[Resolved] SuperJuan Virus

So, I've got ZoneAlarm Security Suite with Anti-Virus and Firewall, and also running on Windows XP using the Opera Browser (Just to let you guys know.)

I've recently been experiencing some slowdowns and a few crashes, and ran a virusscan with ZoneAlarm.

Bam! Found 'em.

So I deleted THREE with the similar names with SuperJuan in them.

Did one again. What do you know? They're back. So, I need some help. I really don't like having viruses of any kind on my computer, so I wanna get rid of these ASAP. Also, recently, even though I have my Automatic Updates set to the Automatic setting, I have a small 'Windows Security Alerts' icon in the bottom right toolbar next to my Clock saying that it's off. This troubles me a bit, especially because the virus may be disabling my updates (I don't know, just guessing.) If I'm right, that's not good at all.

Finally, just today, upon booting up, my explorer.exe didn't load… I manually started it using the Ctrl-Alt-Delete menu, not even thinking of viruses, and nothing else seemed wrong. This only happened once and other recent boot-ups have been fine.

Here's my most recent HijackThis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:31:39 PM, on 11/10/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\UAService7.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\UltraVNC\winvnc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\WINDOWS\ALCMTR.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Razer\razerhid.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\DOCUMENTS AND SETTINGS\NAME.MONSTER\DESKTOP\FRAPS\FRAPS.EXE
C:\WINDOWS\service.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Razer\razertra.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Razer\razerofa.exe
C:\Program Files\Hewlett-Packard\AiO\hp officejet g series\Bin\hpoavn07.exe
C:\Program Files\ZyXEL\ZyXEL G-220 v2 Wireless Adapter Utility\ZyXEL G-220 v2.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Xfire\xfire.exe
C:\PROGRA~1\HEWLET~1\AiO\Shared\Bin\hpoevm07.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOSTS07.exe
C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOFXM07.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe
C:\Program Files\Opera\opera.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 143.205.172.11:3127
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O1 - Hosts: 96.227.244.38 wackawacka.servegame.org
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAudPropShortcut.exe
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [MolCp Monitor] C:\Documents and Settings\Name.MONSTER\My Documents\My Kool Stuff\monitor.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [razer] C:\Program Files\Razer\razerhid.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Windows Service] service.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [44881377] rundll32.exe "C:\WINDOWS\system32\bkwdktmr.dll",b
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" –force_start_minimized
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [updateMgr] c:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [Fraps] C:\DOCUMENTS AND SETTINGS\NAME.MONSTER\DESKTOP\FRAPS\FRAPS.EXE
O4 - HKCU\..\Run: [EA Core] C:\Program Files\Electronic Arts\EADM\Core.exe -silent
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Startup: PowerReg Scheduler.exe
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HPAiODevice(hp officejet g series) - 1.lnk = C:\Program Files\Hewlett-Packard\AiO\hp officejet g series\Bin\hpoavn07.exe
O4 - Global Startup: ZyXEL G-220 v2 Wireless Adapter Utility.lnk = ?
O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: vzTCPConfig - http://www2.verizon.net/help/fios_settings…vzTCPConfig.CAB
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=48835
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/dev/packages/GSManager.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.0.97.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m…96/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by101fd.bay101.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {A2E05F45-F127-4092-B9F7-9A02C3E04C77} (HGPlugin7USA Class) - http://gamedownload.ijjimax.com/gamedownlo…GPlugin7USA.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur…loadManager.ocx
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/m…,26/mcgdmgr.cab
O16 - DPF: {DB7BF79A-FC51-4B5A-92BC-A65731174380} (InstantAction Game Launcher) - http://www.instantaction.com/download/iaplayer.cab
O20 - AppInit_DLLs: wbsys.dll rbzjvx.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Update Service (gupdate1c8ea5eb3336758) (gupdate1c8ea5eb3336758) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MONyog - Unknown owner - C:\Program Files\MONyog\bin\MONyog.exe (file missing)
O23 - Service: MySQL - Unknown owner - C:\Program.exe (file missing)
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - Unknown owner - C:\Program Files\Spyware Doctor\pctsAuxs.exe (file missing)
O23 - Service: PC Tools Security Service (sdCoreService) - Unknown owner - C:\Program Files\Spyware Doctor\pctsSvc.exe (file missing)
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: VNC Server (winvnc) - UltraVNC - C:\Program Files\UltraVNC\winvnc.exe

–
End of file - 11693 bytes




Thank you very much for helping, and I hope you read this soon. =)


Note: This has already been posted on the Tech Support Guy Forums.

P.S. If I need to, please tell me how to start in Safe Mode. =)

Log from ComboFix:

ComboFix 08-11-10.01 - Name 2008-11-11 15:15:07.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.617 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Name.MONSTER\Local Settings\Temporary Internet Files\ijjistarter_verinfo.dat
c:\program files\ZyXEL\ZyXEL G-220 v2 Wireless Adapter Utility\_desktop.ini
c:\windows\admintxt.txt
c:\windows\IE4 Error Log.txt
c:\windows\service.exe
c:\windows\system32\_desktop.ini
c:\windows\system32\awttusro.dll
c:\windows\system32\drivers\_desktop.ini
c:\windows\system32\eKkQWvut.ini
c:\windows\system32\eKkQWvut.ini2
c:\windows\system32\kjxrpurf.ini
c:\windows\system32\mlJYSJDu.dll
c:\windows\system32\pmnmJBTl.dll
c:\windows\system32\rmtkdwkb.ini
c:\windows\system32\tuvWQkKe.dll
c:\windows\system32\yayvVPHw.dll

.
((((((((((((((((((((((((( Files Created from 2008-10-11 to 2008-11-11 )))))))))))))))))))))))))))))))
.

2008-11-11 15:06 . 2008-11-11 15:07 d——– c:\program files\ERUNT
2008-11-10 19:57 . 2008-11-10 19:57 d——– c:\program files\Trend Micro
2008-11-09 20:32 . 2008-11-10 17:48 70,144 –a—— c:\windows\system32\bkwdktmr.dll.vzr
2008-11-09 20:29 . 2008-11-09 20:29 103,424 –a—— c:\windows\system32\rbzjvx.dll.vzr
2008-11-09 19:22 . 2008-11-09 19:22 d——– c:\program files\NHN USA
2008-11-09 11:54 . 2008-04-23 14:02 157,152 –a—— c:\windows\system32\PubPlugin.dll
2008-11-08 21:16 . 2008-11-08 21:18 d——– c:\program files\Teamspeak2_RC2
2008-10-31 14:58 . 2008-10-31 14:58 0 –a—— C:\LHT33C.tmp
2008-10-29 20:24 . 2008-10-29 20:24 42,320 –a—— c:\windows\system32\xfcodec.dll
2008-10-29 19:37 . 2008-11-07 15:14 d——– c:\documents and settings\Name.MONSTER\Application Data\MailFrontier
2008-10-29 19:26 . 2008-10-09 13:25 1,221,008 –a—— c:\windows\system32\zpeng25.dll
2008-10-29 19:17 . 2008-10-29 19:18 49,676 –a—— c:\documents and settings\Name.MONSTER\java_plugin.exe
2008-10-17 21:14 . 2008-10-17 21:15 d——– c:\program files\iTunes
2008-10-17 21:14 . 2008-10-17 21:15 d——– c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-10-17 21:12 . 2008-10-18 10:36 d——– c:\program files\Bonjour
2008-10-17 21:10 . 2008-10-17 21:12 d——– c:\program files\QuickTime
2008-10-15 14:05 . 2008-07-18 21:07 270,880 –a—— c:\windows\system32\mucltui.dll
2008-10-15 14:05 . 2008-07-18 21:07 210,976 –a—— c:\windows\system32\muweb.dll
2008-10-15 14:05 . 2008-07-18 21:07 29,728 –a—— c:\windows\system32\mucltui.dll.mui
2008-10-14 19:37 . 2008-10-15 14:05 d——– c:\documents and settings\Name.MONSTER\Contacts
2008-10-14 19:32 . 2008-10-29 20:16 d——– c:\program files\Windows Live
2008-10-14 19:32 . 2008-10-14 19:36 d–hsc— c:\program files\Common Files\WindowsLiveInstaller
2008-10-14 19:31 . 2008-10-14 19:31 d——– c:\documents and settings\All Users\Application Data\WLInstaller
2008-10-14 15:09 . 2008-10-14 15:09 d——– c:\documents and settings\All Users\Application Data\Blizzard
2008-10-14 14:35 . 2008-10-21 14:26 d——– c:\program files\Copy of World of Warcraft
2008-10-13 19:40 . 2008-10-13 19:40 d——– c:\program files\Vstplugins
2008-10-13 19:40 . 2008-10-13 19:40 d——– c:\documents and settings\All Users\Application Data\Sony

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-11 20:25 63,877,664 –sha-w c:\windows\system32\drivers\fidbox.dat
2008-11-11 20:25 ——— d—–w c:\program files\Steam
2008-11-11 20:22 30,573 —-a-w c:\windows\system32\drivers\mlnmtwdm.log
2008-11-11 20:21 850,484 –sha-w c:\windows\system32\drivers\fidbox.idx
2008-11-11 19:57 ——— d—–w c:\documents and settings\Name.MONSTER\Application Data\Image Zone Express
2008-11-10 01:39 ——— d–h–w c:\documents and settings\Name.MONSTER\Application Data\ijjigame
2008-11-08 21:20 ——— d—–w c:\program files\Google
2008-11-08 16:32 ——— d—–w c:\program files\World of Warcraft
2008-11-08 16:23 ——— d—–w c:\program files\Warcraft III
2008-11-08 04:35 2,990,592 —-a-w c:\windows\Internet Logs\xDB2A.tmp
2008-11-06 20:21 ——— d—–w c:\program files\Xfire
2008-11-06 03:10 146,201 —-a-w c:\windows\Internet Logs\vsmon_2nd_2008_11_05_22_09_40_small.dmp.zip
2008-11-05 04:08 2,435,072 —-a-w c:\windows\Internet Logs\xDB61C.tmp
2008-11-05 04:08 145,979 —-a-w c:\windows\Internet Logs\vsmon_2nd_2008_11_04_23_08_07_small.dmp.zip
2008-11-04 23:43 ——— d—–w c:\documents and settings\Name.MONSTER\Application Data\Xfire
2008-11-01 02:01 ——— d—–w c:\documents and settings\All Users\Application Data\Google Updater
2008-10-29 02:32 2,337,280 —-a-w c:\windows\Internet Logs\xDB29.tmp
2008-10-20 02:36 187,904 —-a-w c:\windows\Internet Logs\xDB28.tmp
2008-10-18 02:14 ——— d—–w c:\program files\iPod
2008-10-18 02:11 ——— d—–w c:\program files\Common Files\Apple
2008-10-16 02:49 706,048 —-a-w c:\windows\Internet Logs\xDB26.tmp
2008-10-16 02:49 2,311,680 —-a-w c:\windows\Internet Logs\xDB27.tmp
2008-10-14 19:15 ——— d–h–w c:\program files\InstallShield Installation Information
2008-10-14 02:13 ——— d—a-w c:\documents and settings\All Users\Application Data\TEMP
2008-10-14 01:35 ——— d—–w c:\program files\Common Files\Symantec Shared
2008-10-14 00:40 ——— d—–w c:\program files\Sony
2008-10-09 18:25 73,104 —-a-w c:\windows\zllsputility.exe
2008-10-08 20:47 ——— d—–w c:\documents and settings\Name.MONSTER\Application Data\GarageGames
2008-10-06 19:14 ——— d—–w c:\program files\Ascentive
2008-10-06 19:11 ——— d—–w c:\program files\DivX
2008-09-28 21:03 ——— d—–w c:\documents and settings\Name.MONSTER\Application Data\Hamachi
2008-09-28 19:36 25,280 —-a-w c:\windows\system32\drivers\hamachi.sys
2008-09-27 18:26 ——— d—–w c:\documents and settings\Name.MONSTER\Application Data\Sony
2008-09-27 13:14 ——— d—–w c:\documents and settings\Name.MONSTER\Application Data\Publish Providers
2008-09-27 02:50 ——— d—–w c:\program files\Sony Setup
2008-09-23 02:52 126,976 —-a-w c:\windows\Internet Logs\xDB25.tmp
2008-09-22 22:08 ——— d—–w c:\program files\Lavalys
2008-09-19 01:57 847,872 —-a-w c:\windows\Internet Logs\xDB24.tmp
2008-09-17 19:16 2,145,792 —-a-w c:\windows\Internet Logs\xDB23.tmp
2008-09-15 11:57 1,846,016 —-a-w c:\windows\system32\win32k.sys
2008-09-14 23:17 ——— d—–w c:\program files\Maple Story
2008-09-01 20:09 2,003,968 —-a-w c:\windows\Internet Logs\xDB303.tmp
2008-08-30 21:39 0 —-a-w c:\documents and settings\Name.MONSTER\jagex_runescape_preferences.dat
2008-08-29 14:18 87,336 —-a-w c:\windows\system32\dns-sd.exe
2008-08-29 13:53 61,440 —-a-w c:\windows\system32\dnssd.dll
2008-08-26 07:24 826,368 —-a-w c:\windows\system32\wininet.dll
2008-08-24 14:37 24,136,184 —-a-w c:\windows\Internet Logs\tvDebug.zip
2008-08-22 04:02 105,984 —-a-w c:\windows\Internet Logs\xDB22.tmp
2008-08-20 03:37 1,316,352 —-a-w c:\windows\Internet Logs\xDB21.tmp
2008-08-17 20:21 1,976,320 —-a-w c:\windows\Internet Logs\xDB20.tmp
2008-08-14 09:58 2,136,064 —-a-w c:\windows\system32\ntoskrnl.exe
2008-08-14 09:22 2,015,744 —-a-w c:\windows\system32\ntkrnlpa.exe
2008-04-19 13:09 952 –sha-w c:\documents and settings\All Users\Application Data\KGyGaAvL.sys
2008-04-19 13:09 88 –sh–r c:\documents and settings\All Users\Application Data\826A01B8B3.sys
2005-12-07 16:30 32 —-a-r c:\documents and settings\All Users\hash.dat
2005-11-16 00:48 0 —-a-w c:\documents and settings\Name\WoW-1.7.1.4695-to-1.8.0-enUS-patch.exe
2005-07-28 13:45 171,796 —-a-w c:\documents and settings\Name\stub.exe
2005-12-09 21:14 56 –sh–r c:\windows\system32\9D8DD8A2B0.sys
2007-03-24 00:10 88 –sh–r c:\windows\system32\B0A2D88D9D.sys
2007-03-24 00:10 4,704 –sha-w c:\windows\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"Steam"="c:\program files\steam\steam.exe" [2008-10-08 1410296]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-26 68856]
"Fraps"="c:\documents and settings\NAME.MONSTER\DESKTOP\FRAPS\FRAPS.EXE" [2005-06-15 2793472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-06-06 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-06-06 118784]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-06-16 221184]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-06-16 81920]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 132496]
"razer"="c:\program files\Razer\razerhid.exe" [2005-05-17 147456]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-09-25 90112]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 49152]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-07-09 36352]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-10-01 289576]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-10-09 981904]
"SoundMan"="SOUNDMAN.EXE" [2004-07-01 c:\windows\SOUNDMAN.EXE]
"High Definition Audio Property Page Shortcut"="HDAudPropShortcut.exe" [2004-03-17 c:\windows\system32\Hdaudpropshortcut.exe]
"AlcWzrd"="ALCWZRD.EXE" [2004-07-05 c:\windows\ALCWZRD.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2006-10-04 c:\windows\system32\narrator.exe]

c:\documents and settings\Name.MONSTER\Start Menu\Programs\Startup\
PowerReg Scheduler.exe [2005-07-23 256000]
Xfire.lnk - c:\program files\Xfire\xfire.exe [2008-10-29 3104080]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Google Updater.lnk - c:\program files\Google\Google Updater\GoogleUpdater.exe [2007-08-31 161264]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-01-02 210520]
HPAiODevice(hp officejet g series) - 1.lnk - c:\program files\Hewlett-Packard\AiO\hp officejet g series\Bin\hpoavn07.exe [2002-11-20 151552]
ZyXEL G-220 v2 Wireless Adapter Utility.lnk - c:\program files\ZyXEL\ZyXEL G-220 v2 Wireless Adapter Utility\ZyXEL G-220 v2.exe [2007-10-19 10891264]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WB]
2001-12-21 00:34 24576 c:\program files\AlienGUIse\fastload.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=wbsys.dll rbzjvx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.avis"= ff_acm.acm
"VIDC.XFR1"= xfcodec.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, zwebauth.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Warcraft III\\Frozen Throne.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2007-01-04 24652]
R2 ZDCNDIS5;ZDCNDIS5 NDIS Protocol Driver;c:\windows\system32\ZDCNDIS5.sys [2006-08-17 19072]
R3 mlnmtwdm;TransportMidi WDM Driver;c:\windows\system32\Drivers\mlnmtwdm.sys [2005-08-02 45056]
R3 Razerlow;Razerlow USB Filter Driver;c:\windows\system32\Drivers\Razerlow.sys [2005-04-24 13225]
R3 ZG760_XP;ZyXEL 802.11g XG762 1211 Driver;c:\windows\system32\DRIVERS\WlanGZXP.sys [2006-08-17 402944]
S2 gupdate1c8ea5eb3336758;Google Update Service (gupdate1c8ea5eb3336758);c:\program files\Google\Update\GoogleUpdate.exe [2008-09-02 133104]
S2 MONyog;MONyog;c:\program files\MONyog\bin\MONyog.exe [ ]
S3 CEDRIVER53;CEDRIVER53;c:\program files\Cheat Engine\dbk32.sys [ ]
S3 dump_wmimmc;dump_wmimmc;c:\ijji\ENGLISH\Gunz\GameGuard\dump_wmimmc.sys [ ]
S3 EverestDriver;Lavalys EVEREST Kernel Driver;c:\program files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt [2008-09-04 23152]
S3 geebers12;geebers12;c:\documents and settings\Name.MONSTER\Desktop\blorbslayerengine\nvid888.sys [ ]
S3 SS1022;Siemens SpeedStream Wireless USB Driver;c:\windows\system32\DRIVERS\SSUSBN51.sys [ ]
S3 XDva007;XDva007;c:\windows\system32\XDva007.sys [ ]
S3 XDva032;XDva032;c:\windows\system32\XDva032.sys [ ]
S3 XDva120;XDva120;c:\windows\system32\XDva120.sys [ ]
S3 xp1;xp1;c:\documents and settings\Name.MONSTER\Desktop\xpengine\xp.sys [ ]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\Shell\AutoRun\command - E:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1c04d864-48e5-11dc-a98f-000f3d04244a}]
\Shell\AutoRun\command - E:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{af41fbd9-d651-11db-a8f5-000f3d04244a}]
\Shell\AutoRun\command - E:\LaunchU3.exe -a
.
Contents of the 'Scheduled Tasks' folder

2008-11-08 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2008-11-11 c:\windows\Tasks\GoogleUpdateTaskMachine.job
- c:\program files\Google\Update\GoogleUpdate.exe [2008-09-02 14:11]

2008-11-07 c:\windows\Tasks\Norton Security Scan for Name.job
- c:\program files\Norton Security Scan\Nss.exe []

2008-11-07 c:\windows\Tasks\Norton Security Scan.job
- c:\program files\Norton Security Scan\Nss.exe []
.
- - - - ORPHANS REMOVED - - - -

BHO-{9950772D-AF73-4AEA-80B6-C251EC40EA30} - c:\windows\system32\mlJYSJDu.dll
BHO-{AAE14803-5440-46B5-B8C2-1931BF854A56} - c:\windows\system32\tuvWQkKe.dll
BHO-{be0a1b78-3adc-433d-9eac-13fb7dd23d8c} - c:\windows\system32\rbzjvx.dll
HKCU-Run-BitTorrent - c:\program files\BitTorrent\bittorrent.exe
HKCU-Run-updateMgr - c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe
HKCU-Run-EA Core - c:\program files\Electronic Arts\EADM\Core.exe
HKCU-Run-MsnMsgr - c:\program files\Windows Live\Messenger\MsnMsgr.Exe
HKLM-Run-MolCp Monitor - c:\documents and settings\Name.MONSTER\My Documents\My Kool Stuff\monitor.exe
HKLM-Run-44881377 - c:\windows\system32\bkwdktmr.dll
ShellExecuteHooks-{9950772D-AF73-4AEA-80B6-C251EC40EA30} - c:\windows\system32\mlJYSJDu.dll


.
——- Supplementary Scan ——-
.
FireFox -: Profile - c:\documents and settings\Name.MONSTER\Application Data\Mozilla\Firefox\Profiles\uh3hw8iy.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.aniwow.xaurora.com/forums/
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-11 15:23:13
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\EverestDriver]
"ImagePath"="\??\c:\program files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt"

[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\MySQL]
"ImagePath"="\"c:\program files\MySQL\MySQL Server 6.0\bin\mysqld\" –defaults-file=\"c:\program files\MySQL\MySQL Server 6.0\my.ini\" MySQL"
.
———————— Other Running Processes ————————
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\PSIService.exe
c:\windows\system32\UAService7.exe
c:\program files\UltraVNC\winvnc.exe
c:\program files\Viewpoint\Viewpoint Manager\ViewMgr.exe
c:\program files\ATI Technologies\ATI.ACE\CLI.exe
c:\program files\Razer\razertra.exe
c:\program files\Razer\razerofa.exe
c:\windows\system32\wscntfy.exe
c:\progra~1\HEWLET~1\AiO\Shared\Bin\hpoevm07.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Hewlett-Packard\AiO\Shared\Bin\hposts07.exe
c:\program files\Hewlett-Packard\AiO\Shared\Bin\hpofxm07.exe
c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\agent.exe
c:\program files\ATI Technologies\ATI.ACE\CLI.exe
c:\program files\ATI Technologies\ATI.ACE\CLI.exe
.
**************************************************************************
.
Completion time: 2008-11-11 15:34:55 - machine was rebooted [Name]
ComboFix-quarantined-files.txt 2008-11-11 20:34:50

Pre-Run: 18,358,104,064 bytes free
Post-Run: 21,294,190,592 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

287 — E O F — 2008-11-03 04:01:10


Uninstall list:

32 Bit HP CIO Components Installer
Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)
Adobe Flash Player ActiveX
Adobe Reader 8.1.2
Adobe Shockwave Player
AlienGUIse
Apple Mobile Device Support
Apple Software Update
Ask Toolbar
ATI - Software Uninstall Utility
ATI Catalyst Control Center
ATI Display Driver
Bonjour
EA Download Manager
ERUNT 1.1j
EVEREST Ultimate Edition v4.60
ffdshow
Fraps (remove only)
Free YouTube to Mp3 Converter version 3.1
Garry's Mod
Google Toolbar for Internet Explorer
Google Toolbar for Internet Explorer
Google Update
Google Updater
GraphicsGale FreeEdition version 1.82
Guild Wars
Half-Life 2
Half-Life 2: Episode One
Half-Life 2: Episode Two
Half-Life® 2
High Definition Audio Driver Package - KB835221
HijackThis 2.0.2
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB914440)
Hotfix for Windows XP (KB915865)
Hotfix for Windows XP (KB926239)
Hotfix for Windows XP (KB952287)
HP Customer Participation Program 8.0
HP Deskjet All-In-One Software 8.0
HP Imaging Device Functions 8.0
hp officejet g series
HP Photosmart Essential
HP Solution Center 8.0
HP Update
HPSSupply
ijji - Gunz
ijji Auto Installer
Intel® Graphics Media Accelerator Driver
Intel® PRO Network Adapters and Drivers
iPod for Windows 2005-10-12
iTunes
J2SE Runtime Environment 5.0 Update 10
J2SE Runtime Environment 5.0 Update 6
J2SE Runtime Environment 5.0 Update 9
Java 2 Runtime Environment, SE v1.4.2
Java™ 6 Update 3
Line Rider Theater Screensaver
Little Fighter 2 1.9c
Lively by Google
MapleStory
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0 Service Pack 1
Microsoft .NET Framework 3.0
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft GIF Animator
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office Standard Edition 2003
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
mIRC
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 Parser and SDK
MSXML 6.0 Parser (KB933579)
MSXML4 Parser
Norton Security Scan
Norton Security Scan (Symantec Corporation)
Opera 9.50
Paint.NET v2.72
Portal
PowerDVD
QuickTime
Razer
Realtek High Definition Audio Driver
RGSS-RTP Standard
Rhapsody Player Engine
RPG Maker VX
RPG Maker VX RTP
S4 League
Security Update for Windows Internet Explorer 7 (KB928090)
Security Update for Windows Internet Explorer 7 (KB929969)
Security Update for Windows Internet Explorer 7 (KB931768)
Security Update for Windows Internet Explorer 7 (KB933566)
Security Update for Windows Internet Explorer 7 (KB937143)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Media Encoder (KB954156)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 10 (KB911565)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893066)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896422)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB896688)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899588)
Security Update for Windows XP (KB899589)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB905915)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB908531)
Security Update for Windows XP (KB911280)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911567)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912812)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913446)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB916281)
Security Update for Windows XP (KB917159)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB918899)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920214)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB921503)
Security Update for Windows XP (KB921883)
Security Update for Windows XP (KB922616)
Security Update for Windows XP (KB922760)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB923694)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925486)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB933729)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
Security Update for Windows XP (KB936021)
Security Update for Windows XP (KB937894)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB938829)
Security Update for Windows XP (KB941202)
Security Update for Windows XP (KB941568)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB941644)
Security Update for Windows XP (KB941693)
Security Update for Windows XP (KB943055)
Security Update for Windows XP (KB943460)
Security Update for Windows XP (KB943485)
Security Update for Windows XP (KB944653)
Security Update for Windows XP (KB945553)
Security Update for Windows XP (KB946026)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB948590)
Security Update for Windows XP (KB948881)
Security Update for Windows XP (KB950749)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB958644)
SHOUTcast Source DSP 1.9.0 (remove only)
Softnyx Launcher
Sony Vegas Pro 8.0
Spyware Doctor 5.5
Steam
System Requirements Lab
Team Fortress 2
TeamSpeak 2 RC2
TES Construction Set
Theme Manager
Ultr@VNC Release 1.0.0 RC 11b - Win32
Uninstall 1.0.0.1
Update for Windows XP (KB894391)
Update for Windows XP (KB896727)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB904942)
Update for Windows XP (KB910437)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB925720)
Update for Windows XP (KB927891)
Update for Windows XP (KB929338)
Update for Windows XP (KB930916)
Update for Windows XP (KB931836)
Update for Windows XP (KB932823-v3)
Update for Windows XP (KB933360)
Update for Windows XP (KB936357)
Update for Windows XP (KB938828)
Update for Windows XP (KB942763)
Update for Windows XP (KB951072-v2)
Valve Hammer Editor
VC 9.0 Runtime
Ventrilo Client
Ventrilo Server
Viewpoint Manager (Remove Only)
Viewpoint Media Player
Winamp
Winamp Remote
Winamp Toolbar for Internet Explorer
Windows Communication Foundation
Windows Imaging Component
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Live installer
Windows Media Encoder 9 Series
Windows Media Encoder 9 Series
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player 11
Windows Presentation Foundation
Windows Workflow Foundation
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887742
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891781
Windows XP Hotfix - KB893086
WinRAR archiver
World of Warcraft
Xfire (remove only)
ZoneAlarm Security Suite
ZyXEL G-220 v2 Wireless Adapter Utility

HijackThis scanning log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:44:09 PM, on 11/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\UAService7.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\UltraVNC\winvnc.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Razer\razerhid.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\DOCUMENTS AND SETTINGS\NAME.MONSTER\DESKTOP\FRAPS\FRAPS.EXE
C:\Program Files\Razer\razertra.exe
C:\Program Files\Razer\razerofa.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Hewlett-Packard\AiO\hp officejet g series\Bin\hpoavn07.exe
C:\Program Files\ZyXEL\ZyXEL G-220 v2 Wireless Adapter Utility\ZyXEL G-220 v2.exe
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\HEWLET~1\AiO\Shared\Bin\hpoevm07.exe
c:\program files\common files\installshield\updateservice\isuspm.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOSTS07.exe
C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOFXM07.exe
C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\agent.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Opera\opera.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 143.205.172.11:3127
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAudPropShortcut.exe
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [razer] C:\Program Files\Razer\razerhid.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Fraps] C:\DOCUMENTS AND SETTINGS\NAME.MONSTER\DESKTOP\FRAPS\FRAPS.EXE
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Startup: PowerReg Scheduler.exe
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HPAiODevice(hp officejet g series) - 1.lnk = C:\Program Files\Hewlett-Packard\AiO\hp officejet g series\Bin\hpoavn07.exe
O4 - Global Startup: ZyXEL G-220 v2 Wireless Adapter Utility.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: vzTCPConfig - http://www2.verizon.net/help/fios_settings…vzTCPConfig.CAB
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=48835
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/dev/packages/GSManager.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.0.97.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m…96/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by101fd.bay101.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {A2E05F45-F127-4092-B9F7-9A02C3E04C77} (HGPlugin7USA Class) - http://gamedownload.ijjimax.com/gamedownlo…GPlugin7USA.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur…loadManager.ocx
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/m…,26/mcgdmgr.cab
O16 - DPF: {DB7BF79A-FC51-4B5A-92BC-A65731174380} (InstantAction Game Launcher) - http://www.instantaction.com/download/iaplayer.cab
O20 - AppInit_DLLs: wbsys.dll rbzjvx.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Update Service (gupdate1c8ea5eb3336758) (gupdate1c8ea5eb3336758) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MONyog - Unknown owner - C:\Program Files\MONyog\bin\MONyog.exe (file missing)
O23 - Service: MySQL - Unknown owner - C:\Program.exe (file missing)
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - Unknown owner - C:\Program Files\Spyware Doctor\pctsAuxs.exe (file missing)
O23 - Service: PC Tools Security Service (sdCoreService) - Unknown owner - C:\Program Files\Spyware Doctor\pctsSvc.exe (file missing)
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: VNC Server (winvnc) - UltraVNC - C:\Program Files\UltraVNC\winvnc.exe

–
End of file - 10707 bytes



Hope this helps. =D

P.S. Thanks a lot for taking time to help me. =)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:47:23 PM, on 11/13/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\UAService7.exe
C:\Program Files\UltraVNC\winvnc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Razer\razerhid.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Razer\razertra.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Razer\razerofa.exe
C:\DOCUMENTS AND SETTINGS\NAME.MONSTER\DESKTOP\MY KOOL STUFF\LOGS\SCHTUFF-O!\NOTHING\FRAPS\FRAPS.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Hewlett-Packard\AiO\hp officejet g series\Bin\hpoavn07.exe
C:\Program Files\ZyXEL\ZyXEL G-220 v2 Wireless Adapter Utility\ZyXEL G-220 v2.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Xfire\xfire.exe
C:\PROGRA~1\HEWLET~1\AiO\Shared\Bin\hpoevm07.exe
C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOSTS07.exe
C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOFXM07.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Opera\opera.exe
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wscntfy.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 143.205.172.11:3127
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAudPropShortcut.exe
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [razer] C:\Program Files\Razer\razerhid.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Fraps] C:\DOCUMENTS AND SETTINGS\NAME.MONSTER\DESKTOP\MY KOOL STUFF\LOGS\SCHTUFF-O!\NOTHING\FRAPS\FRAPS.EXE
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Startup: PowerReg Scheduler.exe
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HPAiODevice(hp officejet g series) - 1.lnk = C:\Program Files\Hewlett-Packard\AiO\hp officejet g series\Bin\hpoavn07.exe
O4 - Global Startup: ZyXEL G-220 v2 Wireless Adapter Utility.lnk = ?
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: vzTCPConfig - http://www2.verizon.net/help/fios_settings…vzTCPConfig.CAB
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=48835
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/dev/packages/GSManager.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.0.97.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m…96/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by101fd.bay101.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {A2E05F45-F127-4092-B9F7-9A02C3E04C77} (HGPlugin7USA Class) - http://gamedownload.ijjimax.com/gamedownlo…GPlugin7USA.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur…loadManager.ocx
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/m…,26/mcgdmgr.cab
O16 - DPF: {DB7BF79A-FC51-4B5A-92BC-A65731174380} (InstantAction Game Launcher) - http://www.instantaction.com/download/iaplayer.cab
O20 - AppInit_DLLs: wbsys.dll rbzjvx.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Update Service (gupdate1c8ea5eb3336758) (gupdate1c8ea5eb3336758) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: MONyog - Unknown owner - C:\Program Files\MONyog\bin\MONyog.exe (file missing)
O23 - Service: MySQL - Unknown owner - C:\Program.exe (file missing)
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - Unknown owner - C:\Program Files\Spyware Doctor\pctsAuxs.exe (file missing)
O23 - Service: PC Tools Security Service (sdCoreService) - Unknown owner - C:\Program Files\Spyware Doctor\pctsSvc.exe (file missing)
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: VNC Server (winvnc) - UltraVNC - C:\Program Files\UltraVNC\winvnc.exe

–
End of file - 10669 bytes





ComboFix Results



ComboFix 08-11-11.01 - Name 2008-11-13 14:59:01.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.577 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Name.MONSTER\Desktop\CFScript.txt
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2008-10-13 to 2008-11-13 )))))))))))))))))))))))))))))))
.

2008-11-13 14:53 . 2008-11-13 14:53 d——– c:\windows\LastGood
2008-11-11 17:01 . 2008-11-11 17:01 d——– c:\program files\MSXML 6.0
2008-11-11 16:59 . 2008-11-11 16:59 d——– c:\program files\MSXML 4.0
2008-11-11 15:06 . 2008-11-11 15:07 d——– c:\program files\ERUNT
2008-11-10 19:57 . 2008-11-10 19:57 d——– c:\program files\Trend Micro
2008-11-09 20:32 . 2008-11-10 17:48 70,144 –a—— c:\windows\system32\bkwdktmr.dll.vzr
2008-11-09 20:29 . 2008-11-09 20:29 103,424 –a—— c:\windows\system32\rbzjvx.dll.vzr
2008-11-09 19:22 . 2008-11-09 19:22 d——– c:\program files\NHN USA
2008-11-09 11:54 . 2008-04-23 14:02 157,152 –a—— c:\windows\system32\PubPlugin.dll
2008-11-08 21:16 . 2008-11-08 21:18 d——– c:\program files\Teamspeak2_RC2
2008-10-31 14:58 . 2008-10-31 14:58 0 –a—— C:\LHT33C.tmp
2008-10-29 20:24 . 2008-10-29 20:24 42,320 –a—— c:\windows\system32\xfcodec.dll
2008-10-29 19:37 . 2008-11-07 15:14 d——– c:\documents and settings\Name.MONSTER\Application Data\MailFrontier
2008-10-29 19:26 . 2008-10-09 13:25 1,221,008 –a—— c:\windows\system32\zpeng25.dll
2008-10-29 19:17 . 2008-10-29 19:18 49,676 –a—— c:\documents and settings\Name.MONSTER\java_plugin.exe
2008-10-17 21:14 . 2008-10-17 21:15 d——– c:\program files\iTunes
2008-10-17 21:14 . 2008-10-17 21:15 d——– c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-10-17 21:12 . 2008-10-18 10:36 d——– c:\program files\Bonjour
2008-10-17 21:10 . 2008-10-17 21:12 d——– c:\program files\QuickTime
2008-10-15 14:05 . 2008-10-16 14:06 268,648 –a—— c:\windows\system32\mucltui.dll
2008-10-15 14:05 . 2008-10-16 14:06 208,744 –a—— c:\windows\system32\muweb.dll
2008-10-15 14:05 . 2008-10-16 14:06 27,496 –a—— c:\windows\system32\mucltui.dll.mui
2008-10-14 19:37 . 2008-10-15 14:05 d——– c:\documents and settings\Name.MONSTER\Contacts
2008-10-14 19:32 . 2008-10-29 20:16 d——– c:\program files\Windows Live
2008-10-14 19:32 . 2008-10-14 19:36 d–hsc— c:\program files\Common Files\WindowsLiveInstaller
2008-10-14 19:31 . 2008-10-14 19:31 d——– c:\documents and settings\All Users\Application Data\WLInstaller
2008-10-14 15:09 . 2008-10-14 15:09 d——– c:\documents and settings\All Users\Application Data\Blizzard
2008-10-14 14:35 . 2008-10-21 14:26 d——– c:\program files\Copy of World of Warcraft
2008-10-13 19:40 . 2008-10-13 19:40 d——– c:\program files\Vstplugins
2008-10-13 19:40 . 2008-10-13 19:40 d——– c:\documents and settings\All Users\Application Data\Sony

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-13 20:02 75,491,616 –sha-w c:\windows\system32\drivers\fidbox.dat
2008-11-13 19:51 ——— d—–w c:\program files\Steam
2008-11-13 19:48 30,968 —-a-w c:\windows\system32\drivers\mlnmtwdm.log
2008-11-13 03:03 996,764 –sha-w c:\windows\system32\drivers\fidbox.idx
2008-11-12 20:13 ——— d—–w c:\program files\Viewpoint
2008-11-12 20:13 ——— d—–w c:\documents and settings\All Users\Application Data\Viewpoint
2008-11-12 20:03 ——— d—–w c:\program files\Java
2008-11-12 19:59 ——— d—–w c:\program files\Xfire
2008-11-11 20:28 ——— d—–w c:\documents and settings\Name.MONSTER\Application Data\Xfire
2008-11-11 19:57 ——— d—–w c:\documents and settings\Name.MONSTER\Application Data\Image Zone Express
2008-11-10 01:39 ——— d–h–w c:\documents and settings\Name.MONSTER\Application Data\ijjigame
2008-11-08 21:20 ——— d—–w c:\program files\Google
2008-11-08 16:32 ——— d—–w c:\program files\World of Warcraft
2008-11-08 16:23 ——— d—–w c:\program files\Warcraft III
2008-11-08 04:35 2,990,592 —-a-w c:\windows\Internet Logs\xDB2A.tmp
2008-11-06 03:10 146,201 —-a-w c:\windows\Internet Logs\vsmon_2nd_2008_11_05_22_09_40_small.dmp.zip
2008-11-05 04:08 2,435,072 —-a-w c:\windows\Internet Logs\xDB61C.tmp
2008-11-05 04:08 145,979 —-a-w c:\windows\Internet Logs\vsmon_2nd_2008_11_04_23_08_07_small.dmp.zip
2008-11-01 02:01 ——— d—–w c:\documents and settings\All Users\Application Data\Google Updater
2008-10-29 02:32 2,337,280 —-a-w c:\windows\Internet Logs\xDB29.tmp
2008-10-24 11:10 453,632 —-a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-20 02:36 187,904 —-a-w c:\windows\Internet Logs\xDB28.tmp
2008-10-18 02:14 ——— d—–w c:\program files\iPod
2008-10-18 02:11 ——— d—–w c:\program files\Common Files\Apple
2008-10-16 19:13 202,776 —-a-w c:\windows\system32\wuweb.dll
2008-10-16 19:13 1,809,944 —-a-w c:\windows\system32\wuaueng.dll
2008-10-16 19:12 561,688 —-a-w c:\windows\system32\wuapi.dll
2008-10-16 19:12 323,608 —-a-w c:\windows\system32\wucltui.dll
2008-10-16 19:09 92,696 —-a-w c:\windows\system32\cdm.dll
2008-10-16 19:09 51,224 —-a-w c:\windows\system32\wuauclt.exe
2008-10-16 02:49 706,048 —-a-w c:\windows\Internet Logs\xDB26.tmp
2008-10-16 02:49 2,311,680 —-a-w c:\windows\Internet Logs\xDB27.tmp
2008-10-14 19:15 ——— d–h–w c:\program files\InstallShield Installation Information
2008-10-14 02:13 ——— d—a-w c:\documents and settings\All Users\Application Data\TEMP
2008-10-14 01:35 ——— d—–w c:\program files\Common Files\Symantec Shared
2008-10-14 00:40 ——— d—–w c:\program files\Sony
2008-10-09 18:25 73,104 —-a-w c:\windows\zllsputility.exe
2008-10-08 20:47 ——— d—–w c:\documents and settings\Name.MONSTER\Application Data\GarageGames
2008-10-06 19:14 ——— d—–w c:\program files\Ascentive
2008-10-06 19:11 ——— d—–w c:\program files\DivX
2008-09-30 21:43 1,286,152 —-a-w c:\windows\system32\msxml4.dll
2008-09-28 21:03 ——— d—–w c:\documents and settings\Name.MONSTER\Application Data\Hamachi
2008-09-28 19:36 25,280 —-a-w c:\windows\system32\drivers\hamachi.sys
2008-09-27 18:26 ——— d—–w c:\documents and settings\Name.MONSTER\Application Data\Sony
2008-09-27 13:14 ——— d—–w c:\documents and settings\Name.MONSTER\Application Data\Publish Providers
2008-09-27 02:50 ——— d—–w c:\program files\Sony Setup
2008-09-23 02:52 126,976 —-a-w c:\windows\Internet Logs\xDB25.tmp
2008-09-22 22:08 ——— d—–w c:\program files\Lavalys
2008-09-19 01:57 847,872 —-a-w c:\windows\Internet Logs\xDB24.tmp
2008-09-17 19:16 2,145,792 —-a-w c:\windows\Internet Logs\xDB23.tmp
2008-09-15 11:57 1,846,016 —-a-w c:\windows\system32\win32k.sys
2008-09-14 23:17 ——— d—–w c:\program files\Maple Story
2008-09-04 16:42 1,106,944 —-a-w c:\windows\system32\msxml3.dll
2008-09-01 20:09 2,003,968 —-a-w c:\windows\Internet Logs\xDB303.tmp
2008-08-30 21:39 0 —-a-w c:\documents and settings\Name.MONSTER\jagex_runescape_preferences.dat
2008-08-30 01:06 1,350,664 —-a-w c:\windows\system32\msxml6.dll
2008-08-29 14:18 87,336 —-a-w c:\windows\system32\dns-sd.exe
2008-08-29 13:53 61,440 —-a-w c:\windows\system32\dnssd.dll
2008-08-26 07:24 826,368 —-a-w c:\windows\system32\wininet.dll
2008-08-24 14:37 24,136,184 —-a-w c:\windows\Internet Logs\tvDebug.zip
2008-08-22 04:02 105,984 —-a-w c:\windows\Internet Logs\xDB22.tmp
2008-08-20 03:37 1,316,352 —-a-w c:\windows\Internet Logs\xDB21.tmp
2008-08-17 20:21 1,976,320 —-a-w c:\windows\Internet Logs\xDB20.tmp
2008-08-14 09:58 2,136,064 —-a-w c:\windows\system32\ntoskrnl.exe
2008-08-14 09:22 2,015,744 —-a-w c:\windows\system32\ntkrnlpa.exe
2008-04-19 13:09 952 –sha-w c:\documents and settings\All Users\Application Data\KGyGaAvL.sys
2008-04-19 13:09 88 –sh–r c:\documents and settings\All Users\Application Data\826A01B8B3.sys
2005-12-07 16:30 32 —-a-r c:\documents and settings\All Users\hash.dat
2005-11-16 00:48 0 —-a-w c:\documents and settings\Name.MONSTER\WoW-1.7.1.4695-to-1.8.0-enUS-patch.exe
2005-07-28 13:45 171,796 —-a-w c:\documents and settings\Name.MONSTER\stub.exe
2005-12-09 21:14 56 –sh–r c:\windows\system32\9D8DD8A2B0.sys
2007-03-24 00:10 88 –sh–r c:\windows\system32\B0A2D88D9D.sys
2007-03-24 00:10 4,704 –sha-w c:\windows\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((( snapshot@2008-11-11_15.34.18.59 )))))))))))))))))))))))))))))))))))))))))
.
- 2006-05-05 09:41:45 453,120 —-a-w c:\windows\Driver Cache\i386\mrxsmb.sys
+ 2008-10-24 11:10:42 453,632 —-a-w c:\windows\Driver Cache\i386\mrxsmb.sys
+ 2008-11-11 21:59:04 32,768 —-a-r c:\windows\Installer\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}\icon.exe
- 2008-11-03 04:00:08 12,288 —-a-r c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
+ 2008-11-11 22:00:40 12,288 —-a-r c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
- 2008-11-03 04:00:07 135,168 —-a-r c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\misc.exe
+ 2008-11-11 22:00:40 135,168 —-a-r c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\misc.exe
- 2008-11-03 04:00:08 11,264 —-a-r c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
+ 2008-11-11 22:00:40 11,264 —-a-r c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
- 2008-11-03 04:00:08 27,136 —-a-r c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
+ 2008-11-11 22:00:40 27,136 —-a-r c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
- 2008-11-03 04:00:08 4,096 —-a-r c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
+ 2008-11-11 22:00:40 4,096 —-a-r c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
- 2008-11-03 04:00:08 794,624 —-a-r c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\outicon.exe
+ 2008-11-11 22:00:40 794,624 —-a-r c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\outicon.exe
- 2008-11-03 04:00:07 249,856 —-a-r c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\pptico.exe
+ 2008-11-11 22:00:40 249,856 —-a-r c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\pptico.exe
- 2008-11-03 04:00:08 23,040 —-a-r c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
+ 2008-11-11 22:00:40 23,040 —-a-r c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
- 2008-11-03 04:00:07 286,720 —-a-r c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
+ 2008-11-11 22:00:40 286,720 —-a-r c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
- 2008-11-03 04:00:07 409,600 —-a-r c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
+ 2008-11-11 22:00:40 409,600 —-a-r c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
+ 2008-07-19 02:10:48 94,920 —-a-w c:\windows\LastGood\system32\cdm.dll
+ 2008-07-19 02:07:34 270,880 —-a-w c:\windows\LastGood\system32\mucltui.dll
+ 2008-07-19 02:07:32 210,976 —-a-w c:\windows\LastGood\system32\muweb.dll
+ 2008-07-19 02:09:44 563,912 —-a-w c:\windows\LastGood\system32\wuapi.dll
+ 2008-07-19 02:10:42 53,448 —-a-w c:\windows\LastGood\system32\wuauclt.exe
+ 2008-07-19 02:09:42 1,811,656 —-a-w c:\windows\LastGood\system32\wuaueng.dll
+ 2008-07-19 02:09:46 325,832 —-a-w c:\windows\LastGood\system32\wucltui.dll
+ 2008-07-19 02:10:20 36,552 —-a-w c:\windows\LastGood\system32\wups.dll
+ 2008-07-19 02:10:40 45,768 —-a-w c:\windows\LastGood\system32\wups2.dll
+ 2008-07-19 02:09:44 205,000 —-a-w c:\windows\LastGood\system32\wuweb.dll
- 2008-07-19 02:10:48 94,920 -c–a-w c:\windows\system32\dllcache\cdm.dll
+ 2008-10-16 19:09:44 92,696 -c–a-w c:\windows\system32\dllcache\cdm.dll
- 2006-05-05 09:41:45 453,120 -c—-w c:\windows\system32\dllcache\mrxsmb.sys
+ 2008-10-24 11:10:42 453,632 -c—-w c:\windows\system32\dllcache\mrxsmb.sys
- 2007-06-26 06:08:16 1,104,896 -c–a-w c:\windows\system32\dllcache\msxml3.dll
+ 2008-09-04 16:42:02 1,106,944 -c–a-w c:\windows\system32\dllcache\msxml3.dll
- 2008-07-19 02:09:44 563,912 -c–a-w c:\windows\system32\dllcache\wuapi.dll
+ 2008-10-16 19:12:20 561,688 -c–a-w c:\windows\system32\dllcache\wuapi.dll
- 2008-07-19 02:10:42 53,448 -c–a-w c:\windows\system32\dllcache\wuauclt.exe
+ 2008-10-16 19:09:44 51,224 -c–a-w c:\windows\system32\dllcache\wuauclt.exe
- 2008-07-19 02:09:42 1,811,656 -c–a-w c:\windows\system32\dllcache\wuaueng.dll
+ 2008-10-16 19:13:40 1,809,944 -c–a-w c:\windows\system32\dllcache\wuaueng.dll
- 2008-07-19 02:09:46 325,832 -c–a-w c:\windows\system32\dllcache\wucltui.dll
+ 2008-10-16 19:12:22 323,608 -c–a-w c:\windows\system32\dllcache\wucltui.dll
- 2008-07-19 02:09:44 205,000 -c–a-w c:\windows\system32\dllcache\wuweb.dll
+ 2008-10-16 19:13:40 202,776 -c–a-w c:\windows\system32\dllcache\wuweb.dll
- 2008-10-07 19:19:40 16,721,856 —-a-w c:\windows\system32\MRT.exe
+ 2008-11-04 00:10:25 17,318,336 —-a-w c:\windows\system32\MRT.exe
+ 2008-10-16 19:08:58 34,328 —-a-w c:\windows\system32\SoftwareDistribution\Setup\ServiceStartup\wups.dll\7.2.6001.788\wups.dll
+ 2008-10-16 19:09:44 43,544 —-a-w c:\windows\system32\SoftwareDistribution\Setup\ServiceStartup\wups2.dll\7.2.6001.788\wups2.dll
- 2007-11-30 11:18:51 17,272 —-a-w c:\windows\system32\spmsg.dll
+ 2008-07-08 13:02:01 17,272 ——w c:\windows\system32\spmsg.dll
- 2008-11-11 00:17:39 4,212 —ha-w c:\windows\system32\zllictbl.dat
+ 2008-11-12 19:50:48 4,212 —ha-w c:\windows\system32\zllictbl.dat
- 2008-11-11 20:05:28 367,568 —-a-w c:\windows\system32\ZoneLabs\avsys\bases\sfdb.dat
+ 2008-11-13 19:57:08 372,356 —-a-w c:\windows\system32\ZoneLabs\avsys\bases\sfdb.dat
- 2008-11-10 19:56:03 10,273,870 —-a-w c:\windows\system32\ZoneLabs\spyware.dat
+ 2008-11-12 19:52:51 10,264,095 —-a-w c:\windows\system32\ZoneLabs\spyware.dat
- 2008-11-11 01:53:38 167,424 —-a-w c:\windows\system32\ZoneLabs\zlqrtdb.dat
+ 2008-11-12 22:28:59 177,664 —-a-w c:\windows\system32\ZoneLabs\zlqrtdb.dat
+ 2008-09-30 21:42:08 1,286,152 —-a-w c:\windows\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9870.0_x-ww_a32d74cf\msxml4.dll
+ 2008-09-30 21:45:12 91,656 —-a-w c:\windows\WinSxS\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.1.0_x-ww_2a41bceb\msxml4r.dll
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"Steam"="c:\program files\steam\steam.exe" [2008-10-08 1410296]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-26 68856]
"Fraps"="c:\documents and settings\NAME.MONSTER\DESKTOP\MY KOOL STUFF\LOGS\SCHTUFF-O!\NOTHING\FRAPS\FRAPS.EXE" [2005-06-15 2793472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-06-06 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-06-06 118784]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-06-16 221184]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-06-16 81920]
"razer"="c:\program files\Razer\razerhid.exe" [2005-05-17 147456]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-09-25 90112]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 49152]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-07-09 36352]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-10-01 289576]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-10-09 981904]
"SoundMan"="SOUNDMAN.EXE" [2004-07-01 c:\windows\SOUNDMAN.EXE]
"High Definition Audio Property Page Shortcut"="HDAudPropShortcut.exe" [2004-03-17 c:\windows\system32\Hdaudpropshortcut.exe]
"AlcWzrd"="ALCWZRD.EXE" [2004-07-05 c:\windows\ALCWZRD.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2006-10-04 c:\windows\system32\narrator.exe]

c:\documents and settings\Name.MONSTER\Start Menu\Programs\Startup\
PowerReg Scheduler.exe [2005-07-23 256000]
Xfire.lnk - c:\program files\Xfire\xfire.exe [2008-10-29 3104080]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Google Updater.lnk - c:\program files\Google\Google Updater\GoogleUpdater.exe [2007-08-31 161264]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-01-02 210520]
HPAiODevice(hp officejet g series) - 1.lnk - c:\program files\Hewlett-Packard\AiO\hp officejet g series\Bin\hpoavn07.exe [2002-11-20 151552]
ZyXEL G-220 v2 Wireless Adapter Utility.lnk - c:\program files\ZyXEL\ZyXEL G-220 v2 Wireless Adapter Utility\ZyXEL G-220 v2.exe [2007-10-19 10891264]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WB]
2001-12-21 00:34 24576 c:\program files\AlienGUIse\fastload.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=wbsys.dll rbzjvx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.avis"= ff_acm.acm
"VIDC.XFR1"= xfcodec.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, zwebauth.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Warcraft III\\Frozen Throne.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R2 ZDCNDIS5;ZDCNDIS5 NDIS Protocol Driver;c:\windows\system32\ZDCNDIS5.sys [2006-08-17 19072]
R3 mlnmtwdm;TransportMidi WDM Driver;c:\windows\system32\Drivers\mlnmtwdm.sys [2005-08-02 45056]
R3 Razerlow;Razerlow USB Filter Driver;c:\windows\system32\Drivers\Razerlow.sys [2005-04-24 13225]
R3 ZG760_XP;ZyXEL 802.11g XG762 1211 Driver;c:\windows\system32\DRIVERS\WlanGZXP.sys [2006-08-17 402944]
S2 gupdate1c8ea5eb3336758;Google Update Service (gupdate1c8ea5eb3336758);c:\program files\Google\Update\GoogleUpdate.exe [2008-09-02 133104]
S2 MONyog;MONyog;c:\program files\MONyog\bin\MONyog.exe [ ]
S3 CEDRIVER53;CEDRIVER53;c:\program files\Cheat Engine\dbk32.sys [ ]
S3 dump_wmimmc;dump_wmimmc;c:\ijji\ENGLISH\Gunz\GameGuard\dump_wmimmc.sys [ ]
S3 EverestDriver;Lavalys EVEREST Kernel Driver;c:\program files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt [2008-09-04 23152]
S3 geebers12;geebers12;c:\documents and settings\Name.MONSTER\Desktop\My Kool Stuff\Logs\Schtuff-O!\Nothing\Told you\blorbslayerengine\nvid888.sys [ ]
S3 iCheat1;iCheat1;c:\documents and settings\Name.MONSTER\Desktop\My Kool Stuff\Logs\Schtuff-O!\Nothing\Told you\ICheat\ICheat\nvid999.sys [ ]
S3 memxers12;memxers12;c:\documents and settings\Name.MONSTER\Desktop\My Kool Stuff\Logs\Schtuff-O!\Nothing\Told you\V.39 Hack Pack\iCheat (rev1021)\nvid999.sys [ ]
S3 saruen;saruen;c:\documents and settings\Name.MONSTER\Desktop\My Kool Stuff\Logs\Schtuff-O!\Nothing\Told you\saruengang101of\saruen.sys [ ]
S3 saruenGang;saruenGang;c:\documents and settings\Name.MONSTER\Desktop\My Kool Stuff\Logs\Schtuff-O!\Nothing\Told you\Bypass\saruenGang.sys [ ]
S3 spuce1;spuce1;c:\documents and settings\Name.MONSTER\Desktop\My Kool Stuff\Logs\Schtuff-O!\Nothing\Told you\SPUCE2\SPUCE 2.0\spuce.sys [ ]
S3 SS1022;Siemens SpeedStream Wireless USB Driver;c:\windows\system32\DRIVERS\SSUSBN51.sys [ ]
S3 XDva007;XDva007;c:\windows\system32\XDva007.sys [ ]
S3 XDva032;XDva032;c:\windows\system32\XDva032.sys [ ]
S3 XDva120;XDva120;c:\windows\system32\XDva120.sys [ ]
S3 xp1;xp1;c:\documents and settings\Name.MONSTER\Desktop\My Kool Stuff\Logs\Schtuff-O!\Nothing\Told you\xpengine\xp.sys [ ]
S3 zenx1;zenx1;c:\documents and settings\Name.MONSTER\Desktop\My Kool Stuff\Logs\Schtuff-O!\Nothing\Told you\ZenX & MSBot\ZenX & MSBot\ZenxEngine_LATEST\zenx.sys [ ]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\Shell\AutoRun\command - E:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1c04d864-48e5-11dc-a98f-000f3d04244a}]
\Shell\AutoRun\command - E:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{af41fbd9-d651-11db-a8f5-000f3d04244a}]
\Shell\AutoRun\command - E:\LaunchU3.exe -a

*Newly Created Service* - CATCHME
.
Contents of the 'Scheduled Tasks' folder

2008-11-08 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2008-11-13 c:\windows\Tasks\GoogleUpdateTaskMachine.job
- c:\program files\Google\Update\GoogleUpdate.exe [2008-09-02 14:11]

2008-11-07 c:\windows\Tasks\Norton Security Scan for Name.job
- c:\program files\Norton Security Scan\Nss.exe []

2008-11-07 c:\windows\Tasks\Norton Security Scan.job
- c:\program files\Norton Security Scan\Nss.exe []
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-13 15:03:01
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet002\Services\EverestDriver]
"ImagePath"="\??\c:\program files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt"

[HKEY_LOCAL_MACHINE\system\ControlSet002\Services\MySQL]
"ImagePath"="\"c:\program files\MySQL\MySQL Server 6.0\bin\mysqld\" –defaults-file=\"c:\program files\MySQL\MySQL Server 6.0\my.ini\" MySQL"
.
Completion time: 2008-11-13 15:05:13
ComboFix-quarantined-files.txt 2008-11-13 20:04:26
ComboFix2.txt 2008-11-11 20:34:57

Pre-Run: 21,094,760,448 bytes free
Post-Run: 21,074,911,232 bytes free

306 — E O F — 2008-11-11 22:02:29








Jotti Scan Results:



Scanner results
Scan taken on 13 Nov 2008 20:37:15 (GMT)
A-Squared Found nothing
AntiVir Found nothing
ArcaVir Found nothing
Avast Found nothing
AVG Antivirus Found nothing
BitDefender Found nothing
ClamAV Found nothing
CPsecure Found nothing
Dr.Web Found nothing
F-Prot Antivirus Found nothing
F-Secure Anti-Virus Found nothing
G DATA Found nothing
Ikarus Found nothing
Kaspersky Anti-Virus Found nothing
NOD32 Found nothing
Norman Virus Control Found nothing
Panda Antivirus Found nothing
Sophos Antivirus Found nothing
VirusBuster Found nothing
VBA32 Found nothing

Also, I can't seem to get Kaspersky to work. I have Java JRE 6 Update 10 installed, but it still says I need Java. =/

Okay, something's happening… My ZoneAlarm is picking up tons of viruses. It just found 10 at once, then 2 more, then another, and the Panda Scan is still running. Here's the CFix Log (It ran successfully):

ComboFix 08-11-12.02 - Name 2008-11-14 14:57:58.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.578 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Name.MONSTER\Desktop\CFScript.txt
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2008-10-14 to 2008-11-14 )))))))))))))))))))))))))))))))
.

2008-11-13 19:55 . 2008-11-13 20:18 d——– c:\program files\Freestylers Gaming Community
2008-11-13 15:28 . 2008-11-13 15:27 410,976 –a—— c:\windows\system32\deploytk.dll
2008-11-13 15:28 . 2008-11-13 15:27 73,728 –a—— c:\windows\system32\javacpl.cpl
2008-11-11 17:01 . 2008-11-11 17:01 d——– c:\program files\MSXML 6.0
2008-11-11 16:59 . 2008-11-11 16:59 d——– c:\program files\MSXML 4.0
2008-11-11 15:06 . 2008-11-11 15:07 d——– c:\program files\ERUNT
2008-11-10 19:57 . 2008-11-10 19:57 d——– c:\program files\Trend Micro
2008-11-09 20:32 . 2008-11-10 17:48 70,144 –a—— c:\windows\system32\bkwdktmr.dll.vzr
2008-11-09 20:29 . 2008-11-09 20:29 103,424 –a—— c:\windows\system32\rbzjvx.dll.vzr
2008-11-09 19:22 . 2008-11-09 19:22 d——– c:\program files\NHN USA
2008-11-09 11:54 . 2008-04-23 14:02 157,152 –a—— c:\windows\system32\PubPlugin.dll
2008-11-08 21:16 . 2008-11-08 21:18 d——– c:\program files\Teamspeak2_RC2
2008-10-31 14:58 . 2008-10-31 14:58 0 –a—— C:\LHT33C.tmp
2008-10-29 20:24 . 2008-10-29 20:24 42,320 –a—— c:\windows\system32\xfcodec.dll
2008-10-29 19:37 . 2008-11-07 15:14 d——– c:\documents and settings\Name.MONSTER\Application Data\MailFrontier
2008-10-29 19:26 . 2008-10-09 13:25 1,221,008 –a—— c:\windows\system32\zpeng25.dll
2008-10-29 19:17 . 2008-10-29 19:18 49,676 –a—— c:\documents and settings\Name.MONSTER\java_plugin.exe
2008-10-17 21:14 . 2008-10-17 21:15 d——– c:\program files\iTunes
2008-10-17 21:14 . 2008-10-17 21:15 d——– c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-10-17 21:12 . 2008-10-18 10:36 d——– c:\program files\Bonjour
2008-10-17 21:10 . 2008-10-17 21:12 d——– c:\program files\QuickTime
2008-10-15 14:05 . 2008-10-16 14:06 268,648 –a—— c:\windows\system32\mucltui.dll
2008-10-15 14:05 . 2008-10-16 14:06 208,744 –a—— c:\windows\system32\muweb.dll
2008-10-15 14:05 . 2008-10-16 14:06 27,496 –a—— c:\windows\system32\mucltui.dll.mui
2008-10-14 19:37 . 2008-10-15 14:05 d——– c:\documents and settings\Name.MONSTER\Contacts
2008-10-14 19:32 . 2008-10-29 20:16 d——– c:\program files\Windows Live
2008-10-14 19:32 . 2008-10-14 19:36 d–hsc— c:\program files\Common Files\WindowsLiveInstaller
2008-10-14 19:31 . 2008-10-14 19:31 d——– c:\documents and settings\All Users\Application Data\WLInstaller
2008-10-14 15:09 . 2008-10-14 15:09 d——– c:\documents and settings\All Users\Application Data\Blizzard
2008-10-14 14:35 . 2008-10-21 14:26 d——– c:\program files\Copy of World of Warcraft

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-14 20:02 80,779,808 –sha-w c:\windows\system32\drivers\fidbox.dat
2008-11-14 19:50 ——— d—–w c:\program files\Steam
2008-11-14 19:47 31,205 —-a-w c:\windows\system32\drivers\mlnmtwdm.log
2008-11-14 03:50 1,071,140 –sha-w c:\windows\system32\drivers\fidbox.idx
2008-11-13 20:27 ——— d—–w c:\program files\Java
2008-11-12 20:13 ——— d—–w c:\program files\Viewpoint
2008-11-12 20:13 ——— d—–w c:\documents and settings\All Users\Application Data\Viewpoint
2008-11-12 19:59 ——— d—–w c:\program files\Xfire
2008-11-11 20:28 ——— d—–w c:\documents and settings\Name.MONSTER\Application Data\Xfire
2008-11-11 19:57 ——— d—–w c:\documents and settings\Name.MONSTER\Application Data\Image Zone Express
2008-11-10 01:39 ——— d–h–w c:\documents and settings\Name.MONSTER\Application Data\ijjigame
2008-11-08 21:20 ——— d—–w c:\program files\Google
2008-11-08 16:32 ——— d—–w c:\program files\World of Warcraft
2008-11-08 16:23 ——— d—–w c:\program files\Warcraft III
2008-11-08 04:35 2,990,592 —-a-w c:\windows\Internet Logs\xDB2A.tmp
2008-11-06 03:10 146,201 —-a-w c:\windows\Internet Logs\vsmon_2nd_2008_11_05_22_09_40_small.dmp.zip
2008-11-05 04:08 2,435,072 —-a-w c:\windows\Internet Logs\xDB61C.tmp
2008-11-05 04:08 145,979 —-a-w c:\windows\Internet Logs\vsmon_2nd_2008_11_04_23_08_07_small.dmp.zip
2008-11-01 02:01 ——— d—–w c:\documents and settings\All Users\Application Data\Google Updater
2008-10-29 02:32 2,337,280 —-a-w c:\windows\Internet Logs\xDB29.tmp
2008-10-24 11:10 453,632 —-a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-20 02:36 187,904 —-a-w c:\windows\Internet Logs\xDB28.tmp
2008-10-18 02:14 ——— d—–w c:\program files\iPod
2008-10-18 02:11 ——— d—–w c:\program files\Common Files\Apple
2008-10-16 19:13 202,776 —-a-w c:\windows\system32\wuweb.dll
2008-10-16 19:13 1,809,944 —-a-w c:\windows\system32\wuaueng.dll
2008-10-16 19:12 561,688 —-a-w c:\windows\system32\wuapi.dll
2008-10-16 19:12 323,608 —-a-w c:\windows\system32\wucltui.dll
2008-10-16 19:09 92,696 —-a-w c:\windows\system32\cdm.dll
2008-10-16 19:09 51,224 —-a-w c:\windows\system32\wuauclt.exe
2008-10-16 19:09 43,544 —-a-w c:\windows\system32\wups2.dll
2008-10-16 19:08 34,328 —-a-w c:\windows\system32\wups.dll
2008-10-16 02:49 706,048 —-a-w c:\windows\Internet Logs\xDB26.tmp
2008-10-16 02:49 2,311,680 —-a-w c:\windows\Internet Logs\xDB27.tmp
2008-10-14 19:15 ——— d–h–w c:\program files\InstallShield Installation Information
2008-10-14 02:13 ——— d—a-w c:\documents and settings\All Users\Application Data\TEMP
2008-10-14 01:35 ——— d—–w c:\program files\Common Files\Symantec Shared
2008-10-14 00:40 ——— d—–w c:\program files\Vstplugins
2008-10-14 00:40 ——— d—–w c:\program files\Sony
2008-10-14 00:40 ——— d—–w c:\documents and settings\All Users\Application Data\Sony
2008-10-09 18:25 73,104 —-a-w c:\windows\zllsputility.exe
2008-10-08 20:47 ——— d—–w c:\documents and settings\Name.MONSTER\Application Data\GarageGames
2008-10-06 19:14 ——— d—–w c:\program files\Ascentive
2008-10-06 19:11 ——— d—–w c:\program files\DivX
2008-09-30 21:43 1,286,152 —-a-w c:\windows\system32\msxml4.dll
2008-09-28 21:03 ——— d—–w c:\documents and settings\Name.MONSTER\Application Data\Hamachi
2008-09-28 19:36 25,280 —-a-w c:\windows\system32\drivers\hamachi.sys
2008-09-27 18:26 ——— d—–w c:\documents and settings\Name.MONSTER\Application Data\Sony
2008-09-27 13:14 ——— d—–w c:\documents and settings\Name.MONSTER\Application Data\Publish Providers
2008-09-27 02:50 ——— d—–w c:\program files\Sony Setup
2008-09-23 02:52 126,976 —-a-w c:\windows\Internet Logs\xDB25.tmp
2008-09-22 22:08 ——— d—–w c:\program files\Lavalys
2008-09-19 01:57 847,872 —-a-w c:\windows\Internet Logs\xDB24.tmp
2008-09-17 19:16 2,145,792 —-a-w c:\windows\Internet Logs\xDB23.tmp
2008-09-15 11:57 1,846,016 —-a-w c:\windows\system32\win32k.sys
2008-09-14 23:17 ——— d—–w c:\program files\Maple Story
2008-09-04 16:42 1,106,944 —-a-w c:\windows\system32\msxml3.dll
2008-09-01 20:09 2,003,968 —-a-w c:\windows\Internet Logs\xDB303.tmp
2008-08-30 21:39 0 —-a-w c:\documents and settings\Name.MONSTER\jagex_runescape_preferences.dat
2008-08-30 01:06 1,350,664 —-a-w c:\windows\system32\msxml6.dll
2008-08-29 14:18 87,336 —-a-w c:\windows\system32\dns-sd.exe
2008-08-29 13:53 61,440 —-a-w c:\windows\system32\dnssd.dll
2008-08-26 07:24 826,368 —-a-w c:\windows\system32\wininet.dll
2008-08-24 14:37 24,136,184 —-a-w c:\windows\Internet Logs\tvDebug.zip
2008-08-22 04:02 105,984 —-a-w c:\windows\Internet Logs\xDB22.tmp
2008-08-20 03:37 1,316,352 —-a-w c:\windows\Internet Logs\xDB21.tmp
2008-08-17 20:21 1,976,320 —-a-w c:\windows\Internet Logs\xDB20.tmp
2008-08-14 09:58 2,136,064 —-a-w c:\windows\system32\ntoskrnl.exe
2008-08-14 09:22 2,015,744 —-a-w c:\windows\system32\ntkrnlpa.exe
2008-04-19 13:09 952 –sha-w c:\documents and settings\All Users\Application Data\KGyGaAvL.sys
2008-04-19 13:09 88 –sh–r c:\documents and settings\All Users\Application Data\826A01B8B3.sys
2005-12-07 16:30 32 —-a-r c:\documents and settings\All Users\hash.dat
2005-11-16 00:48 0 —-a-w c:\documents and settings\Name.MONSTER\WoW-1.7.1.4695-to-1.8.0-enUS-patch.exe
2005-07-28 13:45 171,796 —-a-w c:\documents and settings\Name.MONSTER\stub.exe
2005-12-09 21:14 56 –sh–r c:\windows\system32\9D8DD8A2B0.sys
2007-03-24 00:10 88 –sh–r c:\windows\system32\B0A2D88D9D.sys
2007-03-24 00:10 4,704 –sha-w c:\windows\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((( snapshot_2008-11-13_15.04.04.68 )))))))))))))))))))))))))))))))))))))))))
.
- 2007-03-15 22:16:42 236,928 -c—-w c:\windows\system32\dllcache\WgaLogon.dll
+ 2008-09-06 04:30:42 241,704 -c—-w c:\windows\system32\dllcache\wgaLogon.dll
- 2007-03-15 22:17:08 336,768 -c—-w c:\windows\system32\dllcache\WgaTray.exe
+ 2008-09-06 04:29:58 917,032 -c—-w c:\windows\system32\dllcache\WgaTray.exe
- 2008-07-19 02:10:20 36,552 -c–a-w c:\windows\system32\dllcache\wups.dll
+ 2008-10-16 19:08:58 34,328 -c–a-w c:\windows\system32\dllcache\wups.dll
+ 2008-11-13 20:27:42 144,792 —-a-w c:\windows\system32\java.exe
+ 2008-11-13 20:27:42 144,792 —-a-w c:\windows\system32\javaw.exe
+ 2008-11-13 20:27:42 148,888 —-a-w c:\windows\system32\javaws.exe
- 2007-03-15 22:19:28 1,476,992 —-a-w c:\windows\system32\LegitCheckControl.dll
+ 2008-09-06 04:30:06 1,480,232 —-a-w c:\windows\system32\LegitCheckControl.dll
- 2007-03-15 22:16:42 236,928 —-a-w c:\windows\system32\WgaLogon.dll
+ 2008-09-06 04:30:42 241,704 —-a-w c:\windows\system32\WgaLogon.dll
- 2007-03-15 22:17:08 336,768 —-a-w c:\windows\system32\WgaTray.exe
+ 2008-09-06 04:29:58 917,032 —-a-w c:\windows\system32\WgaTray.exe
- 2008-11-13 19:57:08 372,356 —-a-w c:\windows\system32\ZoneLabs\avsys\bases\sfdb.dat
+ 2008-11-14 19:56:24 397,052 —-a-w c:\windows\system32\ZoneLabs\avsys\bases\sfdb.dat
- 2008-11-12 19:52:51 10,264,095 —-a-w c:\windows\system32\ZoneLabs\spyware.dat
+ 2008-11-14 00:39:25 10,272,310 —-a-w c:\windows\system32\ZoneLabs\spyware.dat
+ 2008-11-14 19:49:07 16,384 —-atw c:\windows\temp\Perflib_Perfdata_2a8.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"Steam"="c:\program files\steam\steam.exe" [2008-10-08 1410296]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-26 68856]
"Fraps"="c:\documents and settings\NAME.MONSTER\DESKTOP\MY KOOL STUFF\LOGS\SCHTUFF-O!\NOTHING\FRAPS\FRAPS.EXE" [2005-06-15 2793472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-06-06 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-06-06 118784]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-06-16 221184]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-06-16 81920]
"razer"="c:\program files\Razer\razerhid.exe" [2005-05-17 147456]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-09-25 90112]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 49152]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-07-09 36352]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-10-01 289576]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-10-09 981904]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-13 136600]
"SoundMan"="SOUNDMAN.EXE" [2004-07-01 c:\windows\SOUNDMAN.EXE]
"High Definition Audio Property Page Shortcut"="HDAudPropShortcut.exe" [2004-03-17 c:\windows\system32\Hdaudpropshortcut.exe]
"AlcWzrd"="ALCWZRD.EXE" [2004-07-05 c:\windows\ALCWZRD.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2006-10-04 c:\windows\system32\narrator.exe]

c:\documents and settings\Name.MONSTER\Start Menu\Programs\Startup\
PowerReg Scheduler.exe [2005-07-23 256000]
Xfire.lnk - c:\program files\Xfire\xfire.exe [2008-10-29 3104080]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Google Updater.lnk - c:\program files\Google\Google Updater\GoogleUpdater.exe [2007-08-31 161264]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-01-02 210520]
HPAiODevice(hp officejet g series) - 1.lnk - c:\program files\Hewlett-Packard\AiO\hp officejet g series\Bin\hpoavn07.exe [2002-11-20 151552]
ZyXEL G-220 v2 Wireless Adapter Utility.lnk - c:\program files\ZyXEL\ZyXEL G-220 v2 Wireless Adapter Utility\ZyXEL G-220 v2.exe [2007-10-19 10891264]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WB]
2001-12-21 00:34 24576 c:\program files\AlienGUIse\fastload.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=wbsys.dll rbzjvx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.avis"= ff_acm.acm
"VIDC.XFR1"= xfcodec.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, zwebauth.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Warcraft III\\Frozen Throne.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R2 ZDCNDIS5;ZDCNDIS5 NDIS Protocol Driver;c:\windows\system32\ZDCNDIS5.sys [2006-08-17 19072]
R3 mlnmtwdm;TransportMidi WDM Driver;c:\windows\system32\Drivers\mlnmtwdm.sys [2005-08-02 45056]
R3 Razerlow;Razerlow USB Filter Driver;c:\windows\system32\Drivers\Razerlow.sys [2005-04-24 13225]
R3 ZG760_XP;ZyXEL 802.11g XG762 1211 Driver;c:\windows\system32\DRIVERS\WlanGZXP.sys [2006-08-17 402944]
S2 gupdate1c8ea5eb3336758;Google Update Service (gupdate1c8ea5eb3336758);c:\program files\Google\Update\GoogleUpdate.exe [2008-09-02 133104]
S2 MONyog;MONyog;c:\program files\MONyog\bin\MONyog.exe [ ]
S3 CEDRIVER53;CEDRIVER53;c:\program files\Cheat Engine\dbk32.sys [ ]
S3 dump_wmimmc;dump_wmimmc;c:\ijji\ENGLISH\Gunz\GameGuard\dump_wmimmc.sys [ ]
S3 EverestDriver;Lavalys EVEREST Kernel Driver;c:\program files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt [2008-09-04 23152]
S3 geebers12;geebers12;c:\documents and settings\Name.MONSTER\Desktop\My Kool Stuff\Logs\Schtuff-O!\Nothing\Told you\blorbslayerengine\nvid888.sys [ ]
S3 iCheat1;iCheat1;c:\documents and settings\Name.MONSTER\Desktop\My Kool Stuff\Logs\Schtuff-O!\Nothing\Told you\ICheat\ICheat\nvid999.sys [ ]
S3 memxers12;memxers12;c:\documents and settings\Name.MONSTER\Desktop\My Kool Stuff\Logs\Schtuff-O!\Nothing\Told you\V.39 Hack Pack\iCheat (rev1021)\nvid999.sys [ ]
S3 saruen;saruen;c:\documents and settings\Name.MONSTER\Desktop\My Kool Stuff\Logs\Schtuff-O!\Nothing\Told you\saruengang101of\saruen.sys [ ]
S3 saruenGang;saruenGang;c:\documents and settings\Name.MONSTER\Desktop\My Kool Stuff\Logs\Schtuff-O!\Nothing\Told you\Bypass\saruenGang.sys [ ]
S3 spuce1;spuce1;c:\documents and settings\Name.MONSTER\Desktop\My Kool Stuff\Logs\Schtuff-O!\Nothing\Told you\SPUCE2\SPUCE 2.0\spuce.sys [ ]
S3 SS1022;Siemens SpeedStream Wireless USB Driver;c:\windows\system32\DRIVERS\SSUSBN51.sys [ ]
S3 XDva007;XDva007;c:\windows\system32\XDva007.sys [ ]
S3 XDva032;XDva032;c:\windows\system32\XDva032.sys [ ]
S3 XDva120;XDva120;c:\windows\system32\XDva120.sys [ ]
S3 xp1;xp1;c:\documents and settings\Name.MONSTER\Desktop\My Kool Stuff\Logs\Schtuff-O!\Nothing\Told you\xpengine\xp.sys [ ]
S3 zenx1;zenx1;c:\documents and settings\Name.MONSTER\Desktop\My Kool Stuff\Logs\Schtuff-O!\Nothing\Told you\ZenX & MSBot\ZenX & MSBot\ZenxEngine_LATEST\zenx.sys [ ]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\Shell\AutoRun\command - E:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1c04d864-48e5-11dc-a98f-000f3d04244a}]
\Shell\AutoRun\command - E:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{af41fbd9-d651-11db-a8f5-000f3d04244a}]
\Shell\AutoRun\command - E:\LaunchU3.exe -a
.
Contents of the 'Scheduled Tasks' folder

2008-11-08 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2008-11-14 c:\windows\Tasks\GoogleUpdateTaskMachine.job
- c:\program files\Google\Update\GoogleUpdate.exe [2008-09-02 14:11]

2008-11-07 c:\windows\Tasks\Norton Security Scan for Name.job
- c:\program files\Norton Security Scan\Nss.exe []

2008-11-07 c:\windows\Tasks\Norton Security Scan.job
- c:\program files\Norton Security Scan\Nss.exe []
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-14 15:02:03
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet002\Services\EverestDriver]
"ImagePath"="\??\c:\program files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt"

[HKEY_LOCAL_MACHINE\system\ControlSet002\Services\MySQL]
"ImagePath"="\"c:\program files\MySQL\MySQL Server 6.0\bin\mysqld\" –defaults-file=\"c:\program files\MySQL\MySQL Server 6.0\my.ini\" MySQL"
.
Completion time: 2008-11-14 15:04:16
ComboFix-quarantined-files.txt 2008-11-14 20:03:28
ComboFix2.txt 2008-11-13 20:05:15
ComboFix3.txt 2008-11-11 20:34:57

Pre-Run: 30,074,724,352 bytes free
Post-Run: 30,099,329,024 bytes free

264 — E O F — 2008-11-14 02:08:33



And now for the HijackThis log:


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:18:01 PM, on 11/14/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\UAService7.exe
C:\Program Files\UltraVNC\winvnc.exe
C:\WINDOWS\ALCWZRD.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Razer\razerhid.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Razer\razertra.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Razer\razerofa.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Hewlett-Packard\AiO\hp officejet g series\Bin\hpoavn07.exe
C:\Program Files\Xfire\xfire.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\HEWLET~1\AiO\Shared\Bin\hpoevm07.exe
C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOSTS07.exe
C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOFXM07.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\ZyXEL\ZyXEL G-220 v2 Wireless Adapter Utility\ZyXEL G-220 v2.exe
C:\Program Files\Opera\opera.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\iTunes\iTunes.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 143.205.172.11:3127
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAudPropShortcut.exe
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [razer] C:\Program Files\Razer\razerhid.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Fraps] C:\DOCUMENTS AND SETTINGS\NAME.MONSTER\DESKTOP\MY KOOL STUFF\LOGS\SCHTUFF-O!\NOTHING\FRAPS\FRAPS.EXE
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Startup: PowerReg Scheduler.exe
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HPAiODevice(hp officejet g series) - 1.lnk = C:\Program Files\Hewlett-Packard\AiO\hp officejet g series\Bin\hpoavn07.exe
O4 - Global Startup: ZyXEL G-220 v2 Wireless Adapter Utility.lnk = ?
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: vzTCPConfig - http://www2.verizon.net/help/fios_settings…vzTCPConfig.CAB
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=48835
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/dev/packages/GSManager.cab
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://www.pandasecurity.com/activescan/cabs/as2stubie.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.0.97.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m…96/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by101fd.bay101.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {A2E05F45-F127-4092-B9F7-9A02C3E04C77} (HGPlugin7USA Class) - http://gamedownload.ijjimax.com/gamedownlo…GPlugin7USA.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur…loadManager.ocx
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/m…,26/mcgdmgr.cab
O16 - DPF: {DB7BF79A-FC51-4B5A-92BC-A65731174380} (InstantAction Game Launcher) - http://www.instantaction.com/download/iaplayer.cab
O20 - AppInit_DLLs: wbsys.dll rbzjvx.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Update Service (gupdate1c8ea5eb3336758) (gupdate1c8ea5eb3336758) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: MONyog - Unknown owner - C:\Program Files\MONyog\bin\MONyog.exe (file missing)
O23 - Service: MySQL - Unknown owner - C:\Program.exe (file missing)
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - Unknown owner - C:\Program Files\Spyware Doctor\pctsAuxs.exe (file missing)
O23 - Service: PC Tools Security Service (sdCoreService) - Unknown owner - C:\Program Files\Spyware Doctor\pctsSvc.exe (file missing)
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: VNC Server (winvnc) - UltraVNC - C:\Program Files\UltraVNC\winvnc.exe

–
End of file - 10713 bytes


EDIT:



;*******************************************************************************
********************************************************************************
*
*******************
ANALYSIS: 2008-11-14 19:24:33
PROTECTIONS: 1
MALWARE: 10
SUSPECTS: 11
;*******************************************************************************
********************************************************************************
*
*******************
PROTECTIONS
Description Version Active Updated
;===============================================================================
================================================================================
=
===================
ZoneAlarm Security Suite Antivirus 8.0.059.000 Yes Yes
;===============================================================================
================================================================================
=
===================
MALWARE
Id Description Type Active Severity Disinfectable Disinfected Location
;===============================================================================
================================================================================
=
===================
00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Documents and Settings\Name.MONSTER\Cookies\gavin_mathes@doubleclick[1].txt
00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\Name.MONSTER\Cookies\gavin_mathes@atdmt[1].txt
00278769 Application/PRScheduler HackTools No 0 Yes No C:\Documents and Settings\Name.MONSTER\Start Menu\Programs\Startup\PowerReg Scheduler.exe
01185375 Application/Psexec.A HackTools No 0 Yes No C:\System Volume Information\_restore{13CFB6F5-7827-4484-960D-A3C791EACE36}\RP978\A0417643.EXE
02885963 Rootkit/Booto.C Virus/Worm No 0 Yes Yes C:\System Volume Information\_restore{13CFB6F5-7827-4484-960D-A3C791EACE36}\RP978\A0417623.sys
04028939 Generic Trojan Virus/Trojan No 0 Yes No C:\Program Files\Freestylers Gaming Community\Freestyle Gunz\Freestyle GunZ.exe
04028939 Generic Trojan Virus/Trojan No 0 No No C:\Documents and Settings\Name.MONSTER\Desktop\Freestyle Gunz.exe[Freestyle Gunz\Freestyle GunZ.exe]
04057611 Generic Trojan Virus/Trojan No 0 Yes Yes C:\Qoobox\Quarantine\C\WINDOWS\service.exe.vir
04057611 Generic Trojan Virus/Trojan No 0 Yes Yes C:\Documents and Settings\Name.MONSTER\java_plugin.exe
04057611 Generic Trojan Virus/Trojan No 0 Yes Yes C:\System Volume Information\_restore{13CFB6F5-7827-4484-960D-A3C791EACE36}\RP978\A0417608.exe
04073163 Generic Malware Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{13CFB6F5-7827-4484-960D-A3C791EACE36}\RP977\A0417511.dll
04073163 Generic Malware Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{13CFB6F5-7827-4484-960D-A3C791EACE36}\RP977\A0417512.dll
04073163 Generic Malware Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{13CFB6F5-7827-4484-960D-A3C791EACE36}\RP977\A0417513.dll
04073163 Generic Malware Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{13CFB6F5-7827-4484-960D-A3C791EACE36}\RP977\A0417491.dll
04073163 Generic Malware Virus/Trojan No 0 Yes Yes C:\WINDOWS\system32\rbzjvx.dll.vzr
04096088 Trj/Downloader.MDW Virus/Trojan No 1 Yes No C:\System Volume Information\_restore{13CFB6F5-7827-4484-960D-A3C791EACE36}\RP977\A0417490.dll
04096088 Trj/Downloader.MDW Virus/Trojan No 1 Yes No C:\WINDOWS\system32\bkwdktmr.dll.vzr
04096088 Trj/Downloader.MDW Virus/Trojan No 1 Yes No C:\System Volume Information\_restore{13CFB6F5-7827-4484-960D-A3C791EACE36}\RP973\A0417438.dll
04105094 Bck/DService.TK Virus/Trojan No 1 No No C:\Documents and Settings\Name.MONSTER\Application Data\Someplayer\RaGEZONE GunZ Launcher\0.9.0.0\cl.lgz[update20.mrs]
;===============================================================================
================================================================================
=
===================
SUSPECTS
Sent Location *
;===============================================================================
================================================================================
=
===================
No C:\Program Files\UltraVNC\winvnc.exe *
No C:\Documents and Settings\Name.MONSTER\Desktop\ComboFix.exe[32788R22FWJFW\psexec.cfexe] *
No C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\profile\cache4\opr097RL[32788R22FWJFW\psexec.cfexe]
No C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL *
No C:\Program Files\UltraVNC\winvnc.exe *
No C:\System Volume Information\_restore{13CFB6F5-7827-4484-960D-A3C791EACE36}\RP978\A0417611.dll *
No C:\System Volume Information\_restore{13CFB6F5-7827-4484-960D-A3C791EACE36}\RP978\A0417612.dll *
No C:\Program Files\Maple Story\FallenCitYUnlimited.exe *
No C:\Program Files\Maple Story\HarukiMS_13_sept.exe *
No C:\Program Files\Maple Story\SLPinStory.exe *
No C:\Qoobox\Quarantine\C\WINDOWS\system32\tuvWQkKe.dll.vir *
;===============================================================================
================================================================================
=
===================
VULNERABILITIES
Id Severity Description *
;===============================================================================
================================================================================
=
===================
;===============================================================================
================================================================================
=
===================


^ ^ ^ PandaScanner results. Doesn't look good to me (Except that everything is inactive.). >.<


Also, I am worried that because of our different timezones, I'm not getting help fast enough. Sorry, but if things are getting serious, I really just need a quick fix. >.<

I personally have nothing against you as a person, JPShortstuff, but I want to rid my computer of viruses before any vital data is lost or personal information stolen. =(

Hi,

Freestyle GunZ was a game I Downloaded to pass the time, and I even made sure to do a virusscan on it before doing anything. It turned up nothing, but I guess I was wrong. After seeing that, I quickly uninstalled it and anything related to it. And for where I got it, I downloaded it off of their website. I've only used a Torrent once and uninstalled it after someone told me about 'bad stuff' that could be coupled with it. That was a long time ago, though.

Here's the OT Log:


========== FILES ==========
File/Folder c:\windows\system32\bkwdktmr.dll.vzr not found.
File/Folder c:\windows\system32\rbzjvx.dll.vzr not found.
C:\LHT33C.tmp moved successfully.
File/Folder C:\Documents and Settings\Name.MONSTER\java_plugin.exe not found.
========== REGISTRY ==========
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows\\"AppInit_DLLs"|"wbsys.dll" /E : value set successfully!
Registry key HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E\\ deleted successfully.
Registry key HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1c04d864-48e5-11dc-a98f-000f3d04244a}\\ deleted successfully.
Registry key HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{af41fbd9-d651-11db-a8f5-000f3d04244a}\\ deleted successfully.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\NAME~1.MON\LOCALS~1\Temp\Perflib_Perfdata_6b8.dat scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\NAME~1.MON\LOCALS~1\Temp\Perflib_Perfdata_b64.dat scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\NAME~1.MON\LOCALS~1\Temp\Perflib_Perfdata_bb0.dat scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\NAME~1.MON\LOCALS~1\Temp\~DF326.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\NAME~1.MON\LOCALS~1\Temp\~DFF224.tmp scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_2bc.dat scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\ZLT06987.TMP scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
FireFox cache emptied.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0013\adoc.bx scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0013\md.dat scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0013\url.ax scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0013\w.ax scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0013\wb.vx scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0012\adoc.bx scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0012\md.dat scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0012\url.ax scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0012\w.ax scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0012\wb.vx scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0011\adoc.bx scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0011\md.dat scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0011\url.ax scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0011\w.ax scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0011\wb.vx scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0010\adoc.bx scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0010\md.dat scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0010\url.ax scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0010\w.ax scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0010\wb.vx scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0009\adoc.bx scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0009\md.dat scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0009\url.ax scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0009\w.ax scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0009\wb.vx scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0008\adoc.bx scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0008\md.dat scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0008\url.ax scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0008\w.ax scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0008\wb.vx scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0007\adoc.bx scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0007\md.dat scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0007\url.ax scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0007\w.ax scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0007\wb.vx scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0006\adoc.bx scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0006\md.dat scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0006\url.ax scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0006\w.ax scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0006\wb.vx scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0005\adoc.bx scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0005\md.dat scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0005\url.ax scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0005\w.ax scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0005\wb.vx scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0003\adoc.bx scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0003\md.dat scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0003\url.ax scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0003\w.ax scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0003\wb.vx scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0002\adoc.bx scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0002\adoc.bx-j scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0002\md.dat scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0002\md.dat-j scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0002\url.ax scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0002\url.ax-j scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0002\w.ax scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0002\w.ax-j scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0002\wb.vx scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0002\wb.vx-j scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0001\adoc.bx scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0001\md.dat scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0001\url.ax scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0001\w.ax scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0001\wb.vx scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0000\adoc.bx scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0000\md.dat scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0000\url.ax scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0000\w.ax scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0000\wb.vx scheduled to be deleted on reboot.
Opera cache emptied.
Temp folders emptied.

OTMoveIt3 by OldTimer - Version 1.0.7.1 log created on 11152008_094238

Files moved on Reboot…
File C:\DOCUME~1\NAME~1.MON\LOCALS~1\Temp\Perflib_Perfdata_6b8.dat not found!
File C:\DOCUME~1\NAME~1.MON\LOCALS~1\Temp\Perflib_Perfdata_b64.dat not found!
File C:\DOCUME~1\NAME~1.MON\LOCALS~1\Temp\Perflib_Perfdata_bb0.dat not found!
File C:\DOCUME~1\NAME~1.MON\LOCALS~1\Temp\~DF326.tmp not found!
C:\DOCUME~1\NAME~1.MON\LOCALS~1\Temp\~DFF224.tmp moved successfully.
File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot.
File C:\WINDOWS\temp\Perflib_Perfdata_2bc.dat not found!
File C:\WINDOWS\temp\ZLT06987.TMP not found!
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0013\adoc.bx moved successfully.
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0013\md.dat moved successfully.
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0013\url.ax moved successfully.
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0013\w.ax moved successfully.
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0013\wb.vx moved successfully.
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0012\adoc.bx moved successfully.
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0012\md.dat moved successfully.
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0012\url.ax moved successfully.
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0012\w.ax moved successfully.
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0012\wb.vx moved successfully.
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0011\adoc.bx moved successfully.
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0011\md.dat moved successfully.
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0011\url.ax moved successfully.
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0011\w.ax moved successfully.
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0011\wb.vx moved successfully.
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0010\adoc.bx moved successfully.
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0010\md.dat moved successfully.
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0010\url.ax moved successfully.
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0010\w.ax moved successfully.
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0010\wb.vx moved successfully.
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0009\adoc.bx moved successfully.
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0009\md.dat moved successfully.
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0009\url.ax moved successfully.
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0009\w.ax moved successfully.
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0009\wb.vx moved successfully.
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0008\adoc.bx moved successfully.
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0008\md.dat moved successfully.
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0008\url.ax moved successfully.
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0008\w.ax moved successfully.
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0008\wb.vx moved successfully.
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0007\adoc.bx moved successfully.
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0007\md.dat moved successfully.
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0007\url.ax moved successfully.
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0007\w.ax moved successfully.
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0007\wb.vx moved successfully.
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0006\adoc.bx moved successfully.
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0006\md.dat moved successfully.
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0006\url.ax moved successfully.
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0006\w.ax moved successfully.
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0006\wb.vx moved successfully.
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0005\adoc.bx moved successfully.
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0005\md.dat moved successfully.
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0005\url.ax moved successfully.
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0005\w.ax moved successfully.
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0005\wb.vx moved successfully.
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0003\adoc.bx moved successfully.
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0003\md.dat moved successfully.
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0003\url.ax moved successfully.
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0003\w.ax moved successfully.
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0003\wb.vx moved successfully.
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0002\adoc.bx moved successfully.
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0002\adoc.bx-j moved successfully.
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0002\md.dat moved successfully.
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0002\md.dat-j moved successfully.
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0002\url.ax moved successfully.
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0002\url.ax-j moved successfully.
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0002\w.ax moved successfully.
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0002\w.ax-j moved successfully.
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0002\wb.vx moved successfully.
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0002\wb.vx-j moved successfully.
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0001\adoc.bx moved successfully.
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0001\md.dat moved successfully.
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0001\url.ax moved successfully.
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0001\w.ax moved successfully.
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0001\wb.vx moved successfully.
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0000\adoc.bx moved successfully.
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0000\md.dat moved successfully.
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0000\url.ax moved successfully.
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0000\w.ax moved successfully.
C:\Documents and Settings\Name.MONSTER\Local Settings\Application Data\Opera\Opera\Profile\vps\0000\wb.vx moved successfully.


Boot-up time was a little faster after this step, and after everything my computer does seem more responsive. =)

New Log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:55:58 PM, on 11/15/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\UAService7.exe
C:\Program Files\UltraVNC\winvnc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Razer\razerhid.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Razer\razertra.exe
C:\DOCUMENTS AND SETTINGS\NAME.MONSTER\DESKTOP\MY KOOL STUFF\LOGS\SCHTUFF-O!\NOTHING\FRAPS\FRAPS.EXE
C:\Program Files\Razer\razerofa.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Hewlett-Packard\AiO\hp officejet g series\Bin\hpoavn07.exe
C:\Program Files\ZyXEL\ZyXEL G-220 v2 Wireless Adapter Utility\ZyXEL G-220 v2.exe
C:\Program Files\Xfire\xfire.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\HEWLET~1\AiO\Shared\Bin\hpoevm07.exe
C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOSTS07.exe
C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOFXM07.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Opera\opera.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 143.205.172.11:3127
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: Solid State Networks IE Browser Plugin - {BD08A9D5-0E5C-4f42-99A3-C0CB5E860557} - C:\WINDOWS\system32\SolidStateNetworks\SolidStateION\solidax.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAudPropShortcut.exe
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [razer] C:\Program Files\Razer\razerhid.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\RunOnce: [AskSBar Uninstall] rundll32 C:\PROGRA~1\UNINST~1.DLL,O -3
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Fraps] C:\DOCUMENTS AND SETTINGS\NAME.MONSTER\DESKTOP\MY KOOL STUFF\LOGS\SCHTUFF-O!\NOTHING\FRAPS\FRAPS.EXE
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Startup: PowerReg Scheduler.exe
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HPAiODevice(hp officejet g series) - 1.lnk = C:\Program Files\Hewlett-Packard\AiO\hp officejet g series\Bin\hpoavn07.exe
O4 - Global Startup: ZyXEL G-220 v2 Wireless Adapter Utility.lnk = ?
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: vzTCPConfig - http://www2.verizon.net/help/fios_settings…vzTCPConfig.CAB
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=48835
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/dev/packages/GSManager.cab
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://www.pandasecurity.com/activescan/cabs/as2stubie.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.0.97.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m…96/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by101fd.bay101.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {A2E05F45-F127-4092-B9F7-9A02C3E04C77} (HGPlugin7USA Class) - http://gamedownload.ijjimax.com/gamedownlo…GPlugin7USA.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur…loadManager.ocx
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/m…,26/mcgdmgr.cab
O16 - DPF: {BD08A9D5-0E5C-4F42-99A3-C0CB5E860557} (CSolidBrowserObj Object) - http://www.playwhat.com/solidPlugin/solidstateion.cab
O16 - DPF: {DB7BF79A-FC51-4B5A-92BC-A65731174380} (InstantAction Game Launcher) - http://www.instantaction.com/download/iaplayer.cab
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Update Service (gupdate1c8ea5eb3336758) (gupdate1c8ea5eb3336758) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: MONyog - Unknown owner - C:\Program Files\MONyog\bin\MONyog.exe (file missing)
O23 - Service: MySQL - Unknown owner - C:\Program.exe (file missing)
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - Unknown owner - C:\Program Files\Spyware Doctor\pctsAuxs.exe (file missing)
O23 - Service: PC Tools Security Service (sdCoreService) - Unknown owner - C:\Program Files\Spyware Doctor\pctsSvc.exe (file missing)
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: VNC Server (winvnc) - UltraVNC - C:\Program Files\UltraVNC\winvnc.exe

–
End of file - 10955 bytes