[Resolved] wintantispyware help

Hi all, Sorry to bother but I really need help with this. The winantispyware pop out once in a while but it's making my computer very sluggish. here the hijack log below, pls take a look at it and thanks in advance

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:16:52 PM, on 10/7/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\eManager\anbmServ.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\acer\epm\epm-dm.exe
C:\Program Files\Launch Manager\QtZgAcer.EXE
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Hamachi\hamachi.exe
C:\Program Files\Red Chair Software\Anapod Explorer\anamgr.exe
C:\Program Files\Thunder\Program\Thunder5.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://global.acer.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 61.152.109.123:80
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAudPropShortcut.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [EPM-DM] c:\acer\epm\epm-dm.exe
O4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe boot
O4 - HKLM\..\Run: [LManager] C:\Program Files\Launch Manager\QtZgAcer.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe"
O4 - HKLM\..\Run: [SearchIndexer] rundll32.exe "C:\WINDOWS\system32\ijvsregw.dll",sitypnow
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\RunOnce: [iolo 3rd Party Reboot] C:\Documents and Settings\All Users\Application Data\iolo\IRestartStub.exe /t "System Mechanic Professional" /i "C:\Application\System Performance\System.Mechanic.7.1.11.Professional\System Mechanic 7.1.11 Professional\SystemMechanic7Pro.exe" /v "iolo 3rd Party Reboot" /av "Norton Antivirus" /fw "Norton Firewall"
O4 - Startup: hamachi.lnk = C:\Program Files\Hamachi\hamachi.exe
O4 - Startup: Anapod Manager.lnk = C:\Program Files\Red Chair Software\Anapod Explorer\anamgr.exe
O4 - Global Startup: BTTray.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: ʹÓÃѸÀ×ÏÂÔØ - C:\Program Files\Thunder\Program\geturl.htm
O8 - Extra context menu item: ʹÓÃѸÀ×ÏÂÔØÈ«²¿Á´½Ó - C:\Program Files\Thunder\Program\getallurl.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02ECD07A-22D0-4AF0-BA0A-3F6B06086D08} (GamesCampus Control) - http://fishingchamp.gamescampus.com/luncher/GamesCampus.cab
O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games.com.my/com/EGamesPlugin.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1188267419437
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

–
End of file - 9061 bytes

H, thanks for the reply and sorry for giving the wrong hijack log. hope this time is correct, change the exe to whatever.exe in the hijack folder this time

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:49:46 AM, on 10/9/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\eManager\anbmServ.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\acer\epm\epm-dm.exe
C:\Program Files\Launch Manager\QtZgAcer.EXE
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Hamachi\hamachi.exe
C:\Program Files\Red Chair Software\Anapod Explorer\anamgr.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\whatever.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://global.acer.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 61.152.109.123:80
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Thunder AtOnce - {01443AEC-0FD1-40fd-9C87-E93D1494C233} - C:\Program Files\Thunder\ComDlls\TDAtOnce_Now.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {124359B7-3526-4D5A-B30D-597BA6EC628E} - C:\WINDOWS\system32\jkhfg.dll
O2 - BHO: (no name) - {140BD8E3-C167-11D4-B4A3-080000180323} - (no file)
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: ThunderBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - C:\Program Files\Thunder\ComDlls\xunleiBHO_Now.dll
O2 - BHO: (no name) - {89AD4D75-2429-462e-BD4E-443F233F6033} - C:\WINDOWS\system32\fuvgilyr.dll
O2 - BHO: (no name) - {8AFAA704-240B-415E-9407-316189CE9C08} - (no file)
O2 - BHO: (no name) - {9E62D02F-7CF3-404C-B2E3-162FDFB267C7} - (no file)
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAudPropShortcut.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [EPM-DM] c:\acer\epm\epm-dm.exe
O4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe boot
O4 - HKLM\..\Run: [LManager] C:\Program Files\Launch Manager\QtZgAcer.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe"
O4 - HKLM\..\Run: [SearchIndexer] rundll32.exe "C:\WINDOWS\system32\dofejnxn.dll",sitypnow
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\RunOnce: [iolo 3rd Party Reboot] C:\Documents and Settings\All Users\Application Data\iolo\IRestartStub.exe /t "System Mechanic Professional" /i "C:\Application\System Performance\System.Mechanic.7.1.11.Professional\System Mechanic 7.1.11 Professional\SystemMechanic7Pro.exe" /v "iolo 3rd Party Reboot" /av "Norton Antivirus" /fw "Norton Firewall"
O4 - Startup: hamachi.lnk = C:\Program Files\Hamachi\hamachi.exe
O4 - Startup: Anapod Manager.lnk = C:\Program Files\Red Chair Software\Anapod Explorer\anamgr.exe
O4 - Global Startup: BTTray.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: ʹÓÃѸÀ×ÏÂÔØ - C:\Program Files\Thunder\Program\geturl.htm
O8 - Extra context menu item: ʹÓÃѸÀ×ÏÂÔØÈ«²¿Á´½Ó - C:\Program Files\Thunder\Program\getallurl.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02ECD07A-22D0-4AF0-BA0A-3F6B06086D08} (GamesCampus Control) - http://fishingchamp.gamescampus.com/luncher/GamesCampus.cab
O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games.com.my/com/EGamesPlugin.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1188267419437
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: fccdefc - C:\WINDOWS\SYSTEM32\fccdefc.dll
O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

–
End of file - 10182 bytes

hi Blade81,
I ran the combofix and I got an error. It says sed.cfexe has encounted a problem and needs to close. I click Don't Send and the combofix continue to run. Is that normal? Anyway here's the combofix log

ComboFix 07-10-09.3 - Acer 2007-10-10 0:06:22.3 - FAT32x86 MINIMAL
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1051 [GMT 8:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\cookies.ini
C:\WINDOWS\system32\aakdofnb.dll
C:\WINDOWS\system32\bbtfwbih.ini
C:\WINDOWS\system32\bclfumyi.ini
C:\WINDOWS\system32\bnfodkaa.ini
C:\WINDOWS\system32\ckmvqmxu.ini
C:\WINDOWS\system32\dgjlm.bak1
C:\WINDOWS\system32\dgjlm.bak1
C:\WINDOWS\system32\dgjlm.ini2
C:\WINDOWS\system32\dgjlm.ini2
C:\WINDOWS\system32\dgjlm.tmp
C:\WINDOWS\system32\dgjlm.tmp
C:\WINDOWS\system32\dofejnxn.dll
C:\WINDOWS\system32\fuvgilyr.dll
C:\WINDOWS\system32\gfhkj.bak2
C:\WINDOWS\system32\gfhkj.bak2
C:\WINDOWS\system32\gfhkj.ini
C:\WINDOWS\system32\gfhkj.ini
C:\WINDOWS\system32\gfhkj.ini2
C:\WINDOWS\system32\gfhkj.ini2
C:\WINDOWS\system32\gfhkj.tmp
C:\WINDOWS\system32\gfhkj.tmp
C:\WINDOWS\system32\hibwftbb.dll
C:\WINDOWS\system32\ijvsregw.dll
C:\WINDOWS\system32\iymuflcb.dll
C:\WINDOWS\system32\jkhfg.dll
C:\WINDOWS\system32\nnoyciit.dll
C:\WINDOWS\system32\nxnjefod.ini
C:\WINDOWS\system32\pdkrnvqq.ini
C:\WINDOWS\system32\ppqss.bak1
C:\WINDOWS\system32\ppqss.bak1
C:\WINDOWS\system32\ppqss.ini
C:\WINDOWS\system32\ppqss.ini
C:\WINDOWS\system32\qqvnrkdp.dll
C:\WINDOWS\system32\rgmauaot.ini
C:\WINDOWS\system32\sonkswwx.ini
C:\WINDOWS\system32\ssqpp.dll
C:\WINDOWS\system32\tiicyonn.ini
C:\WINDOWS\system32\toauamgr.dll
C:\WINDOWS\system32\uxmqvmkc.dll
C:\WINDOWS\system32\wgersvji.ini
C:\WINDOWS\system32\xunleibho_v1.dll
C:\WINDOWS\system32\xunleibho_v2.dll
C:\WINDOWS\system32\xunleibho_v3.dll
C:\WINDOWS\system32\xwwsknos.dll

.
((((((((((((((((((((((((( Files Created from 2007-09-09 to 2007-10-09 )))))))))))))))))))))))))))))))
.

2007-10-09 23:55 33,280 –a—— C:\WINDOWS\system32\rundll32.exe
2007-10-09 23:55 33,280 –a—— C:\WINDOWS\system32\dllcache\rundll32.exe
2007-10-09 23:53 51,200 –a—— C:\WINDOWS\NirCmd.exe
2007-10-07 23:51 d——– C:\Program Files\Real Alternative
2007-10-07 23:51 d——– C:\Program Files\Media Player Classic
2007-10-07 23:51 d——– C:\Documents and Settings\All Users\Application Data\Real
2007-10-07 17:13 d–hs—- C:\FOUND.000
2007-10-07 05:29 d——– C:\Program Files\WIDCOMM
2007-10-07 05:29 d——– C:\driver
2007-10-06 17:39 d——– C:\Program Files\Trend Micro
2007-10-06 02:34 d——– C:\TDDOWNLOAD
2007-10-06 02:24 d——– C:\Documents and Settings\All Users\Application Data\thunder_vod_cache
2007-10-06 02:24 d——– C:\Documents and Settings\All Users\Application Data\mvcache
2007-10-06 02:24 1,871 –a—— C:\WINDOWS\system32\cid_store.dat
2007-10-06 02:10 d——– C:\Program Files\Thunder
2007-10-06 02:10 d——– C:\Documents and Settings\All Users\Application Data\Thunder Network
2007-10-06 00:55 d——– C:\Program Files\SUPERAntiSpyware
2007-10-06 00:55 d——– C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2007-10-06 00:55 d——– C:\Documents and Settings\Acer\Application Data\SUPERAntiSpyware.com
2007-10-06 00:51 d——– C:\Program Files\Common Files\Wise Installation Wizard
2007-10-06 00:51 5,914,648 –a—— C:\SUPERAntiSpyware.exe
2007-10-05 00:53 d——– C:\Program Files\Purple Star Astrology
2007-10-04 07:49 22,112 -ra—— C:\WINDOWS\system32\drivers\COH_Mon.sys
2007-10-03 22:22 4,468 –a—— C:\WINDOWS\system32\tmp.reg
2007-10-03 21:14 d——– C:\Program Files\Norton AntiVirus
2007-10-03 21:14 123,952 –a—— C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2007-10-03 21:14 60,800 –a—— C:\WINDOWS\system32\S32EVNT1.DLL
2007-10-03 19:45 d——– C:\Documents and Settings\Acer\.housecall6.6
2007-10-03 13:32 d——– C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-10-02 23:53 d——– C:\Documents and Settings\Administrator\Application Data\Lavasoft
2007-10-02 23:53 d——– C:\Documents and Settings\Administrator\Application Data\Lavasoft
2007-10-02 22:24 d——– C:\Program Files\Bluetooth Remote Control
2007-10-02 22:22 d——– C:\WINDOWS\system32\URTTEMP
2007-10-02 14:20 d–h—– C:\WINDOWS\PIF
2007-10-02 14:14 d——– C:\Program Files\Symantec
2007-10-02 14:14 d——– C:\Program Files\Common Files\Symantec Shared
2007-10-02 11:12 d——– C:\WINDOWS\pss
2007-10-02 10:49 d——– C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
2007-10-01 22:36 d——– C:\Program Files\PowerISO
2007-10-01 22:36 36,352 –a—— C:\WINDOWS\system32\fccdefc.dll
2007-09-30 21:56 d——– C:\Program Files\Siber Systems
2007-09-30 21:18 d——– C:\Program Files\Rapidown
2007-09-30 19:50 d——– C:\Documents and Settings\Acer\Application Data\Lavasoft
2007-09-30 19:49 d——– C:\Program Files\Lavasoft
2007-09-30 19:47 d——– C:\Documents and Settings\All Users\Application Data\iolo
2007-09-30 19:47 d——– C:\Documents and Settings\Acer\Application Data\iolo
2007-09-30 19:47 74,703 –a—— C:\WINDOWS\system32\mfc45.dll
2007-09-29 18:42 1,156 –a—— C:\WINDOWS\mozver.dat
2007-09-28 23:32 d-a—— C:\i386
2007-09-27 22:24 266,360 –a—— C:\WINDOWS\system32\TweakUI.exe
2007-09-27 18:58 d——– C:\Program Files\RegCure
2007-09-27 18:38 d——– C:\Program Files\XP Repair Pro 2007
2007-09-27 18:35 d——– C:\Application
2007-09-26 23:24 d——– C:\Program Files\Yahoo!
2007-09-26 23:24 d——– C:\Program Files\CCleaner
2007-09-26 22:24 d–h—– C:\WINDOWS\system32\GroupPolicy
2007-09-26 22:09 d——– C:\My Zip Files
2007-09-26 22:05 64,342 –a—— C:\WINDOWS\BricoPackUninst.cmd
2007-09-26 22:04 d——– C:\WINDOWS\BricoPacks
2007-09-26 22:04 6,112 –a—— C:\WINDOWS\BricoPackFoldersDelete.cmd
2007-09-26 21:52 d——– C:\Program Files\Red Chair Software
2007-09-26 21:52 d——– C:\Documents and Settings\Acer\Application Data\Red Chair Software
2007-09-26 21:51 d——– C:\Anapod_Explorer_9.0.3
2007-09-26 21:00 d——– C:\Stop_Smoking
2007-09-23 18:30 d——– C:\Program Files\Ares
2007-09-23 16:24 d——– C:\Downloads
2007-09-23 14:19 d——– C:\Program Files\Download Direct
2007-09-23 14:03 d——– C:\Program Files\My-Proxy
2007-09-23 05:59 d——– C:\OpenSSL
2007-09-23 05:59 155,648 –a—— C:\WINDOWS\system32\libssl32.dll
2007-09-23 05:41 d——– C:\Documents and Settings\Acer\Application Data\Talkback
2007-09-23 05:41 0 –a—— C:\WINDOWS\nsreg.dat
2007-09-23 05:21 d——– C:\Neo Geo
2007-09-23 01:04 1,056,768 –a—— C:\WINDOWS\system32\ROBOEX32.DLL
2007-09-23 01:04 49,152 –a—— C:\WINDOWS\system32\INETWH32.dll
2007-09-23 00:18 d——– C:\Documents and Settings\Acer\Application Data\Ulead Systems
2007-09-22 23:55 d——– C:\WINDOWS\Noslip
2007-09-22 23:55 d——– C:\Program Files\Ulead Systems
2007-09-22 23:55 d——– C:\Documents and Settings\All Users\Application Data\Ulead Systems
2007-09-22 23:44 d——– C:\Documents and Settings\Acer\Application Data\Media Player Classic
2007-09-22 23:44 d——– C:\Documents and Settings\Acer\Application Data\DivX
2007-09-22 18:53 116,224 –a—— C:\WINDOWS\system32\dllcache\xrxwiadr.dll
2007-09-22 18:53 99,865 –a—— C:\WINDOWS\system32\dllcache\xlog.exe
2007-09-22 18:53 27,648 –a—— C:\WINDOWS\system32\dllcache\xrxftplt.exe
2007-09-22 18:53 23,040 –a—— C:\WINDOWS\system32\dllcache\xrxwbtmp.dll
2007-09-22 18:53 19,455 –a—— C:\WINDOWS\system32\dllcache\wvchntxx.sys
2007-09-22 18:53 17,408 –a—— C:\WINDOWS\system32\dllcache\xrxscnui.dll
2007-09-22 18:53 16,970 –a—— C:\WINDOWS\system32\dllcache\xem336n5.sys
2007-09-22 18:53 4,608 –a—— C:\WINDOWS\system32\dllcache\xrxflnch.exe
2007-09-22 18:49 525,568 –a—— C:\WINDOWS\system32\dllcache\tridxp.dll
2007-09-22 18:49 166,784 –a—— C:\WINDOWS\system32\dllcache\tridxpm.sys
2007-09-22 18:49 159,232 –a—— C:\WINDOWS\system32\dllcache\tridkbm.sys
2007-09-22 18:49 11,520 –a—— C:\WINDOWS\system32\dllcache\twotrack.sys
2007-09-18 14:43 317,616 –a—— C:\WINDOWS\system32\drivers\srtspl.sys
2007-09-18 14:43 278,576 –a—— C:\WINDOWS\system32\drivers\srtsp.sys
2007-09-18 14:43 43,696 –a—— C:\WINDOWS\system32\drivers\srtspx.sys
2007-09-15 19:42 d——– C:\Documents and Settings\Acer\Application Data\Nokia Multimedia Player
2007-09-15 19:38 d——– C:\Documents and Settings\Acer\Phone Browser
2007-09-15 19:38 d——– C:\Documents and Settings\Acer\Application Data\Datalayer
2007-09-15 12:48 440,576 –a—— C:\WINDOWS\system32\dllcache\tridkb.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-03 23:49 805 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
2007-10-03 23:49 10,740 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2007-09-26 14:05 218,624 —-a-w C:\WINDOWS\system32\uxtheme.dll
2007-09-26 14:05 218,624 —-a-w C:\WINDOWS\system32\dllcache\uxtheme.dll
2007-09-26 13:59 359,808 —-a-w C:\WINDOWS\system32\drivers\TCPIP.SYS
2007-09-26 13:59 359,808 —-a-w C:\WINDOWS\system32\dllcache\tcpip.sys
2007-09-23 06:13 359,808 —-a-w C:\WINDOWS\system32\drivers\TCPIP.SYS.ORIGINAL
2007-09-18 06:44 10,662 —-a-w C:\WINDOWS\system32\drivers\srtspx.cat
2007-09-18 06:44 10,662 —-a-w C:\WINDOWS\system32\drivers\srtspl.cat
2007-09-18 06:44 10,658 —-a-w C:\WINDOWS\system32\drivers\srtsp.cat
2007-09-18 06:44 1,430 —-a-w C:\WINDOWS\system32\drivers\srtspl.inf
2007-09-18 06:44 1,421 —-a-w C:\WINDOWS\system32\drivers\srtspx.inf
2007-09-18 06:44 1,415 —-a-w C:\WINDOWS\system32\drivers\srtsp.inf
2007-09-08 04:10 ——— d—–w C:\Program Files\DivX
2007-09-04 12:31 ——— d—–w C:\Documents and Settings\Acer\Application Data\AdobeUM
2007-09-02 16:14 ——— d—–w C:\Program Files\MSXML 4.0
2007-09-02 13:59 ——— d—–w C:\Program Files\Common Files\Thraex Software
2007-09-01 15:36 ——— d—–w C:\Program Files\Common Files\Real
2007-09-01 15:36 ——— d—–w C:\Documents and Settings\Acer\Application Data\Real
2007-09-01 05:25 ——— d—–w C:\Documents and Settings\Acer\Application Data\Nokia
2007-09-01 05:21 ——— d—–w C:\Program Files\DIFX
2007-09-01 05:21 ——— d—–w C:\Program Files\Common Files\PCSuite
2007-09-01 05:21 ——— d—–w C:\Program Files\Common Files\Nokia
2007-09-01 05:21 ——— d—–w C:\Documents and Settings\All Users\Application Data\PC Suite
2007-09-01 05:21 ——— d—–w C:\Documents and Settings\Acer\Application Data\PC Suite
2007-09-01 05:20 ——— d—–w C:\Program Files\Nokia
2007-09-01 00:53 ——— d—–w C:\Program Files\uTorrent
2007-09-01 00:52 ——— d—–w C:\Documents and Settings\Acer\Application Data\uTorrent
2007-08-31 23:52 ——— d—–w C:\Documents and Settings\Acer\Application Data\Hamachi
2007-08-31 23:51 25,544 —-a-w C:\WINDOWS\system32\drivers\hamachi.sys
2007-08-31 23:51 ——— d—–w C:\Program Files\Hamachi
2007-08-28 15:33 ——— d—–w C:\Documents and Settings\All Users\Application Data\Symantec
2007-08-28 15:31 ——— d—–w C:\Program Files\Microsoft.NET
2007-08-28 15:31 ——— d—–w C:\Program Files\Microsoft ActiveSync
2007-08-28 15:31 ——— d—–w C:\Program Files\Common Files\L&H;
2007-08-28 15:30 ——— d—–w C:\Program Files\Microsoft Works
2007-08-28 09:34 ——— d—–w C:\Documents and Settings\Acer\Application Data\Help
2007-08-28 09:28 ——— d—–w C:\Program Files\Skype
2007-08-28 09:28 ——— d—–w C:\Program Files\Common Files\Skype
2007-08-28 09:28 ——— d—–w C:\Documents and Settings\All Users\Application Data\Skype
2007-08-28 09:28 ——— d—–w C:\Documents and Settings\Acer\Application Data\Skype
2007-08-28 04:54 ——— d—–w C:\Program Files\e-Games
2007-08-28 03:31 ——— d—–w C:\Documents and Settings\Acer\Application Data\WinRAR
2007-08-28 03:28 139,264 —-a-w C:\WINDOWS\War3Unin.exe
2007-08-28 03:20 ——— d—–w C:\Program Files\Warcraft III
2007-08-28 02:54 685,816 —-a-w C:\WINDOWS\system32\drivers\sptd.sys
2007-08-28 02:49 ——— d—–w C:\Program Files\Gamescampus
2007-08-28 02:41 ——— d—–w C:\Program Files\MSN Messenger
2007-08-28 00:04 ——— d—–w C:\WINDOWS\system32\config\systemprofile\Application Data\Help
2007-08-28 00:04 ——— d—–w C:\WINDOWS\system32\config\systemprofile\Application Data\Help
2007-08-24 17:31 ——— d—–w C:\Program Files\acer
2007-08-24 17:29 ——— d—–w C:\Program Files\Launch Manager
2007-08-24 00:39 4,094 —-a-w C:\WINDOWS\CLEANUP.CMD
2007-08-21 00:26 81,920 —-a-w C:\WINDOWS\system32\dpl100.dll
2007-08-21 00:26 196,608 —-a-w C:\WINDOWS\system32\dtu100.dll
2007-08-15 22:33 9,464 ——w C:\WINDOWS\system32\drivers\cdralw2k.sys
2007-08-15 22:33 9,336 ——w C:\WINDOWS\system32\drivers\cdr4_xp.sys
2007-08-15 22:33 524,288 —-a-w C:\WINDOWS\system32\DivXsm.exe
2007-08-15 22:33 43,528 ——w C:\WINDOWS\system32\drivers\PxHelp20.sys
2007-08-15 22:33 3,596,288 —-a-w C:\WINDOWS\system32\qt-dx331.dll
2007-08-15 22:33 200,704 —-a-w C:\WINDOWS\system32\ssldivx.dll
2007-08-15 22:33 144,704 —-a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2007-08-15 22:33 129,784 ——w C:\WINDOWS\system32\pxafs.dll
2007-08-15 22:33 120,056 ——w C:\WINDOWS\system32\pxcpyi64.exe
2007-08-15 22:33 118,520 ——w C:\WINDOWS\system32\pxinsi64.exe
2007-08-15 22:33 1,044,480 —-a-w C:\WINDOWS\system32\libdivx.dll
2007-08-15 22:31 593,920 —-a-w C:\WINDOWS\system32\dpuGUI11.dll
2007-08-15 22:31 57,344 —-a-w C:\WINDOWS\system32\dpv11.dll
2007-08-15 22:31 53,248 —-a-w C:\WINDOWS\system32\dpuGUI10.dll
2007-08-15 22:31 344,064 —-a-w C:\WINDOWS\system32\dpus11.dll
2007-08-15 22:31 294,912 —-a-w C:\WINDOWS\system32\dpu11.dll
2007-08-15 22:31 294,912 —-a-w C:\WINDOWS\system32\dpu10.dll
2007-08-15 22:30 823,296 —-a-w C:\WINDOWS\system32\divx_xx0c.dll
2007-08-15 22:30 823,296 —-a-w C:\WINDOWS\system32\divx_xx07.dll
2007-08-15 22:30 802,816 —-a-w C:\WINDOWS\system32\divx_xx11.dll
2007-08-15 22:30 740,442 —-a-w C:\WINDOWS\system32\DivX.dll
2007-08-15 22:30 12,288 —-a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2007-07-30 11:19 92,504 —-a-w C:\WINDOWS\system32\dllcache\cdm.dll
2007-07-30 11:19 92,504 —-a-w C:\WINDOWS\system32\cdm.dll
2007-07-30 11:19 68,440 —-a-w C:\WINDOWS\system32\dllcache\wuauclt.exe
2007-07-30 11:19 549,720 —-a-w C:\WINDOWS\system32\wuapi.dll
2007-07-30 11:19 549,720 —-a-w C:\WINDOWS\system32\dllcache\wuapi.dll
2007-07-30 11:19 53,080 —-a-w C:\WINDOWS\system32\wuauclt.exe
2007-07-30 11:19 43,352 —-a-w C:\WINDOWS\system32\wups2.dll
2007-07-30 11:19 325,976 —-a-w C:\WINDOWS\system32\wucltui.dll
2007-07-30 11:19 325,976 —-a-w C:\WINDOWS\system32\dllcache\wucltui.dll
2007-07-30 11:19 203,096 —-a-w C:\WINDOWS\system32\wuweb.dll
2007-07-30 11:19 203,096 —-a-w C:\WINDOWS\system32\dllcache\wuweb.dll
2007-07-30 11:19 1,712,984 —-a-w C:\WINDOWS\system32\wuaueng.dll
2007-07-30 11:19 1,712,984 —-a-w C:\WINDOWS\system32\dllcache\wuaueng.dll
2007-07-30 11:18 33,624 —-a-w C:\WINDOWS\system32\wups.dll
2007-07-30 11:18 33,624 —-a-w C:\WINDOWS\system32\dllcache\wups.dll
2007-07-19 07:00 3,856,384 —-a-w C:\WINDOWS\system32\dllcache\mshtml.dll
2007-07-12 23:31 765,952 —-a-w C:\WINDOWS\system32\dllcache\vgx.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{140BD8E3-C167-11D4-B4A3-080000180323}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8AFAA704-240B-415E-9407-316189CE9C08}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9E62D02F-7CF3-404C-B2E3-162FDFB267C7}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-12-07 21:10]
"High Definition Audio Property Page Shortcut"="HDAudPropShortcut.exe" [2004-08-12 17:45 C:\WINDOWS\system32\Hdaudpropshortcut.exe]
"AGRSMMSG"="AGRSMMSG.exe" [2004-10-08 10:50 C:\WINDOWS\AGRSMMSG.exe]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-10-08 14:44]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-10-08 14:43]
"SoundMan"="SOUNDMAN.EXE" [2004-11-02 14:53 C:\WINDOWS\SoundMan.exe]
"AlcWzrd"="ALCWZRD.EXE" [2004-12-10 15:38 C:\WINDOWS\ALCWZRD.EXE]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-07-15 01:07]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-04 05:00]
"MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 05:00]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 05:00]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 05:00]
"EPM-DM"="c:\acer\epm\epm-dm.exe" [2005-01-25 14:02]
"ePowerManagement"="C:\Acer\ePM\ePM.exe" [2005-01-21 15:21]
"LManager"="C:\Program Files\Launch Manager\QtZgAcer.EXE" [2004-12-09 12:35]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]
"PCSuiteTrayApplication"="C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.exe" [2006-04-26 08:29]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 18:30]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-10 13:59]
"osCheck"="C:\Program Files\Norton AntiVirus\osCheck.exe" [2007-01-14 15:11]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 05:00]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\runonce]
"iolo 3rd Party Reboot"=C:\Documents and Settings\All Users\Application Data\iolo\IRestartStub.exe /t "System Mechanic Professional" /i "C:\Application\System Performance\System.Mechanic.7.1.11.Professional\System Mechanic 7.1.11 Professional\SystemMechanic7Pro.exe" /v "iolo 3rd Party Reboot" /av "Norton Antivirus" /fw "Norton Firewall"

C:\Documents and Settings\Acer\Start Menu\Programs\Startup\
hamachi.lnk - C:\Program Files\Hamachi\hamachi.exe [2007-09-01 07:51:57]
Anapod Manager.lnk - C:\Program Files\Red Chair Software\Anapod Explorer\anamgr.exe [2007-08-06 07:07:02]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
BTTray.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2003-07-29 16:14:16]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{E908A6A7-026C-4FBE-93A9-96020BEEAD53}"= C:\WINDOWS\system32\fccdefc.dll [2007-10-01 22:36 36352]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\fccdefc]
fccdefc.dll 2007-10-01 22:36 36352 C:\WINDOWS\system32\fccdefc.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent]
rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegistryMechanic]


R1 UBHelper;MRW remapping;C:\WINDOWS\system32\drivers\UBHelper.sys
R2 EpmPsd;Acer EPM Power Scheme Driver;\??\C:\WINDOWS\system32\drivers\epm-psd.sys
R2 EpmShd;Acer EPM System Hardware Driver;\??\C:\WINDOWS\system32\drivers\epm-shd.sys
R3 CONAN;CONAN;C:\WINDOWS\system32\drivers\o2mmb.sys
R3 DKbFltr;Dritek HotKey Keyboard Filter Driver;C:\WINDOWS\system32\Drivers\DKbFltr.sys
R3 MbxStby;MbxStby;C:\WINDOWS\system32\drivers\MbxStby.sys
R3 O2SCBUS;O2Micro SmartCardBus Reader;C:\WINDOWS\system32\DRIVERS\ozscr.sys
S3 int15.sys;int15.sys;\??\C:\Program Files\acer\erecovery\int15.sys

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5e473278-5a13-11dc-ad4b-00c09f794138}]
AutoRun\command



[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D48g43BC-4266-43f0-B6ED-9D38C4202C7E}]
C:\Program Files\ComPlus Applications\mscd.exe
.
Contents of the 'Scheduled Tasks' folder
"2007-09-27 10:58:32 C:\WINDOWS\Tasks\RegCure.job"
- C:\Program Files\RegCure\RegCure.exe
"2007-10-09 16:10:18 C:\WINDOWS\Tasks\RegCure Program Check.job"
"2007-10-08 12:32:14 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - Acer.job"
.
**************************************************************************

catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-10 00:10:52
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-10-10 0:12:13 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-10-10 00:12
.
— E O F —





and here's the hijack log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:13:26 AM, on 10/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\eManager\anbmServ.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\acer\epm\epm-dm.exe
C:\Program Files\Launch Manager\QtZgAcer.EXE
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Hamachi\hamachi.exe
C:\Program Files\Red Chair Software\Anapod Explorer\anamgr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\whatever.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://global.acer.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 61.152.109.123:80
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Thunder AtOnce - {01443AEC-0FD1-40fd-9C87-E93D1494C233} - C:\Program Files\Thunder\ComDlls\TDAtOnce_Now.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {140BD8E3-C167-11D4-B4A3-080000180323} - (no file)
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: ThunderBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - C:\Program Files\Thunder\ComDlls\xunleiBHO_Now.dll
O2 - BHO: (no name) - {8AFAA704-240B-415E-9407-316189CE9C08} - (no file)
O2 - BHO: (no name) - {9E62D02F-7CF3-404C-B2E3-162FDFB267C7} - (no file)
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAudPropShortcut.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [EPM-DM] c:\acer\epm\epm-dm.exe
O4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe boot
O4 - HKLM\..\Run: [LManager] C:\Program Files\Launch Manager\QtZgAcer.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\RunOnce: [iolo 3rd Party Reboot] C:\Documents and Settings\All Users\Application Data\iolo\IRestartStub.exe /t "System Mechanic Professional" /i "C:\Application\System Performance\System.Mechanic.7.1.11.Professional\System Mechanic 7.1.11 Professional\SystemMechanic7Pro.exe" /v "iolo 3rd Party Reboot" /av "Norton Antivirus" /fw "Norton Firewall"
O4 - Startup: hamachi.lnk = C:\Program Files\Hamachi\hamachi.exe
O4 - Startup: Anapod Manager.lnk = C:\Program Files\Red Chair Software\Anapod Explorer\anamgr.exe
O4 - Global Startup: BTTray.lnk = ?
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send To &Bluetooth; - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: ʹÓÃѸÀ×ÏÂÔØ - C:\Program Files\Thunder\Program\geturl.htm
O8 - Extra context menu item: ʹÓÃѸÀ×ÏÂÔØÈ«²¿Á´½Ó - C:\Program Files\Thunder\Program\getallurl.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02ECD07A-22D0-4AF0-BA0A-3F6B06086D08} (GamesCampus Control) - http://fishingchamp.gamescampus.com/luncher/GamesCampus.cab
O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games.com.my/com/EGamesPlugin.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1188267419437
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: fccdefc - C:\WINDOWS\SYSTEM32\fccdefc.dll
O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

–
End of file - 9784 bytes

lastly, thanks for helping

hi blade81,

here's the combofix log:

ComboFix 07-10-09.3 - Acer 2007-10-10 7:48:26.4 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.776 [GMT 8:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Acer\Desktop\CFScript.txt
* Created a new restore point

FILE::
C:\WINDOWS\system32\fccdefc.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\fccdefc.dll

.
((((((((((((((((((((((((( Files Created from 2007-09-09 to 2007-10-09 )))))))))))))))))))))))))))))))
.

2007-10-09 23:55 33,280 –a—— C:\WINDOWS\system32\rundll32.exe
2007-10-09 23:55 33,280 –a—— C:\WINDOWS\system32\dllcache\rundll32.exe
2007-10-09 23:53 51,200 –a—— C:\WINDOWS\NirCmd.exe
2007-10-07 23:51 d——– C:\Program Files\Real Alternative
2007-10-07 23:51 d——– C:\Program Files\Media Player Classic
2007-10-07 23:51 d——– C:\Documents and Settings\All Users\Application Data\Real
2007-10-07 17:13 d–hs—- C:\FOUND.000
2007-10-07 05:29 d——– C:\Program Files\WIDCOMM
2007-10-07 05:29 d——– C:\driver
2007-10-06 17:39 d——– C:\Program Files\Trend Micro
2007-10-06 02:34 d——– C:\TDDOWNLOAD
2007-10-06 02:24 d——– C:\Documents and Settings\All Users\Application Data\thunder_vod_cache
2007-10-06 02:24 d——– C:\Documents and Settings\All Users\Application Data\mvcache
2007-10-06 02:24 1,871 –a—— C:\WINDOWS\system32\cid_store.dat
2007-10-06 02:10 d——– C:\Program Files\Thunder
2007-10-06 02:10 d——– C:\Documents and Settings\All Users\Application Data\Thunder Network
2007-10-06 00:55 d——– C:\Program Files\SUPERAntiSpyware
2007-10-06 00:55 d——– C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2007-10-06 00:55 d——– C:\Documents and Settings\Acer\Application Data\SUPERAntiSpyware.com
2007-10-06 00:51 d——– C:\Program Files\Common Files\Wise Installation Wizard
2007-10-06 00:51 5,914,648 –a—— C:\SUPERAntiSpyware.exe
2007-10-05 00:53 d——– C:\Program Files\Purple Star Astrology
2007-10-04 07:49 22,112 -ra—— C:\WINDOWS\system32\drivers\COH_Mon.sys
2007-10-03 22:22 4,468 –a—— C:\WINDOWS\system32\tmp.reg
2007-10-03 21:14 d——– C:\Program Files\Norton AntiVirus
2007-10-03 21:14 123,952 –a—— C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2007-10-03 21:14 60,800 –a—— C:\WINDOWS\system32\S32EVNT1.DLL
2007-10-03 19:45 d——– C:\Documents and Settings\Acer\.housecall6.6
2007-10-03 13:32 d——– C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-10-02 23:53 d——– C:\Documents and Settings\Administrator\Application Data\Lavasoft
2007-10-02 23:53 d——– C:\Documents and Settings\Administrator\Application Data\Lavasoft
2007-10-02 22:24 d——– C:\Program Files\Bluetooth Remote Control
2007-10-02 22:22 d——– C:\WINDOWS\system32\URTTEMP
2007-10-02 14:20 d–h—– C:\WINDOWS\PIF
2007-10-02 14:14 d——– C:\Program Files\Symantec
2007-10-02 14:14 d——– C:\Program Files\Common Files\Symantec Shared
2007-10-02 11:12 d——– C:\WINDOWS\pss
2007-10-02 10:49 d——– C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
2007-10-01 22:36 d——– C:\Program Files\PowerISO
2007-09-30 21:56 d——– C:\Program Files\Siber Systems
2007-09-30 21:18 d——– C:\Program Files\Rapidown
2007-09-30 19:50 d——– C:\Documents and Settings\Acer\Application Data\Lavasoft
2007-09-30 19:49 d——– C:\Program Files\Lavasoft
2007-09-30 19:47 d——– C:\Documents and Settings\All Users\Application Data\iolo
2007-09-30 19:47 d——– C:\Documents and Settings\Acer\Application Data\iolo
2007-09-30 19:47 74,703 –a—— C:\WINDOWS\system32\mfc45.dll
2007-09-29 18:42 1,156 –a—— C:\WINDOWS\mozver.dat
2007-09-28 23:32 d-a—— C:\i386
2007-09-27 22:24 266,360 –a—— C:\WINDOWS\system32\TweakUI.exe
2007-09-27 18:58 d——– C:\Program Files\RegCure
2007-09-27 18:38 d——– C:\Program Files\XP Repair Pro 2007
2007-09-27 18:35 d——– C:\Application
2007-09-26 23:24 d——– C:\Program Files\Yahoo!
2007-09-26 23:24 d——– C:\Program Files\CCleaner
2007-09-26 22:24 d–h—– C:\WINDOWS\system32\GroupPolicy
2007-09-26 22:09 d——– C:\My Zip Files
2007-09-26 22:05 64,342 –a—— C:\WINDOWS\BricoPackUninst.cmd
2007-09-26 22:04 d——– C:\WINDOWS\BricoPacks
2007-09-26 22:04 6,112 –a—— C:\WINDOWS\BricoPackFoldersDelete.cmd
2007-09-26 21:52 d——– C:\Program Files\Red Chair Software
2007-09-26 21:52 d——– C:\Documents and Settings\Acer\Application Data\Red Chair Software
2007-09-26 21:51 d——– C:\Anapod_Explorer_9.0.3
2007-09-26 21:00 d——– C:\Stop_Smoking
2007-09-23 18:30 d——– C:\Program Files\Ares
2007-09-23 16:24 d——– C:\Downloads
2007-09-23 14:19 d——– C:\Program Files\Download Direct
2007-09-23 14:03 d——– C:\Program Files\My-Proxy
2007-09-23 05:59 d——– C:\OpenSSL
2007-09-23 05:59 155,648 –a—— C:\WINDOWS\system32\libssl32.dll
2007-09-23 05:41 d——– C:\Documents and Settings\Acer\Application Data\Talkback
2007-09-23 05:41 0 –a—— C:\WINDOWS\nsreg.dat
2007-09-23 05:21 d——– C:\Neo Geo
2007-09-23 01:04 1,056,768 –a—— C:\WINDOWS\system32\ROBOEX32.DLL
2007-09-23 01:04 49,152 –a—— C:\WINDOWS\system32\INETWH32.dll
2007-09-23 00:18 d——– C:\Documents and Settings\Acer\Application Data\Ulead Systems
2007-09-22 23:55 d——– C:\WINDOWS\Noslip
2007-09-22 23:55 d——– C:\Program Files\Ulead Systems
2007-09-22 23:55 d——– C:\Documents and Settings\All Users\Application Data\Ulead Systems
2007-09-22 23:44 d——– C:\Documents and Settings\Acer\Application Data\Media Player Classic
2007-09-22 23:44 d——– C:\Documents and Settings\Acer\Application Data\DivX
2007-09-22 18:53 116,224 –a—— C:\WINDOWS\system32\dllcache\xrxwiadr.dll
2007-09-22 18:53 99,865 –a—— C:\WINDOWS\system32\dllcache\xlog.exe
2007-09-22 18:53 27,648 –a—— C:\WINDOWS\system32\dllcache\xrxftplt.exe
2007-09-22 18:53 23,040 –a—— C:\WINDOWS\system32\dllcache\xrxwbtmp.dll
2007-09-22 18:53 19,455 –a—— C:\WINDOWS\system32\dllcache\wvchntxx.sys
2007-09-22 18:53 17,408 –a—— C:\WINDOWS\system32\dllcache\xrxscnui.dll
2007-09-22 18:53 16,970 –a—— C:\WINDOWS\system32\dllcache\xem336n5.sys
2007-09-22 18:53 4,608 –a—— C:\WINDOWS\system32\dllcache\xrxflnch.exe
2007-09-22 18:49 525,568 –a—— C:\WINDOWS\system32\dllcache\tridxp.dll
2007-09-22 18:49 166,784 –a—— C:\WINDOWS\system32\dllcache\tridxpm.sys
2007-09-22 18:49 159,232 –a—— C:\WINDOWS\system32\dllcache\tridkbm.sys
2007-09-22 18:49 11,520 –a—— C:\WINDOWS\system32\dllcache\twotrack.sys
2007-09-18 14:43 317,616 –a—— C:\WINDOWS\system32\drivers\srtspl.sys
2007-09-18 14:43 278,576 –a—— C:\WINDOWS\system32\drivers\srtsp.sys
2007-09-18 14:43 43,696 –a—— C:\WINDOWS\system32\drivers\srtspx.sys
2007-09-15 19:42 d——– C:\Documents and Settings\Acer\Application Data\Nokia Multimedia Player
2007-09-15 19:38 d——– C:\Documents and Settings\Acer\Phone Browser
2007-09-15 19:38 d——– C:\Documents and Settings\Acer\Application Data\Datalayer
2007-09-15 12:48 440,576 –a—— C:\WINDOWS\system32\dllcache\tridkb.dll
2007-09-15 12:48 315,520 –a—— C:\WINDOWS\system32\dllcache\trid3d.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-03 23:49 805 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
2007-10-03 23:49 10,740 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2007-09-26 14:05 218,624 —-a-w C:\WINDOWS\system32\uxtheme.dll
2007-09-26 14:05 218,624 —-a-w C:\WINDOWS\system32\dllcache\uxtheme.dll
2007-09-26 13:59 359,808 —-a-w C:\WINDOWS\system32\drivers\TCPIP.SYS
2007-09-26 13:59 359,808 —-a-w C:\WINDOWS\system32\dllcache\tcpip.sys
2007-09-23 06:13 359,808 —-a-w C:\WINDOWS\system32\drivers\TCPIP.SYS.ORIGINAL
2007-09-18 06:44 10,662 —-a-w C:\WINDOWS\system32\drivers\srtspx.cat
2007-09-18 06:44 10,662 —-a-w C:\WINDOWS\system32\drivers\srtspl.cat
2007-09-18 06:44 10,658 —-a-w C:\WINDOWS\system32\drivers\srtsp.cat
2007-09-18 06:44 1,430 —-a-w C:\WINDOWS\system32\drivers\srtspl.inf
2007-09-18 06:44 1,421 —-a-w C:\WINDOWS\system32\drivers\srtspx.inf
2007-09-18 06:44 1,415 —-a-w C:\WINDOWS\system32\drivers\srtsp.inf
2007-09-08 04:10 ——— d—–w C:\Program Files\DivX
2007-09-04 12:31 ——— d—–w C:\Documents and Settings\Acer\Application Data\AdobeUM
2007-09-02 16:14 ——— d—–w C:\Program Files\MSXML 4.0
2007-09-02 13:59 ——— d—–w C:\Program Files\Common Files\Thraex Software
2007-09-01 15:36 ——— d—–w C:\Program Files\Common Files\Real
2007-09-01 15:36 ——— d—–w C:\Documents and Settings\Acer\Application Data\Real
2007-09-01 05:25 ——— d—–w C:\Documents and Settings\Acer\Application Data\Nokia
2007-09-01 05:21 ——— d—–w C:\Program Files\DIFX
2007-09-01 05:21 ——— d—–w C:\Program Files\Common Files\PCSuite
2007-09-01 05:21 ——— d—–w C:\Program Files\Common Files\Nokia
2007-09-01 05:21 ——— d—–w C:\Documents and Settings\All Users\Application Data\PC Suite
2007-09-01 05:21 ——— d—–w C:\Documents and Settings\Acer\Application Data\PC Suite
2007-09-01 05:20 ——— d—–w C:\Program Files\Nokia
2007-09-01 00:53 ——— d—–w C:\Program Files\uTorrent
2007-09-01 00:52 ——— d—–w C:\Documents and Settings\Acer\Application Data\uTorrent
2007-08-31 23:52 ——— d—–w C:\Documents and Settings\Acer\Application Data\Hamachi
2007-08-31 23:51 25,544 —-a-w C:\WINDOWS\system32\drivers\hamachi.sys
2007-08-31 23:51 ——— d—–w C:\Program Files\Hamachi
2007-08-28 15:33 ——— d—–w C:\Documents and Settings\All Users\Application Data\Symantec
2007-08-28 15:31 ——— d—–w C:\Program Files\Microsoft.NET
2007-08-28 15:31 ——— d—–w C:\Program Files\Microsoft ActiveSync
2007-08-28 15:31 ——— d—–w C:\Program Files\Common Files\L&H
2007-08-28 15:30 ——— d—–w C:\Program Files\Microsoft Works
2007-08-28 09:34 ——— d—–w C:\Documents and Settings\Acer\Application Data\Help
2007-08-28 09:28 ——— d—–w C:\Program Files\Skype
2007-08-28 09:28 ——— d—–w C:\Program Files\Common Files\Skype
2007-08-28 09:28 ——— d—–w C:\Documents and Settings\All Users\Application Data\Skype
2007-08-28 09:28 ——— d—–w C:\Documents and Settings\Acer\Application Data\Skype
2007-08-28 04:54 ——— d—–w C:\Program Files\e-Games
2007-08-28 03:31 ——— d—–w C:\Documents and Settings\Acer\Application Data\WinRAR
2007-08-28 03:28 139,264 —-a-w C:\WINDOWS\War3Unin.exe
2007-08-28 03:20 ——— d—–w C:\Program Files\Warcraft III
2007-08-28 02:54 685,816 —-a-w C:\WINDOWS\system32\drivers\sptd.sys
2007-08-28 02:49 ——— d—–w C:\Program Files\Gamescampus
2007-08-28 02:41 ——— d—–w C:\Program Files\MSN Messenger
2007-08-28 00:04 ——— d—–w C:\WINDOWS\system32\config\systemprofile\Application Data\Help
2007-08-28 00:04 ——— d—–w C:\WINDOWS\system32\config\systemprofile\Application Data\Help
2007-08-24 17:31 ——— d—–w C:\Program Files\acer
2007-08-24 17:29 ——— d—–w C:\Program Files\Launch Manager
2007-08-24 00:39 4,094 —-a-w C:\WINDOWS\CLEANUP.CMD
2007-08-21 00:26 81,920 —-a-w C:\WINDOWS\system32\dpl100.dll
2007-08-21 00:26 196,608 —-a-w C:\WINDOWS\system32\dtu100.dll
2007-08-15 22:33 9,464 ——w C:\WINDOWS\system32\drivers\cdralw2k.sys
2007-08-15 22:33 9,336 ——w C:\WINDOWS\system32\drivers\cdr4_xp.sys
2007-08-15 22:33 524,288 —-a-w C:\WINDOWS\system32\DivXsm.exe
2007-08-15 22:33 43,528 ——w C:\WINDOWS\system32\drivers\PxHelp20.sys
2007-08-15 22:33 3,596,288 —-a-w C:\WINDOWS\system32\qt-dx331.dll
2007-08-15 22:33 200,704 —-a-w C:\WINDOWS\system32\ssldivx.dll
2007-08-15 22:33 144,704 —-a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2007-08-15 22:33 129,784 ——w C:\WINDOWS\system32\pxafs.dll
2007-08-15 22:33 120,056 ——w C:\WINDOWS\system32\pxcpyi64.exe
2007-08-15 22:33 118,520 ——w C:\WINDOWS\system32\pxinsi64.exe
2007-08-15 22:33 1,044,480 —-a-w C:\WINDOWS\system32\libdivx.dll
2007-08-15 22:31 593,920 —-a-w C:\WINDOWS\system32\dpuGUI11.dll
2007-08-15 22:31 57,344 —-a-w C:\WINDOWS\system32\dpv11.dll
2007-08-15 22:31 53,248 —-a-w C:\WINDOWS\system32\dpuGUI10.dll
2007-08-15 22:31 344,064 —-a-w C:\WINDOWS\system32\dpus11.dll
2007-08-15 22:31 294,912 —-a-w C:\WINDOWS\system32\dpu11.dll
2007-08-15 22:31 294,912 —-a-w C:\WINDOWS\system32\dpu10.dll
2007-08-15 22:30 823,296 —-a-w C:\WINDOWS\system32\divx_xx0c.dll
2007-08-15 22:30 823,296 —-a-w C:\WINDOWS\system32\divx_xx07.dll
2007-08-15 22:30 802,816 —-a-w C:\WINDOWS\system32\divx_xx11.dll
2007-08-15 22:30 740,442 —-a-w C:\WINDOWS\system32\DivX.dll
2007-08-15 22:30 12,288 —-a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2007-07-30 11:19 92,504 —-a-w C:\WINDOWS\system32\dllcache\cdm.dll
2007-07-30 11:19 92,504 —-a-w C:\WINDOWS\system32\cdm.dll
2007-07-30 11:19 68,440 —-a-w C:\WINDOWS\system32\dllcache\wuauclt.exe
2007-07-30 11:19 549,720 —-a-w C:\WINDOWS\system32\wuapi.dll
2007-07-30 11:19 549,720 —-a-w C:\WINDOWS\system32\dllcache\wuapi.dll
2007-07-30 11:19 53,080 —-a-w C:\WINDOWS\system32\wuauclt.exe
2007-07-30 11:19 43,352 —-a-w C:\WINDOWS\system32\wups2.dll
2007-07-30 11:19 325,976 —-a-w C:\WINDOWS\system32\wucltui.dll
2007-07-30 11:19 325,976 —-a-w C:\WINDOWS\system32\dllcache\wucltui.dll
2007-07-30 11:19 203,096 —-a-w C:\WINDOWS\system32\wuweb.dll
2007-07-30 11:19 203,096 —-a-w C:\WINDOWS\system32\dllcache\wuweb.dll
2007-07-30 11:19 1,712,984 —-a-w C:\WINDOWS\system32\wuaueng.dll
2007-07-30 11:19 1,712,984 —-a-w C:\WINDOWS\system32\dllcache\wuaueng.dll
2007-07-30 11:18 33,624 —-a-w C:\WINDOWS\system32\wups.dll
2007-07-30 11:18 33,624 —-a-w C:\WINDOWS\system32\dllcache\wups.dll
2007-07-19 07:00 3,856,384 —-a-w C:\WINDOWS\system32\dllcache\mshtml.dll
2007-07-12 23:31 765,952 —-a-w C:\WINDOWS\system32\dllcache\vgx.dll
.

((((((((((((((((((((((((((((( snapshot@2007-10-10_ 0.11.19.98 )))))))))))))))))))))))))))))))))))))))))
.
—-a-w 63,360 2007-10-09 23:46:38 C:\WINDOWS\system32\perfc009.dat
—-a-w 402,534 2007-10-09 23:46:38 C:\WINDOWS\system32\perfh009.dat
—-a-w 163,328 2007-03-13 02:57:12 C:\WINDOWS\erdnt\subs\ERDNT.EXE
.
—-a-w 63,360 2007-10-07 04:28:48 C:\WINDOWS\system32\perfc009.dat
—-a-w 402,534 2007-10-07 04:28:48 C:\WINDOWS\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-12-07 21:10]
"High Definition Audio Property Page Shortcut"="HDAudPropShortcut.exe" [2004-08-12 17:45 C:\WINDOWS\system32\Hdaudpropshortcut.exe]
"AGRSMMSG"="AGRSMMSG.exe" [2004-10-08 10:50 C:\WINDOWS\AGRSMMSG.exe]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-10-08 14:44]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-10-08 14:43]
"SoundMan"="SOUNDMAN.EXE" [2004-11-02 14:53 C:\WINDOWS\SoundMan.exe]
"AlcWzrd"="ALCWZRD.EXE" [2004-12-10 15:38 C:\WINDOWS\ALCWZRD.EXE]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-07-15 01:07]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-04 05:00]
"MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 05:00]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 05:00]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 05:00]
"EPM-DM"="c:\acer\epm\epm-dm.exe" [2005-01-25 14:02]
"ePowerManagement"="C:\Acer\ePM\ePM.exe" [2005-01-21 15:21]
"LManager"="C:\Program Files\Launch Manager\QtZgAcer.EXE" [2004-12-09 12:35]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]
"PCSuiteTrayApplication"="C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.exe" [2006-04-26 08:29]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 18:30]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-10 13:59]
"osCheck"="C:\Program Files\Norton AntiVirus\osCheck.exe" [2007-01-14 15:11]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 05:00]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\runonce]
"iolo 3rd Party Reboot"=C:\Documents and Settings\All Users\Application Data\iolo\IRestartStub.exe /t "System Mechanic Professional" /i "C:\Application\System Performance\System.Mechanic.7.1.11.Professional\System Mechanic 7.1.11 Professional\SystemMechanic7Pro.exe" /v "iolo 3rd Party Reboot" /av "Norton Antivirus" /fw "Norton Firewall"

C:\Documents and Settings\Acer\Start Menu\Programs\Startup\
hamachi.lnk - C:\Program Files\Hamachi\hamachi.exe [2007-09-01 07:51:57]
Anapod Manager.lnk - C:\Program Files\Red Chair Software\Anapod Explorer\anamgr.exe [2007-08-06 07:07:02]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
BTTray.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2003-07-29 16:14:16]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent]
rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegistryMechanic]


R1 UBHelper;MRW remapping;C:\WINDOWS\system32\drivers\UBHelper.sys
R2 EpmPsd;Acer EPM Power Scheme Driver;\??\C:\WINDOWS\system32\drivers\epm-psd.sys
R2 EpmShd;Acer EPM System Hardware Driver;\??\C:\WINDOWS\system32\drivers\epm-shd.sys
R3 CONAN;CONAN;C:\WINDOWS\system32\drivers\o2mmb.sys
R3 DKbFltr;Dritek HotKey Keyboard Filter Driver;C:\WINDOWS\system32\Drivers\DKbFltr.sys
R3 MbxStby;MbxStby;C:\WINDOWS\system32\drivers\MbxStby.sys
R3 O2SCBUS;O2Micro SmartCardBus Reader;C:\WINDOWS\system32\DRIVERS\ozscr.sys
S3 int15.sys;int15.sys;\??\C:\Program Files\acer\erecovery\int15.sys

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5e473278-5a13-11dc-ad4b-00c09f794138}]
AutoRun\command



[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D48g43BC-4266-43f0-B6ED-9D38C4202C7E}]
C:\Program Files\ComPlus Applications\mscd.exe
.
Contents of the 'Scheduled Tasks' folder
"2007-09-27 10:58:32 C:\WINDOWS\Tasks\RegCure.job"
- C:\Program Files\RegCure\RegCure.exe
"2007-10-09 23:51:30 C:\WINDOWS\Tasks\RegCure Program Check.job"
"2007-10-08 12:32:14 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - Acer.job"
.
**************************************************************************

catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-10 07:52:13
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-10-10 7:53:17 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-10-10 07:53
C:\ComboFix2.txt … 2007-10-10 00:12
.
— E O F —




and here's the hijack log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:57:42 AM, on 10/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\eManager\anbmServ.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\acer\epm\epm-dm.exe
C:\Program Files\Launch Manager\QtZgAcer.EXE
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Hamachi\hamachi.exe
C:\Program Files\Red Chair Software\Anapod Explorer\anamgr.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\notepad.exe
C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
C:\Program Files\Symantec\LiveUpdate\AUPDATE.EXE
C:\Program Files\Trend Micro\HijackThis\whatever.exe
C:\Program Files\Norton AntiVirus\NAVW32.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://global.acer.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 61.152.109.123:80
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Thunder AtOnce - {01443AEC-0FD1-40fd-9C87-E93D1494C233} - C:\Program Files\Thunder\ComDlls\TDAtOnce_Now.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: ThunderBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - C:\Program Files\Thunder\ComDlls\xunleiBHO_Now.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAudPropShortcut.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [EPM-DM] c:\acer\epm\epm-dm.exe
O4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe boot
O4 - HKLM\..\Run: [LManager] C:\Program Files\Launch Manager\QtZgAcer.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\RunOnce: [iolo 3rd Party Reboot] C:\Documents and Settings\All Users\Application Data\iolo\IRestartStub.exe /t "System Mechanic Professional" /i "C:\Application\System Performance\System.Mechanic.7.1.11.Professional\System Mechanic 7.1.11 Professional\SystemMechanic7Pro.exe" /v "iolo 3rd Party Reboot" /av "Norton Antivirus" /fw "Norton Firewall"
O4 - Startup: hamachi.lnk = C:\Program Files\Hamachi\hamachi.exe
O4 - Startup: Anapod Manager.lnk = C:\Program Files\Red Chair Software\Anapod Explorer\anamgr.exe
O4 - Global Startup: BTTray.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: ʹÓÃѸÀ×ÏÂÔØ - C:\Program Files\Thunder\Program\geturl.htm
O8 - Extra context menu item: ʹÓÃѸÀ×ÏÂÔØÈ«²¿Á´½Ó - C:\Program Files\Thunder\Program\getallurl.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02ECD07A-22D0-4AF0-BA0A-3F6B06086D08} (GamesCampus Control) - http://fishingchamp.gamescampus.com/luncher/GamesCampus.cab
O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games.com.my/com/EGamesPlugin.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1188267419437
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

–
End of file - 9669 bytes

hi there,

i had done the scanner and here's the log

——————————————————————————-
KASPERSKY ONLINE SCANNER REPORT
Wednesday, October 10, 2007 9:24:40 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 10/10/2007
Kaspersky Anti-Virus database records: 430314
——————————————————————————-

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\

Scan Statistics:
Total number of scanned objects: 43343
Number of viruses found: 3
Number of infected objects: 8
Number of suspicious objects: 0
Duration of the scan process: 01:14:03

Infected Object Name / Virus Name / Last Action
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\SYSTEM Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped
C:\WINDOWS\system32\config\DEFAULT Object is locked skipped
C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edbtmp.log Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\Tasks\SCHEDLGU.TXT Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\2007-10-10_Log.ALUSchedulerSvc.LiveUpdate Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SubEng\submissions.idx Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtViEvt.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtNvEvt.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtMoEvt.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtScEvt.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtErEvt.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtTxFEvt.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtETmp\E4E37BFB.TMP Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtETmp\EFF6EB79.TMP Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\SPPolicy.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\SPStart.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\SPStop.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBValid.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBConfig.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBRefr.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBNotify.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetCfg.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetCfg2.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetUsr.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBStHash.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetLoc.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetDev.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBDetect.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBDebug.log Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Acer\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Acer\Local Settings\Temp\~DF6674.tmp Object is locked skipped
C:\Documents and Settings\Acer\Local Settings\Temp\~DF815B.tmp Object is locked skipped
C:\Documents and Settings\Acer\Local Settings\Temp\~DF816C.tmp Object is locked skipped
C:\Documents and Settings\Acer\Local Settings\Temp\~DFBD0D.tmp Object is locked skipped
C:\Documents and Settings\Acer\Local Settings\Temp\~DFBD33.tmp Object is locked skipped
C:\Documents and Settings\Acer\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Acer\Local Settings\History\History.IE5\MSHist012007101020071011\index.dat Object is locked skipped
C:\Documents and Settings\Acer\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Acer\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
C:\Documents and Settings\Acer\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Acer\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Acer\Local Settings\Application Data\Microsoft\Windows Live Contacts\[removed]\real\members.stg Object is locked skipped
C:\Documents and Settings\Acer\Local Settings\Application Data\Microsoft\Windows Live Contacts\[removed]\shadow\members.stg Object is locked skipped
C:\Documents and Settings\Acer\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped
C:\Documents and Settings\Acer\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Acer\ntuser.dat Object is locked skipped
C:\Documents and Settings\Acer\.housecall6.6\Quarantine\Dc1.exe.bac_a02188 Infected: Trojan-Downloader.Win32.Agent.dvd skipped
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcrst.dll Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\EENGINE\EPERSIST.DAT Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\NFWEVT.LOG Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SNDSYS.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SNDFW.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SNDCON.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SNDALRT.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SNDIDS.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SNDDBG.log Object is locked skipped
C:\Program Files\ComPlus Applications\svchost.exe Infected: Backdoor.Win32.Delf.bvz skipped
C:\Program Files\Norton AntiVirus\AVVirus.log Object is locked skipped
C:\Program Files\Norton AntiVirus\AVApp.log Object is locked skipped
C:\Program Files\Norton AntiVirus\AVError.log Object is locked skipped
C:\System Volume Information\_restore{4FE9DE13-0068-472E-89C3-D392849B5DAD}\RP1\A0000054.exe/data.rar/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\System Volume Information\_restore{4FE9DE13-0068-472E-89C3-D392849B5DAD}\RP1\A0000054.exe/data.rar Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\System Volume Information\_restore{4FE9DE13-0068-472E-89C3-D392849B5DAD}\RP1\A0000054.exe RarSFX: infected - 2 skipped
C:\System Volume Information\_restore{4FE9DE13-0068-472E-89C3-D392849B5DAD}\RP1\A0000061.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\System Volume Information\_restore{4FE9DE13-0068-472E-89C3-D392849B5DAD}\RP4\A0000444.exe Infected: Backdoor.Win32.Delf.bvz skipped
C:\System Volume Information\_restore{4FE9DE13-0068-472E-89C3-D392849B5DAD}\RP4\A0000475.exe Infected: Backdoor.Win32.Delf.bvz skipped
C:\System Volume Information\_restore{4FE9DE13-0068-472E-89C3-D392849B5DAD}\RP7\change.log Object is locked skipped

Scan process completed.







and here's the hijack log




Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:26:48 PM, on 10/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\eManager\anbmServ.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\acer\epm\epm-dm.exe
C:\Program Files\Launch Manager\QtZgAcer.EXE
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Hamachi\hamachi.exe
C:\Program Files\Red Chair Software\Anapod Explorer\anamgr.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\WISPTIS.EXE
C:\Program Files\Trend Micro\HijackThis\whatever.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://global.acer.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 61.152.109.123:80
O2 - BHO: Thunder AtOnce - {01443AEC-0FD1-40fd-9C87-E93D1494C233} - C:\Program Files\Thunder\ComDlls\TDAtOnce_Now.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: ThunderBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - C:\Program Files\Thunder\ComDlls\xunleiBHO_Now.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAudPropShortcut.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [EPM-DM] c:\acer\epm\epm-dm.exe
O4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe boot
O4 - HKLM\..\Run: [LManager] C:\Program Files\Launch Manager\QtZgAcer.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\RunOnce: [iolo 3rd Party Reboot] C:\Documents and Settings\All Users\Application Data\iolo\IRestartStub.exe /t "System Mechanic Professional" /i "C:\Application\System Performance\System.Mechanic.7.1.11.Professional\System Mechanic 7.1.11 Professional\SystemMechanic7Pro.exe" /v "iolo 3rd Party Reboot" /av "Norton Antivirus" /fw "Norton Firewall"
O4 - Startup: hamachi.lnk = C:\Program Files\Hamachi\hamachi.exe
O4 - Startup: Anapod Manager.lnk = C:\Program Files\Red Chair Software\Anapod Explorer\anamgr.exe
O4 - Global Startup: BTTray.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: ʹÓÃѸÀ×ÏÂÔØ - C:\Program Files\Thunder\Program\geturl.htm
O8 - Extra context menu item: ʹÓÃѸÀ×ÏÂÔØÈ«²¿Á´½Ó - C:\Program Files\Thunder\Program\getallurl.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02ECD07A-22D0-4AF0-BA0A-3F6B06086D08} (GamesCampus Control) - http://fishingchamp.gamescampus.com/luncher/GamesCampus.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games.com.my/com/EGamesPlugin.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1188267419437
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

–
End of file - 9528 bytes