwell Automation\Rockwell Automation USB CIP Driver Package\UsbCipHelper\UsbCipHelper.exe" [2006-09-28 18:25 434176]
"ENISysTray"="C:\Program Files\Rexroth\IndraLogic\ENI Server\ENISysTray.exe" [2007-01-23 08:12 712704]
"LogMeIn GUI"="C:\Program Files\LogMeIn\x86\LogMeInSystray.exe" [2007-08-03 16:09 63048]
"LogitechCommunicationsManager"="C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-10-25 16:33 563984]
"LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam\Quickcam.exe" [2007-10-25 16:37 2178832]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-04-22 12:11 579584]
"FTSvrMgr"="C:\WINDOWS\system32\FTSvrMgr.exe" [2003-03-20 13:07 32768]
"Dell QuickSet"="C:\Program Files\Dell\QuickSet\quickset.exe" [2007-05-14 15:23 1191936]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-03-29 00:37 413696]
"nwiz"="nwiz.exe" [2007-05-31 16:50 1626112 C:\WINDOWS\system32\nwiz.exe]
"NVHotkey"="nvHotkey.dll" [2007-05-31 16:50 67584 C:\WINDOWS\system32\nvhotkey.dll]
"NvMediaCenter"="NvMCTray.dll" [2007-05-31 16:50 81920 C:\WINDOWS\system32\nvmctray.dll]
"SigmatelSysTrayApp"="stsystra.exe" [2007-02-19 00:26 303104 C:\WINDOWS\stsystra.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-04-02 16:43 219136]

C:\Documents and Settings\Johnny Heng\Start Menu\Programs\Startup\
OpenOffice.org 2.4.lnk - C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe [2008-01-21 16:41:28 393216]
Workrave.lnk - C:\Program Files\Workrave\lib\Workrave.exe [2007-09-14 22:23:03 2925568]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Bluetooth Manager.lnk - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2007-01-11 21:43:46 2150400]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"SENTINEL"= snti386.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 wvauth

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dllschannel.dlldigest.dllmsnsspc.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
backup=C:\WINDOWS\pss\Digital Line Detect.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
--a------ 2007-10-15 16:13 1862144 C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
--a------ 2004-07-27 17:50 81920 C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Orb]
--a------ 2008-03-24 22:59 507904 C:\Program Files\Winamp Remote\bin\OrbTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDVDDXSrv]
--------- 2006-10-20 18:23 118784 C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-03-29 00:37 413696 C:\Program Files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxioDragToDisc]
--a------ 2006-08-17 10:00 1116920 C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SecureUpgrade]
--a------ 2007-01-22 12:53 212992 C:\Program Files\Wave Systems Corp\SecureUpgrade.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2008-05-03 01:32 185896 C:\Program Files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Rockwell Software\\RSLogix 5000\\ENU\\v16\\Bin\\RS5000.Exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
"C:\\WINDOWS\\system32\\OpcEnum.exe"=
"C:\\Program Files\\Rockwell Software\\RSLINX\\RSLINX.EXE"=
"C:\\Program Files\\Rockwell Software\\OPCTools\\OPCTest\\opctest.exe"=
"C:\\Program Files\\Common Files\\Rockwell\\EventClientMultiplexer.exe"=
"C:\\Program Files\\Common Files\\Rockwell\\RsvcHost.exe"=
"C:\\Program Files\\Common Files\\Rockwell\\RnaDirServer.exe"=
"C:\\Program Files\\Common Files\\Rockwell\\EventServer.exe"=
"C:\\Program Files\\Common Files\\Rockwell\\DaClient.exe"=
"C:\\Program Files\\Common Files\\Rockwell\\RNADiagReceiver.exe"=
"C:\\Program Files\\Common Files\\Rockwell\\RNADiagnosticsSrv.exe"=
"C:\\Program Files\\Common Files\\Rockwell\\VStudio.exe"=
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"C:\\Program Files\\Rockwell Software\\RSLinx Enterprise\\RSLinxNG.exe"=
"C:\\Program Files\\Rockwell Software\\RSLinx Enterprise\\RSLinxShortcutAOA.exe"=
"C:\\Program Files\\Rockwell Software\\RSView\\sptddssv32.exe"=
"C:\\Program Files\\Rockwell Software\\RSView\\SptFTServer.exe"=
"C:\\Program Files\\Rockwell Software\\RSView\\sptddeex32.exe"=
"C:\\Program Files\\Rockwell Software\\RDM\\Cmeopc32.exe"=
"C:\\Program Files\\Common Files\\Rockwell\\RSViewLogServer.exe"=
"C:\\Program Files\\Common Files\\Rockwell\\RSVWHist.exe"=
"C:\\WINDOWS\\system32\\netdde.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Jaman Player\\jamdownloader.exe"=
"C:\\Program Files\\Jaman Player\\jaman-updater.exe"=
"C:\\Program Files\\Rexroth\\IndraWorks\\DDP.EngineeringDesktop.exe"=
"C:\\Program Files\\Rexroth\\IndraWorks\\Drive\\Offline\\DriveServer_MPB03vrs.exe"=
"C:\\Program Files\\Rexroth\\IndraWorks\\Drive\\Offline\\DriveServer_MPD03vrs.exe"=
"C:\\Program Files\\Rexroth\\IndraWorks\\Drive\\Offline\\DriveServer_MPH03vrs.exe"=
"C:\\WINDOWS\\system32\\Gateway.exe"=
"C:\\Program Files\\Rexroth\\IndraWorks\\Drive\\Offline\\DriveServer_MPB04vrs.exe"=
"C:\\Program Files\\Rexroth\\IndraWorks\\Drive\\Offline\\DriveServer_MPD04vrs.exe"=
"C:\\Program Files\\Rexroth\\IndraWorks\\Drive\\Offline\\DriveServer_MPH04vrs.exe"=
"C:\\Program Files\\Winamp Remote\\bin\\Orb.exe"=
"C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"=
"C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Documents and Settings\\All Users\\Application Data\\NexonUS\\NGM\\NGM.exe"=
"C:\Nexon\Combat Arms\CombatArms.exe"= C:\Nexon\Combat Arms\CombatArms.exe:*Enabled:CombatArms.exe
"C:\Nexon\Combat Arms\Engine.exe"= C:\Nexon\Combat Arms\Engine.exe:*Enabled:Engine.exe
"C:\\Nexon\\Combat Arms\\NMService.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Common Files\\Rockwell\\RdcyHost.exe"=
"C:\\Program Files\\Common Files\\Rockwell\\NmspHost.exe"=
"C:\\Program Files\\Rexroth\\IndraWorks\\PDA.Server.exe"=
"C:\\Program Files\\Rexroth\\IndraWorks\\SCPServer.exe"=
"C:\\Program Files\\Rexroth\\IndraWorks\\Drive\\Offline\\DriveServer_MPB05vrs.exe"=
"C:\\Program Files\\Rexroth\\IndraWorks\\Drive\\Offline\\DriveServer_MPD05vrs.exe"=
"C:\\Program Files\\Rexroth\\IndraWorks\\Drive\\Offline\\DriveServer_MPH05vrs.exe"=
"C:\\Program Files\\Common Files\\Rockwell\\countermonitor.exe"=
"C:\\Program Files\\Rockwell Software\\RSView Enterprise\\MERuntime.exe"=
"C:\\Program Files\\Rockwell Software\\RSView Enterprise\\TagSrv.exe"=
"C:\\Program Files\\PPLive\\PPLive.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"135:TCP"= 135:TCP:Port135
"10504:TCP"= 10504:TCP:BitComet 10504 TCP
"10504:UDP"= 10504:UDP:BitComet 10504 UDP

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R0 PBADRV;PBADRV;C:\WINDOWS\system32\DRIVERS\PBADRV.sys [2006-08-28 16:00]
R1 DLARTL_M;DLARTL_M;C:\WINDOWS\system32\Drivers\DLARTL_M.SYS [2006-08-11 11:35]
R1 VirtualBackplane;A-B Virtual Backplane;C:\WINDOWS\system32\drivers\VirtualBackplane.sys [2007-04-18 10:32]
R2 ASFIPmon;Broadcom ASF IP and SMBIOS Mailbox Monitor;C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe [2006-12-19 15:21]
R2 ENI Server;ENI Server;C:\Program Files\Rexroth\IndraLogic\ENI Server\ENI.exe [2007-01-23 08:00]
R2 LMIInfo;LogMeIn Kernel Information Provider;C:\Program Files\LogMeIn\x86\RaInfo.sys [2007-08-03 16:09]
R2 LMIRfsDriver;LogMeIn Remote File System Driver;C:\WINDOWS\system32\drivers\LMIRfsDriver.sys [2007-08-03 16:09]
R2 NmspHost;Rockwell Namespace Services;C:\Program Files\Common Files\Rockwell\NmspHost.exe [2007-09-18 00:57]
R2 ODMV3;ODM V3;C:\Program Files\Common Files\Hilscher\ODMV3\ODMV3.exe [2007-09-21 16:22]
R2 RdcyHost;Rockwell Redundancy Services;C:\Program Files\Common Files\Rockwell\RdcyHost.exe [2007-09-18 00:57]
R2 Viewpoint Manager Service;Viewpoint Manager Service;C:\Program Files\Viewpoint\Common\ViewpointService.exe [2007-01-04 17:38]
R2 vnccom;vnccom;C:\WINDOWS\system32\Drivers\vnccom.SYS [2004-06-26 13:22]
R2 Wave UCSPlus;Wave UCSPlus;C:\WINDOWS\system32\dllhost.exe [2004-08-04 06:00]
R3 DXEC01;DXEC01;C:\WINDOWS\system32\drivers\dxec01.sys [2006-11-02 13:32]
R3 EventServer;Rockwell Event Server;C:\Program Files\Common Files\Rockwell\EventServer.exe [2007-09-17 23:36]
R3 swmsflt;swmsflt;C:\WINDOWS\system32\drivers\swmsflt.sys [2007-08-10 12:08]
S2 SsfdcPp;Parallel Port Ssfdc Programmer Driver;C:\WINDOWS\system32\DRIVERS\SsfdcPp.sys [2001-11-26 10:42]
S3 1784-PCIDS DeviceNet;1784-PCIDS DeviceNet;C:\Program Files\Rockwell Software\RSLogix Emulate 5000\PcidsService.exe [2007-04-18 11:18]
S3 ABKTCX;Rockwell Automation 1784-KTC(X) Driver;C:\WINDOWS\system32\Drivers\ABKTCX.sys [2000-05-31 20:13]
S3 EmuLogix 5868 Slot1;EmuLogix 5868 Slot1;C:\Program Files\Rockwell Software\RSLogix Emulate 5000\\V16\EmuLogix5868.exe [2007-04-18 11:13]
S3 EmuLogix 5868 Slot10;EmuLogix 5868 Slot10;C:\Program Files\Rockwell Software\RSLogix Emulate 5000\V15\EmuLogix5868.exe [2005-07-08 07:21]
S3 EmuLogix 5868 Slot11;EmuLogix 5868 Slot11;C:\Program Files\Rockwell Software\RSLogix Emulate 5000\V15\EmuLogix5868.exe [2005-07-08 07:21]
S3 EmuLogix 5868 Slot12;EmuLogix 5868 Slot12;C:\Program Files\Rockwell Software\RSLogix Emulate 5000\V15\EmuLogix5868.exe [2005-07-08 07:21]
S3 EmuLogix 5868 Slot13;EmuLogix 5868 Slot13;C:\Program Files\Rockwell Software\RSLogix Emulate 5000\V15\EmuLogix5868.exe [2005-07-08 07:21]
S3 EmuLogix 5868 Slot14;EmuLogix 5868 Slot14;C:\Program Files\Rockwell Software\RSLogix Emulate 5000\V15\EmuLogix5868.exe [2005-07-08 07:21]
S3 EmuLogix 5868 Slot15;EmuLogix 5868 Slot15;C:\Program Files\Rockwell Software\RSLogix Emulate 5000\V15\EmuLogix5868.exe [2005-07-08 07:21]
S3 EmuLogix 5868 Slot16;EmuLogix 5868 Slot16;C:\Program Files\Rockwell Software\RSLogix Emulate 5000\V15\EmuLogix5868.exe [2005-07-08 07:21]
S3 EmuLogix 5868 Slot2;EmuLogix 5868 Slot2;C:\Program Files\Rockwell Software\RSLogix Emulate 5000\V15\EmuLogix5868.exe [2005-07-08 07:21]
S3 EmuLogix 5868 Slot3;EmuLogix 5868 Slot3;C:\Program Files\Rockwell Software\RSLogix Emulate 5000\\V16\EmuLogix5868.exe [2007-04-18 11:13]
S3 EmuLogix 5868 Slot4;EmuLogix 5868 Slot4;C:\Program Files\Rockwell Software\RSLogix Emulate 5000\V15\EmuLogix5868.exe [2005-07-08 07:21]
S3 EmuLogix 5868 Slot5;EmuLogix 5868 Slot5;C:\Program Files\Rockwell Software\RSLogix Emulate 5000\V15\EmuLogix5868.exe [2005-07-08 07:21]
S3 EmuLogix 5868 Slot6;EmuLogix 5868 Slot6;C:\Program Files\Rockwell Software\RSLogix Emulate 5000\V15\EmuLogix5868.exe [2005-07-08 07:21]
S3 EmuLogix 5868 Slot7;EmuLogix 5868 Slot7;C:\Program Files\Rockwell Software\RSLogix Emulate 5000\V15\EmuLogix5868.exe [2005-07-08 07:21]
S3 EmuLogix 5868 Slot8;EmuLogix 5868 Slot8;C:\Program Files\Rockwell Software\RSLogix Emulate 5000\V15\EmuLogix5868.exe [2005-07-08 07:21]
S3 EmuLogix 5868 Slot9;EmuLogix 5868 Slot9;C:\Program Files\Rockwell Software\RSLogix Emulate 5000\V15\EmuLogix5868.exe [2005-07-08 07:21]
S3 IndraWorksService;IndraWorksService;C:\Program Files\Rexroth\IndraWorks\IndraWorks.Service.exe [2007-03-09 17:56]
S3 LogReceiver;LogReceiver;C:\Program Files\Rockwell Software\RSLinx Enterprise\LogReceiver.exe [2007-07-09 10:47]
S3 LVPrcMon;Logitech LVPrcMon Driver;C:\WINDOWS\system32\drivers\LVPrcMon.sys [2005-12-09 16:37]
S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys [2007-01-25 13:31]
S3 PccWdm;%PccWdm.DeviceDesc%;C:\WINDOWS\system32\DRIVERS\PccWdm.sys [2000-06-15 16:32]
S3 pcidnt;pcidnt;C:\WINDOWS\system32\Drivers\pcidnt.sys []
S3 RS_SS_NT;RSLinx Classic S-S SD/SD2 Device Driver;C:\WINDOWS\system32\RS_SS_NT.SYS [1999-11-10 09:27]
S3 RSI-PKTX-A;RSI-PKTX-A;C:\WINDOWS\system32\drivers\RSI-PKTX-A.SYS [2002-11-13 14:38]
S3 RsiKtControl;RsiKtControl;C:\WINDOWS\system32\RSIKT.SYS [2006-01-18 11:33]
S3 RSLINXNGKtControl;RSLINXNGKtControl;C:\WINDOWS\system32\drivers\RSIKTNG.SYS [2002-04-23 19:02]
S3 RSSERIAL;RSLinx Classic Serial Driver;C:\WINDOWS\system32\RSSERIAL.SYS [1999-05-11 14:48]
S3 SecureStorageService;SecureStorageService;C:\Program Files\Wave Systems Corp\Secure Storage Manager\SecureStorageService.exe [2007-01-29 22:59]
S3 SimModuleService;1789-SIM Simulator Module;C:\Program Files\Rockwell Software\RSLogix Emulate 5000\SimModuleService.exe [2007-04-18 10:44]
S3 usbprint;Microsoft USB PRINTER Class;C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-04 00:01]
S3 wcsccdrv;wcsccdrv.sys;C:\WINDOWS\system32\wcsccdrv.sys []
S3 XDva090;XDva090;C:\WINDOWS\system32\XDva090.sys []
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-22 13:00:31
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\WINDOWS\system32\scardsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Rockwell Software\RSCommon\RSOBSERV.EXE
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Dell\QuickSet\NicConfigSvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\hpzipm12.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Common Files\Rockwell\RNADiagnosticsSrv.exe
C:\Program Files\Rockwell Software\RSView Enterprise\HMIDIAGNOSTICSLSTADAPT.exe
C:\PROGRA~1\ROCKWE~1\RSLINX\RSLINX.EXE
C:\Program Files\Common Files\Rockwell\RsvcHost.exe
C:\Program Files\Sprint\Sierra Wireless\Sprint PCS Connection Manager\SPCSUtilityService.exe
C:\WINDOWS\system32\stacsv.exe
C:\Program Files\NTRU Cryptosystems\NTRU TCG Software Stack\bin\tcsd_win32.exe
C:\Program Files\Intel\Wireless\Bin\WLKEEPER.exe
C:\Program Files\Common Files\Rockwell\EventClientMultiplexer.exe
C:\Program Files\Common Files\Rockwell\RnaDirServer.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Common Files\Rockwell\RNADirMultiplexor.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Apoint\ApMsgFwd.exe
C:\Program Files\Apoint\hidfind.exe
C:\Program Files\Apoint\ApntEx.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.bin
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHSP.exe
C:\Program Files\Common Files\LogiShrd\LQCVFX\COCIManager.exe
C:\Program Files\MSN Messenger\livecall.exe
C:\Program Files\MSN Messenger\usnsvc.exe
.
**************************************************************************
.
Completion time: 2008-08-22 13:11:16 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-22 17:11:07
ComboFix2.txt 2008-08-22 16:15:56

Pre-Run: 8,258,113,536 bytes free
Post-Run: 8,236,457,984 bytes free

398 --- E O F --- 2008-08-14 08:04:53

HijackThis Log
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:19:43, on 8/22/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Rockwell\EventServer.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Rockwell Software\RSCommon\RSOBSERV.EXE
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\Program Files\Common Files\Rockwell\NmspHost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\Hilscher\ODMV3\ODMV3.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\Common Files\Rockwell\RdcyHost.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Common Files\Rockwell\RNADiagnosticsSrv.exe
C:\Program Files\Rockwell Software\RSView Enterprise\HMIDIAGNOSTICSLSTADAPT.exe
C:\PROGRA~1\ROCKWE~1\RSLinx\RSLINX.EXE
C:\Program Files\Common Files\Rockwell\RsvcHost.exe
C:\Program Files\Sprint\Sierra Wireless\Sprint PCS Connection Manager\SPCSUtilityService.exe
C:\WINDOWS\system32\StacSV.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\Program Files\Rexroth\IndraLogic\ENI Server\ENI.exe
C:\Program Files\Common Files\Rockwell\EventClientMultiplexer.exe
C:\Program Files\Common Files\Rockwell\RnaDirServer.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Common Files\Rockwell\RNADirMultiplexor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\Apoint\ApMsgFwd.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Apoint\HidFind.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe
C:\WINDOWS\system32\KADxMain.exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\Program Files\Rockwell Automation\Rockwell Automation USB CIP Driver Package\UsbCipHelper\UsbCipHelper.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Rexroth\IndraLogic\ENI Server\ENISysTray.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Logitech\QuickCam\Quickcam.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\FTSvrMgr.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Eraser\eraser.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Program Files\Workrave\lib\Workrave.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files\MSN Messenger\livecall.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=0071015
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,Start
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [Document Manager] C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe
O4 - HKLM\..\Run: [KADxMain] C:\WINDOWS\system32\KADxMain.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [UsbCipHelper] C:\Program Files\Rockwell Automation\Rockwell Automation USB CIP Driver Package\UsbCipHelper\UsbCipHelper.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [ENISysTray] "C:\Program Files\Rexroth\IndraLogic\ENI Server\ENISysTray.exe"
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [FTSvrMgr] C:\WINDOWS\system32\FTSvrMgr.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Eraser] C:\Program Files\Eraser\eraser.exe -hide
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O4 - Startup: Workrave.lnk = C:\Program Files\Workrave\lib\Workrave.exe
O4 - Global Startup: Bluetooth Manager.lnk = ?
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\Office12\REFIEBAR.DLL
O9 - Extra button: PPLive - {95B3F550-91C4-4627-BCC4-521288C52977} - C:\Program Files\PPLive\PPLive.exe
O9 - Extra 'Tools' menuitem: PPLive - {95B3F550-91C4-4627-BCC4-521288C52977} - C:\Program Files\PPLive\PPLive.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00134F72-5284-44F7-95A8-52A619F70751} (ObjWinNTCheck Class) - https://192.168.254....ll/WinNTChk.cab
O16 - DPF: {08D75BB0-D2B5-11D1-88FC-0080C859833B} (OfficeScan Corp Edition Web-Deployment SetupINICtrl Class) - https://192.168.254....ll/setupini.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zon...kr.cab56986.cab
O16 - DPF: {254AA86E-5655-4518-AA87-185D7CC41801} (LogMeIn Rescue Technician Console) - https://secure.logme...scueControl.cab
O16 - DPF: {3D3BF1F8-9696-4A5E-B4F1-49101C997B70} (VaxSIPUserAgentCAB Control) - http://labs.jaduka.c...serAgentCAB.cab
O16 - DPF: {5EFE8CB1-D095-11D1-88FC-0080C859833B} (OfficeScan Corp Edition Web-Deployment ObjRemoveCtrl Class) - https://192.168.254..../RemoveCtrl.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebo...otoUploader.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.mi...b?1192837145421
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/p...owserPlugin.cab
O16 - DPF: {70EE0AA4-5A3A-4052-8FFA-2EEDA43F7942} - http://www.innotive....cibrowser11.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zon...nt.cab56907.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logme...trl.cab?lmi=100
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: 1784-PCIDS DeviceNet - Rockwell Automation - C:\Program Files\Rockwell Software\RSLogix Emulate 5000\PcidsService.exe
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Broadcom ASF IP and SMBIOS Mailbox Monitor (ASFIPmon) - Broadcom Corpo

[Rorschach112]

Hello

Please do an online scan with Kaspersky WebScanner

Make sure you are using Internet Explorer for this. Click on Kaspersky Online Scanner and click Accept

You will be prompted to install an ActiveX component from Kaspersky, Click Yes.

• The program will launch and then begin downloading the latest definition files:
• Once the files have been downloaded click on NEXT
  
• Now click on Scan Settings
• In the scan settings make that the following are selected:
  • Scan using the following Anti-Virus database:
  Extended (if available otherwise Standard)
  
  • Scan Options:
  Scan Archives
  Scan Mail Bases
• Click OK
• Now under select a target to scan:Select My Computer
• This will program will start and scan your system.
• The scan will take a while so be patient and let it run.
• Once the scan is complete it will display if your system has been infected.
  
  • Now click on the Save as Text button:
• Save the file to your desktop.
• Copy and paste that information in your next post.

[AmazingTrans]

WOw. took me 8 hours to scan. first 4 hours it hangs at 90%. at last night everything went through. Thanks for being patient. Here's my new log.

Kaspersky Virus Scan

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Friday, August 22, 2008
Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Friday, August 22, 2008 18:44:27
Records in database: 1124860
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
H:\
Z:\

Scan statistics:
Files scanned: 178299
Threat name: 93
Infected objects: 135
Suspicious objects: 1
Duration of the scan: 04:01:37


File name / Threat name / Threats count
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\01EA2182.tmp Infected: Backdoor.Win32.Nethief.10 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\066F4926.tmp Infected: not-a-virus:Monitor.Win32.FamilyKeyLogger.280 3
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\068D4305.exe Infected: not-a-virus:Monitor.Win32.HomeKeyLogger.170 2
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\06B764D7.tmp Infected: not-a-virus:Monitor.Win32.HomeKeyLogger.170 2
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\09101241.tmp Infected: Backdoor.Win32.Nethief.10 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\09133C3E.tmp Infected: Backdoor.Win32.Nethief.10 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\0AF00776.tmp Infected: Backdoor.Win32.Nethief.10 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\46DE46E5.tmp Infected: Backdoor.Win32.Nethief.10 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\6EFF5185.exe Infected: not-a-virus:Monitor.Win32.HomeKeyLogger.170 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\6FC0502A.exe Infected: Backdoor.Win32.Nethief.10 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\741431EF.swf Infected: Trojan-Downloader.SWF.Gida.a 1
C:\Documents and Settings\Johnny Heng\Desktop\CA-Bypass.exe Suspicious: Packed.Win32.PePatch.dk 1
C:\Documents and Settings\Johnny Heng\Desktop\SmitfraudFix.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f 1
C:\Documents and Settings\Johnny Heng\MediaTubeCodec_ver1.1463.0.exe Infected: Trojan-Downloader.Win32.Zlob.wor 1
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: not-a-virus:NetTool.Win32.PsKill.a 1
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: Virus.Script.ASX.Conp 1
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: Trojan-Downloader.Win32.Small.ai 1
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: Trojan.Win32.CpuHog.10 1
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: Trojan.DOS.ControlDuSockets.a 1
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: Exploit.Win32.Jolt 1
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: not-a-virus:RemoteAdmin.Win32.SrvCmd 1
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: not-a-virus:PSWTool.Win32.Brutus 1
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: Backdoor.Win32.DSSdoor.a 1
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: HackTool.Win32.Munga.b 1
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: not-a-virus:PSWTool.Win32.SnadBoy.2011 2
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: Exploit.Win32.WebDav.j 1
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: Exploit.Win32.WebDav.i 1
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: Exploit.Win32.DCom.a 1
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: Exploit.Win32.IISError 1
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: Trojan.Win32.HK 2
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: Exploit.Win32.Snakeover.20 2
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: Exploit.Win32.WebDav.a 1
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: Exploit.Win32.PrinterOverflow.d 1
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: Exploit.Win32.IndexServerOverflow.a 2
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: Exploit.Win32.IISCrack.a 1
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: Trojan.Win32.IIS_Hack 1
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: Backdoor.Win32.Ncx.a 1
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: Backdoor.Win32.Ncx.b 1
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: Exploit.Win32.Xploit.b 1
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: DoS.Win32.Agent.c 1
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: Exploit.Win32.CAN.1999-0412.c 2
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: Exploit.Win32.PrinterOverflow.g 2
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: not-a-virus:RemoteAdmin.Win32.NetCat 2
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: Exploit.Perl.CAN.2002-0823 1
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: not-a-virus:NetTool.Win32.IEEN.030 2
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: HackTool.Win32.CntLink 1
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: Trojan.JS.WindowBomb.a 1
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: HackTool.Win32.SQLInject.j 1
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: not-a-virus:PSWTool.Win32.ForceSQL.20 1
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: Exploit.Win32.SQLhuc.a 1
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: HackTool.Win32.SQLPass.a 1
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: Trojan.Win32.SQLExec 1
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: Exploit.Win32.CAN.2002-0649.a 1
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: Trojan.BAT.KillAll.c 1
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: VirTool.Win32.Avpsof 1
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: Constructor.Win32.Tvirus 1
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: Virus.DOS.Nuke.1680 1
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: Email-Worm.VBS.GMW 1
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: Email-Worm.VBS.LoveLetter 3
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: Constructor.VBS.SSIWG.20 1
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: Email-Worm.Win32.Klez.h 4
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: Trojan.DOS.Membrain 1
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: Virus.DOS.HLLO.Membrain 1
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: Backdoor.Win32.Pipes 1
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: Trojan-Dropper.Win32.StealthBat 1
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: Net-Worm.Linux.Ramen.c 4
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: Net-Worm.Linux.Ramen.b 3
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: Net-Worm.Linux.Ramen 2
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: Trojan.Novell.Burglar 1
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: Backdoor.Win32.IpxCtrl 2
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: Trojan.DOS.GetLogin.100 2
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: Trojan-Spy.DOS.Keycopy 1
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: Trojan-Spy.DOS.KeyTrap.20 1
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: Rootkit.FreeBSD.Agent.a 2
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: Backdoor.Win32.AckCmd 2
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: not-a-virus:NetTool.Win32.Calc-DNet.l 2
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: not-a-virus:NetTool.Win32.Calc-DNet.g 2
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: HackTool.Win32.BackStealth 1
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: Exploit.Win32.Firewar 1
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: Backdoor.Win32.Aphexdoor.LiteSock 2
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: HackTool.Win32.EnumPlus.a 1
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: Spoofer.Win32.Myazz 1
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: Trojan-Spy.Win32.SCKeyLog.20 1
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: Trojan-Spy.Win32.Fearless.11.b 1
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: Exploit.Win32.GetAdmin.a 2
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: not-a-virus:Monitor.Win32.IKSlog.20.a 1
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: not-a-virus:Monitor.Win32.IKSlog.21 2
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: not-a-virus:PSWTool.Win32.KerbCrack.a 1
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: HackTool.Win32.BruteForce.a 1
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: HackTool.Win32.BruteForce.d 1
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: not-a-virus:NetTool.Win32.Legion.21 1
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Certified Ethical Hacker Lab 3.0\Certified Ethical Hacker Lab 3.0.iso Infected: Trojan-PSW.Win32.Spion.c 1
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Tot.Vid.Con.v3.11-RLZ + Crack Serial.rar Infected: Trojan.Win32.Monder.gen 2
C:\Documents and Settings\Johnny Heng\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f 1
C:\Program Files\UltraVNC\vnchooks.dll Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.c 1
C:\Program Files\UltraVNC\vncviewer.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.1102 1
C:\Program Files\UltraVNC\winvnc.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.c 1
C:\QooBox\Quarantine\C\WINDOWS\system32\lufccn.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cug 1
C:\QooBox\Quarantine\C\WINDOWS\system32\qmbsfuha.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cug 1
H:\Personal\SoftWare\Security\hide_folders.exe Infected: not-a-virus:RiskTool.Win32.HideFolders.214 1
H:\Personal\SoftWare\Internet\MSNEmotions\213 MSN Winks - 44 Moods and 255 Emoticons (Includes Self Installer)\Install.exe Infected: IM-Worm.Win32.Sohanad.bb 1
H:\Personal\SoftWare\RemoteAssistance\tightvnc-1.2.9-setup.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC-based.h 1
H:\Personal\SoftWare\RemoteAssistance\tightvnc-1.2.9-setup.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC-based.b 1

The selected area was scanned.

[Rorschach112]

You got infected because you downloaded cracks, if you do this again you will have to reformat as you wont get helped here

Please download the OTMoveIt2 by OldTimer.

• Save it to your desktop.
• Please double-click OTMoveIt2.exe to run it.
• Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  

  [kill explorer]
  C:\Documents and Settings\Johnny Heng\Desktop\CA-Bypass.exe
  C:\Documents and Settings\Johnny Heng\MediaTubeCodec_ver1.1463.0.exe
  C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Tot.Vid.Con.v3.11-RLZ + Crack Serial.rar
  H:\Personal\SoftWare\Internet\MSNEmotions\213 MSN Winks - 44 Moods and 255 Emoticons (Includes Self Installer)
  purity 
  EmptyTemp
  [start explorer]

• Return to OTMoveIt2, right click in the "Paste List of Files/Folders to Move" window (under the light Yellow bar) and choose Paste.
• Click the red Moveit! button.
• A log of files and folders moved will be created in the c:\_OTMoveIt\MovedFiles folder in the form of Date and Time (mmddyyyy_hhmmss.log). Please open this log in Notepad and post its contents in your next reply.
• Close OTMoveIt2

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.



Please download DirLook by jpshortstuff from here.

• Double-click DirLook.exe to run it.
• Ensure that Show Hidden Files/Folders and BBCode Ouput are both checked.
• Copy the content of the following codebox into the main textfield:
  
  

  C:\Documents and Settings\Johnny Heng\My Documents\Downloads
  H:\Personal\SoftWare

• Click the DirLook button to start the scan.
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply. (Note: The log can also be found at C:\dl_log.txt)

Note: Scanning may take longer for large folders.

[AmazingTrans]

Explorer killed successfully
C:\Documents and Settings\Johnny Heng\Desktop\CA-Bypass.exe moved successfully.
C:\Documents and Settings\Johnny Heng\MediaTubeCodec_ver1.1463.0.exe moved successfully.
C:\Documents and Settings\Johnny Heng\My Documents\Downloads\Tot.Vid.Con.v3.11-RLZ + Crack Serial.rar moved successfully.
File/Folder H:\Personal\SoftWare\Internet\MSNEmotions\213 MSN Winks - 44 Moods and 255 Emoticons (Includes Self Installer) not found.
< purity >
< EmptyTemp >
File delete failed. C:\DOCUME~1\JOHNNY~1\LOCALS~1\Temp\etilqs_fPh4uUksVxrGPtbU0Oif scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\JOHNNY~1\LOCALS~1\Temp\Perflib_Perfdata_10a4.dat scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\JOHNNY~1\LOCALS~1\Temp\~DF5BF9.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\JOHNNY~1\LOCALS~1\Temp\~DF5C10.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\JOHNNY~1\LOCALS~1\Temp\~DFB6C.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\JOHNNY~1\LOCALS~1\Temp\~DFBFB.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\hlktmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\LVCOMSX.LOG scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\~DFE900.tmp scheduled to be deleted on reboot.
Temp folders emptied.
IE temp folders emptied.
Explorer started successfully

OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 08242008_140605

Files moved on Reboot...
File move failed. C:\DOCUME~1\JOHNNY~1\LOCALS~1\Temp\etilqs_fPh4uUksVxrGPtbU0Oif scheduled to be moved on reboot.
File move failed. C:\DOCUME~1\JOHNNY~1\LOCALS~1\Temp\Perflib_Perfdata_10a4.dat scheduled to be moved on reboot.
File C:\DOCUME~1\JOHNNY~1\LOCALS~1\Temp\~DF5BF9.tmp not found!
File C:\DOCUME~1\JOHNNY~1\LOCALS~1\Temp\~DF5C10.tmp not found!
File C:\DOCUME~1\JOHNNY~1\LOCALS~1\Temp\~DFB6C.tmp not found!
File C:\DOCUME~1\JOHNNY~1\LOCALS~1\Temp\~DFBFB.tmp not found!
File move failed. C:\WINDOWS\temp\hlktmp scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\LVCOMSX.LOG scheduled to be moved on reboot.
C:\WINDOWS\temp\~DFE900.tmp moved successfully.


DirLook.exe by jpshortstuff
Log created at 22:47:59 on Sun 08/24/2008

==============================

Contents of "C:\Documents and Settings\Johnny Heng\My Documents\Downloads" (inc. hidden/system files/folders)

---FOLDERS---

2008 Beijing Olympics Opening Ceremony (created: 08/08/2008 20:21) d--------
Certified Ethical Hacker Lab 3.0 (created: 12/16/2007 05:32) d--------

---FILES---

Beijing_Olympics_Opening_Ceremony_First_hour.MP4 (344532333 bytes, created: 08/08/2008 22:31) --a------
Thumbs.db (9728 bytes, created: 08/08/2008 12:41) --ahs----

==============================

Contents of "H:\Personal\SoftWare" (inc. hidden/system files/folders)

Folder not found.

==============================

=EOF=

[Rorschach112]

Your logs are clean

Follow these steps to uninstall Combofix and tools used in the removal of malware

• Click START then RUN
• Now type Combofix /u in the runbox and click OK. Note the space between the X and the U, it needs to be there.
  

• Make sure you have an Internet Connection.
• Double-click OTMoveIt2.exe to run it.
• Click on the CleanUp! button
• A list of tool components used in the Cleanup of malware will be downloaded.
• If your Firewall or Real Time protection attempts to block OtMoveit2 to rech the Internet, please allow the application to do so.
• Click Yes to beging the Cleanup process and remove these components, including this application.
• You will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes.

Please download JavaRa to your desktop and unzip it to its own folder

• Run JavaRa.exe, pick the language of your choice and click Select. Then click Remove Older Versions.
• Accept any prompts.
• Open JavaRa.exe again and select Search For Updates.
• Select Update Using Sun Java's Website then click Search and click on the Open Webpage button. Download and install the latest Java Runtime Environment (JRE) version for your computer.

Below I have included a number of recommendations for how to protect your computer against malware infections.

* Keep Windows updated by regularly checking their website at :
http://windowsupdate.microsoft.com/
This will ensure your computer has always the latest security updates available installed on your computer.

* To reduce re-infection for malware in the future, I strongly recommend installing these free programs:

SpywareBlaster protects against bad ActiveX
IE-SPYAD puts over 5000 sites in your restricted zone so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all
Have a look at this tutorial for IE-Spyad here

* SpywareGuard offers realtime protection from spyware installation attempts. Make sure you are only running one real-time anti-spyware protection program or there will be a conflict.

Make Internet Explorer more secure

• Click Start > Run
• Type Inetcpl.cpl & click OK
• Click on the Security tab
• Click Reset all zones to default level
• Make sure the Internet Zone is selected & Click Custom level
• In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
• Next Click OK, then Apply button and then OK to exit the Internet Properties page.

* MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.

* Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more
secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in pop up
blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from
Here

* Take a good look at the following suggestions for malware prevention by reading Tony Klein’s article 'How Did I Get Infected In The First Place'
Here

Thank you for your patience, and performing all of the procedures requested.

[AmazingTrans]

Thank You very much once again.
Everything is good now.

[Rorschach112]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.