Security Toolbar 7.1, Blinking Icon, Numerous Viruses

Hi guys,
I've looked everywhere for help and this place seems like the best bet.
I have a blinking icon on my taskbar that keeps asking me to download antivirus programs, which, i obviously object to. I Also receive the occasional pop-up, and without my numerous antivirus programs, i believe i would have a lot more.

I have tried:
SUPERAntiSpyware - It works and gets rid of the virus, but wont let me start my machine up. I'm guessing this is because important files are infected?
SmitFraudFix - I Use it during safe mode, and it works temporarily, then after 5 minutes or so, it comes back.
PrevX - It detected the same file that most of my antivirus programs detected. - gebcc.dll which is located in C:\Windows\system32 folder.

This is my HJT Log.

Logfile of HijackThis v1.99.1
Scan saved at 10:40:15 PM, on 15/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\IPSSVC.EXE
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\WINDOWS\System32\TPHDEXLG.EXE
C:\Program Files\IBM ThinkVantage\Rescue and Recovery\rrservice.exe
C:\Program Files\IBM ThinkVantage\Common\Scheduler\tvtsched.exe
C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
C:\Program Files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\TpShocks.exe
C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\PROGRA~1\THINKV~1\PrdCtr\LPMGR.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\IBM ThinkVantage\Client Security Solution\cssauth.exe
C:\Program Files\IBM ThinkVantage\SafeGuard PrivateDisk\pdservice.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe
C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~2\VPTray.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\ThinkVantage\SystemUpdate\PipeServer.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://balwynhs.vic.edu.au/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.balwynhs.vic.edu.au:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.balwynhs.vic.edu.au;172.*;*.education.vic.gov.au;*.sofweb.vic.edu.au;*.vass.vi
.edu.au;*.eduweb.vic.gov.au;*.edudev.vic.gov.au;*.edumail.vic.gov.au;*.otte.vic.
ov.au;*.icon.edu.vic.gov.au;*.ultranet.vic.edu.au;*.vcaa.vic.edu.au;
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Security Toolbar - {11A69AE4-FBED-4832-A2BF-45AF82825583} - C:\WINDOWS\system32\psrdswkp.dll
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [TPKMAPHELPER] C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper
O4 - HKLM\..\Run: [TpShocks] TpShocks.exe
O4 - HKLM\..\Run: [TP4EX] tp4ex.exe
O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [suScheduler] C:\Program Files\ThinkVantage\SystemUpdate\UCLauncher.exe /SCHEDULER
O4 - HKLM\..\Run: [LPManager] C:\PROGRA~1\THINKV~1\PrdCtr\LPMGR.exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [ISUSPM Startup] c:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "c:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [cssauth] "C:\Program Files\IBM ThinkVantage\Client Security Solution\cssauth.exe" silent
O4 - HKLM\..\Run: [PDService.exe] "C:\Program Files\IBM ThinkVantage\SafeGuard PrivateDisk\pdservice.exe"
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [ACTray] C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe
O4 - HKLM\..\Run: [ACWLIcon] C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe
O4 - HKLM\..\Run: [PWRMGRTR] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL,PwrMgrBkGndMonitor
O4 - HKLM\..\Run: [BLOG] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL,StartBattLog
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~2\VPTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [NI.UGA6P_0001_N122M2210] "C:\DOCUME~1\lin0056\LOCALS~1\Temp\qrjatydi.exe"
O4 - HKLM\..\Run: [acfdb785] rundll32.exe "C:\WINDOWS\system32\fbofvtbl.dll",b
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Software Installer - {D1A4DEBD-C2EE-449f-B9FB-E8409F9A0BC5} - C:\Program Files\Lenovo\PkgMgr\\PkgMgr.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O11 - Options group: [JAVA_IBM] Java (IBM)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1185221205500
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = balwynhs.vic.edu.au
O17 - HKLM\Software\..\Telephony: DomainName = balwynhs.vic.edu.au
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll
O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll
O20 - AppInit_DLLs: C:\WINDOWS\system32\__c00EFFF5.dat
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ac Profile Manager Service (AcPrfMgrSvc) - Unknown owner - C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe (file missing)
O23 - Service: Access Connections Main Service (AcSvc) - Lenovo - C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\eicdpwnq.exe (file missing)
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: ThinkPad PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\system32\ibmpmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: IPS Core Service (IPSSVC) - Lenovo Group Limited - C:\WINDOWS\system32\IPSSVC.EXE
O23 - Service: IBM PSA Access Driver Control (PsaSrv) - Unknown owner - C:\WINDOWS\system32\PsaSrv.exe (file missing)
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: ThinkPad HDD APS Logging Service (TPHDEXLGSVC) - Lenovo. - C:\WINDOWS\System32\TPHDEXLG.EXE
O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe (file missing)
O23 - Service: TSS Core Service (TSSCoreService) - IBM - C:\Program Files\IBM ThinkVantage\Client Security Solution\ibmtcsd.exe
O23 - Service: TVT Backup Service - Unknown owner - C:\Program Files\IBM ThinkVantage\Rescue and Recovery\rrservice.exe
O23 - Service: TVT Scheduler - Unknown owner - C:\Program Files\IBM ThinkVantage\Common\Scheduler\tvtsched.exe
O23 - Service: ThinkVantage System Update (UCLauncherService) - Unknown owner - C:\Program Files\ThinkVantage\SystemUpdate\UCLauncherService.exe (file missing)

ComboFix 07-11-08.1 - LIN0056 2007-11-16 20:17:11.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.70 [GMT 11:00]Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point
.

Unable to gain System Privileges

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Start Menu\Live Safety Center.lnk
C:\Documents and Settings\All Users\Start Menu\Online Security Guide.lnk
C:\Documents and Settings\lin0056\Desktop\Live Safety Center.lnk
C:\Documents and Settings\lin0056\Desktop\Online Security Guide.lnk
C:\Documents and Settings\lin0056\Favorites\Online Security Guide.lnk
C:\WINDOWS\cookies.ini
C:\WINDOWS\system32\blvltmjy.dll
C:\WINDOWS\system32\bqmqbwwe.dll
C:\WINDOWS\system32\ccbeg.bak1
C:\WINDOWS\system32\ccbeg.bak2
C:\WINDOWS\system32\ccbeg.ini
C:\WINDOWS\system32\ccbeg.ini2
C:\WINDOWS\system32\ccbeg.tmp
C:\WINDOWS\system32\ckbvkmvu.dll
C:\WINDOWS\system32\fqpdidqb.dll
C:\WINDOWS\system32\gamytlnv.dll
C:\WINDOWS\system32\gebcc.dll
C:\WINDOWS\system32\gxpftlfs.dll
C:\WINDOWS\system32\hgsijeay.dll
C:\WINDOWS\system32\hvieklcl.dll
C:\WINDOWS\system32\itoxavya.dll
C:\WINDOWS\system32\jlmyblvf.dll
C:\WINDOWS\system32\psrdswkp.dllbox
C:\WINDOWS\system32\ynmbuudi.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
——-\LEGACY_DOMAINSERVICE
——-\DomainService


((((((((((((((((((((((((( Files Created from 2007-10-16 to 2007-11-16 )))))))))))))))))))))))))))))))
.

2007-11-16 20:12 51,200 –a–c— C:\WINDOWS\NirCmd.exe
2007-11-16 19:52 d—-c— C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-11-16 18:46 85,056 –a–c— C:\WINDOWS\system32\tmrtbsew.dll
2007-11-16 18:43 81,984 –a–c— C:\WINDOWS\system32\afpljkqi.dll
2007-11-16 18:37 71,232 –a–c— C:\WINDOWS\system32\emrxtgra.exe
2007-11-16 18:08 71,232 –a–c— C:\WINDOWS\system32\qsuwkdqf.exe
2007-11-16 17:49 81,984 –a–c— C:\WINDOWS\system32\yotrjgoj.dll
2007-11-16 17:43 71,232 –a–c— C:\WINDOWS\system32\vpayuxki.exe
2007-11-16 15:05 79,936 –a–c— C:\WINDOWS\system32\eoltomnq.dll
2007-11-16 14:56 71,232 –a–c— C:\WINDOWS\system32\pnvbdxeh.exe
2007-11-16 13:50 d—-c— C:\Documents and Settings\lin0056\Application Data\Grisoft
2007-11-15 23:11 d—-c— C:\Documents and Settings\All Users\Application Data\Grisoft
2007-11-15 23:11 10,872 –a–c— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-11-15 22:25 d—-c— C:\WINDOWS\Sun
2007-11-15 21:50 79,936 –a–c— C:\WINDOWS\system32\mfntceyh.dll
2007-11-15 21:41 7,076 –a–c— C:\WINDOWS\system32\sktcrtba.dll
2007-11-15 21:38 71,232 –a–c— C:\WINDOWS\system32\kiasxola.exe
2007-11-15 20:01 289,144 –a–c— C:\WINDOWS\system32\VCCLSID.exe
2007-11-15 20:01 288,417 –a–c— C:\WINDOWS\system32\SrchSTS.exe
2007-11-15 20:01 53,248 –a–c— C:\WINDOWS\system32\Process.exe
2007-11-15 20:01 51,200 –a–c— C:\WINDOWS\system32\dumphive.exe
2007-11-15 20:01 25,600 –a–c— C:\WINDOWS\system32\WS2Fix.exe
2007-11-15 19:33 79,936 –a–c— C:\WINDOWS\system32\kevdwiwv.dll
2007-11-15 19:26 71,232 –a–c— C:\WINDOWS\system32\lwgjsbnc.exe
2007-11-15 17:44 79,936 –a–c— C:\WINDOWS\system32\llbvaiuu.dll
2007-11-15 17:38 85,056 –a–c— C:\WINDOWS\system32\erthdarm.dll
2007-11-15 17:35 71,232 –a–c— C:\WINDOWS\system32\ihrudddn.exe
2007-11-15 16:41 79,936 –a–c— C:\WINDOWS\system32\ubmhmmiy.dll
2007-11-15 14:18 79,424 –a–c— C:\WINDOWS\system32\olprpygl.dll
2007-11-15 14:14 71,232 –a–c— C:\WINDOWS\system32\cpjitabn.exe
2007-11-15 11:22 d—-c— C:\Program Files\NJStar Chinese WP
2007-11-15 11:22 d—-c— C:\Documents and Settings\lin0056\Application Data\NJStar
2007-11-15 11:11 79,424 –a–c— C:\WINDOWS\system32\olffixyw.dll
2007-11-15 11:08 71,232 –a–c— C:\WINDOWS\system32\jpewuuny.exe
2007-11-15 10:32 79,424 –a–c— C:\WINDOWS\system32\xtcqatem.dll
2007-11-14 19:50 20,480 –a–c— C:\WINDOWS\system32\H@tKeysH@@k.DLL
2007-11-14 16:42 81,472 –a–c— C:\WINDOWS\system32\nwixdqhj.dll
2007-11-14 16:36 71,232 –a–c— C:\WINDOWS\system32\mtkjpdrw.exe
2007-11-14 16:20 81,472 –a–c— C:\WINDOWS\system32\hvnptjtv.dll
2007-11-14 10:32 85,056 –a–c— C:\WINDOWS\system32\xuvlkqpj.dll
2007-11-14 10:29 71,232 –a–c— C:\WINDOWS\system32\samtevlo.exe
2007-11-13 21:54 d—-c— C:\temp\Tmp___30808
2007-11-13 21:52 d—-c— C:\temp\Tmp___30328
2007-11-13 21:48 d—-c— C:\temp\Tmp___29584
2007-11-13 21:46 d—-c— C:\temp\Tmp___29189
2007-11-13 21:45 d—-c— C:\temp\Tmp___28980
2007-11-13 21:44 d—-c— C:\temp\Tmp___28879
2007-11-13 21:31 80,448 –a–c— C:\WINDOWS\system32\wlenjfca.dll
2007-11-13 21:26 71,232 –a–c— C:\WINDOWS\system32\kmmhkrdi.exe
2007-11-13 21:15 80,448 –a–c— C:\WINDOWS\system32\beulhmop.dll
2007-11-13 21:12 88,128 –a–c— C:\WINDOWS\system32\jkajxbqk.dll
2007-11-13 21:04 71,232 –a–c— C:\WINDOWS\system32\gywllfdb.exe
2007-11-13 20:57 80,448 –a–c— C:\WINDOWS\system32\peyygprm.dll
2007-11-13 20:52 71,232 –a–c— C:\WINDOWS\system32\dkobkxgy.exe
2007-11-13 20:49 5,616 –a–c— C:\WINDOWS\system32\iaydefdl.dll
2007-11-13 20:33 80,448 –a–c— C:\WINDOWS\system32\wnbabcxn.dll
2007-11-13 20:29 88,128 –a–c— C:\WINDOWS\system32\rruuucag.dll
2007-11-13 20:24 71,232 –a–c— C:\WINDOWS\system32\hujevyak.exe
2007-11-13 20:14 71,232 –a–c— C:\WINDOWS\system32\sqarphbc.exe
2007-11-13 20:08 80,448 –a–c— C:\WINDOWS\system32\sratotyk.dll
2007-11-13 20:07 0 –a–c— C:\WINDOWS\system32\dliuwief.dll
2007-11-13 20:06 664 –a–c— C:\WINDOWS\system32\d3d9caps.dat
2007-11-13 20:05 71,232 –a–c— C:\WINDOWS\system32\koehucfc.exe
2007-11-13 19:28 71,232 –a–c— C:\WINDOWS\system32\adahwgxo.exe
2007-11-13 19:21 71,232 –a–c— C:\WINDOWS\system32\gotuqmuw.exe
2007-11-13 19:11 80,448 –a–c— C:\WINDOWS\system32\bquyovlc.dll
2007-11-13 19:11 4,156 –a–c— C:\WINDOWS\system32\vsuomipf.dll
2007-11-13 19:09 71,232 –a–c— C:\WINDOWS\system32\uhcsojlo.exe
2007-11-13 19:06 5,470 –a–c— C:\WINDOWS\system32\tmp.reg
2007-11-13 18:47 d—-c— C:\Documents and Settings\All Users\Application Data\Prevx
2007-11-13 18:36 80,448 –a–c— C:\WINDOWS\system32\rlhpenks.dll
2007-11-13 18:33 88,128 –a–c— C:\WINDOWS\system32\rdaqkigu.dll
2007-11-13 18:29 71,232 –a–c— C:\WINDOWS\system32\ufapsahm.exe
2007-11-13 17:12 80,448 –a–c— C:\WINDOWS\system32\euovygjx.dll
2007-11-13 17:09 71,232 –a–c— C:\WINDOWS\system32\hiwshbgc.exe
2007-11-13 07:51 d—-c— C:\Program Files\SUPERAntiSpyware
2007-11-13 07:51 d—-c— C:\Documents and Settings\lin0056\Application Data\SUPERAntiSpyware.com
2007-11-13 07:51 d—-c— C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2007-11-13 07:50 d—-c— C:\Program Files\Common Files\Wise Installation Wizard
2007-11-12 16:45 144,320 –a–c— C:\WINDOWS\system32\psrdswkp.dll
2007-11-12 16:45 144,320 –a–c— C:\WINDOWS\system32\cosetjjg.dll
2007-11-11 20:26 d—-c— C:\WINDOWS\system32\xlive
2007-11-11 20:26 3,495,784 –a–c— C:\WINDOWS\system32\d3dx9_33.dll
2007-11-11 20:26 1,123,696 –a–c— C:\WINDOWS\system32\D3DCompiler_33.dll
2007-11-11 20:26 81,768 –a–c— C:\WINDOWS\system32\xinput1_3.dll
2007-11-11 20:05 519,912 –a–c— C:\WINDOWS\system32\d3dx10d_33.dll
2007-11-11 20:05 519,912 –a–c— C:\WINDOWS\system32\d3dx10d.dll
2007-11-11 20:05 519,912 –a–c— C:\WINDOWS\system32\d3dx10_33.dll
2007-11-11 19:57 566,624 –a–c— C:\WINDOWS\system32\d3d10.dll
2007-11-11 19:57 519,912 –a–c— C:\WINDOWS\system32\d3dx10.dll
2007-11-11 19:57 494,557 –a–c— C:\WINDOWS\system32\dxgi.dll
2007-11-11 19:57 25,037 –a–c— C:\WINDOWS\system32\Nucleus.dll
2007-11-11 18:56 d—-c— C:\Program Files\Microsoft Games
2007-11-11 18:49 d—-c— C:\Documents and Settings\lin0056\Application Data\Microsoft Game Studios
2007-11-11 14:42 32,768 –a–c— C:\WINDOWS\system32\mf.dll
2007-11-11 14:24 d—-c— C:\Documents and Settings\lin0056\My Games
2007-11-11 14:24 d—-c— C:\Documents and Settings\All Users\Microsoft
2007-11-10 13:47 d—-c— C:\WINDOWS\Emoticon Live Patch Uninstall
2007-11-09 23:09 98,304 –a—— C:\WINDOWS\system32\CmdLineExt.dll
2007-11-09 22:59 d—-c— C:\Program Files\Sierra

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-16 09:37 ——— dc—-w C:\Program Files\Symantec AntiVirus
2007-11-10 22:23 5,427 -c–a-w C:\WINDOWS\system32\EGATHDRV.SYS
2007-11-09 11:58 ——— dc-h–w C:\Program Files\InstallShield Installation Information
2007-11-08 01:18 ——— dc—-w C:\Program Files\Windows Media Connect
2007-11-08 01:13 ——— dc—-w C:\Program Files\Microsoft Works
2007-11-07 05:31 ——— dc—-w C:\Program Files\Google
2007-11-07 05:09 ——— dc—-w C:\Program Files\Picasa2
2007-10-21 16:39 267,272 -c–a-w C:\WINDOWS\system32\xactengine2_10.dll
2007-10-21 16:37 17,928 -c–a-w C:\WINDOWS\system32\X3DAudio1_2.dll
2007-10-12 12:19 13,653,824 -c–a-w C:\WINDOWS\system32\xlivefnt.dll
2007-10-12 12:19 10,155,840 -c–a-w C:\WINDOWS\system32\xlive.dll
2007-10-12 04:14 3,734,536 -c–a-w C:\WINDOWS\system32\d3dx9_36.dll
2007-10-12 04:14 1,374,232 -c–a-w C:\WINDOWS\system32\D3DCompiler_36.dll
2007-10-01 22:56 444,776 -c–a-w C:\WINDOWS\system32\d3dx10_36.dll
2007-08-21 06:15 683,520 -c–a-w C:\WINDOWS\system32\inetcomm.dll
2007-07-23 21:37:19 32,768 -csha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0aec91cc-56fb-42ff-8bd4-632dfd696cd9}]
2007-11-16 18:43 81984 –a–c— C:\WINDOWS\system32\afpljkqi.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{140BD8E3-C167-11D4-B4A3-080000180323}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A95B2816-1D7E-4561-A202-68C0DE02353A}]
2007-11-12 16:45 144320 –a–c— C:\WINDOWS\system32\psrdswkp.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{11A69AE4-FBED-4832-A2BF-45AF82825583}"= C:\WINDOWS\system32\psrdswkp.dll [2007-11-12 16:45 144320]

[HKEY_CLASSES_ROOT\CLSID\{11A69AE4-FBED-4832-A2BF-45AF82825583}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2005-09-16 07:57]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-09-16 07:57]
"TPKMAPHELPER"="C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe" [2005-10-29 13:04]
"TpShocks"="TpShocks.exe" [2005-11-08 05:14 C:\WINDOWS\system32\TpShocks.exe]
"TP4EX"="tp4ex.exe" [2005-10-17 19:11 C:\WINDOWS\system32\TP4EX.exe]
"EZEJMNAP"="C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe" [2005-11-17 20:22]
"TPHOTKEY"="C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe" []
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2005-12-16 08:19]
"SoundMAX"="C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" [2005-05-07 08:06]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2005-08-13 08:43]
"suScheduler"="C:\Program Files\ThinkVantage\SystemUpdate\UCLauncher.exe" [2005-08-02 11:32]
"LPManager"="C:\PROGRA~1\THINKV~1\PrdCtr\LPMGR.exe" [2006-01-25 19:03]
"DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2005-08-01 23:10]
"ISUSPM Startup"="c:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-28 10:50]
"ISUSScheduler"="c:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-28 10:50]
"cssauth"="C:\Program Files\IBM ThinkVantage\Client Security Solution\cssauth.exe" [2005-12-22 12:08]
"PDService.exe"="C:\Program Files\IBM ThinkVantage\SafeGuard PrivateDisk\pdservice.exe" [2005-11-16 07:13]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2005-10-29 05:08]
"DiskeeperSystray"="C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe" [2005-11-30 04:55]
"ACTray"="C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe" [2006-04-18 07:09]
"ACWLIcon"="C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe" [2006-04-18 06:59]
"PWRMGRTR"="C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL" [2005-12-07 19:12]
"BLOG"="C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL" [2005-12-07 19:12]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-09-02 09:57]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-04 12:20]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2005-04-09 09:52]
"vptray"="C:\PROGRA~1\SYMANT~2\VPTray.exe" [2005-04-18 06:30]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 20:25]
"acfdb785"="C:\WINDOWS\system32\tmrtbsew.dll" [2007-11-16 18:46]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 23:00]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-11-09 17:36]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-14 03:24]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2005-05-31 01:04]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [2007-07-24 08:18:49]
Adobe Reader Synchronizer.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2007-07-24 08:18:47]
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2006-08-18 18:50:44]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"disablecad"=0 (0x0)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ACNotify]
ACNotify.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psrdswkp]
psrdswkp.dll 2007-11-12 16:45 144320 C:\WINDOWS\system32\psrdswkp.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpfnf2]
notifyf2.dll 2005-07-06 17:45 28672 C:\WINDOWS\system32\notifyf2.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey]
tphklock.dll 2005-12-01 14:16 24576 C:\WINDOWS\system32\tphklock.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\system32\gebcc.dll
"Notification Packages"= scecli csspwntfy

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1292428093-1757981266-682003330-35769\Scripts\Logon\0\0]
"Script"=stdlogon.vbs


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e047ed2c-8cee-11dc-ad54-0019d2456ac3}]
\Shell\1\Command - .\readme.txt.exe
\Shell\2\Command - .\readme.txt.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL .\readme.txt.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e047ed2d-8cee-11dc-ad54-0019d2456ac3}]
\Shell\1\Command - .\readme.txt.exe
\Shell\2\Command - .\readme.txt.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL .\readme.txt.exe

.
Contents of the 'Scheduled Tasks' folder
"2007-11-10 01:06:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2007-11-16 09:37:06 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
"2007-11-16 09:40:01 C:\WINDOWS\Tasks\PMTask.job"
.
**************************************************************************

catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-16 20:37:49
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-16 20:43:20 - machine was rebooted
.
— E O F —







Logfile of HijackThis v1.99.1
Scan saved at 20:47, on 2007-11-16
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\IPSSVC.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\System32\TPHDEXLG.EXE
C:\Program Files\IBM ThinkVantage\Rescue and Recovery\rrservice.exe
C:\Program Files\IBM ThinkVantage\Common\Scheduler\tvtsched.exe
C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
C:\Program Files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\TpShocks.exe
C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\PROGRA~1\THINKV~1\PrdCtr\LPMGR.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\IBM ThinkVantage\Client Security Solution\cssauth.exe
C:\Program Files\IBM ThinkVantage\SafeGuard PrivateDisk\pdservice.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\PROGRA~1\SYMANT~2\VPTray.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Symantec AntiVirus\DoScan.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://balwynhs.vic.edu.au/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.balwynhs.vic.edu.au:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.balwynhs.vic.edu.au;172.*;*.education.vic.gov.au;*.sofweb.vic.edu.au;*.vass.vi
.edu.au;*.eduweb.vic.gov.au;*.edudev.vic.gov.au;*.edumail.vic.gov.au;*.otte.vic.
ov.au;*.icon.edu.vic.gov.au;*.ultranet.vic.edu.au;*.vcaa.vic.edu.au;
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: {9dc696df-d236-4db8-ff24-bf65cc19cea0} - {0aec91cc-56fb-42ff-8bd4-632dfd696cd9} - C:\WINDOWS\system32\afpljkqi.dll
O2 - BHO: (no name) - {140BD8E3-C167-11D4-B4A3-080000180323} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {A95B2816-1D7E-4561-A202-68C0DE02353A} - C:\WINDOWS\system32\psrdswkp.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Security Toolbar - {11A69AE4-FBED-4832-A2BF-45AF82825583} - C:\WINDOWS\system32\psrdswkp.dll
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [TPKMAPHELPER] C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper
O4 - HKLM\..\Run: [TpShocks] TpShocks.exe
O4 - HKLM\..\Run: [TP4EX] tp4ex.exe
O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [suScheduler] C:\Program Files\ThinkVantage\SystemUpdate\UCLauncher.exe /SCHEDULER
O4 - HKLM\..\Run: [LPManager] C:\PROGRA~1\THINKV~1\PrdCtr\LPMGR.exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [ISUSPM Startup] c:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "c:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [cssauth] "C:\Program Files\IBM ThinkVantage\Client Security Solution\cssauth.exe" silent
O4 - HKLM\..\Run: [PDService.exe] "C:\Program Files\IBM ThinkVantage\SafeGuard PrivateDisk\pdservice.exe"
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [ACTray] C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe
O4 - HKLM\..\Run: [ACWLIcon] C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe
O4 - HKLM\..\Run: [PWRMGRTR] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL,PwrMgrBkGndMonitor
O4 - HKLM\..\Run: [BLOG] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL,StartBattLog
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~2\VPTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [acfdb785] rundll32.exe "C:\WINDOWS\system32\tmrtbsew.dll",b
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Software Installer - {D1A4DEBD-C2EE-449f-B9FB-E8409F9A0BC5} - C:\Program Files\Lenovo\PkgMgr\\PkgMgr.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O11 - Options group: [JAVA_IBM] Java (IBM)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1185221205500
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = balwynhs.vic.edu.au
O17 - HKLM\Software\..\Telephony: DomainName = balwynhs.vic.edu.au
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = balwynhs.vic.edu.au
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = balwynhs.vic.edu.au
O17 - HKLM\System\CS4\Services\Tcpip\Parameters: Domain = balwynhs.vic.edu.au
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll
O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: ACNotify - ACNotify.dll (file missing)
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: psrdswkp - C:\WINDOWS\SYSTEM32\psrdswkp.dll
O20 - Winlogon Notify: tpfnf2 - C:\WINDOWS\SYSTEM32\notifyf2.dll
O20 - Winlogon Notify: tphotkey - C:\WINDOWS\SYSTEM32\tphklock.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ac Profile Manager Service (AcPrfMgrSvc) - Unknown owner - C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe (file missing)
O23 - Service: Access Connections Main Service (AcSvc) - Lenovo - C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: ThinkPad PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\system32\ibmpmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: IPS Core Service (IPSSVC) - Lenovo Group Limited - C:\WINDOWS\system32\IPSSVC.EXE
O23 - Service: IBM PSA Access Driver Control (PsaSrv) - Unknown owner - C:\WINDOWS\system32\PsaSrv.exe (file missing)
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: ThinkPad HDD APS Logging Service (TPHDEXLGSVC) - Lenovo. - C:\WINDOWS\System32\TPHDEXLG.EXE
O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe (file missing)
O23 - Service: TSS Core Service (TSSCoreService) - IBM - C:\Program Files\IBM ThinkVantage\Client Security Solution\ibmtcsd.exe
O23 - Service: TVT Backup Service - Unknown owner - C:\Program Files\IBM ThinkVantage\Rescue and Recovery\rrservice.exe
O23 - Service: TVT Scheduler - Unknown owner - C:\Program Files\IBM ThinkVantage\Common\Scheduler\tvtsched.exe
O23 - Service: ThinkVantage System Update (UCLauncherService) - Unknown owner - C:\Program Files\ThinkVantage\SystemUpdate\UCLauncherService.exe (file missing)

thanks

Hi SNOWHITE, thanks for your help. so far my system hasnt been getting these popups or anything since i rebooted through combofix. here are my logs u requested

ComboFix 07-11-08.1 - LIN0056 2007-11-18 8:43:32.3 - NTFSx86
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\lin0056\Desktop\CFScript.txt
* Created a new restore point

FILE
C:\WINDOWS\system32\adahwgxo.exe
C:\WINDOWS\system32\beulhmop.dll
C:\WINDOWS\system32\bquyovlc.dll
C:\WINDOWS\system32\cosetjjg.dll
C:\WINDOWS\system32\cpjitabn.exe
C:\WINDOWS\system32\dkobkxgy.exe
C:\WINDOWS\system32\dliuwief.dll
C:\WINDOWS\system32\emrxtgra.exe
C:\WINDOWS\system32\erthdarm.dll
C:\WINDOWS\system32\euovygjx.dll
C:\WINDOWS\system32\gotuqmuw.exe
C:\WINDOWS\system32\gywllfdb.exe
C:\WINDOWS\system32\hiwshbgc.exe
C:\WINDOWS\system32\hujevyak.exe
C:\WINDOWS\system32\iaydefdl.dll
C:\WINDOWS\system32\ihrudddn.exe
C:\WINDOWS\system32\jkajxbqk.dll
C:\WINDOWS\system32\jpewuuny.exe
C:\WINDOWS\system32\kevdwiwv.dll
C:\WINDOWS\system32\kiasxola.exe
C:\WINDOWS\system32\kmmhkrdi.exe
C:\WINDOWS\system32\koehucfc.exe
C:\WINDOWS\system32\llbvaiuu.dll
C:\WINDOWS\system32\lwgjsbnc.exe
C:\WINDOWS\system32\mfntceyh.dll
C:\WINDOWS\system32\mtkjpdrw.exe
C:\WINDOWS\system32\nwixdqhj.dll
C:\WINDOWS\system32\olffixyw.dll
C:\WINDOWS\system32\olprpygl.dll
C:\WINDOWS\system32\peyygprm.dll
C:\WINDOWS\system32\pnvbdxeh.exe
C:\WINDOWS\system32\qsuwkdqf.exe
C:\WINDOWS\system32\rlhpenks.dll
C:\WINDOWS\system32\rruuucag.dll
C:\WINDOWS\system32\samtevlo.exe
C:\WINDOWS\system32\ubmhmmiy.dll
C:\WINDOWS\system32\ufapsahm.exe
C:\WINDOWS\system32\uhcsojlo.exe
C:\WINDOWS\system32\vpayuxki.exe
C:\WINDOWS\system32\vsuomipf.dll
C:\WINDOWS\system32\wlenjfca.dll
C:\WINDOWS\system32\wnbabcxn.dll
C:\WINDOWS\system32\xuvlkqpj.dll
C:\WINDOWS\system32\yotrjgoj.dll
.

Unable to gain System Privileges

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Start Menu\Live Safety Center.lnk
C:\Documents and Settings\All Users\Start Menu\Online Security Guide.lnk
C:\Documents and Settings\lin0056\Desktop\Live Safety Center.lnk
C:\Documents and Settings\lin0056\Desktop\Online Security Guide.lnk
C:\Documents and Settings\lin0056\Favorites\Online Security Guide.lnk
C:\WINDOWS\system32\adahwgxo.exe
C:\WINDOWS\system32\afpljkqi.dll
C:\WINDOWS\system32\beulhmop.dll
C:\WINDOWS\system32\bquyovlc.dll
C:\WINDOWS\system32\cosetjjg.dll
C:\WINDOWS\system32\cpjitabn.exe
C:\WINDOWS\system32\dkobkxgy.exe
C:\WINDOWS\system32\dliuwief.dll
C:\WINDOWS\system32\emrxtgra.exe
C:\WINDOWS\system32\eoltomnq.dll
C:\WINDOWS\system32\erthdarm.dll
C:\WINDOWS\system32\euovygjx.dll
C:\WINDOWS\system32\gotuqmuw.exe
C:\WINDOWS\system32\gywllfdb.exe
C:\WINDOWS\system32\hiwshbgc.exe
C:\WINDOWS\system32\hujevyak.exe
C:\WINDOWS\system32\hvnptjtv.dll
C:\WINDOWS\system32\iaydefdl.dll
C:\WINDOWS\system32\ihrudddn.exe
C:\WINDOWS\system32\jkajxbqk.dll
C:\WINDOWS\system32\jpewuuny.exe
C:\WINDOWS\system32\kevdwiwv.dll
C:\WINDOWS\system32\kiasxola.exe
C:\WINDOWS\system32\kmmhkrdi.exe
C:\WINDOWS\system32\koehucfc.exe
C:\WINDOWS\system32\llbvaiuu.dll
C:\WINDOWS\system32\lwgjsbnc.exe
C:\WINDOWS\system32\mfntceyh.dll
C:\WINDOWS\system32\mtkjpdrw.exe
C:\WINDOWS\system32\nwixdqhj.dll
C:\WINDOWS\system32\olffixyw.dll
C:\WINDOWS\system32\olprpygl.dll
C:\WINDOWS\system32\peyygprm.dll
C:\WINDOWS\system32\pnvbdxeh.exe
C:\WINDOWS\system32\psrdswkp.dll
C:\WINDOWS\system32\psrdswkp.dllbox
C:\WINDOWS\system32\qsuwkdqf.exe
C:\WINDOWS\system32\rdaqkigu.dll
C:\WINDOWS\system32\rlhpenks.dll
C:\WINDOWS\system32\rruuucag.dll
C:\WINDOWS\system32\samtevlo.exe
C:\WINDOWS\system32\sktcrtba.dll
C:\WINDOWS\system32\sqarphbc.exe
C:\WINDOWS\system32\sratotyk.dll
C:\WINDOWS\system32\tmrtbsew.dll
C:\WINDOWS\system32\ubmhmmiy.dll
C:\WINDOWS\system32\ufapsahm.exe
C:\WINDOWS\system32\uhcsojlo.exe
C:\WINDOWS\system32\vpayuxki.exe
C:\WINDOWS\system32\vsuomipf.dll
C:\WINDOWS\system32\wlenjfca.dll
C:\WINDOWS\system32\wnbabcxn.dll
C:\WINDOWS\system32\xtcqatem.dll
C:\WINDOWS\system32\xuvlkqpj.dll
C:\WINDOWS\system32\yotrjgoj.dll

.
((((((((((((((((((((((((( Files Created from 2007-10-17 to 2007-11-17 )))))))))))))))))))))))))))))))
.

2007-11-16 20:12 51,200 –a–c— C:\WINDOWS\NirCmd.exe
2007-11-16 19:52 d—-c— C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-11-16 13:50 d—-c— C:\Documents and Settings\lin0056\Application Data\Grisoft
2007-11-15 23:11 d—-c— C:\Documents and Settings\All Users\Application Data\Grisoft
2007-11-15 23:11 10,872 –a–c— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-11-15 22:25 d—-c— C:\WINDOWS\Sun
2007-11-15 20:01 289,144 –a–c— C:\WINDOWS\system32\VCCLSID.exe
2007-11-15 20:01 288,417 –a–c— C:\WINDOWS\system32\SrchSTS.exe
2007-11-15 20:01 53,248 –a–c— C:\WINDOWS\system32\Process.exe
2007-11-15 20:01 51,200 –a–c— C:\WINDOWS\system32\dumphive.exe
2007-11-15 20:01 25,600 –a–c— C:\WINDOWS\system32\WS2Fix.exe
2007-11-15 11:22 d—-c— C:\Program Files\NJStar Chinese WP
2007-11-15 11:22 d—-c— C:\Documents and Settings\lin0056\Application Data\NJStar
2007-11-14 19:50 20,480 –a–c— C:\WINDOWS\system32\H@tKeysH@@k.DLL
2007-11-13 21:54 d—-c— C:\temp\Tmp___30808
2007-11-13 21:52 d—-c— C:\temp\Tmp___30328
2007-11-13 21:48 d—-c— C:\temp\Tmp___29584
2007-11-13 21:46 d—-c— C:\temp\Tmp___29189
2007-11-13 21:45 d—-c— C:\temp\Tmp___28980
2007-11-13 21:44 d—-c— C:\temp\Tmp___28879
2007-11-13 20:06 664 –a–c— C:\WINDOWS\system32\d3d9caps.dat
2007-11-13 19:06 5,470 –a–c— C:\WINDOWS\system32\tmp.reg
2007-11-13 18:47 d—-c— C:\Documents and Settings\All Users\Application Data\Prevx
2007-11-13 07:51 d—-c— C:\Program Files\SUPERAntiSpyware
2007-11-13 07:51 d—-c— C:\Documents and Settings\lin0056\Application Data\SUPERAntiSpyware.com
2007-11-13 07:51 d—-c— C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2007-11-13 07:50 d—-c— C:\Program Files\Common Files\Wise Installation Wizard
2007-11-11 20:26 d—-c— C:\WINDOWS\system32\xlive
2007-11-11 20:26 3,495,784 –a–c— C:\WINDOWS\system32\d3dx9_33.dll
2007-11-11 20:26 1,123,696 –a–c— C:\WINDOWS\system32\D3DCompiler_33.dll
2007-11-11 20:26 81,768 –a–c— C:\WINDOWS\system32\xinput1_3.dll
2007-11-11 20:05 519,912 –a–c— C:\WINDOWS\system32\d3dx10d_33.dll
2007-11-11 20:05 519,912 –a–c— C:\WINDOWS\system32\d3dx10d.dll
2007-11-11 20:05 519,912 –a–c— C:\WINDOWS\system32\d3dx10_33.dll
2007-11-11 19:57 566,624 –a–c— C:\WINDOWS\system32\d3d10.dll
2007-11-11 19:57 519,912 –a–c— C:\WINDOWS\system32\d3dx10.dll
2007-11-11 19:57 494,557 –a–c— C:\WINDOWS\system32\dxgi.dll
2007-11-11 19:57 25,037 –a–c— C:\WINDOWS\system32\Nucleus.dll
2007-11-11 18:56 d—-c— C:\Program Files\Microsoft Games
2007-11-11 18:49 d—-c— C:\Documents and Settings\lin0056\Application Data\Microsoft Game Studios
2007-11-11 14:42 32,768 –a–c— C:\WINDOWS\system32\mf.dll
2007-11-11 14:24 d—-c— C:\Documents and Settings\lin0056\My Games
2007-11-11 14:24 d—-c— C:\Documents and Settings\All Users\Microsoft
2007-11-10 13:47 d—-c— C:\WINDOWS\Emoticon Live Patch Uninstall
2007-11-09 23:09 98,304 –a—— C:\WINDOWS\system32\CmdLineExt.dll
2007-11-09 22:59 d—-c— C:\Program Files\Sierra
2007-11-09 18:13 0 –a–c— C:\WINDOWS\nsreg.dat
2007-11-09 09:21 d—-c— C:\Program Files\MSXML 6.0
2007-11-08 19:18 313 –a–c— C:\WINDOWS\NAME_HERE.bat
2007-11-08 12:27 d—-c— C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-11-08 12:22 d—-c— C:\Program Files\Windows Media Connect 2
2007-11-08 12:19 d—-c— C:\WINDOWS\system32\LogFiles
2007-11-08 12:19 d—-c— C:\WINDOWS\system32\drivers\UMDF
2007-11-08 10:01 1,033,216 ——— C:\WINDOWS\system32\dllcache\explorer.exe
2007-11-08 10:01 582,656 —–c— C:\WINDOWS\system32\dllcache\rpcrt4.dll
2007-11-08 10:01 549,376 —–c— C:\WINDOWS\system32\dllcache\oleaut32.dll
2007-11-08 10:00 63,488 —–c— C:\WINDOWS\system32\dllcache\icardie.dll
2007-11-07 23:30 d—-c— C:\Program Files\MSN Messenger
2007-11-07 22:04 d—-c— C:\Program Files\Rapidown
2007-11-07 20:50 d—-c— C:\Documents and Settings\lin0056\Application Data\Apple Computer
2007-11-07 20:02 d—-c— C:\Program Files\sXe Injected
2007-11-07 19:59 d—-c— C:\Program Files\Counter-Strike 1.6
2007-11-07 18:31 221,184 –a–c— C:\WINDOWS\system32\wmpns.dll
2007-11-07 18:22 d—-c— C:\Documents and Settings\NetworkService\Application Data\Xfire
2007-11-07 18:13 d—-c— C:\Documents and Settings\All Users\Application Data\Messenger Plus!
2007-11-07 18:09 d—-c— C:\Program Files\Paint.NET
2007-11-07 17:48 d—-c— C:\Program Files\MSBuild
2007-11-07 17:45 d—-c— C:\WINDOWS\system32\XPSViewer
2007-11-07 17:44 d—-c— C:\Program Files\Reference Assemblies
2007-11-07 17:43 14,048 –a–c— C:\WINDOWS\system32\spmsg2.dll
2007-11-07 17:38 d—sc— C:\Program Files\Xfire
2007-11-07 17:38 d—-c— C:\Documents and Settings\lin0056\Application Data\Xfire
2007-11-07 17:34 d—-c— C:\Program Files\uTorrent
2007-11-07 17:34 d—-c— C:\Documents and Settings\lin0056\Application Data\uTorrent
2007-11-07 17:32 d—-c— C:\Program Files\Steam
2007-11-07 17:29 d—-c— C:\Program Files\PowerISO
2007-11-07 17:24 d—-c— C:\Program Files\GIMP-2.0
2007-11-07 17:22 d—-c— C:\Documents and Settings\lin0056\Shared
2007-11-07 17:22 d—-c— C:\Documents and Settings\lin0056\Incomplete
2007-11-07 17:22 d—-c— C:\Documents and Settings\lin0056\Application Data\FrostWire
2007-11-07 17:21 d—-c— C:\Program Files\Java
2007-11-07 17:21 d—-c— C:\Program Files\Common Files\Java
2007-11-07 17:19 d—-c— C:\Program Files\Common Files\GTK
2007-11-07 17:18 d—-c— C:\Program Files\FrostWire
2007-11-07 17:09 d—-c— C:\Program Files\Messenger Plus! Live
2007-11-07 16:53 d—-c— C:\Documents and Settings\lin0056\Contacts
2007-11-07 16:51 d—-c— C:\Program Files\DoubleDesktop
2007-11-07 16:41 d–hsc— C:\Program Files\Common Files\WindowsLiveInstaller
2007-11-07 16:40 d—-c— C:\Program Files\Windows Live
2007-11-07 16:40 d—-c— C:\Documents and Settings\All Users\Application Data\WLInstaller
2007-11-07 16:22 d—-c— C:\Downloads
2007-11-07 16:04 12,160 –a–c— C:\WINDOWS\system32\drivers\mouhid.sys
2007-11-07 16:04 12,160 –a–c— C:\WINDOWS\system32\dllcache\mouhid.sys
2007-11-07 16:03 9,600 –a–c— C:\WINDOWS\system32\drivers\hidusb.sys
2007-11-07 16:03 9,600 –a–c— C:\WINDOWS\system32\dllcache\hidusb.sys
2007-11-07 14:04 d–hsc— C:\Documents and Settings\lin0056\UserData
2007-11-07 14:04 d—-c— C:\Documents and Settings\lin0056\Application Data\ThinkVantage
2007-11-07 14:04 d—-c— C:\Documents and Settings\lin0056\Application Data\Symantec
2007-11-07 14:04 d—-c— C:\Documents and Settings\lin0056\Application Data\Inspiration Software
2007-11-07 14:04 d—-c— C:\Documents and Settings\lin0056\Application Data\IBM

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-17 21:53 ——— dc—-w C:\Program Files\Symantec AntiVirus
2007-11-09 11:58 ——— dc-h–w C:\Program Files\InstallShield Installation Information
2007-11-08 01:18 ——— dc—-w C:\Program Files\Windows Media Connect
2007-11-08 01:13 ——— dc—-w C:\Program Files\Microsoft Works
2007-11-07 05:31 ——— dc—-w C:\Program Files\Google
2007-11-07 05:09 ——— dc—-w C:\Program Files\Picasa2
2007-07-23 21:37:19 32,768 -csha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

—- Directory of C:\WINDOWS\system32\xlive —-

2007-09-18 16:01 134144 –a–c— C:\WINDOWS\system32\xlive\sqmapi.dll


((((((((((((((((((((((((((((( snapshot@2007-11-16_20.38.52.82 )))))))))))))))))))))))))))))))))))))))))
.
- 2007-11-10 22:23:46 5,427 -c–a-w C:\WINDOWS\system32\EGATHDRV.SYS
+ 2007-11-17 13:00:02 5,427 -c–a-w C:\WINDOWS\system32\EGATHDRV.SYS
+ 2007-11-17 21:52:41 16,384 -c–atw C:\WINDOWS\Temp\Perflib_Perfdata_78c.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2005-09-16 07:57]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-09-16 07:57]
"TPKMAPHELPER"="C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe" [2005-10-29 13:04]
"TpShocks"="TpShocks.exe" [2005-11-08 05:14 C:\WINDOWS\system32\TpShocks.exe]
"TP4EX"="tp4ex.exe" [2005-10-17 19:11 C:\WINDOWS\system32\TP4EX.exe]
"EZEJMNAP"="C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe" [2005-11-17 20:22]
"TPHOTKEY"="C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe" []
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2005-12-16 08:19]
"SoundMAX"="C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" [2005-05-07 08:06]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2005-08-13 08:43]
"suScheduler"="C:\Program Files\ThinkVantage\SystemUpdate\UCLauncher.exe" [2005-08-02 11:32]
"LPManager"="C:\PROGRA~1\THINKV~1\PrdCtr\LPMGR.exe" [2006-01-25 19:03]
"DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2005-08-01 23:10]
"ISUSPM Startup"="c:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-28 10:50]
"ISUSScheduler"="c:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-28 10:50]
"cssauth"="C:\Program Files\IBM ThinkVantage\Client Security Solution\cssauth.exe" [2005-12-22 12:08]
"PDService.exe"="C:\Program Files\IBM ThinkVantage\SafeGuard PrivateDisk\pdservice.exe" [2005-11-16 07:13]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2005-10-29 05:08]
"DiskeeperSystray"="C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe" [2005-11-30 04:55]
"ACTray"="C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe" [2006-04-18 07:09]
"ACWLIcon"="C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe" [2006-04-18 06:59]
"PWRMGRTR"="C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL" [2005-12-07 19:12]
"BLOG"="C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL" [2005-12-07 19:12]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-09-02 09:57]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-04 12:20]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2005-04-09 09:52]
"vptray"="C:\PROGRA~1\SYMANT~2\VPTray.exe" [2005-04-18 06:30]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 20:25]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 23:00]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-11-09 17:36]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-14 03:24]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [2007-07-24 08:18:49]
Adobe Reader Synchronizer.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2007-07-24 08:18:47]
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2006-08-18 18:50:44]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"disablecad"=0 (0x0)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ACNotify]
ACNotify.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpfnf2]
notifyf2.dll 2005-07-06 17:45 28672 C:\WINDOWS\system32\notifyf2.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey]
tphklock.dll 2005-12-01 14:16 24576 C:\WINDOWS\system32\tphklock.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Notification Packages"= scecli csspwntfy

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1292428093-1757981266-682003330-35769\Scripts\Logon\0\0]
"Script"=stdlogon.vbs

R0 Shockprf;Shockprf;C:\WINDOWS\system32\drivers\Shockprf.sys
R1 ANC;ANC;C:\WINDOWS\system32\drivers\ANC.SYS
R1 IBMTPCHK;IBMTPCHK;\??\C:\WINDOWS\system32\Drivers\IBMBLDID.sys
R1 ShockMgr;ShockMgr;C:\WINDOWS\system32\drivers\ShockMgr.sys
R1 TPPWRIF;TPPWRIF;C:\WINDOWS\system32\drivers\Tppwrif.sys
R2 ibmfilter;ibmfilter;\??\C:\WINDOWS\system32\drivers\ibmfilter.sys
R2 PrivateDisk;PrivateDisk;\??\C:\Program Files\IBM ThinkVantage\SafeGuard PrivateDisk\PrivateDiskM.sys
R2 smi2;smi2;\??\C:\Program Files\SMI2\smi2.sys
R3 AEAudioService;AEAudio Service;C:\WINDOWS\system32\drivers\AEAudio.sys
R3 atmeltpm;atmeltpm;C:\WINDOWS\system32\DRIVERS\atmeltpm.sys

.
Contents of the 'Scheduled Tasks' folder
"2007-11-17 01:06:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2007-11-17 21:54:29 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
"2007-11-17 21:55:16 C:\WINDOWS\Tasks\PMTask.job"
.
**************************************************************************

catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-18 08:54:28
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

**************************************************************************
.
Completion time: 2007-11-18 8:58:42 - machine was rebooted
C:\ComboFix2.txt … 2007-11-16 21:55
C:\ComboFix3.txt … 2007-11-16 20:43
.
— E O F —



gram Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [suScheduler] C:\Program Files\ThinkVantage\SystemUpdate\UCLauncher.exe /SCHEDULER
O4 - HKLM\..\Run: [LPManager] C:\PROGRA~1\THINKV~1\PrdCtr\LPMGR.exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [ISUSPM Startup] c:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "c:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [cssauth] "C:\Program Files\IBM ThinkVantage\Client Security Solution\cssauth.exe" silent
O4 - HKLM\..\Run: [PDService.exe] "C:\Program Files\IBM ThinkVantage\SafeGuard PrivateDisk\pdservice.exe"
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [ACTray] C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe
O4 - HKLM\..\Run: [ACWLIcon] C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe
O4 - HKLM\..\Run: [PWRMGRTR] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL,PwrMgrBkGndMonitor
O4 - HKLM\..\Run: [BLOG] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL,StartBattLog
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~2\VPTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Software Installer - {D1A4DEBD-C2EE-449f-B9FB-E8409F9A0BC5} - C:\Program Files\Lenovo\PkgMgr\\PkgMgr.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O11 - Options group: [JAVA_IBM] Java (IBM)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1185221205500
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = balwynhs.vic.edu.au
O17 - HKLM\Software\..\Telephony: DomainName = balwynhs.vic.edu.au
O17 - HKLM\System\CCS\Services\Tcpip\..\{581BEF0D-C033-4CA8-92CB-85EEFEC95FE1}: NameServer = 61.9.133.193,61.9.134.49
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll
O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: ACNotify - ACNotify.dll (file missing)
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: tpfnf2 - C:\WINDOWS\SYSTEM32\notifyf2.dll
O20 - Winlogon Notify: tphotkey - C:\WINDOWS\SYSTEM32\tphklock.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ac Profile Manager Service (AcPrfMgrSvc) - Unknown owner - C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe (file missing)
O23 - Service: Access Connections Main Service (AcSvc) - Lenovo - C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: ThinkPad PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\system32\ibmpmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: IPS Core Service (IPSSVC) - Lenovo Group Limited - C:\WINDOWS\system32\IPSSVC.EXE
O23 - Service: IBM PSA Access Driver Control (PsaSrv) - Unknown owner - C:\WINDOWS\system32\PsaSrv.exe (file missing)
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: ThinkPad HDD APS Logging Service (TPHDEXLGSVC) - Lenovo. - C:\WINDOWS\System32\TPHDEXLG.EXE
O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe (file missing)
O23 - Service: TSS Core Service (TSSCoreService) - IBM - C:\Program Files\IBM ThinkVantage\Client Security Solution\ibmtcsd.exe
O23 - Service: TVT Backup Service - Unknown owner - C:\Program Files\IBM ThinkVantage\Rescue and Recovery\rrservice.exe
O23 - Service: TVT Scheduler - Unknown owner - C:\Program Files\IBM ThinkVantage\Common\Scheduler\tvtsched.exe
O23 - Service: ThinkVantage System Update (UCLauncherService) - Unknown owner - C:\Program Files\ThinkVantage\SystemUpdate\UCLauncherService.exe (file missing)

thanks

Here are my logs as you requested. kaspersky detected quite a lot of viruses.

——————————————————————————-
KASPERSKY ONLINE SCANNER REPORT
Sunday, November 18, 2007 12:18:38 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 18/11/2007
Kaspersky Anti-Virus database records: 461025
——————————————————————————-

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\

Scan Statistics:
Total number of scanned objects: 77555
Number of viruses found: 11
Number of infected objects: 93
Number of suspicious objects: 0
Duration of the scan process: 01:08:43

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Support\MPLog-07232007-142208.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine3E40000.VBN Infected: Trojan-Downloader.Win32.ConHook.hl skipped
C:\Documents and Settings\lin0056\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\lin0056\Local Settings\Application Data\ApplicationHistory\cli.exe.c88dbd71.ini.inuse Object is locked skipped
C:\Documents and Settings\lin0056\Local Settings\Application Data\Microsoft\Media Player\CurrentDatabase_360.wmdb Object is locked skipped
C:\Documents and Settings\lin0056\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\lin0056\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\lin0056\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{6A1A313E-F619-4BAF-8A77-3B0D6505A783} Object is locked skipped
C:\Documents and Settings\lin0056\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\lin0056\Local Settings\Temp\Perflib_Perfdata_1f8.dat Object is locked skipped
C:\Documents and Settings\lin0056\Local Settings\Temp\Perflib_Perfdata_dec.dat Object is locked skipped
C:\Documents and Settings\lin0056\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\lin0056\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\lin0056\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Downloads\AntiVirus Stuff\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Downloads\AntiVirus Stuff\SmitfraudFix\SmitfraudFix.zip/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Downloads\AntiVirus Stuff\SmitfraudFix\SmitfraudFix.zip ZIP: infected - 1 skipped
C:\Downloads\AntiVirus Stuff\SmitfraudFix.exe/data.rar/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Downloads\AntiVirus Stuff\SmitfraudFix.exe/data.rar Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Downloads\AntiVirus Stuff\SmitfraudFix.exe RarSFX: infected - 2 skipped
C:\Downloads\MSN Fun\NYU_msn_hack_with_rapidshare_premium_downloader\msn.hack\MSN Hack v2.1 All.exe Infected: HackTool.Win32.Blackmess.a skipped
C:\Downloads\MSN Fun\NYU_msn_hack_with_rapidshare_premium_downloader.rar/msn.hack/MSN Hack v2.1 All.exe Infected: HackTool.Win32.Blackmess.a skipped
C:\Downloads\MSN Fun\NYU_msn_hack_with_rapidshare_premium_downloader.rar RAR: infected - 1 skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBConfig.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBDebug.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBDetect.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBNotify.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBRefr.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetCfg.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetDev.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetLoc.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetUsr.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBStHash.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBStMSI.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBValid.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPPolicy.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPStart.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPStop.log Object is locked skipped
C:\Program Files\Microsoft Games\halo2xp_v0.3\INSTALL\cmdow.exe Infected: not-a-virus:RiskTool.Win32.HideWindows skipped
C:\Program Files\Rapidown\Download\halo2xp_v0.3.zip/halo2xp_v0.3/INSTALL/cmdow.exe Infected: not-a-virus:RiskTool.Win32.HideWindows skipped
C:\Program Files\Rapidown\Download\halo2xp_v0.3.zip ZIP: infected - 1 skipped
C:\Program Files\Symantec AntiVirus\SAVRT893NAV~.TMP Object is locked skipped
C:\Program Files\Symantec AntiVirus\SAVRT969NAV~.TMP Object is locked skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\adahwgxo.exe.vir Infected: Trojan.Win32.Obfuscated.kp skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\cosetjjg.dll.vir Infected: not-a-virus:AdWare.Win32.SecToolBar.k skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\cpjitabn.exe.vir Infected: Trojan.Win32.Obfuscated.kp skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\dkobkxgy.exe.vir Infected: Trojan.Win32.Obfuscated.kp skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\emrxtgra.exe.vir Infected: Trojan.Win32.Obfuscated.kp skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\erthdarm.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.aps skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\gotuqmuw.exe.vir Infected: Trojan.Win32.Obfuscated.kp skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\gywllfdb.exe.vir Infected: Trojan.Win32.Obfuscated.kp skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\hiwshbgc.exe.vir Infected: Trojan.Win32.Obfuscated.kp skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\hujevyak.exe.vir Infected: Trojan.Win32.Obfuscated.kp skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\hvnptjtv.dll.vir Infected: Trojan.Win32.BHO.xe skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\ihrudddn.exe.vir Infected: Trojan.Win32.Obfuscated.kp skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\jpewuuny.exe.vir Infected: Trojan.Win32.Obfuscated.kp skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\kiasxola.exe.vir Infected: Trojan.Win32.Obfuscated.kp skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\kmmhkrdi.exe.vir Infected: Trojan.Win32.Obfuscated.kp skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\koehucfc.exe.vir Infected: Trojan.Win32.Obfuscated.kp skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\lwgjsbnc.exe.vir Infected: Trojan.Win32.Obfuscated.kp skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\mtkjpdrw.exe.vir Infected: Trojan.Win32.Obfuscated.kp skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\nwixdqhj.dll.vir Infected: Trojan.Win32.BHO.xe skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\pnvbdxeh.exe.vir Infected: Trojan.Win32.Obfuscated.kp skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\psrdswkp.dll.vir Infected: not-a-virus:AdWare.Win32.SecToolBar.k skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\qsuwkdqf.exe.vir Infected: Trojan.Win32.Obfuscated.kp skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\samtevlo.exe.vir Infected: Trojan.Win32.Obfuscated.kp skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\sqarphbc.exe.vir Infected: Trojan.Win32.Obfuscated.kp skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\tmrtbsew.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.aps skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\ufapsahm.exe.vir Infected: Trojan.Win32.Obfuscated.kp skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\uhcsojlo.exe.vir Infected: Trojan.Win32.Obfuscated.kp skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\vpayuxki.exe.vir Infected: Trojan.Win32.Obfuscated.kp skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\xuvlkqpj.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.aps skipped
C:\qoobox\Quarantine\catchme2007-11-18_ 85420.70.zip/psrdswkp.dll Infected: not-a-virus:AdWare.Win32.SecToolBar.k skipped
C:\qoobox\Quarantine\catchme2007-11-18_ 85420.70.zip ZIP: infected - 1 skipped
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP26\A0008684.exe Infected: Trojan-Downloader.Win32.Tuvir.r skipped
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP26\A0008686.exe Infected: Trojan.Win32.Dialer.qn skipped
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP29\A0012892.exe/stream/data0004 Infected: Trojan-Downloader.Win32.Zlob.ego skipped
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP29\A0012892.exe/stream Infected: Trojan-Downloader.Win32.Zlob.ego skipped
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP29\A0012892.exe NSIS: infected - 2 skipped
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP30\A0012945.exe Infected: Trojan.Win32.Obfuscated.kp skipped
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP30\A0019076.exe/data.rar/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP30\A0019076.exe/data.rar Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP30\A0019076.exe RarSFX: infected - 2 skipped
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP30\A0022196.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP31\A0022356.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.aps skipped
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP31\A0023356.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.aps skipped
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP31\A0023470.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.aps skipped
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP32\A0027633.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.aps skipped
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP32\A0028634.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.aps skipped
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP33\A0028668.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.aps skipped
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP33\A0028669.exe Infected: Trojan.Win32.Obfuscated.kp skipped
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP33\A0028698.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.aps skipped
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP34\A0028754.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.aps skipped
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP37\A0029015.dll Infected: Trojan.Win32.BHO.xe skipped
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP37\A0029018.exe Infected: Trojan.Win32.Obfuscated.kp skipped
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP37\A0029020.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.aps skipped
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP37\A0029022.exe Infected: Trojan.Win32.Obfuscated.kp skipped
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP37\A0029025.dll Infected: not-a-virus:AdWare.Win32.SecToolBar.k skipped
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP37\A0029026.exe Infected: Trojan.Win32.Obfuscated.kp skipped
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP37\A0029027.exe Infected: Trojan.Win32.Obfuscated.kp skipped
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP37\A0029029.exe Infected: Trojan.Win32.Obfuscated.kp skipped
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP37\A0029030.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.aps skipped
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP37\A0029032.exe Infected: Trojan.Win32.Obfuscated.kp skipped
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP37\A0029033.exe Infected: Trojan.Win32.Obfuscated.kp skipped
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP37\A0029034.exe Infected: Trojan.Win32.Obfuscated.kp skipped
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP37\A0029035.exe Infected: Trojan.Win32.Obfuscated.kp skipped
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP37\A0029037.exe Infected: Trojan.Win32.Obfuscated.kp skipped
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP37\A0029039.exe Infected: Trojan.Win32.Obfuscated.kp skipped
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP37\A0029041.exe Infected: Trojan.Win32.Obfuscated.kp skipped
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP37\A0029042.exe Infected: Trojan.Win32.Obfuscated.kp skipped
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP37\A0029043.exe Infected: Trojan.Win32.Obfuscated.kp skipped
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP37\A0029045.exe Infected: Trojan.Win32.Obfuscated.kp skipped
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP37\A0029047.exe Infected: Trojan.Win32.Obfuscated.kp skipped
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP37\A0029048.dll Infected: Trojan.Win32.BHO.xe skipped
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP37\A0029052.exe Infected: Trojan.Win32.Obfuscated.kp skipped
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP37\A0029053.exe Infected: Trojan.Win32.Obfuscated.kp skipped
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP37\A0029056.exe Infected: Trojan.Win32.Obfuscated.kp skipped
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP37\A0029058.exe Infected: Trojan.Win32.Obfuscated.kp skipped
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP37\A0029059.exe Infected: Trojan.Win32.Obfuscated.kp skipped
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP37\A0029060.exe Infected: Trojan.Win32.Obfuscated.kp skipped
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP37\A0029064.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.aps skipped
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP37\A0029069.dll Infected: not-a-virus:AdWare.Win32.SecToolBar.k skipped
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP37\A0029075.dll Infected: not-a-virus:AdWare.Win32.SecToolBar.k skipped
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP37\change.log Object is locked skipped
C:\WINDOWS\CSC\000001 Object is locked skipped
C:\WINDOWS\Debug\Netlogon.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{A136A2AF-B217-4140-A86E-82CD574438D8}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\ACEEvent.evt Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\DEFAULT Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SYSTEM Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\Temp\Perflib_Perfdata_78c.dat Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.




Logfile of HijackThis v1.99.1
Scan saved at 12:56, on 2007-11-18
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\IPSSVC.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\System32\TPHDEXLG.EXE
C:\Program Files\IBM ThinkVantage\Rescue and Recovery\rrservice.exe
C:\Program Files\IBM ThinkVantage\Common\Scheduler\tvtsched.exe
C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
C:\Program Files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\TpShocks.exe
C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\PROGRA~1\THINKV~1\PrdCtr\LPMGR.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\IBM ThinkVantage\Client Security Solution\cssauth.exe
C:\Program Files\IBM ThinkVantage\SafeGuard PrivateDisk\pdservice.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe
C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~2\VPTray.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.balwynhs.vic.edu.au/home/home.bhs
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.balwynhs.vic.edu.au:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.balwynhs.vic.edu.au;172.*;*.education.vic.gov.au;*.sofweb.vic.edu.au;*.vass.vi
.edu.au;*.eduweb.vic.gov.au;*.edudev.vic.gov.au;*.edumail.vic.gov.au;*.otte.vic.
ov.au;*.icon.edu.vic.gov.au;*.ultranet.vic.edu.au;*.vcaa.vic.edu.au;
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [TPKMAPHELPER] C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper
O4 - HKLM\..\Run: [TpShocks] TpShocks.exe
O4 - HKLM\..\Run: [TP4EX] tp4ex.exe
O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [suScheduler] C:\Program Files\ThinkVantage\SystemUpdate\UCLauncher.exe /SCHEDULER
O4 - HKLM\..\Run: [LPManager] C:\PROGRA~1\THINKV~1\PrdCtr\LPMGR.exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [ISUSPM Startup] c:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "c:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [cssauth] "C:\Program Files\IBM ThinkVantage\Client Security Solution\cssauth.exe" silent
O4 - HKLM\..\Run: [PDService.exe] "C:\Program Files\IBM ThinkVantage\SafeGuard PrivateDisk\pdservice.exe"
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [ACTray] C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe
O4 - HKLM\..\Run: [ACWLIcon] C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe
O4 - HKLM\..\Run: [PWRMGRTR] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL,PwrMgrBkGndMonitor
O4 - HKLM\..\Run: [BLOG] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL,StartBattLog
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~2\VPTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Software Installer - {D1A4DEBD-C2EE-449f-B9FB-E8409F9A0BC5} - C:\Program Files\Lenovo\PkgMgr\\PkgMgr.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O11 - Options group: [JAVA_IBM] Java (IBM)
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1185221205500
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = balwynhs.vic.edu.au
O17 - HKLM\Software\..\Telephony: DomainName = balwynhs.vic.edu.au
O17 - HKLM\System\CCS\Services\Tcpip\..\{581BEF0D-C033-4CA8-92CB-85EEFEC95FE1}: NameServer = 61.9.133.193,61.9.134.49
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll
O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: ACNotify - ACNotify.dll (file missing)
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: tpfnf2 - C:\WINDOWS\SYSTEM32\notifyf2.dll
O20 - Winlogon Notify: tphotkey - C:\WINDOWS\SYSTEM32\tphklock.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ac Profile Manager Service (AcPrfMgrSvc) - Unknown owner - C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe (file missing)
O23 - Service: Access Connections Main Service (AcSvc) - Lenovo - C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: ThinkPad PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\system32\ibmpmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: IPS Core Service (IPSSVC) - Lenovo Group Limited - C:\WINDOWS\system32\IPSSVC.EXE
O23 - Service: IBM PSA Access Driver Control (PsaSrv) - Unknown owner - C:\WINDOWS\system32\PsaSrv.exe (file missing)
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: ThinkPad HDD APS Logging Service (TPHDEXLGSVC) - Lenovo. - C:\WINDOWS\System32\TPHDEXLG.EXE
O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe (file missing)
O23 - Service: TSS Core Service (TSSCoreService) - IBM - C:\Program Files\IBM ThinkVantage\Client Security Solution\ibmtcsd.exe
O23 - Service: TVT Backup Service - Unknown owner - C:\Program Files\IBM ThinkVantage\Rescue and Recovery\rrservice.exe
O23 - Service: TVT Scheduler - Unknown owner - C:\Program Files\IBM ThinkVantage\Common\Scheduler\tvtsched.exe
O23 - Service: ThinkVantage System Update (UCLauncherService) - Unknown owner - C:\Program Files\ThinkVantage\SystemUpdate\UCLauncherService.exe (file missing)

Hi lin0056

Please follow the steps below exactly in the order they are written:

Step #1
Next two entries are leftovers from legit programs, and you can fix them. Re-open HiJackThis and click on "Do a system scan only". Check the boxes next to all the entries listed below.

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O20 - Winlogon Notify: ACNotify - ACNotify.dll (file missing)

Now close all windows other than HiJackThis, then click Fix Checked. Close HiJackThis.


Step #2

Please download the OTMoveIt by OldTimer.

• Save it to your desktop.
• Please double-click OTMoveIt.exe to run it.
• Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):
  
  C:\Downloads\MSN Fun\NYU_msn_hack_with_rapidshare_premium_downloader
  C:\Downloads\MSN Fun\NYU_msn_hack_with_rapidshare_premium_downloader.rar
  
  
  
• Return to OTMoveIt, right click on the "Paste List of Files/Folders to be moved" window and choose Paste.
• Click the red Moveit! button.
• Copy everything on the Results window to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it on your next reply.
• Close OTMoveIt

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

Step #3

Please download Deckard's System Scanner (DSS) and save it to your Desktop.

• Close all other windows before proceeding.
• Double-click on dss.exe and follow the prompts.
• When it has finished, dss will open two Notepads main.txt and extra.txt – please copy (CTRL+A and then CTRL+C) and paste (CTRL+V) the contents of main.txt and extra.txt in your next reply.

What DSS will do:

• create a new System Restore point in Windows XP and Vista.
  
• clean your Temporary Files, Downloaded Program Files, and Internet Cache Files, and also empty the Recycle Bin on all drives.
  
• check some important areas of your system and produce a report for your analyst to review. DSS automatically runs HijackThis for you, but it will also install and place a shortcut to HijackThis on your desktop if you do not already have HijackThis installed.

Post back with OTMoveIt report, and dss scan reports main.txt and extra.txt.


Regards,

Here is the OTMove it. i think this is a virus some guy sent me, i never saw it

C:\Downloads\MSN Fun\NYU_msn_hack_with_rapidshare_premium_downloader moved successfully.
C:\Downloads\MSN Fun\NYU_msn_hack_with_rapidshare_premium_downloader.rar moved successfully.

Created on 11-19-2007 17:12:46

This is my main.txt

Deckard's System Scanner v20071014.68
Run by [removed] on 2007-11-19 17:19:58
Computer is in Normal Mode.
——————————————————————————–

Total Physical Memory: 511 MiB (512 MiB recommended).


– HijackThis (run as LIN0056.exe) ———————————————

Logfile of HijackThis v1.99.1
Scan saved at 17:20, on 2007-11-19
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\IPSSVC.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\System32\TPHDEXLG.EXE
C:\Program Files\IBM ThinkVantage\Rescue and Recovery\rrservice.exe
C:\Program Files\IBM ThinkVantage\Common\Scheduler\tvtsched.exe
C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
C:\Program Files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\TpShocks.exe
C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\PROGRA~1\THINKV~1\PrdCtr\LPMGR.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\IBM ThinkVantage\Client Security Solution\cssauth.exe
C:\Program Files\IBM ThinkVantage\SafeGuard PrivateDisk\pdservice.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~2\VPTray.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Documents and Settings\lin0056\Desktop\dss.exe
C:\PROGRA~1\Hijackthis\LIN0056.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.balwynhs.vic.edu.au/home/home.bhs
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.balwynhs.vic.edu.au:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.balwynhs.vic.edu.au;172.*;*.education.vic.gov.au;*.sofweb.vic.edu.au;*.vass.vi
.edu.au;*.eduweb.vic.gov.au;*.edudev.vic.gov.au;*.edumail.vic.gov.au;*.otte.vic.
ov.au;*.icon.edu.vic.gov.au;*.ultranet.vic.edu.au;*.vcaa.vic.edu.au;
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google; - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [TPKMAPHELPER] C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper
O4 - HKLM\..\Run: [TpShocks] TpShocks.exe
O4 - HKLM\..\Run: [TP4EX] tp4ex.exe
O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [suScheduler] C:\Program Files\ThinkVantage\SystemUpdate\UCLauncher.exe /SCHEDULER
O4 - HKLM\..\Run: [LPManager] C:\PROGRA~1\THINKV~1\PrdCtr\LPMGR.exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [ISUSPM Startup] c:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "c:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [cssauth] "C:\Program Files\IBM ThinkVantage\Client Security Solution\cssauth.exe" silent
O4 - HKLM\..\Run: [PDService.exe] "C:\Program Files\IBM ThinkVantage\SafeGuard PrivateDisk\pdservice.exe"
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [ACTray] C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe
O4 - HKLM\..\Run: [ACWLIcon] C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe
O4 - HKLM\..\Run: [PWRMGRTR] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL,PwrMgrBkGndMonitor
O4 - HKLM\..\Run: [BLOG] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL,StartBattLog
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~2\VPTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Software Installer - {D1A4DEBD-C2EE-449f-B9FB-E8409F9A0BC5} - C:\Program Files\Lenovo\PkgMgr\\PkgMgr.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O11 - Options group: [JAVA_IBM] Java (IBM)
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1185221205500
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = balwynhs.vic.edu.au
O17 - HKLM\Software\..\Telephony: DomainName = balwynhs.vic.edu.au
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll
O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: tpfnf2 - C:\WINDOWS\SYSTEM32\notifyf2.dll
O20 - Winlogon Notify: tphotkey - C:\WINDOWS\SYSTEM32\tphklock.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ac Profile Manager Service (AcPrfMgrSvc) - Unknown owner - C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe (file missing)
O23 - Service: Access Connections Main Service (AcSvc) - Lenovo - C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: ThinkPad PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\system32\ibmpmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: IPS Core Service (IPSSVC) - Lenovo Group Limited - C:\WINDOWS\system32\IPSSVC.EXE
O23 - Service: IBM PSA Access Driver Control (PsaSrv) - Unknown owner - C:\WINDOWS\system32\PsaSrv.exe (file missing)
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: ThinkPad HDD APS Logging Service (TPHDEXLGSVC) - Lenovo. - C:\WINDOWS\System32\TPHDEXLG.EXE
O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe (file missing)
O23 - Service: TSS Core Service (TSSCoreService) - IBM - C:\Program Files\IBM ThinkVantage\Client Security Solution\ibmtcsd.exe
O23 - Service: TVT Backup Service - Unknown owner - C:\Program Files\IBM ThinkVantage\Rescue and Recovery\rrservice.exe
O23 - Service: TVT Scheduler - Unknown owner - C:\Program Files\IBM ThinkVantage\Common\Scheduler\tvtsched.exe
O23 - Service: ThinkVantage System Update (UCLauncherService) - Unknown owner - C:\Program Files\ThinkVantage\SystemUpdate\UCLauncherService.exe (file missing)


– Files created between 2007-10-19 and 2007-11-19 —————————–

2007-11-19 13:47:49 0 d——c- C:\Documents and Settings\LocalService\Desktop
2007-11-18 10:28:39 0 d——c- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-11-18 10:28:36 0 d——c- C:\WINDOWS\system32\Kaspersky Lab
2007-11-16 19:52:25 0 d——c- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-11-16 13:50:11 0 d——c- C:\Documents and Settings\lin0056\Application Data\Grisoft
2007-11-15 23:11:19 0 d——c- C:\Documents and Settings\All Users\Application Data\Grisoft
2007-11-15 22:25:04 0 d——c- C:\WINDOWS\Sun
2007-11-15 20:01:31 25600 –a—-c- C:\WINDOWS\system32\WS2Fix.exe
2007-11-15 20:01:31 289144 –a—-c- C:\WINDOWS\system32\VCCLSID.exe

Hi SNOWHITE, i couldn't find readme.txt.exe, it is not hidden. maybe you thought wrong? i don't know.

main.txt:

Deckard's System Scanner v20071014.68
Run by [removed] on 2007-11-22 20:58:11
Computer is in Normal Mode.
——————————————————————————–

Percentage of Memory in Use: 77% (more than 75%).
Total Physical Memory: 511 MiB (512 MiB recommended).


– HijackThis (run as LIN0056.exe) ———————————————

Unable to find log (file not found); running clone.
– HijackThis Clone ————————————————————


Emulating logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2007-11-22 20:58:14
Platform: Windows XP Service Pack 2 (5.01.2600)
MSIE: Internet Explorer (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\system32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\IPSSVC.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\system32\TPHDEXLG.exe
C:\Program Files\IBM ThinkVantage\Rescue and Recovery\rrservice.exe
C:\Program Files\IBM ThinkVantage\Common\Scheduler\tvtsched.exe
C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
C:\Program Files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Microsoft Games\Halo\Halo.eXe
C:\Documents and Settings\lin0056\Desktop\dss.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.balwynhs.vic.edu.au/home/home.bhs
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://home.microsoft.com/access/autosearch.asp?p=%s
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.balwynhs.vic.edu.au:8080
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?p…amp;ar=iesearch
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\GoogleToolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\GoogleToolbar2.dll
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing)
O9 - Extra button: Software Installer - {D1A4DEBD-C2EE-449f-B9FB-E8409F9A0BC5} - C:\Program Files\Lenovo\PkgMgr\\PkgMgr.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options Group: [JAVA_IBM] Java (IBM)
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/5/b…heckControl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1185221205500
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} () - http://fpdownload.macromedia.com/get/flash…t/ultrashim.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 - HKLM\Software\..\Telephony: DomainName = balwynhs.vic.edu.au
O17 - HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: Domain = balwynhs.vic.edu.au
O17 - HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: Domain = balwynhs.vic.edu.au
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll
O18 - Protocol: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll
O18 - Protocol: mso-offdap11 - {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL
O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll
O18 - Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ac Profile Manager Service (AcPrfMgrSvc) - Unknown owner - C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
O23 - Service: Access Connections Main Service (AcSvc) - Lenovo - C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: ThinkPad PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\system32\ibmpmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: IPS Core Service (IPSSVC) - Lenovo Group Limited - C:\WINDOWS\system32\IPSSVC.EXE
O23 - Service: IBM PSA Access Driver Control (PsaSrv) - Unknown owner - C:\WINDOWS\system32\PsaSrv.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SavRoam - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: ThinkPad HDD APS Logging Service (TPHDEXLGSVC) - Lenovo. - C:\WINDOWS\system32\TPHDEXLG.exe
O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe
O23 - Service: TSS Core Service (TSSCoreService) - IBM - C:\Program Files\IBM ThinkVantage\Client Security Solution\ibmtcsd.exe
O23 - Service: TVT Backup Service - Unknown owner - C:\Program Files\IBM ThinkVantage\Rescue and Recovery\rrservice.exe
O23 - Service: TVT Scheduler - Unknown owner - C:\Program Files\IBM ThinkVantage\Common\Scheduler\tvtsched.exe
O23 - Service: ThinkVantage System Update (UCLauncherService) - Unknown owner - C:\Program Files\ThinkVantage\SystemUpdate\UCLauncherService.exe


–
End of file - 10407 bytes

– Files created between 2007-10-22 and 2007-11-22 —————————–

2007-11-22 17:28:58 0 d——c- C:\Documents and Settings\lin0056\DoctorWeb
2007-11-21 17:03:11 0 d——c- C:\WINDOWS\system32\ActiveScan
2007-11-20 22:24:36 552 –a—-c- C:\WINDOWS\system32\d3d8caps.dat
2007-11-20 17:30:21 1622016 –a—-c- C:\WINDOWS\system32\rlvknlg.exe

ComboFix 07-12-02.7 - LIN0056 2007-12-04 22:25:02.4 - NTFSx86
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\lin0056\Desktop\CFScript.txt
* Created a new restore point

FILE
C:\WINDOWS\system32\rkupginstaller.exe
C:\WINDOWS\system32\rlvknlg.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Autorun.inf
C:\WINDOWS\system32\rkupginstaller.exe
C:\WINDOWS\system32\scvhost.exe
C:\WINDOWS\system32\xlive
C:\WINDOWS\system32\xlive\sqmapi.dll

.
((((((((((((((((((((((((( Files Created from 2007-11-04 to 2007-12-04 )))))))))))))))))))))))))))))))
.

2007-12-04 19:54 . 2007-12-04 19:54 17,542 —h-c— C:\DriveIcon.ico
2007-12-04 19:50 . 2007-12-04 19:56 d—-c— C:\Program Files\Bee Icons
2007-12-04 16:54 . 2007-12-04 16:55 d—-c— C:\Program Files\AnyReader
2007-12-04 09:20 . 2007-12-04 09:20 d—-c— C:\Program Files\VideoLAN
2007-12-04 09:15 . 2007-12-04 09:15 d—-c— C:\Program Files\XviD
2007-12-04 09:08 . 2007-12-04 09:08 d—-c— C:\Program Files\DScaler5
2007-12-04 08:58 . 2007-12-04 08:58 d—-c— C:\Program Files\3ivx
2007-12-04 08:50 . 2007-12-04 15:38 d—-c— C:\Documents and Settings\lin0056\Application Data\DivX
2007-12-04 08:48 . 2007-09-29 03:07 129,784 —–c— C:\WINDOWS\system32\pxafs.dll
2007-12-04 08:48 . 2007-09-29 03:07 9,464 —–c— C:\WINDOWS\system32\drivers\cdralw2k.sys
2007-12-04 08:48 . 2007-09-29 03:07 9,336 —–c— C:\WINDOWS\system32\drivers\cdr4_xp.sys
2007-12-04 08:34 . 2007-12-04 08:48 d—-c— C:\Program Files\DivX
2007-12-04 08:31 . 2007-12-04 08:31 d—-c— C:\Documents and Settings\lin0056\Application Data\Nokia Multimedia Player
2007-12-04 08:30 . 2007-12-04 08:31 54,156 –ah-c— C:\WINDOWS\QTFont.qfn
2007-12-04 08:30 . 2007-12-04 08:31 1,409 –a–c— C:\WINDOWS\QTFont.for
2007-12-04 00:36 . 2007-12-04 00:36 d—-c— C:\Program Files\ElcomSoft
2007-12-04 00:17 . 2007-12-04 00:17 d—-c— C:\Documents and Settings\lin0056\Application Data\Leadertech
2007-12-03 23:25 . 2007-12-03 23:25 d—-c— C:\Documents and Settings\All Users\Application Data\Nokia
2007-12-03 23:23 . 2007-02-22 11:15 137,216 –a–c— C:\WINDOWS\system32\drivers\nmwcd.sys
2007-12-03 23:23 . 2007-02-22 11:15 65,536 –a–c— C:\WINDOWS\system32\nmwcdcocls.dll
2007-12-03 23:19 . 2007-12-03 23:21 d—-c— C:\Documents and Settings\lin0056\Phone Browser
2007-12-03 22:36 . 2007-12-03 22:38 d—-c— C:\Documents and Settings\All Users\Application Data\PC Suite
2007-12-03 22:35 . 2007-12-03 22:38 d—-c— C:\Documents and Settings\lin0056\Application Data\Nokia
2007-12-03 22:34 . 2007-12-03 22:35 d—-c— C:\Program Files\DIFX
2007-12-03 22:34 . 2007-12-03 22:34 d—-c— C:\Program Files\Common Files\PCSuite
2007-12-03 22:34 . 2007-12-03 23:42 d—-c— C:\Program Files\Common Files\Nokia
2007-12-03 22:34 . 2007-12-03 23:19 d—-c— C:\Documents and Settings\lin0056\Application Data\PC Suite
2007-12-03 22:33 . 2007-12-03 22:33 d—-c— C:\Program Files\PC Connectivity Solution
2007-12-03 22:33 . 2007-12-03 23:42 d—-c— C:\Program Files\Nokia
2007-12-03 22:33 . 2007-02-22 11:15 90,624 –a–c— C:\WINDOWS\system32\nmwcdcls.dll
2007-12-03 22:24 . 2007-12-03 22:24 d—-c— C:\Documents and Settings\All Users\Application Data\Installations
2007-12-03 22:21 . 2007-12-03 22:21 d–hsc— C:\WINDOWS\ftpcache
2007-12-03 22:02 . 2007-12-03 22:02 d—-c— C:\Documents and Settings\lin0056\Application Data\AdobeUM
2007-12-03 22:02 . 2007-12-03 22:02 d—-c— C:\Documents and Settings\lin0056\Application Data\AdobeAUM
2007-12-03 18:27 . 2007-12-03 18:56 d—-c— C:\Program Files\Download Direct
2007-12-03 17:37 . 2007-12-03 17:37 d–h-c— C:\WINDOWS\system32\GroupPolicy
2007-12-03 17:23 . 2007-12-02 02:05 307,200 –a–c— C:\WINDOWS\kopmet.dll
2007-12-03 17:23 . 2007-12-02 02:05 192,512 –a–c— C:\WINDOWS\jetctrl.dll
2007-12-03 17:23 . 2007-12-02 02:05 147,456 –a–c— C:\WINDOWS\nretcip.exe
2007-12-03 17:03 . 2007-12-03 17:04 d—-c— C:\Program Files\RichVideoCodec
2007-12-03 11:21 . 2007-12-03 11:21 244 –ah-c— C:\sqmnoopt00.sqm
2007-12-03 11:21 . 2007-12-03 11:21 232 –ah-c— C:\sqmdata00.sqm
2007-12-03 06:25 . 2007-05-27 17:09 419,969 -r-h-c— C:\WINDOWS\NetMSConfig.exe
2007-12-03 06:04 . 2007-12-03 06:05 d—-c— C:\Program Files\Date Cracker 2000
2007-12-03 06:04 . 2007-12-03 06:04 73,216 –a–c— C:\WINDOWS\temp.000
2007-12-02 22:53 . 2007-12-02 22:53 d—-c— C:\Documents and Settings\All Users\Application Data\FLEXnet
2007-12-02 13:54 . 2007-12-02 14:15 d—-c— C:\Program Files\TVAnts
2007-12-02 13:53 . 2007-12-02 13:53 d—-c— C:\WINDOWS\uninstall\Satellite TV for PC Elite
2007-12-02 13:53 . 2007-12-02 13:53 d—-c— C:\WINDOWS\uninstall
2007-12-02 13:53 . 2007-12-02 13:53 d—-c— C:\Program Files\SatelliteTVforPC
2007-12-02 13:11 . 2007-12-02 13:11 d—-c— C:\Documents and Settings\lin0056\Application Data\TVU Networks
2007-12-02 10:56 . 2007-12-02 10:56 d—-c— C:\Program Files\smr-usenet
2007-12-02 10:56 . 2001-03-29 01:38 69,632 –a–c— C:\WINDOWS\system32\GkSui18.EXE
2007-12-02 09:45 . 2007-12-02 09:45 d—-c— C:\Documents and Settings\lin0056\Application Data\ZipZag
2007-12-02 09:44 . 2007-12-02 09:46 d—-c— C:\Program Files\ZipZag
2007-12-01 20:20 . 2007-12-04 09:23 d—-c— C:\Documents and Settings\lin0056\Application Data\vlc
2007-12-01 20:17 . 2007-12-02 13:12 d—-c— C:\Program Files\TVU Player
2007-12-01 16:35 . 2007-12-01 16:43 d—-c— C:\WINDOWS\system32\dt
2007-12-01 16:29 . 2007-12-01 16:29 0 –a–c— C:\WINDOWS\WB.ini
2007-12-01 15:48 . 2007-12-01 15:48 d—-c— C:\WINDOWS\{hopper}
2007-12-01 15:48 . 2007-12-03 10:01 d—-c— C:\Program Files\WiFi Hopper
2007-12-01 15:48 . 2006-05-31 02:36 21,376 –a–c— C:\WINDOWS\system32\drivers\hopperp.sys
2007-12-01 15:14 . 2007-12-01 15:14 103 –a–c— C:\WINDOWS\system32\msrcom.dat
2007-12-01 12:31 . 2001-06-11 22:15 115,016 –a–c— C:\WINDOWS\system32\Msinet.ocx
2007-12-01 09:44 . 2007-12-01 09:44 d—-c— C:\Program Files\Download Manager
2007-12-01 09:43 . 2007-12-01 11:23 d—-c— C:\Documents and Settings\lin0056\Application Data\IGN_DLM
2007-12-01 00:43 . 2007-12-01 00:43 479,298 –a–c— C:\WINDOWS\system32\wbocx.ocx
2007-12-01 00:43 . 2007-12-01 00:43 172,032 –a–c— C:\WINDOWS\system32\AniGIF.ocx
2007-12-01 00:43 . 2007-12-01 00:43 50,688 –a–c— C:\WINDOWS\system32\wbhelp2.dll
2007-11-30 21:37 . 2007-11-30 21:37 d—-c— C:\Program Files\GameSpot
2007-11-30 20:17 . 2007-11-30 20:17 d—-c— C:\Program Files\Uconomix
2007-11-30 17:00 . 2007-11-30 17:18 d—-c— C:\Program Files\Spyware Doctor
2007-11-30 17:00 . 2007-11-30 17:00 d—-c— C:\Documents and Settings\lin0056\Application Data\PC Tools
2007-11-30 17:00 . 2007-10-18 00:16 79,688 –a–c— C:\WINDOWS\system32\drivers\iksyssec.sys
2007-11-30 17:00 . 2007-10-18 00:15 62,280 –a–c— C:\WINDOWS\system32\drivers\iksysflt.sys
2007-11-30 17:00 . 2007-10-18 00:14 41,288 –a–c— C:\WINDOWS\system32\drivers\ikfilesec.sys
2007-11-30 17:00 . 2007-10-18 00:16 29,000 –a–c— C:\WINDOWS\system32\drivers\kcom.sys
2007-11-30 16:59 . 2005-09-23 08:29 626,688 –a–c— C:\WINDOWS\system32\msvcr80.dll
2007-11-30 13:40 . 2007-12-01 15:15 160,564,119 –a–c— C:\WINDOWS\system32\mfccache.dll
2007-11-29 20:41 . 2007-11-29 20:58 d—-c— C:\Program Files\Hide The IP
2007-11-29 20:28 . 2007-12-01 22:40 d—-c— C:\Documents and Settings\lin0056\Application Data\LimeWire
2007-11-29 20:27 . 2007-11-29 20:27 d—-c— C:\Program Files\LimeWire
2007-11-29 18:52 . 2007-11-29 18:55 d—-c— C:\Documents and Settings\lin0056\Application Data\XP Visual Tools
2007-11-29 18:50 . 2007-12-03 16:56 d-a–c— C:\Documents and Settings\All Users\Application Data\TEMP
2007-11-29 12:49 . 2007-11-29 18:58 d—-c— C:\Program Files\Common Files\Stardock
2007-11-29 11:52 . 2007-11-29 18:57 d—-c— C:\Program Files\Stardock
2007-11-29 11:52 . 2007-07-11 15:06 42,672 –a–c— C:\WINDOWS\system32\wbsys.dll
2007-11-29 11:52 . 2005-01-22 18:05 20,480 –a–c— C:\WINDOWS\system32\wbload.dll
2007-11-29 08:57 . 2007-11-29 09:15 d—-c— C:\Program Files\GameSpy Arcade
2007-11-28 15:16 . 2007-11-28 15:16 d—-c— C:\WINDOWS\.jagex_cache_32
2007-11-24 19:16 . 2007-11-25 11:39 d—-c— C:\Program Files\Halo Server
2007-11-24 16:41 . 2007-11-24 16:41 d—-c— C:\Documents and Settings\LocalService\Application Data\Xfire
2007-11-24 09:34 . 2007-11-24 09:34 54 –a–c— C:\WINDOWS\Composer.INI
2007-11-24 09:33 . 2007-11-28 20:54 d—-c— C:\Program Files\Notation
2007-11-24 08:21 . 2007-11-24 08:21 d—-c— C:\Documents and Settings\All Users\Application Data\Musicnotes
2007-11-22 17:28 . 2007-11-22 17:44 d—-c— C:\Documents and Settings\lin0056\DoctorWeb
2007-11-21 17:03 . 2007-11-22 17:22 d—-c— C:\WINDOWS\system32\ActiveScan
2007-11-21 17:03 . 2007-11-22 16:22 30,590 –a–c— C:\WINDOWS\system32\pavas.ico
2007-11-21 17:03 . 2007-11-22 16:22 2,550 –a–c— C:\WINDOWS\system32\Uninstall.ico
2007-11-21 17:03 . 2007-11-22 16:22 1,406 –a–c— C:\WINDOWS\system32\Help.ico

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-04 11:29 ——— dc—-w C:\Program Files\Symantec AntiVirus
2007-12-04 08:54 106 -c-h–w C:\Program Files\desktop.ini
2007-12-03 14:28 ——— dc—-w C:\Program Files\Common Files\Adobe
2007-12-02 19:04 249,856 -c—-w C:\WINDOWS\Setup1.exe
2007-11-30 10:37 5,588 -c–a-w C:\Program Files\install.log
2007-11-22 06:14 ——— dc—-w C:\Program Files\Windows Defender
2007-11-22 06:04 ——— dc—-w C:\Program Files\Google
2007-11-22 06:04 ——— dc—-w C:\Program Files\Digital Line Detect
2007-11-22 06:00 ——— dc—-w C:\Program Files\Common Files\Symantec Shared
2007-11-09 11:58 ——— dc-h–w C:\Program Files\InstallShield Installation Information
2007-11-08 01:18 ——— dc—-w C:\Program Files\Windows Media Connect
2007-11-08 01:13 ——— dc—-w C:\Program Files\Microsoft Works
2007-11-07 05:09 ——— dc—-w C:\Program Files\Picasa2
2007-07-23 21:37 32,768 -csha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat
.

((((((((((((((((((((((((((((( snapshot@2007-11-16_20.38.52.82 )))))))))))))))))))))))))))))))))))))))))
.
+ 2006-05-30 02:44:18 11,776 -c–a-w C:\WINDOWS\{hopper}\snetcfg.exe
- 2007-10-29 07:56:19 136,192 -c–a-w C:\WINDOWS\catchme.exe
+ 2007-11-26 16:58:11 140,288 -c–a-w C:\WINDOWS\catchme.exe
+ 2006-08-23 21:28:54 141,424 -c–a-w C:\WINDOWS\Downloaded Program Files\asinst.dll
+ 2007-03-05 02:57:46 325,240 -c–a-w C:\WINDOWS\Downloaded Program Files\DLMControl.dll
+ 2007-06-01 03:25:26 317,016 -c–a-w C:\WINDOWS\Downloaded Program Files\mnviewer.dll
+ 2006-05-30 15:36:54 21,376 -c–a-w C:\WINDOWS\inf\hopperp.sys
+ 2007-12-04 05:40:30 10,134 -c–a-r C:\WINDOWS\Installer\{066D65EA-ED53-44E4-A96A-F81B6E409D2E}\ARPPRODUCTICON.exe
+ 2007-12-03 12:23:50 3,262 -c–a-r C:\WINDOWS\Installer\{11964613-805F-432D-A12B-169554B793E7}\ARPPRODUCTICON.exe
+ 2007-12-03 10:59:43 65,536 -c–a-r C:\WINDOWS\Installer\{4BDFD2CE-6329-42E4-9801-9B3D1F10D79B}\ARPPRODUCTICON.exe
+ 2007-12-03 10:59:43 65,536 -c–a-r C:\WINDOWS\Installer\{4BDFD2CE-6329-42E4-9801-9B3D1F10D79B}\NewShortcut2_4BDFD2CE632942E498019B3D1F10D79B.exe
+ 2007-12-03 10:59:43 65,536 -c–a-r C:\WINDOWS\Installer\{4BDFD2CE-6329-42E4-9801-9B3D1F10D79B}\NewShortcut3_4BDFD2CE632942E498019B3D1F10D79B.exe
+ 2007-12-04 05:41:19 15,086 -c–a-r C:\WINDOWS\Installer\{57A48477-92F0-4C1F-ADF9-4806C4EC3CF2}\ARPPRODUCTICON.exe
+ 2007-12-04 05:41:19 216,358 -c–a-r C:\WINDOWS\Installer\{57A48477-92F0-4C1F-ADF9-4806C4EC3CF2}\EXTUI_UninstallPCSui_0F854AC05AF149EFBE65492233B7B5AD.exe
- 2007-11-08 01:18:14 12,288 -c–a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
+ 2007-11-30 02:49:27 12,288 -c–a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
- 2007-11-08 01:18:14 135,168 -c–a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\misc.exe
+ 2007-11-30 02:49:26 135,168 -c–a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\misc.exe
- 2007-11-08 01:18:14 11,264 -c–a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
+ 2007-11-30 02:49:27 11,264 -c–a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
- 2007-11-08 01:18:14 27,136 -c–a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
+ 2007-11-30 02:49:27 27,136 -c–a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
- 2007-11-08 01:18:14 4,096 -c–a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
+ 2007-11-30 02:49:27 4,096 -c–a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
- 2007-11-08 01:18:15 794,624 -c–a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\outicon.exe
+ 2007-11-30 02:49:27 794,624 -c–a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\outicon.exe
- 2007-11-08 01:18:14 249,856 -c–a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\pptico.exe
+ 2007-11-30 02:49:26 249,856 -c–a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\pptico.exe
- 2007-11-08 01:18:15 23,040 -c–a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
+ 2007-11-30 02:49:27 23,040 -c–a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
- 2007-11-08 01:18:14 286,720 -c–a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
+ 2007-11-30 02:49:26 286,720 -c–a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
- 2007-11-08 01:18:13 409,600 -c–a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
+ 2007-11-30 02:49:26 409,600 -c–a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
+ 2007-08-07 01:51:46 1,139,488 -c–a-w C:\WINDOWS\system32\3ivx.dll
+ 2007-08-07 01:51:52 324,320 -c–a-w C:\WINDOWS\system32\3ivxVfWCodec.dll
+ 2007-03-28 22:20:50 110,592 -c–a-w C:\WINDOWS\system32\ActiveScan\as.dll
+ 2006-10-05 05:15:26 233,472 -c–a-w C:\WINDOWS\system32\ActiveScan\ascontrol.dll
+ 2005-06-03 03:03:18 96,256 -c–a-w C:\WINDOWS\system32\ActiveScan\asmdat.dll
+ 2003-08-01 00:00:16 36,864 -c–a-w C:\WINDOWS\system32\ActiveScan\certdll.dll
+ 2005-05-20 02:42:44 86,016 -c–a-w C:\WINDOWS\system32\ActiveScan\instlsp.dll
+ 2006-02-16 07:20:20 4,608 -c–a-w C:\WINDOWS\system32\ActiveScan\memvfile.dll
+ 2005-10-25 07:08:32 348,160 -c–a-w C:\WINDOWS\system32\ActiveScan\msvcr71.dll
+ 2004-05-04 04:01:02 139,264 -c–a-w C:\WINDOWS\system32\ActiveScan\pavaleas.dll
+ 2006-07-14 02:04:10 45,056 -c–a-w C:\WINDOWS\system32\ActiveScan\pavdr.exe
+ 2006-04-09 23:50:02 159,832 -c–a-w C:\WINDOWS\system32\ActiveScan\pavexcom.dll
+ 2006-02-14 02:05:38 94,208 -c–a-w C:\WINDOWS\system32\ActiveScan\pavinas.dll
+ 2006-02-16 07:35:38 180,224 -c–a-w C:\WINDOWS\system32\ActiveScan\pavoe.dll
+ 2006-10-05 05:15:38 122,880 -c–a-w C:\WINDOWS\system32\ActiveScan\pavpz.dll
+ 2006-06-30 03:13:38 8,704 -c–a-w C:\WINDOWS\system32\ActiveScan\pfdnnt.exe
+ 2004-02-04 03:08:42 49,152 -c–a-w C:\WINDOWS\system32\ActiveScan\port32.dll
+ 2006-08-01 02:23:10 69,632 -c–a-w C:\WINDOWS\system32\ActiveScan\pscpu.dll
+ 2006-08-23 02:06:08 1,388,544 -c–a-w C:\WINDOWS\system32\ActiveScan\pskahk.dll
+ 2006-08-17 00:38:14 10,752 -c–a-w C:\WINDOWS\system32\ActiveScan\pskalloc.dll
+ 2006-09-04 00:49:54 61,440 -c–a-w C:\WINDOWS\system32\ActiveScan\pskas.dll
+ 2006-08-17 21:46:18 779,264 -c–a-w C:\WINDOWS\system32\ActiveScan\pskavs.dll
+ 2007-03-26 03:25:34 417,792 -c–a-w C:\WINDOWS\system32\ActiveScan\pskcmp.dll
+ 2006-08-08 23:42:24 90,112 -c–a-w C:\WINDOWS\system32\ActiveScan\pskfss.dll
+ 2006-07-18 23:55:58 208,896 -c–a-w C:\WINDOWS\system32\ActiveScan\pskhtml.dll
+ 2006-01-20 05:57:00 9,728 -c–a-w C:\WINDOWS\system32\ActiveScan\pskmas.dll
+ 2006-05-16 22:50:12 14,336 -c–a-w C:\WINDOWS\system32\ActiveScan\pskmdfs.dll
+ 2006-08-15 23:58:12 33,280 -c–a-w C:\WINDOWS\system32\ActiveScan\pskpack.dll
+ 2006-06-30 03:42:36 266,240 -c–a-w C:\WINDOWS\system32\ActiveScan\pskscs.dll
+ 2006-08-17 03:33:14 62,976 -c–a-w C:\WINDOWS\system32\ActiveScan\pskutil.dll
+ 2006-08-08 02:13:10 13,312 -c–a-w C:\WINDOWS\system32\ActiveScan\pskvfile.dll
+ 2006-08-17 21:53:08 69,632 -c–a-w C:\WINDOWS\system32\ActiveScan\pskvfs.dll
+ 2006-08-17 21:49:50 167,936 -c–a-w C:\WINDOWS\system32\ActiveScan\pskvm.dll
+ 2007-04-18 06:16:04 353,840 -c–a-w C:\WINDOWS\system32\ActiveScan\psscan.dll
+ 2007-01-22 03:42:48 35,328 -c–a-w C:\WINDOWS\system32\ActiveScan\rawvfile.dll
+ 1997-09-17 19:12:32 9,488 -c–a-w C:\WINDOWS\system32\ActiveScan\sporder.dll
+ 2006-02-28 06:23:40 69,632 -c–a-w C:\WINDOWS\system32\ActiveScan\tcpvfile.dll
+ 2006-08-02 01:39:06 73,728 -c–a-w C:\WINDOWS\system32\asuninst.exe
+ 2007-12-04 05:55:33 15,360 -c–a-w C:\WINDOWS\system32\BASSMOD.dll
+ 2006-12-01 05:30:01 6,201 -c–a-w C:\WINDOWS\system32\bpk.dat
+ 2005-12-07 01:31:00 202,752 -c–a-r C:\WINDOWS\system32\CddbCdda.dll
- 2007-04-17 05:45:28 92,504 -c–a-w C:\WINDOWS\system32\cdm.dll
+ 2007-04-16 11:45:28 92,504 -c–a-w C:\WINDOWS\system32\cdm.dll
+ 2004-06-04 15:34:36 86,016 -c–a-w C:\WINDOWS\system32\CNMCP6d.exe
+ 2004-06-07 05:00:00 116,736 -c–a-w C:\WINDOWS\system32\CNMLM6d.DLL
+ 2004-06-07 05:00:00 7,680 -c–a-w C:\WINDOWS\system32\CNMVS6d.DLL
+ 2007-09-28 16:05:40 739,840 -c–a-w C:\WINDOWS\system32\DivX.dll
+ 2007-09-28 16:05:40 823,296 -c–a-w C:\WINDOWS\system32\divx_xx07.dll
+ 2007-09-28 16:05:40 823,296 -c–a-w C:\WINDOWS\system32\divx_xx0c.dll
+ 2007-09-28 16:05:40 802,816 -c–a-w C:\WINDOWS\system32\divx_xx11.dll
+ 2007-09-28 16:08:18 156,992 -c–a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
+ 2007-09-28 16:07:54 524,288 -c–a-w C:\WINDOWS\system32\DivXsm.exe
+ 2007-08-07 01:52:58 25,312 -c–a-w C:\WINDOWS\system32\DivXVfWCodec.dll
+ 2007-09-28 16:05:08 12,288 -c–a-w C:\WINDOWS\system32\DivXWMPExtType.dll
- 2007-04-17 05:45:28 92,504 -c–a-w C:\WINDOWS\system32\dllcache\cdm.dll
+ 2007-04-16 11:45:28 92,504 -c–a-w C:\WINDOWS\system32\dllcache\cdm.dll
+ 2004-08-03 12:01:26 25,856 -c–a-w C:\WINDOWS\system32\dllcache\usbprint.sys
- 2007-04-17 05:45:48 549,720 -c–a-w C:\WINDOWS\system32\dllcache\wuapi.dll
+ 2007-04-16 11:45:48 549,720 -c–a-w C:\WINDOWS\system32\dllcache\wuapi.dll
- 2007-04-17 05:45:20 53,080 -c–a-w C:\WINDOWS\system32\dllcache\wuauclt.exe
+ 2007-04-16 11:45:20 53,080 -c–a-w C:\WINDOWS\system32\dllcache\wuauclt.exe
- 2007-04-17 05:45:54 1,710,936 -c–a-w C:\WINDOWS\system32\dllcache\wuaueng.dll
+ 2007-04-16 11:45:54 1,710,936 -c–a-w C:\WINDOWS\system32\dllcache\wuaueng.dll
- 2007-04-17 05:45:42 325,976 -c–a-w C:\WINDOWS\system32\dllcache\wucltui.dll
+ 2007-04-16 11:45:42 325,976 -c–a-w C:\WINDOWS\system32\dllcache\wucltui.dll
- 2007-04-17 05:47:36 33,624 -c–a-w C:\WINDOWS\system32\dllcache\wups.dll
+ 2007-04-16 11:47:36 33,624 -c–a-w C:\WINDOWS\system32\dllcache\wups.dll
- 2007-04-17 05:43:44 203,096 -c–a-w C:\WINDOWS\system32\dllcache\wuweb.dll
+ 2007-04-16 11:45:36 203,096 -c–a-w C:\WINDOWS\system32\dllcache\wuweb.dll
+ 2007-09-28 16:05:50 81,920 -c–a-w C:\WINDOWS\system32\dpl100.dll
+ 2007-09-28 16:05:42 294,912 -c–a-w C:\WINDOWS\system32\dpu10.dll
+ 2007-09-28 16:05:42 294,912 -c–a-w C:\WINDOWS\system32\dpu11.dll
+ 2007-09-28 16:05:44 53,248 -c–a-w C:\WINDOWS\system32\dpuGUI10.dll
+ 2007-09-28 16:05:42 593,920 -c–a-w C:\WINDOWS\system32\dpuGUI11.dll
+ 2007-09-28 16:05:42 344,064 -c–a-w C:\WINDOWS\system32\dpus11.dll
+ 2007-09-28 16:05:42 57,344 -c–a-w C:\WINDOWS\system32\dpv11.dll
- 2005-10-26 20:12:50 20,640 -c–a-w C:\WINDOWS\system32\drivers\pxhelp20.sys
+ 2007-09-28 16:07:50 43,528 -c—-w C:\WINDOWS\system32\drivers\pxhelp20.sys
- 2004-08-04 12:00:00 27,440 -c–a-w C:\WINDOWS\system32\drivers\secdrv.sys
+ 2003-09-09 04:30:32 11,376 -c–a-r C:\WINDOWS\system32\drivers\secdrv.sys
+ 2007-03-20 00:45:50 479,232 -c–a-w C:\WINDOWS\system32\drivers\UMDF\PCCSWpdDriver.dll
+ 2004-08-03 12:01:26 25,856 -c–a-w C:\WINDOWS\system32\drivers\usbprint.sys
- 2006-09-28 07:55:50 77,568 -c—-w C:\WINDOWS\system32\drivers\WudfPf.sys
+ 2006-09-15 11:29:52 76,544 -c—-w C:\WINDOWS\system32\drivers\WudfPf.sys
- 2006-09-28 08:00:34 82,944 -c—-w C:\WINDOWS\system32\drivers\WudfRd.sys
+ 2006-09-15 11:30:10 82,688 -c—-w C:\WINDOWS\system32\drivers\WudfRd.sys
+ 2007-02-22 00:15:56 137,216 -c–a-w C:\WINDOWS\system32\DRVSTORE\nmwcd_F3FA2468AF360A65811B287DD7A88CB715CF7275\nmwcd.sys
+ 2007-02-22 00:15:12 90,624 -c–a-w C:\WINDOWS\system32\DRVSTORE\nmwcd_F3FA2468AF360A65811B287DD7A88CB715CF7275\nmwcdcls.dll
+ 2007-02-22 00:15:12 65,536 -c–a-w C:\WINDOWS\system32\DRVSTORE\nmwcd_F3FA2468AF360A65811B287DD7A88CB715CF7275\nmwcdcocls.dll
+ 2007-02-22 00:15:14 8,320 -c–a-w C:\WINDOWS\system32\DRVSTORE\nmwcdc_F3FA2468AF360A65811B287DD7A88CB715CF7275\nmwcdc.sys
+ 2007-02-22 00:15:14 12,288 -c–a-w C:\WINDOWS\system32\DRVSTORE\nmwcdcj_F3FA2468AF360A65811B287DD7A88CB715CF7275\nmwcdcj.sys
+ 2007-02-22 00:15:14 12,288 -c–a-w C:\WINDOWS\system32\DRVSTORE\nmwcdm2k_F3FA2468AF360A65811B287DD7A88CB715CF7275\nmwcdcm.sys
+ 2007-03-20 00:45:50 479,232 -c–a-w C:\WINDOWS\system32\DRVSTORE\pccswpddri_039E7E24575DBAE6A389611AF28F4EB97729D33E\PCCSWpdDriver.dll
+ 2007-03-20 00:37:46 831,048 -c–a-w C:\WINDOWS\system32\DRVSTORE\pccswpddri_039E7E24575DBAE6A389611AF28F4EB97729D33E\WudfUpdate_01005.dll
+ 2007-09-28 16:05:50 196,608 -c–a-w C:\WINDOWS\system32\dtu100.dll
- 2007-11-10 22:23:46 5,427 -c–a-w C:\WINDOWS\system32\EGATHDRV.SYS
+ 2007-12-19 19:18:58 5,427 -c–a-w C:\WINDOWS\system32\EGATHDRV.SYS
- 2007-11-08 05:40:28 117,360 -c–a-w C:\WINDOWS\system32\FNTCACHE.DAT
+ 2007-12-03 12:58:21 1,429,080 -c–a-w C:\WINDOWS\system32\FNTCACHE.DAT
+ 2005-05-24 01:27:16 213,048 -c–a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll
+ 2007-08-29 04:47:20 94,208 -c–a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe
+ 2007-08-29 04:49:54 950,272 -c–a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll
+ 2007-09-28 16:07:44 1,044,480 -c–a-w C:\WINDOWS\system32\libdivx.dll
+ 2007-08-07 01:52:02 66,272 -c–a-w C:\WINDOWS\system32\libfaac.dll
- 2004-02-23 07:00:00 1,386,496 -c–a-w C:\WINDOWS\system32\msvbvm60.dll
+ 2004-02-23 09:42:40 1,386,496 -c–a-w C:\WINDOWS\system32\MSVBVM60.DLL
+ 2007-08-07 01:52:14 443,104 -c–a-w C:\WINDOWS\system32\OpenQuicktimeLib.dll
- 2007-11-08 22:18:04 71,302 -c–a-w C:\WINDOWS\system32\perfc009.dat
+ 2007-12-03 13:15:38 71,302 —-a-w C:\WINDOWS\system32\perfc009.dat
- 2007-11-08 22:18:04 439,598 -c–a-w C:\WINDOWS\system32\perfh009.dat
+ 2007-12-03 13:15:38 439,598 —-a-w C:\WINDOWS\system32\perfh009.dat
+ 2006-12-01 05:31:53 4,204 -c–a-w C:\WINDOWS\system32\pk.bin
+ 2007-06-08 03:46:44 86,070 -c–a-w C:\WINDOWS\system32\pthreadVC2.dll
- 2005-08-12 21:27:22 405,504 -c–a-w C:\WINDOWS\system32\Px.dll
+ 2007-09-28 16:07:48 551,672 -c—-w C:\WINDOWS\system32\Px.dll
- 2006-08-18 08:09:26 56,832 -c–a-w C:\WINDOWS\system32\pxcpya64.exe
+ 2007-09-28 16:07:48 66,296 -c—-w C:\WINDOWS\system32\pxcpya64.exe
- 2006-08-18 08:09:26 108,544 -c–a-w C:\WINDOWS\system32\pxcpyi64.exe
+ 2007-09-28 16:07:48 120,056 -c—-w C:\WINDOWS\system32\pxcpyi64.exe
- 2005-09-01 08:01:00 434,176 -c–a-w C:\WINDOWS\system32\pxdrv.dll
+ 2007-09-28 16:07:48 518,904 -c—-w C:\WINDOWS\system32\pxdrv.dll
- 2006-08-18 08:09:26 57,344 -c–a-w C:\WINDOWS\system32\pxhpinst.exe
+ 2007-09-28 16:07:50 72,440 -c—-w C:\WINDOWS\system32\pxhpinst.exe
- 2006-08-18 08:09:26 56,320 -c–a-w C:\WINDOWS\system32\pxinsa64.exe
+ 2007-09-28 16:07:48 64,760 -c—-w C:\WINDOWS\system32\pxinsa64.exe
- 2006-08-18 08:09:26 109,056 -c–a-w C:\WINDOWS\system32\pxinsi64.exe
+ 2007-09-28 16:07:48 118,520 -c—-w C:\WINDOWS\system32\pxinsi64.exe
- 2005-08-12 21:26:20 172,032 -c–a-w C:\WINDOWS\system32\PxMas.dll
+ 2007-09-28 16:07:50 187,128 -c—-w C:\WINDOWS\system32\PxMas.dll
- 2005-08-12 21:30:48 1,196,032 -c–a-w C:\WINDOWS\system32\PxSFS.DLL
+ 2007-09-28 16:07:50 1,628,920 -c—-w C:\WINDOWS\system32\PxSFS.DLL
- 2005-08-12 21:25:50 339,968 -c–a-w C:\WINDOWS\system32\PxWave.dll
+ 2007-09-28 16:07:50 379,640 -c—-w C:\WINDOWS\system32\PxWave.dll
+ 2007-09-28 16:07:52 3,596,288 -c–a-w C:\WINDOWS\system32\qt-dx331.dll
- 2007-11-16 07:17:31 95,128 -c–a-w C:\WINDOWS\system32\Restore\rstrlog.dat
+ 2007-12-02 23:10:13 31,984 -c–a-w C:\WINDOWS\system32\Restore\rstrlog.dat
+ 2007-08-07 01:52:50 25,312 -c–a-w C:\WINDOWS\system32\SamsungVfWCodec.dll
+ 2006-12-01 05:19:49 24,576 -c–a-w C:\WINDOWS\system32\scvhosthk.dll
+ 2006-12-01 05:19:49 40,960 -c–a-w C:\WINDOWS\system32\scvhostwb.dll
- 2007-04-17 05:47:36 33,624 -c–a-w C:\WINDOWS\system32\SoftwareDistribution\Setup\ServiceStartup\wups.dll\7.0.6000.374\wups.dll
+ 2007-04-16 11:47:36 33,624 -c–a-w C:\WINDOWS\system32\SoftwareDistribution\Setup\ServiceStartup\wups.dll\7.0.6000.374\wups.dll
+ 2007-04-16 11:45:20 43,352 -c–a-w C:\WINDOWS\system32\SoftwareDistribution\Setup\ServiceStartup\wups2.dll\7.0.6000.374\wups2.dll
- 2006-09-25 06:58:48 14,640 -c–a-w C:\WINDOWS\system32\spmsg.dll
+ 2006-09-15 16:02:34 14,640 -c—-w C:\WINDOWS\system32\spmsg.dll
+ 2004-06-07 05:00:00 68,608 -c–a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMCP6d.DLL
+ 2004-06-07 05:00:00 153,600 -c–a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMD56d.DLL
+ 2004-06-07 05:00:00 397,824 -c–a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMDR6d.DLL
+ 2004-06-07 05:00:00 19,456 -c–a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMFU6d.DLL
+ 2004-06-07 05:10:00 22,528 -c–a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMOP6d.DLL
+ 2004-06-07 05:00:00 23,280 -c–a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMP06d.DAT
+ 2004-06-07 05:00:00 27,140 -c–a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMP16d.DAT
+ 2004-06-07 05:00:00 30,320 -c–a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMP26d.DAT
+ 2004-06-07 05:00:00 6,656 -c–a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMPI6d.DLL
+ 2004-06-07 05:00:00 80,896 -c–a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMPV6d.EXE
+ 2004-06-07 05:00:00 850,944 -c–a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMSB6d.DLL
+ 2004-06-07 05:00:00 8,704 -c–a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMSD6d.EXE
+ 2004-06-07 05:00:00 130,048 -c–a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMSM6d.EXE
+ 2004-06-07 05:00:00 6,656 -c–a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMSQ6d.EXE
+ 2004-06-07 05:00:00 110,592 -c–a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMSR6d.DLL
+ 2004-06-07 05:00:00 322,048 -c–a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMUB6d.DLL
+ 2004-06-07 05:00:00 1,571,840 -c–a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMUI6d.DLL
+ 2004-06-07 05:00:00 219,648 -c–a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMUR6d.DLL
+ 2004-06-07 05:00:00 6,656 -c–a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMW36d.DLL
+ 2007-01-10 12:05:15 94,274 -c–a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBHEALR.DLL
+ 2007-01-10 12:05:15 40,960 -c–a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBMMON.DLL
+ 2007-01-10 12:05:16 659,528 -c–a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\HPCDMC32.DLL
+ 2007-01-10 12:05:17 58,368 -c–a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\HPDOMON.DLL
+ 2007-01-10 12:05:22 1,202,688 -c–a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\HPZ3A041.DLL
+ 2007-01-10 12:05:22 1,117,696 -c–a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\HPZ6R041.DLL
+ 2007-01-10 12:05:22 570,368 -c–a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\HPZEV041.DLL
+ 2007-01-10 12:05:22 61,952 -c–a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\HPZPP041.DLL
+ 2007-01-10 12:05:22 433,664 -c–a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\HPZSS041.DLL
+ 2007-01-10 12:05:22 2,337,280 -c–a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\HPZST041.DLL
+ 2007-01-10 12:05:22 1,907,200 -c–a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\HPZUI041.DLL
+ 2007-02-16 17:45:44 169,984 -c–a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\PCLXL.DLL
+ 2004-06-07 05:00:00 68,608 -c–a-w C:\WINDOWS\system32\spool\drivers\w32x86\canonip500008f7\CNMCP6d.DLL
+ 2004-06-07 05:00:00 153,600 -c–a-w C:\WINDOWS\system32\spool\drivers\w32x86\canonip500008f7\CNMD56d.DLL
+ 2004-06-07 05:00:00 397,824 -c–a-w C:\WINDOWS\system32\spool\drivers\w32x86\canonip500008f7\CNMDR6d.DLL
+ 2004-06-07 05:00:00 19,456 -c–a-w C:\WINDOWS\system32\spool\drivers\w32x86\canonip500008f7\CNMFU6d.DLL
+ 2004-06-07 05:10:00 22,528 -c–a-w C:\WINDOWS\system32\spool\drivers\w32x86\canonip500008f7\CNMOP6d.DLL
+ 2004-06-07 05:00:00 23,280 -c–a-w C:\WINDOWS\system32\spool\drivers\w32x86\canonip500008f7\CNMP06d.DAT
+ 2004-06-07 05:00:00 27,140 -c–a-w C:\WINDOWS\system32\spool\drivers\w32x86\canonip500008f7\CNMP16d.DAT
+ 2004-06-07 05:00:00 30,320 -c–a-w C:\WINDOWS\system32\spool\drivers\w32x86\canonip500008f7\CNMP26d.DAT
+ 2004-06-07 05:00:00 6,656 -c–a-w C:\WINDOWS\system32\spool\drivers\w32x86\canonip500008f7\CNMPI6d.DLL
+ 2004-06-07 05:00:00 80,896 -c–a-w C:\WINDOWS\system32\spool\drivers\w32x86\canonip500008f7\CNMPV6d.EXE
+ 2004-06-07 05:00:00 850,944 -c–a-w C:\WINDOWS\system32\spool\drivers\w32x86\canonip500008f7\CNMSB6d.DLL
+ 2004-06-07 05:00:00 8,704 -c–a-w C:\WINDOWS\system32\spool\drivers\w32x86\canonip500008f7\CNMSD6d.EXE
+ 2004-06-07 05:00:00 130,048 -c–a-w C:\WINDOWS\system32\spool\drivers\w32x86\canonip500008f7\CNMSM6d.EXE
+ 2004-06-07 05:00:00 6,656 -c–a-w C:\WINDOWS\system32\spool\drivers\w32x86\canonip500008f7\CNMSQ6d.EXE
+ 2004-06-07 05:00:00 110,592 -c–a-w C:\WINDOWS\system32\spool\drivers\w32x86\canonip500008f7\CNMSR6d.DLL
+ 2004-06-07 05:00:00 322,048 -c–a-w C:\WINDOWS\system32\spool\drivers\w32x86\canonip500008f7\CNMUB6d.DLL
+ 2004-06-07 05:00:00 1,571,840 -c–a-w C:\WINDOWS\system32\spool\drivers\w32x86\canonip500008f7\CNMUI6d.DLL
+ 2004-06-07 05:00:00 219,648 -c–a-w C:\WINDOWS\system32\spool\drivers\w32x86\canonip500008f7\CNMUR6d.DLL
+ 2004-06-07 05:00:00 6,656 -c–a-w C:\WINDOWS\system32\spool\drivers\w32x86\canonip500008f7\CNMW36d.DLL
+ 2004-06-07 05:00:00 17,920 -c–a-w C:\WINDOWS\system32\spool\prtprocs\w32x86\CNMPD6d.DLL
+ 2004-06-07 05:00:00 54,272 -c–a-w C:\WINDOWS\system32\spool\prtprocs\w32x86\CNMPP6d.DLL
+ 2007-09-28 16:07:44 200,704 -c–a-w C:\WINDOWS\system32\ssldivx.dll
+ 2007-03-21 09:54:16 77,312 -c–a-w C:\WINDOWS\system32\TWAIN_32.DLL
+ 2007-03-21 09:54:16 48,560 -c–a-w C:\WINDOWS\system32\TWUNK_16.EXE
+ 2007-03-21 09:54:16 69,632 -c–a-w C:\WINDOWS\system32\TWUNK_32.EXE
- 2005-08-12 08:00:00 28,672 -c–a-w C:\WINDOWS\system32\VXBLOCK.dll
+ 2007-09-28 16:07:48 88,824 -c—-w C:\WINDOWS\system32\VXBLOCK.dll
+ 2006-01-18 06:22:42 807,032 -c–a-w C:\WINDOWS\system32\wmv9dmod.dll
- 2007-04-17 05:45:48 549,720 -c–a-w C:\WINDOWS\system32\wuapi.dll
+ 2007-04-16 11:45:48 549,720 -c–a-w C:\WINDOWS\system32\wuapi.dll
- 2007-04-17 05:45:20 53,080 -c–a-w C:\WINDOWS\system32\wuauclt.exe
+ 2007-04-16 11:45:20 53,080 -c–a-w C:\WINDOWS\system32\wuauclt.exe
- 2007-04-17 05:45:54 1,710,936 —-a-w C:\WINDOWS\system32\wuaueng.dll
+ 2007-04-16 11:45:54 1,710,936 -c–a-w C:\WINDOWS\system32\wuaueng.dll
- 2007-04-17 05:45:42 325,976 -c–a-w C:\WINDOWS\system32\wucltui.dll
+ 2007-04-16 11:45:42 325,976 -c–a-w C:\WINDOWS\system32\wucltui.dll
- 2006-09-28 09:13:26 95,344 -c–a-w C:\WINDOWS\system32\WUDFCoinstaller.dll
+ 2006-09-15 12:30:16 87,040 -c–a-w C:\WINDOWS\system32\WUDFCoinstaller.dll
- 2006-09-28 07:56:38 146,432 -c–a-w C:\WINDOWS\system32\WudfHost.exe
+ 2006-09-15 12:30:06 142,848 -c–a-w C:\WINDOWS\system32\WudfHost.exe
- 2006-09-28 07:56:16 165,376 -c–a-w C:\WINDOWS\system32\WudfPlatform.dll
+ 2006-09-15 11:29:54 163,840 -c–a-w C:\WINDOWS\system32\WudfPlatform.dll
- 2006-09-28 07:56:14 55,808 -c–a-w C:\WINDOWS\system32\WudfSvc.dll
+ 2006-09-15 12:30:16 55,296 -c–a-w C:\WINDOWS\system32\WudfSvc.dll
+ 2007-03-20 00:37:46 831,048 -c–a-w C:\WINDOWS\system32\WudfUpdate_01005.dll
- 2006-09-28 07:56:38 316,416 -c–a-w C:\WINDOWS\system32\WUDFx.dll
+ 2006-09-15 12:30:16 308,224 -c–a-w C:\WINDOWS\system32\WUDFx.dll
- 2007-04-17 05:47:36 33,624 -c–a-w C:\WINDOWS\system32\wups.dll
+ 2007-04-16 11:47:36 33,624 -c–a-w C:\WINDOWS\system32\wups.dll
- 2007-04-17 05:45:20 43,352 —-a-w C:\WINDOWS\system32\wups2.dll
+ 2007-04-16 11:45:20 43,352 —-a-w C:\WINDOWS\system32\wups2.dll
- 2007-04-17 05:43:44 203,096 -c–a-w C:\WINDOWS\system32\wuweb.dll
+ 2007-04-16 11:45:36 203,096 -c–a-w C:\WINDOWS\system32\wuweb.dll
+ 1999-11-18 14:00:00 284,032 -c–a-w C:\WINDOWS\system32\XceedZip.dll
+ 2004-09-04 21:58:04 679,936 -c–a-w C:\WINDOWS\system32\xvidcore.dll
+ 2004-09-04 21:59:50 155,648 -c–a-w C:\WINDOWS\system32\xvidvfw.dll
+ 2003-03-25 07:53:50 11,776 -c–a-w C:\WINDOWS\system32\ZPORT4AS.dll
+ 2007-12-04 11:32:07 16,384 -c–atw C:\WINDOWS\Temp\Perflib_Perfdata_348.dat
+ 2007-12-02 02:53:24 417,792 -c–a-w C:\WINDOWS\uninstall\Satellite TV for PC Elite\setup.exe
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 23:00]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-11-09 17:36]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SDTray"="C:\Program Files\Spyware Doctor\SDTrayApp.exe" [2007-11-02 17:24]
"DSS"="C:\WINDOWS\NetMSConfig.exe" [2007-05-27 17:09]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 23:00]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-22 19:29]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-03-27 15:58]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [2007-07-24 08:18:49]
Adobe Reader Synchronizer.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2007-07-24 08:18:47]
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2006-08-18 18:50:44]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"disablecad"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"System"="lsass.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpfnf2]
notifyf2.dll 2005-07-06 17:45 28672 C:\WINDOWS\system32\notifyf2.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey]
tphklock.dll 2005-12-01 14:16 24576 C:\WINDOWS\system32\tphklock.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv]
C:\Program Files\Stardock\Object Desktop\WindowBlinds\wbsrv.dll 2007-12-01 16:20 229376 C:\Program Files\Stardock\Object Desktop\WindowBlinds\WbSrv.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Extension-List]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Extension-List\{00000000-0000-0000-0000-000000000000}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Extension-List\{c6dc5466-785a-11d2-84d0-00c04fb169f7}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\GPLink-List]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\GPLink-List\0]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\GPLink-List\1]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\GPLink-List\2]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\GPLink-List\3]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\GPLink-List\4]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\GPLink-List\5]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\GPO-List]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\GPO-List\0]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\GPO-List\1]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\GPO-List\2]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\GPO-List\3]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\GPO-List\4]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\GPO-List\5]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1292428093-1757981266-682003330-35769]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1292428093-1757981266-682003330-35769\Extension-List]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1292428093-1757981266-682003330-35769\Extension-List\{00000000-0000-0000-0000-000000000000}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1292428093-1757981266-682003330-35769\Extension-List\{c6dc5466-785a-11d2-84d0-00c04fb169f7}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1292428093-1757981266-682003330-35769\GPLink-List]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1292428093-1757981266-682003330-35769\GPLink-List\0]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1292428093-1757981266-682003330-35769\GPLink-List\1]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1292428093-1757981266-682003330-35769\GPLink-List\2]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1292428093-1757981266-682003330-35769\GPO-List]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1292428093-1757981266-682003330-35769\GPO-List\0]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1292428093-1757981266-682003330-35769\GPO-List\1]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1292428093-1757981266-682003330-35769\GPO-List\2]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1292428093-1757981266-682003330-35769\Loopback-GPLink-List]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1292428093-1757981266-682003330-35769\Loopback-GPO-List]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1292428093-1757981266-682003330-35769\Scripts]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1292428093-1757981266-682003330-35769\Scripts\Logoff]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1292428093-1757981266-682003330-35769\Scripts\Logon]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1292428093-1757981266-682003330-35769\Scripts\Logon\0]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1292428093-1757981266-682003330-35769\Scripts\Logon\0\0]
"Script"=stdlogon.vbs
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-23451335-341113855-1709847394-500]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-23451335-341113855-1709847394-500\Extension-List]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-23451335-341113855-1709847394-500\Extension-List\{00000000-0000-0000-0000-000000000000}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-23451335-341113855-1709847394-500\Extension-List\{c6dc5466-785a-11d2-84d0-00c04fb169f7}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-23451335-341113855-1709847394-500\GPLink-List]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-23451335-341113855-1709847394-500\GPLink-List\0]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-23451335-341113855-1709847394-500\GPO-List]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-23451335-341113855-1709847394-500\GPO-List\0]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-23451335-341113855-1709847394-500\Loopback-GPLink-List]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-23451335-341113855-1709847394-500\Loopback-GPO-List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
2005-06-06 23:46 57344 –a–c— C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup

R0 Shockprf;Shockprf;C:\WINDOWS\system32\drivers\Shockprf.sys
R1 ANC;ANC;C:\WINDOWS\system32\drivers\ANC.SYS
R1 IBMTPCHK;IBMTPCHK;\??\C:\WINDOWS\system32\Drivers\IBMBLDID.sys
R1 ShockMgr;ShockMgr;C:\WINDOWS\system32\drivers\ShockMgr.sys
R1 TPPWRIF;TPPWRIF;C:\WINDOWS\system32\drivers\Tppwrif.sys
R2 HopperP;WiFi Hopper;C:\WINDOWS\system32\DRIVERS\hopperp.sys
R2 ibmfilter;ibmfilter;\??\C:\WINDOWS\system32\drivers\ibmfilter.sys
R2 PrivateDisk;PrivateDisk;\??\C:\Program Files\IBM ThinkVantage\SafeGuard PrivateDisk\PrivateDiskM.sys
R2 smi2;smi2;\??\C:\Program Files\SMI2\smi2.sys
R3 AEAudioService;AEAudio Service;C:\WINDOWS\system32\drivers\AEAudio.sys
R3 atmeltpm;atmeltpm;C:\WINDOWS\system32\DRIVERS\atmeltpm.sys
S3 EraserUtilDrv10733;EraserUtilDrv10733;\??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilDrv10733.sys
S3 EraserUtilDrvI4;EraserUtilDrvI4;\??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilDrvI4.sys

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
\Shell\AutoRun\command - G:\setup.exe /autorun
\Shell\directx\command - G:\DirectX\dxsetup.exe
\Shell\setup\command - G:\setup.exe

.
Contents of the 'Scheduled Tasks' folder
"2007-12-01 01:06:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2007-12-04 11:33:59 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
"2007-11-19 05:59:01 C:\WINDOWS\Tasks\PMTask.job"
- C:\PROGRA~1\ThinkPad\UTILIT~1\PWMIDTSK.EXE
.
**************************************************************************

catchme 0.3.1318 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-04 22:34:21
Windows 5.1.2600 Service Pack 2 NTFS

detected NTDLL code modification:
ZwClose

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-04 22:36:03 - machine was rebooted
C:\ComboFix2.txt … 2007-11-18 08:58
C:\ComboFix3.txt … 2007-11-16 21:55
.
— E O F —


Logfile of HijackThis v1.99.1
Scan saved at 22:56, on 2007-12-04
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\IPSSVC.EXE
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\System32\TPHDEXLG.EXE
C:\Program Files\IBM ThinkVantage\Client Security Solution\ibmtcsd.exe
C:\Program Files\IBM ThinkVantage\Rescue and Recovery\rrservice.exe
C:\Program Files\IBM ThinkVantage\Common\Scheduler\tvtsched.exe
C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.balwynhs.vic.edu.au/home/home.bhs
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.balwynhs.vic.edu.au:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.balwynhs.vic.edu.au;172.*;*.education.vic.gov.au;*.sofweb.vic.edu.au;*.vass.vi
c.edu.au;*.eduweb.vic.gov.au;*.edudev.vic.gov.au;*.edumail.vic.gov.au;*.otte.vic.
gov.au;*.icon.edu.vic.gov.au;*.ultranet.vic.edu.au;*.vcaa.vic.edu.au;;*.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKLM\..\Run: [DSS] C:\WINDOWS\NetMSConfig.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Software Installer - {D1A4DEBD-C2EE-449f-B9FB-E8409F9A0BC5} - C:\Program Files\Lenovo\PkgMgr\\PkgMgr.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O11 - Options group: [JAVA_IBM] Java (IBM)
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (CDownloadCtrl Object) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.6.108.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1185221205500
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = balwynhs.vic.edu.au
O17 - HKLM\Software\..\Telephony: DomainName = balwynhs.vic.edu.au
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll
O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: tpfnf2 - C:\WINDOWS\SYSTEM32\notifyf2.dll
O20 - Winlogon Notify: tphotkey - C:\WINDOWS\SYSTEM32\tphklock.dll
O20 - Winlogon Notify: WBSrv - C:\Program Files\Stardock\Object Desktop\WindowBlinds\wbsrv.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ac Profile Manager Service (AcPrfMgrSvc) - Unknown owner - C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe (file missing)
O23 - Service: Access Connections Main Service (AcSvc) - Lenovo - C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - Unknown owner - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: ThinkPad PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\system32\ibmpmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: IPS Core Service (IPSSVC) - Lenovo Group Limited - C:\WINDOWS\system32\IPSSVC.EXE
O23 - Service: IBM PSA Access Driver Control (PsaSrv) - Unknown owner - C:\WINDOWS\system32\PsaSrv.exe (file missing)
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: ThinkPad HDD APS Logging Service (TPHDEXLGSVC) - Lenovo. - C:\WINDOWS\System32\TPHDEXLG.EXE
O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe (file missing)
O23 - Service: TSS Core Service (TSSCoreService) - IBM - C:\Program Files\IBM ThinkVantage\Client Security Solution\ibmtcsd.exe
O23 - Service: TVT Backup Service - Unknown owner - C:\Program Files\IBM ThinkVantage\Rescue and Recovery\rrservice.exe
O23 - Service: TVT Scheduler - Unknown owner - C:\Program Files\IBM ThinkVantage\Common\Scheduler\tvtsched.exe
O23 - Service: ThinkVantage System Update (UCLauncherService) - Unknown owner - C:\Program Files\ThinkVantage\SystemUpdate\UCLauncherService.exe (file missing)

My combofix log:

ComboFix 07-12-02.7 - LIN0056 2007-12-05 16:50:09.5 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.139 [GMT 11:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\lin0056\Desktop\CFScript.txt
* Created a new restore point

FILE
C:\WINDOWS\jetctrl.dll
C:\WINDOWS\kopmet.dll
C:\WINDOWS\NetMSConfig.exe
C:\WINDOWS\nretcip.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\jetctrl.dll
C:\WINDOWS\kopmet.dll
C:\WINDOWS\NetMSConfig.exe
C:\WINDOWS\nretcip.exe

.
((((((((((((((((((((((((( Files Created from 2007-11-05 to 2007-12-05 )))))))))))))))))))))))))))))))
.

2007-12-04 19:54 . 2007-12-04 19:54 17,542 —h-c— C:\DriveIcon.ico
2007-12-04 19:50 . 2007-12-04 23:14 d—-c— C:\Program Files\Bee Icons
2007-12-04 16:54 . 2007-12-04 16:55 d—-c— C:\Program Files\AnyReader
2007-12-04 09:20 . 2007-12-04 09:20 d—-c— C:\Program Files\VideoLAN
2007-12-04 09:15 . 2007-12-04 09:15 d—-c— C:\Program Files\XviD
2007-12-04 09:08 . 2007-12-04 09:08 d—-c— C:\Program Files\DScaler5
2007-12-04 08:58 . 2007-12-04 08:58 d—-c— C:\Program Files\3ivx
2007-12-04 08:50 . 2007-12-04 15:38 d—-c— C:\Documents and Settings\lin0056\Application Data\DivX
2007-12-04 08:48 . 2007-09-29 03:07 129,784 —–c— C:\WINDOWS\system32\pxafs.dll
2007-12-04 08:48 . 2007-09-29 03:07 9,464 —–c— C:\WINDOWS\system32\drivers\cdralw2k.sys
2007-12-04 08:48 . 2007-09-29 03:07 9,336 —–c— C:\WINDOWS\system32\drivers\cdr4_xp.sys
2007-12-04 08:34 . 2007-12-04 08:48 d—-c— C:\Program Files\DivX
2007-12-04 08:31 . 2007-12-04 08:31 d—-c— C:\Documents and Settings\lin0056\Application Data\Nokia Multimedia Player
2007-12-04 08:30 . 2007-12-04 08:31 54,156 –ah-c— C:\WINDOWS\QTFont.qfn
2007-12-04 08:30 . 2007-12-04 08:31 1,409 –a–c— C:\WINDOWS\QTFont.for
2007-12-04 00:36 . 2007-12-04 00:36 d—-c— C:\Program Files\ElcomSoft
2007-12-04 00:17 . 2007-12-04 00:17 d—-c— C:\Documents and Settings\lin0056\Application Data\Leadertech
2007-12-03 23:25 . 2007-12-03 23:25 d—-c— C:\Documents and Settings\All Users\Application Data\Nokia
2007-12-03 23:23 . 2007-02-22 11:15 137,216 –a–c— C:\WINDOWS\system32\drivers\nmwcd.sys
2007-12-03 23:23 . 2007-02-22 11:15 65,536 –a–c— C:\WINDOWS\system32\nmwcdcocls.dll
2007-12-03 22:36 . 2007-12-03 22:38 d—-c— C:\Documents and Settings\All Users\Application Data\PC Suite
2007-12-03 22:35 . 2007-12-03 22:38 d—-c— C:\Documents and Settings\lin0056\Application Data\Nokia
2007-12-03 22:34 . 2007-12-03 22:35 d—-c— C:\Program Files\DIFX
2007-12-03 22:34 . 2007-12-03 22:34 d—-c— C:\Program Files\Common Files\PCSuite
2007-12-03 22:34 . 2007-12-05 16:25 d—-c— C:\Program Files\Common Files\Nokia
2007-12-03 22:34 . 2007-12-03 23:19 d—-c— C:\Documents and Settings\lin0056\Application Data\PC Suite
2007-12-03 22:33 . 2007-12-03 22:33 d—-c— C:\Program Files\PC Connectivity Solution
2007-12-03 22:33 . 2007-12-03 23:42 d—-c— C:\Program Files\Nokia
2007-12-03 22:33 . 2007-02-22 11:15 90,624 –a–c— C:\WINDOWS\system32\nmwcdcls.dll
2007-12-03 22:24 . 2007-12-03 22:24 d—-c— C:\Documents and Settings\All Users\Application Data\Installations
2007-12-03 22:21 . 2007-12-03 22:21 d–hsc— C:\WINDOWS\ftpcache
2007-12-03 22:02 . 2007-12-03 22:02 d—-c— C:\Documents and Settings\lin0056\Application Data\AdobeUM
2007-12-03 22:02 . 2007-12-03 22:02 d—-c— C:\Documents and Settings\lin0056\Application Data\AdobeAUM
2007-12-03 18:27 . 2007-12-03 18:56 d—-c— C:\Program Files\Download Direct
2007-12-03 17:37 . 2007-12-03 17:37 d–h-c— C:\WINDOWS\system32\GroupPolicy
2007-12-03 17:03 . 2007-12-03 17:04 d—-c— C:\Program Files\RichVideoCodec
2007-12-03 11:21 . 2007-12-03 11:21 244 –ah-c— C:\sqmnoopt00.sqm
2007-12-03 11:21 . 2007-12-03 11:21 232 –ah-c— C:\sqmdata00.sqm
2007-12-03 06:04 . 2007-12-03 06:05 d—-c— C:\Program Files\Date Cracker 2000
2007-12-03 06:04 . 2007-12-03 06:04 73,216 –a–c— C:\WINDOWS\temp.000
2007-12-02 22:53 . 2007-12-02 22:53 d—-c— C:\Documents and Settings\All Users\Application Data\FLEXnet
2007-12-02 13:54 . 2007-12-02 14:15 d—-c— C:\Program Files\TVAnts
2007-12-02 13:53 . 2007-12-02 13:53 d—-c— C:\WINDOWS\uninstall\Satellite TV for PC Elite
2007-12-02 13:53 . 2007-12-02 13:53 d—-c— C:\WINDOWS\uninstall
2007-12-02 13:53 . 2007-12-02 13:53 d—-c— C:\Program Files\SatelliteTVforPC
2007-12-02 13:11 . 2007-12-02 13:11 d—-c— C:\Documents and Settings\lin0056\Application Data\TVU Networks
2007-12-02 10:56 . 2007-12-02 10:56 d—-c— C:\Program Files\smr-usenet
2007-12-02 10:56 . 2001-03-29 01:38 69,632 –a–c— C:\WINDOWS\system32\GkSui18.EXE
2007-12-02 09:45 . 2007-12-02 09:45 d—-c— C:\Documents and Settings\lin0056\Application Data\ZipZag
2007-12-02 09:44 . 2007-12-02 09:46 d—-c— C:\Program Files\ZipZag
2007-12-01 20:20 . 2007-12-04 09:23 d—-c— C:\Documents and Settings\lin0056\Application Data\vlc
2007-12-01 20:17 . 2007-12-02 13:12 d—-c— C:\Program Files\TVU Player
2007-12-01 16:35 . 2007-12-01 16:43 d—-c— C:\WINDOWS\system32\dt
2007-12-01 16:29 . 2007-12-01 16:29 0 –a–c— C:\WINDOWS\WB.ini
2007-12-01 15:48 . 2007-12-01 15:48 d—-c— C:\WINDOWS\{hopper}
2007-12-01 15:48 . 2007-12-03 10:01 d—-c— C:\Program Files\WiFi Hopper
2007-12-01 15:48 . 2006-05-31 02:36 21,376 –a–c— C:\WINDOWS\system32\drivers\hopperp.sys
2007-12-01 15:14 . 2007-12-01 15:14 103 –a–c— C:\WINDOWS\system32\msrcom.dat
2007-12-01 12:31 . 2001-06-11 22:15 115,016 –a–c— C:\WINDOWS\system32\Msinet.ocx
2007-12-01 09:44 . 2007-12-01 09:44 d—-c— C:\Program Files\Download Manager
2007-12-01 09:43 . 2007-12-01 11:23 d—-c— C:\Documents and Settings\lin0056\Application Data\IGN_DLM
2007-12-01 00:43 . 2007-12-01 00:43 479,298 –a–c— C:\WINDOWS\system32\wbocx.ocx
2007-12-01 00:43 . 2007-12-01 00:43 172,032 –a–c— C:\WINDOWS\system32\AniGIF.ocx
2007-12-01 00:43 . 2007-12-01 00:43 50,688 –a–c— C:\WINDOWS\system32\wbhelp2.dll
2007-11-30 21:37 . 2007-11-30 21:37 d—-c— C:\Program Files\GameSpot
2007-11-30 20:17 . 2007-11-30 20:17 d—-c— C:\Program Files\Uconomix
2007-11-30 17:00 . 2007-11-30 17:18 d—-c— C:\Program Files\Spyware Doctor
2007-11-30 17:00 . 2007-11-30 17:00 d—-c— C:\Documents and Settings\lin0056\Application Data\PC Tools
2007-11-30 17:00 . 2007-10-18 00:16 79,688 –a–c— C:\WINDOWS\system32\drivers\iksyssec.sys
2007-11-30 17:00 . 2007-10-18 00:15 62,280 –a–c— C:\WINDOWS\system32\drivers\iksysflt.sys
2007-11-30 17:00 . 2007-10-18 00:14 41,288 –a–c— C:\WINDOWS\system32\drivers\ikfilesec.sys
2007-11-30 17:00 . 2007-10-18 00:16 29,000 –a–c— C:\WINDOWS\system32\drivers\kcom.sys
2007-11-30 16:59 . 2005-09-23 08:29 626,688 –a–c— C:\WINDOWS\system32\msvcr80.dll
2007-11-30 13:40 . 2007-12-01 15:15 160,564,119 –a–c— C:\WINDOWS\system32\mfccache.dll
2007-11-29 20:41 . 2007-11-29 20:58 d—-c— C:\Program Files\Hide The IP
2007-11-29 20:28 . 2007-12-01 22:40 d—-c— C:\Documents and Settings\lin0056\Application Data\LimeWire
2007-11-29 20:27 . 2007-11-29 20:27 d—-c— C:\Program Files\LimeWire
2007-11-29 18:52 . 2007-11-29 18:55 d—-c— C:\Documents and Settings\lin0056\Application Data\XP Visual Tools
2007-11-29 18:50 . 2007-12-03 16:56 d-a–c— C:\Documents and Settings\All Users\Application Data\TEMP
2007-11-29 12:49 . 2007-11-29 18:58 d—-c— C:\Program Files\Common Files\Stardock
2007-11-29 11:52 . 2007-12-04 23:15 d—-c— C:\Program Files\Stardock
2007-11-29 11:52 . 2007-07-11 15:06 42,672 –a–c— C:\WINDOWS\system32\wbsys.dll
2007-11-29 11:52 . 2005-01-22 18:05 20,480 –a–c— C:\WINDOWS\system32\wbload.dll
2007-11-29 08:57 . 2007-11-29 09:15 d—-c— C:\Program Files\GameSpy Arcade
2007-11-28 15:16 . 2007-11-28 15:16 d—-c— C:\WINDOWS\.jagex_cache_32
2007-11-24 19:16 . 2007-11-25 11:39 d—-c— C:\Program Files\Halo Server
2007-11-24 16:41 . 2007-11-24 16:41 d—-c— C:\Documents and Settings\LocalService\Application Data\Xfire
2007-11-24 09:34 . 2007-11-24 09:34 54 –a–c— C:\WINDOWS\Composer.INI
2007-11-24 09:33 . 2007-11-28 20:54 d—-c— C:\Program Files\Notation
2007-11-24 08:21 . 2007-11-24 08:21 d—-c— C:\Documents and Settings\All Users\Application Data\Musicnotes
2007-11-21 17:03 . 2007-11-22 17:22 d—-c— C:\WINDOWS\system32\ActiveScan
2007-11-21 17:03 . 2007-11-22 16:22 30,590 –a–c— C:\WINDOWS\system32\pavas.ico
2007-11-21 17:03 . 2007-11-22 16:22 2,550 –a–c— C:\WINDOWS\system32\Uninstall.ico
2007-11-21 17:03 . 2007-11-22 16:22 1,406 –a–c— C:\WINDOWS\system32\Help.ico
2007-11-20 22:24 . 2007-11-20 22:24 552 –a–c— C:\WINDOWS\system32\d3d8caps.dat
2007-11-20 17:25 . 2007-11-20 17:25 d—-c— C:\Program Files\CEDP Stealer 6.0 for Messenger
2007-11-20 11:40 . 2007-11-20 11:40 d—-c— C:\Documents and Settings\lin0056\Application Data\InterVideo
2007-11-19 21:39 . 2004-08-03 23:01 25,856 –a–c— C:\WINDOWS\system32\drivers\usbprint.sys
2007-11-19 21:39 . 2004-08-03 23:01 25,856 –a–c— C:\WINDOWS\system32\dllcache\usbprint.sys
2007-11-19 21:37 . 2004-06-07 16:00 116,736 –a–c— C:\WINDOWS\system32\CNMLM6d.DLL

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-19 19:18 5,427 -c–a-w C:\WINDOWS\system32\EGATHDRV.SYS
2007-12-05 06:01 ——— dc—-w C:\Program Files\Symantec AntiVirus
2007-12-04 12:14 19 -c-h–w C:\Program Files\desktop.ini
2007-12-03 14:28 ——— dc—-w C:\Program Files\Common Files\Adobe
2007-12-02 19:04 249,856 -c—-w C:\WINDOWS\Setup1.exe
2007-11-30 10:37 5,588 -c–a-w C:\Program Files\install.log
2007-11-22 06:14 ——— dc—-w C:\Program Files\Windows Defender
2007-11-22 06:04 ——— dc—-w C:\Program Files\Google
2007-11-22 06:04 ——— dc—-w C:\Program Files\Digital Line Detect
2007-11-22 06:00 ——— dc—-w C:\Program Files\Common Files\Symantec Shared
2007-11-09 11:58 ——— dc-h–w C:\Program Files\InstallShield Installation Information
2007-11-08 01:18 ——— dc—-w C:\Program Files\Windows Media Connect
2007-11-08 01:13 ——— dc—-w C:\Program Files\Microsoft Works
2007-11-07 05:09 ——— dc—-w C:\Program Files\Picasa2
2007-10-21 16:39 267,272 -c–a-w C:\WINDOWS\system32\xactengine2_10.dll
2007-10-21 16:37 17,928 -c–a-w C:\WINDOWS\system32\X3DAudio1_2.dll
2007-10-18 00:31 51,224 -c–a-w C:\WINDOWS\system32\sirenacm.dll
2007-10-12 12:19 13,653,824 -c–a-w C:\WINDOWS\system32\xlivefnt.dll
2007-10-12 12:19 10,155,840 -c–a-w C:\WINDOWS\system32\xlive.dll
2007-10-12 04:14 3,734,536 -c–a-w C:\WINDOWS\system32\d3dx9_36.dll
2007-10-12 04:14 1,374,232 -c–a-w C:\WINDOWS\system32\D3DCompiler_36.dll
2007-10-01 22:56 444,776 -c–a-w C:\WINDOWS\system32\d3dx10_36.dll
2007-09-28 16:08 156,992 -c–a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2007-09-28 16:07 524,288 -c–a-w C:\WINDOWS\system32\DivXsm.exe
2007-09-28 16:07 3,596,288 -c–a-w C:\WINDOWS\system32\qt-dx331.dll
2007-09-28 16:07 200,704 -c–a-w C:\WINDOWS\system32\ssldivx.dll
2007-09-28 16:07 120,056 -c—-w C:\WINDOWS\system32\pxcpyi64.exe
2007-09-28 16:07 118,520 -c—-w C:\WINDOWS\system32\pxinsi64.exe
2007-09-28 16:07 1,044,480 -c–a-w C:\WINDOWS\system32\libdivx.dll
2007-09-28 16:05 823,296 -c–a-w C:\WINDOWS\system32\divx_xx0c.dll
2007-09-28 16:05 823,296 -c–a-w C:\WINDOWS\system32\divx_xx07.dll
2007-09-28 16:05 81,920 -c–a-w C:\WINDOWS\system32\dpl100.dll
2007-09-28 16:05 802,816 -c–a-w C:\WINDOWS\system32\divx_xx11.dll
2007-09-28 16:05 739,840 -c–a-w C:\WINDOWS\system32\DivX.dll
2007-09-28 16:05 593,920 -c–a-w C:\WINDOWS\system32\dpuGUI11.dll
2007-09-28 16:05 57,344 -c–a-w C:\WINDOWS\system32\dpv11.dll
2007-09-28 16:05 53,248 -c–a-w C:\WINDOWS\system32\dpuGUI10.dll
2007-09-28 16:05 344,064 -c–a-w C:\WINDOWS\system32\dpus11.dll
2007-09-28 16:05 294,912 -c–a-w C:\WINDOWS\system32\dpu11.dll
2007-09-28 16:05 294,912 -c–a-w C:\WINDOWS\system32\dpu10.dll
2007-09-28 16:05 196,608 -c–a-w C:\WINDOWS\system32\dtu100.dll
2007-09-28 16:05 12,288 -c–a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2006-05-30 15:36 21,376 -c–a-w C:\WINDOWS\inf\hopperp.sys
2007-07-23 21:37 32,768 -csha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat
.

((((((((((((((((((((((((((((( snapshot_2007-12-04_22.35.14.85 )))))))))))))))))))))))))))))))))))))))))
.
- 2006-12-19 21:52:18 8,453,632 -c–a-w C:\WINDOWS\system32\dllcache\shell32.dll
+ 2007-10-26 03:34:01 8,460,288 -c–a-w C:\WINDOWS\system32\dllcache\shell32.dll
- 2006-12-19 21:52:18 8,453,632 —-a-w C:\WINDOWS\system32\shell32.dll
+ 2007-10-26 03:34:01 8,460,288 -c–a-w C:\WINDOWS\system32\shell32.dll
- 2007-06-19 07:24:36 350,720 —-a-w C:\WINDOWS\system32\xpsp3res.dll
+ 2007-10-29 10:04:03 350,720 -c–a-w C:\WINDOWS\system32\xpsp3res.dll
+ 2007-12-05 05:04:10 16,384 -c–atw C:\WINDOWS\Temp\Perflib_Perfdata_5dc.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 23:00]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-11-09 17:36]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SDTray"="C:\Program Files\Spyware Doctor\SDTrayApp.exe" [2007-11-02 17:24]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 23:00]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-22 19:29]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-03-27 15:58]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [2007-07-24 08:18:49]
Adobe Reader Synchronizer.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2007-07-24 08:18:47]
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2006-08-18 18:50:44]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"disablecad"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"System"="lsass.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpfnf2]
notifyf2.dll 2005-07-06 17:45 28672 C:\WINDOWS\system32\notifyf2.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey]
tphklock.dll 2005-12-01 14:16 24576 C:\WINDOWS\system32\tphklock.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv]
C:\Program Files\Stardock\Object Desktop\WindowBlinds\wbsrv.dll 2007-12-01 16:20 229376 C:\Program Files\Stardock\Object Desktop\WindowBlinds\WbSrv.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Extension-List]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Extension-List\{00000000-0000-0000-0000-000000000000}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Extension-List\{c6dc5466-785a-11d2-84d0-00c04fb169f7}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\GPLink-List]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\GPLink-List\0]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\GPLink-List\1]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\GPLink-List\2]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\GPLink-List\3]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\GPLink-List\4]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\GPLink-List\5]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\GPO-List]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\GPO-List\0]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\GPO-List\1]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\GPO-List\2]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\GPO-List\3]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\GPO-List\4]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\GPO-List\5]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1292428093-1757981266-682003330-35769]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1292428093-1757981266-682003330-35769\Extension-List]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1292428093-1757981266-682003330-35769\Extension-List\{00000000-0000-0000-0000-000000000000}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1292428093-1757981266-682003330-35769\Extension-List\{c6dc5466-785a-11d2-84d0-00c04fb169f7}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1292428093-1757981266-682003330-35769\GPLink-List]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1292428093-1757981266-682003330-35769\GPLink-List\0]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1292428093-1757981266-682003330-35769\GPLink-List\1]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1292428093-1757981266-682003330-35769\GPLink-List\2]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1292428093-1757981266-682003330-35769\GPO-List]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1292428093-1757981266-682003330-35769\GPO-List\0]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1292428093-1757981266-682003330-35769\GPO-List\1]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1292428093-1757981266-682003330-35769\GPO-List\2]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1292428093-1757981266-682003330-35769\Loopback-GPLink-List]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1292428093-1757981266-682003330-35769\Loopback-GPO-List]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1292428093-1757981266-682003330-35769\Scripts]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1292428093-1757981266-682003330-35769\Scripts\Logoff]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1292428093-1757981266-682003330-35769\Scripts\Logon]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1292428093-1757981266-682003330-35769\Scripts\Logon\0]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1292428093-1757981266-682003330-35769\Scripts\Logon\0\0]
"Script"=stdlogon.vbs
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-23451335-341113855-1709847394-500]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-23451335-341113855-1709847394-500\Extension-List]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-23451335-341113855-1709847394-500\Extension-List\{00000000-0000-0000-0000-000000000000}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-23451335-341113855-1709847394-500\Extension-List\{c6dc5466-785a-11d2-84d0-00c04fb169f7}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-23451335-341113855-1709847394-500\GPLink-List]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-23451335-341113855-1709847394-500\GPLink-List\0]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-23451335-341113855-1709847394-500\GPO-List]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-23451335-341113855-1709847394-500\GPO-List\0]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-23451335-341113855-1709847394-500\Loopback-GPLink-List]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-23451335-341113855-1709847394-500\Loopback-GPO-List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
2005-06-06 23:46 57344 –a–c— C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2004-08-04 23:00 15360 –a—— C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2007-11-09 17:36 68856 –a—— C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

R0 Shockprf;Shockprf;C:\WINDOWS\system32\drivers\Shockprf.sys
R1 ANC;ANC;C:\WINDOWS\system32\drivers\ANC.SYS
R1 IBMTPCHK;IBMTPCHK;\??\C:\WINDOWS\system32\Drivers\IBMBLDID.sys
R1 ShockMgr;ShockMgr;C:\WINDOWS\system32\drivers\ShockMgr.sys
R1 TPPWRIF;TPPWRIF;C:\WINDOWS\system32\drivers\Tppwrif.sys
R2 HopperP;WiFi Hopper;C:\WINDOWS\system32\DRIVERS\hopperp.sys
R2 ibmfilter;ibmfilter;\??\C:\WINDOWS\system32\drivers\ibmfilter.sys
R2 PrivateDisk;PrivateDisk;\??\C:\Program Files\IBM ThinkVantage\SafeGuard PrivateDisk\PrivateDiskM.sys
R2 smi2;smi2;\??\C:\Program Files\SMI2\smi2.sys
R3 AEAudioService;AEAudio Service;C:\WINDOWS\system32\drivers\AEAudio.sys
R3 atmeltpm;atmeltpm;C:\WINDOWS\system32\DRIVERS\atmeltpm.sys
S3 EraserUtilDrv10733;EraserUtilDrv10733;\??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilDrv10733.sys

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
\Shell\AutoRun\command - G:\setup.exe /autorun
\Shell\directx\command - G:\DirectX\dxsetup.exe
\Shell\setup\command - G:\setup.exe

.
Contents of the 'Scheduled Tasks' folder
"2007-12-01 01:06:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2007-12-05 05:58:08 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
"2007-11-19 05:59:01 C:\WINDOWS\Tasks\PMTask.job"
- C:\PROGRA~1\ThinkPad\UTILIT~1\PWMIDTSK.EXE
.
**************************************************************************

catchme 0.3.1318 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-05 17:01:11
Windows 5.1.2600 Service Pack 2 NTFS

detected NTDLL code modification:
ZwClose

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-05 17:05:47 - machine was rebooted
C:\ComboFix2.txt … 2007-12-04 22:36
C:\ComboFix3.txt … 2007-11-18 08:58
.
— E O F —


its quite long, heres my hijackthis log:


Logfile of HijackThis v1.99.1
Scan saved at 17:08, on 2007-12-05
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\IPSSVC.EXE
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\System32\TPHDEXLG.EXE
C:\Program Files\IBM ThinkVantage\Client Security Solution\ibmtcsd.exe
C:\Program Files\IBM ThinkVantage\Rescue and Recovery\rrservice.exe
C:\Program Files\IBM ThinkVantage\Common\Scheduler\tvtsched.exe
C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.balwynhs.vic.edu.au/home/home.bhs
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.balwynhs.vic.edu.au:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.balwynhs.vic.edu.au;172.*;*.education.vic.gov.au;*.sofweb.vic.edu.au;*.vass.vi
c.edu.au;*.eduweb.vic.gov.au;*.edudev.vic.gov.au;*.edumail.vic.gov.au;*.otte.vic.
gov.au;*.icon.edu.vic.gov.au;*.ultranet.vic.edu.au;*.vcaa.vic.edu.au;;*.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Software Installer - {D1A4DEBD-C2EE-449f-B9FB-E8409F9A0BC5} - C:\Program Files\Lenovo\PkgMgr\\PkgMgr.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O11 - Options group: [JAVA_IBM] Java (IBM)
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (CDownloadCtrl Object) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.6.108.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1185221205500
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = balwynhs.vic.edu.au
O17 - HKLM\Software\..\Telephony: DomainName = balwynhs.vic.edu.au
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll
O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: tpfnf2 - C:\WINDOWS\SYSTEM32\notifyf2.dll
O20 - Winlogon Notify: tphotkey - C:\WINDOWS\SYSTEM32\tphklock.dll
O20 - Winlogon Notify: WBSrv - C:\Program Files\Stardock\Object Desktop\WindowBlinds\wbsrv.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ac Profile Manager Service (AcPrfMgrSvc) - Unknown owner - C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe (file missing)
O23 - Service: Access Connections Main Service (AcSvc) - Lenovo - C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - Unknown owner - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: ThinkPad PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\system32\ibmpmsvc.exe
O23 - Service: IPS Core Service (IPSSVC) - Lenovo Group Limited - C:\WINDOWS\system32\IPSSVC.EXE
O23 - Service: IBM PSA Access Driver Control (PsaSrv) - Unknown owner - C:\WINDOWS\system32\PsaSrv.exe (file missing)
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: ThinkPad HDD APS Logging Service (TPHDEXLGSVC) - Lenovo. - C:\WINDOWS\System32\TPHDEXLG.EXE
O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe (file missing)
O23 - Service: TSS Core Service (TSSCoreService) - IBM - C:\Program Files\IBM ThinkVantage\Client Security Solution\ibmtcsd.exe
O23 - Service: TVT Backup Service - Unknown owner - C:\Program Files\IBM ThinkVantage\Rescue and Recovery\rrservice.exe
O23 - Service: TVT Scheduler - Unknown owner - C:\Program Files\IBM ThinkVantage\Common\Scheduler\tvtsched.exe
O23 - Service: ThinkVantage System Update (UCLauncherService) - Unknown owner - C:\Program Files\ThinkVantage\SystemUpdate\UCLauncherService.exe (file missing)

thanks.