Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\S24EvMon.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
C:\Program Files\Dell\OpenManage\Client\Iap.exe
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\PROT_SRV.EXE
C:\WINDOWS\system32\pagents.exe
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\WINDOWS\system32\PSTARTSR.EXE
C:\WINDOWS\System32\RegSrvc.exe
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
C:\WINDOWS\system32\vmnat.exe
C:\WINDOWS\system32\vmnetdhcp.exe
C:\Program Files\F-Secure\Common\FNRB32.EXE
C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
C:\Program Files\F-Secure\Common\FIH32.EXE
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\carpserv.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\Program Files\Pointsec\P95tray.exe
C:\Program Files\ViewMail\LFfaxtomail\lfsndmng.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
C:\Program Files\F-Secure\FSGUI\fsguiexe.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\GAOV\Mysee Alert\Mysee Alert.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\NEC\OpenWorX\PCA\ClipboardDialer.exe
C:\ScanPanel\ScnPanel.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\Program Files\Cisco Systems\VPN Client\vpngui.exe
C:\Documents and Settings\rcheng\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://vod.mmdy.org/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://vod.mmdy.org/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://unifiedweb/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://vod.mmdy.org/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by NEC Unified Solutions, Inc.
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [Protect Tray] "C:\Program Files\Pointsec\P95tray.exe"
O4 - HKLM\..\Run: [lfsndmngav] C:\Program Files\ViewMail\LFfaxtomail\lfsndmng.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Mysee Alert] "C:\Program Files\GAOV\Mysee Alert\Mysee Alert.exe" -notray
O4 - HKLM\..\Run: [webService] systems.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [DW4] "C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe"
O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\vpngui.exe
O4 - Global Startup: NEC Sheduler.lnk = C:\Program Files\NEC\Scheduler\Schedule.exe
O4 - Global Startup: Personal Call Assistant.lnk = C:\Program Files\NEC\OpenWorX\PCA\ClipboardDialer.exe
O4 - Global Startup: ScanPanel.lnk = C:\ScanPanel\ScnPanel.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Dial with VT&GO - file:///C:\Program Files\IP blue\VTGO\Scripts\dialer.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PowerWord - {9A687CA6-D585-4947-9ED9-BE96071F5CD9} - C:\PROGRA~1\Kingsoft\POWERW~1\XDictExB.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://unifiedweb/
O16 - DPF: {08288600-E9D9-11D1-9C84-006008319186} (VanTFind.VanTFindCtrl) - file://C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\VANTFIND.cab
O16 - DPF: {0CBD083F-B6B3-11D0-AD20-0060976EA210} (DropBox Control) - file://C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\VANDRO~1.cab
O16 - DPF: {14924309-C4D4-11D1-85ED-006097794610} (StkCstUserControl.StkCstMaster) - file://C:\DOCUME~1\rcheng\LOCALS~1\Temp\ucStkCst.cab
O16 - DPF: {1C8B8F66-60FA-11D1-8B99-0020AFF5AA3B} (ucCommonDataField.ucCmnDataField) - file://C:\DOCUME~1\rcheng\LOCALS~1\Temp\icccdf4.cab
O16 - DPF: {201CF4B6-C42D-11D1-A0EC-006008936BDD} (ItemStUC.ItemStocking) - file://C:\DOCUME~1\rcheng\LOCALS~1\Temp\ucItmStk.cab
O16 - DPF: {2F756781-B536-11D2-8847-00105A287731} (VanDispBrd.DispatchBoard) - file://C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\VanDispBrd.CAB
O16 - DPF: {39D420B3-E0EB-424C-89AA-C24F8DE7EF79} (KooPlayer Control) - http://www.im.tv/IMTVPlayer.ocx
O16 - DPF: {4117ECE7-C7FE-11D1-9844-0060089F7AEB} (StkLkpUC.StockLookup) - file://C:\DOCUME~1\rcheng\LOCALS~1\Temp\ucStkLkp.cab
O16 - DPF: {4E192D78-E515-11D1-B89E-0020AFF695A0} (ItmMastUC.ItemMaster) - file://C:\DOCUME~1\rcheng\LOCALS~1\Temp\ucItmMst.cab
O16 - DPF: {5D14D3F2-6CEF-11D1-81F5-00A02470741B} (ICC.CustomLabels Class) - file://C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ICCLABL4.cab
O16 - DPF: {5D14D41C-6CEF-11D1-81F5-00A02470741B} (ICC.DomHierarchy Class) - file://C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\iccdmhi4.cab
O16 - DPF: {603607C4-BE6F-11D1-983A-0060089F7AEB} (CarrierUserControl.CarrierMaster) - file://C:\DOCUME~1\rcheng\LOCALS~1\Temp\ucCarrier.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1121452344367
O16 - DPF: {6D852581-7F1A-11D2-9CAB-006008319186} (VanColorPickProj.VanColorPick) - file://C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\VANCOLORPICK.cab
O16 - DPF: {7E0FDFBB-87D4-43A1-9AD4-41F0EA8AFF7B} (Net6Launcher Class) - https://64.95.116.140/net6helper.cab
O16 - DPF: {9345E91A-BF88-11D1-8AFE-00A02470741B} (VendorContUC.VendorCont) - file://C:\DOCUME~1\rcheng\LOCALS~1\Temp\ucVendCt.cab
O16 - DPF: {97EEFD1A-C41D-11D1-A0EC-006008936BDD} (CustLabelsUsrCtrl.CustomLabels) - file://C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\UCCUSLBL.cab
O16 - DPF: {99AC51A7-BEFF-11D1-B5B1-00A024CD30C6} (VanFind.VanFindCtrl) - file://C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\VANFIND.cab
O16 - DPF: {9E85612B-D0A6-11D1-89BF-0060089F7A3E} (ShipComp.ShipmentViewer) - file://C:\DOCUME~1\rcheng\LOCALS~1\Temp\SHIPVIEW.cab
O16 - DPF: {A6928F2E-DDEF-11D1-804D-006097F95635} (vanStageTask.van_stage_task_ctl) - file://C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\VANSTAGETASK.cab
O16 - DPF: {AA64AF34-C45D-11D1-85ED-006097794610} (VirDomUC.VirDomainMaster) - file://C:\DOCUME~1\rcheng\LOCALS~1\Temp\ucVirDm.cab
O16 - DPF: {ADCBFFBC-DB3F-11D2-AADF-006008936C61} (VanGrid.VanGridCtrl) - file://C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\VANGRID.cab
O16 - DPF: {B2E0C2EA-A543-11CF-BC8C-207402C10627} (GMS Angular Gauge ActiveX Control) - file://C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\AGAUGEM.cab
O16 - DPF: {B86D4018-C597-11D1-9843-0060089F7AEB} (UOMUserControl.UOMMaster) - file://C:\DOCUME~1\rcheng\LOCALS~1\Temp\ucUOM.cab
O16 - DPF: {B86D4502-C597-11D1-9843-0060089F7AEB} (ItemCat.ItmCatUC) - file://C:\DOCUME~1\rcheng\LOCALS~1\Temp\ucItmCat.cab
O16 - DPF: {B8958DE0-BAC9-101C-933E-0000C005958C} (FarPoint DateTime Control) - file://C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\EDT32X20.cab
O16 - DPF: {B9FDDE3F-28E2-11D2-B461-006008936ABD} (vanChevron.van_chevron_ctl) - file://C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\VANCHEVRON.cab
O16 - DPF: {BE77224A-C41F-11D1-85ED-006097794610} (StkDtUserControl.StkDtMaster) - file://C:\DOCUME~1\rcheng\LOCALS~1\Temp\ucStkDt.cab
O16 - DPF: {C6CCA9AF-2B4E-11D1-9B21-0080C79EFE90} (VanPallet.VanPalletCtrl) - file://C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\VANPALLET.cab
O16 - DPF: {DF2DBD30-B720-11D0-9B9A-0080C73BDD90} (iccbtn4.ucButtonBar) - file://C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ICCBTN4.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://necunified.webex.com/client/v_myweb…bex/ieatgpc.cab
O16 - DPF: {E0DB982A-E986-11D0-B2F8-00A0247B9D10} (VanViewer.VanViewerCrtl) - file://C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\VANVIEWER.cab
O16 - DPF: {EB0CF3B4-C33B-11D1-A0EC-006008936BDD} (StkStUC.StockStatusMaint) - file://C:\DOCUME~1\rcheng\LOCALS~1\Temp\ucStkSt.cab
O16 - DPF: {EB52CF7B-3917-11CE-80FB-0000C0C14E92} (SSDateCombo Control) - file://C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\SSCALA32.cab
O16 - DPF: {EBF47667-BF3F-11D1-983D-0060089F7AEB} (CarrConUserControl.CarrierContactMaster) - file://C:\DOCUME~1\rcheng\LOCALS~1\Temp\ucCarCont.cab
O16 - DPF: {EC9B6CDE-C5BF-11D2-820B-00A024CD30C6} (VanLiteralDLL.VanLiteral) - file://C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\VanLiteralDLL.CAB
O16 - DPF: {ED738376-C44A-11D1-A0EC-006008936BDD} (BDUsrCtrl.BusinessDomain) - file://C:\DOCUME~1\rcheng\LOCALS~1\Temp\ucBusDom.cab
O16 - DPF: {F29BE3C6-BE82-11D1-91FE-0020AFF5AA68} (CurrencyUserControl.CurrencyMaster) - file://C:\DOCUME~1\rcheng\LOCALS~1\Temp\ucCurr.cab
O16 - DPF: {F39FD815-E9C3-11D1-9C83-006008319186} (VanTree.VanTreeCtrl) - file://C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\VANTREE.cab
O16 - DPF: {F74887C8-C44B-11D1-85ED-006097794610} (VendorUserControl.VendorMaster) - file://C:\DOCUME~1\rcheng\LOCALS~1\Temp\ucVend.cab
O16 - DPF: {FF1DACCD-3047-11D1-8028-00A024CA8C68} (VanPipelineGraph.VanPipelineGraphCtrl) - file://C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\VanPipeline.CAB
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = ufs.prv
O17 - HKLM\Software\..\Telephony: DomainName = ufs.prv
O17 - HKLM\System\CCS\Services\Tcpip\..\{CCE0C669-6F9A-4CD6-A01F-21BFE132C6B2}: Domain = ufs.prv
O17 - HKLM\System\CCS\Services\Tcpip\..\{CCE0C669-6F9A-4CD6-A01F-21BFE132C6B2}: NameServer = 172.24.172.35,172.24.172.34
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = ufs.prv
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = ufs.prv,ufs.prv,ufs.prv
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = ufs.prv,ufs.prv,ufs.prv
O18 - Protocol: dic - {C21F5C32-F57A-4A0D-8E0A-B672691C52D0} - C:\PROGRA~1\Kingsoft\POWERW~1\XDictExB.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: Sebring - C:\WINDOWS\System32\LgNotify.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: Iap - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\Iap.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: OracleClientCache80 - Unknown owner - C:\orant\BIN\ONRSD80.EXE
O23 - Service: Pointsec - Unknown owner - C:\WINDOWS\system32\PROT_SRV.EXE
O23 - Service: Pointsec update agent (Pointsec_agent) - Unknown owner - C:\WINDOWS\system32\pagents.exe
O23 - Service: Pointsec service start (Pointsec_start) - Unknown owner - C:\WINDOWS\system32\PSTARTSR.EXE
O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe
O23 - Service: Remote Managements Instrumenta (Remss_Ser) - Unknown owner - C:\WINDOWS\system32\netstart.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\System32\S24EvMon.exe
O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe
O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe