Also got infected with Winbluesoft

Please help here is the log from the scan i did today. What should i do now?

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:08:07, on 6/3/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Safe mode with network support

Running processes:
I:\WINDOWS\System32\smss.exe
I:\WINDOWS\system32\winlogon.exe
I:\WINDOWS\system32\services.exe
I:\WINDOWS\system32\lsass.exe
I:\WINDOWS\system32\svchost.exe
I:\Program Files\Windows Defender\MsMpEng.exe
I:\WINDOWS\system32\svchost.exe
I:\WINDOWS\Explorer.EXE
I:\Program Files\Internet Explorer\iexplore.exe
I:\WINDOWS\system32\ctfmon.exe
I:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - I:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - I:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - I:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - I:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - I:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE I:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [P17Helper] Rundll32 SPIRun.dll,RunDLLEntry
O4 - HKLM\..\Run: [VolPanel] "I:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" /r
O4 - HKLM\..\Run: [Windows Defender] "I:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [OutpostMonitor] I:\PROGRA~1\Agnitum\OUTPOS~1\op_mon.exe /tray /noservice
O4 - HKLM\..\Run: [OutpostFeedBack] "I:\Program Files\Agnitum\Outpost Security Suite Pro\feedback.exe" /dump:os_startup
O4 - HKLM\..\Run: [QuickTime Task] "I:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "I:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "I:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [iTunesHelper] "I:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe
O4 - HKCU\..\Run: [SRS Audio Sandbox] "I:\Program Files\SRS Labs\Audio Sandbox\SRSSSC.exe" /hideme
O4 - HKCU\..\Run: [H/PC Connection Agent] "I:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [ctfmon.exe] I:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [tempo-setup2.exe] I:\WINDOWS\system32\tempo-setup2.exe
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "I:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "I:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Global Startup: Bluetooth.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://I:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send To &Bluetooth - I:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - I:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - I:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - I:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: Outpost Security Suite Pro Quick Tune - {44627E97-789B-40d4-B5C2-58BD171129A1} - I:\Program Files\Agnitum\Outpost Security Suite Pro\ie_bar.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - I:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - I:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - I:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - I:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - I:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15030/CTSUEng.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1167421070296
O16 - DPF: {C237A80A-4C55-4C68-BAA9-CBE4408D12B2} (F-Secure Online Scanner 4.0 Launcher) - http://download.sp.f-secure.com/ols/f-secure-rtm/resources/fslauncher.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/softwareupdate/su2/ocx/15035/CTPID.cab
O20 - AppInit_DLLs: blocker.dll
O23 - Service: Agnitum Client Security Service (acssrv) - Agnitum Ltd. - I:\PROGRA~1\Agnitum\OUTPOS~1\acs.exe
O23 - Service: Apple Mobile Device - Apple Inc. - I:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - I:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - I:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - I:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - I:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPod Service - Apple Inc. - I:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - I:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - I:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - I:\WINDOWS\system32\nvsvc32.exe

--
End of file - 6759 bytes

• Open HijackThis.
  
• Choose "Do a system scan only"
  
• Check the boxes in front of these lines:
  
  
  O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - (no file)
  O4 - HKCU\..\Run: [tempo-setup2.exe] I:\WINDOWS\system32\tempo-setup2.exe
  O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "I:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
  O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "I:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
  O4 - Global Startup: Bluetooth.lnk = ?
  O20 - AppInit_DLLs: blocker.dll
  
  
  
  
• Press "Fix Checked"
  
• Close Hijack This.
  

• Download combofix from here
  Link 1
  Link 2
  

1. If you are using Firefox, make sure that your download settings are as follows:

* Tools->Options->Main tab
* Set to "Always ask me where to Save the files".

2. During the download, rename Combofix to Combo-Fix as follows:





3. It is important you rename Combofix during the download, but not after.
4. Please do not rename Combofix to other names, but only to the one indicated.
5. Close any open browsers.
6. We need to disable your local AV (Anti-virus) before running Combofix.

• See HERE for how to disable your AV. (Mcafee)
  
• Double click on ComboFix.exe.
  
• Follow the prompts. NOTE:
  
• ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
  ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***
  
• Allow combofix to run
  
• Post C:\combofix.txt back here.
  
  Note:
  Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
  

nothing happens when I double click on ComboFix.

• Open HijackThis.
  
• When Hijack This opens, click "Open the Misc Tools section"
  
• Then select "Delete a file on reboot..."
  
• Then find and select this file: C:\windows\system32\blocker.dll
  
• Select okay and select yes to reboot.
  

Then run Combofix, it will work after that.

Here is the log for combofix

ComboFix 09-06-03.04 - Kuya 06/05/2009 18:53.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.570 [GMT -4:00]
Running from: i:\documents and settings\Kuya\Desktop\Combo-Fix.exe
AV: Outpost Security Suite Pro *On-access scanning disabled* (Updated) {8A20CA2A-9E02-4A64-923B-0A38208EB7FD}
FW: Outpost Security Suite Pro *disabled* {8A20CA2A-9E02-4A64-923B-0A38208EB7FD}
* Created a new restore point
* Resident AV is active

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Autorun.inf
D:\Autorun.inf
E:\Autorun.inf
E:\desktop.ini
I:\autorun.inf
i:\windows\102z7spamb9t43e5.bin
i:\windows\104z5spa9bot75b.exe
i:\windows\10z89not-9-vi5us6d1.dll
i:\windows\1132b5zkdoo92055.exe
i:\windows\11803sp9mbo52d8z.dll
i:\windows\11985wozm63c5.ocx
i:\windows\11c95ddwaze3262.dll
i:\windows\1215zt9oj3e9.exe
i:\windows\12230sp9mbot73z5.bin
i:\windows\1239zw5rm1b3.cpl
i:\windows\12599s9azbot595.dll
i:\windows\1268n5t9a-viruz6bc.dll
i:\windows\1269zhac9tool5765.ocx
i:\windows\12720sp59bot22z.cpl
i:\windows\12d5addwa95295z.cpl
i:\windows\12z49spy295.bin
i:\windows\133445zt-a-vi9us414.bin
i:\windows\133z59orm774.exe
i:\windows\13536spam9ot2bz.exe
i:\windows\13cathief35z9.ocx
i:\windows\13d5back9oor1761z.bin
i:\windows\14e5zparse994.exe
i:\windows\15054zorm92.bin
i:\windows\150zdownload5r2947.bin
i:\windows\15335wo9m55az.ocx
i:\windows\15472vi5usz09.cpl
i:\windows\15554sz5mbot9b2.cpl
i:\windows\1555s9yware576z.dll
i:\windows\157z79pambot7c9.ocx
i:\windows\158z5spa9bo519e.cpl
i:\windows\1593addwarz2308.ocx
i:\windows\15989zacktoo539e.cpl
i:\windows\15d4s9z5se1862.bin
i:\windows\15e3addwarz9235.exe
i:\windows\15z7b9ckdoor173.cpl
i:\windows\163739zoj7e5.bin
i:\windows\16529wzrm699.dll
i:\windows\16541spamzo970.exe
i:\windows\1655tz5e9949.dll
i:\windows\17009hacktoo515z.dll
i:\windows\17320not5z-virus915.ocx
i:\windows\17486zpa59ot6c3.cpl
i:\windows\17509virus50z9.ocx
i:\windows\176519acktool7bz.cpl
i:\windows\17760not-a-v5rus19z.ocx
i:\windows\17c5doz5loa9er3236.exe
i:\windows\17z8backdoo59876.bin
i:\windows\18140notza-vi5us7a9.cpl
i:\windows\18319h5cktool74z.bin
i:\windows\18586sp9mbzt51b.cpl
i:\windows\19198tr5z98c.bin
i:\windows\1939bac5doo9218z.exe
i:\windows\19480troz5469.dll
i:\windows\19692not-a-vi5usf9z.exe
i:\windows\19873troj65z9.dll
i:\windows\1abszars99275.cpl
i:\windows\1b5z9ir1842.cpl
i:\windows\1bc89teal2z45.bin
i:\windows\1bz4back9o5r25.ocx
i:\windows\1caza59ware531.bin
i:\windows\1cd0st59l2z27.bin
i:\windows\1ebft9ief1635z.ocx
i:\windows\1z584s9y650.ocx
i:\windows\1z6529py18.dll
i:\windows\20208hackt5z9641.dll
i:\windows\2045spy509z.exe
i:\windows\20479spamboz5315.bin
i:\windows\20529a5kdoor15z8.bin
i:\windows\20533not-z5vir9s7a0.ocx
i:\windows\2069zworm535.exe
i:\windows\20857not-z-vi5usc79.ocx
i:\windows\20z92virus1ec5.bin
i:\windows\21615not-a-viruz195.cpl
i:\windows\21856w9zm67f.cpl
i:\windows\21895tzojf9.bin
i:\windows\21937wzr59d9.exe
i:\windows\219z0not5a-virus1f9.dll
i:\windows\22457worz2095.exe
i:\windows\22655spy299z.ocx
i:\windows\2267595azbotea.dll
i:\windows\22e7tzreat306095.exe
i:\windows\22z45sp9210.dll
i:\windows\23047sp9mb5t458z.ocx
i:\windows\23059worm237z.cpl
i:\windows\230809roz55b.dll
i:\windows\23508worm579z.ocx
i:\windows\2354tzre9t29492.cpl
i:\windows\235729pambo5zd5.ocx
i:\windows\2368addzar52294.cpl
i:\windows\23760not-z5virus8a9.dll
i:\windows\2396z5roj7a4.bin
i:\windows\23ffdown5oa9er155z.ocx
i:\windows\24595vzrus457.cpl
i:\windows\24z98vir5s23b.exe
i:\windows\2509addw9ze35.ocx
i:\windows\25351vz9us551.ocx
i:\windows\2537thz5at997.cpl
i:\windows\25651zack5ool71f9.cpl
i:\windows\25655h9cktoo53zc.cpl
i:\windows\25959trzj98d5.bin
i:\windows\25969pz106.dll
i:\windows\25989spz21b.exe
i:\windows\259do59loader333z.exe
i:\windows\2610t9reat11959z.bin
i:\windows\26bfdownl9ader4z85.cpl
i:\windows\271fthr9at5z015.cpl
i:\windows\2726tzo952.ocx
i:\windows\27292spamzot15b.exe
i:\windows\27a29ddwarez125.cpl
i:\windows\2823downloaderz5269.dll
i:\windows\28756zot-a-9irus557.cpl
i:\windows\28850worm59z.cpl
i:\windows\29051hacktzol55b.cpl
i:\windows\29252viru935z.exe
i:\windows\295fsparsez850.ocx
i:\windows\29a5ste5lz608.bin
i:\windows\2a9dbackdo5r12z59.exe
i:\windows\2ce9sparse30z5.cpl
i:\windows\2d94spar5e2z10.exe
i:\windows\2d9dspywarz25229.cpl
i:\windows\2e6dztea91520.dll
i:\windows\2z2asp5rs92555.dll
i:\windows\2z431s9y5e6.ocx
i:\windows\2z507spambot309.exe
i:\windows\2z695troj7ce.dll
i:\windows\2z757virus5f9.exe
i:\windows\2z9cstea5857.cpl
i:\windows\30039wormzba5.cpl
i:\windows\30075haz9toolb5.ocx
i:\windows\30093sp95zot7ab.exe
i:\windows\30689h9z5tool23c.ocx
i:\windows\3075viru953z.exe
i:\windows\3095thze9t32355.ocx
i:\windows\30970t9oz593.bin
i:\windows\30baddw5r964z.ocx
i:\windows\30e2addware158z9.cpl
i:\windows\31540szy699.exe
i:\windows\319btzi5f2390.cpl
i:\windows\320z8tro54899.exe
i:\windows\32c5back5oor298z.exe
i:\windows\32c9t5ief966z.ocx
i:\windows\3416zhrea944545.exe
i:\windows\34335pambzt972.cpl
i:\windows\3496szeal18025.cpl
i:\windows\3498spy5zre31.dll
i:\windows\35295aczto9l633.ocx
i:\windows\354fd9wzloader1032.ocx
i:\windows\355e9teaz2599.cpl
i:\windows\3592thizf533.dll
i:\windows\35fcs5ealz0079.ocx
i:\windows\3655thr9at11z49.dll
i:\windows\3724s5y9a2z.cpl
i:\windows\387fdownz9ader3265.bin
i:\windows\392znot5a-vi9us3a2.bin
i:\windows\394zspars9516.bin
i:\windows\395evir14z6.exe
i:\windows\39c99hreat15z7.cpl
i:\windows\39d7downlza9er1656.dll
i:\windows\39z635roj555.dll
i:\windows\3a23s9ealz504.exe
i:\windows\3a57thief38z9.cpl
i:\windows\3bccdownlza5er9917.ocx
i:\windows\3c06steal2955z.cpl
i:\windows\3c6bspywar9552z.dll
i:\windows\3e1dthreatz759.ocx
i:\windows\3f88do5nloaderz932.cpl
i:\windows\3fz9spy5are2431.dll
i:\windows\3z089t5oj1f9.cpl
i:\windows\4085vi93595z.cpl
i:\windows\419fdzwnl5ader2508.cpl
i:\windows\4259v9r5s1zb.exe
i:\windows\429e5teal682z.cpl
i:\windows\435ezpywa9e29315.cpl
i:\windows\435zaddware9565.dll
i:\windows\4550zp9rse2954.exe
i:\windows\4556spambo95z3.ocx
i:\windows\4565azd9are3164.cpl
i:\windows\456ct5r9zt24834.dll
i:\windows\459avir2z295.ocx
i:\windows\47f1zddwar91535.bin
i:\windows\484ath5e9tz6515.cpl
i:\windows\4878sz5al20149.exe
i:\windows\49z6steal645.bin
i:\windows\49zfspar9e1153.cpl
i:\windows\4a3bth5e91769z.cpl
i:\windows\4a499ackdoor2615z.bin
i:\windows\4ca6addza5e13559.dll
i:\windows\4d5d9ddware5z5.bin
i:\windows\4debd9wnlo5dez1295.ocx
i:\windows\4e0stza59477.exe
i:\windows\4e79addwz5e967.exe
i:\windows\4z54threat15995.dll
i:\windows\4zdddow5lo9der3126.ocx
i:\windows\4ze55ir982.ocx
i:\windows\5025h5ckt9ol6ffz.bin
i:\windows\508cvzr1597.ocx
i:\windows\5149stea52z30.dll
i:\windows\5191d5wnlozder991.ocx
i:\windows\521ad9ware3153z.exe
i:\windows\52f5addwzre9031.dll
i:\windows\53116not9a-virus5d4z.exe
i:\windows\5315ha9ktoolz6f.exe
i:\windows\5446zpar95501.bin
i:\windows\5483thie9140z.exe
i:\windows\5494spy5b9z.cpl
i:\windows\549stezl1528.ocx
i:\windows\54f9thr9az35198.cpl
i:\windows\5503sp9zbot4e25.cpl
i:\windows\5509sparse1z1.exe
i:\windows\5520dow95zader194.bin
i:\windows\5539woz559b.dll
i:\windows\5549steal9541z.exe
i:\windows\554hackt9ol563z.dll
i:\windows\5551downloade9655z.bin
i:\windows\55c959ief1202z.dll
i:\windows\55z30hacktool1059.bin
i:\windows\55z5spy69c.ocx
i:\windows\572tzoj9b6.bin
i:\windows\5740worz40a9.cpl
i:\windows\57727spambo961z.exe
i:\windows\57a55ownlzader9960.exe
i:\windows\57ez9hief2450.ocx
i:\windows\584ab9zkdoor1854.exe
i:\windows\5965zroj1d5.cpl
i:\windows\59a0spars5304z.cpl
i:\windows\59b5steal2054z.cpl
i:\windows\5a2dtz9eat13574.ocx
i:\windows\5af8spyware1892z.cpl
i:\windows\5b51downzo5der194.exe
i:\windows\5b52backdzo59479.cpl
i:\windows\5c2fa5zware21809.ocx
i:\windows\5cfaddwarez4759.dll
i:\windows\5d95spyzare1944.exe
i:\windows\5f1badzware20149.cpl
i:\windows\5f90downloadzr2112.dll
i:\windows\5z0029orm421.exe
i:\windows\5z1cth5e91126.ocx
i:\windows\5z2v9r3172.ocx
i:\windows\5z59vir2979.ocx
i:\windows\5z5ddo9nloader553.bin
i:\windows\6005spamboz7519.dll
i:\windows\622csparsz5679.exe
i:\windows\6329h9ckt5oz102.cpl
i:\windows\6338do9nloadzr555.bin
i:\windows\63b3azdwar517869.cpl
i:\windows\63fdthief560z9.ocx
i:\windows\64169iruzd5.dll
i:\windows\647zh9cktool525.exe
i:\windows\6509st5al25z.exe
i:\windows\659559rus577z.cpl
i:\windows\65a9dzwn5oader2115.bin
i:\windows\6600ad95are5z3.dll
i:\windows\6865thre5z10089.bin
i:\windows\68935orm599z.ocx
i:\windows\68a0st5az896.ocx
i:\windows\6916spamzot457.dll
i:\windows\6924vzr18985.ocx
i:\windows\693wo5m27z9.exe
i:\windows\698avzr17455.exe
i:\windows\6bbfaddwz5e10649.bin
i:\windows\6d94virz425.cpl
i:\windows\6z94backdoor549.cpl
i:\windows\6zabackd9or350.exe
i:\windows\7040thre9t317z5.exe
i:\windows\7044backdoorz495.dll
i:\windows\709zstea52051.bin
i:\windows\715f5parse2z29.cpl
i:\windows\74d85pywa9ez119.exe
i:\windows\74dfdownl95dez2787.exe
i:\windows\7500w9rm37bz.exe
i:\windows\7509virus5z5.dll
i:\windows\755b9zarse2429.dll
i:\windows\7593spyzare788.exe
i:\windows\75z5thief16519.dll
i:\windows\77h9ck5oolz31.bin
i:\windows\78509ir14z9.dll
i:\windows\797dzownloader5159.dll
i:\windows\79a5stzal23949.dll
i:\windows\79baspy9aze5785.bin
i:\windows\79z8spywa9e3145.ocx
i:\windows\7a1bvz92145.bin
i:\windows\7a68thi5f9z4.bin
i:\windows\7bce9pywa5e16z0.cpl
i:\windows\7c60sparse6z59.dll
i:\windows\7dd59irz127.exe
i:\windows\7e72b5ckd9zr2289.cpl
i:\windows\7z51sparse13709.ocx
i:\windows\7zb9th9ef5315.bin
i:\windows\8253hacktoo9z21.bin
i:\windows\8629tr5j20z.cpl
i:\windows\8952zpy55a.dll
i:\windows\8c7szeal14995.exe
i:\windows\8z19tr5j258.cpl
i:\windows\9054hacktool589z.cpl
i:\windows\90560trzj3d8.dll
i:\windows\90ethr9at2015z.bin
i:\windows\91095trzj2075.dll
i:\windows\9117zworm14f5.cpl
i:\windows\9157troz45d.ocx
i:\windows\92517wozm590.exe
i:\windows\94559wormz43.dll
i:\windows\9529vir5s4z2.exe
i:\windows\9557vizus591.dll
i:\windows\957thzef17995.ocx
i:\windows\9581threaz2785.ocx
i:\windows\95bs5arsz2910.dll
i:\windows\96259roz225.ocx
i:\windows\96965worm74z5.exe
i:\windows\96z48troj575.bin
i:\windows\97776hacktoo5z0.ocx
i:\windows\9805notza9v5rusd7.bin
i:\windows\98305orm39z.cpl
i:\windows\9996tzoj595.exe
i:\windows\999a5dwarz625.cpl
i:\windows\99z95py2c3.dll
i:\windows\9bzcthief2554.dll
i:\windows\9d93spzrse553.dll
i:\windows\9e45sparze799.bin
i:\windows\9f04dow5lzader427.exe
i:\windows\9f97downloade5917z.exe
i:\windows\a5aspar9e135z.bin
i:\windows\c95zteal2586.bin
i:\windows\dzav9r3256.cpl
i:\windows\e3a9dw5rez03.ocx
i:\windows\e45d5wnloader1965z.ocx

con't of log


i:\windows\system32\1070s9za51943.bin
i:\windows\system32\107z3t59j775.ocx
i:\windows\system32\10975v95usz0a.cpl
i:\windows\system32\10991trzj51.exe
i:\windows\system32\10b1adzwar91945.cpl
i:\windows\system32\110069p5mbot4dz.bin
i:\windows\system32\1131295oz37a.ocx
i:\windows\system32\11329zpy45c.dll
i:\windows\system32\114z9virus79e5.ocx
i:\windows\system32\118a9parse59z.bin
i:\windows\system32\118fadd5zr92238.bin
i:\windows\system32\1191s5azse3904.ocx
i:\windows\system32\11997wo5z729.ocx
i:\windows\system32\11zathief1059.bin
i:\windows\system32\12510spamb9t5cbz.ocx
i:\windows\system32\1270ha9kt5olzdb.dll
i:\windows\system32\12918zp530a.cpl
i:\windows\system32\13716h9cktool1z5.ocx
i:\windows\system32\141z99orm4b65.cpl
i:\windows\system32\14382t5oj4z09.bin
i:\windows\system32\14396wzrm55.bin
i:\windows\system32\14c95parze2150.ocx
i:\windows\system32\150459orz655.bin
i:\windows\system32\15157v95uz14.exe
i:\windows\system32\152589zrm205.ocx
i:\windows\system32\1532zs95550.dll
i:\windows\system32\15388spy96z5.dll
i:\windows\system32\15503spambzt925.dll
i:\windows\system32\1552spa9sez917.exe
i:\windows\system32\1552szy6029.dll
i:\windows\system32\1559zparse1949.exe
i:\windows\system32\15698zpambot445.bin
i:\windows\system32\157589ir5z252.ocx
i:\windows\system32\15758not-a-zirus1069.cpl
i:\windows\system32\15952spamb5t66z.exe
i:\windows\system32\1599sp5rze504.cpl
i:\windows\system32\15ac9i559z.dll
i:\windows\system32\16152worm69z.exe
i:\windows\system32\16358not-a-vi9uz42f.bin
i:\windows\system32\16599spy5z.exe
i:\windows\system32\1683vz95675.exe
i:\windows\system32\16881hazk5oo9f5.ocx
i:\windows\system32\17187szy5f9.bin
i:\windows\system32\175cs9azse245.dll
i:\windows\system32\179z4vir5s219.ocx
i:\windows\system32\1856znot-a-viru519.cpl
i:\windows\system32\185steal327z9.bin
i:\windows\system32\19017worz55f.bin
i:\windows\system32\19158zirus625.dll
i:\windows\system32\19598not9a-vzrus250.dll
i:\windows\system32\19735pambot9cz.exe
i:\windows\system32\19z2d9wnl5ader2127.exe
i:\windows\system32\1a32d5wnloadez1789.exe
i:\windows\system32\1bzspars9951.cpl
i:\windows\system32\1cf9addwaze2495.ocx
i:\windows\system32\1f1fthre5t3z559.exe
i:\windows\system32\1z002spa5b9tf3.ocx
i:\windows\system32\1z19vi52909.cpl
i:\windows\system32\1z378t5o9198.cpl
i:\windows\system32\1z894troj695.bin
i:\windows\system32\20799zir95433.dll
i:\windows\system32\2079znot-a-viru9125.dll
i:\windows\system32\210199iru5z5d.bin
i:\windows\system32\21455virus2e9z.exe
i:\windows\system32\216az9ief5329.bin
i:\windows\system32\217815pamz9t201.cpl
i:\windows\system32\219679pazbot752.bin
i:\windows\system32\21974sp52z.bin
i:\windows\system32\21z00spamb9519a.bin
i:\windows\system32\22235ha5kt9oz452.dll
i:\windows\system32\22449not9az5irus17f.cpl
i:\windows\system32\22999hackt5ol1zc.ocx
i:\windows\system32\2350threat9z3.cpl
i:\windows\system32\2355s9ealz74.exe
i:\windows\system32\243025ro9z84.dll
i:\windows\system32\24557h5cztool93.bin
i:\windows\system32\248575ot-a-vir9s6eaz.dll
i:\windows\system32\24985spy70cz.ocx
i:\windows\system32\25097spy569z.ocx
i:\windows\system32\2520not-a-vi5zs393.exe
i:\windows\system32\25272tr9z4f1.cpl
i:\windows\system32\25301hacktzol291.bin
i:\windows\system32\25578ha5ktoo977z.exe
i:\windows\system32\255929py34z.bin
i:\windows\system32\25592not-a-vi9z52d2.dll
i:\windows\system32\25655w5rmz9.cpl
i:\windows\system32\257115orz1d79.exe
i:\windows\system32\2595acktozl519.cpl
i:\windows\system32\260569roj5z4.dll
i:\windows\system32\26584not-a-v59uz302.dll
i:\windows\system32\265z7spy59f.cpl
i:\windows\system32\26657zacktool559.ocx
i:\windows\system32\266z59ormcf.ocx
i:\windows\system32\2745spa5sz91.exe
i:\windows\system32\27599worm9z5.cpl
i:\windows\system32\27957hacktooz9c6.dll
i:\windows\system32\28009h5cktoolz95.bin
i:\windows\system32\28197virzs7f5.ocx
i:\windows\system32\288bv5z9994.bin
i:\windows\system32\28z19sp5154.bin
i:\windows\system32\29069wor5z1a.bin
i:\windows\system32\29197spyz56.ocx
i:\windows\system32\29215no5-a-virus691z.dll
i:\windows\system32\294185zrm5c6.bin
i:\windows\system32\2958vzr909.bin
i:\windows\system32\29690tr5j94z.ocx
i:\windows\system32\2976zs597e5.bin
i:\windows\system32\29838w5r96cz.cpl
i:\windows\system32\29999sz9mb5t539.ocx
i:\windows\system32\2b649ackdozr5017.ocx
i:\windows\system32\2b935ir1541z.cpl
i:\windows\system32\2bdsparze5099.bin
i:\windows\system32\2be09hzef1564.cpl
i:\windows\system32\2de0spyz95e297.bin
i:\windows\system32\2dzasteal595.bin
i:\windows\system32\2eebthreaz9153.ocx
i:\windows\system32\2fd9zackdoor20295.ocx
i:\windows\system32\2z089s9ambot451.cpl
i:\windows\system32\2z659spy3c25.cpl
i:\windows\system32\2z92spy599.ocx
i:\windows\system32\2zd4spa5s91109.dll
i:\windows\system32\30125spzmb9t22a.exe
i:\windows\system32\304129pambot554z.exe
i:\windows\system32\3045zworm495.exe
i:\windows\system32\30719tzoj995.exe
i:\windows\system32\3119zworm59f.cpl
i:\windows\system32\3145zpywa5e1932.ocx
i:\windows\system32\31baspazs512559.exe
i:\windows\system32\31z38tr95f8.ocx
i:\windows\system32\32121zot-5-v9rus3f4.bin
i:\windows\system32\3253z9or557.ocx
i:\windows\system32\325cthz9f2737.ocx
i:\windows\system32\3382a5dware2z769.exe
i:\windows\system32\3512hack9ozl575.ocx
i:\windows\system32\3569virus157z.bin
i:\windows\system32\35cavir9z03.cpl
i:\windows\system32\379cdo5nloader25z.exe
i:\windows\system32\3854thrza59907.bin
i:\windows\system32\39555trojz6d.dll
i:\windows\system32\39795irusz27.bin
i:\windows\system32\39dc5hreatz5993.exe
i:\windows\system32\39f2spywz5e16989.ocx
i:\windows\system32\3b75ste9l9z9.ocx
i:\windows\system32\3d29thze5291.dll
i:\windows\system32\3d2fback5o9r1z06.dll
i:\windows\system32\3fz9sparse1585.exe
i:\windows\system32\3z42th95f1277.cpl
i:\windows\system32\3z5athrea911065.cpl
i:\windows\system32\40009zo5f2.exe
i:\windows\system32\4145thzeat17997.cpl
i:\windows\system32\41z3worm595.cpl
i:\windows\system32\434ddowz9oa5er2058.exe
i:\windows\system32\4430not-z-vir9s65d.dll
i:\windows\system32\452zsteal1904.ocx
i:\windows\system32\457a5ir1549z.ocx
i:\windows\system32\45abspywzre20229.bin
i:\windows\system32\476fsparse259z.bin
i:\windows\system32\47acsparse2z59.dll
i:\windows\system32\49405zarse2102.ocx
i:\windows\system32\49495pa9zot56a.dll
i:\windows\system32\4972spyware98z5.exe
i:\windows\system32\4997t5zeat28436.dll
i:\windows\system32\499fdzwnloade52333.cpl
i:\windows\system32\4a8abacz9oor10135.exe
i:\windows\system32\4abzbac95oor13.exe
i:\windows\system32\4d5zthrea94276.dll
i:\windows\system32\4d6a5pzrse15789.exe
i:\windows\system32\4d75spywar91154z.dll
i:\windows\system32\4ddf5hief329z.bin
i:\windows\system32\4z39steal1165.dll
i:\windows\system32\5107not9a-vzrus22c.exe
i:\windows\system32\514b5owzloa9er585.dll
i:\windows\system32\5269spyware24z0.cpl
i:\windows\system32\529395eaz458.exe
i:\windows\system32\52a1down9oader25z5.bin
i:\windows\system32\52z35ir958.exe
i:\windows\system32\52z9sp951b.dll
i:\windows\system32\535abac5do9r6z3.cpl
i:\windows\system32\5396a9dware193z.ocx
i:\windows\system32\54019wozm26.bin
i:\windows\system32\5455addw9re1z53.bin
i:\windows\system32\547znot59-virus536.ocx
i:\windows\system32\5495tr9j2z8.bin
i:\windows\system32\5505spzrse9841.cpl
i:\windows\system32\551ftzie9571.cpl
i:\windows\system32\55295tealz724.exe
i:\windows\system32\5559addzare2255.ocx
i:\windows\system32\555fv9r307z.dll
i:\windows\system32\557abackzoo93006.exe
i:\windows\system32\5587do9nloader5692z.bin
i:\windows\system32\5587downloz9er124.bin
i:\windows\system32\558downloa9er1999z.ocx
i:\windows\system32\559adow9loader588z.cpl
i:\windows\system32\559csteal9z97.dll
i:\windows\system32\55dzthief695.dll
i:\windows\system32\55f5threat192z7.dll
i:\windows\system32\56215spamb9z91.dll
i:\windows\system32\5656vzr990.dll
i:\windows\system32\56e2ste9z1970.dll
i:\windows\system32\56zasp5rse8479.bin
i:\windows\system32\57474spy2z9.dll
i:\windows\system32\5765z9us76a.dll
i:\windows\system32\57905parse1282z.cpl
i:\windows\system32\57905spzmbot5a3.ocx
i:\windows\system32\57ezvir55599.cpl
i:\windows\system32\5825thze9235.exe
i:\windows\system32\5882spz5se1898.dll
i:\windows\system32\58fth9efz899.dll
i:\windows\system32\59159acztool4875.bin
i:\windows\system32\5915v9r29z1.exe
i:\windows\system32\59269py16az.ocx
i:\windows\system32\594z0troj395.exe
i:\windows\system32\59502h9zktool150.ocx
i:\windows\system32\5959backdzor3211.cpl
i:\windows\system32\5960nzt-a-viru9259.dll
i:\windows\system32\5965backdoor9756z.cpl
i:\windows\system32\598asparse259z.cpl
i:\windows\system32\598bzckd9or1321.cpl
i:\windows\system32\599149roj3zb.exe
i:\windows\system32\5992sp5waze3389.ocx
i:\windows\system32\599dsteal1380z.dll
i:\windows\system32\59f5szyware2082.ocx
i:\windows\system32\59z50worm997.cpl
i:\windows\system32\5b5z5r1199.bin
i:\windows\system32\5bccstezl9542.ocx
i:\windows\system32\5bf19pa5se2z29.bin
i:\windows\system32\5c5abackzoor2191.exe
i:\windows\system32\5cd3add9are126z.cpl
i:\windows\system32\5cf3s5ezl489.bin
i:\windows\system32\5d18vir9522z.dll
i:\windows\system32\5d7cd9wnloaderz55.cpl
i:\windows\system32\5dccdownl9ader3195z.dll
i:\windows\system32\5e07addware409z.ocx
i:\windows\system32\5e0cthr5at9z309.exe
i:\windows\system32\5e56addwzre1958.cpl
i:\windows\system32\5fcfs9eal353z.bin
i:\windows\system32\5z1cspa9se2575.exe
i:\windows\system32\5z6fdownl9ader2650.cpl
i:\windows\system32\5z84th9ef852.cpl
i:\windows\system32\5zbevi91735.ocx
i:\windows\system32\5zc8vi516619.cpl
i:\windows\system32\5zf9parse2053.exe
i:\windows\system32\5zfcspars99395.ocx
i:\windows\system32\606295t-a-vzrus461.dll
i:\windows\system32\61f69h5zf1964.bin
i:\windows\system32\622e9ownloa5er76z.ocx
i:\windows\system32\63b095ief26z5.dll
i:\windows\system32\64c5downzoad5944.bin
i:\windows\system32\6514b9ckdoor2955z.bin
i:\windows\system32\653dowzloader2559.bin
i:\windows\system32\65659hiz5583.cpl
i:\windows\system32\656dv5z11579.dll
i:\windows\system32\6591downloa9ez2556.bin
i:\windows\system32\65e8thzef94305.dll
i:\windows\system32\65ebazkdoo51904.bin
i:\windows\system32\6706a5dwaze902.cpl
i:\windows\system32\69d2vir57z29.bin
i:\windows\system32\6b909tealz518.exe
i:\windows\system32\6bdath5eatz9829.bin
i:\windows\system32\6c43addwzr5967.bin
i:\windows\system32\6dz7s59al713.cpl
i:\windows\system32\6ed05ownload9r185z.ocx
i:\windows\system32\6ezdo9nloader13965.exe
i:\windows\system32\6f10szeal5933.bin
i:\windows\system32\7048zac5tool962.ocx
i:\windows\system32\73549zy34e.exe
i:\windows\system32\736baddwzre7895.bin
i:\windows\system32\736h5ck9ooz4b9.exe
i:\windows\system32\7455thzef1939.exe
i:\windows\system32\74dbzhreat551109.cpl
i:\windows\system32\7577bac5dooz2923.cpl
i:\windows\system32\7593tzief15899.cpl
i:\windows\system32\75adth9ef1035z.dll
i:\windows\system32\75edvir65z9.bin
i:\windows\system32\75fbt5ief9z56.exe
i:\windows\system32\7651z5ckt9ol1d8.ocx
i:\windows\system32\769zp9rse5025.exe
i:\windows\system32\76a19oz5loader2905.exe
i:\windows\system32\771azir549.dll
i:\windows\system32\78zed5wnl9ader2835.bin
i:\windows\system32\7938t5i9f68z.cpl
i:\windows\system32\793z59r788.exe
i:\windows\system32\795z5ir20149.exe
i:\windows\system32\79d5thzef5899.dll
i:\windows\system32\79ebaczdoo51549.bin
i:\windows\system32\79f1backdoorz552.bin
i:\windows\system32\7a0cthrezt19354.bin
i:\windows\system32\7a55ad9wzr52406.cpl
i:\windows\system32\7bdzthie54279.cpl
i:\windows\system32\7z79spyware13575.cpl
i:\windows\system32\855hazktool45d9.cpl
i:\windows\system32\8569worm13az.exe
i:\windows\system32\8914not-a-z9rus335.exe
i:\windows\system32\8974n5t9a-virus1caz.dll
i:\windows\system32\8989w5zm463.exe
i:\windows\system32\8d0s9z5l1357.bin
i:\windows\system32\8z26tr9j158.cpl
i:\windows\system32\90859spy1z15.ocx
i:\windows\system32\90908vizus6ce5.dll
i:\windows\system32\915z55orm158.dll
i:\windows\system32\91944vir5s1za.ocx
i:\windows\system32\9195troj552z.cpl
i:\windows\system32\92z5sp9a0.exe
i:\windows\system32\93025zp592.ocx
i:\windows\system32\93418wor55za.exe
i:\windows\system32\95094vzrus3cd.dll
i:\windows\system32\9546zhacktool21f.bin
i:\windows\system32\9548vir3254z.bin
i:\windows\system32\9549sz968a.ocx
i:\windows\system32\9587downlo5der28z.cpl
i:\windows\system32\95f8ad5warz22.bin
i:\windows\system32\95z83spy1a8.bin
i:\windows\system32\97d1spywar524z8.bin
i:\windows\system32\9855zpy19a.bin
i:\windows\system32\99505sp5mbzt6b8.bin
i:\windows\system32\995steal2z845.ocx
i:\windows\system32\9b19v5r3z91.cpl
i:\windows\system32\9d4e5hzeat4402.bin
i:\windows\system32\9d9b5ir3016z.exe
i:\windows\system32\9e40spywa5e2525z.cpl
i:\windows\system32\9e7t5ief2z81.bin
i:\windows\system32\9ecaddzare31725.bin
i:\windows\system32\9f5fback5zor2144.cpl
i:\windows\system32\a8f9hief92z5.dll
i:\windows\system32\aazvi95534.ocx
i:\windows\system32\e7cz9r2165.ocx
i:\windows\system32\f29bazkdoor5256.bin
i:\windows\system32\f5evir2982z.ocx
i:\windows\system32\fffthr5az292909.cpl
i:\windows\system32\tmp31.tmp
i:\windows\system32\tmp38.tmp
i:\windows\system32\tmp40.tmp
i:\windows\system32\z0284n5t9a-virus185.ocx
i:\windows\system32\z083t9r5at25862.ocx
i:\windows\system32\z115spambo9564.exe
i:\windows\system32\z129spyw5re579.bin
i:\windows\system32\z1595s9ambot7b1.ocx
i:\windows\system32\z15daddware3955.ocx
i:\windows\system32\z2052not-a-5iru9765.cpl
i:\windows\system32\z2549spy2b6.cpl
i:\windows\system32\z2b0thie95772.dll
i:\windows\system32\z3866hacktoo53f69.bin
i:\windows\system32\z3f0spyware20995.bin
i:\windows\system32\z4246wor9545.exe
i:\windows\system32\z5979vi5us2ee.dll
i:\windows\system32\z6144no59a-virus182.cpl
i:\windows\system32\z63s5yware3069.cpl
i:\windows\system32\z690tr9j555.cpl
i:\windows\system32\z6t9reat53651.exe
i:\windows\system32\z902spy551.ocx
i:\windows\system32\z9bspyware17785.cpl
i:\windows\system32\za9c5parse312.dll
i:\windows\system32\zb679ddwar51136.cpl
i:\windows\system32\zd5cspyware2997.cpl
i:\windows\z0799spy2509.exe
i:\windows\z19f5pyware2675.exe
i:\windows\z27459irus228.cpl
i:\windows\z35tr9j557.exe
i:\windows\z3b8t9i5f2107.exe
i:\windows\z405steal99595.cpl
i:\windows\z4795ha9ktool425.ocx
i:\windows\z49a5parse9221.exe
i:\windows\z52est9al5694.dll
i:\windows\z59419py105.dll
i:\windows\z6415worm1935.dll
i:\windows\z7081h5cktool59a.ocx
i:\windows\z77abackdoor2395.dll
i:\windows\z7fspyware1955.ocx
i:\windows\z9038not-a-vi5us969.exe
i:\windows\z939virus56c.dll
i:\windows\z9465worm46b.dll
i:\windows\z9484spy456.bin
i:\windows\z9ccbackdoor17485.dll
i:\windows\za7dvir9695.exe
i:\windows\zbe9teal3185.ocx
i:\windows\zc5dspars5599.bin
i:\windows\ze14thre5t96214.dll
i:\windows\zfc4downloa9er3365.ocx
i:\windows\zfec5parse8869.cpl

last part of log


.
((((((((((((((((((((((((( Files Created from 2009-05-05 to 2009-06-05 )))))))))))))))))))))))))))))))
.

2009-06-04 03:05 . 2009-06-04 03:05 -------- d-----w- i:\program files\Trend Micro
2009-06-04 02:36 . 2009-06-04 02:36 -------- d-----w- i:\program files\CCleaner
2009-06-04 01:50 . 2009-05-26 17:20 40160 ----a-w- i:\windows\system32\drivers\mbamswissarmy.sys
2009-06-04 01:50 . 2009-06-04 01:50 -------- d-----w- i:\documents and settings\All Users\Application Data\Malwarebytes
2009-06-04 01:50 . 2009-05-26 17:19 19096 ----a-w- i:\windows\system32\drivers\mbam.sys
2009-06-04 01:50 . 2009-06-04 01:51 -------- d-----w- i:\program files\Malwarebytes' Anti-Malware
2009-06-03 11:05 . 2009-06-03 11:05 63984 ----a-w- i:\documents and settings\Operator.UNIT00\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-03 11:03 . 2009-06-03 11:07 664 ----a-w- i:\windows\system32\d3d9caps.dat
2009-06-03 02:12 . 2009-06-03 02:12 361472 ----a-w- i:\windows\system32\tempo-setup2.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-02 22:33 . 2006-12-18 00:42 -------- d-----w- i:\documents and settings\Kuya\Application Data\Azureus
2009-04-22 22:17 . 2007-09-29 03:15 7114736 ----a-w- i:\documents and settings\Kuya\Application Data\Azureus\plugins\azemp\azmplay.exe
2009-04-22 22:14 . 2006-12-18 00:05 -------- d-----w- i:\program files\Azureus
2009-04-12 11:47 . 2009-04-12 11:46 -------- d-----w- i:\program files\iTunes
2009-04-12 11:47 . 2009-04-12 11:46 -------- d-----w- i:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-04-12 11:46 . 2009-04-12 11:46 -------- d-----w- i:\program files\iPod
2009-04-12 11:46 . 2008-09-13 12:56 -------- d-----w- i:\program files\Common Files\Apple
2009-04-12 11:38 . 2009-04-12 11:38 75048 ----a-w- i:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.1.1.10\SetupAdmin.exe
2009-04-01 11:54 . 2009-04-01 11:54 152576 ----a-w- i:\documents and settings\Kuya\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-03-19 20:32 . 2009-03-19 20:32 23400 ----a-w- i:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}\x86\x86\GEARAspiWDM.sys
2009-03-19 20:32 . 2008-01-29 16:01 23400 ----a-w- i:\windows\system32\drivers\GEARAspiWDM.sys
2009-03-09 09:19 . 2008-11-26 23:13 410984 ----a-w- i:\windows\system32\deploytk.dll
2002-08-02 12:00 . 2007-06-23 14:26 12348 ----a-w- i:\program files\viewsonicinstruct_xp.pdf
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"H/PC Connection Agent"="i:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]
"ctfmon.exe"="i:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"SetDefaultMIDI"="MIDIDef.exe" - i:\windows\MIDIDEF.EXE [2005-04-22 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="i:\windows\system32\NvCpl.dll" [2008-09-17 13574144]
"VolPanel"="i:\program files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" [2006-09-15 122880]
"OutpostMonitor"="i:\progra~1\Agnitum\OUTPOS~1\op_mon.exe" [2008-07-15 1207128]
"OutpostFeedBack"="i:\program files\Agnitum\Outpost Security Suite Pro\feedback.exe" [2008-07-15 435544]
"QuickTime Task"="i:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"Adobe Reader Speed Launcher"="i:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2006-10-23 40048]
"SunJavaUpdateSched"="i:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"iTunesHelper"="i:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]
"P17Helper"="SPIRun.dll" - i:\windows\system32\SPIRUN.DLL [2006-07-03 10752]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"NoDispBackgroundPage"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WB]
2001-12-21 03:34 24576 ----a-w- i:\program files\Stardock\Object Desktop\ThemeManager\fastload.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\I:^Documents and Settings^All Users^Start Menu^Programs^Startup^Acrobat Assistant.lnk]
path=i:\documents and settings\All Users\Start Menu\Programs\Startup\Acrobat Assistant.lnk
backup=i:\windows\pss\Acrobat Assistant.lnkCommon Startup

[HKLM\~\startupfolder\I:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=i:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=i:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"i:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"i:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"i:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"=
"i:\\WINDOWS\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"i:\program files\Microsoft ActiveSync\rapimgr.exe"= i:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"i:\program files\Microsoft ActiveSync\wcescomm.exe"= i:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"i:\program files\Microsoft ActiveSync\WCESMgr.exe"= i:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"i:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"i:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R1 SandBox;SandBox;i:\windows\system32\drivers\SandBox.sys [9/1/2008 15:04 673920]
R2 WinDefend;Windows Defender;i:\program files\Windows Defender\MsMpEng.exe [11/3/2006 19:19 13592]
R3 afw;Agnitum firewall driver;i:\windows\system32\drivers\afw.sys [9/1/2008 15:04 30864]
R3 afwcore;afwcore;i:\windows\system32\drivers\afwcore.sys [9/1/2008 15:05 234640]
R3 ASWFilt;ASWFilt;i:\windows\system32\Filt\ASWFilt.dll [9/1/2008 15:04 33408]
R3 VBEngNT;VBEngNT;i:\windows\system32\drivers\VBEngNT.sys [9/1/2008 15:04 1072722]
R3 VBFilt;VBFilt;i:\windows\system32\Filt\VBFilt.dll [9/1/2008 15:04 158816]
S2 acssrv;Agnitum Client Security Service;i:\progra~1\Agnitum\OUTPOS~1\acs.exe [9/1/2008 15:04 1570136]
S3 XIRLINK;IBM PC Camera;i:\windows\system32\drivers\C-itNT.sys [12/9/2006 15:30 503768]
.
Contents of the 'Scheduled Tasks' folder

2009-06-05 i:\windows\Tasks\MP Scheduled Scan.job
- i:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 23:20]

2009-06-05 i:\windows\Tasks\User_Feed_Synchronization-{4E45ABE5-87F0-4A97-8DAF-50A507642CBF}.job
- i:\windows\system32\msfeedssync.exe [2006-10-17 16:58]
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-SRS Audio Sandbox - i:\program files\SRS Labs\Audio Sandbox\SRSSSC.exe
SafeBoot-procexp90.Sys


.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: E&xport to Microsoft Excel - i:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Send To &Bluetooth - i:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
FF - ProfilePath - i:\documents and settings\Kuya\Application Data\Mozilla\Firefox\Profiles\e056wyhn.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com
FF - plugin: i:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-05 18:59
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
P17Helper = Rundll32 SPIRun.dll,RunDLLEntry?

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1275210071-507921405-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID]
@Denied: (Full) (LocalSystem)

[HKEY_USERS\S-1-5-21-1275210071-507921405-839522115-1003\Software\Microsoft\Windows Mobile Disc\S*a*m*s*u*n*g* *B*l*a*c*k*J*a*c*k*"!\CriticalAppInstall\ActiveSync]
"Name"="ActiveSync"
"DisplayName"="Microsoft ActiveSync"
"Param1"="ActiveSync"
"Type"="wellknown"
"Order"=dword:00000000
"State"=dword:0000000b

[HKEY_USERS\S-1-5-21-1275210071-507921405-839522115-1003\Software\Microsoft\Windows Mobile Disc\S*a*m*s*u*n*g* *B*l*a*c*k*J*a*c*k*"!\CriticalAppInstall\IESettings]
"Name"="IESettings"
"Type"="IESettings"
"Order"=dword:00000003
"State"=dword:0000000b

[HKEY_USERS\S-1-5-21-1275210071-507921405-839522115-1003\Software\Microsoft\Windows Mobile Disc\S*a*m*s*u*n*g* *B*l*a*c*k*J*a*c*k*"!\CriticalAppInstall\MediaFiles]
"Name"="MediaFiles"
"Type"="MediaFiles"
"Order"=dword:00000002
"State"=dword:0000000b

[HKEY_USERS\S-1-5-21-1275210071-507921405-839522115-1003\Software\Microsoft\Windows Mobile Disc\S*a*m*s*u*n*g* *B*l*a*c*k*J*a*c*k*"!\CriticalAppInstall\NPW]
"Name"="NPW"
"Param1"="NPW"
"Type"="wellknown"
"Order"=dword:00000001
"State"=dword:0000000b
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(956)
i:\program files\Stardock\Object Desktop\ThemeManager\fastload.dll
.
Completion time: 2009-06-05 19:01
ComboFix-quarantined-files.txt 2009-06-05 23:01

Pre-Run: 45,679,665,152 bytes free
Post-Run: 47,135,645,696 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
i:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

881 --- E O F --- 2009-05-22 12:35

Now open a new notepad file.
Input this into the notepad file:

KILLALL::

File::
i:\windows\system32\tempo-setup2.exe

Folder::
i:\documents and settings\Kuya\Application Data\Azureus
i:\program files\Azureus

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"NoDispBackgroundPage"=-

Save this as CFScript.txt, save it to your desktop also.
Then drag and drop CFScript.txt into combofix as seen below:


This will open combofix again, agree to it's terms and allow it to run.
It may want to reboot after it's done. (It will warn you if it wants to)
Post the resulting log back here.