[Resolved] Unknown Infection(s)

Hi there, recently i have been having some problems..help would really be appreciated! Thanks!

ad-aware, spybot have been installed and some infected files removed. however problem still persists.
windows defender has also been installed and used to scan.
spybot keeps detecting registry key changes after system start up and windows defender keeps detecting the same bunch of infected files (trojan (Virtualmundo?), windowsbundler.kaZaA)
pop ups appear after launching I.E and while I.E is open. pop ups mostly advertising brandarama, freeairlinegiftcard, musicplusTV.
system takes longer than normal to boot up.
I.E responding slowly (typing in the browser has a ton of missing letters, opening links takes a long time to load)
problems surfaced about 3days ago.

HijackThis™ Log:

Logfile of HijackThis v1.99.1
Scan saved at 10:48:30 PM, on 9/14/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Carmen\programs\adaware\aawservice.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\HPQ\SHARED\HPQTOA~1.EXE
C:\Program Files\SmartFix\bin\McciTrayApp.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Brother\ControlCenter2\brctrcen.exe
C:\Carmen\programs\poweriso\PWRISOVM.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Carmen\programs\adaware\AAWTray.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Carmen\programs\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\dllhost.exe
C:\Documents and Settings\Carmen\Start Menu\Programs\Startup\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\ghvgfxnd.exe
C:\Program Files\Brother\Brmfcmon\brmfcwnd.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…o&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.tp.edu.sg:80
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;*.tp.edu.sg;
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [Reminder] C:\Windows\CREATOR\Remind_XP.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [singtelTrayApp] "C:\Program Files\SmartFix\bin\McciTrayApp.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl05a\BrStDvPt.exe
O4 - HKLM\..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Carmen\programs\poweriso\PWRISOVM.EXE
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [AAWTray] C:\Carmen\programs\adaware\AAWTray.exe
O4 - HKLM\..\Run: [SystemOptimizer] rundll32.exe "C:\WINDOWS\system32\ayvpbicn.dll",forkonce
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Carmen\programs\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Startup: ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: dllhost.exe
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Status Monitor.lnk = C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Carmen\programs\bitcomet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Carmen\programs\bitcomet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Carmen\programs\bitcomet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Carmen\programs\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Carmen\programs\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_SG&c=Q106&bd=presario&pf=laptop
O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games.com.my/com/EGamesPlugin.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab
O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} (ijjiPlugin2 Class) - http://gamedownload.ijjimax.com/gamedownlo…Plugin11USA.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Carmen\programs\adaware\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\Shared\hpqwmi.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing)
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe


Once again, thanks in advance!

Thank you for the quick reply!
as per your instructions, here are the files:

SDfix Report.txt:

SDFix: Version 1.104

Run by [removed] on Sat 09/15/2007 at 12:18 AM

Microsoft Windows XP [Version 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting…


Normal Mode:
Checking Files:

Trojan Files Found:

C:\WINDOWS\SYSTEM32\TASKKILL.EXE - Deleted
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\dllhost.exe - Deleted
C:\Program Files\a.zip - Deleted
C:\Program Files\b.zip - Deleted
C:\Program Files\c.zip - Deleted
C:\Program Files\A.ico - Deleted
C:\Program Files\B.ico - Deleted
C:\Program Files\Setup.exe - Deleted
C:\Program Files\Track_03.exe - Deleted
C:\Program Files\Video.exe - Deleted
C:\Documents and Settings\Carmen\install.exe - Deleted
C:\WINDOWS\system32\install.exe - Deleted
C:\WINDOWS\system32\WINLOGO.EXE - Deleted



Removing Temp Files…

ADS Check:

C:\WINDOWS
No streams found.

C:\WINDOWS\system32
No streams found.

C:\WINDOWS\system32\svchost.exe
No streams found.

C:\WINDOWS\system32\ntoskrnl.exe
No streams found.



Final Check:

Remaining Services:
——————




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Carmen\\programs\\LimeWire\\LimeWire.exe"="C:\\Carmen\\programs\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
"C:\\WINDOWS\\system32\\eglxchub.exe"="C:\\WINDOWS\\system32\\egl"
"C:\\WINDOWS\\system32\\eopievfq.exe"="C:\\WINDOWS\\system32\\eop"
"C:\\WINDOWS\\system32\\ghvgfxnd.exe"="C:\\WINDOWS\\system32\\ghv"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

Remaining Files:
—————

File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes:

C:\Carmen\songs\Pirates.Of.The.Caribbean.At.Worlds.End.2007.Soundtrack.[WwW.LoKoTorrents.Co
]\Thumbs.db
C:\Carmen\songs\Pirates.Of.The.Caribbean.At.Worlds.End.2007.Soundtrack.[WwW.LoKoTorrents.Co
]\Pirates.Of.The.Caribbean.At.Worlds.End.2007.Soundtrack.[WwW.LoKoTorrents.Co
]\AlbumArtSmall.jpg
C:\Carmen\songs\Pirates.Of.The.Caribbean.At.Worlds.End.2007.Soundtrack.[WwW.LoKoTorrents.Co
]\Pirates.Of.The.Caribbean.At.Worlds.End.2007.Soundtrack.[WwW.LoKoTorrents.Co
]\AlbumArt_{0B8B34EF-6537-4C40-B871-CB1F1884CF4B}_Large.jpg
C:\Carmen\songs\Pirates.Of.The.Caribbean.At.Worlds.End.2007.Soundtrack.[WwW.LoKoTorrents.Co
]\Pirates.Of.The.Caribbean.At.Worlds.End.2007.Soundtrack.[WwW.LoKoTorrents.Co
]\AlbumArt_{0B8B34EF-6537-4C40-B871-CB1F1884CF4B}_Small.jpg
C:\Carmen\songs\Pirates.Of.The.Caribbean.At.Worlds.End.2007.Soundtrack.[WwW.LoKoTorrents.Co
]\Pirates.Of.The.Caribbean.At.Worlds.End.2007.Soundtrack.[WwW.LoKoTorrents.Co
]\desktop.ini
C:\Carmen\songs\Pirates.Of.The.Caribbean.At.Worlds.End.2007.Soundtrack.[WwW.LoKoTorrents.Co
]\Pirates.Of.The.Caribbean.At.Worlds.End.2007.Soundtrack.[WwW.LoKoTorrents.Co
]\Folder.jpg
C:\Recycled\Recycled\ctfmon.exe
C:\WINDOWS\winlo.exe
C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp
C:\WINDOWS\SoftwareDistribution\Download\S-1-5-1820d707bac435f3aaf9795e281e492d1\BIT13.tmp
C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\5c2fff059116831eadb67ce69de7675d\BIT10.tmp
C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\7c2abac6be44024546dacfbafa591a74\BIT6.tmp
C:\Carmen\programs\Veoh\downloads\Directory\searchcloud.zip.enc
C:\Carmen\programs\Veoh\downloads\Directory\webdirectory.zip.enc

Finished!


the new hijackthis:

Logfile of HijackThis v1.99.1
Scan saved at 12:43:41 AM, on 9/15/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Carmen\programs\adaware\aawservice.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\brss01a.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\PROGRA~1\HPQ\SHARED\HPQTOA~1.EXE
C:\Program Files\Symantec\LiveUpdate\AUpdate.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\SmartFix\bin\McciTrayApp.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
C:\Program Files\Brother\ControlCenter2\brctrcen.exe
C:\Carmen\programs\poweriso\PWRISOVM.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Carmen\programs\adaware\AAWTray.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Carmen\programs\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Documents and Settings\Carmen\Start Menu\Programs\Startup\ctfmon.exe
C:\Program Files\Hijackthis\HijackThis.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…o&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.tp.edu.sg:80
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;*.tp.edu.sg;
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [Reminder] C:\Windows\CREATOR\Remind_XP.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [singtelTrayApp] "C:\Program Files\SmartFix\bin\McciTrayApp.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl05a\BrStDvPt.exe
O4 - HKLM\..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Carmen\programs\poweriso\PWRISOVM.EXE
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [AAWTray] C:\Carmen\programs\adaware\AAWTray.exe
O4 - HKLM\..\Run: [SystemOptimizer] rundll32.exe "C:\WINDOWS\system32\ayvpbicn.dll",forkonce
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Carmen\programs\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Startup: ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Status Monitor.lnk = C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Carmen\programs\bitcomet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Carmen\programs\bitcomet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Carmen\programs\bitcomet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Carmen\programs\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Carmen\programs\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_SG&c=Q106&bd=presario&pf=laptop
O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games.com.my/com/EGamesPlugin.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab
O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} (ijjiPlugin2 Class) - http://gamedownload.ijjimax.com/gamedownlo…Plugin11USA.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Carmen\programs\adaware\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\Shared\hpqwmi.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing)
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe



Once again, thank you!

hello,

here are the files as instructed:

uninstall.txt:

Ad-Aware 2007
Adobe Flash Player 9 ActiveX
Adobe Reader 7.0
Adobe Shockwave Player
Alien Shooter
Apple Software Update
Athlon 64 Processor Driver
ATI - Software Uninstall Utility
ATI Control Panel
ATI Display Driver
Ballistik
Bejeweled 2 Deluxe
BeTrapped!
biohazard 4
BitComet 0.89
Bookworm Deluxe
Bricks of Egypt
Brother MFL-Pro Suite
CC_ccProxyExt
ccCommon
ccPxyCore
Chainz
Chuzzle
Conexant AC-Link Audio
Counter-Strike 1.6
Cubis Gold 2
Customer Experience Enhancement
Data Fax SoftModem with SmartCP
DivX Codec
DivX Content Uploader
DivX Converter
DivX Player
DivX Web Player
Easy Internet Sign-up
Feeding Frenzy
GameGuard
Google Toolbar for Internet Explorer
GunboundWC
Hijackthis 1.99.1
HijackThis 1.99.1
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB896256)
Hotfix for Windows XP (KB914440)
Hotfix for Windows XP (KB915865)
Hotfix for Windows XP (KB926239)
HP DVD Play 2.0
HP Help and Support
HP Imaging Device Functions 6.0
HP Photosmart Premier Software 6.0
HP Software Update
HP User Guides 0024
HP User Guides–System Recovery
HP Wireless Assistant 2.00 B3
Insaniquarium Deluxe
Inspector-Parker
iTunes
J2SE Runtime Environment 5.0 Update 6
J2SE Runtime Environment 5.0 Update 8
Java™ 6 Update 2
Java™ SE Runtime Environment 6 Update 1
Jets n Guns
Jewel Quest
Jigsaw 365
LimeWire 4.12.15
Links® Course Challenge – Chateau Whistler
LiveUpdate 3.0 (Symantec Corporation)
LiveUpdate Notice (Symantec Corporation)
Luxor
Magic Ball 2
Magic Inlay
Mah Jong Medley
Mah Jong Quest
Max Payne
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft Money
Microsoft National Language Support Downlevel APIs
Microsoft Office XP Professional with FrontPage
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Windows Journal Viewer
Microsoft Works
MSRedist
MSXML 4.0 SP2 (KB925672)
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
muvee autoProducer 4.5
Norton AntiSpam
Norton AntiVirus 2006
Norton Internet Security
Norton Internet Security
Norton Internet Security
Norton Internet Security
Norton Internet Security
Norton Internet Security
Norton Internet Security
Norton Internet Security
Norton Internet Security 2006 (Symantec Corporation)
Norton Protection Center
Norton WMI Update
Norton WMI Update
O2Jam (e-Games) v.3.50
Office Animation Runtime
PaperPort
Poker Superstars
PowerISO
Prism
Quick Launch Buttons 5.20 G1
QuickTime
Ricochet Lost Worlds
Security Update for CAPICOM (KB931906)
Security Update for CAPICOM (KB931906)
Security Update for Step By Step Interactive Training (KB898458)
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 9 (KB911565)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893066)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896422)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901190)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB903235)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911567)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913446)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB916281)
Security Update for Windows XP (KB917159)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB918899)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920214)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB921503)
Security Update for Windows XP (KB921883)
Security Update for Windows XP (KB922616)
Security Update for Windows XP (KB922760)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB923694)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925454)
Security Update for Windows XP (KB925486)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928090)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
Security Update for Windows XP (KB936021)
Security Update for Windows XP (KB938829)
Shape Solitaire
SingTel SmartFix
Slingo
Sonic Audio Module
Sonic Copy Module
Sonic Data Module
Sonic Express Labeler
Sonic MyDVD Plus
Sonic Update Manager
SPBBC
Spin & Win
Spybot - Search & Destroy
Star Wars JK II Jedi Outcast
Synaptics Pointing Device Driver
Texas Instruments PCIxx21/x515/xx12 drivers.
Tradewinds 2
Tumblebugs
Update for Windows XP (KB894391)
Update for Windows XP (KB896727)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB904942)
Update for Windows XP (KB908531)
Update for Windows XP (KB910437)
Update for Windows XP (KB911280)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB927891)
Update for Windows XP (KB930916)
Update for Windows XP (KB931836)
Update for Windows XP (KB933360)
Update for Windows XP (KB938828)
VideoLAN VLC media player 0.8.6c
Windows Defender
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Live Messenger
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player 11
Windows XP Hotfix - KB873333
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB884575
Windows XP Hotfix - KB885250
Windows XP Hotfix - KB885464
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB885855
Windows XP Hotfix - KB885884
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB887742
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB888239
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB888402
Windows XP Hotfix - KB889673
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891781
Windows XP Hotfix - KB892559
WinRAR archiver
Wonderland - Secret Worlds
Zuma Deluxe


combofix log:

ComboFix 07-09-14.2 - "Carmen" 2007-09-15 19:44:00.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.826 [GMT 8:00]
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Autorun.inf
C:\WINDOWS\cookies.ini
C:\WINDOWS\system32\_000008_.tmp.dll
C:\WINDOWS\system32\_000025_.tmp.dll
C:\WINDOWS\system32\bxwrbrsa.dll
C:\WINDOWS\system32\dgjlm.bak1
C:\WINDOWS\system32\dgjlm.bak2
C:\WINDOWS\system32\dgjlm.ini
C:\WINDOWS\system32\eopievfq.exe
C:\WINDOWS\system32\ghvgfxnd.exe
C:\WINDOWS\system32\gqusxjbl.exe
C:\WINDOWS\system32\hndmopmw.exe
C:\WINDOWS\system32\mljgd.dll
C:\WINDOWS\system32\urqrsrs.dll
C:\WINDOWS\system32\wyuhvaip.exe
C:\WINDOWS\system32\ymgwlaml.dll
D:\Autorun.inf

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))


——-\LEGACY_DOMAINSERVICE


((((((((((((((((((((((((( Files Created from 2007-08-15 to 2007-09-15 )))))))))))))))))))))))))))))))
.

2007-09-15 19:41 51,200 –a—— C:\WINDOWS\NirCmd.exe
2007-09-15 00:15 d——– C:\WINDOWS\ERUNT
2007-09-14 20:29 199 –a—— C:\WINDOWS\system32\9964.bat
2007-09-14 00:47 263 –a—— C:\WINDOWS\system32\2345.bat
2007-09-13 01:59 626,688 –a—— C:\WINDOWS\system32\msvcr80.dll
2007-09-13 01:25 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\McAfee
2007-09-13 01:24 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-09-12 22:31 157 –a—— C:\WINDOWS\system32\9543.bat
2007-09-11 16:34 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-09-11 16:32 d——– C:\Program Files\Common Files\Wise Installation Wizard
2007-09-10 22:58 d——– C:\Program Files\Windows Defender
2007-09-10 22:29 157 –a—— C:\DOCUME~1\Carmen\7647.bat
2007-09-10 00:22 203,155 —hs—- C:\WINDOWS\winlo.exe
2007-09-10 00:22 157 –a—— C:\DOCUME~1\Carmen\2912.bat
2007-09-08 21:26 209 –a—— C:\DOCUME~1\Carmen\6990.bat
2007-09-05 14:55 4,682 –a—— C:\WINDOWS\system32\npptNT2.sys
2007-09-04 13:30 159,744 –a—— C:\WINDOWS\system32\lfpng13n.dll
2007-08-29 13:12 209 –a—— C:\DOCUME~1\Carmen\2339.bat
2007-08-28 12:14 209 –a—— C:\DOCUME~1\Carmen\7123.bat
2007-08-27 12:58 209 –a—— C:\DOCUME~1\Carmen\5916.bat
2007-08-26 12:05 d——– C:\DOCUME~1\Carmen\APPLIC~1\Media Player Classic
2007-08-25 11:32 209 –a—— C:\DOCUME~1\Carmen\5708.bat
2007-08-24 15:02 209 –a—— C:\DOCUME~1\Carmen\9418.bat
2007-08-23 10:07 209 –a—— C:\DOCUME~1\Carmen\5701.bat
2007-08-22 14:29 167 –a—— C:\DOCUME~1\Carmen\5367.bat
2007-08-19 21:37 69,632 –a—— C:\WINDOWS\system32\lfgif13n.dll
2007-08-19 21:37 57,344 –a—— C:\WINDOWS\system32\lfbmp13n.dll
2007-08-19 21:37 462,848 –a—— C:\WINDOWS\system32\ltkrn13n.dll
2007-08-19 21:37 450,560 –a—— C:\WINDOWS\system32\ltimg13n.dll
2007-08-19 21:37 401,408 –a—— C:\WINDOWS\system32\lfcmp13n.dll
2007-08-19 21:37 299,008 –a—— C:\WINDOWS\system32\ltdis13n.dll
2007-08-19 21:37 206,336 –a—— C:\WINDOWS\system32\ltefx13n.dll
2007-08-19 21:37 163,840 –a—— C:\WINDOWS\system32\ltfil13n.dll
2007-08-18 00:04 d——– C:\Program Files\PacNet Sign Up
2007-08-17 17:40 209 –a—— C:\DOCUME~1\Carmen\4124.bat
2007-08-16 15:37 209 –a—— C:\WINDOWS\system32\4069.bat
2007-08-15 11:39 209 –a—— C:\DOCUME~1\Carmen\2645.bat

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-15 19:24 ——— d——– C:\Program Files\Common Files\Symantec Shared
2007-09-14 20:28 78360 –a—— C:\Program Files\uy.exe
2007-09-13 02:22 ——— d——– C:\Program Files\Google
2007-09-13 02:06 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Motive
2007-09-11 20:43 ——— d——– C:\DOCUME~1\Carmen\APPLIC~1\LimeWire
2007-09-11 20:20 ——— d–h—– C:\Program Files\InstallShield Installation Information
2007-09-11 20:17 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
2007-09-11 12:51 ——— d——– C:\DOCUME~1\Carmen\APPLIC~1\AdobeUM
2007-09-08 21:26 32768 –a—— C:\DOCUME~1\Carmen\setup9x.exe
2007-08-29 13:12 218600 –a—— C:\Program Files\zic03916
2007-08-29 13:12 217700 –a—— C:\Program Files\zib03916
2007-08-29 13:12 217700 –a—— C:\Program Files\zia03916
2007-08-23 10:05 128 –a—— C:\DOCUME~1\Carmen\app.exe
2007-08-14 22:29 209 –a—— C:\DOCUME~1\Carmen\3739.bat
2007-08-10 11:30 209 –a—— C:\DOCUME~1\Carmen\7023.bat
2007-08-10 11:30 128 –a—— C:\DOCUME~1\Carmen\rev.exe
2007-08-09 22:08 167 –a—— C:\DOCUME~1\Carmen\6316.bat
2007-08-09 13:31 167 –a—— C:\DOCUME~1\Carmen\2738.bat
2007-08-08 23:48 167 –a—— C:\DOCUME~1\Carmen\7450.bat
2007-08-07 15:26 167 –a—— C:\DOCUME~1\Carmen\1903.bat
2007-08-07 13:58 8320 –a—— C:\WINDOWS\system32\drivers\AWRTRD.sys
2007-08-07 13:56 9344 –a—— C:\WINDOWS\system32\drivers\NSDriver.sys
2007-08-06 20:22 167 –a—— C:\DOCUME~1\Carmen\5464.bat
2007-08-05 00:24 ——— d–h—– C:\DOCUME~1\Carmen\APPLIC~1\ijjigame
2007-08-04 21:03 167 –a—— C:\DOCUME~1\Carmen\4483.bat
2007-08-04 13:10 167 –a—— C:\DOCUME~1\Carmen\2955.bat
2007-08-03 17:39 167 –a—— C:\DOCUME~1\Carmen\7314.bat
2007-08-02 19:21 167 –a—— C:\DOCUME~1\Carmen\5334.bat
2007-08-02 13:37 ——— d——– C:\Program Files\NCH Swift Sound
2007-08-01 22:44 167 –a—— C:\DOCUME~1\Carmen\3224.bat
2007-07-31 13:39 167 –a—— C:\DOCUME~1\Carmen\5942.bat
2007-07-30 17:27 167 –a—— C:\DOCUME~1\Carmen\5002.bat
2007-07-29 12:26 167 –a—— C:\DOCUME~1\Carmen\7695.bat
2007-07-28 14:03 167 –a—— C:\DOCUME~1\Carmen\7964.bat
2007-07-27 19:35 ——— d——– C:\Program Files\Oberon Media
2007-07-27 19:33 ——— d-a—— C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
2007-07-27 17:10 167 –a—— C:\DOCUME~1\Carmen\4538.bat
2007-07-27 00:06 ——— d——– C:\DOCUME~1\Carmen\APPLIC~1\7Wonders
2007-07-26 15:50 167 –a—— C:\DOCUME~1\Carmen\8778.bat
2007-07-25 14:09 167 –a—— C:\DOCUME~1\Carmen\4206.bat
2007-07-24 15:05 167 –a—— C:\DOCUME~1\Carmen\4417.bat
2007-07-23 20:48 167 –a—— C:\DOCUME~1\Carmen\1059.bat
2007-07-23 20:37 167 –a—— C:\DOCUME~1\Carmen\9828.bat
2007-07-22 11:30 167 –a—— C:\DOCUME~1\Carmen\9656.bat
2007-07-20 20:33 167 –a—— C:\DOCUME~1\Carmen\8221.bat
2007-07-19 16:23 167 –a—— C:\DOCUME~1\Carmen\3649.bat
2007-07-19 16:22 218600 –a—— C:\Program Files\zic04088
2007-07-19 16:22 217700 –a—— C:\Program Files\zib04088
2007-07-19 16:22 217700 –a—— C:\Program Files\zia04088
2007-07-18 20:36 167 –a—— C:\DOCUME~1\Carmen\4517.bat
2007-07-17 20:10 ——— d——– C:\DOCUME~1\Carmen\APPLIC~1\dvdcss
2007-07-17 16:42 167 –a—— C:\DOCUME~1\Carmen\9567.bat
2007-07-16 20:40 167 –a—— C:\DOCUME~1\Carmen\3836.bat
2007-07-15 14:23 167 –a—— C:\DOCUME~1\Carmen\1732.bat
2007-07-14 12:40 167 –a—— C:\DOCUME~1\Carmen\2022.bat
2007-07-14 12:24 167 –a—— C:\DOCUME~1\Carmen\8610.bat
2007-07-13 17:26 167 –a—— C:\DOCUME~1\Carmen\3404.bat
2007-07-11 16:59 167 –a—— C:\DOCUME~1\Carmen\2809.bat
2007-07-10 13:28 167 –a—— C:\DOCUME~1\Carmen\6288.bat
2007-07-10 13:17 167 –a—— C:\DOCUME~1\Carmen\5818.bat
2007-07-09 17:03 167 –a—— C:\DOCUME~1\Carmen\8858.bat
2007-07-09 16:49 167 –a—— C:\DOCUME~1\Carmen\5684.bat
2007-07-08 16:52 167 –a—— C:\DOCUME~1\Carmen\6031.bat
2007-07-08 13:53 167 –a—— C:\DOCUME~1\Carmen\2637.bat
2007-07-08 13:39 167 –a—— C:\DOCUME~1\Carmen\8846.bat
2005-09-24 00:49 12288 –a–c— C:\WINDOWS\Fonts\RandFont.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3CB1B559-5B9A-4DA4-826D-7DB4EDBB4332}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A5906242-BB5E-4382-A2A3-C61D6E303F16}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-07-13 21:05]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2005-02-02 20:12]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-02-02 20:11]
"hpWirelessAssistant"="C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2005-11-16 08:30]
"HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-22 22:19]
"QPService"="C:\Program Files\HP\QuickPlay\QPService.exe" [2005-12-12 11:39]
"eabconfg.cpl"="C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe" [2005-12-22 08:57]
"Cpqset"="C:\Program Files\HPQ\Default Settings\cpqset.exe" [2005-02-17 14:01]
"RecGuard"="C:\Windows\SMINST\RecGuard.exe" [2005-10-11 10:23]
"Reminder"="C:\Windows\CREATOR\Remind_XP.exe" [2006-02-09 09:52]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-04 21:00]
"IMEKRMIG6.1"="C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE" [2004-08-04 21:00]
"MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 21:00]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 21:00]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 21:00]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-16 10:54]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-03-14 19:05]
"singtelTrayApp"="C:\Program Files\SmartFix\bin\McciTrayApp.exe" [2007-03-16 13:45]
"SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-10-14 10:22]
"PaperPort PTD"="C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe" [2005-03-17 14:25]
"IndexSearch"="C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe" [2005-03-17 14:45]
"SetDefPrt"="C:\Program Files\Brother\Brmfl05a\BrStDvPt.exe" [2005-01-26 18:02]
"ControlCenter2.0"="C:\Program Files\Brother\ControlCenter2\brctrcen.exe" [2005-05-17 17:42]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 18:30]
"PWRISOVM.EXE"="C:\Carmen\programs\poweriso\PWRISOVM.EXE" [2007-04-09 20:23]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20]
"AAWTray"="C:\Carmen\programs\adaware\AAWTray.exe" [2007-08-08 15:53]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 16:00]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2004-11-22 08:18]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-09-13 17:46]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t

C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 04:44:06]
HP Photosmart Premier Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2005-09-24 01:39:30]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04]
Status Monitor.lnk - C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe [2007-06-24 12:50:35]

C:\DOCUME~1\Carmen\STARTM~1\Programs\Startup\
ctfmon.exe [2006-06-27 14:23:42]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\\WINDOWS\\system32\\mljgd

R3 HSFHWATI;HSFHWATI;C:\WINDOWS\system32\DRIVERS\HSFHWATI.sys
S3 BrScnUsb;Brother USB Still Image driver;C:\WINDOWS\system32\Drivers\BrScnUsb.sys


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\Recycled\ctfmon.exe
Open(&O)\command- C:\Recycled\Recycled\ctfmon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe protect.ed 480 480

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4137ec2d-1ff4-11dc-b966-0014a5a8b07d}]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
Open(&0)\command- G:\Recycled\ctfmon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{45f693c0-1da1-11dc-b962-0014a5a8b07d}]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
Open(&0)\command- F:\Recycled\ctfmon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{76284066-3f4b-11dc-b99d-0014a5a8b07d}]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
Open(&0)\command- Recycled\ctfmon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bf8677de-1e25-11dc-b963-0014a5a8b07d}]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
Open(&0)\command- H:\Recycled\ctfmon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ccccb449-7532-11db-b928-0014a5a8b07d}]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
Open(&0)\command- G:\Recycled\ctfmon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cdd2147e-adf6-11db-b941-0014a5a8b07d}]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
Open(&0)\command- G:\Recycled\ctfmon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fa2ce9a8-218d-11dc-b96b-0014a5a8b07d}]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
Open(&0)\command- G:\Recycled\ctfmon.exe

*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder
"2007-08-25 10:45:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2007-09-15 12:03:38 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
"2007-09-07 13:18:08 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - Carmen.job"
.
**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-15 20:01:18
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = C:\Program Files\HPQ\Default Settings\cpqset.exe???????????????|?????? ???B?????????????hLC? ??????

scanning hidden files …

**************************************************************************
.
Completion time: 2007-09-15 20:07:03 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-09-15 20:06
.
— E O F —



new hijackthis log:

Logfile of HijackThis v1.99.1
Scan saved at 8:08:45 PM, on 9/15/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Carmen\programs\adaware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\brss01a.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\HPQ\SHARED\HPQTOA~1.EXE
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\SmartFix\bin\McciTrayApp.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Brother\ControlCenter2\brctrcen.exe
C:\Carmen\programs\poweriso\PWRISOVM.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Carmen\programs\adaware\AAWTray.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Documents and Settings\Carmen\Start Menu\Programs\Startup\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\Symantec\LiveUpdate\AUpdate.exe
C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Hijackthis\Scanner.exe.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\WINDOWS\system32\cmd.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…o&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.tp.edu.sg:80
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;*.tp.edu.sg;
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Carmen\programs\bitcomet\tools\BitCometBHO_1.1.5.19.dll
O2 - BHO: (no name) - {3CB1B559-5B9A-4DA4-826D-7DB4EDBB4332} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Carmen\programs\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {A5906242-BB5E-4382-A2A3-C61D6E303F16} - (no file)
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [Reminder] C:\Windows\CREATOR\Remind_XP.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [singtelTrayApp] "C:\Program Files\SmartFix\bin\McciTrayApp.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl05a\BrStDvPt.exe
O4 - HKLM\..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Carmen\programs\poweriso\PWRISOVM.EXE
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [AAWTray] C:\Carmen\programs\adaware\AAWTray.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Startup: ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Status Monitor.lnk = C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Carmen\programs\bitcomet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Carmen\programs\bitcomet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Carmen\programs\bitcomet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Carmen\programs\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Carmen\programs\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_SG&c=Q106&bd=presario&pf=laptop
O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games.com.my/com/EGamesPlugin.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab
O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} (ijjiPlugin2 Class) - http://gamedownload.ijjimax.com/gamedownlo…Plugin11USA.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Carmen\programs\adaware\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\Shared\hpqwmi.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing)
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe



thanks!

Hello smiggers,

Using Add Or Remove Programs remove the following entries (if present): (To get into add Or Remove Programs press the START button > Control Panel > Add Or Remove Programs.)

LimeWire 4.12.15
J2SE Runtime Environment 5.0 Update 6
J2SE Runtime Environment 5.0 Update 8
Poker Superstars

A. Please RUN HijackThis

• Click the SCAN button to produce a log.
  
  
• Place a check mark beside each one of the following items:
  
  O2 - BHO: (no name) - {3CB1B559-5B9A-4DA4-826D-7DB4EDBB4332} - (no file)
  O2 - BHO: (no name) - {A5906242-BB5E-4382-A2A3-C61D6E303F16} - (no file)
  O4 - Startup: ctfmon.exe
  
  
• Now with all the items selected, and all windows closed except for HJT, delete them by clicking the FIX checked button. Close the HijackThis window.

B. 1. Please open Notepad

• Click Start , then Run
• Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

File::
C:\WINDOWS\system32\9964.bat
C:\WINDOWS\system32\2345.bat
C:\WINDOWS\system32\9543.bat
C:\DOCUME~1\Carmen\7647.bat
C:\WINDOWS\winlo.exe
C:\DOCUME~1\Carmen\2912.bat
C:\DOCUME~1\Carmen\6990.bat
C:\DOCUME~1\Carmen\2339.bat
C:\DOCUME~1\Carmen\7123.bat
C:\DOCUME~1\Carmen\5916.bat
C:\DOCUME~1\Carmen\5708.bat
C:\DOCUME~1\Carmen\9418.bat
C:\DOCUME~1\Carmen\5701.bat
C:\DOCUME~1\Carmen\5367.bat
C:\DOCUME~1\Carmen\4124.bat
C:\WINDOWS\system32\4069.bat
C:\DOCUME~1\Carmen\2645.bat
C:\Program Files\uy.exe
C:\DOCUME~1\Carmen\app.exe
C:\DOCUME~1\Carmen\3739.bat
C:\DOCUME~1\Carmen\7023.bat
C:\DOCUME~1\Carmen\rev.exe
C:\DOCUME~1\Carmen\6316.bat
C:\DOCUME~1\Carmen\2738.bat
C:\DOCUME~1\Carmen\7450.bat
C:\DOCUME~1\Carmen\1903.bat
C:\DOCUME~1\Carmen\5464.bat
C:\DOCUME~1\Carmen\4483.bat
C:\DOCUME~1\Carmen\2955.bat
C:\DOCUME~1\Carmen\7314.bat
C:\DOCUME~1\Carmen\5334.bat
C:\DOCUME~1\Carmen\3224.bat
C:\DOCUME~1\Carmen\5942.bat
C:\DOCUME~1\Carmen\5002.bat
C:\DOCUME~1\Carmen\7695.bat
C:\DOCUME~1\Carmen\7964.bat
C:\DOCUME~1\Carmen\4538.bat
C:\DOCUME~1\Carmen\8778.bat
C:\DOCUME~1\Carmen\4206.bat
C:\DOCUME~1\Carmen\4417.bat
C:\DOCUME~1\Carmen\1059.bat
C:\DOCUME~1\Carmen\9828.bat
C:\DOCUME~1\Carmen\9656.bat
C:\DOCUME~1\Carmen\8221.bat
C:\DOCUME~1\Carmen\3649.bat
C:\DOCUME~1\Carmen\4517.bat
C:\DOCUME~1\Carmen\9567.bat
C:\DOCUME~1\Carmen\3836.bat
C:\DOCUME~1\Carmen\1732.bat
C:\DOCUME~1\Carmen\2022.bat
C:\DOCUME~1\Carmen\8610.bat
C:\DOCUME~1\Carmen\3404.bat
C:\DOCUME~1\Carmen\2809.bat
C:\DOCUME~1\Carmen\6288.bat
C:\DOCUME~1\Carmen\5818.bat
C:\DOCUME~1\Carmen\8858.bat
C:\DOCUME~1\Carmen\5684.bat
C:\DOCUME~1\Carmen\6031.bat
C:\DOCUME~1\Carmen\2637.bat
C:\DOCUME~1\Carmen\8846.bat
C:\\WINDOWS\\system32\\mljgd

Folder::
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire
C:\Program Files\zic04088
C:\Program Files\zib04088
C:\Program Files\zia04088
C:\Program Files\zic03916
C:\Program Files\zib03916
C:\Program Files\zia03916

Registry::
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\\WINDOWS\\system32\\mljgd
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4137ec2d-1ff4-11dc-b966-0014a5a8b07d}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{45f693c0-1da1-11dc-b962-0014a5a8b07d}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{76284066-3f4b-11dc-b99d-0014a5a8b07d}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bf8677de-1e25-11dc-b963-0014a5a8b07d}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ccccb449-7532-11db-b928-0014a5a8b07d}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cdd2147e-adf6-11db-b941-0014a5a8b07d}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fa2ce9a8-218d-11dc-b96b-0014a5a8b07d}]

3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

[external image: Posted Image]


5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

• Combofix.txt
• A new HijackThis log.

i cant seem to be able to fix this: O4 - Startup: ctfmon.exe
hijackthis prompt me to end the process in task manager which i did then to run hijackthis again.
however, although ctfmon.exe is no longer under the running process list of task manager, hijackthis still cant fix it and prompts me again to end the process..

here is the new comboFix log:

ComboFix 07-09-14.2 - "Carmen" 2007-09-15 23:54:21.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.837 [GMT 8:00]
Command switches used :: C:\Documents and Settings\Carmen\Desktop\CFScript.txt
* Created a new restore point

FILE::
C:\WINDOWS\system32\9964.bat
C:\WINDOWS\system32\2345.bat
C:\WINDOWS\system32\9543.bat
C:\DOCUME~1\Carmen\7647.bat
C:\WINDOWS\winlo.exe
C:\DOCUME~1\Carmen\2912.bat
C:\DOCUME~1\Carmen\6990.bat
C:\DOCUME~1\Carmen\2339.bat
C:\DOCUME~1\Carmen\7123.bat
C:\DOCUME~1\Carmen\5916.bat
C:\DOCUME~1\Carmen\5708.bat
C:\DOCUME~1\Carmen\9418.bat
C:\DOCUME~1\Carmen\5701.bat
C:\DOCUME~1\Carmen\5367.bat
C:\DOCUME~1\Carmen\4124.bat
C:\WINDOWS\system32\4069.bat
C:\DOCUME~1\Carmen\2645.bat
C:\Program Files\uy.exe
C:\DOCUME~1\Carmen\app.exe
C:\DOCUME~1\Carmen\3739.bat
C:\DOCUME~1\Carmen\7023.bat
C:\DOCUME~1\Carmen\rev.exe
C:\DOCUME~1\Carmen\6316.bat
C:\DOCUME~1\Carmen\2738.bat
C:\DOCUME~1\Carmen\7450.bat
C:\DOCUME~1\Carmen\1903.bat
C:\DOCUME~1\Carmen\5464.bat
C:\DOCUME~1\Carmen\4483.bat
C:\DOCUME~1\Carmen\2955.bat
C:\DOCUME~1\Carmen\7314.bat
C:\DOCUME~1\Carmen\5334.bat
C:\DOCUME~1\Carmen\3224.bat
C:\DOCUME~1\Carmen\5942.bat
C:\DOCUME~1\Carmen\5002.bat
C:\DOCUME~1\Carmen\7695.bat
C:\DOCUME~1\Carmen\7964.bat
C:\DOCUME~1\Carmen\4538.bat
C:\DOCUME~1\Carmen\8778.bat
C:\DOCUME~1\Carmen\4206.bat
C:\DOCUME~1\Carmen\4417.bat
C:\DOCUME~1\Carmen\1059.bat
C:\DOCUME~1\Carmen\9828.bat
C:\DOCUME~1\Carmen\9656.bat
C:\DOCUME~1\Carmen\8221.bat
C:\DOCUME~1\Carmen\3649.bat
C:\DOCUME~1\Carmen\4517.bat
C:\DOCUME~1\Carmen\9567.bat
C:\DOCUME~1\Carmen\3836.bat
C:\DOCUME~1\Carmen\1732.bat
C:\DOCUME~1\Carmen\2022.bat
C:\DOCUME~1\Carmen\8610.bat
C:\DOCUME~1\Carmen\3404.bat
C:\DOCUME~1\Carmen\2809.bat
C:\DOCUME~1\Carmen\6288.bat
C:\DOCUME~1\Carmen\5818.bat
C:\DOCUME~1\Carmen\8858.bat
C:\DOCUME~1\Carmen\5684.bat
C:\DOCUME~1\Carmen\6031.bat
C:\DOCUME~1\Carmen\2637.bat
C:\DOCUME~1\Carmen\8846.bat
C:\\WINDOWS\\system32\\mljgd
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Autorun.inf
C:\DOCUME~1\Carmen\1059.bat
C:\DOCUME~1\Carmen\1732.bat
C:\DOCUME~1\Carmen\1903.bat
C:\DOCUME~1\Carmen\2022.bat
C:\DOCUME~1\Carmen\2339.bat
C:\DOCUME~1\Carmen\2637.bat
C:\DOCUME~1\Carmen\2645.bat
C:\DOCUME~1\Carmen\2738.bat
C:\DOCUME~1\Carmen\2809.bat
C:\DOCUME~1\Carmen\2912.bat
C:\DOCUME~1\Carmen\2955.bat
C:\DOCUME~1\Carmen\3224.bat
C:\DOCUME~1\Carmen\3404.bat
C:\DOCUME~1\Carmen\3649.bat
C:\DOCUME~1\Carmen\3739.bat
C:\DOCUME~1\Carmen\3836.bat
C:\DOCUME~1\Carmen\4124.bat
C:\DOCUME~1\Carmen\4206.bat
C:\DOCUME~1\Carmen\4417.bat
C:\DOCUME~1\Carmen\4483.bat
C:\DOCUME~1\Carmen\4517.bat
C:\DOCUME~1\Carmen\4538.bat
C:\DOCUME~1\Carmen\5002.bat
C:\DOCUME~1\Carmen\5334.bat
C:\DOCUME~1\Carmen\5367.bat
C:\DOCUME~1\Carmen\5464.bat
C:\DOCUME~1\Carmen\5684.bat
C:\DOCUME~1\Carmen\5701.bat
C:\DOCUME~1\Carmen\5708.bat
C:\DOCUME~1\Carmen\5818.bat
C:\DOCUME~1\Carmen\5916.bat
C:\DOCUME~1\Carmen\5942.bat
C:\DOCUME~1\Carmen\6031.bat
C:\DOCUME~1\Carmen\6288.bat
C:\DOCUME~1\Carmen\6316.bat
C:\DOCUME~1\Carmen\6990.bat
C:\DOCUME~1\Carmen\7023.bat
C:\DOCUME~1\Carmen\7123.bat
C:\DOCUME~1\Carmen\7314.bat
C:\DOCUME~1\Carmen\7450.bat
C:\DOCUME~1\Carmen\7647.bat
C:\DOCUME~1\Carmen\7695.bat
C:\DOCUME~1\Carmen\7964.bat
C:\DOCUME~1\Carmen\8221.bat
C:\DOCUME~1\Carmen\8610.bat
C:\DOCUME~1\Carmen\8778.bat
C:\DOCUME~1\Carmen\8846.bat
C:\DOCUME~1\Carmen\8858.bat
C:\DOCUME~1\Carmen\9418.bat
C:\DOCUME~1\Carmen\9567.bat
C:\DOCUME~1\Carmen\9656.bat
C:\DOCUME~1\Carmen\9828.bat
C:\DOCUME~1\Carmen\app.exe
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\.NetworkShare\LimeWireWin4.14.8.exe
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\412splashfree.png
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\createtimes.cache
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\data.ser
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\fileurns.bak
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\fileurns.cache
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\filters.props
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\gnutella.net
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\installation.props
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\library.dat
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\limewire.props
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\pub1.key
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\public.key
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\questions.props
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\responses.cache
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\secureMessage.key
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\simpp.xml
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\spam.dat
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\tables.props
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\black_theme.lwtp
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\black_theme1_star.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\black_theme2_star.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\black_theme3_star.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\black_theme4_star.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\black_theme5_star.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\black_theme\chat.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\black_theme\dir_closed.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\black_theme\dir_open.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\black_theme\forward_dn.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\black_theme\forward_up.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\black_theme\kill.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\black_theme\kill_on.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\black_theme\lime.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\black_theme\logo.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\black_theme\notsearching.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\black_theme\pause_dn.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\black_theme\pause_up.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\black_theme\play_dn.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\black_theme\play_up.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\black_theme\question.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\black_theme\rewind_dn.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\black_theme\rewind_up.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\black_theme\searching.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\black_theme\splash.png
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\black_theme\splashpro.png
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\black_theme\stop_dn.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\black_theme\stop_up.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\black_theme\theme.txt
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\black_theme\warning.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\classic_theme.lwtp
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\classic_theme1_star.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\classic_theme2_star.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\classic_theme3_star.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\classic_theme4_star.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\classic_theme5_star.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\classic_theme\chat.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\classic_theme\dir_closed.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\classic_theme\dir_open.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\classic_theme\forward_dn.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\classic_theme\forward_up.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\classic_theme\kill.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\classic_theme\logo.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\classic_theme\notsearching.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\classic_theme\pause_dn.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\classic_theme\pause_up.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\classic_theme\play_dn.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\classic_theme\play_up.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\classic_theme\question.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\classic_theme\rewind_dn.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\classic_theme\rewind_up.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\classic_theme\search.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\classic_theme\searching.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\classic_theme\splash.png
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\classic_theme\splashpro.png
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\classic_theme\stop_dn.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\classic_theme\stop_up.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\classic_theme\theme.txt
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\classic_theme\warning.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\limewire_theme.lwtp
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\limewire_theme1_star.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\limewire_theme2_star.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\limewire_theme3_star.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\limewire_theme4_star.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\limewire_theme5_star.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\limewire_theme\chat.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\limewire_theme\dir_closed.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\limewire_theme\dir_open.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\limewire_theme\forward_dn.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\limewire_theme\forward_up.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\limewire_theme\kill.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\limewire_theme\kill_on.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\limewire_theme\lime.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\limewire_theme\logo.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\limewire_theme\notsearching.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\limewire_theme\pause_dn.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\limewire_theme\pause_up.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\limewire_theme\play_dn.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\limewire_theme\play_up.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\limewire_theme\question.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\limewire_theme\rewind_dn.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\limewire_theme\rewind_up.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\limewire_theme\searching.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\limewire_theme\splash.png
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\limewire_theme\splashpro.png
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\limewire_theme\stop_dn.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\limewire_theme\stop_up.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\limewire_theme\theme.txt
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\limewire_theme\warning.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\other_theme.lwtp
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\other_theme1_star.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\other_theme2_star.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\other_theme3_star.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\other_theme4_star.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\other_theme5_star.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\other_theme\chat.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\other_theme\forward_dn.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\other_theme\forward_up.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\other_theme\kill.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\other_theme\kill_on.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\other_theme\logo.png
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\other_theme\notsearching.png
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\other_theme\pause_dn.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\other_theme\pause_up.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\other_theme\play_dn.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\other_theme\play_up.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\other_theme\question.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\other_theme\rewind_dn.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\other_theme\rewind_up.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\other_theme\searching.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\other_theme\splash.png
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\other_theme\splashpro.png
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\other_theme\stop_dn.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\other_theme\stop_up.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\other_theme\theme.txt
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\other_theme\warning.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\windows_theme.lwtp
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\windows_theme1_star.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\windows_theme2_star.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\windows_theme3_star.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\windows_theme4_star.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\windows_theme5_star.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\windows_theme\chat.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\windows_theme\forward_dn.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\windows_theme\forward_up.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\windows_theme\kill.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\windows_theme\kill_on.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\windows_theme\logo.png
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\windows_theme\notsearching.png
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\windows_theme\pause_dn.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\windows_theme\pause_up.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\windows_theme\play_dn.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\windows_theme\play_up.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\windows_theme\question.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\windows_theme\rewind_dn.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\windows_theme\rewind_up.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\windows_theme\searching.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\windows_theme\splash.png
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\windows_theme\splashpro.png
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\windows_theme\stop_dn.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\windows_theme\stop_up.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\windows_theme\theme.txt
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\themes\windows_theme\warning.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\ttree.cache
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\update.xml
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\version.key
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\version.xml
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\xml\data\audio.sxml
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\xml\data\delete_me
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\xml\data\video.sxml
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\xml\misc\application.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\xml\misc\audio.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\xml\misc\document.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\xml\misc\image.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\xml\misc\video.gif
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\xml\schemas\application.xsd
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\xml\schemas\audio.xsd
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\xml\schemas\document.xsd
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\xml\schemas\image.xsd
C:\DOCUME~1\Carmen\APPLIC~1\LimeWire\xml\schemas\video.xsd
C:\DOCUME~1\Carmen\rev.exe
C:\Program Files\uy.exe
C:\Program Files\zia03916\
C:\Program Files\zia04088\
C:\Program Files\zib03916\
C:\Program Files\zib04088\
C:\Program Files\zic03916\
C:\Program Files\zic04088\
C:\WINDOWS\system32\2345.bat
C:\WINDOWS\system32\4069.bat
C:\WINDOWS\system32\9543.bat
C:\WINDOWS\system32\9964.bat
C:\WINDOWS\winlo.exe
D:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2007-08-15 to 2007-09-15 )))))))))))))))))))))))))))))))
.

2007-09-15 19:41 51,200 –a—— C:\WINDOWS\NirCmd.exe
2007-09-15 00:15 d——– C:\WINDOWS\ERUNT
2007-09-13 01:59 626,688 –a—— C:\WINDOWS\system32\msvcr80.dll
2007-09-13 01:25 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\McAfee
2007-09-13 01:24 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-09-11 16:34 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-09-11 16:32 d——– C:\Program Files\Common Files\Wise Installation Wizard
2007-09-10 22:58 d——– C:\Program Files\Windows Defender
2007-09-05 14:55 4,682 –a—— C:\WINDOWS\system32\npptNT2.sys
2007-09-04 13:30 159,744 –a—— C:\WINDOWS\system32\lfpng13n.dll
2007-08-26 12:05 d——– C:\DOCUME~1\Carmen\APPLIC~1\Media Player Classic
2007-08-19 21:37 69,632 –a—— C:\WINDOWS\system32\lfgif13n.dll
2007-08-19 21:37 57,344 –a—— C:\WINDOWS\system32\lfbmp13n.dll
2007-08-19 21:37 462,848 –a—— C:\WINDOWS\system32\ltkrn13n.dll
2007-08-19 21:37 450,560 –a—— C:\WINDOWS\system32\ltimg13n.dll
2007-08-19 21:37 401,408 –a—— C:\WINDOWS\system32\lfcmp13n.dll
2007-08-19 21:37 299,008 –a—— C:\WINDOWS\system32\ltdis13n.dll
2007-08-19 21:37 206,336 –a—— C:\WINDOWS\system32\ltefx13n.dll
2007-08-19 21:37 163,840 –a—— C:\WINDOWS\system32\ltfil13n.dll
2007-08-18 00:04 d——– C:\Program Files\PacNet Sign Up

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-15 23:44 ——— d——– C:\Program Files\Oberon Media
2007-09-15 19:24 ——— d——– C:\Program Files\Common Files\Symantec Shared
2007-09-13 02:22 ——— d——– C:\Program Files\Google
2007-09-13 02:06 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Motive
2007-09-11 20:20 ——— d–h—– C:\Program Files\InstallShield Installation Information
2007-09-11 20:17 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
2007-09-11 12:51 ——— d——– C:\DOCUME~1\Carmen\APPLIC~1\AdobeUM
2007-09-08 21:26 32768 –a—— C:\DOCUME~1\Carmen\setup9x.exe
2007-08-29 13:12 218600 –a—— C:\Program Files\zic03916
2007-08-29 13:12 217700 –a—— C:\Program Files\zib03916
2007-08-29 13:12 217700 –a—— C:\Program Files\zia03916
2007-08-16 15:37 32768 –a—— C:\WINDOWS\system32\setup9x.exe
2007-08-07 13:58 8320 –a—— C:\WINDOWS\system32\drivers\AWRTRD.sys
2007-08-07 13:56 9344 –a—— C:\WINDOWS\system32\drivers\NSDriver.sys
2007-08-05 00:24 ——— d–h—– C:\DOCUME~1\Carmen\APPLIC~1\ijjigame
2007-08-02 13:37 ——— d——– C:\Program Files\NCH Swift Sound
2007-07-30 19:19 92504 –a—— C:\WINDOWS\system32\dllcache\cdm.dll
2007-07-30 19:19 92504 –a—— C:\WINDOWS\system32\cdm.dll
2007-07-30 19:19 549720 –a—— C:\WINDOWS\system32\wuapi.dll
2007-07-30 19:19 549720 –a—— C:\WINDOWS\system32\dllcache\wuapi.dll
2007-07-30 19:19 53080 –a—— C:\WINDOWS\system32\wuauclt.exe
2007-07-30 19:19 53080 –a—— C:\WINDOWS\system32\dllcache\wuauclt.exe
2007-07-30 19:19 43352 –a—— C:\WINDOWS\system32\wups2.dll
2007-07-30 19:19 325976 –a—— C:\WINDOWS\system32\wucltui.dll
2007-07-30 19:19 325976 –a—— C:\WINDOWS\system32\dllcache\wucltui.dll
2007-07-30 19:19 271224 –a—— C:\WINDOWS\system32\mucltui.dll
2007-07-30 19:19 207736 –a—— C:\WINDOWS\system32\muweb.dll
2007-07-30 19:19 203096 –a—— C:\WINDOWS\system32\wuweb.dll
2007-07-30 19:19 203096 –a—— C:\WINDOWS\system32\dllcache\wuweb.dll
2007-07-30 19:19 1712984 –a—— C:\WINDOWS\system32\wuaueng.dll
2007-07-30 19:19 1712984 –a—— C:\WINDOWS\system32\dllcache\wuaueng.dll
2007-07-30 19:18 33624 –a—— C:\WINDOWS\system32\wups.dll
2007-07-30 19:18 33624 –a—— C:\WINDOWS\system32\dllcache\wups.dll
2007-07-27 19:33 ——— d-a—— C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
2007-07-27 00:06 ——— d——– C:\DOCUME~1\Carmen\APPLIC~1\7Wonders
2007-07-19 16:22 218600 –a—— C:\Program Files\zic04088
2007-07-19 16:22 217700 –a—— C:\Program Files\zib04088
2007-07-19 16:22 217700 –a—— C:\Program Files\zia04088
2007-07-19 14:59 3583488 –a—— C:\WINDOWS\system32\dllcache\mshtml.dll
2007-07-17 20:10 ——— d——– C:\DOCUME~1\Carmen\APPLIC~1\dvdcss
2007-07-14 12:34 48776 –a—— C:\WINDOWS\system32\S32EVNT1.DLL
2007-07-13 07:31 765952 –a—— C:\WINDOWS\system32\dllcache\vgx.dll
2007-07-06 20:38 147456 –a—— C:\WINDOWS\system32\vbzip10.dll
2007-06-27 22:34 823808 –a—— C:\WINDOWS\system32\dllcache\wininet.dll
2007-06-27 22:34 671232 –a—— C:\WINDOWS\system32\dllcache\mstime.dll
2007-06-27 22:34 6058496 ——— C:\WINDOWS\system32\dllcache\ieframe.dll
2007-06-27 22:34 52224 ——— C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2007-06-27 22:34 477696 –a—— C:\WINDOWS\system32\dllcache\mshtmled.dll
2007-06-27 22:34 459264 ——— C:\WINDOWS\system32\dllcache\msfeeds.dll
2007-06-27 22:34 44544 ——— C:\WINDOWS\system32\dllcache\iernonce.dll
2007-06-27 22:34 384512 ——— C:\WINDOWS\system32\dllcache\iedkcs32.dll
2007-06-27 22:34 383488 ——— C:\WINDOWS\system32\dllcache\ieapfltr.dll
2007-06-27 22:34 27648 –a—— C:\WINDOWS\system32\dllcache\jsproxy.dll
2007-06-27 22:34 267776 ——— C:\WINDOWS\system32\dllcache\iertutil.dll
2007-06-27 22:34 232960 ——— C:\WINDOWS\system32\dllcache\webcheck.dll
2007-06-27 22:34 230400 ——— C:\WINDOWS\system32\dllcache\ieaksie.dll
2007-06-27 22:34 193024 –a—— C:\WINDOWS\system32\dllcache\msrating.dll
2007-06-27 22:34 153088 ——— C:\WINDOWS\system32\dllcache\ieakeng.dll
2007-06-27 22:34 132608 –a—— C:\WINDOWS\system32\dllcache\extmgr.dll
2007-06-27 22:34 124928 ——— C:\WINDOWS\system32\dllcache\advpack.dll
2007-06-27 22:34 1152000 –a—— C:\WINDOWS\system32\dllcache\urlmon.dll
2007-06-27 22:34 105984 ——— C:\WINDOWS\system32\dllcache\url.dll
2007-06-27 22:34 102400 ——— C:\WINDOWS\system32\dllcache\occache.dll
2007-06-27 16:27 63488 ——— C:\WINDOWS\system32\dllcache\ie4uinit.exe
2007-06-27 16:27 625152 ——— C:\WINDOWS\system32\dllcache\iexplore.exe
2007-06-27 16:27 13824 ——— C:\WINDOWS\system32\dllcache\ieudinit.exe
2007-06-27 15:00 161792 ——— C:\WINDOWS\system32\dllcache\ieakui.dll
2007-06-26 22:10 317440 –a—— C:\WINDOWS\system32\dllcache\unregmp2.exe
2007-06-26 14:08 1104896 –a—— C:\WINDOWS\system32\msxml3.dll
2007-06-26 14:08 1104896 ——— C:\WINDOWS\system32\dllcache\msxml3.dll
2007-06-19 21:31 282112 –a—— C:\WINDOWS\system32\gdi32.dll
2007-06-19 21:31 282112 ——— C:\WINDOWS\system32\dllcache\gdi32.dll
2005-09-24 00:49 12288 –a–c— C:\WINDOWS\Fonts\RandFont.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-07-13 21:05]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2005-02-02 20:12]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-02-02 20:11]
"hpWirelessAssistant"="C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2005-11-16 08:30]
"HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-22 22:19]
"QPService"="C:\Program Files\HP\QuickPlay\QPService.exe" [2005-12-12 11:39]
"eabconfg.cpl"="C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe" [2005-12-22 08:57]
"Cpqset"="C:\Program Files\HPQ\Default Settings\cpqset.exe" [2005-02-17 14:01]
"RecGuard"="C:\Windows\SMINST\RecGuard.exe" [2005-10-11 10:23]
"Reminder"="C:\Windows\CREATOR\Remind_XP.exe" [2006-02-09 09:52]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-04 21:00]
"IMEKRMIG6.1"="C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE" [2004-08-04 21:00]
"MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 21:00]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 21:00]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 21:00]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-16 10:54]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-03-14 19:05]
"singtelTrayApp"="C:\Program Files\SmartFix\bin\McciTrayApp.exe" [2007-03-16 13:45]
"SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-10-14 10:22]
"PaperPort PTD"="C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe" [2005-03-17 14:25]
"IndexSearch"="C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe" [2005-03-17 14:45]
"SetDefPrt"="C:\Program Files\Brother\Brmfl05a\BrStDvPt.exe" [2005-01-26 18:02]
"ControlCenter2.0"="C:\Program Files\Brother\ControlCenter2\brctrcen.exe" [2005-05-17 17:42]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 18:30]
"PWRISOVM.EXE"="C:\Carmen\programs\poweriso\PWRISOVM.EXE" [2007-04-09 20:23]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20]
"AAWTray"="C:\Carmen\programs\adaware\AAWTray.exe" [2007-08-08 15:53]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 16:00]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2004-11-22 08:18]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-09-13 17:46]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t

C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 04:44:06]
HP Photosmart Premier Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2005-09-24 01:39:30]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04]
Status Monitor.lnk - C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe [2007-06-24 12:50:35]

C:\DOCUME~1\Carmen\STARTM~1\Programs\Startup\
ctfmon.exe [2006-06-27 14:23:42]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\\WINDOWS\\system32\\mljgd

R3 HSFHWATI;HSFHWATI;C:\WINDOWS\system32\DRIVERS\HSFHWATI.sys
S3 BrScnUsb;Brother USB Still Image driver;C:\WINDOWS\system32\Drivers\BrScnUsb.sys


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\Recycled\ctfmon.exe
Open(&O)\command- C:\Recycled\Recycled\ctfmon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe protect.ed 480 480

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4137ec2d-1ff4-11dc-b966-0014a5a8b07d}]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
Open(&0)\command- G:\Recycled\ctfmon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{45f693c0-1da1-11dc-b962-0014a5a8b07d}]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
Open(&0)\command- F:\Recycled\ctfmon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{76284066-3f4b-11dc-b99d-0014a5a8b07d}]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
Open(&0)\command- Recycled\ctfmon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bf8677de-1e25-11dc-b963-0014a5a8b07d}]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
Open(&0)\command- H:\Recycled\ctfmon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ccccb449-7532-11db-b928-0014a5a8b07d}]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
Open(&0)\command- G:\Recycled\ctfmon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cdd2147e-adf6-11db-b941-0014a5a8b07d}]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
Open(&0)\command- G:\Recycled\ctfmon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fa2ce9a8-218d-11dc-b96b-0014a5a8b07d}]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
Open(&0)\command- G:\Recycled\ctfmon.exe

*Newly Created Service* - APPMGMT
*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder
"2007-08-25 10:45:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2007-09-15 12:03:38 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
"2007-09-07 13:18:08 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - Carmen.job"
.
**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-15 23:57:09
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = C:\Program Files\HPQ\Default Settings\cpqset.exe???????????????|?????? ???B?????????????hLC? ??????

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-09-15 23:58:10
C:\ComboFix-quarantined-files.txt … 2007-09-15 23:57
C:\ComboFix2.txt … 2007-09-15 20:07
.
— E O F —


new hijackthis log:

Logfile of HijackThis v1.99.1
Scan saved at 11:58:56 PM, on 9/15/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Carmen\programs\adaware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\brss01a.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\HPQ\SHARED\HPQTOA~1.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\SmartFix\bin\McciTrayApp.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Brother\ControlCenter2\brctrcen.exe
C:\Carmen\programs\poweriso\PWRISOVM.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Carmen\programs\adaware\AAWTray.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Brother\Brmfcmon\brmfcwnd.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Hijackthis\Scanner.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…o&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.tp.edu.sg:80
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;*.tp.edu.sg;
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Carmen\programs\bitcomet\tools\BitCometBHO_1.1.5.19.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Carmen\programs\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [Reminder] C:\Windows\CREATOR\Remind_XP.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [singtelTrayApp] "C:\Program Files\SmartFix\bin\McciTrayApp.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl05a\BrStDvPt.exe
O4 - HKLM\..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Carmen\programs\poweriso\PWRISOVM.EXE
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [AAWTray] C:\Carmen\programs\adaware\AAWTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Startup: ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Status Monitor.lnk = C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Carmen\programs\bitcomet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Carmen\programs\bitcomet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Carmen\programs\bitcomet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Carmen\programs\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Carmen\programs\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_SG&c=Q106&bd=presario&pf=laptop
O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games.com.my/com/EGamesPlugin.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab
O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} (ijjiPlugin2 Class) - http://gamedownload.ijjimax.com/gamedownlo…Plugin11USA.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Carmen\programs\adaware\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\Shared\hpqwmi.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing)
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe



thanks!

combofix log:

ComboFix 07-09-14.2 - "Carmen" 2007-09-17 13:03:52.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.868 [GMT 8:00]
* Created a new restore point

FILE::
C:\\WINDOWS\\system32\\mljgd
C:\DOCUME~1\Carmen\STARTM~1\Programs\Startup\ctfmon.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Autorun.inf
C:\DOCUME~1\Carmen\STARTM~1\Programs\Startup\ctfmon.exe
D:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2007-08-17 to 2007-09-17 )))))))))))))))))))))))))))))))
.

2007-09-15 19:41 51,200 –a—— C:\WINDOWS\NirCmd.exe
2007-09-15 00:15 d——– C:\WINDOWS\ERUNT
2007-09-13 01:59 626,688 –a—— C:\WINDOWS\system32\msvcr80.dll
2007-09-13 01:25 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\McAfee
2007-09-13 01:24 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-09-11 16:34 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-09-11 16:32 d——– C:\Program Files\Common Files\Wise Installation Wizard
2007-09-10 22:58 d——– C:\Program Files\Windows Defender
2007-09-05 14:55 4,682 –a—— C:\WINDOWS\system32\npptNT2.sys
2007-09-04 13:30 159,744 –a—— C:\WINDOWS\system32\lfpng13n.dll
2007-08-26 12:05 d——– C:\DOCUME~1\Carmen\APPLIC~1\Media Player Classic
2007-08-19 21:37 69,632 –a—— C:\WINDOWS\system32\lfgif13n.dll
2007-08-19 21:37 57,344 –a—— C:\WINDOWS\system32\lfbmp13n.dll
2007-08-19 21:37 462,848 –a—— C:\WINDOWS\system32\ltkrn13n.dll
2007-08-19 21:37 450,560 –a—— C:\WINDOWS\system32\ltimg13n.dll
2007-08-19 21:37 401,408 –a—— C:\WINDOWS\system32\lfcmp13n.dll
2007-08-19 21:37 299,008 –a—— C:\WINDOWS\system32\ltdis13n.dll
2007-08-19 21:37 206,336 –a—— C:\WINDOWS\system32\ltefx13n.dll
2007-08-19 21:37 163,840 –a—— C:\WINDOWS\system32\ltfil13n.dll
2007-08-18 00:04 d——– C:\Program Files\PacNet Sign Up

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-16 14:09 ——— d——– C:\Program Files\Common Files\Symantec Shared
2007-09-15 23:44 ——— d——– C:\Program Files\Oberon Media
2007-09-13 02:22 ——— d——– C:\Program Files\Google
2007-09-13 02:06 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Motive
2007-09-11 20:20 ——— d–h—– C:\Program Files\InstallShield Installation Information
2007-09-11 20:17 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
2007-09-11 12:51 ——— d——– C:\DOCUME~1\Carmen\APPLIC~1\AdobeUM
2007-09-08 21:26 32768 –a—— C:\DOCUME~1\Carmen\setup9x.exe
2007-08-29 13:12 218600 –a—— C:\Program Files\zic03916
2007-08-29 13:12 217700 –a—— C:\Program Files\zib03916
2007-08-29 13:12 217700 –a—— C:\Program Files\zia03916
2007-08-16 15:37 32768 –a—— C:\WINDOWS\system32\setup9x.exe
2007-08-07 13:58 8320 –a—— C:\WINDOWS\system32\drivers\AWRTRD.sys
2007-08-07 13:56 9344 –a—— C:\WINDOWS\system32\drivers\NSDriver.sys
2007-08-05 00:24 ——— d–h—– C:\DOCUME~1\Carmen\APPLIC~1\ijjigame
2007-08-02 13:37 ——— d——– C:\Program Files\NCH Swift Sound
2007-07-30 19:19 92504 –a—— C:\WINDOWS\system32\dllcache\cdm.dll
2007-07-30 19:19 92504 –a—— C:\WINDOWS\system32\cdm.dll
2007-07-30 19:19 549720 –a—— C:\WINDOWS\system32\wuapi.dll
2007-07-30 19:19 549720 –a—— C:\WINDOWS\system32\dllcache\wuapi.dll
2007-07-30 19:19 53080 –a—— C:\WINDOWS\system32\wuauclt.exe
2007-07-30 19:19 53080 –a—— C:\WINDOWS\system32\dllcache\wuauclt.exe
2007-07-30 19:19 43352 –a—— C:\WINDOWS\system32\wups2.dll
2007-07-30 19:19 325976 –a—— C:\WINDOWS\system32\wucltui.dll
2007-07-30 19:19 325976 –a—— C:\WINDOWS\system32\dllcache\wucltui.dll
2007-07-30 19:19 271224 –a—— C:\WINDOWS\system32\mucltui.dll
2007-07-30 19:19 207736 –a—— C:\WINDOWS\system32\muweb.dll
2007-07-30 19:19 203096 –a—— C:\WINDOWS\system32\wuweb.dll
2007-07-30 19:19 203096 –a—— C:\WINDOWS\system32\dllcache\wuweb.dll
2007-07-30 19:19 1712984 –a—— C:\WINDOWS\system32\wuaueng.dll
2007-07-30 19:19 1712984 –a—— C:\WINDOWS\system32\dllcache\wuaueng.dll
2007-07-30 19:18 33624 –a—— C:\WINDOWS\system32\wups.dll
2007-07-30 19:18 33624 –a—— C:\WINDOWS\system32\dllcache\wups.dll
2007-07-27 19:33 ——— d-a—— C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
2007-07-27 00:06 ——— d——– C:\DOCUME~1\Carmen\APPLIC~1\7Wonders
2007-07-19 16:22 218600 –a—— C:\Program Files\zic04088
2007-07-19 16:22 217700 –a—— C:\Program Files\zib04088
2007-07-19 16:22 217700 –a—— C:\Program Files\zia04088
2007-07-19 14:59 3583488 –a—— C:\WINDOWS\system32\dllcache\mshtml.dll
2007-07-17 20:10 ——— d——– C:\DOCUME~1\Carmen\APPLIC~1\dvdcss
2007-07-14 12:34 48776 –a—— C:\WINDOWS\system32\S32EVNT1.DLL
2007-07-13 07:31 765952 –a—— C:\WINDOWS\system32\dllcache\vgx.dll
2007-07-06 20:38 147456 –a—— C:\WINDOWS\system32\vbzip10.dll
2007-06-27 22:34 823808 –a—— C:\WINDOWS\system32\dllcache\wininet.dll
2007-06-27 22:34 671232 –a—— C:\WINDOWS\system32\dllcache\mstime.dll
2007-06-27 22:34 6058496 ——— C:\WINDOWS\system32\dllcache\ieframe.dll
2007-06-27 22:34 52224 ——— C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2007-06-27 22:34 477696 –a—— C:\WINDOWS\system32\dllcache\mshtmled.dll
2007-06-27 22:34 459264 ——— C:\WINDOWS\system32\dllcache\msfeeds.dll
2007-06-27 22:34 44544 ——— C:\WINDOWS\system32\dllcache\iernonce.dll
2007-06-27 22:34 384512 ——— C:\WINDOWS\system32\dllcache\iedkcs32.dll
2007-06-27 22:34 383488 ——— C:\WINDOWS\system32\dllcache\ieapfltr.dll
2007-06-27 22:34 27648 –a—— C:\WINDOWS\system32\dllcache\jsproxy.dll
2007-06-27 22:34 267776 ——— C:\WINDOWS\system32\dllcache\iertutil.dll
2007-06-27 22:34 232960 ——— C:\WINDOWS\system32\dllcache\webcheck.dll
2007-06-27 22:34 230400 ——— C:\WINDOWS\system32\dllcache\ieaksie.dll
2007-06-27 22:34 193024 –a—— C:\WINDOWS\system32\dllcache\msrating.dll
2007-06-27 22:34 153088 ——— C:\WINDOWS\system32\dllcache\ieakeng.dll
2007-06-27 22:34 132608 –a—— C:\WINDOWS\system32\dllcache\extmgr.dll
2007-06-27 22:34 124928 ——— C:\WINDOWS\system32\dllcache\advpack.dll
2007-06-27 22:34 1152000 –a—— C:\WINDOWS\system32\dllcache\urlmon.dll
2007-06-27 22:34 105984 ——— C:\WINDOWS\system32\dllcache\url.dll
2007-06-27 22:34 102400 ——— C:\WINDOWS\system32\dllcache\occache.dll
2007-06-27 16:27 63488 ——— C:\WINDOWS\system32\dllcache\ie4uinit.exe
2007-06-27 16:27 625152 ——— C:\WINDOWS\system32\dllcache\iexplore.exe
2007-06-27 16:27 13824 ——— C:\WINDOWS\system32\dllcache\ieudinit.exe
2007-06-27 15:00 161792 ——— C:\WINDOWS\system32\dllcache\ieakui.dll
2007-06-26 22:10 317440 –a—— C:\WINDOWS\system32\dllcache\unregmp2.exe
2007-06-26 14:08 1104896 –a—— C:\WINDOWS\system32\msxml3.dll
2007-06-26 14:08 1104896 ——— C:\WINDOWS\system32\dllcache\msxml3.dll
2007-06-19 21:31 282112 –a—— C:\WINDOWS\system32\gdi32.dll
2007-06-19 21:31 282112 ——— C:\WINDOWS\system32\dllcache\gdi32.dll
2005-09-24 00:49 12288 –a–c— C:\WINDOWS\Fonts\RandFont.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-07-13 21:05]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2005-02-02 20:12]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-02-02 20:11]
"hpWirelessAssistant"="C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2005-11-16 08:30]
"HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-22 22:19]
"QPService"="C:\Program Files\HP\QuickPlay\QPService.exe" [2005-12-12 11:39]
"eabconfg.cpl"="C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe" [2005-12-22 08:57]
"Cpqset"="C:\Program Files\HPQ\Default Settings\cpqset.exe" [2005-02-17 14:01]
"RecGuard"="C:\Windows\SMINST\RecGuard.exe" [2005-10-11 10:23]
"Reminder"="C:\Windows\CREATOR\Remind_XP.exe" [2006-02-09 09:52]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-04 21:00]
"IMEKRMIG6.1"="C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE" [2004-08-04 21:00]
"MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 21:00]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 21:00]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 21:00]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-16 10:54]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-03-14 19:05]
"singtelTrayApp"="C:\Program Files\SmartFix\bin\McciTrayApp.exe" [2007-03-16 13:45]
"SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-10-14 10:22]
"PaperPort PTD"="C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe" [2005-03-17 14:25]
"IndexSearch"="C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe" [2005-03-17 14:45]
"SetDefPrt"="C:\Program Files\Brother\Brmfl05a\BrStDvPt.exe" [2005-01-26 18:02]
"ControlCenter2.0"="C:\Program Files\Brother\ControlCenter2\brctrcen.exe" [2005-05-17 17:42]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 18:30]
"PWRISOVM.EXE"="C:\Carmen\programs\poweriso\PWRISOVM.EXE" [2007-04-09 20:23]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20]
"AAWTray"="C:\Carmen\programs\adaware\AAWTray.exe" [2007-08-08 15:53]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 16:00]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2004-11-22 08:18]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-09-13 17:46]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t

C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 04:44:06]
HP Photosmart Premier Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2005-09-24 01:39:30]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04]
Status Monitor.lnk - C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe [2007-06-24 12:50:35]

R3 HSFHWATI;HSFHWATI;C:\WINDOWS\system32\DRIVERS\HSFHWATI.sys
S3 BrScnUsb;Brother USB Still Image driver;C:\WINDOWS\system32\Drivers\BrScnUsb.sys

*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder
"2007-08-25 10:45:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2007-09-17 04:57:35 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
"2007-09-07 13:18:08 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - Carmen.job"
.
**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-17 13:06:05
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = C:\Program Files\HPQ\Default Settings\cpqset.exe??????????`????|?????? ???B?????????????hLC? ??????

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-09-17 13:07:08
C:\ComboFix-quarantined-files.txt … 2007-09-17 13:06
C:\ComboFix2.txt … 2007-09-15 23:58
C:\ComboFix3.txt … 2007-09-15 20:07
.
— E O F —



new hijackthis log:

Logfile of HijackThis v1.99.1
Scan saved at 1:07:51 PM, on 9/17/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Carmen\programs\adaware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\brss01a.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\PROGRA~1\HPQ\SHARED\HPQTOA~1.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\SmartFix\bin\McciTrayApp.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Brother\ControlCenter2\brctrcen.exe
C:\Carmen\programs\poweriso\PWRISOVM.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Carmen\programs\adaware\AAWTray.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Documents and Settings\Carmen\Start Menu\Programs\Startup\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis\Scanner.exe.exe
C:\Program Files\Messenger\msmsgs.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…o&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.tp.edu.sg:80
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;*.tp.edu.sg;
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Carmen\programs\bitcomet\tools\BitCometBHO_1.1.5.19.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Carmen\programs\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [Reminder] C:\Windows\CREATOR\Remind_XP.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [singtelTrayApp] "C:\Program Files\SmartFix\bin\McciTrayApp.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl05a\BrStDvPt.exe
O4 - HKLM\..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Carmen\programs\poweriso\PWRISOVM.EXE
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [AAWTray] C:\Carmen\programs\adaware\AAWTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Status Monitor.lnk = C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Carmen\programs\bitcomet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Carmen\programs\bitcomet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Carmen\programs\bitcomet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Carmen\programs\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Carmen\programs\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_SG&c=Q106&bd=presario&pf=laptop
O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games.com.my/com/EGamesPlugin.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab
O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} (ijjiPlugin2 Class) - http://gamedownload.ijjimax.com/gamedownlo…Plugin11USA.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Carmen\programs\adaware\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\Shared\hpqwmi.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing)
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe





seems like the ctfmon.exe is still around lol

combofix:

ComboFix 07-09-14.2 - "Carmen" 2007-09-18 22:08:03.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.831 [GMT 8:00]
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Autorun.inf
C:\Program Files\zia03916\
C:\Program Files\zia04088\
C:\Program Files\zib03916\
C:\Program Files\zib04088\
C:\Program Files\zic03916\
C:\Program Files\zic04088\
D:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2007-08-18 to 2007-09-18 )))))))))))))))))))))))))))))))
.

2007-09-17 19:47 d——– C:\WINDOWS\system32\ActiveScan
2007-09-15 19:41 51,200 –a—— C:\WINDOWS\NirCmd.exe
2007-09-15 00:15 d——– C:\WINDOWS\ERUNT
2007-09-13 01:59 626,688 –a—— C:\WINDOWS\system32\msvcr80.dll
2007-09-13 01:25 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\McAfee
2007-09-13 01:24 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-09-11 16:34 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-09-11 16:32 d——– C:\Program Files\Common Files\Wise Installation Wizard
2007-09-10 22:58 d——– C:\Program Files\Windows Defender
2007-09-05 14:55 4,682 –a—— C:\WINDOWS\system32\npptNT2.sys
2007-09-04 13:30 159,744 –a—— C:\WINDOWS\system32\lfpng13n.dll
2007-08-26 12:05 d——– C:\DOCUME~1\Carmen\APPLIC~1\Media Player Classic
2007-08-19 21:37 69,632 –a—— C:\WINDOWS\system32\lfgif13n.dll
2007-08-19 21:37 57,344 –a—— C:\WINDOWS\system32\lfbmp13n.dll
2007-08-19 21:37 462,848 –a—— C:\WINDOWS\system32\ltkrn13n.dll
2007-08-19 21:37 450,560 –a—— C:\WINDOWS\system32\ltimg13n.dll
2007-08-19 21:37 401,408 –a—— C:\WINDOWS\system32\lfcmp13n.dll
2007-08-19 21:37 299,008 –a—— C:\WINDOWS\system32\ltdis13n.dll
2007-08-19 21:37 206,336 –a—— C:\WINDOWS\system32\ltefx13n.dll
2007-08-19 21:37 163,840 –a—— C:\WINDOWS\system32\ltfil13n.dll
2007-08-18 00:04 d——– C:\Program Files\PacNet Sign Up

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-18 22:02 ——— d——– C:\Program Files\Common Files\Symantec Shared
2007-09-17 20:48 22 –a—— C:\Program Files\zic04088
2007-09-17 20:48 22 –a—— C:\Program Files\zic03916
2007-09-17 20:48 22 –a—— C:\Program Files\zib04088
2007-09-17 20:48 22 –a—— C:\Program Files\zib03916
2007-09-17 20:48 22 –a—— C:\Program Files\zia04088
2007-09-17 20:48 22 –a—— C:\Program Files\zia03916
2007-09-17 20:48 ——— d——– C:\Program Files\Symantec
2007-09-17 20:47 ——— d——– C:\Program Files\QuickTime
2007-09-17 20:41 ——— d——– C:\Program Files\MSN Messenger
2007-09-17 20:34 ——— d——– C:\Program Files\iTunes
2007-09-17 20:32 ——— d——– C:\Program Files\Google
2007-09-17 20:27 ——— d——– C:\Program Files\Common Files\Motive
2007-09-17 20:27 ——— d——– C:\Program Files\Common Files\LightScribe
2007-09-17 20:12 ——— d——– C:\DOCUME~1\Carmen\APPLIC~1\Symantec
2007-09-17 20:10 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
2007-09-15 23:44 ——— d——– C:\Program Files\Oberon Media
2007-09-13 02:06 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Motive
2007-09-11 20:20 ——— d–h—– C:\Program Files\InstallShield Installation Information
2007-09-11 20:17 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
2007-09-11 12:51 ——— d——– C:\DOCUME~1\Carmen\APPLIC~1\AdobeUM
2007-09-08 21:26 32768 –a—— C:\DOCUME~1\Carmen\setup9x.exe
2007-08-16 15:37 32768 –a—— C:\WINDOWS\system32\setup9x.exe
2007-08-07 13:58 8320 –a—— C:\WINDOWS\system32\drivers\AWRTRD.sys
2007-08-07 13:56 9344 –a—— C:\WINDOWS\system32\drivers\NSDriver.sys
2007-08-05 00:24 ——— d–h—– C:\DOCUME~1\Carmen\APPLIC~1\ijjigame
2007-08-02 13:37 ——— d——– C:\Program Files\NCH Swift Sound
2007-07-30 19:19 92504 –a—— C:\WINDOWS\system32\dllcache\cdm.dll
2007-07-30 19:19 92504 –a—— C:\WINDOWS\system32\cdm.dll
2007-07-30 19:19 549720 –a—— C:\WINDOWS\system32\wuapi.dll
2007-07-30 19:19 549720 –a—— C:\WINDOWS\system32\dllcache\wuapi.dll
2007-07-30 19:19 53080 –a—— C:\WINDOWS\system32\wuauclt.exe
2007-07-30 19:19 53080 –a—— C:\WINDOWS\system32\dllcache\wuauclt.exe
2007-07-30 19:19 43352 –a—— C:\WINDOWS\system32\wups2.dll
2007-07-30 19:19 325976 –a—— C:\WINDOWS\system32\wucltui.dll
2007-07-30 19:19 325976 –a—— C:\WINDOWS\system32\dllcache\wucltui.dll
2007-07-30 19:19 271224 –a—— C:\WINDOWS\system32\mucltui.dll
2007-07-30 19:19 207736 –a—— C:\WINDOWS\system32\muweb.dll
2007-07-30 19:19 203096 –a—— C:\WINDOWS\system32\wuweb.dll
2007-07-30 19:19 203096 –a—— C:\WINDOWS\system32\dllcache\wuweb.dll
2007-07-30 19:19 1712984 –a—— C:\WINDOWS\system32\wuaueng.dll
2007-07-30 19:19 1712984 –a—— C:\WINDOWS\system32\dllcache\wuaueng.dll
2007-07-30 19:18 33624 –a—— C:\WINDOWS\system32\wups.dll
2007-07-30 19:18 33624 –a—— C:\WINDOWS\system32\dllcache\wups.dll
2007-07-27 19:33 ——— d-a—— C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
2007-07-27 00:06 ——— d——– C:\DOCUME~1\Carmen\APPLIC~1\7Wonders
2007-07-19 14:59 3583488 –a—— C:\WINDOWS\system32\dllcache\mshtml.dll
2007-07-14 12:34 48776 –a—— C:\WINDOWS\system32\S32EVNT1.DLL
2007-07-13 07:31 765952 –a—— C:\WINDOWS\system32\dllcache\vgx.dll
2007-07-06 20:38 147456 –a—— C:\WINDOWS\system32\vbzip10.dll
2007-06-27 22:34 823808 –a—— C:\WINDOWS\system32\dllcache\wininet.dll
2007-06-27 22:34 671232 –a—— C:\WINDOWS\system32\dllcache\mstime.dll
2007-06-27 22:34 6058496 ——— C:\WINDOWS\system32\dllcache\ieframe.dll
2007-06-27 22:34 52224 ——— C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2007-06-27 22:34 477696 –a—— C:\WINDOWS\system32\dllcache\mshtmled.dll
2007-06-27 22:34 459264 ——— C:\WINDOWS\system32\dllcache\msfeeds.dll
2007-06-27 22:34 44544 ——— C:\WINDOWS\system32\dllcache\iernonce.dll
2007-06-27 22:34 384512 ——— C:\WINDOWS\system32\dllcache\iedkcs32.dll
2007-06-27 22:34 383488 ——— C:\WINDOWS\system32\dllcache\ieapfltr.dll
2007-06-27 22:34 27648 –a—— C:\WINDOWS\system32\dllcache\jsproxy.dll
2007-06-27 22:34 267776 ——— C:\WINDOWS\system32\dllcache\iertutil.dll
2007-06-27 22:34 232960 ——— C:\WINDOWS\system32\dllcache\webcheck.dll
2007-06-27 22:34 230400 ——— C:\WINDOWS\system32\dllcache\ieaksie.dll
2007-06-27 22:34 193024 –a—— C:\WINDOWS\system32\dllcache\msrating.dll
2007-06-27 22:34 153088 ——— C:\WINDOWS\system32\dllcache\ieakeng.dll
2007-06-27 22:34 132608 –a—— C:\WINDOWS\system32\dllcache\extmgr.dll
2007-06-27 22:34 124928 ——— C:\WINDOWS\system32\dllcache\advpack.dll
2007-06-27 22:34 1152000 –a—— C:\WINDOWS\system32\dllcache\urlmon.dll
2007-06-27 22:34 105984 ——— C:\WINDOWS\system32\dllcache\url.dll
2007-06-27 22:34 102400 ——— C:\WINDOWS\system32\dllcache\occache.dll
2007-06-27 16:27 63488 ——— C:\WINDOWS\system32\dllcache\ie4uinit.exe
2007-06-27 16:27 625152 ——— C:\WINDOWS\system32\dllcache\iexplore.exe
2007-06-27 16:27 13824 ——— C:\WINDOWS\system32\dllcache\ieudinit.exe
2007-06-27 15:00 161792 ——— C:\WINDOWS\system32\dllcache\ieakui.dll
2007-06-26 22:10 317440 –a—— C:\WINDOWS\system32\dllcache\unregmp2.exe
2007-06-26 14:08 1104896 –a—— C:\WINDOWS\system32\msxml3.dll
2007-06-26 14:08 1104896 ——— C:\WINDOWS\system32\dllcache\msxml3.dll
2007-06-19 21:31 282112 –a—— C:\WINDOWS\system32\gdi32.dll
2007-06-19 21:31 282112 ——— C:\WINDOWS\system32\dllcache\gdi32.dll
2005-09-24 00:49 12288 –a–c— C:\WINDOWS\Fonts\RandFont.dll
.

((((((((((((((((((((((((((((( snapshot_2007-09-15_200407.07 )))))))))))))))))))))))))))))))))))))))))
.
—-a-w 141,424 2006-08-24 00:28:54 C:\WINDOWS\Downloaded Program Files\asinst.dll
—-a-w 73,728 2006-08-02 04:39:06 C:\WINDOWS\system32\asuninst.exe
—-a-w 11,776 2003-03-25 10:53:50 C:\WINDOWS\system32\ZPORT4AS.dll
—-a-w 110,592 2007-03-29 01:20:50 C:\WINDOWS\system32\ActiveScan\as.dll
—-a-w 233,472 2006-10-05 08:15:26 C:\WINDOWS\system32\ActiveScan\ascontrol.dll
—-a-w 96,256 2005-06-03 06:03:18 C:\WINDOWS\system32\ActiveScan\asmdat.dll
—-a-w 36,864 2003-08-01 03:00:16 C:\WINDOWS\system32\ActiveScan\certdll.dll
—-a-w 86,016 2005-05-20 05:42:44 C:\WINDOWS\system32\ActiveScan\instlsp.dll
—-a-w 4,608 2006-02-16 10:20:20 C:\WINDOWS\system32\ActiveScan\memvfile.dll
—-a-w 348,160 2005-10-25 10:08:32 C:\WINDOWS\system32\ActiveScan\msvcr71.dll
—-a-w 139,264 2004-05-04 07:01:02 C:\WINDOWS\system32\ActiveScan\pavaleas.dll
—-a-w 45,056 2006-07-14 05:04:10 C:\WINDOWS\system32\ActiveScan\pavdr.exe
—-a-w 159,832 2006-04-10 02:50:02 C:\WINDOWS\system32\ActiveScan\pavexcom.dll
—-a-w 94,208 2006-02-14 05:05:38 C:\WINDOWS\system32\ActiveScan\pavinas.dll
—-a-w 180,224 2006-02-16 10:35:38 C:\WINDOWS\system32\ActiveScan\pavoe.dll
—-a-w 122,880 2006-10-05 08:15:38 C:\WINDOWS\system32\ActiveScan\pavpz.dll
—-a-w 8,704 2006-06-30 06:13:38 C:\WINDOWS\system32\ActiveScan\pfdnnt.exe
—-a-w 49,152 2004-02-04 06:08:42 C:\WINDOWS\system32\ActiveScan\port32.dll
—-a-w 69,632 2006-08-01 05:23:10 C:\WINDOWS\system32\ActiveScan\pscpu.dll
—-a-w 1,388,544 2006-08-23 05:06:08 C:\WINDOWS\system32\ActiveScan\pskahk.dll
—-a-w 10,752 2006-08-17 03:38:14 C:\WINDOWS\system32\ActiveScan\pskalloc.dll
—-a-w 61,440 2006-09-04 03:49:54 C:\WINDOWS\system32\ActiveScan\pskas.dll
—-a-w 779,264 2006-08-18 00:46:18 C:\WINDOWS\system32\ActiveScan\pskavs.dll
—-a-w 417,792 2007-03-26 06:25:34 C:\WINDOWS\system32\ActiveScan\pskcmp.dll
—-a-w 90,112 2006-08-09 02:42:24 C:\WINDOWS\system32\ActiveScan\pskfss.dll
—-a-w 208,896 2006-07-19 02:55:58 C:\WINDOWS\system32\ActiveScan\pskhtml.dll
—-a-w 9,728 2006-01-20 08:57:00 C:\WINDOWS\system32\ActiveScan\pskmas.dll
—-a-w 14,336 2006-05-17 01:50:12 C:\WINDOWS\system32\ActiveScan\pskmdfs.dll
—-a-w 33,280 2006-08-16 02:58:12 C:\WINDOWS\system32\ActiveScan\pskpack.dll
—-a-w 266,240 2006-06-30 06:42:36 C:\WINDOWS\system32\ActiveScan\pskscs.dll
—-a-w 62,976 2006-08-17 06:33:14 C:\WINDOWS\system32\ActiveScan\pskutil.dll
—-a-w 13,312 2006-08-08 05:13:10 C:\WINDOWS\system32\ActiveScan\pskvfile.dll
—-a-w 69,632 2006-08-18 00:53:08 C:\WINDOWS\system32\ActiveScan\pskvfs.dll
—-a-w 167,936 2006-08-18 00:49:50 C:\WINDOWS\system32\ActiveScan\pskvm.dll
—-a-w 353,840 2007-04-18 09:16:04 C:\WINDOWS\system32\ActiveScan\psscan.dll
—-a-w 35,328 2007-01-22 06:42:48 C:\WINDOWS\system32\ActiveScan\rawvfile.dll
—-a-w 9,488 1997-09-17 22:12:32 C:\WINDOWS\system32\ActiveScan\sporder.dll
—-a-w 69,632 2006-02-28 09:23:40 C:\WINDOWS\system32\ActiveScan\tcpvfile.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-07-13 21:05]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2005-02-02 20:12]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-02-02 20:11]
"hpWirelessAssistant"="C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2005-11-16 08:30]
"HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-22 22:19]
"QPService"="C:\Program Files\HP\QuickPlay\QPService.exe" [2005-12-12 11:39]
"eabconfg.cpl"="C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe" [2005-12-22 08:57]
"Cpqset"="C:\Program Files\HPQ\Default Settings\cpqset.exe" [2005-02-17 14:01]
"RecGuard"="C:\Windows\SMINST\RecGuard.exe" [2005-10-11 10:23]
"Reminder"="C:\Windows\CREATOR\Remind_XP.exe" [2006-02-09 09:52]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-04 21:00]
"IMEKRMIG6.1"="C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE" [2004-08-04 21:00]
"MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 21:00]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 21:00]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 21:00]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-16 10:54]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-03-14 19:05]
"singtelTrayApp"="C:\Program Files\SmartFix\bin\McciTrayApp.exe" [2007-03-16 13:45]
"SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-10-14 10:22]
"PaperPort PTD"="C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe" [2005-03-17 14:25]
"IndexSearch"="C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe" [2005-03-17 14:45]
"SetDefPrt"="C:\Program Files\Brother\Brmfl05a\BrStDvPt.exe" [2005-01-26 18:02]
"ControlCenter2.0"="C:\Program Files\Brother\ControlCenter2\brctrcen.exe" [2005-05-17 17:42]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 18:30]
"PWRISOVM.EXE"="C:\Carmen\programs\poweriso\PWRISOVM.EXE" [2007-04-09 20:23]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20]
"AAWTray"="C:\Carmen\programs\adaware\AAWTray.exe" [2007-08-08 15:53]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 16:00]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2004-11-22 08:18]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-09-13 17:46]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t

C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 04:44:06]
HP Photosmart Premier Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2005-09-24 01:39:30]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04]
Status Monitor.lnk - C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe [2007-06-24 12:50:35]

C:\DOCUME~1\Carmen\STARTM~1\Programs\Startup\
ctfmon.exe [2006-06-27 14:23:42]

R3 HSFHWATI;HSFHWATI;C:\WINDOWS\system32\DRIVERS\HSFHWATI.sys
S3 BrScnUsb;Brother USB Still Image driver;C:\WINDOWS\system32\Drivers\BrScnUsb.sys


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{76284066-3f4b-11dc-b99d-0014a5a8b07d}]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
Open(&0)\command- I:\Recycled\ctfmon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bf8677de-1e25-11dc-b963-0014a5a8b07d}]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
Open(&0)\command- H:\Recycled\ctfmon.exe

*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder
"2007-08-25 10:45:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2007-09-18 13:57:31 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
"2007-09-07 13:18:08 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - Carmen.job"
.
**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-18 22:10:27
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = C:\Program Files\HPQ\Default Settings\cpqset.exe??????????\????|?????? ???B?????????????hLC? ??????

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-09-18 22:11:32
C:\ComboFix-quarantined-files.txt … 2007-09-18 22:11
C:\ComboFix2.txt … 2007-09-17 13:07
C:\ComboFix3.txt … 2007-09-15 23:58
.
— E O F —




new hijackthis log:


Logfile of HijackThis v1.99.1
Scan saved at 10:12:04 PM, on 9/18/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Carmen\programs\adaware\aawservice.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\SmartFix\bin\McciTrayApp.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\Brother\ControlCenter2\brctrcen.exe
C:\Carmen\programs\poweriso\PWRISOVM.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\svchost.exe
C:\Carmen\programs\adaware\AAWTray.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\PROGRA~1\HPQ\SHARED\HPQTOA~1.EXE
C:\Documents and Settings\Carmen\Start Menu\Programs\Startup\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Hijackthis\Scanner.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…o&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.tp.edu.sg:80
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;*.tp.edu.sg;
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Carmen\programs\bitcomet\tools\BitCometBHO_1.1.5.19.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Carmen\programs\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [Reminder] C:\Windows\CREATOR\Remind_XP.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [singtelTrayApp] "C:\Program Files\SmartFix\bin\McciTrayApp.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl05a\BrStDvPt.exe
O4 - HKLM\..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Carmen\programs\poweriso\PWRISOVM.EXE
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [AAWTray] C:\Carmen\programs\adaware\AAWTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Startup: ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Status Monitor.lnk = C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Carmen\programs\bitcomet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Carmen\programs\bitcomet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Carmen\programs\bitcomet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Carmen\programs\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Carmen\programs\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_SG&c=Q106&bd=presario&pf=laptop
O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games.com.my/com/EGamesPlugin.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab
O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} (ijjiPlugin2 Class) - http://gamedownload.ijjimax.com/gamedownlo…Plugin11USA.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Carmen\programs\adaware\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\Shared\hpqwmi.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing)
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe



thanks!

erm..do you want me to post the Dr.web report?

here is the new hijackthis log after the Dr. web scan

Logfile of HijackThis v1.99.1
Scan saved at 6:53:38 PM, on 9/19/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Carmen\programs\adaware\aawservice.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\brss01a.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\PROGRA~1\HPQ\SHARED\HPQTOA~1.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\SmartFix\bin\McciTrayApp.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Brother\ControlCenter2\brctrcen.exe
C:\Carmen\programs\poweriso\PWRISOVM.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Carmen\programs\adaware\AAWTray.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Carmen\Desktop\drweb-cureit.exe
C:\DOCUME~1\Carmen\LOCALS~1\Temp\RarSFX0\_start.exe
C:\DOCUME~1\Carmen\LOCALS~1\Temp\RarSFX0\setup.exe
C:\Program Files\Microsoft Office\Office10\EXCEL.EXE
C:\Program Files\Hijackthis\Scanner.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…o&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.tp.edu.sg:80
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;*.tp.edu.sg;
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Carmen\programs\bitcomet\tools\BitCometBHO_1.1.5.19.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Carmen\programs\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [Reminder] C:\Windows\CREATOR\Remind_XP.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [singtelTrayApp] "C:\Program Files\SmartFix\bin\McciTrayApp.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl05a\BrStDvPt.exe
O4 - HKLM\..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Carmen\programs\poweriso\PWRISOVM.EXE
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [AAWTray] C:\Carmen\programs\adaware\AAWTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Status Monitor.lnk = C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Carmen\programs\bitcomet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Carmen\programs\bitcomet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Carmen\programs\bitcomet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Carmen\programs\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Carmen\programs\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_SG&c=Q106&bd=presario&pf=laptop
O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games.com.my/com/EGamesPlugin.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab
O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} (ijjiPlugin2 Class) - http://gamedownload.ijjimax.com/gamedownlo…Plugin11USA.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Carmen\programs\adaware\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\Shared\hpqwmi.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing)
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe