Thanks random for your help. Here my log file
ComboFix :
"Administrator" - 07-01-25 7:50:24 Service Pack 2
ComboFix 07-01-23.2 - Running from: "C:\Documents and Settings\Administrator\Desktop"
((((((((((((((((((((((((((((((( Files Created from 2006-12-25 to 2007-01-25 ))))))))))))))))))))))))))))))))))
2007-01-24 11:13 d——– C:\pebuilder3110a
2007-01-24 11:02 d——– C:\WINXP
2007-01-24 10:47 d——– C:\BCD
2007-01-24 10:16 d——– C:\rename_this_folder_back_to_sUBs_
2007-01-22 08:40 d——– C:\WINDOWS\system32\LogFiles
2007-01-22 08:37 d——– C:\WINDOWS\system32\drivers\umdf
2007-01-22 08:34 22,752 –a—— C:\WINDOWS\system32\spupdsvc.exe
2007-01-20 14:41 d——– C:\Program Files\BitLord
2007-01-20 02:43 3,968 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-01-20 02:27 d——– C:\Program Files\Lavasoft
2007-01-20 02:27 d——– C:\DOCUME~1\ADMINI~1\Application Data\Lavasoft
2007-01-20 01:07 d——– C:\DOCUME~1\ALLUSE~1\Application Data\Spybot - Search & Destroy
2007-01-19 22:22 d——– C:\Program Files\ScanSpyware v3.8.0.4
2007-01-19 14:01 d——– C:\Program Files\Common Files\Ulead
2007-01-19 13:51 d——– C:\Program Files\Grisoft
2007-01-19 10:34 d——– C:\DOCUME~1\ADMINI~1\Application Data\PE Explorer
2007-01-19 10:31 d——– C:\VEXPLITE
2007-01-19 01:14 d–hs—- C:\rm
2007-01-19 01:14 d–hs—- C:\ms.config
2007-01-18 23:57 d——– C:\DOCUME~1\ALLUSE~1\Application Data\Acronis
2007-01-18 23:46 395,744 –a—— C:\WINDOWS\system32\drivers\timntr.sys
2007-01-18 23:46 39,264 –a—— C:\WINDOWS\system32\drivers\tifsfilt.sys
2007-01-18 18:16 50,688 –a—— C:\WINDOWS\system32\wbhelp2.dll
2007-01-18 18:16 d——– C:\Program Files\DAP
2007-01-15 11:55 d——– C:\Program Files\Motorola Phone Tools
2007-01-15 11:42 d——– C:\Program Files\JustRegistry
2007-01-15 11:37 d——– C:\Program Files\Avanquest update
2007-01-15 11:36 d——– C:\DOCUME~1\ALLUSE~1\Application Data\BVRP Software
2007-01-15 11:14 25,600 –a—— C:\WINDOWS\system32\drivers\usbser.sys
2007-01-15 11:13 24,192 –a—— C:\DOCUME~1\ADMINI~1\usbsermptxp.sys
2007-01-15 11:13 22,768 –a—— C:\WINDOWS\system32\drivers\usbsermpt.sys
2007-01-15 11:13 22,768 –a—— C:\DOCUME~1\ADMINI~1\usbsermpt.sys
2007-01-14 15:48 d——– C:\DOCUME~1\ALLUSE~1\Application Data\Raxco
2007-01-14 15:47 d——– C:\Program Files\Raxco
2007-01-14 15:47 d——– C:\Program Files\Common Files\Raxco
2007-01-14 15:37 641,752 -ra—— C:\WINDOWS\system32\drivers\cfosspeed.sys
2007-01-14 15:36 277,720 –a—— C:\WINDOWS\system32\cfosspeed.dll
2007-01-14 15:16 d——– C:\Program Files\cFosSpeed
2007-01-13 17:51 d——– C:\Program Files\MobiK
2007-01-13 12:10 d——– C:\Program Files\Common Files\Macrovision Shared
2007-01-13 11:50 d——– C:\WINDOWS\SxsCaPendDel
2007-01-13 11:13 d——– C:\Program Files\PowerISO
2007-01-12 15:13 d——– C:\Program Files\DirectVobSub
2007-01-12 14:32 d——– C:\Program Files\Gabest
2007-01-12 14:03 d——– C:\Program Files\Freecorp
2007-01-11 20:25 d——– C:\DOCUME~1\ADMINI~1\Application Data\pdf995
2007-01-11 19:19 51,716 –a—— C:\WINDOWS\system32\pdf995mon.dll
2007-01-11 19:19 122,880 –a—— C:\WINDOWS\system32\pdfmona.dll
2007-01-11 19:19 d——– C:\Program Files\pdf995
2007-01-11 19:19 d——– C:\DOCUME~1\ALLUSE~1\Application Data\pdf995
2007-01-10 14:29 d——– C:\Program Files\Pointstone
2007-01-10 14:29 d——– C:\Program Files\Common Files\Pointstone
2007-01-10 13:13 32,592 –a—— C:\WINDOWS\system32\msonpmon.dll
2007-01-10 13:05 d——– C:\Program Files\MSBuild
2007-01-10 12:55 d——– C:\Program Files\Microsoft Visual Studio 8
2007-01-10 12:53 d——– C:\DOCUME~1\ALLUSE~1\Application Data\Microsoft Help
2007-01-10 12:49 dr-h—– C:\MSOCache
2007-01-10 12:05 d——– C:\DOCUME~1\ADMINI~1\Application Data\Ahead
2007-01-10 12:01 d——– C:\Program Files\Nero
2007-01-10 12:01 d——– C:\Program Files\Common Files\Ahead
2007-01-09 23:20 d——– C:\WINDOWS\pss
2007-01-09 23:03 d——– C:\WINDOWS\vbSkinner
2007-01-09 23:03 d——– C:\Program Files\PFConfig
2007-01-09 19:46 d——– C:\Program Files\BT Engine
2007-01-09 15:30 d——– C:\Program Files\MailExpert Email Server
2007-01-09 15:15 d——– C:\Program Files\Code-Crafters
2007-01-09 14:12 176,128 –a—— C:\WINDOWS\uninstall.exe
2007-01-09 14:09 d——– C:\Program Files\WorkgroupMail
2007-01-09 14:09 d——– C:\Program Files\Common Files\Softalk
2007-01-08 19:09 d——– C:\MERCURY
2007-01-08 16:29 d——– C:\Program Files\Mp3 Internet
2007-01-08 16:29 d——– C:\DOCUME~1\ADMINI~1\Application Data\Mp3 Internet
2007-01-08 16:21 d——– C:\Program Files\BitRoll
2007-01-08 16:21 d——– C:\DOCUME~1\ADMINI~1\Application Data\BitRoll
2007-01-07 19:31 d——– C:\Program Files\PostCast Server
2007-01-07 19:31 d——– C:\Program Files\Common Files\InfoJoin
2007-01-04 03:31 d——– C:\DOCUME~1\ADMINI~1\Application Data\SmartFTP
2007-01-04 03:30 d——– C:\Program Files\SmartFTP Client 2.0 Setup Files
2007-01-04 03:30 d——– C:\Program Files\SmartFTP Client 2.0
2007-01-04 03:08 d–h—– C:\DOCUME~1\ALLUSE~1\Application Data\WebDrive
2007-01-02 07:11 d——– C:\Program Files\Online TV Player 3
2007-01-02 01:09 d——– C:\Program Files\QK SMTP Server
2006-12-30 10:59 d——– C:\Program Files\Ashampoo
2006-12-28 12:08 737,280 –a—— C:\WINDOWS\system32\msvcp70d.dll
2006-12-28 12:08 536,576 –a—— C:\WINDOWS\system32\msvcr70d.dll
2006-12-28 12:08 53,760 –a—— C:\WINDOWS\system32\Nmorenu.dll
2006-12-28 12:08 48,128 –a—— C:\WINDOWS\system32\Nmsckn.dll
2006-12-28 12:08 401,408 –a—— C:\WINDOWS\system32\Nmw3vwn.dll
2006-12-28 12:08 189,952 –a—— C:\WINDOWS\system32\Nmocod.dll
2006-12-28 12:08 1,933,312 –a—— C:\WINDOWS\system32\mfc70d.dll
2006-12-28 12:08 d——– C:\Program Files\The Name Technology
2006-12-28 12:07 389,120 –a—— C:\WINDOWS\TNTRegWizAdv.dll
2006-12-28 12:07 225,280 –a—— C:\WINDOWS\deutil.dll
2006-12-28 12:07 180,224 –a—— C:\WINDOWS\ComponentHelper.dll
2006-12-28 12:07 147,456 –a—— C:\WINDOWS\depSetupDLL.dll
2006-12-28 00:05 d——– C:\Program Files\uTorrent
2006-12-26 15:52 d——– C:\Program Files\Common Files\Download Manager
(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))
2007-01-25 07:54 ——– d——– C:\DOCUME~1\ADMINI~1\Application Data\utorrent
2007-01-25 07:47 ——– d——– C:\Program Files\mozilla firefox
2007-01-24 10:40 ——– d——– C:\Program Files\winamp
2007-01-23 23:10 ——– d——– C:\Program Files\speedfan
2007-01-20 14:16 ——– d——– C:\Program Files\promasoft autoresponder
2007-01-20 10:54 ——– d–h—– C:\Program Files\installshield installation information
2007-01-20 10:54 ——– d——– C:\Program Files\nvidia corporation
2007-01-20 10:53 ——– d——– C:\Program Files\newsleecher
2007-01-20 02:17 ——– d——– C:\Program Files\warez
2007-01-19 20:20 ——– d——– C:\Program Files\abc amber chm converter
2007-01-19 20:07 ——– d——– C:\Program Files\spyware doctor
2007-01-19 14:08 ——– d——– C:\Program Files\tuneup utilities 2006
2007-01-19 14:00 ——– d——– C:\Program Files\intervideo
2007-01-19 14:00 ——– d——– C:\Program Files\Common Files\installshield
2007-01-19 13:53 ——– d——– C:\Program Files\divx
2007-01-18 23:46 114048 –a—— C:\WINDOWS\system32\drivers\snapman.sys
2007-01-18 23:46 ——– d——– C:\Program Files\Common Files\acronis
2007-01-18 23:45 ——– d——– C:\Program Files\acronis
2007-01-13 12:00 ——– d——– C:\Program Files\Common Files\adobe
2007-01-10 19:41 ——– d—s—- C:\DOCUME~1\ADMINI~1\Application Data\microsoft
2007-01-10 14:38 ——– d——– C:\Program Files\workspace macro 4.5
2007-01-10 14:35 ——– d——– C:\Program Files\rich mailer
2007-01-10 14:35 ——– d——– C:\Program Files\local smtp relay server
2007-01-10 14:34 ——– d——– C:\DOCUME~1\ADMINI~1\Application Data\usenext
2007-01-10 13:05 ——– d——– C:\Program Files\microsoft works
2007-01-09 19:53 360448 –a—— C:\WINDOWS\system32\drivers\TCPIP.SYS
2007-01-07 19:29 ——– d——– C:\Program Files\Common Files\wise installation wizard
2006-12-29 17:29 ——– d——– C:\DOCUME~1\ADMINI~1\Application Data\bsplayer pro
2006-12-24 06:54 ——– d——– C:\Program Files\sendscheduler outlook
2006-12-24 02:23 98304 –a—— C:\WINDOWS\system32\cmdlineext.dll
2006-12-24 02:21 ——– d——– C:\DOCUME~1\ADMINI~1\Application Data\leadertech
2006-12-24 02:15 ——– d——– C:\Program Files\buena vista games
2006-12-24 02:11 ——– d——– C:\Program Files\daemon tools
2006-12-24 02:08 639224 –a—— C:\WINDOWS\system32\drivers\sptd.sys
2006-12-23 14:55 335 –a—— C:\Program Files\sendscheduler.log
2006-12-23 11:06 ——– d——– C:\Program Files\the logo creator v5
2006-12-23 01:15 ——– d——– C:\Program Files\basta computing
2006-12-23 01:15 ——– d——– C:\DOCUME~1\ADMINI~1\Application Data\basta computing
2006-12-23 01:08 ——– d——– C:\Program Files\1st mail server
2006-12-23 01:08 ——– d——– C:\Program Files\1st mail sender
2006-12-22 10:42 23275 –a—— C:\DOCUME~1\ADMINI~1\Application Data\comma separated values (windows).adr
2006-12-22 01:18 ——– d——– C:\Program Files\4team corporation
2006-12-22 01:18 ——– d——– C:\DOCUME~1\ADMINI~1\Application Data\4team
2006-12-20 23:04 ——– d——– C:\Program Files\lbe email scheduler
2006-12-20 16:53 ——– d——– C:\Program Files\group mail
2006-12-20 15:04 ——– d——– C:\Program Files\kaspersky lab
2006-12-20 14:41 ——– d——– C:\Program Files\microsoft.net
2006-12-19 18:39 ——– d——– C:\Program Files\Common Files\acd systems
2006-12-19 18:39 ——– d——– C:\Program Files\acd systems
2006-12-16 01:23 ——– d——– C:\Program Files\automize7
2006-12-16 01:02 ——– d–h—– C:\Program Files\zero g registry
2006-12-16 00:48 ——– d——– C:\Program Files\alarmwiz
2006-12-15 20:26 ——– d——– C:\DOCUME~1\ADMINI~1\Application Data\mapilab ltd
2006-12-14 21:35 ——– d——– C:\Program Files\sendmail
2006-12-14 00:32 ——– d——– C:\Program Files\usenext
2006-12-13 16:12 ——– d——– C:\DOCUME~1\ADMINI~1\Application Data\help
2006-12-13 13:11 ——– d——– C:\Program Files\argo software design
2006-12-12 23:33 ——– d——– C:\Program Files\webteh
2006-12-12 22:37 ——– d——– C:\Program Files\chm to pdf converter pro
2006-12-12 17:23 ——– d——– C:\Program Files\exp elite
2006-12-12 17:06 ——– d——– C:\Program Files\movie maker
2006-12-07 12:32 176167 –a—— C:\WINDOWS\system32\rmocx.dll
2006-12-07 12:30 ——– d——– C:\DOCUME~1\ADMINI~1\Application Data\real
2006-12-07 12:18 ——– d——– C:\Program Files\Common Files\xing shared
2006-12-07 12:18 ——– d——– C:\Program Files\Common Files\real
2006-12-07 12:17 ——– d——– C:\Program Files\real
2006-12-07 11:26 ——– d——– C:\Program Files\bytesky
2006-12-05 14:13 517120 –a—— C:\WINDOWS\system32\autoprnt.exe
2006-12-05 14:13 37888 –a—— C:\WINDOWS\system32\setupnt.dll
2006-12-05 14:09 ——– d——– C:\Program Files\powerquest
2006-12-05 12:53 ——– d——– C:\Program Files\brezosoft corporation
2006-12-05 12:44 ——– d——– C:\Program Files\information packaging
2006-12-05 11:16 52525 –a—— C:\DOCUME~1\ADMINI~1\Application Data\unins000.dat
2006-12-05 11:15 673546 –a—— C:\DOCUME~1\ADMINI~1\Application Data\unins000.exe
2006-12-05 11:15 ——– d——– C:\Program Files\groupmail 5
2006-12-03 15:12 ——– d——– C:\DOCUME~1\ADMINI~1\Application Data\acd systems
2006-12-03 15:02 ——– d——– C:\DOCUME~1\ADMINI~1\Application Data\adobe
2006-12-01 04:37 ——– d——– C:\Program Files\limewire
2006-12-01 01:31 ——– d——– C:\Program Files\shareaza
2006-12-01 01:31 ——– d——– C:\DOCUME~1\ADMINI~1\Application Data\shareaza
2006-12-01 01:14 ——– d——– C:\DOCUME~1\ADMINI~1\Application Data\morpheus
2006-12-01 01:02 ——– d——– C:\Program Files\morpheusbar
2006-11-30 22:01 ——– d——– C:\DOCUME~1\ADMINI~1\Application Data\warez
2006-11-30 21:46 ——– d——– C:\Program Files\anconia
2006-11-30 21:24 ——– d——– C:\Program Files\multiemail
2006-11-30 20:05 ——– d——– C:\Program Files\filepipe p2p
2006-11-30 17:09 ——– d——– C:\Program Files\sprika software
2006-11-30 16:54 ——– d——– C:\Program Files\Common Files\system-g
2006-11-30 16:16 ——– d——– C:\Program Files\worldcast
2006-11-30 14:41 ——– d——– C:\Program Files\mach5 mailer 4
2006-11-27 21:47 ——– d——– C:\DOCUME~1\ADMINI~1\Application Data\skype
2006-11-27 08:23 ——– d——– C:\Program Files\skype
2006-11-22 09:41 737280 –a—— C:\WINDOWS\iun6002.exe
2006-11-22 08:57 73216 –a—— C:\WINDOWS\st6unst.exe
2006-11-22 08:57 249856 –a—— C:\WINDOWS\setup1.exe
2006-10-31 11:49 397856 –a—— C:\WINDOWS\system32\xceedzip.dll
2006-10-30 07:17 62 –ahsc— C:\DOCUME~1\ADMINI~1\Application Data\desktop.ini
2006-10-29 23:35 0 -rahs—- C:\MSDOS.SYS
2006-10-29 23:35 0 -rahs—- C:\IO.SYS
2006-10-29 23:35 0 –a—— C:\CONFIG.SYS
2006-10-29 23:35 0 –a—— C:\AUTOEXEC.BAT
2006-10-26 19:58 30512 –a—— C:\WINDOWS\system32\mdimon.dll
2006-10-26 14:10 33088 –a—— C:\WINDOWS\system32\fm20enu.dll
2006-10-26 14:10 1190688 –a—— C:\WINDOWS\system32\fm20.dll
2006-10-26 13:45 293376 –a—— C:\WINDOWS\system32\wisptis.exe
2006-10-26 13:45 207360 –a—— C:\WINDOWS\system32\inked.dll
(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries & legit default entries are not shown
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"RoboForm"="\"C:\\Program Files\\Siber Systems\\AI RoboForm\\RoboTaskBarIcon.exe\""
"µTorrent"="\"C:\\Program Files\\uTorrent\\utorrent.exe\""
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
"Yahoo! Pager"="\"C:\\PROGRA~1\\Yahoo!\\Messenger\\YahooMessenger.exe\" -quiet"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"kis"="\"C:\\Program Files\\Kaspersky Lab\\Kaspersky Internet Security 6.0\\avp.exe\""
@=""
"cFosSpeed"="C:\\Program Files\\cFosSpeed\\cFosSpeed.exe"
"!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized"
"KernelFaultCheck"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,\
65,6d,33,32,5c,64,75,6d,70,72,65,70,20,30,20,2d,6b,00
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"RoboForm"="\"C:\\Program Files\\Siber Systems\\AI RoboForm\\RoboTaskBarIcon.exe\""
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Acronis Scheduler2 Service"="\"C:\\Program Files\\Common Files\\Acronis\\Schedule2\\schedhlp.exe\""
"AcronisTimounterMonitor"="C:\\Program Files\\Acronis\\TrueImageHome\\TimounterMonitor.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"SMTPMainService"=dword:00000002
"SDhelper"=dword:00000002
"ose"=dword:00000003
"FLEXnet Licensing Service"=dword:00000003
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"appinit_dlls"="C:\PROGRA~1\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{EDB0E980-90BD-11D4-8599-0008C7D3B6F8}"="Eudora's Shell Extension"
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"WPDShServiceObj"="{AAA288BA-9A4C-45B0-95D7-94D524869DB5}"
[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Spyware Doctor"="\"C:\\Program Files\\Spyware Doctor\\swdoctor.exe\" /Q"
[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"Spyware Doctor"="\"C:\\Program Files\\Spyware Doctor\\swdoctor.exe\" /Q"
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ClearRecentDocsOnExit"=dword:00000001
"NoRecentDocsMenu"=dword:00000001
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\run]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0
WudfServiceGroup REG_MULTI_SZ WUDFSvc\0\0
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{60ab938f-a7b1-11db-9fb7-806d6172696f}]
Shell\Auto\command infrom.exe
Shell\AutoRun\command C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL infrom.exe
Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\1-Click Maintenance.job
C:\WINDOWS\tasks\LBE Email Scheduler task created 11 Dec 2006 19 36.job
Completion time: 07-01-25 7:54:38
C:\ComboFix2.txt … 07-01-24 10:19
HijackThis Log :
Logfile of HijackThis v1.99.1
Scan saved at 7:59:03 AM, on 1/25/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
C:\Program Files\cFosSpeed\cFosSpeed.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\Program Files\uTorrent\utorrent.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
C:\Program Files\cFosSpeed\spd.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\java.exe
C:\Program Files\Raxco\PerfectDisk\PDSched.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\PROGRA~1\Yahoo!\Messenger\YahooMessenger.exe
D:\Software\System Utility\Hijack This\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = socks=127.0.0.1:8998
O2 - BHO: (no name) - {0000CC75-ACF3-4cac-A0A9-DD3868E06852} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: (no name) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - (no file)
O2 - BHO: (no name) - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - (no file)
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (file missing)
O4 - HKLM\..\Run: [kis] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe"
O4 - HKLM\..\Run: [cFosSpeed] C:\Program Files\cFosSpeed\cFosSpeed.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [µTorrent] "C:\Program Files\uTorrent\utorrent.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - Startup: Shortcut to startServer.bat.lnk = C:\Documents and Settings\Administrator\Desktop\paw-release-0.27\startServer.bat
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Add to Kaspersky Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\\ie_banner_deny.htm
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\Microsoft Office\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scieplugin.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\Microsoft Office\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\Microsoft Office\Office12\ONBttnIE.dll
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\Microsoft Office\Office12\REFIEBAR.DLL
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Kaspersky Internet Security 6.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" -r (file missing)
O23 - Service: cFosSpeed System Service (cFosSpeedS) - Unknown owner - C:\Program Files\cFosSpeed\spd.exe" -service (file missing)
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: PDScheduler (PDSched) - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDSched.exe
Folder c:\rm and ms.config very suspicious to me. I cannot see this folder in my windows explorer……
P/S : I just noticed today i have same problem when i try to open removeable disk . And there are folder rm and ms.config also in my removeable disk.
