Please Help ..remove spyware 2009

Hi ,

Please help in removing the spyware2009,nuqelE.BankerFox...

I went through the forums but couldnt relate to ...Please guide..

Thanks in advance for your help and time

rgds,
vpmdvpmd

Hello.
Before we can start, I have to prepare you for the worst, some cases this is fixable, others cases, it isn't.

• Please download DDS by sUBs to your Desktop (Important!!) from one of these locations:
  Link 1
  Link 2
  Link 3
  
• Double click DDS.scr to run
  
• When complete, DDS.txt will open.
  
• Save the report to your Desktop.
  
• Copy and paste DDS.txt back here, I don't need to see attach.txt.
  

thanks..

After downloading the file clicking from Link2 or 3 - on click of Run - I get foll error.

"Windows cannot find cmd.. Make sure you type name correctly and try again"

rgds,
vpmdvpmd

Darn it, that could be a sign of the patched files.
Lets start with Hijack This.

You are running an old version of Hijack This, and we need to use the new version before we can do anything else.

Please download the current version of HijackThis from HERE

• Double click and run the installer.
  
• It will install to C:\Program Files\Trend Micro\HijackThis\hijackthis.exe
  
• After installing, you should get the user agreement, press accept and Hijack This will run.
  
• Select Do a system scan and save a log file. This will open a notepad file of everything Hijack This found, copy and paste it back here.
  

The log file ..........

***********************************************************

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:02:43 AM, on 2/9/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Dell Network Assistant\hnm_svc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Kontiki\KService.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe
C:\Program Files\Trend Micro\BM\TMBMSRV.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\DOCUME~1\ITALEN~1\LOCALS~1\Temp\winlognn.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\TEMP\winlognn.exe
C:\WINDOWS\services.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\WINDOWS\sysguard.exe
C:\DOCUME~1\ITALEN~1\LOCALS~1\Temp\perce.jpg.exe
C:\Program Files\Dell Network Assistant\ezi_hnm2.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Trend Micro\Internet Security\TmProxy.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\pdbcopy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\7c5a3NJ4.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\wuauclt.exe
C:\DOCUME~1\ITALEN~1\LOCALS~1\Temp\csrssc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = partnerpage.google.com/smallbiz.dell.com/en_us?hl=en&client=dell-usuk&channel=us-smb&ibd=2080208
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mail.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://server.toolbar.rediff.com/toolbar/3.0/sidesearch.html?mode=toolbar
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = partnerpage.google.com/smallbiz.dell.com/en_us?hl=en&client=dell-usuk&channel=us-smb&ibd=2080208
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\Documents and Settings\iTalent-1\pjpa.exe \s,C:\WINDOWS\system32\hhupd.exe,C:\WINDOWS\system32\7z.exe,C:\WINDOWS\system32\windres.exe,C:\WINDOWS\system32\idaw64.exe,C:\WINDOWS\system32\undname.exe,C:\WINDOWS\system32\ndetect.exe,C:\WINDOWS\system32\ndetect.exe,C:\WINDOWS\system32\pdbcopy.exe,
O1 - Hosts: 195.245.119.131 browser-security.microsoft.com
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [jsf8uiw3jnjgffght] C:\DOCUME~1\ITALEN~1\LOCALS~1\Temp\winlognn.exe
O4 - HKLM\..\Run: [Qtipe] rundll32.exe "C:\WINDOWS\Emucofajahigafek.dll",e
O4 - HKLM\..\Run: [lrijh8s73jhbfgfd] C:\WINDOWS\TEMP\winlognn.exe
O4 - HKLM\..\Run: [UfSeAgnt.exe] "C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe"
O4 - HKLM\..\Run: [Axayara] rundll32.exe "C:\WINDOWS\ucahutaf.dll",e
O4 - HKLM\..\Run: [services] C:\WINDOWS\services.exe
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [systeminit.exe] C:\DOCUME~1\ITALEN~1\LOCALS~1\Temp\systeminit.exe
O4 - HKCU\..\Run: [Cognac] C:\DOCUME~1\ITALEN~1\LOCALS~1\Temp\perce.jpg.exe
O4 - HKCU\..\Run: [jsf8uiw3jnjgffght] C:\DOCUME~1\ITALEN~1\LOCALS~1\Temp\winlognn.exe
O4 - HKCU\..\Run: [tezrtsjhfr84iusjfo84f] C:\DOCUME~1\ITALEN~1\LOCALS~1\Temp\csrssc.exe
O4 - HKCU\..\Run: [sysguard] C:\WINDOWS\sysguard.exe
O4 - HKCU\..\Run: [lrijh8s73jhbfgfd] C:\WINDOWS\TEMP\winlognn.exe
O4 - HKCU\..\Run: [MS AntiSpyware 2009] "C:\Documents and Settings\All Users\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009\msas2009.exe" /autorun
O4 - HKCU\..\Run: [RegistryMechanic] C:\Program Files\Registry Mechanic\RegMech.exe /H
O4 - Global Startup: $McRebootA5E6DEAA56$.lnk = ?
O4 - Global Startup: Dell Network Assistant.lnk = ?
O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {2019DC25-D1C0-11D6-97B3-0008A124F542} (StreamPlug Class) - http://www.streamplug.com/StreamPlug/beta/SP.cab
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} (Java Plug-in 1.5.0) - http://support.magicjack.com/jre-1_5_0_14-windows-i586-p.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/RACtrl.cab
O18 - Protocol: HTLFP - {03B7A5D4-96B0-4316-95F8-072D326A58F1} - ielpview.dll (file missing)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: vfsp - (no CLSID) - (no file)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Advanced Networking Service (hnmsvc) - SingleClick Systems - C:\Program Files\Dell Network Assistant\hnm_svc.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: KService - Unknown owner - C:\Program Files\Kontiki\KService.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: Trend Micro Central Control Component (SfCtlCom) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
O23 - Service: Trend Micro Unauthorized Change Prevention Service (TMBMServer) - Trend Micro Inc. - C:\Program Files\Trend Micro\BM\TMBMSRV.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\TmProxy.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

--
End of file - 9831 bytes
************************************************************

thanks.

Hello.

• Open HijackThis
  
• Choose "Do a system scan only"
  
• Check the boxes in front of these lines:
  
  
  F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\Documents and Settings\iTalent-1\pjpa.exe \s,C:\WINDOWS\system32\hhupd.exe,C:\WINDOWS\system32\7z.exe,C:\WINDOWS\system32\windres.exe,C:\WINDOWS\system32\idaw64.exe,C:\WINDOWS\system32\undname.exe,C:\WINDOWS\system32\ndetect.exe,C:\WINDOWS\system32\ndetect.exe,C:\WINDOWS\system32\pdbcopy.exe,
  O1 - Hosts: 195.245.119.131 browser-security.microsoft.com
  O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
  O4 - HKLM\..\Run: [jsf8uiw3jnjgffght] C:\DOCUME~1\ITALEN~1\LOCALS~1\Temp\winlognn.exe
  O4 - HKLM\..\Run: [Qtipe] rundll32.exe "C:\WINDOWS\Emucofajahigafek.dll",e
  O4 - HKLM\..\Run: [lrijh8s73jhbfgfd] C:\WINDOWS\TEMP\winlognn.exe
  O4 - HKLM\..\Run: [Axayara] rundll32.exe "C:\WINDOWS\ucahutaf.dll",e
  O4 - HKLM\..\Run: [services] C:\WINDOWS\services.exe
  - HKCU\..\Run: [systeminit.exe] C:\DOCUME~1\ITALEN~1\LOCALS~1\Temp\systeminit.exe
  O4 - HKCU\..\Run: [Cognac] C:\DOCUME~1\ITALEN~1\LOCALS~1\Temp\perce.jpg.exe
  O4 - HKCU\..\Run: [jsf8uiw3jnjgffght] C:\DOCUME~1\ITALEN~1\LOCALS~1\Temp\winlognn.exe
  O4 - HKCU\..\Run: [tezrtsjhfr84iusjfo84f] C:\DOCUME~1\ITALEN~1\LOCALS~1\Temp\csrssc.exe
  O4 - HKCU\..\Run: [sysguard] C:\WINDOWS\sysguard.exe
  O4 - HKCU\..\Run: [lrijh8s73jhbfgfd] C:\WINDOWS\TEMP\winlognn.exe
  O4 - HKCU\..\Run: [MS AntiSpyware 2009] "C:\Documents and Settings\All Users\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009\msas2009.exe" /autorun
  O4 - Global Startup: $McRebootA5E6DEAA56$.lnk = ?
  O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
  O18 - Protocol: HTLFP - {03B7A5D4-96B0-4316-95F8-072D326A58F1} - ielpview.dll (file missing)
  O18 - Protocol: vfsp - (no CLSID) - (no file)
  
  
  
• Press "Fix Checked"
  
• Close Hijack This.
  

• Download combofix from here combofix.exe
  
• Please disable your local AV (Anti-virus) by right clicking it's icon in the tray, and exit it. See HERE for how to disable your AV.
  
• Double click on ComboFix.exe.
  
• Follow the prompts. NOTE:
  
• ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
  ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***
  
  **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will automatically proceed with its scan.
  
  
  
• The Recovery Console provides a recovery/repair mode should a problem occur during a Combofix run.
  
  
  
  
• Allow ComboFix to download the Recovery Console.
  
• Accept the End-User License Agreement.
  
• The Recovery Console will be installed.
  
• You will then get this next prompt that asks if you want to continue the malware scan, select yes
  
  
  
  
• Allow combofix to run
  
• Post C:\combofix.txt back here.
  
  Note:
  Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
  

Hi...

Followed the steps till "Fix Checked".

I am unable to download the combofix.exe. from given location.

rgds,
vpmdvpmd

1. Please download The Avenger by Swandog46 to your Desktop
Link: HERE or HERE.

• Click on Avenger.zip to open the file
  
• Extract avenger.exe to your desktop
  

2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):

Files to delete:
C:\Documents and Settings\iTalent-1\pjpa.exe
C:\WINDOWS\system32\hhupd.exe
C:\WINDOWS\system32\7z.exe
C:\WINDOWS\system32\windres.exe
C:\WINDOWS\system32\idaw64.exe
C:\WINDOWS\system32\undname.exe
C:\WINDOWS\system32\ndetect.exe
C:\WINDOWS\system32\pdbcopy.exe
C:\WINDOWS\Emucofajahigafek.dll
C:\WINDOWS\ucahutaf.dll
C:\WINDOWS\services.exe
C:\WINDOWS\sysguard.exe

Folders to delete:
C:\Documents and Settings\All Users\Application Data\CrucialSoft Ltd

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, start The Avenger program by clicking on its icon on your desktop.

• Under "Input script here:", paste in the script from the quote box above.
  
• Leave the ticked box "Scan for rootkit" ticked.
  
• Then tick "Disable any rootkits found"
  
• Now click on the Execute to begin execution of the script.
  
• Answer "Yes" twice when prompted.
  
  The Avenger will automatically do the following:
  
  
• It will Restart your computer.
  
• On reboot, it will briefly open a black command window on your desktop, this is normal.
  
• After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
  
• The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
  

4. Please copy/paste the content of c:\avenger.txt into your reply.

Here is the avenger.txt

************************************************

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

File "C:\Documents and Settings\iTalent-1\pjpa.exe" deleted successfully.
File "C:\WINDOWS\system32\hhupd.exe" deleted successfully.
File "C:\WINDOWS\system32\7z.exe" deleted successfully.
File "C:\WINDOWS\system32\windres.exe" deleted successfully.
File "C:\WINDOWS\system32\idaw64.exe" deleted successfully.
File "C:\WINDOWS\system32\undname.exe" deleted successfully.
File "C:\WINDOWS\system32\ndetect.exe" deleted successfully.
File "C:\WINDOWS\system32\pdbcopy.exe" deleted successfully.
File "C:\WINDOWS\Emucofajahigafek.dll" deleted successfully.
File "C:\WINDOWS\ucahutaf.dll" deleted successfully.
File "C:\WINDOWS\services.exe" deleted successfully.
File "C:\WINDOWS\sysguard.exe" deleted successfully.
Folder "C:\Documents and Settings\All Users\Application Data\CrucialSoft Ltd" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

****************************************************

On rebooting I got the following error

Error loading C:\Windows\ucahutaf.dll
The specified module could not be found

thanks...

Also while restarting - I got console error -- BAD_POOL_ERROR.

Had to manually shut down and start the system.

thanks for your patience and time....

rgds,
vpmdvpmd

The error is caused by malware still in the run key, we'll fix it soon.

• Please download DDS by sUBs to your Desktop (Important!!) from one of these locations:
  Link 1
  Link 2
  Link 3
  
• Double click DDS.scr to run
  
• When complete, DDS.txt will open.
  
• Save the report to your Desktop.
  
• Copy and paste DDS.txt back here, I don't need to see attach.txt.
  

Hi,

I get the same error again - "windows cannot find 'cmd '. Make sure you typed the name correctly , and then try again...To search for the file click the Start button and then click Search"

I downloaded - Link 1 - dds.com , link2 - dds.scr, Link3 -dds.pif.

All the unwanted popups - BankerFox.A and Nuqel have stopped.. but all web pages are loaded w/o images...

thanks a ton...

Lets see if this will work.

• Download random's system information tool (RSIT) by random/random from here and save it to your desktop.
  
• Double click on RSIT.exe to run RSIT.
  
• Click Continue at the disclaimer screen.
  
• Once it has finished, two logs will open. Please post the contents of both log.txt (<< will be maximized) and info.txt (<< will be minimized)
  

log.txt - part 1

**************************************************
Logfile of random's system information tool 1.05 (written by random/random)
Run by iTalent-1 at 2009-02-09 12:56:48
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 66 GB (87%) free of 76 GB
Total RAM: 446 MB (12% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:57:07 PM, on 2/9/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\i386kd.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Dell Network Assistant\hnm_svc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Kontiki\KService.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe
C:\Program Files\Trend Micro\BM\TMBMSRV.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\services.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Dell Network Assistant\ezi_hnm2.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\Internet Security\TmProxy.exe
C:\Documents and Settings\iTalent-1\Desktop\RSIT.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Trend Micro\HijackThis\iTalent-1.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = partnerpage.google.com/smallbiz.dell.com/en_us?hl=en&client=dell-usuk&channel=us-smb&ibd=2080208
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mail.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://server.toolbar.rediff.com/toolbar/3.0/sidesearch.html?mode=toolbar
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = partnerpage.google.com/smallbiz.dell.com/en_us?hl=en&client=dell-usuk&channel=us-smb&ibd=2080208
F2 - REG:system.ini: UserInit=C:\WINDOWS\SYSTEM32\Userinit.exe,C:\WINDOWS\system32\i386kd.exe,C:\WINDOWS\system32\ndetect.exe,C:\WINDOWS\system32\c++.exe,
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [UfSeAgnt.exe] "C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe"
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [Axayara] rundll32.exe "C:\WINDOWS\ucahutaf.dll",e
O4 - HKLM\..\Run: [services] C:\WINDOWS\services.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [systeminit.exe] C:\DOCUME~1\ITALEN~1\LOCALS~1\Temp\systeminit.exe
O4 - HKCU\..\Run: [RegistryMechanic] C:\Program Files\Registry Mechanic\RegMech.exe /H
O4 - HKUS\S-1-5-18\..\Run: [bnuywaoc.exe] C:\WINDOWS\bnuywaoc.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [xlmqladk.exe] C:\WINDOWS\xlmqladk.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [bnuywaoc.exe] C:\WINDOWS\bnuywaoc.exe (User 'Default user')
O4 - Global Startup: Dell Network Assistant.lnk = ?
O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {2019DC25-D1C0-11D6-97B3-0008A124F542} (StreamPlug Class) - http://www.streamplug.com/StreamPlug/beta/SP.cab
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} (Java Plug-in 1.5.0) - http://support.magicjack.com/jre-1_5_0_14-windows-i586-p.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/RACtrl.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: vfsp - (no CLSID) - (no file)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Advanced Networking Service (hnmsvc) - SingleClick Systems - C:\Program Files\Dell Network Assistant\hnm_svc.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: KService - Unknown owner - C:\Program Files\Kontiki\KService.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: Trend Micro Central Control Component (SfCtlCom) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
O23 - Service: Trend Micro Unauthorized Change Prevention Service (TMBMServer) - Trend Micro Inc. - C:\Program Files\Trend Micro\BM\TMBMSRV.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\TmProxy.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

--
End of file - 8392 bytes

***********************************************************

log.txt - part2
**********************************************************

======Scheduled tasks folder======

C:\WINDOWS\tasks\At1.job
C:\WINDOWS\tasks\At10.job
C:\WINDOWS\tasks\At11.job
C:\WINDOWS\tasks\At12.job
C:\WINDOWS\tasks\At13.job
C:\WINDOWS\tasks\At14.job
C:\WINDOWS\tasks\At15.job
C:\WINDOWS\tasks\At16.job
C:\WINDOWS\tasks\At17.job
C:\WINDOWS\tasks\At18.job
C:\WINDOWS\tasks\At19.job
C:\WINDOWS\tasks\At2.job
C:\WINDOWS\tasks\At20.job
C:\WINDOWS\tasks\At21.job
C:\WINDOWS\tasks\At22.job
C:\WINDOWS\tasks\At23.job
C:\WINDOWS\tasks\At24.job
C:\WINDOWS\tasks\At3.job
C:\WINDOWS\tasks\At4.job
C:\WINDOWS\tasks\At5.job
C:\WINDOWS\tasks\At6.job
C:\WINDOWS\tasks\At7.job
C:\WINDOWS\tasks\At8.job
C:\WINDOWS\tasks\At9.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{22BF413B-C6D2-4d91-82A9-A0F997BA588C}]
Skype add-on (mastermind) - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2009-01-29 1088296]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]
RealPlayer Download and Record Plugin for Internet Explorer - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll [2008-03-25 308856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2009-02-07 320920]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - c:\program files\google\googletoolbar1.dll [2009-02-07 2403392]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - &Google - c:\program files\google\googletoolbar1.dll [2009-02-07 2403392]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"DellSupportCenter"=C:\Program Files\Dell Support Center\bin\sprtcmd.exe /P DellSupportCenter []
"TkBellExe"=C:\Program Files\Common Files\Real\Update_OB\realsched.exe [2008-03-25 185896]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-01-11 39792]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-02-07 136600]
"UfSeAgnt.exe"=C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe [2008-07-29 1398024]
"ISTray"=C:\Program Files\Spyware Doctor\pctsTray.exe [2008-08-25 1168264]
"Axayara"=C:\WINDOWS\ucahutaf.dll []
"services"=C:\WINDOWS\services.exe [2009-02-09 55809]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-13 32256]
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe [2009-02-07 171448]
"systeminit.exe"=C:\DOCUME~1\ITALEN~1\LOCALS~1\Temp\systeminit.exe []
"RegistryMechanic"=C:\Program Files\Registry Mechanic\RegMech.exe [2008-07-08 2828184]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
Dell Network Assistant.lnk - C:\WINDOWS\Installer\{0240BDFB-2995-4A3F-8C96-18D41282B716}\Icon0240BDFB3.exe
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2007-10-16 90112]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\cpqsrwex.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\cpqsrwex.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\sdauxservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\sdcoreservice]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
"NoFolderOptions"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Google\Google Talk\googletalk.exe"="C:\Program Files\Google\Google Talk\googletalk.exe:*:Enabled:Google Talk"
"C:\Program Files\Globe7\Globe7Phone.exe"="C:\Program Files\Globe7\Globe7Phone.exe:*:Enabled:Globe7"
"C:\Program Files\Winamp Remote\bin\Orb.exe"="C:\Program Files\Winamp Remote\bin\Orb.exe:*:Enabled:Orb"
"C:\Program Files\Winamp Remote\bin\OrbTray.exe"="C:\Program Files\Winamp Remote\bin\OrbTray.exe:*:Enabled:OrbTray"
"C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe"="C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:*:Enabled:Orb Stream Client"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Rediff Bol\RediffMessenger.exe"="C:\Program Files\Rediff Bol\RediffMessenger.exe:*:Enabled:Rediff Bol 8.0 "
"C:\Program Files\Rediff Bol\AppWorkingDir\Client\Video\Talk&See.exe"="C:\Program Files\Rediff Bol\AppWorkingDir\Client\Video\Talk&See.exe:*:Enabled:Rediff Bol Talk & See"
"C:\Program Files\Real\RealPlayer\realplay.exe"="C:\Program Files\Real\RealPlayer\realplay.exe:*:Enabled:RealPlayer"
"C:\Program Files\Internet Explorer\iexplore.exe"="C:\Program Files\Internet Explorer\iexplore.exe:*:Enabled:Internet Explorer"
"C:\Program Files\Mercury Interactive\LoadRunner\launch_service\bin\magentproc.exe"="C:\Program Files\Mercury Interactive\LoadRunner\launch_service\bin\magentproc.exe:*:Enabled:Mercury Launcher Process"
"C:\Program Files\Mercury Interactive\LoadRunner\bin\vugen.exe"="C:\Program Files\Mercury Interactive\LoadRunner\bin\vugen.exe:*:Enabled:vugen"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\WINDOWS\system32\mmc.exe"="C:\WINDOWS\system32\mmc.exe:*:Enabled:Microsoft Management Console"
"C:\Program Files\SopCast\adv\SopAdver.exe"="C:\Program Files\SopCast\adv\SopAdver.exe:*:Enabled:SopCast Adver"
"C:\Program Files\SopCast\SopCast.exe"="C:\Program Files\SopCast\SopCast.exe:*:Enabled:SopCast Main Application"
"C:\Program Files\Kontiki\KService.exe"="C:\Program Files\Kontiki\KService.exe:*:Enabled:Delivery Manager Service"
"C:\Program Files\VoipRaider.com\VoipRaider\VoipRaider.exe"="C:\Program Files\VoipRaider.com\VoipRaider\VoipRaider.exe:*:Enabled:VoipRaider"
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"C:\Program Files\Yahoo!\Messenger\YServer.exe"="C:\Program Files\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server"
"C:\Documents and Settings\italent\Application Data\mjusbsp\magicJack.exe"="C:\Documents and Settings\italent\Application Data\mjusbsp\magicJack.exe:*:Enabled:magicJack"
"C:\Program Files\Dell Network Assistant\ezi_hnm2.exe"="C:\Program Files\Dell Network Assistant\ezi_hnm2.exe:*:Enabled:Dell Network Assistant"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype. Take a deep breath "
"C:\Program Files\LimeWire\LimeWire.exe"="C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire"
"\??\C:\WINDOWS\system32\winlogon.exe"="\??\C:\WINDOWS\system32\winlogon.exe:*:enabled:@shell32.dll,-1"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
****************************************************

log.txt - part3
************************************************************======List of files/folders created in the last 1 months======

2009-02-09 12:56:48 ----D---- C:\rsit
2009-02-09 12:22:20 ----N---- C:\WINDOWS\system32\3B.tmp
2009-02-09 12:22:17 ----A---- C:\WINDOWS\system32\39.tmp
2009-02-09 12:22:02 ----A---- C:\WINDOWS\system32\38.tmp
2009-02-09 12:21:46 ----A---- C:\WINDOWS\system32\26.tmp
2009-02-09 12:19:04 ----A---- C:\WINDOWS\system32\ndetect.exe
2009-02-09 12:19:03 ----N---- C:\WINDOWS\system32\35.tmp
2009-02-09 12:19:03 ----A---- C:\WINDOWS\xlmqladk.exe
2009-02-09 12:19:03 ----A---- C:\WINDOWS\system32\34.tmp
2009-02-09 12:13:30 ----A---- C:\WINDOWS\services.exe
2009-02-09 12:13:26 ----A---- C:\WINDOWS\system32\27.tmp
2009-02-09 12:13:04 ----A---- C:\WINDOWS\system32\20.tmp
2009-02-09 12:09:44 ----D---- C:\Avenger
2009-02-09 12:09:43 ----A---- C:\avenger.txt
2009-02-09 12:07:10 ----A---- C:\zip.exe
2009-02-09 12:07:10 ----A---- C:\cleanup.exe
2009-02-09 12:07:10 ----A---- C:\cleanup.bat
2009-02-09 12:00:08 ----D---- C:\32788R22FWJFW
2009-02-09 11:53:51 ----A---- C:\WINDOWS\bnuywaoc.exe
2009-02-09 11:53:50 ----A---- C:\WINDOWS\system32\i386kd.exe
2009-02-09 11:53:49 ----N---- C:\WINDOWS\system32\33.tmp
2009-02-09 11:53:49 ----A---- C:\WINDOWS\system32\31.tmp
2009-02-09 11:37:03 ----A---- C:\WINDOWS\system32\2D.tmp
2009-02-09 11:37:01 ----A---- C:\WINDOWS\system32\2A.tmp
2009-02-09 11:36:59 ----A---- C:\WINDOWS\system32\29.tmp
2009-02-09 10:46:39 ----N---- C:\WINDOWS\system32\24.tmp
2009-02-09 10:46:38 ----A---- C:\WINDOWS\system32\23.tmp
2009-02-09 10:46:21 ----A---- C:\WINDOWS\system32\22.tmp
2009-02-09 10:46:18 ----A---- C:\WINDOWS\system32\1E.tmp
2009-02-09 10:44:23 ----HD---- C:\WINDOWS\PIF
2009-02-09 09:52:51 ----A---- C:\WINDOWS\system32\iehelper.dll
2009-02-09 00:27:57 ----A---- C:\WINDOWS\system32\4E.tmp
2009-02-09 00:26:12 ----A---- C:\WINDOWS\system32\49.tmp
2009-02-09 00:26:10 ----A---- C:\WINDOWS\system32\47.tmp
2009-02-09 00:23:47 ----D---- C:\Program Files\Spyware Doctor
2009-02-09 00:23:47 ----D---- C:\Documents and Settings\iTalent-1\Application Data\PC Tools
2009-02-09 00:11:16 ----A---- C:\WINDOWS\system32\63.tmp
2009-02-09 00:11:03 ----A---- C:\WINDOWS\system32\61.tmp
2009-02-09 00:04:14 ----A---- C:\WINDOWS\system32\5D.tmp
2009-02-09 00:04:14 ----A---- C:\WINDOWS\system32\5C.tmp
2009-02-09 00:04:06 ----A---- C:\WINDOWS\system32\58.tmp
2009-02-09 00:04:00 ----A---- C:\WINDOWS\system32\56.tmp
2009-02-09 00:02:53 ----A---- C:\WINDOWS\system32\54.tmp
2009-02-09 00:02:53 ----A---- C:\WINDOWS\system32\53.tmp
2009-02-09 00:01:31 ----A---- C:\WINDOWS\system32\46.tmp
2009-02-09 00:01:28 ----A---- C:\WINDOWS\system32\44.tmp
2009-02-08 23:48:07 ----A---- C:\WINDOWS\system32\STKIT432.DLL
2009-02-08 23:48:05 ----D---- C:\Program Files\Registry Mechanic
2009-02-08 23:15:45 ----A---- C:\WINDOWS\system32\3C.tmp
2009-02-08 23:15:43 ----A---- C:\WINDOWS\system32\3A.tmp
2009-02-08 23:10:37 ----A---- C:\WINDOWS\system32\37.tmp
2009-02-08 23:10:35 ----A---- C:\WINDOWS\system32\2B.tmp
2009-02-08 20:11:13 ----A---- C:\WINDOWS\system32\32.tmp
2009-02-08 20:10:32 ----A---- C:\WINDOWS\system32\30.tmp
2009-02-08 20:10:32 ----A---- C:\WINDOWS\system32\2F.tmp
2009-02-08 20:09:41 ----A---- C:\WINDOWS\system32\2E.tmp
2009-02-08 20:09:40 ----A---- C:\WINDOWS\system32\2C.tmp
2009-02-08 20:08:55 ----A---- C:\WINDOWS\system32\28.tmp
2009-02-08 20:08:54 ----A---- C:\WINDOWS\system32\1C.tmp
2009-02-08 20:06:08 ----D---- C:\WINDOWS\system32\Quarantine
2009-02-08 20:05:09 ----A---- C:\WINDOWS\adobe.bat
2009-02-08 20:05:00 ----A---- C:\WINDOWS\system32\25.tmp
2009-02-08 20:01:33 ----A---- C:\WINDOWS\system32\21.tmp
2009-02-08 19:58:01 ----A---- C:\WINDOWS\system32\1F.tmp
2009-02-08 19:57:58 ----A---- C:\WINDOWS\system32\1D.tmp
2009-02-08 19:56:42 ----A---- C:\WINDOWS\system32\1B.tmp
2009-02-08 19:56:42 ----A---- C:\WINDOWS\system32\1A.tmp
2009-02-08 19:54:11 ----A---- C:\WINDOWS\system32\19.tmp
2009-02-08 19:54:07 ----A---- C:\WINDOWS\system32\15.tmp
2009-02-08 19:50:19 ----A---- C:\WINDOWS\file.bat
2009-02-08 19:50:17 ----A---- C:\WINDOWS\system32\14.tmp
2009-02-08 19:46:29 ----A---- C:\WINDOWS\system32\12.tmp
2009-02-08 19:46:28 ----A---- C:\WINDOWS\system32\10.tmp
2009-02-08 19:30:54 ----A---- C:\WINDOWS\icuxeqay.dll
2009-02-08 19:27:55 ----A---- C:\WINDOWS\system32\43.tmp
2009-02-08 19:27:54 ----A---- C:\WINDOWS\system32\42.tmp
2009-02-08 19:19:52 ----A---- C:\WINDOWS\system32\actcontroller.exe
2009-02-08 19:19:51 ----A---- C:\WINDOWS\system32\40.tmp
2009-02-08 19:19:49 ----A---- C:\WINDOWS\system32\3E.tmp
2009-02-08 18:59:02 ----D---- C:\Documents and Settings\All Users\Application Data\Trend Micro
2009-02-08 18:57:30 ----D---- C:\Program Files\Trend Micro
2009-02-08 18:34:19 ----A---- C:\WINDOWS\system32\17.tmp
2009-02-08 18:34:18 ----A---- C:\WINDOWS\system32\16.tmp
2009-02-08 18:28:32 ----A---- C:\WINDOWS\system32\c++.exe
2009-02-08 18:28:28 ----A---- C:\WINDOWS\system32\D.tmp
2009-02-08 18:12:17 ----A---- C:\WINDOWS\system32\hs78k4rgf4d.dll
2009-02-08 18:12:14 ----A---- C:\WINDOWS\system32\C.tmp
2009-02-08 18:12:12 ----A---- C:\WINDOWS\system32\A.tmp
2009-02-08 18:09:52 ----A---- C:\WINDOWS\system32\rah3b8ffdnd.dll
2009-02-08 18:08:34 ----A---- C:\WINDOWS\p2hhr.bat
2009-02-08 18:08:29 ----A---- C:\WINDOWS\system32\deviceemulator.exe
2009-02-08 18:08:27 ----A---- C:\WINDOWS\system32\59.tmp
2009-02-08 18:07:54 ----D---- C:\Program Files\Microsoft Common
2009-02-08 18:07:31 ----A---- C:\WINDOWS\winsock32.exe
2009-02-08 18:07:12 ----A---- C:\WINDOWS\kernel32.exe
2009-02-08 18:06:49 ----A---- C:\WINDOWS\system32\7c5a3NJ4.exe.a_a
2009-02-08 18:06:49 ----A---- C:\WINDOWS\system32\7c5a3NJ4.exe
2009-02-07 12:19:34 ----D---- C:\Documents and Settings\iTalent-1\Application Data\Mozilla
2009-02-07 12:17:35 ----D---- C:\Documents and Settings\iTalent-1\Application Data\LimeWire
2009-02-07 12:16:15 ----A---- C:\WINDOWS\system32\javaws.exe
2009-02-07 12:16:15 ----A---- C:\WINDOWS\system32\deploytk.dll
2009-02-07 12:16:14 ----A---- C:\WINDOWS\system32\javaw.exe
2009-02-07 12:16:14 ----A---- C:\WINDOWS\system32\java.exe
2009-02-07 12:13:54 ----D---- C:\Program Files\LimeWire
2009-02-07 12:04:56 ----D---- C:\Documents and Settings\iTalent-1\Application Data\Google
2009-02-07 11:58:51 ----D---- C:\Documents and Settings\iTalent-1\Application Data\skypePM
2009-02-07 11:57:34 ----D---- C:\Documents and Settings\iTalent-1\Application Data\Skype
2009-02-07 11:56:23 ----D---- C:\Program Files\Common Files\Skype
2009-02-07 11:56:19 ----RD---- C:\Program Files\Skype
2009-02-04 00:14:21 ----HDC---- C:\WINDOWS\$NtUninstallKB958687$

======List of files/folders modified in the last 1 months======

2009-02-09 12:51:57 ----AD---- C:\WINDOWS\Temp
2009-02-09 12:37:09 ----AD---- C:\Documents and Settings\All Users\Application Data\TEMP
2009-02-09 12:25:35 ----D---- C:\WINDOWS\system32
2009-02-09 12:25:34 ----AC---- C:\WINDOWS\system32\PerfStringBackup.INI
2009-02-09 12:21:28 ----D---- C:\WINDOWS
2009-02-09 12:21:17 ----D---- C:\WINDOWS\system32\drivers
2009-02-09 12:21:13 ----A---- C:\WINDOWS\ModemLog_Conexant HDA D330 MDC V.92 Modem.txt
2009-02-09 12:19:39 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-02-09 12:13:33 ----D---- C:\WINDOWS\system32\CatRoot2
2009-02-09 11:28:20 ----SHD---- C:\System Volume Information
2009-02-09 11:28:20 ----D---- C:\WINDOWS\system32\Restore
2009-02-09 11:24:39 ----D---- C:\WINDOWS\system32\FxsTmp
2009-02-09 09:21:14 ----D---- C:\WINDOWS\Prefetch
2009-02-09 08:42:06 ----RD---- C:\Program Files
2009-02-09 00:05:54 ----D---- C:\WINDOWS\Minidump
2009-02-08 23:11:50 ----D---- C:\WINDOWS\SoftwareDistribution
2009-02-08 20:10:07 ----HD---- C:\WINDOWS\inf
2009-02-08 19:01:39 ----D---- C:\WINDOWS\system32\CatRoot
2009-02-08 18:59:11 ----SHD---- C:\WINDOWS\Installer
2009-02-08 18:55:41 ----D---- C:\Program Files\Common Files
2009-02-08 18:55:40 ----D---- C:\Documents and Settings\All Users\Application Data\McAfee
2009-02-08 18:55:36 ----D---- C:\Program Files\McAfee
2009-02-08 18:52:00 ----SD---- C:\WINDOWS\Tasks
2009-02-08 18:42:19 ----D---- C:\i386
2009-02-08 18:33:04 ----D---- C:\dell
2009-02-08 18:17:59 ----SD---- C:\Documents and Settings\iTalent-1\Application Data\Microsoft
2009-02-08 18:12:15 ----AC---- C:\WINDOWS\system32\regwiz.exe
2009-02-07 21:00:34 ----D---- C:\Documents and Settings\iTalent-1\Application Data\Real
2009-02-07 20:56:39 ----AC---- C:\WINDOWS\cdplayer.ini
2009-02-07 12:14:53 ----D---- C:\Program Files\Java
2009-02-07 11:57:26 ----D---- C:\Program Files\Google
2009-02-07 11:56:24 ----D---- C:\Documents and Settings\All Users\Application Data\Skype
2009-02-04 11:44:47 ----D---- C:\Program Files\Creative
2009-02-04 00:14:23 ----RSHD---- C:\WINDOWS\system32\dllcache
2009-02-04 00:13:50 ----HD---- C:\WINDOWS\$hf_mig$
2009-02-04 00:04:04 ----D---- C:\Documents and Settings
2009-02-03 23:56:03 ----A---- C:\WINDOWS\imsins.BAK
2009-02-03 23:52:11 ----D---- C:\WINDOWS\twain_32
2009-02-03 23:50:26 ----D---- C:\Documents and Settings\All Users\Application Data\SupportSoft
2009-02-03 23:50:21 ----D---- C:\Program Files\Dell Support Center
2009-02-03 19:26:34 ----D---- C:\Program Files\DivX
2009-02-03 19:24:28 ----AC---- C:\WINDOWS\ODBC.INI
2009-02-03 19:13:51 ----A---- C:\YServer.txt
2009-02-03 19:12:24 ----RSD---- C:\WINDOWS\assembly
2009-02-03 19:12:19 ----D---- C:\Program Files\Common Files\Intuit
2009-02-03 19:10:49 ----RSD---- C:\WINDOWS\Fonts
2009-02-03 19:03:14 ----SHD---- C:\RECYCLER
2009-02-03 18:36:37 ----D---- C:\Program Files\Common Files\InstallShield
2009-02-03 18:36:34 ----AC---- C:\WINDOWS\mercury.ini
2009-02-03 18:36:07 ----HD---- C:\Program Files\InstallShield Installation Information

**************************************************************

log.txt - part 4

********************************************************

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 IKSysFlt;System Filter Driver; C:\WINDOWS\system32\drivers\iksysflt.sys [2008-08-25 66952]
R1 IKSysSec;System Security Driver; C:\WINDOWS\system32\drivers\iksyssec.sys [2008-08-25 81288]
R1 tmtdi;Trend Micro TDI Driver; C:\WINDOWS\system32\DRIVERS\tmtdi.sys [2008-02-15 65936]
R1 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2008-04-13 8832]
R2 mdmxsdk;mdmxsdk; C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys [2007-12-02 12672]
R2 Packet;Auto Internet Protocol; C:\WINDOWS\system32\DRIVERS\packet.sys [2006-12-18 12672]
R2 paldrv;paldrv; \??\C:\WINDOWS\system32\pal_drv.sys []
R2 rimmptsk;rimmptsk; C:\WINDOWS\system32\DRIVERS\rimmptsk.sys [2007-04-23 32256]
R2 tmactmon;tmactmon; \??\C:\WINDOWS\system32\drivers\tmactmon.sys []
R2 tmcomm;tmcomm; \??\C:\WINDOWS\system32\drivers\tmcomm.sys []
R2 tmevtmgr;tmevtmgr; \??\C:\WINDOWS\system32\drivers\tmevtmgr.sys []
R2 tmpreflt;tmpreflt; C:\WINDOWS\system32\DRIVERS\tmpreflt.sys [2008-08-16 36368]
R2 tmxpflt;tmxpflt; C:\WINDOWS\system32\DRIVERS\tmxpflt.sys [2008-08-16 205328]
R2 vsapint;vsapint; C:\WINDOWS\system32\DRIVERS\vsapint.sys [2008-08-16 1195448]
R3 BCM43XX;Dell Wireless WLAN Card Driver; C:\WINDOWS\system32\DRIVERS\bcmwl5.sys [2007-10-09 1123328]
R3 bcm4sbxp;Broadcom 440x 10/100 Integrated Controller XP Driver; C:\WINDOWS\system32\DRIVERS\bcm4sbxp.sys [2007-04-23 45568]
R3 CmBatt;Microsoft ACPI Control Method Battery Driver; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2008-04-13 13952]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 HSF_DPV;HSF_DPV; C:\WINDOWS\system32\DRIVERS\HSF_DPV.sys [2007-12-02 989952]
R3 HSFHWAZL;HSFHWAZL; C:\WINDOWS\system32\DRIVERS\HSFHWAZL.sys [2007-12-02 211200]
R3 Passthru;Service; C:\WINDOWS\system32\DRIVERS\ndisio.sys [2009-02-08 53248]
R3 sdbus;sdbus; C:\WINDOWS\system32\DRIVERS\sdbus.sys [2008-04-13 79232]
R3 STHDA;SigmaTel High Definition Audio CODEC; C:\WINDOWS\system32\drivers\sthda.sys [2007-04-23 1228296]
R3 SynTP;Synaptics TouchPad Driver; C:\WINDOWS\system32\DRIVERS\SynTP.sys [2007-04-27 202912]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Microsoft USB Standard Hub Driver; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbohci;Microsoft USB Open Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-13 17152]
R3 winachsf;winachsf; C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys [2007-12-02 731136]
S1 ethccjcq;ethccjcq; C:\WINDOWS\system32\drivers\ethccjcq.sys [2009-02-09 137600]
S1 kbdhid;Keyboard HID Driver; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-13 14592]
S3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2007-10-16 1777152]
S3 CA561;ICatch (VI) PC Camera; C:\WINDOWS\System32\Drivers\SPCA561.SYS []
S3 CCDECODE;Closed Caption Decoder; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 E100B;Intel(R) PRO Adapter Driver; C:\WINDOWS\system32\DRIVERS\e100b325.sys [2001-08-17 117760]
S3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
S3 lmimirr;lmimirr; C:\WINDOWS\system32\DRIVERS\lmimirr.sys []
S3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-17 12160]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2004-08-03 1897408]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 SONYPVU1;Sony USB Filter Driver (SONYPVU1); C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS [2001-08-17 7552]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 usbaudio;USB Audio Driver (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-13 60032]
S3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 usbscan;USB Scanner Driver; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S3 WSTCODEC;World Standard Teletext Codec; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S4 agp440;Intel AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\agp440.sys [2008-04-13 42368]
S4 agpCPQ;Compaq AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\agpCPQ.sys [2008-04-13 44928]
S4 alim1541;ALI AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\alim1541.sys [2008-04-13 42752]
S4 amdagp;AMD AGP Bus Filter Driver; C:\WINDOWS\system32\DRIVERS\amdagp.sys [2008-04-13 43008]
S4 cbidf;cbidf; C:\WINDOWS\system32\DRIVERS\cbidf2k.sys [2001-08-17 13952]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\DRIVERS\intelide.sys [2008-04-13 5504]
S4 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 36352]
S4 sisagp;SIS AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\sisagp.sys [2008-04-13 40960]
S4 viaagp;VIA AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\viaagp.sys [2008-04-13 42240]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 hnmsvc;Advanced Networking Service; C:\Program Files\Dell Network Assistant\hnm_svc.exe [2007-05-25 112176]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-02-07 152984]
R2 KService;KService; C:\Program Files\Kontiki\KService.exe [2007-03-09 3068352]
R2 sdAuxService;PC Tools Auxiliary Service; C:\Program Files\Spyware Doctor\pctsAuxs.exe [2008-06-13 356920]
R2 sdCoreService;PC Tools Security Service; C:\Program Files\Spyware Doctor\pctsSvc.exe [2008-10-09 1079176]
R2 SfCtlCom;Trend Micro Central Control Component; C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe [2008-07-29 698888]
R2 TMBMServer;Trend Micro Unauthorized Change Prevention Service; C:\Program Files\Trend Micro\BM\TMBMSRV.exe [2008-02-15 333064]
R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2005-01-28 55808]
R2 wltrysvc;Dell Wireless WLAN Tray Service; C:\WINDOWS\System32\WLTRYSVC.EXE [2007-10-09 40960]
R3 tmproxy;Trend Micro Proxy Service; C:\Program Files\Trend Micro\Internet Security\TmProxy.exe [2008-02-26 648456]
S2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2007-10-16 450560]
S2 Fax;Fax; C:\WINDOWS\system32\fxssvc.exe [2008-04-13 284672]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-02-07 138168]

-----------------EOF-----------------
********************************************************

info.txt - part 1
**********************************************************

nfo.txt logfile of random's system information tool 1.05 2009-02-09 12:57:12

======Uninstall list======

-->C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
-->C:\WINDOWS\IsUninst.exe -fC:\WINDOWS\orun32.isu
-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{439C01D2-84A2-4421-9141-ED58FE79C6BE}\setup.exe" -l0x9
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->MsiExec.exe /X{ECA1A3B6-898F-4DCE-9F04-714CF3BA126B}
Adobe Reader 8.1.2-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81200000003}
ATI Catalyst Control Center-->MsiExec.exe /I{EF40BAC3-372B-46F4-A32D-B37CF4217CE7}
ATI Display Driver-->rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
Broadcom Management Programs-->MsiExec.exe /I{C99C0593-3B48-41D9-B42F-6E035B320449}
Browser Address Error Redirector-->MsiExec.exe /I{62230596-37E5-4618-A329-0D21F529A86F}
Conexant HDA D330 MDC V.92 Modem-->C:\Program Files\CONEXANT\CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2C06&SUBSYS_14F1000F\UIU32m.exe -U -Idel000f5.INF
Dell Network Assistant-->MsiExec.exe /I{0240BDFB-2995-4A3F-8C96-18D41282B716}
Dell Touchpad-->rundll32.exe "C:\Program Files\Synaptics\SynTP\SynISDLL.dll",standAloneUninstall
Dell Wireless WLAN Card-->"C:\Program Files\Dell\Dell Wireless WLAN Card\bcmwlu00.exe" verbose /rootkey="Software\Broadcom\802.11\UninstallInfo" /rootdir="C:\Program Files\Dell\Dell Wireless WLAN Card"
Digital Line Detect-->C:\Program Files\InstallShield Installation Information\{E646DCF0-5A68-11D5-B229-002078017FBF}\setup.exe -runfromtemp -l0x0009 -removeonly
Google Toolbar for Internet Explorer-->MsiExec.exe /I{DBEA1034-5882-4A88-8033-81C4EF0CFA29}
Google Toolbar for Internet Explorer-->regsvr32 /u /s "c:\program files\google\googletoolbar1.dll"
High Definition Audio Driver Package - KB835221-->C:\WINDOWS\$NtUninstallKB835221WXP$\spuninst\spuninst.exe
HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Hotfix for Windows Internet Explorer 7 (KB947864)-->"C:\WINDOWS\ie7updates\KB947864-IE7\spuninst\spuninst.exe"
Hotfix for Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
J2SE Runtime Environment 5.0 Update 14-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150140}
Java(TM) 6 Update 11-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216011FF}
MetaFrame Presentation Server Web Client for Win32-->C:\WINDOWS\system32\ctxsetup.exe /uninst C:\PROGRA~1\Citrix\icaweb32\uninst.inf
Microsoft .NET Framework 1.1 Hotfix (KB928366)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0 Service Pack 1-->MsiExec.exe /I{B508B3F1-A24A-32C0-B310-85786919EF28}
Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
Microsoft Office 2000 Professional-->MsiExec.exe /I{00010409-78E1-11D2-B60F-006097C998E7}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Works-->MsiExec.exe /I{6D52C408-B09A-4520-9B18-475B81D393F1}
Modem Diagnostic Tool-->MsiExec.exe /I{F63A3748-B93D-4360-9AD4-B064481A5C7B}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 6.0 Parser (KB933579)-->MsiExec.exe /I{0A869A65-8C94-4F7C-A5C7-972D3C8CED9E}
NetWaiting-->C:\Program Files\InstallShield Installation Information\{3F92ABBB-6BBF-11D5-B229-002078017FBF}\setup.exe -runfromtemp -l0x0009 -removeonly
Pdf995-->C:\Program Files\pdf995\setup.exe uninstall
RealPlayer-->C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
SearchAssist-->C:\DELL\SearchAssist\UninstSA.bat
Security Update for Step By Step Interactive Training (KB923723)-->"C:\WINDOWS\$NtUninstallKB923723$\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB938127)-->"C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB942615)-->"C:\WINDOWS\ie7updates\KB942615-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB944533)-->"C:\WINDOWS\ie7updates\KB944533-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB950759)-->"C:\WINDOWS\ie7updates\KB950759-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB953838)-->"C:\WINDOWS\ie7updates\KB953838-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB956390)-->"C:\WINDOWS\ie7updates\KB956390-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB958215)-->"C:\WINDOWS\ie7updates\KB958215-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB960714)-->"C:\WINDOWS\ie7updates\KB960714-IE7\spuninst\spuninst.exe"
Security Update for Windows Media Player (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
Security Update for Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
Security Update for Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Security Update for Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950760)-->"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951376)-->"C:\WINDOWS\$NtUninstallKB951376$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Security Update for Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Security Update for Windows XP (KB953839)-->"C:\WINDOWS\$NtUninstallKB953839$\spuninst\spuninst.exe"
Security Update for Windows XP (KB954211)-->"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"
Security Update for Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"
Security Update for Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"
Security Update for Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956391)-->"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"
Security Update for Windows XP (KB957095)-->"C:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe"
Security Update for Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Security Update for Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Security Update for Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"
Skype 4.0-->MsiExec.exe /X{24D753CA-6AE9-4E30-8F5F-EFC93E08BF3D}
Spyware Doctor 6.0-->C:\Program Files\Spyware Doctor\unins000.exe /LOG
Trend Micro AntiVirus-->C:\Program Files\Trend Micro\Internet Security\remove.exe
Trend Micro AntiVirus-->MsiExec.exe /X{A621B45A-D138-4A95-BE10-7CABA05EF94E}
Update for Windows XP (KB951072-v2)-->"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"
Update for Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
Update for Windows XP (KB955839)-->"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe"
Windows Media Format Runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"
*********************************************************

info.txt - part 2
*******************************************************

=====HijackThis Backups=====

O4 - HKCU\..\Run: [sysguard] C:\WINDOWS\sysguard.exe
O4 - HKCU\..\Run: [MS AntiSpyware 2009] "C:\Documents and Settings\All Users\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009\msas2009.exe" /autorun
O4 - HKLM\..\Run: [services] C:\WINDOWS\services.exe
O4 - HKLM\..\Run: [lrijh8s73jhbfgfd] C:\WINDOWS\TEMP\winlognn.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O1 - Hosts: 195.245.119.131 browser-security.microsoft.com
O4 - HKLM\..\Run: [jsf8uiw3jnjgffght] C:\DOCUME~1\ITALEN~1\LOCALS~1\Temp\winlognn.exe
O4 - HKCU\..\Run: [lrijh8s73jhbfgfd] C:\WINDOWS\TEMP\winlognn.exe
O18 - Protocol: HTLFP - {03B7A5D4-96B0-4316-95F8-072D326A58F1} - ielpview.dll (file missing)
O4 - HKLM\..\Run: [Axayara] rundll32.exe "C:\WINDOWS\ucahutaf.dll",e
O4 - HKCU\..\Run: [jsf8uiw3jnjgffght] C:\DOCUME~1\ITALEN~1\LOCALS~1\Temp\winlognn.exe
O4 - Global Startup: $McRebootA5E6DEAA56$.lnk = ?
O4 - HKLM\..\Run: [Qtipe] rundll32.exe "C:\WINDOWS\Emucofajahigafek.dll",e
O18 - Protocol: vfsp - (no CLSID) - (no file)
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\Documents and Settings\iTalent-1\pjpa.exe \s,C:\WINDOWS\system32\hhupd.exe,C:\WINDOWS\system32\7z.exe,C:\WINDOWS\system32\windres.exe,C:\WINDOWS\system32\idaw64.exe,C:\WINDOWS\system32\undname.exe,C:\WINDOWS\system32\ndetect.exe,C:\WINDOWS\system32\ndetect.exe,C:\WINDOWS\system32\pdbcopy.exe,
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O4 - HKCU\..\Run: [tezrtsjhfr84iusjfo84f] C:\DOCUME~1\ITALEN~1\LOCALS~1\Temp\csrssc.exe
O4 - HKCU\..\Run: [Cognac] C:\DOCUME~1\ITALEN~1\LOCALS~1\Temp\perce.jpg.exe

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\ATI Technologies\ATI.ACE\
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 124 Stepping 2, AuthenticAMD
"PROCESSOR_REVISION"=7c02
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
************************************************************

Please download the OTMoveIt3 by OldTimer.

• Save it to your desktop.
  
• Please double-click OTMoveIt3.exe to run it.
  
• Copy the bolded text below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  
  :files
  C:\WINDOWS\tasks\At*.job
  C:\WINDOWS\system32\7c5a3NJ4.exe
  C:\WINDOWS\services.exe
  C:\WINDOWS\system32\*.tmp
  C:\WINDOWS\system32\ndetect.exe
  C:\WINDOWS\xlmqladk.exe
  C:\WINDOWS\bnuywaoc.exe
  C:\WINDOWS\system32\i386kd.exe
  C:\WINDOWS\system32\iehelper.dll
  C:\WINDOWS\file.bat
  C:\WINDOWS\icuxeqay.dll
  C:\WINDOWS\system32\actcontroller.exe
  C:\WINDOWS\system32\c++.exe
  C:\WINDOWS\system32\hs78k4rgf4d.dll
  C:\WINDOWS\system32\rah3b8ffdnd.dll
  C:\WINDOWS\p2hhr.bat
  C:\WINDOWS\system32\deviceemulator.exe
  C:\WINDOWS\kernel32.exe
  C:\WINDOWS\winsock32.exe
  
  :reg
  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  "Axayara"=-
  "services"=-
  [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  "systeminit.exe"=-
  [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
  "\??\C:\WINDOWS\system32\winlogon.exe"=-
  [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\cpqsrwex.sys]
  [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\cpqsrwex.sys]
  
  :commands
  [emptytemp]
  
  
  
• Return to OTMoveIt3, right click in the "Paste instructions for items to be Moved" window (under the light blue bar) and choose Paste.
  
• Click the red Moveit! button.
  
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  
• Close OTMoveIt3
  

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

Please post the OTMoveIt log.

The system got unstable and had to be restarted twice. In the confusion I ran OTMoveIt twice. Here are the logs...


Log 1
================================================

========== FILES ==========
C:\WINDOWS\tasks\At1.job moved successfully.
C:\WINDOWS\tasks\At10.job moved successfully.
C:\WINDOWS\tasks\At11.job moved successfully.
C:\WINDOWS\tasks\At12.job moved successfully.
C:\WINDOWS\tasks\At13.job moved successfully.
C:\WINDOWS\tasks\At14.job moved successfully.
C:\WINDOWS\tasks\At15.job moved successfully.
C:\WINDOWS\tasks\At16.job moved successfully.
C:\WINDOWS\tasks\At17.job moved successfully.
C:\WINDOWS\tasks\At18.job moved successfully.
C:\WINDOWS\tasks\At19.job moved successfully.
C:\WINDOWS\tasks\At2.job moved successfully.
C:\WINDOWS\tasks\At20.job moved successfully.
C:\WINDOWS\tasks\At21.job moved successfully.
C:\WINDOWS\tasks\At22.job moved successfully.
C:\WINDOWS\tasks\At23.job moved successfully.
C:\WINDOWS\tasks\At24.job moved successfully.
C:\WINDOWS\tasks\At3.job moved successfully.
C:\WINDOWS\tasks\At4.job moved successfully.
C:\WINDOWS\tasks\At5.job moved successfully.
C:\WINDOWS\tasks\At6.job moved successfully.
C:\WINDOWS\tasks\At7.job moved successfully.
C:\WINDOWS\tasks\At8.job moved successfully.
C:\WINDOWS\tasks\At9.job moved successfully.
C:\WINDOWS\system32\7c5a3NJ4.exe moved successfully.
C:\WINDOWS\services.exe moved successfully.
C:\WINDOWS\system32\10.tmp moved successfully.
C:\WINDOWS\system32\12.tmp moved successfully.
C:\WINDOWS\system32\14.tmp moved successfully.
C:\WINDOWS\system32\15.tmp moved successfully.
C:\WINDOWS\system32\16.tmp moved successfully.
C:\WINDOWS\system32\17.tmp moved successfully.
C:\WINDOWS\system32\19.tmp moved successfully.
C:\WINDOWS\system32\1A.tmp moved successfully.
C:\WINDOWS\system32\1B.tmp moved successfully.
C:\WINDOWS\system32\1C.tmp moved successfully.
C:\WINDOWS\system32\1D.tmp moved successfully.
C:\WINDOWS\system32\1E.tmp moved successfully.
C:\WINDOWS\system32\1F.tmp moved successfully.
C:\WINDOWS\system32\20.tmp moved successfully.
C:\WINDOWS\system32\21.tmp moved successfully.
C:\WINDOWS\system32\22.tmp moved successfully.
C:\WINDOWS\system32\23.tmp moved successfully.
C:\WINDOWS\system32\24.tmp moved successfully.
C:\WINDOWS\system32\25.tmp moved successfully.
C:\WINDOWS\system32\26.tmp moved successfully.
C:\WINDOWS\system32\27.tmp moved successfully.
C:\WINDOWS\system32\28.tmp moved successfully.
C:\WINDOWS\system32\29.tmp moved successfully.
C:\WINDOWS\system32\2A.tmp moved successfully.
C:\WINDOWS\system32\2B.tmp moved successfully.
C:\WINDOWS\system32\2C.tmp moved successfully.
C:\WINDOWS\system32\2D.tmp moved successfully.
C:\WINDOWS\system32\2E.tmp moved successfully.
C:\WINDOWS\system32\2F.tmp moved successfully.
C:\WINDOWS\system32\30.tmp moved successfully.
C:\WINDOWS\system32\31.tmp moved successfully.
C:\WINDOWS\system32\32.tmp moved successfully.
C:\WINDOWS\system32\33.tmp moved successfully.
C:\WINDOWS\system32\34.tmp moved successfully.
C:\WINDOWS\system32\35.tmp moved successfully.
C:\WINDOWS\system32\37.tmp moved successfully.
C:\WINDOWS\system32\38.tmp moved successfully.
C:\WINDOWS\system32\39.tmp moved successfully.
C:\WINDOWS\system32\3A.tmp moved successfully.
C:\WINDOWS\system32\3B.tmp moved successfully.
C:\WINDOWS\system32\3C.tmp moved successfully.
C:\WINDOWS\system32\3E.tmp moved successfully.
C:\WINDOWS\system32\40.tmp moved successfully.
C:\WINDOWS\system32\42.tmp moved successfully.
C:\WINDOWS\system32\43.tmp moved successfully.
C:\WINDOWS\system32\44.tmp moved successfully.
C:\WINDOWS\system32\46.tmp moved successfully.
C:\WINDOWS\system32\47.tmp moved successfully.
C:\WINDOWS\system32\49.tmp moved successfully.
C:\WINDOWS\system32\4E.tmp moved successfully.
C:\WINDOWS\system32\53.tmp moved successfully.
C:\WINDOWS\system32\54.tmp moved successfully.
C:\WINDOWS\system32\56.tmp moved successfully.
C:\WINDOWS\system32\58.tmp moved successfully.
C:\WINDOWS\system32\59.tmp moved successfully.
C:\WINDOWS\system32\5C.tmp moved successfully.
C:\WINDOWS\system32\5D.tmp moved successfully.
C:\WINDOWS\system32\61.tmp moved successfully.
C:\WINDOWS\system32\63.tmp moved successfully.
C:\WINDOWS\system32\A.tmp moved successfully.
C:\WINDOWS\system32\C.tmp moved successfully.
C:\WINDOWS\system32\CONFIG.TMP moved successfully.
C:\WINDOWS\system32\D.tmp moved successfully.
C:\WINDOWS\system32\ndetect.exe moved successfully.
C:\WINDOWS\xlmqladk.exe moved successfully.
C:\WINDOWS\bnuywaoc.exe moved successfully.
C:\WINDOWS\system32\i386kd.exe moved successfully.
C:\WINDOWS\system32\iehelper.dll unregistered successfully.
C:\WINDOWS\system32\iehelper.dll moved successfully.
C:\WINDOWS\file.bat moved successfully.
LoadLibrary failed for C:\WINDOWS\icuxeqay.dll
C:\WINDOWS\icuxeqay.dll NOT unregistered.
C:\WINDOWS\icuxeqay.dll moved successfully.
C:\WINDOWS\system32\actcontroller.exe moved successfully.
C:\WINDOWS\system32\c++.exe moved successfully.
LoadLibrary failed for C:\WINDOWS\system32\hs78k4rgf4d.dll
C:\WINDOWS\system32\hs78k4rgf4d.dll NOT unregistered.
C:\WINDOWS\system32\hs78k4rgf4d.dll moved successfully.
C:\WINDOWS\system32\rah3b8ffdnd.dll NOT unregistered.
C:\WINDOWS\system32\rah3b8ffdnd.dll moved successfully.
C:\WINDOWS\p2hhr.bat moved successfully.
C:\WINDOWS\system32\deviceemulator.exe moved successfully.
C:\WINDOWS\kernel32.exe moved successfully.
C:\WINDOWS\winsock32.exe moved successfully.
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Axayara deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\services deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\systeminit.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\\??\C:\WINDOWS\system32\winlogon.exe deleted successfully.
Unable to delete registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\cpqsrwex.sys\\ .
Unable to delete registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\cpqsrwex.sys\\ .
========== COMMANDS ==========
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_3b4.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
Temp folders emptied.

OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 02092009_132656
Files moved on Reboot...
File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot.
File C:\WINDOWS\temp\Perflib_Perfdata_3b4.dat not found!

Log 2

========== FILES ==========
File/Folder C:\WINDOWS\tasks\At*.job not found.
File/Folder C:\WINDOWS\system32\7c5a3NJ4.exe not found.
File/Folder C:\WINDOWS\services.exe not found.
C:\WINDOWS\system32\10.tmp moved successfully.
C:\WINDOWS\system32\15.tmp moved successfully.
C:\WINDOWS\system32\16.tmp moved successfully.
C:\WINDOWS\system32\42.tmp moved successfully.
C:\WINDOWS\system32\43.tmp moved successfully.
C:\WINDOWS\system32\44.tmp moved successfully.
C:\WINDOWS\system32\A.tmp moved successfully.
C:\WINDOWS\system32\B.tmp moved successfully.
C:\WINDOWS\system32\C.tmp moved successfully.
C:\WINDOWS\system32\D.tmp moved successfully.
C:\WINDOWS\system32\F.tmp moved successfully.
File/Folder C:\WINDOWS\system32\ndetect.exe not found.
File/Folder C:\WINDOWS\xlmqladk.exe not found.
File/Folder C:\WINDOWS\bnuywaoc.exe not found.
File/Folder C:\WINDOWS\system32\i386kd.exe not found.
File/Folder C:\WINDOWS\system32\iehelper.dll not found.
File/Folder C:\WINDOWS\file.bat not found.
File/Folder C:\WINDOWS\icuxeqay.dll not found.
File/Folder C:\WINDOWS\system32\actcontroller.exe not found.
C:\WINDOWS\system32\c++.exe moved successfully.
File/Folder C:\WINDOWS\system32\hs78k4rgf4d.dll not found.
File/Folder C:\WINDOWS\system32\rah3b8ffdnd.dll not found.
File/Folder C:\WINDOWS\p2hhr.bat not found.
File/Folder C:\WINDOWS\system32\deviceemulator.exe not found.
File/Folder C:\WINDOWS\kernel32.exe not found.
File/Folder C:\WINDOWS\winsock32.exe not found.
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Axayara not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\services deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\systeminit.exe not found.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\\??\C:\WINDOWS\system32\winlogon.exe deleted successfully.
Unable to delete registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\cpqsrwex.sys\\ .
Unable to delete registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\cpqsrwex.sys\\ .
========== COMMANDS ==========
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_3bc.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
Temp folders emptied.

OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 02092009_135259
Files moved on Reboot...
File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot.
File C:\WINDOWS\temp\Perflib_Perfdata_3bc.dat not found!

Okay, post a new RSIT scan.
Only RSIT.txt this time.

Part 1

Logfile of random's system information tool 1.05 (written by random/random)
Run by iTalent-1 at 2009-02-09 15:15:32
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 67 GB (87%) free of 76 GB
Total RAM: 446 MB (24% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:15:33 PM, on 2/9/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\windres.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Dell Network Assistant\hnm_svc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Kontiki\KService.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe
C:\Program Files\Trend Micro\BM\TMBMSRV.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Dell Network Assistant\ezi_hnm2.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro\Internet Security\TmProxy.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Documents and Settings\iTalent-1\Desktop\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\iTalent-1.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = partnerpage.google.com/smallbiz.dell.com/en_us?hl=en&client=dell-usuk&channel=us-smb&ibd=2080208
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mail.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://server.toolbar.rediff.com/toolbar/3.0/sidesearch.html?mode=toolbar
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = partnerpage.google.com/smallbiz.dell.com/en_us?hl=en&client=dell-usuk&channel=us-smb&ibd=2080208
F2 - REG:system.ini: UserInit=C:\WINDOWS\SYSTEM32\Userinit.exe,C:\WINDOWS\system32\i386kd.exe,C:\WINDOWS\system32\ndetect.exe,C:\WINDOWS\system32\c++.exe,C:\WINDOWS\system32\c++.exe,C:\WINDOWS\system32\windres.exe,C:\WINDOWS\system32\codeblocks.exe,C:\WINDOWS\system32\undname.exe,
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [UfSeAgnt.exe] "C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe"
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [PromoReg] C:\WINDOWS\TEMP\TMP15.tmp
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [RegistryMechanic] C:\Program Files\Registry Mechanic\RegMech.exe /H
O4 - HKUS\S-1-5-18\..\Run: [bnuywaoc.exe] C:\WINDOWS\bnuywaoc.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [xlmqladk.exe] C:\WINDOWS\xlmqladk.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [jrcxsikd.exe] C:\WINDOWS\jrcxsikd.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [rvekqdbm.exe] C:\WINDOWS\rvekqdbm.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [bnuywaoc.exe] C:\WINDOWS\bnuywaoc.exe (User 'Default user')
O4 - Global Startup: Dell Network Assistant.lnk = ?
O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {2019DC25-D1C0-11D6-97B3-0008A124F542} (StreamPlug Class) - http://www.streamplug.com/StreamPlug/beta/SP.cab
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} (Java Plug-in 1.5.0) - http://support.magicjack.com/jre-1_5_0_14-windows-i586-p.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/RACtrl.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: vfsp - (no CLSID) - (no file)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Advanced Networking Service (hnmsvc) - SingleClick Systems - C:\Program Files\Dell Network Assistant\hnm_svc.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: KService - Unknown owner - C:\Program Files\Kontiki\KService.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: Trend Micro Central Control Component (SfCtlCom) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
O23 - Service: Trend Micro Unauthorized Change Prevention Service (TMBMServer) - Trend Micro Inc. - C:\Program Files\Trend Micro\BM\TMBMSRV.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\TmProxy.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

--
End of file - 8519 bytes

Part 2

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{22BF413B-C6D2-4d91-82A9-A0F997BA588C}]
Skype add-on (mastermind) - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2009-01-29 1088296]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]
RealPlayer Download and Record Plugin for Internet Explorer - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll [2008-03-25 308856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2009-02-07 320920]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - c:\program files\google\googletoolbar1.dll [2009-02-07 2403392]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - &Google - c:\program files\google\googletoolbar1.dll [2009-02-07 2403392]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"DellSupportCenter"=C:\Program Files\Dell Support Center\bin\sprtcmd.exe /P DellSupportCenter []
"TkBellExe"=C:\Program Files\Common Files\Real\Update_OB\realsched.exe [2008-03-25 185896]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-01-11 39792]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-02-07 136600]
"UfSeAgnt.exe"=C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe [2008-07-29 1398024]
"ISTray"=C:\Program Files\Spyware Doctor\pctsTray.exe [2008-08-25 1168264]
"PromoReg"=C:\WINDOWS\TEMP\TMP15.tmp [2009-02-09 387584]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-13 32256]
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe [2009-02-07 171448]
"RegistryMechanic"=C:\Program Files\Registry Mechanic\RegMech.exe [2008-07-08 2828184]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
Dell Network Assistant.lnk - C:\WINDOWS\Installer\{0240BDFB-2995-4A3F-8C96-18D41282B716}\Icon0240BDFB3.exe
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2007-10-16 90112]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\cpqsrwex.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\cpqsrwex.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\sdauxservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\sdcoreservice]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
"NoFolderOptions"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Google\Google Talk\googletalk.exe"="C:\Program Files\Google\Google Talk\googletalk.exe:*:Enabled:Google Talk"
"C:\Program Files\Globe7\Globe7Phone.exe"="C:\Program Files\Globe7\Globe7Phone.exe:*:Enabled:Globe7"
"C:\Program Files\Winamp Remote\bin\Orb.exe"="C:\Program Files\Winamp Remote\bin\Orb.exe:*:Enabled:Orb"
"C:\Program Files\Winamp Remote\bin\OrbTray.exe"="C:\Program Files\Winamp Remote\bin\OrbTray.exe:*:Enabled:OrbTray"
"C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe"="C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:*:Enabled:Orb Stream Client"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Rediff Bol\RediffMessenger.exe"="C:\Program Files\Rediff Bol\RediffMessenger.exe:*:Enabled:Rediff Bol 8.0 "
"C:\Program Files\Rediff Bol\AppWorkingDir\Client\Video\Talk&See.exe"="C:\Program Files\Rediff Bol\AppWorkingDir\Client\Video\Talk&See.exe:*:Enabled:Rediff Bol Talk & See"
"C:\Program Files\Real\RealPlayer\realplay.exe"="C:\Program Files\Real\RealPlayer\realplay.exe:*:Enabled:RealPlayer"
"C:\Program Files\Internet Explorer\iexplore.exe"="C:\Program Files\Internet Explorer\iexplore.exe:*:Enabled:Internet Explorer"
"C:\Program Files\Mercury Interactive\LoadRunner\launch_service\bin\magentproc.exe"="C:\Program Files\Mercury Interactive\LoadRunner\launch_service\bin\magentproc.exe:*:Enabled:Mercury Launcher Process"
"C:\Program Files\Mercury Interactive\LoadRunner\bin\vugen.exe"="C:\Program Files\Mercury Interactive\LoadRunner\bin\vugen.exe:*:Enabled:vugen"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\WINDOWS\system32\mmc.exe"="C:\WINDOWS\system32\mmc.exe:*:Enabled:Microsoft Management Console"
"C:\Program Files\SopCast\adv\SopAdver.exe"="C:\Program Files\SopCast\adv\SopAdver.exe:*:Enabled:SopCast Adver"
"C:\Program Files\SopCast\SopCast.exe"="C:\Program Files\SopCast\SopCast.exe:*:Enabled:SopCast Main Application"
"C:\Program Files\Kontiki\KService.exe"="C:\Program Files\Kontiki\KService.exe:*:Enabled:Delivery Manager Service"
"C:\Program Files\VoipRaider.com\VoipRaider\VoipRaider.exe"="C:\Program Files\VoipRaider.com\VoipRaider\VoipRaider.exe:*:Enabled:VoipRaider"
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"C:\Program Files\Yahoo!\Messenger\YServer.exe"="C:\Program Files\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server"
"C:\Documents and Settings\italent\Application Data\mjusbsp\magicJack.exe"="C:\Documents and Settings\italent\Application Data\mjusbsp\magicJack.exe:*:Enabled:magicJack"
"C:\Program Files\Dell Network Assistant\ezi_hnm2.exe"="C:\Program Files\Dell Network Assistant\ezi_hnm2.exe:*:Enabled:Dell Network Assistant"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype. Take a deep breath "
"C:\Program Files\LimeWire\LimeWire.exe"="C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire"
"\??\C:\WINDOWS\system32\winlogon.exe"="\??\C:\WINDOWS\system32\winlogon.exe:*:enabled:@shell32.dll,-1"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

Part 3


======List of files/folders created in the last 1 months======

2009-02-09 14:47:35 ----N---- C:\WINDOWS\system32\21.tmp
2009-02-09 14:47:35 ----A---- C:\WINDOWS\system32\undname.exe
2009-02-09 14:47:35 ----A---- C:\WINDOWS\system32\20.tmp
2009-02-09 14:47:22 ----A---- C:\WINDOWS\system32\1E.tmp
2009-02-09 14:47:21 ----A---- C:\WINDOWS\system32\1D.tmp
2009-02-09 14:47:21 ----A---- C:\WINDOWS\system32\1C.tmp
2009-02-09 14:09:57 ----A---- C:\WINDOWS\system32\codeblocks.exe
2009-02-09 14:09:56 ----N---- C:\WINDOWS\system32\19.tmp
2009-02-09 14:09:55 ----A---- C:\WINDOWS\system32\18.tmp
2009-02-09 14:05:20 ----A---- C:\WINDOWS\system32\12.tmp
2009-02-09 14:05:17 ----A---- C:\WINDOWS\system32\11.tmp
2009-02-09 14:04:12 ----A---- C:\WINDOWS\system32\10.tmp
2009-02-09 14:01:57 ----N---- C:\WINDOWS\system32\17.tmp
2009-02-09 14:01:57 ----A---- C:\WINDOWS\system32\windres.exe
2009-02-09 14:01:57 ----A---- C:\WINDOWS\rvekqdbm.exe
2009-02-09 14:01:56 ----A---- C:\WINDOWS\system32\16.tmp
2009-02-09 13:57:38 ----A---- C:\WINDOWS\system32\F.tmp
2009-02-09 13:57:37 ----A---- C:\WINDOWS\system32\E.tmp
2009-02-09 13:57:35 ----A---- C:\WINDOWS\system32\D.tmp
2009-02-09 13:55:27 ----A---- C:\WINDOWS\system32\C.tmp
2009-02-09 13:55:26 ----A---- C:\WINDOWS\system32\B.tmp
2009-02-09 13:55:25 ----A---- C:\WINDOWS\system32\A.tmp
2009-02-09 13:46:09 ----A---- C:\WINDOWS\jrcxsikd.exe
2009-02-09 13:26:56 ----D---- C:\_OTMoveIt
2009-02-09 12:56:48 ----D---- C:\rsit
2009-02-09 12:09:44 ----D---- C:\Avenger
2009-02-09 12:09:43 ----A---- C:\avenger.txt
2009-02-09 12:07:10 ----A---- C:\zip.exe
2009-02-09 12:07:10 ----A---- C:\cleanup.exe
2009-02-09 12:07:10 ----A---- C:\cleanup.bat
2009-02-09 12:00:08 ----D---- C:\32788R22FWJFW
2009-02-09 10:44:23 ----HD---- C:\WINDOWS\PIF
2009-02-09 00:23:47 ----D---- C:\Program Files\Spyware Doctor
2009-02-09 00:23:47 ----D---- C:\Documents and Settings\iTalent-1\Application Data\PC Tools
2009-02-08 23:48:07 ----A---- C:\WINDOWS\system32\STKIT432.DLL
2009-02-08 23:48:05 ----D---- C:\Program Files\Registry Mechanic
2009-02-08 20:06:08 ----D---- C:\WINDOWS\system32\Quarantine
2009-02-08 20:05:09 ----A---- C:\WINDOWS\adobe.bat
2009-02-08 18:59:02 ----D---- C:\Documents and Settings\All Users\Application Data\Trend Micro
2009-02-08 18:57:30 ----D---- C:\Program Files\Trend Micro
2009-02-08 18:07:54 ----D---- C:\Program Files\Microsoft Common
2009-02-08 18:06:49 ----A---- C:\WINDOWS\system32\7c5a3NJ4.exe.a_a
2009-02-07 12:19:34 ----D---- C:\Documents and Settings\iTalent-1\Application Data\Mozilla
2009-02-07 12:17:35 ----D---- C:\Documents and Settings\iTalent-1\Application Data\LimeWire
2009-02-07 12:16:15 ----A---- C:\WINDOWS\system32\javaws.exe
2009-02-07 12:16:15 ----A---- C:\WINDOWS\system32\deploytk.dll
2009-02-07 12:16:14 ----A---- C:\WINDOWS\system32\javaw.exe
2009-02-07 12:16:14 ----A---- C:\WINDOWS\system32\java.exe
2009-02-07 12:13:54 ----D---- C:\Program Files\LimeWire
2009-02-07 12:04:56 ----D---- C:\Documents and Settings\iTalent-1\Application Data\Google
2009-02-07 11:58:51 ----D---- C:\Documents and Settings\iTalent-1\Application Data\skypePM
2009-02-07 11:57:34 ----D---- C:\Documents and Settings\iTalent-1\Application Data\Skype
2009-02-07 11:56:23 ----D---- C:\Program Files\Common Files\Skype
2009-02-07 11:56:19 ----RD---- C:\Program Files\Skype
2009-02-04 00:14:21 ----HDC---- C:\WINDOWS\$NtUninstallKB958687$

======List of files/folders modified in the last 1 months======

2009-02-09 14:50:19 ----AD---- C:\WINDOWS\Temp
2009-02-09 14:47:35 ----D---- C:\WINDOWS\system32
2009-02-09 14:24:33 ----AC---- C:\WINDOWS\system32\PerfStringBackup.INI
2009-02-09 14:22:53 ----AD---- C:\Documents and Settings\All Users\Application Data\TEMP
2009-02-09 14:03:51 ----D---- C:\WINDOWS
2009-02-09 14:03:41 ----D---- C:\WINDOWS\system32\drivers
2009-02-09 14:03:38 ----A---- C:\WINDOWS\ModemLog_Conexant HDA D330 MDC V.92 Modem.txt
2009-02-09 14:02:14 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-02-09 13:56:48 ----A---- C:\WINDOWS\DUMP7128.tmp
2009-02-09 13:40:53 ----A---- C:\WINDOWS\DUMP7a02.tmp
2009-02-09 13:36:19 ----D---- C:\WINDOWS\system32\CatRoot2
2009-02-09 13:26:57 ----SD---- C:\WINDOWS\Tasks
2009-02-09 11:28:20 ----SHD---- C:\System Volume Information
2009-02-09 11:28:20 ----D---- C:\WINDOWS\system32\Restore
2009-02-09 11:24:39 ----D---- C:\WINDOWS\system32\FxsTmp
2009-02-09 09:21:14 ----D---- C:\WINDOWS\Prefetch
2009-02-09 08:42:06 ----RD---- C:\Program Files
2009-02-09 00:05:54 ----D---- C:\WINDOWS\Minidump
2009-02-08 23:11:50 ----D---- C:\WINDOWS\SoftwareDistribution
2009-02-08 20:10:07 ----HD---- C:\WINDOWS\inf
2009-02-08 19:01:39 ----D---- C:\WINDOWS\system32\CatRoot
2009-02-08 18:59:11 ----SHD---- C:\WINDOWS\Installer
2009-02-08 18:55:41 ----D---- C:\Program Files\Common Files
2009-02-08 18:55:40 ----D---- C:\Documents and Settings\All Users\Application Data\McAfee
2009-02-08 18:55:36 ----D---- C:\Program Files\McAfee
2009-02-08 18:42:19 ----D---- C:\i386
2009-02-08 18:33:04 ----D---- C:\dell
2009-02-08 18:17:59 ----SD---- C:\Documents and Settings\iTalent-1\Application Data\Microsoft
2009-02-08 18:12:15 ----AC---- C:\WINDOWS\system32\regwiz.exe
2009-02-07 21:00:34 ----D---- C:\Documents and Settings\iTalent-1\Application Data\Real
2009-02-07 20:56:39 ----AC---- C:\WINDOWS\cdplayer.ini
2009-02-07 12:14:53 ----D---- C:\Program Files\Java
2009-02-07 11:57:26 ----D---- C:\Program Files\Google
2009-02-07 11:56:24 ----D---- C:\Documents and Settings\All Users\Application Data\Skype
2009-02-04 11:44:47 ----D---- C:\Program Files\Creative
2009-02-04 00:14:23 ----RSHD---- C:\WINDOWS\system32\dllcache
2009-02-04 00:13:50 ----HD---- C:\WINDOWS\$hf_mig$
2009-02-04 00:04:04 ----D---- C:\Documents and Settings
2009-02-03 23:56:03 ----A---- C:\WINDOWS\imsins.BAK
2009-02-03 23:52:11 ----D---- C:\WINDOWS\twain_32
2009-02-03 23:50:26 ----D---- C:\Documents and Settings\All Users\Application Data\SupportSoft
2009-02-03 23:50:21 ----D---- C:\Program Files\Dell Support Center
2009-02-03 19:26:34 ----D---- C:\Program Files\DivX
2009-02-03 19:24:28 ----AC---- C:\WINDOWS\ODBC.INI
2009-02-03 19:13:51 ----A---- C:\YServer.txt
2009-02-03 19:12:24 ----RSD---- C:\WINDOWS\assembly
2009-02-03 19:12:19 ----D---- C:\Program Files\Common Files\Intuit
2009-02-03 19:10:49 ----RSD---- C:\WINDOWS\Fonts
2009-02-03 19:03:14 ----SHD---- C:\RECYCLER
2009-02-03 18:36:37 ----D---- C:\Program Files\Common Files\InstallShield
2009-02-03 18:36:34 ----AC---- C:\WINDOWS\mercury.ini
2009-02-03 18:36:07 ----HD---- C:\Program Files\InstallShield Installation Information

Part 4 of 4


======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 IKSysFlt;System Filter Driver; C:\WINDOWS\system32\drivers\iksysflt.sys [2008-08-25 66952]
R1 IKSysSec;System Security Driver; C:\WINDOWS\system32\drivers\iksyssec.sys [2008-08-25 81288]
R1 tmtdi;Trend Micro TDI Driver; C:\WINDOWS\system32\DRIVERS\tmtdi.sys [2008-02-15 65936]
R1 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2008-04-13 8832]
R2 mdmxsdk;mdmxsdk; C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys [2007-12-02 12672]
R2 Packet;Auto Internet Protocol; C:\WINDOWS\system32\DRIVERS\packet.sys [2006-12-18 12672]
R2 paldrv;paldrv; \??\C:\WINDOWS\system32\pal_drv.sys []
R2 rimmptsk;rimmptsk; C:\WINDOWS\system32\DRIVERS\rimmptsk.sys [2007-04-23 32256]
R2 tmactmon;tmactmon; \??\C:\WINDOWS\system32\drivers\tmactmon.sys []
R2 tmcomm;tmcomm; \??\C:\WINDOWS\system32\drivers\tmcomm.sys []
R2 tmevtmgr;tmevtmgr; \??\C:\WINDOWS\system32\drivers\tmevtmgr.sys []
R2 tmpreflt;tmpreflt; C:\WINDOWS\system32\DRIVERS\tmpreflt.sys [2008-08-16 36368]
R2 tmxpflt;tmxpflt; C:\WINDOWS\system32\DRIVERS\tmxpflt.sys [2008-08-16 205328]
R2 vsapint;vsapint; C:\WINDOWS\system32\DRIVERS\vsapint.sys [2008-08-16 1195448]
R3 BCM43XX;Dell Wireless WLAN Card Driver; C:\WINDOWS\system32\DRIVERS\bcmwl5.sys [2007-10-09 1123328]
R3 bcm4sbxp;Broadcom 440x 10/100 Integrated Controller XP Driver; C:\WINDOWS\system32\DRIVERS\bcm4sbxp.sys [2007-04-23 45568]
R3 CmBatt;Microsoft ACPI Control Method Battery Driver; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2008-04-13 13952]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 HSF_DPV;HSF_DPV; C:\WINDOWS\system32\DRIVERS\HSF_DPV.sys [2007-12-02 989952]
R3 HSFHWAZL;HSFHWAZL; C:\WINDOWS\system32\DRIVERS\HSFHWAZL.sys [2007-12-02 211200]
R3 Passthru;Service; C:\WINDOWS\system32\DRIVERS\ndisio.sys [2009-02-08 53248]
R3 sdbus;sdbus; C:\WINDOWS\system32\DRIVERS\sdbus.sys [2008-04-13 79232]
R3 STHDA;SigmaTel High Definition Audio CODEC; C:\WINDOWS\system32\drivers\sthda.sys [2007-04-23 1228296]
R3 SynTP;Synaptics TouchPad Driver; C:\WINDOWS\system32\DRIVERS\SynTP.sys [2007-04-27 202912]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Microsoft USB Standard Hub Driver; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbohci;Microsoft USB Open Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-13 17152]
R3 winachsf;winachsf; C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys [2007-12-02 731136]
S1 ethccjcq;ethccjcq; C:\WINDOWS\system32\drivers\ethccjcq.sys [2009-02-09 138336]
S1 kbdhid;Keyboard HID Driver; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-13 14592]
S3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2007-10-16 1777152]
S3 CA561;ICatch (VI) PC Camera; C:\WINDOWS\System32\Drivers\SPCA561.SYS []
S3 CCDECODE;Closed Caption Decoder; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 E100B;Intel(R) PRO Adapter Driver; C:\WINDOWS\system32\DRIVERS\e100b325.sys [2001-08-17 117760]
S3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
S3 lmimirr;lmimirr; C:\WINDOWS\system32\DRIVERS\lmimirr.sys []
S3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-17 12160]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2004-08-03 1897408]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 SONYPVU1;Sony USB Filter Driver (SONYPVU1); C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS [2001-08-17 7552]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 usbaudio;USB Audio Driver (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-13 60032]
S3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 usbscan;USB Scanner Driver; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S3 WSTCODEC;World Standard Teletext Codec; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S4 agp440;Intel AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\agp440.sys [2008-04-13 42368]
S4 agpCPQ;Compaq AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\agpCPQ.sys [2008-04-13 44928]
S4 alim1541;ALI AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\alim1541.sys [2008-04-13 42752]
S4 amdagp;AMD AGP Bus Filter Driver; C:\WINDOWS\system32\DRIVERS\amdagp.sys [2008-04-13 43008]
S4 cbidf;cbidf; C:\WINDOWS\system32\DRIVERS\cbidf2k.sys [2001-08-17 13952]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\DRIVERS\intelide.sys [2008-04-13 5504]
S4 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 36352]
S4 sisagp;SIS AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\sisagp.sys [2008-04-13 40960]
S4 viaagp;VIA AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\viaagp.sys [2008-04-13 42240]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 hnmsvc;Advanced Networking Service; C:\Program Files\Dell Network Assistant\hnm_svc.exe [2007-05-25 112176]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-02-07 152984]
R2 KService;KService; C:\Program Files\Kontiki\KService.exe [2007-03-09 3068352]
R2 sdAuxService;PC Tools Auxiliary Service; C:\Program Files\Spyware Doctor\pctsAuxs.exe [2008-06-13 356920]
R2 sdCoreService;PC Tools Security Service; C:\Program Files\Spyware Doctor\pctsSvc.exe [2008-10-09 1079176]
R2 SfCtlCom;Trend Micro Central Control Component; C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe [2008-07-29 698888]
R2 TMBMServer;Trend Micro Unauthorized Change Prevention Service; C:\Program Files\Trend Micro\BM\TMBMSRV.exe [2008-02-15 333064]
R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2005-01-28 55808]
R2 wltrysvc;Dell Wireless WLAN Tray Service; C:\WINDOWS\System32\WLTRYSVC.EXE [2007-10-09 40960]
R3 tmproxy;Trend Micro Proxy Service; C:\Program Files\Trend Micro\Internet Security\TmProxy.exe [2008-02-26 648456]
S2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2007-10-16 450560]
S2 Fax;Fax; C:\WINDOWS\system32\fxssvc.exe [2008-04-13 284672]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-02-07 138168]

-----------------EOF-----------------

Lets go back to Combofix.
The link I supplied is indeed dead, I just thought it was the malware blocking it.

I have changed the link here, so it should work.

• Download combofix from here combofix.exe
  
• Please disable your local AV (Anti-virus) by right clicking it's icon in the tray, and exit it. See HERE for how to disable your AV.
  
• Double click on ComboFix.exe.
  
• Follow the prompts. NOTE:
  
• ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
  ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***
  
  **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will automatically proceed with its scan.
  
  
  
• The Recovery Console provides a recovery/repair mode should a problem occur during a Combofix run.
  
  
  
  
• Allow ComboFix to download the Recovery Console.
  
• Accept the End-User License Agreement.
  
• The Recovery Console will be installed.
  
• You will then get this next prompt that asks if you want to continue the malware scan, select yes
  
  
  
  
• Allow combofix to run
  
• Post C:\combofix.txt back here.
  
  Note:
  Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
  

Hi!

Combofix did run but it did not create a Cambofix.txt

There is no Combofix.txt in the C drive?
Is there a Combofix folder in the C drive?

Nope... No file or folder...

Can you try running it again please.

No Belhazur,

Same results again... No text file generated...

Lets see if this will work.

Please download and run this tool.

Download Malwarebytes' Anti-Malware from Here

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
  
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  

Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.

Post the contents of the MBAM Log.

Tried this but says

Runtime error0 and Runtime error 440

Download and install VB runtime package.

http://www.microsoft.com/downloads/details.aspx?FamilyId=7B9BA261-7A9C-43E7-9117-F673077FFB3C&displaylang=en

Downloaded VB and then tried Malware. The same runtime errors continue to dog me...

Lets try this.

* Download Dr.Web CureIt to the desktop:
ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe

• Doubleclick the drweb-cureit.exe file and Allow to run the express scan
  
• This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it. This is only a short scan.
  
• Once the short scan has finished, Click Options > Change settings
  
• Choose the "Scan"-tab, remove the mark at "Heuristic analysis".
  
• Back at the main window, mark the drives that you want to scan.
  
• Select all drives. A red dot shows which drives have been chosen.
  
• Click the green arrow at the right, and the scan will start.
  
• Click 'Yes to all' if it asks if you want to cure/move the file.
  
• When the scan has finished, look if you can click next icon next to the files found:
  
• If so, click it and then click the next icon right below and select Move incurable as you'll see in next image:
  
  This will move it to the %userprofile%\DoctorWeb\quarantaine-folder if it can't be cured. (this in case if we need samples)
  
• After selecting, in the Dr.Web CureIt menu on top, click file and choose save report list
  
• Save the report to your desktop. The report will be called DrWeb.csv
  
• Close Dr.Web Cureit.
  
• Reboot your computer!! Because it could be possible that files in use will be moved/deleted during reboot.
  
• After reboot, post the contents of the log from Dr.Web you saved previously in your next reply.
  

The software detected some 10 viruses(mainly Trojan) and windows suddenly closed down..Am starting the laptop again. I am mailing this from another laptop...

If it won't startup anymore, the malware has done damage.
Winlogon may have been patched, and you were dealing with some kind of spambot.

No system hasn't given up yet! But man I really admire your patience. And yes, thanks very much.

What should I run now. I have a multitude of choices

Is there a report from doctor web?

No report. Should I run Webdoctor once more?

Yeah.

Have started the scan. There is message "Found Trojan.cookie.origin Can not be cured...

Should I skip this and complete the scan?

Tracking cookies.
They aren't really an infection, every browser needs cookies to function correctly.
Complete the scan please.

Hi folks. I have more bad news...

Webdoctor was doing a good job I thought but while the scan was on, the systm shut down and restarted againand this time the Spyware protect 2009 icon is back on my screen with the two white boxes... There is no scan report from Webdoc

This had stopped after I had ticked the boxes in Hijack this on the first page of this thread...

Do we have any hopes now?

Unless we can somehow get Combofix to run, not really. The files regenerated when we used OTMoveIt, don't know why though.

Should I download Combofix on anoter system and run it on my system?

Can we get rid of the Spyware icon by doing what we did earlier. That way at least I could work on the system?

I suppose we can try.
Post a new RSIT log (RSIT.txt only)