MSN and Yahoo sending spams..maybe virus is also malfuntioning other software

Hi, I have a window XP SP2.
I accidentally clicked on a spam message without knowing. Now I have virus and my anti-virus said it is deleted but some programs stopped working after. I don't know if the virus was the cause and/or still exist and lurking somewhere. If possible, can we fix without rebooting?

EDIT: here are the names of the viruses my anti-virus program have found and deleted recently
detected: riskware Hidden data sending
Running process: D:\WINDOWS\system32\svchost.exe

deleted: Trojan program Trojan.Win32.Jorik.IRCbot.ro
File: d:\windows\jusched.exe

deleted: Trojan program Trojan.Win32.Jorik.IRCbot.ro
File: c:\program files\download programs\pic675799074533-jpg-www.facebook.com.exe

deleted: Trojan program Trojan.Win32.Jorik.IRCbot.ro
File: D:\System Volume Information\_restore{E5499DA2-5223-407C-93C4-5D37F08BCF0F}\RP111\A0016740.EXE

detected: riskware Hidden install
Running process: D:\WINDOWS\Temp\iajh\setup.exe

deleted: Trojan program Backdoor.Win32.Agent.bcul
File: C:\ntdll.log

detected: riskware Invader (loader)
Running process: C:\Program files\Boom online US\New Folder\PopTag\ca.exe

deleted: Trojan program Trojan.Win32.Jorik.IRCbot.ro
File: C:\System Volume Information\_restore{E5499DA2-5223-407C-93C4-5D37F08BCF0F}\RP111\A0016741.exe

deleted: Trojan program Trojan.Win32.TDSS.bsqu
File: C:\cdfss.exe

deleted: Trojan program Trojan.Win32.TDSS.bsqu
File: D:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\BV09D065
\GaR2ThE5P5jEFc6MTQ1fGRvd25sb2FkfA==36Z[2].gif

deleted: Trojan program Trojan.Win32.Agent.givz
File: D:\System Volume Information\_restore{E5499DA2-5223-407C-93C4-5D37F08BCF0F}\RP111\A0018789.exe


Thank you,
Tina

Hi,

Welcome to GeekPolice.net!

Please download OTL to your Desktop. (If you already have it downloaded, then just follow the instructions below).

• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  
• Under the Custom Scan box paste this in
  
  %systemroot%\*. /mp /s
  %systemroot%\system32\*.dll /lockedfiles
  %systemroot%\system32\*.exe /lockedfiles
  %systemroot%\Tasks\*.job /lockedfiles
  %systemroot%\system32\drivers\*.sys /lockedfiles
  %systemroot%\System32\config\*.sav
  %systemroot%\system32\*.sys
  %systemroot%\system32\drivers\*.dll
  %systemroot%\system32\drivers\*.ini
  %systemroot%\system32\drivers\*.exe
  %SYSTEMDRIVE%\*.*
  %PROGRAMFILES%\*.
  %appdata%\*.*
  netsvcs
  msconfig
  safebootminimal
  safebootnetwork
  activex
  drivers32
  /md5start
  eventlog.dll
  scecli.dll
  netlogon.dll
  cngaudit.dll
  sceclt.dll
  ntelogon.dll
  logevent.dll
  iaStor.sys
  nvstor.sys
  atapi.sys
  IdeChnDr.sys
  viasraid.sys
  AGP440.sys
  vaxscsi.sys
  nvatabus.sys
  viamraid.sys
  nvata.sys
  nvgts.sys
  iastorv.sys
  ViPrt.sys
  eNetHook.dll
  ahcix86.sys
  KR10N.sys
  disk.sys
  nvstor32.sys
  ahcix86s.sys
  nvrd32.sys
  symmpi.sys
  adp3132.sys
  mv61xx.sys
  usbstor.sys
  /md5stop
  CREATERESTOREPOINT
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
  
  
• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
  
  
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
    
  • Please copy (Edit->Select All, Edit->Copy) and paste (Edit->Paste) the contents of these files, one at a time

Note: in the event that OTL fails to run, please use alternate download links to try again:

http://oldtimer.geekstogo.com/OTL.com
http://oldtimer.geekstogo.com/OTL.scr

Extras.txt

OTL Extras logfile created on: 12/10/2010 3:58:42 PM - Run 1
OTL by OldTimer - Version 3.2.17.3 Folder = C:\Program files\Download programs
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 69.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 87.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092D:\pagefile.sys 2 2 [binary data]

%SystemDrive% = D: | %SystemRoot% = D:\WINDOWS | %ProgramFiles% = D:\Program Files
Drive C: | 22.94 Gb Total Space | 17.86 Gb Free Space | 77.88% Space Free | Partition Type: FAT32
Drive D: | 4.97 Gb Total Space | 0.95 Gb Free Space | 19.09% Space Free | Partition Type: FAT32
Unable to calculate disk information.

Computer Name: RAWR-07055BA756 | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] -- C:\Program files\Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring" = 1
"" =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"58263:TCP" = 58263:TCP:*:Enabled:Pando Media Booster
"58263:UDP" = 58263:UDP:*:Enabled:Pando Media Booster
"57531:TCP" = 57531:TCP:*:Enabled:Pando Media Booster
"57531:UDP" = 57531:UDP:*:Enabled:Pando Media Booster

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"58263:TCP" = 58263:TCP:*:Enabled:Pando Media Booster
"58263:UDP" = 58263:UDP:*:Enabled:Pando Media Booster
"8378:TCP" = 8378:TCP:*:Enabled:League of Legends Launcher
"8378:UDP" = 8378:UDP:*:Enabled:League of Legends Launcher
"57531:TCP" = 57531:TCP:*:Enabled:Pando Media Booster
"57531:UDP" = 57531:UDP:*:Enabled:Pando Media Booster

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"D:\Program Files\Pando Networks\Media Booster\PMB.exe" = D:\Program Files\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster -- ()

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program files\Yahoo!\Messenger\YahooMessenger.exe" = C:\Program files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger -- (Yahoo! Inc.)
"D:\Program Files\Internet Download Manager\IDMan.exe" = D:\Program Files\Internet Download Manager\IDMan.exe:*:Enabled:Internet Download Manager (IDM) -- (Tonec Inc.)
"E:\Common\EasyInstall\EasyInstall.exe" = E:\Common\EasyInstall\EasyInstall.exe:*:Enabled:EasyInstall -- File not found
"C:\Program files\Riot Games\League of Legends\air\LolClient.exe" = C:\Program files\Riot Games\League of Legends\air\LolClient.exe:*:Enabled:League of Legends Lobby -- File not found
"C:\Program files\Riot Games\League of Legends\game\League of Legends.exe" = C:\Program files\Riot Games\League of Legends\game\League of Legends.exe:*:Enabled:League of Legends Game Client -- File not found
"C:\Program files\mIRC\mirc.exe" = C:\Program files\mIRC\mirc.exe:*:Enabled:mIRC -- File not found
"C:\Program files\Ares\Ares.exe" = C:\Program files\Ares\Ares.exe:*:Enabled:Ares p2p for windows -- File not found
"C:\Program files\Boom online\ca.exe" = C:\Program files\Boom online\ca.exe:*:Enabled:Crazy Arcade -- File not found
"C:\Program files\Boom online\nmcosrv.exe" = C:\Program files\Boom online\nmcosrv.exe:*:Enabled:CA Messenger Module -- File not found
"D:\Program Files\Pando Networks\Media Booster\PMB.exe" = D:\Program Files\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster -- ()
"D:\Documents and Settings\All Users\Application Data\NexonUS\NGM\NGM.exe" = D:\Documents and Settings\All Users\Application Data\NexonUS\NGM\NGM.exe:*:Enabled:Nexon Game Manager -- (Nexon)
"C:\Program files\Boom online US\PopTag\CA.exe" = C:\Program files\Boom online US\PopTag\CA.exe:*:Enabled:Crazy Arcade -- File not found
"C:\Program files\Boom online US\PopTag\NMCOSrv.exe" = C:\Program files\Boom online US\PopTag\NMCOSrv.exe:*:Enabled:CA Messenger Module -- File not found
"C:\Program files\Boom online US\New Folder\PopTag\CA.exe" = C:\Program files\Boom online US\New Folder\PopTag\CA.exe:*:Enabled:Crazy Arcade -- ((C) Nexon Corporation, 2007)
"C:\Program files\Boom online US\New Folder\PopTag\NMCOSrv.exe" = C:\Program files\Boom online US\New Folder\PopTag\NMCOSrv.exe:*:Enabled:CA Messenger Module -- (Nexon)
"C:\Program files\Saved Programs\setup.exe" = C:\Program files\Saved Programs\setup.exe:*:Enabled:Installationsprogramm für Kaspersky Security Suite CBE -- (Kaspersky Lab)
"D:\Documents and Settings\Administrator\Application Data\MJUSBSP\magicJack.exe" = D:\Documents and Settings\Administrator\Application Data\MJUSBSP\magicJack.exe:*:Enabled:magicJack -- (magicJack L.P.)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83216018FF}" = Java(TM) 6 Update 18
"{2B0CDD4D-5C1A-47F7-89E2-9BF604670ABC}" = EpsonNet Config V3
"{3E31400D-274E-4647-916C-2CACC3741799}" = EpsonNet Print
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}" = Microsoft .NET Framework 2.0
"{7CCEBC24-62DB-4280-A8EC-BFA49F167920}" = Software Update for Web Folders
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel(R) Extreme Graphics Driver
"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office 2003: Bản Rút gọn && Việt hóa
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{98B6FB8A-8638-4037-AD44-CF7D0EEAB875}_is1" = TypingMaster Pro
"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.1
"{BE6890C7-31EF-478C-812E-1E2899ABFCA9}" = B57Inst
"{C3234E43-10BF-470E-BD2B-2E36EA29D11C}" = League of Legends
"{C774410D-3EF9-4DE7-AC01-332613163ECF}" = Kaspersky Security Suite CBE
"{EA2DB6E0-72C5-4ef9-A3A0-E6705F4A6A9E}" = Nexon Game Manager
"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"EPSON Artisan 800 Series" = EPSON Artisan 800 Series Printer Uninstall
"EPSON Scanner" = EPSON Scan
"fairy story online_is1" = fsonline 1.0.1.5
"FLV Player" = FLV Player 2.0 (build 25)
"InstallShield_{BE6890C7-31EF-478C-812E-1E2899ABFCA9}" = Broadcom Driver Installer
"InstallWIX_{C774410D-3EF9-4DE7-AC01-332613163ECF}" = Kaspersky Security Suite CBE
"Internet Download Manager" = Internet Download Manager
"Kool_is1" = Kool Dictionary 1.5
"Microsoft .NET Framework 2.0" = Microsoft .NET Framework 2.0
"Mozilla Firefox (3.6.12)" = Mozilla Firefox (3.6.12)
"MPlayer" = MPlayer (remove only)
"PC Suite" = PC Suite
"PopTag" = PopTag!
"UniKey" = UniKey 4.0 NT
"WinRAR archiver" = WinRAR archiver
"Yahoo! Messenger" = Yahoo! Messenger

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"magicJack" = magicJack

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 12/5/2010 6:40:09 PM | Computer Name = RAWR-07055BA756 | Source = Userenv | ID = 1041
Description = Windows cannot query DllName registry entry for {CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}
and it will not be loaded. This is most likely caused by a faulty registration.

Error - 12/5/2010 8:04:06 PM | Computer Name = RAWR-07055BA756 | Source = Userenv | ID = 1041
Description = Windows cannot query DllName registry entry for {7B849a69-220F-451E-B3FE-2CB811AF94AE}
and it will not be loaded. This is most likely caused by a faulty registration.

Error - 12/5/2010 8:04:06 PM | Computer Name = RAWR-07055BA756 | Source = Userenv | ID = 1041
Description = Windows cannot query DllName registry entry for {CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}
and it will not be loaded. This is most likely caused by a faulty registration.

Error - 12/5/2010 8:13:09 PM | Computer Name = RAWR-07055BA756 | Source = Userenv | ID = 1041
Description = Windows cannot query DllName registry entry for {7B849a69-220F-451E-B3FE-2CB811AF94AE}
and it will not be loaded. This is most likely caused by a faulty registration.

Error - 12/5/2010 8:13:09 PM | Computer Name = RAWR-07055BA756 | Source = Userenv | ID = 1041
Description = Windows cannot query DllName registry entry for {CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}
and it will not be loaded. This is most likely caused by a faulty registration.

Error - 12/5/2010 9:43:06 PM | Computer Name = RAWR-07055BA756 | Source = Userenv | ID = 1041
Description = Windows cannot query DllName registry entry for {7B849a69-220F-451E-B3FE-2CB811AF94AE}
and it will not be loaded. This is most likely caused by a faulty registration.

Error - 12/5/2010 9:43:06 PM | Computer Name = RAWR-07055BA756 | Source = Userenv | ID = 1041
Description = Windows cannot query DllName registry entry for {CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}
and it will not be loaded. This is most likely caused by a faulty registration.

Error - 12/5/2010 9:46:09 PM | Computer Name = RAWR-07055BA756 | Source = Userenv | ID = 1041
Description = Windows cannot query DllName registry entry for {7B849a69-220F-451E-B3FE-2CB811AF94AE}
and it will not be loaded. This is most likely caused by a faulty registration.

Error - 12/5/2010 9:46:09 PM | Computer Name = RAWR-07055BA756 | Source = Userenv | ID = 1041
Description = Windows cannot query DllName registry entry for {CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}
and it will not be loaded. This is most likely caused by a faulty registration.

Error - 12/5/2010 10:22:43 PM | Computer Name = RAWR-07055BA756 | Source = Application Error | ID = 1000
Description = Faulting application ca.exe, version 1.1.584.531, faulting module
, version 0.0.0.0, fault address 0x00000000.

[ System Events ]
Error - 7/5/2010 1:06:20 AM | Computer Name = RAWR-07055BA756 | Source = ialm | ID = 262252
Description = The driver ialmrnt5 for the display device \Device\Video0 got stuck
in an infinite loop. This usually indicates a problem with the device itself or
with the device driver programming the hardware incorrectly. Please check with your
hardware
device vendor for any driver updates.

Error - 7/5/2010 1:13:34 AM | Computer Name = RAWR-07055BA756 | Source = System Error | ID = 1003
Description = Error code 000000ea, parameter1 8948c020, parameter2 89716a28, parameter3
895f86e8, parameter4 00000001.

Error - 7/14/2010 12:15:09 AM | Computer Name = RAWR-07055BA756 | Source = ialm | ID = 262252
Description = The driver ialmrnt5 for the display device \Device\Video0 got stuck
in an infinite loop. This usually indicates a problem with the device itself or
with the device driver programming the hardware incorrectly. Please check with your
hardware
device vendor for any driver updates.

Error - 7/14/2010 12:18:59 AM | Computer Name = RAWR-07055BA756 | Source = System Error | ID = 1003
Description = Error code 000000ea, parameter1 896e4938, parameter2 89ab5600, parameter3
899b62e8, parameter4 00000001.

Error - 8/1/2010 8:11:07 PM | Computer Name = RAWR-07055BA756 | Source = ialm | ID = 262252
Description = The driver ialmrnt5 for the display device \Device\Video0 got stuck
in an infinite loop. This usually indicates a problem with the device itself or
with the device driver programming the hardware incorrectly. Please check with your
hardware
device vendor for any driver updates.

Error - 8/1/2010 8:14:34 PM | Computer Name = RAWR-07055BA756 | Source = System Error | ID = 1003
Description = Error code 000000ea, parameter1 8983d020, parameter2 899b6008, parameter3
89a005f0, parameter4 00000001.


< End of report >

This is weird.
I posted random things and it let me, but when I tried to post OTL.txt
The "connection was reset"
I can't preview my post either.

Edit: Only certain lines can't be post. Refer to post after this.
It's the same only with out the "[[[[ * ]]]]"

First line: [2010/04/24 16:04:02 | 000,000,000 | -H-D | M] -- D:\Program Files\Windows [[[[Update]]]]]

Second Line: < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Windows[[[[ Update ]]]]\Auto Update\Results\Install|LastSuccessTime /rs >

Last edited by jelly101 on 11th December 2010, 5:36 am; edited 1 time in total

OTL logfile created on: 12/10/2010 3:58:41 PM - Run 1
OTL by OldTimer - Version 3.2.17.3 Folder = C:\Program files\Download programs
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 69.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 87.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092D:\pagefile.sys 2 2 [binary data]

%SystemDrive% = D: | %SystemRoot% = D:\WINDOWS | %ProgramFiles% = D:\Program Files
Drive C: | 22.94 Gb Total Space | 17.86 Gb Free Space | 77.88% Space Free | Partition Type: FAT32
Drive D: | 4.97 Gb Total Space | 0.95 Gb Free Space | 19.09% Space Free | Partition Type: FAT32
Unable to calculate disk information.

Computer Name: RAWR-07055BA756 | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - File not found -- f:\autorun.exe
PRC - [2010/12/10 15:58:22 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Program files\Download programs\OTL.exe
PRC - [2010/12/03 04:39:14 | 022,283,664 | ---- | M] (magicJack L.P.) -- D:\Documents and Settings\Administrator\Application Data\mjusbsp\magicJack.exe
PRC - [2010/12/03 04:37:14 | 000,103,840 | ---- | M] (magicJack L.P.) -- D:\Documents and Settings\Administrator\Application Data\mjusbsp\st00000\mjsetup.exe
PRC - [2010/11/07 17:41:52 | 000,016,856 | ---- | M] (Mozilla Corporation) -- C:\Program files\Firefox\plugin-container.exe
PRC - [2010/11/07 17:41:50 | 000,912,344 | ---- | M] (Mozilla Corporation) -- C:\Program files\Firefox\firefox.exe
PRC - [2010/09/23 04:47:04 | 000,035,760 | ---- | M] (Adobe Systems Incorporated) -- C:\Program files\Adobe Reader 9\Reader\reader_sl.exe
PRC - [2009/09/17 09:13:36 | 003,118,512 | ---- | M] (Tonec Inc.) -- D:\Program Files\Internet Download Manager\IDMan.exe
PRC - [2008/05/01 15:33:30 | 000,221,184 | ---- | M] (Kaspersky Lab) -- C:\Program files\K.s\avp.exe
PRC - [2007/06/13 11:26:04 | 001,033,216 | ---- | M] (Microsoft Corporation) -- D:\WINDOWS\explorer.exe
PRC - [2006/12/19 18:23:20 | 000,094,208 | ---- | M] (SEIKO EPSON CORPORATION) -- D:\Program Files\Common Files\EPSON\eEBAPI\eEBSvc.exe
PRC - [2006/04/18 16:55:02 | 000,217,088 | ---- | M] () -- C:\Program files\UniKey\UniKeyNT.exe
PRC - [2002/08/21 12:13:12 | 000,189,952 | ---- | M] (Microsoft Corporation) -- D:\WINDOWS\system32\WISPTIS.EXE

========== Modules (SafeList) ==========

MOD - [2010/12/10 15:58:22 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Program files\Download programs\OTL.exe
MOD - [2009/07/12 01:12:06 | 000,632,656 | ---- | M] (Microsoft Corporation) -- D:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll
MOD - [2009/03/26 23:35:40 | 000,034,224 | ---- | M] (Tonec Inc.) -- D:\Program Files\Internet Download Manager\idmmkb.dll
MOD - [2008/02/08 19:37:48 | 000,088,592 | ---- | M] (Kaspersky Lab) -- C:\Program files\K.s\miscr3.dll
MOD - [2008/02/08 19:37:42 | 000,048,656 | ---- | M] (Kaspersky Lab) -- C:\Program files\K.s\fssync.dll
MOD - [2008/02/08 19:37:30 | 000,084,496 | ---- | M] (Kaspersky Lab) -- C:\Program files\K.s\adialhk.dll
MOD - [2006/08/25 12:45:56 | 001,054,208 | ---- | M] (Microsoft Corporation) -- D:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll
MOD - [2006/04/18 16:53:52 | 000,188,416 | ---- | M] () -- C:\Program files\UniKey\UKHook40.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] -- D:\WINDOWS\System32\hidserv.dll -- (HidServ)
SRV - File not found [Auto | Stopped] -- D:\WINDOWS\System32\6to4v32.dll -- (6to4)
SRV - [2008/05/01 15:33:30 | 000,221,184 | ---- | M] (Kaspersky Lab) [Auto | Running] -- C:\Program files\K.s\avp.exe -- (AVP)
SRV - [2006/12/19 18:23:20 | 000,094,208 | ---- | M] (SEIKO EPSON CORPORATION) [Auto | Running] -- D:\Program Files\Common Files\EPSON\eEBAPI\eEBSvc.exe -- (EpsonBidirectionalService)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- D:\WINDOWS\System32\DRIVERS\irenum.sys -- (IRENUM)
DRV - File not found [Kernel | On_Demand | Stopped] -- D:\WINDOWS\System32\drivers\EagleNT.sys -- (EagleNT)
DRV - [2009/09/24 04:55:42 | 000,103,552 | R--- | M] (QUALCOMM Incorporated) [Kernel | On_Demand | Stopped] -- D:\WINDOWS\system32\drivers\qscnusb.sys -- (MobileAdapter)
DRV - [2007/12/28 20:51:04 | 000,195,344 | ---- | M] (Kaspersky Lab) [Kernel | System | Running] -- D:\WINDOWS\system32\drivers\klif.sys -- (klif)
DRV - [2007/12/13 14:28:40 | 000,024,592 | ---- | M] (Kaspersky Lab) [Kernel | On_Demand | Running] -- D:\WINDOWS\system32\drivers\klim5.sys -- (klim5)
DRV - [2007/10/31 14:41:16 | 000,110,096 | ---- | M] (Kaspersky Lab) [Kernel | Boot | Running] -- D:\WINDOWS\system32\drivers\kl1.sys -- (kl1)
DRV - [2007/04/10 11:08:20 | 000,060,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- D:\WINDOWS\system32\drivers\USBAUDIO.sys -- (usbaudio) USB Audio Driver (WDM)
DRV - [2004/08/03 22:31:34 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Running] -- D:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139) Realtek RTL8139(A/B/C)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,AlwaysUseDefaultPrinter = yes
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://domredi.com/1/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 46 D8 AB 08 13 61 CB 01 [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = http://domredi.com/1/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "https://www.google.com/"
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: mozilla_cc@internetdownloadmanager.com:6.7
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.1
FF - prefs.js..extensions.enabledItems: morningCoffee@shaneliesegang:1.33
FF - prefs.js..extensions.enabledItems: {6F0976E6-26F3-4AFE-BBEC-9E99E27E4DF3}:1.4.10
FF - prefs.js..extensions.enabledItems: lazarus@interclue.com:2.0.5
FF - prefs.js..extensions.enabledItems: nppluginlauncher.dll@vng.com.vn:1.0
FF - prefs.js..keyword.URL: "http://www.bing.com/search?pc=Z006&form=ZGAADF&q="


FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Components: C:\Program files\Firefox\components [2010/04/24 17:58:46 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Plugins: C:\Program files\Firefox\plugins [2010/04/24 17:58:50 | 000,000,000 | ---D | M]

[2010/04/24 18:00:18 | 000,000,000 | ---D | M] -- D:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions
[2010/04/24 18:00:18 | 000,000,000 | ---D | M] -- D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\kn808e1s.default\extensions
[2010/12/01 15:15:56 | 000,000,000 | ---D | M] (Fire.fm) -- D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\kn808e1s.default\extensions\{6F0976E6-26F3-4AFE-BBEC-9E99E27E4DF3}
[2010/12/01 15:15:58 | 000,000,000 | ---D | M] (Adblock Plus) -- D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\kn808e1s.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010/06/25 08:18:40 | 000,000,000 | ---D | M] -- D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\kn808e1s.default\extensions\lazarus@interclue.com
[2010/06/25 07:57:38 | 000,000,000 | ---D | M] -- D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\kn808e1s.default\extensions\morningCoffee@shaneliesegang
[2010/11/24 12:58:12 | 000,000,000 | ---D | M] -- D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\kn808e1s.default\extensions\nppluginlauncher.dll@vng.com.vn
[2010/12/02 14:27:06 | 000,001,919 | ---- | M] () -- D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\kn808e1s.default\searchplugins\bing-zugo.xml

O1 HOSTS File: ([2010/05/22 03:15:40 | 000,001,985 | ---- | M]) - D:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 tonec.com
O1 - Hosts: 127.0.0.1 www.tonec.com
O1 - Hosts: 127.0.0.1 registeridm.com
O1 - Hosts: 127.0.0.1 www.registeridm.com
O1 - Hosts: 127.0.0.1 secure.registeridm.com
O1 - Hosts: 127.0.0.1 internetdownloadmanager.com
O1 - Hosts: 127.0.0.1 www.internetdownloadmanager.com
O1 - Hosts: 127.0.0.1 secure.internetdownloadmanager.com
O1 - Hosts: 127.0.0.1 mirror.internetdownloadmanager.com
O1 - Hosts: 127.0.0.1 mirror2.internetdownloadmanager.com
O1 - Hosts: 127.0.0.1 mirror3.internetdownloadmanager.com
O1 - Hosts: 127.0.0.1 tonec.com
O1 - Hosts: 127.0.0.1 www.tonec.com
O1 - Hosts: 127.0.0.1 registeridm.com
O1 - Hosts: 127.0.0.1 www.registeridm.com
O1 - Hosts: 127.0.0.1 secure.registeridm.com
O1 - Hosts: 127.0.0.1 internetdownloadmanager.com
O1 - Hosts: 127.0.0.1 www.internetdownloadmanager.com
O1 - Hosts: 127.0.0.1 secure.internetdownloadmanager.com
O1 - Hosts: 127.0.0.1 mirror.internetdownloadmanager.com
O1 - Hosts: 127.0.0.1 mirror2.internetdownloadmanager.com
O1 - Hosts: 127.0.0.1 mirror3.internetdownloadmanager.com
O1 - Hosts: 127.0.0.1 tonec.com
O1 - Hosts: 127.0.0.1 www.tonec.com
O1 - Hosts: 9 more lines...
O2 - BHO: (IDMIEHlprObj Class) - {0055C089-8582-441B-A0BF-17B458C2A3A8} - D:\Program Files\Internet Download Manager\IDMIECC.dll (Tonec Inc.)
O2 - BHO: (no name) - {9D425283-D487-4337-BAB6-AB8354A81457} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {9D425283-D487-4337-BAB6-AB8354A81457} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {9D425283-D487-4337-BAB6-AB8354A81457} - No CLSID value found.
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program files\Adobe Reader 9\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AVP] C:\Program files\K.s\avp.exe (Kaspersky Lab)
O4 - HKLM..\Run: [SunJavaUpdateSched] D:\Program Files\Common Files\Java\Java Update\jusched.exe File not found
O4 - HKCU..\Run: [cdloader] D:\Documents and Settings\Administrator\Application Data\mjusbsp\cdloader2.exe (magicJack L.P.)
O4 - HKCU..\Run: [EPSON Artisan 800 Series] D:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIEMA.EXE (SEIKO EPSON CORPORATION)
O4 - HKCU..\Run: [EPSON Artisan 800(Network)] D:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIEMA.EXE (SEIKO EPSON CORPORATION)
O4 - HKCU..\Run: [Messenger (Yahoo!)] C:\Program files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O4 - HKCU..\Run: [UniKey] C:\Program files\UniKey\UniKeyNT.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 28
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Add to Anti-Banner - C:\Program files\K.s\ie_banner_deny.htm ()
O8 - Extra context menu item: Download all links with IDM - D:\Program Files\Internet Download Manager\IEGetAll.htm ()
O8 - Extra context menu item: Download FLV video content with IDM - D:\Program Files\Internet Download Manager\IEGetVL.htm ()
O8 - Extra context menu item: Download FLV videos with IDM from 10 last requested - D:\Program Files\Internet Download Manager\IEGetVL2.htm ()
O8 - Extra context menu item: Download with IDM - D:\Program Files\Internet Download Manager\IEExt.htm ()
O9 - Extra Button: Statistik für Web-Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program files\K.s\SCIEPlgn.dll (Kaspersky Lab)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O20 - AppInit_DLLs: (C:\PROGRA~1\K.s\adialhk.dll) - C:\Program files\K.s\adialhk.dll (Kaspersky Lab)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - D:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - D:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O20 - Winlogon\Notify\klogon: DllName - D:\WINDOWS\system32\klogon.dll - D:\WINDOWS\system32\klogon.dll (Kaspersky Lab)
O24 - Desktop WallPaper: D:\WINDOWS\Web\Wallpaper\Bliss.bmp
O24 - Desktop BackupWallPaper: D:\WINDOWS\Web\Wallpaper\Bliss.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/04/24 16:05:52 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ FAT32 ]
O33 - MountPoints2\{697e0a0c-657a-11df-a867-0030bd6de919}\Shell - "" = AutoRun
O33 - MountPoints2\{697e0a0c-657a-11df-a867-0030bd6de919}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{697e0a0c-657a-11df-a867-0030bd6de919}\Shell\AutoRun\command - "" = F:\HWPcAssistant.exe -- File not found
O33 - MountPoints2\{697e0a0d-657a-11df-a867-0030bd6de919}\Shell - "" = AutoRun
O33 - MountPoints2\{697e0a0d-657a-11df-a867-0030bd6de919}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{697e0a0d-657a-11df-a867-0030bd6de919}\Shell\AutoRun\command - "" = G:\HWPcAssistant.exe -- File not found
O33 - MountPoints2\{ac10381c-8b2d-11df-a8a3-0030bd6de919}\Shell\AuToplAY\cOMmaNd - "" = F:\ljlp.pif -- File not found
O33 - MountPoints2\{ac10381c-8b2d-11df-a8a3-0030bd6de919}\Shell\AutoRun\command - "" = F:\ljlp.pif -- File not found
O33 - MountPoints2\{ac10381c-8b2d-11df-a8a3-0030bd6de919}\Shell\EXplOre\cOmMAnd - "" = F:\ljlp.pif -- File not found
O33 - MountPoints2\{ac10381c-8b2d-11df-a8a3-0030bd6de919}\Shell\OpEn\comMand - "" = F:\ljlp.pif -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - D:\WINDOWS\System32\6to4v32.dll File not found
NetSvcs: HidServ - D:\WINDOWS\System32\hidserv.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found


SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vga.sys - Driver
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vga.sys - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vector Graphics Rendering (VML)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML Data Binding for Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Advanced Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection D:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.7
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection D:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player 11
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework
ActiveX: {73fa19d0-2d75-11d2-995d-00c04f98bbc9} - Web Folders
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - D:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - D:\WINDOWS\system32\Rundll32.exe D:\WINDOWS\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {ACC563BC-4266-43f0-B6ED-9D38C4202C7E} -
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Task Scheduler
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - Reg Error: Value error.
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {EF289A85-8E57-408d-BE47-73B55609861A} - RootsUpdate
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - D:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - D:\WINDOWS\inf\unregmp2.exe /HideWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - D:\WINDOWS\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

Drivers32: msacm.iac2 - D:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - D:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - D:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - D:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - D:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - D:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - D:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - D:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - D:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - D:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (68974980045471744)

========== Files/Folders - Created Within 30 Days ==========

[2010/12/09 19:46:00 | 000,000,000 | ---D | C] -- D:\WINDOWS\Sun
[2010/12/09 14:43:06 | 000,000,000 | -HSD | C] -- D:\FOUND.000
[2010/12/09 07:40:21 | 000,000,000 | ---D | C] -- D:\Documents and Settings\NetworkService\Application Data\Sun
[2010/12/09 04:46:23 | 000,000,000 | ---D | C] -- D:\Documents and Settings\NetworkService\Application Data\Macromedia
[2010/12/09 04:14:28 | 000,000,000 | ---D | C] -- D:\Documents and Settings\LocalService\Application Data\Macromedia
[2010/12/09 04:14:08 | 000,000,000 | ---D | C] -- D:\Documents and Settings\LocalService\Application Data\Adobe
[2010/12/09 03:15:14 | 000,000,000 | ---D | C] -- D:\Documents and Settings\NetworkService\Application Data\Adobe
[2010/11/29 04:13:19 | 000,000,000 | ---D | C] -- D:\Program Files\VS Revo Group
[2010/11/27 02:27:28 | 000,000,000 | ---D | C] -- D:\Documents and Settings\Administrator\My Documents\PopTag!
[2010/11/24 20:22:36 | 000,000,000 | ---D | C] -- D:\Documents and Settings\All Users\Application Data\NexonUS

========== Files - Modified Within 30 Days ==========

[2010/12/10 16:06:00 | 000,000,000 | -HS- | M] () -- D:\WINDOWS\System32\drivers\fidbox.idx
[2010/12/10 16:06:00 | 000,000,000 | -HS- | M] () -- D:\WINDOWS\System32\drivers\fidbox.dat
[2010/12/10 15:55:40 | 000,000,952 | ---- | M] () -- D:\Documents and Settings\Administrator\Desktop\magicJack.lnk
[2010/12/10 15:54:06 | 000,002,048 | --S- | M] () -- D:\WINDOWS\bootstat.dat
[2010/12/10 15:51:40 | 000,000,032 | -HS- | M] () -- D:\WINDOWS\System32\drivers\fidbox2.idx
[2010/12/10 15:51:40 | 000,000,032 | -HS- | M] () -- D:\WINDOWS\System32\drivers\fidbox2.dat
[2010/12/10 00:11:18 | 000,022,016 | ---- | M] () -- D:\Documents and Settings\Administrator\Desktop\1.doc
[2010/12/09 06:33:50 | 000,000,162 | -H-- | M] () -- D:\Documents and Settings\Administrator\My Documents\~$ok 3 questions.doc
[2010/12/09 06:32:18 | 000,023,552 | ---- | M] () -- D:\Documents and Settings\Administrator\My Documents\book 3 questions.doc
[2010/12/09 05:44:42 | 000,001,372 | ---- | M] () -- D:\WINDOWS\System32\Improve Your PC.lnk
[2010/12/09 04:17:38 | 000,114,243 | ---- | M] () -- D:\WINDOWS\System32\drivers\klin.dat
[2010/12/09 04:17:38 | 000,097,859 | ---- | M] () -- D:\WINDOWS\System32\drivers\klick.dat
[2010/12/09 04:10:36 | 000,020,480 | ---- | M] () -- D:\Documents and Settings\Administrator\My Documents\Trinh Ho.doc
[2010/12/09 03:01:38 | 000,019,968 | ---- | M] () -- D:\Documents and Settings\Administrator\My Documents\Book 3 study guide questions.doc
[2010/12/08 15:54:22 | 000,002,206 | ---- | M] () -- D:\WINDOWS\System32\wpa.dbl
[2010/12/07 02:56:44 | 000,188,947 | ---- | M] () -- D:\Documents and Settings\Administrator\Desktop\alg2_ca_08_0449.jpg
[2010/12/07 01:28:18 | 000,024,064 | ---- | M] () -- D:\Documents and Settings\Administrator\Desktop\CHECK EMAILS THROUGHOUT DEC.doc
[2010/12/06 02:59:44 | 000,161,280 | ---- | M] () -- D:\Documents and Settings\Administrator\My Documents\Tales of two cities, book 3.doc
[2010/12/06 02:35:46 | 000,023,552 | ---- | M] () -- D:\Documents and Settings\Administrator\Desktop\Julius Caesar Essay.doc
[2010/12/06 00:21:30 | 000,006,947 | ---- | M] () -- D:\Documents and Settings\Administrator\Desktop\163002_170041296357659_100000553695409_474633_7826817_n.jpg
[2010/12/02 23:27:48 | 000,033,263 | ---- | M] () -- D:\Documents and Settings\Administrator\Desktop\Image.jpg
[2010/12/02 23:10:50 | 000,089,593 | ---- | M] () -- D:\Documents and Settings\Administrator\Desktop\Grown Ups (2010).jpg
[2010/12/02 22:52:02 | 000,052,740 | ---- | M] () -- D:\Documents and Settings\Administrator\Desktop\155803_131316420257838_100001384426527_183631_6537248_n.jpg
[2010/12/02 22:32:10 | 000,753,231 | ---- | M] () -- D:\Documents and Settings\Administrator\Desktop\IMG_0276.JPG
[2010/12/02 22:31:46 | 001,778,201 | ---- | M] () -- D:\Documents and Settings\Administrator\Desktop\IMG_0415.JPG
[2010/12/01 07:31:50 | 000,211,672 | ---- | M] () -- D:\Documents and Settings\Administrator\Desktop\alg2_ca_08_0442.jpg
[2010/11/29 22:26:00 | 000,000,222 | ---- | M] () -- D:\Documents and Settings\All Users\Desktop\PopTag!.url
[2010/11/29 22:21:28 | 000,000,623 | ---- | M] () -- D:\WINDOWS\CA_Crash_info.nfo
[2010/11/29 04:18:14 | 000,000,391 | ---- | M] () -- D:\Documents and Settings\Administrator\Desktop\Download Files.lnk
[2010/11/23 18:52:14 | 000,020,480 | ---- | M] () -- D:\Documents and Settings\Administrator\Desktop\Daily routines.doc
[2010/11/22 16:28:50 | 000,020,992 | ---- | M] () -- D:\Documents and Settings\Administrator\Desktop\Thigh slimming exercise.doc
[2010/11/22 07:12:32 | 000,023,552 | ---- | M] () -- D:\Documents and Settings\Administrator\My Documents\book the first study guide.doc
[2010/11/21 05:11:22 | 000,000,366 | ---- | M] () -- D:\Documents and Settings\Administrator\Desktop\Download programs.lnk
[2010/11/21 05:11:12 | 000,000,363 | ---- | M] () -- D:\Documents and Settings\Administrator\Desktop\Download general.lnk
[2010/11/21 05:10:58 | 000,000,348 | ---- | M] () -- D:\Documents and Settings\Administrator\Desktop\Saved files.lnk
[2010/11/21 05:10:22 | 000,000,391 | ---- | M] () -- D:\Documents and Settings\Administrator\Desktop\Saved Programs.lnk
[2010/11/20 07:28:32 | 000,000,719 | ---- | M] () -- D:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2010/11/18 07:13:06 | 000,001,447 | ---- | M] () -- D:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk

========== Files Created - No Company Name ==========

[2010/12/10 00:11:17 | 000,022,016 | ---- | C] () -- D:\Documents and Settings\Administrator\Desktop\1.doc
[2010/12/09 06:33:48 | 000,000,162 | -H-- | C] () -- D:\Documents and Settings\Administrator\My Documents\~$ok 3 questions.doc
[2010/12/09 06:32:17 | 000,023,552 | ---- | C] () -- D:\Documents and Settings\Administrator\My Documents\book 3 questions.doc
[2010/12/09 05:44:41 | 000,001,372 | ---- | C] () -- D:\WINDOWS\System32\Improve Your PC.lnk
[2010/12/09 04:10:34 | 000,020,480 | ---- | C] () -- D:\Documents and Settings\Administrator\My Documents\Trinh Ho.doc
[2010/12/09 03:01:37 | 000,019,968 | ---- | C] () -- D:\Documents and Settings\Administrator\My Documents\Book 3 study guide questions.doc
[2010/12/08 22:16:57 | 000,114,243 | ---- | C] () -- D:\WINDOWS\System32\drivers\klin.dat
[2010/12/08 22:16:57 | 000,097,859 | ---- | C] () -- D:\WINDOWS\System32\drivers\klick.dat
[2010/12/08 22:13:14 | 000,000,032 | -HS- | C] () -- D:\WINDOWS\System32\drivers\fidbox2.idx
[2010/12/08 22:13:14 | 000,000,032 | -HS- | C] () -- D:\WINDOWS\System32\drivers\fidbox2.dat
[2010/12/08 22:13:14 | 000,000,032 | -HS- | C] () -- D:\WINDOWS\System32\drivers\fidbox.dat
[2010/12/08 22:13:14 | 000,000,000 | -HS- | C] () -- D:\WINDOWS\System32\drivers\fidbox.idx
[2010/12/07 02:56:41 | 000,188,947 | ---- | C] () -- D:\Documents and Settings\Administrator\Desktop\alg2_ca_08_0449.jpg
[2010/12/07 01:28:15 | 000,024,064 | ---- | C] () -- D:\Documents and Settings\Administrator\Desktop\CHECK EMAILS THROUGHOUT DEC.doc
[2010/12/06 02:59:42 | 000,161,280 | ---- | C] () -- D:\Documents and Settings\Administrator\My Documents\Tales of two cities, book 3.doc
[2010/12/06 02:35:44 | 000,023,552 | ---- | C] () -- D:\Documents and Settings\Administrator\Desktop\Julius Caesar Essay.doc
[2010/12/06 00:17:22 | 000,006,947 | ---- | C] () -- D:\Documents and Settings\Administrator\Desktop\163002_170041296357659_100000553695409_474633_7826817_n.jpg
[2010/12/02 23:27:26 | 000,033,263 | ---- | C] () -- D:\Documents and Settings\Administrator\Desktop\Image.jpg
[2010/12/02 23:10:45 | 000,089,593 | ---- | C] () -- D:\Documents and Settings\Administrator\Desktop\Grown Ups (2010).jpg
[2010/12/02 22:51:58 | 000,052,740 | ---- | C] () -- D:\Documents and Settings\Administrator\Desktop\155803_131316420257838_100001384426527_183631_6537248_n.jpg
[2010/12/02 22:31:53 | 000,753,231 | ---- | C] () -- D:\Documents and Settings\Administrator\Desktop\IMG_0276.JPG
[2010/12/02 22:31:03 | 001,778,201 | ---- | C] () -- D:\Documents and Settings\Administrator\Desktop\IMG_0415.JPG
[2010/12/01 07:31:46 | 000,211,672 | ---- | C] () -- D:\Documents and Settings\Administrator\Desktop\alg2_ca_08_0442.jpg
[2010/11/29 22:25:59 | 000,000,222 | ---- | C] () -- D:\Documents and Settings\All Users\Desktop\PopTag!.url
[2010/11/29 22:21:27 | 000,000,623 | ---- | C] () -- D:\WINDOWS\CA_Crash_info.nfo
[2010/11/29 04:18:13 | 000,000,391 | ---- | C] () -- D:\Documents and Settings\Administrator\Desktop\Download Files.lnk
[2010/11/23 18:52:13 | 000,020,480 | ---- | C] () -- D:\Documents and Settings\Administrator\Desktop\Daily routines.doc
[2010/11/22 16:28:48 | 000,020,992 | ---- | C] () -- D:\Documents and Settings\Administrator\Desktop\Thigh slimming exercise.doc
[2010/11/22 07:12:29 | 000,023,552 | ---- | C] () -- D:\Documents and Settings\Administrator\My Documents\book the first study guide.doc
[2010/11/21 05:11:21 | 000,000,366 | ---- | C] () -- D:\Documents and Settings\Administrator\Desktop\Download programs.lnk
[2010/11/21 05:11:11 | 000,000,363 | ---- | C] () -- D:\Documents and Settings\Administrator\Desktop\Download general.lnk
[2010/11/21 05:10:57 | 000,000,348 | ---- | C] () -- D:\Documents and Settings\Administrator\Desktop\Saved files.lnk
[2010/11/21 05:10:30 | 000,000,391 | ---- | C] () -- D:\Documents and Settings\Administrator\Desktop\Saved Programs.lnk
[2010/09/12 21:52:58 | 000,000,376 | ---- | C] () -- D:\WINDOWS\ODBC.INI
[2010/09/12 19:58:53 | 000,000,754 | ---- | C] () -- D:\WINDOWS\WORDPAD.INI
[2010/09/02 15:25:10 | 000,005,120 | ---- | C] () -- D:\Documents and Settings\Administrator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/06/30 21:57:45 | 000,000,029 | ---- | C] () -- D:\WINDOWS\DEBUGSM.INI
[2010/06/16 07:26:28 | 000,000,000 | ---- | C] () -- D:\WINDOWS\EEventManager.INI
[2010/06/14 22:05:12 | 000,000,097 | ---- | C] () -- D:\WINDOWS\System32\PICSDK.ini
[2010/06/14 22:02:25 | 000,000,044 | ---- | C] () -- D:\WINDOWS\EPART800.ini
[2010/04/24 15:53:29 | 000,004,161 | ---- | C] () -- D:\WINDOWS\ODBCINST.INI
[2000/05/16 00:42:48 | 000,001,157 | ---- | C] () -- D:\WINDOWS\System32\FM20ENU.DLL

========== Custom Scans ==========


< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2004/08/04 12:00:00 | 001,355,776 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- D:\WINDOWS\system32\msvbvm50.dll
[2004/08/04 12:00:00 | 001,028,096 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- D:\WINDOWS\system32\mfc42.dll
[2004/08/04 12:00:00 | 001,392,671 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- D:\WINDOWS\system32\msvbvm60.dll

< %systemroot%\system32\*.exe /lockedfiles >

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2010/04/24 15:48:40 | 000,876,544 | ---- | M] () -- D:\WINDOWS\system32\config\system.sav
[2010/04/24 15:48:40 | 000,659,456 | ---- | M] () -- D:\WINDOWS\system32\config\software.sav
[2010/04/24 15:48:40 | 000,094,208 | ---- | M] () -- D:\WINDOWS\system32\config\default.sav


< %systemroot%\system32\*.sys >
[2004/08/04 12:00:00 | 000,009,029 | ---- | M] () -- D:\WINDOWS\system32\ansi.sys
[2004/08/04 12:00:00 | 000,027,097 | ---- | M] () -- D:\WINDOWS\system32\country.sys
[2004/08/04 12:00:00 | 000,004,768 | ---- | M] () -- D:\WINDOWS\system32\himem.sys
[2004/08/04 12:00:00 | 000,042,809 | ---- | M] () -- D:\WINDOWS\system32\key01.sys
[2004/08/04 12:00:00 | 000,027,866 | ---- | M] () -- D:\WINDOWS\system32\ntdos.sys
[2004/08/04 12:00:00 | 000,029,370 | ---- | M] () -- D:\WINDOWS\system32\ntdos411.sys
[2004/08/04 12:00:00 | 000,029,274 | ---- | M] () -- D:\WINDOWS\system32\ntdos412.sys
[2004/08/04 12:00:00 | 000,029,146 | ---- | M] () -- D:\WINDOWS\system32\ntdos404.sys
[2004/08/04 12:00:00 | 000,029,146 | ---- | M] () -- D:\WINDOWS\system32\ntdos804.sys
[2007/08/27 12:42:26 | 001,843,968 | ---- | M] (Microsoft Corporation) -- D:\WINDOWS\system32\win32k.sys
[2004/08/04 12:00:00 | 000,017,664 | ---- | M] (Microsoft Corporation) -- D:\WINDOWS\system32\watchdog.sys
[2004/08/04 12:00:00 | 000,042,537 | ---- | M] () -- D:\WINDOWS\system32\keyboard.sys
[2004/08/04 12:00:00 | 000,033,840 | ---- | M] () -- D:\WINDOWS\system32\ntio.sys
[2004/08/04 12:00:00 | 000,034,560 | ---- | M] () -- D:\WINDOWS\system32\ntio404.sys
[2004/08/04 12:00:00 | 000,035,648 | ---- | M] () -- D:\WINDOWS\system32\ntio411.sys
[2004/08/04 12:00:00 | 000,035,424 | ---- | M] () -- D:\WINDOWS\system32\ntio412.sys
[2004/08/04 12:00:00 | 000,034,560 | ---- | M] () -- D:\WINDOWS\system32\ntio804.sys


< %systemroot%\system32\drivers\*.dll >

< %systemroot%\system32\drivers\*.ini >

< %systemroot%\system32\drivers\*.exe >

< %SYSTEMDRIVE%\*.* >
[2010/06/25 14:50:40 | 000,384,394 | ---- | M] () -- D:\watching.jpg
[2010/06/25 16:04:50 | 000,299,954 | ---- | M] () -- D:\korean.gif


< %PROGRAMFILES%\*. >

[2010/04/24 15:53:26 | 000,000,000 | ---D | M] -- D:\Program Files\Common Files
[2010/04/24 16:00:28 | 000,000,000 | ---D | M] -- D:\Program Files\Windows NT
[2010/04/24 16:01:02 | 000,000,000 | ---D | M] -- D:\Program Files\MSN Gaming Zone
[2010/04/24 16:01:06 | 000,000,000 | ---D | M] -- D:\Program Files\Messenger
[2010/04/24 16:01:06 | 000,000,000 | ---D | M] -- D:\Program Files\Windows Media Player
[2010/04/24 16:01:08 | 000,000,000 | ---D | M] -- D:\Program Files\Windows Media Connect 2
[2010/11/29 04:13:20 | 000,000,000 | ---D | M] -- D:\Program Files\VS Revo Group
[2010/09/19 16:00:24 | 000,000,000 | ---D | M] -- D:\Program Files\MPlayer 1.0rc2
[2010/04/24 16:01:52 | 000,000,000 | -H-D | M] -- D:\Program Files\Uninstall Information
[2010/04/24 16:02:38 | 000,000,000 | ---D | M] -- D:\Program Files\Internet Explorer
[2010/04/24 16:02:44 | 000,000,000 | ---D | M] -- D:\Program Files\Outlook Express
[2010/04/24 16:02:48 | 000,000,000 | ---D | M] -- D:\Program Files\NetMeeting
[2010/04/24 16:02:58 | 000,000,000 | ---D | M] -- D:\Program Files\Movie Maker

[The first missing Line. I need to delete this to POST]

[2010/04/24 16:06:20 | 000,000,000 | ---D | M] -- D:\Program Files\microsoft frontpage
[2010/04/24 16:06:20 | 000,000,000 | ---D | M] -- D:\Program Files\xerox
[2010/09/28 21:31:40 | 000,000,000 | ---D | M] -- D:\Program Files\MSECache
[2010/04/24 16:26:20 | 000,000,000 | ---D | M] -- D:\Program Files\Analog Devices
[2010/04/24 18:06:42 | 000,000,000 | ---D | M] -- D:\Program Files\Broadcom
[2010/04/24 18:06:48 | 000,000,000 | -H-D | M] -- D:\Program Files\InstallShield Installation Information
[2010/04/24 18:12:26 | 000,000,000 | ---D | M] -- D:\Program Files\Java
[2010/05/22 02:21:24 | 000,000,000 | ---D | M] -- D:\Program Files\Internet Download Manager
[2010/06/14 22:02:58 | 000,000,000 | ---D | M] -- D:\Program Files\epson
[2010/06/14 22:05:22 | 000,000,000 | ---D | M] -- D:\Program Files\EpsonNet
[2010/06/27 12:13:28 | 000,000,000 | ---D | M] -- D:\Program Files\Pando Networks
[2010/07/21 10:42:56 | 000,000,000 | ---D | M] -- D:\Program Files\Microsoft
[2010/07/21 10:52:42 | 000,000,000 | ---D | M] -- D:\Program Files\Microsoft Silverlight
[2010/09/12 21:52:26 | 000,000,000 | ---D | M] -- D:\Program Files\Microsoft Office
[2010/09/12 21:52:26 | 000,000,000 | ---D | M] -- D:\Program Files\Microsoft.NET
[2010/09/12 21:52:32 | 000,000,000 | ---D | M] -- D:\Program Files\Microsoft ActiveSync

< %appdata%\*.* >
[2010/04/24 15:52:36 | 000,000,062 | -HS- | M] () -- D:\Documents and Settings\Administrator\Application Data\desktop.ini


< MD5 for: ATAPI.SYS >
[2004/08/04 12:00:00 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- D:\WINDOWS\system32\drivers\atapi.sys


< MD5 for: DISK.SYS >
[2004/08/04 12:00:00 | 000,036,352 | ---- | M] (Microsoft Corporation) MD5=00CA44E4534865F8A3B64F7C0984BFF0 -- D:\WINDOWS\system32\drivers\disk.sys

< MD5 for: EVENTLOG.DLL >
[2007/10/04 11:20:16 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=56E7D7261A4BE548B784760896375D8A -- D:\WINDOWS\system32\dllcache\eventlog.dll
[2007/10/04 18:20:16 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=56E7D7261A4BE548B784760896375D8A -- D:\WINDOWS\system32\eventlog.dll


< MD5 for: NETLOGON.DLL >
[2007/07/11 08:42:06 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=5FD8684F1C5DD26509383F6CCDAEE3A3 -- D:\WINDOWS\system32\dllcache\netlogon.dll
[2007/07/11 15:42:06 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=5FD8684F1C5DD26509383F6CCDAEE3A3 -- D:\WINDOWS\system32\netlogon.dll

< MD5 for: SCECLI.DLL >
[2004/08/04 05:00:00 | 000,180,224 | ---- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A -- D:\WINDOWS\system32\dllcache\scecli.dll
[2004/08/04 12:00:00 | 000,180,224 | ---- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A -- D:\WINDOWS\system32\scecli.dll


< MD5 for: USBSTOR.SYS >
[2004/08/03 23:08:48 | 000,026,496 | ---- | M] (Microsoft Corporation) MD5=6CD7B22193718F1D17A47A1CD6D37E75 -- D:\WINDOWS\system32\dllcache\usbstor.sys
[2004/08/03 23:08:48 | 000,026,496 | ---- | M] (Microsoft Corporation) MD5=6CD7B22193718F1D17A47A1CD6D37E75 -- D:\WINDOWS\system32\drivers\USBSTOR.SYS


[The Second LINE missing]


========== Files - Unicode (All) ==========
[2010/10/02 17:47:08 | 000,026,624 | ---- | M] ()(D:\Documents and Settings\Administrator\My Documents\Bánh d?ng kem.doc) -- D:\Documents and Settings\Administrator\My Documents\Bánh đựng kem.doc
[2010/10/02 17:47:07 | 000,026,624 | ---- | C] ()(D:\Documents and Settings\Administrator\My Documents\Bánh d?ng kem.doc) -- D:\Documents and Settings\Administrator\My Documents\Bánh đựng kem.doc

< End of report >

Hi,

Please run OTL.exe.

• Copy the commands with file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  
  :OTL
  PRC - File not found -- f:\autorun.exe
  SRV - File not found [Auto | Stopped] -- D:\WINDOWS\System32\6to4v32.dll -- (6to4)
  O2 - BHO: (no name) - {9D425283-D487-4337-BAB6-AB8354A81457} - No CLSID value found.
  O3 - HKLM\..\Toolbar: (no name) - {9D425283-D487-4337-BAB6-AB8354A81457} - No CLSID value found.
  O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {9D425283-D487-4337-BAB6-AB8354A81457} - No CLSID value found.
  O33 - MountPoints2\{697e0a0c-657a-11df-a867-0030bd6de919}\Shell - "" = AutoRun
  O33 - MountPoints2\{697e0a0c-657a-11df-a867-0030bd6de919}\Shell\AutoRun - "" = Auto&Play
  O33 - MountPoints2\{697e0a0c-657a-11df-a867-0030bd6de919}\Shell\AutoRun\command - "" = F:\HWPcAssistant.exe -- File not found
  O33 - MountPoints2\{697e0a0d-657a-11df-a867-0030bd6de919}\Shell - "" = AutoRun
  O33 - MountPoints2\{697e0a0d-657a-11df-a867-0030bd6de919}\Shell\AutoRun - "" = Auto&Play
  O33 - MountPoints2\{697e0a0d-657a-11df-a867-0030bd6de919}\Shell\AutoRun\command - "" = G:\HWPcAssistant.exe -- File not found
  O33 - MountPoints2\{ac10381c-8b2d-11df-a8a3-0030bd6de919}\Shell\AuToplAY\cOMmaNd - "" = F:\ljlp.pif -- File not found
  O33 - MountPoints2\{ac10381c-8b2d-11df-a8a3-0030bd6de919}\Shell\AutoRun\command - "" = F:\ljlp.pif -- File not found
  O33 - MountPoints2\{ac10381c-8b2d-11df-a8a3-0030bd6de919}\Shell\EXplOre\cOmMAnd - "" = F:\ljlp.pif -- File not found
  O33 - MountPoints2\{ac10381c-8b2d-11df-a8a3-0030bd6de919}\Shell\OpEn\comMand - "" = F:\ljlp.pif -- File not found
  NetSvcs: 6to4 - D:\WINDOWS\System32\6to4v32.dll File not found
  
  
  :commands
  [emptytemp]
  [resethosts]
  
  
  
• Return to OTL.exe, right click in the "Custom Scans/Fixes" window (under the light green bar) and choose Paste.
  
  
• Click the red Run Fix button.
  
• A fix log in Notepad will appear. Copy the contents of the fix log to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  
• Close OTL.exe
  

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

==================

Please download ComboFix from BleepingComputer.com

Alternate link: GeeksToGo.com

Alternate link: Forospyware.com

Rename ComboFix.exe to commy.exe before you save it to your Desktop

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools A guide to do this can be found here
  
• Click Start>Run then copy paste the following command into the Run box & click OK "%userprofile%\desktop\commy.exe" /stepdel
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console

Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

• Click on Yes, to continue scanning for malware.
  
• When finished, it shall produce a log for you. Please include the contents of C:\ComboFix.txt in your next reply.
  

I can't run fixes in OTL.exe
Every time, it closes everything-including the toolbar at the bottom, the desktop,ect. and leave only the wallpaper-
and froze, I waited for it overnight but nothing happened.

Here is the Combofix.txt

ComboFix 10-12-13.02 - Administrator 12/14/2010 1:33:43.2.1 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1252.263.1033.18.2046.1671 [GMT -8:00]
Running from: D:\Documents and Settings\Administrator\Desktop\Commy.exe
AV: Kaspersky Security Suite CBE *Disabled/Updated* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
D:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
D:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
D:\Program Files\Search Toolbar\icon.ico
D:\Program Files\Search Toolbar\SearchToolbar.dll
D:\Program Files\Search Toolbar\SearchToolbarUninstall.exe
D:\Program Files\Search Toolbar\SearchToolbarUpdater.exe
D:\WINDOWS\system32\arp.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_6TO4
-------\Legacy_6TO4


((((((((((((((((((((((((( Files Created from 2010-11-14 to 2010-12-14 )))))))))))))))))))))))))))))))
.

2010-12-13 22:45:31 . 2010-12-13 22:45:32 38721 ----a-w- D:\WINDOWS\system32\task.exe
2010-12-13 22:45:14 . 2010-12-13 22:45:16 47425 ----a-w- D:\WINDOWS\system32\lsp5B.dll
2010-12-13 22:45:14 . 2010-12-13 22:45:16 0 ----a-w- D:\WINDOWS\system32\lsp5B.tmp
2010-12-13 22:32:02 . 2010-12-13 22:32:04 -------- d-----w- D:\WINDOWS\system32\wbem\Repository
2010-12-13 22:12:36 . 2010-12-13 22:12:38 -------- d--h--w- D:\WINDOWS\system32\GroupPolicy
2010-12-12 11:47:08 . 2010-12-12 11:47:08 -------- d-----w- D:\FOUND.001
2010-12-11 11:29:09 . 2010-12-11 11:29:10 -------- d-----w- D:\Documents and Settings\All Users\Application Data\Comodo Downloader
2010-12-10 03:46:00 . 2010-12-10 03:46:02 -------- d-----w- D:\WINDOWS\Sun
2010-12-09 22:43:06 . 2010-12-09 22:43:06 -------- d-----w- D:\FOUND.000
2010-12-09 06:16:57 . 2010-12-09 12:17:38 97859 ----a-w- D:\WINDOWS\system32\drivers\klick.dat
2010-12-09 06:16:57 . 2010-12-09 12:17:38 114243 ----a-w- D:\WINDOWS\system32\drivers\klin.dat
2010-12-09 06:13:14 . 2010-12-14 14:21:40 32 --sha-w- D:\WINDOWS\system32\drivers\fidbox.dat
2010-12-09 06:13:14 . 2010-12-14 10:12:22 32 --sha-w- D:\WINDOWS\system32\drivers\fidbox2.dat
2010-11-29 12:13:19 . 2010-11-29 12:13:20 -------- d-----w- D:\Program Files\VS Revo Group
2010-11-25 04:22:36 . 2010-11-25 04:22:38 -------- d-----w- D:\Documents and Settings\All Users\Application Data\NexonUS

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Messenger (Yahoo!)"="C:\PROGRA~1\Yahoo!\Messenger\YahooMessenger.exe" [2010-03-20 01:27:46 5248312]
"UniKey"="C:\Program files\UniKey\UniKeyNT.exe" [2006-04-19 00:55:02 217088]
"cdloader"="D:\Documents and Settings\Administrator\Application Data\mjusbsp\cdloader2.exe" [2010-12-03 12:39:04 50592]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="D:\WINDOWS\system32\igfxtray.exe" [2004-02-10 19:55:32 155648]
"HotKeysCmds"="D:\WINDOWS\system32\hkcmd.exe" [2004-02-10 19:51:30 118784]
"Adobe Reader Speed Launcher"="C:\Program files\Adobe Reader 9\Reader\Reader_sl.exe" [2010-09-23 12:47:04 35760]
"Adobe ARM"="D:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 07:07:44 932288]
"GMorphCl"="D:\WINDOWS\system32\task.exe" [2010-12-13 22:45:32 38721]
"AVP"="C:\Program files\K.s\avp.exe" [2008-05-01 23:33:30 221184]

Hi,

Your ComboFix log is cut off, could you please post the entire log?

here you go:
ComboFix 10-12-18.01 - Administrator 12/19/2010 2:48.3.1 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1252.263.1033.18.2046.1751 [GMT -8:00]
Running from: d:\documents and settings\Administrator\Desktop\Commy.exe
AV: Kaspersky Security Suite CBE *Disabled/Updated* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Security Suite CBE *Disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_6TO4
-------\Legacy_6TO4
-------\Legacy_6TO4
-------\Legacy_IAS


((((((((((((((((((((((((( Files Created from 2010-11-19 to 2010-12-19 )))))))))))))))))))))))))))))))
.

2010-12-16 23:43 . 2010-12-16 23:43 -------- d-----w- d:\windows\system32\%APPDATA%
2010-12-13 22:45 . 2010-12-13 22:45 38721 ----a-w- d:\windows\system32\task.exe
2010-12-13 22:45 . 2010-12-13 22:45 47425 ----a-w- d:\windows\system32\lsp5B.dll
2010-12-13 22:45 . 2010-12-13 22:45 0 ----a-w- d:\windows\system32\lsp5B.tmp
2010-12-13 22:32 . 2010-12-13 22:32 -------- d-----w- d:\windows\system32\wbem\Repository
2010-12-13 22:12 . 2010-12-13 22:12 -------- d--h--w- d:\windows\system32\GroupPolicy
2010-12-12 11:47 . 2010-12-12 11:47 -------- d-----w- D:\FOUND.001
2010-12-11 11:29 . 2010-12-11 11:29 -------- d-----w- d:\documents and settings\All Users\Application Data\Comodo Downloader
2010-12-10 03:46 . 2010-12-10 03:46 -------- d-----w- d:\windows\Sun
2010-12-09 22:43 . 2010-12-09 22:43 -------- d-----w- D:\FOUND.000
2010-12-09 06:16 . 2010-12-09 12:17 97859 ----a-w- d:\windows\system32\drivers\klick.dat
2010-12-09 06:16 . 2010-12-09 12:17 114243 ----a-w- d:\windows\system32\drivers\klin.dat
2010-12-09 06:13 . 2010-12-19 13:04 32 --sha-w- d:\windows\system32\drivers\fidbox.dat
2010-12-09 06:13 . 2010-12-19 12:05 32 --sha-w- d:\windows\system32\drivers\fidbox2.dat
2010-11-25 04:22 . 2010-11-25 04:22 -------- d-----w- d:\documents and settings\All Users\Application Data\NexonUS

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.

((((((((((((((((((((((((((((( SnapShot@2010-12-14_14.22.27 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-12-19 12:08 . 2010-12-19 12:08 16384 d:\windows\Temp\Perflib_Perfdata_26c.dat
- 2004-08-04 20:00 . 2010-08-19 11:32 58800 d:\windows\system32\perfc009.dat
+ 2004-08-04 20:00 . 2010-12-15 06:50 58800 d:\windows\system32\perfc009.dat
- 2010-04-25 19:18 . 2010-12-14 10:13 32768 d:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2010-04-25 19:18 . 2010-12-19 12:29 32768 d:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2010-04-25 19:18 . 2010-12-19 12:29 16384 d:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2010-04-25 19:18 . 2010-12-14 10:13 16384 d:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2010-04-25 19:18 . 2010-12-19 12:29 16384 d:\windows\system32\config\systemprofile\Cookies\index.dat
- 2010-04-25 19:18 . 2010-12-14 10:13 16384 d:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2004-08-04 20:00 . 2010-12-15 06:50 392626 d:\windows\system32\perfh009.dat
- 2004-08-04 20:00 . 2010-08-19 11:32 392626 d:\windows\system32\perfh009.dat
- 2010-04-24 23:49 . 2010-11-07 09:20 123728 d:\windows\system32\FNTCACHE.DAT
+ 2010-04-24 23:49 . 2010-12-16 10:41 123728 d:\windows\system32\FNTCACHE.DAT
+ 2010-12-16 23:43 . 2010-07-07 09:45 807744 d:\windows\system32\%APPDATA%\WhiteSmokeSetup\setup.exe
+ 2010-12-16 23:43 . 2010-07-07 09:45 581440 d:\windows\system32\%APPDATA%\WhiteSmokeSetup\ISSetup.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Messenger (Yahoo!)"="c:\progra~1\Yahoo!\Messenger\YahooMessenger.exe" [2010-03-20 5248312]
"UniKey"="c:\program files\UniKey\UniKeyNT.exe" [2006-04-19 217088]
"cdloader"="d:\documents and settings\Administrator\Application Data\mjusbsp\cdloader2.exe" [2010-12-03 50592]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="d:\windows\system32\igfxtray.exe" [2004-02-10 155648]
"HotKeysCmds"="d:\windows\system32\hkcmd.exe" [2004-02-10 118784]
"SunJavaUpdateSched"="d:\program files\Common Files\Java\Java Update\jusched.exe" [BU]
"Adobe Reader Speed Launcher"="c:\program files\Adobe Reader 9\Reader\Reader_sl.exe" [2010-09-23 35760]
"Adobe ARM"="d:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
"GMorphCl"="d:\windows\system32\task.exe" [2010-12-13 38721]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\K.s\adialhk.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"d:\\Program Files\\Internet Download Manager\\IDMan.exe"=
"d:\\Documents and Settings\\All Users\\Application Data\\NexonUS\\NGM\\NGM.exe"=
"c:\\Program files\\Boom online US\\New Folder\\PopTag\\CA.exe"=
"c:\\Program files\\Boom online US\\New Folder\\PopTag\\NMCOSrv.exe"=
"c:\\Program files\\Saved Programs\\setup.exe"=
"d:\\Documents and Settings\\Administrator\\Application Data\\MJUSBSP\\magicJack.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8378:TCP"= 8378:TCP:League of Legends Launcher
"8378:UDP"= 8378:UDP:League of Legends Launcher
"57531:TCP"= 57531:TCP:Pando Media Booster
"57531:UDP"= 57531:UDP:Pando Media Booster

R3 klim5;Kaspersky Anti-Virus NDIS Filter;d:\windows\system32\drivers\klim5.sys [12/13/2007 2:28 PM 24592]
S2 Ias;Network Security;d:\windows\System32\svchost.exe -k netsvcs [8/4/2004 12:00 PM 14336]
S3 MobileAdapter;Mobile Adapter USB Modem and USB Serial;d:\windows\system32\drivers\qscnusb.sys [5/22/2010 1:20 AM 103552]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - 6TO4
*NewlyCreated* - IAS
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://domredi.com/1/
IE: Download all links with IDM - d:\program files\Internet Download Manager\IEGetAll.htm
IE: Download FLV video content with IDM - d:\program files\Internet Download Manager\IEGetVL.htm
IE: Download FLV videos with IDM from 10 last requested - d:\program files\Internet Download Manager\IEGetVL2.htm
IE: Download with IDM - d:\program files\Internet Download Manager\IEExt.htm
LSP: d:\windows\system32\lsp5B.dll
FF - ProfilePath - d:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\kn808e1s.default\
FF - prefs.js: browser.startup.homepage - hxxps://www.google.com/
FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?pc=Z006&form=ZGAADF&q=
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - c:\program files\Firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}
FF - Ext: Java Quick Starter: jqs@sun.com - d:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: IDM CC: mozilla_cc@internetdownloadmanager.com - d:\documents and settings\Administrator\Application Data\IDM\idmmzcc3
FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
FF - Ext: Fire.fm: {6F0976E6-26F3-4AFE-BBEC-9E99E27E4DF3} - %profile%\extensions\{6F0976E6-26F3-4AFE-BBEC-9E99E27E4DF3}
FF - Ext: Lazarus: Form Recovery: lazarus@interclue.com - %profile%\extensions\lazarus@interclue.com
FF - Ext: VNG Launcher Firefox Integration: nppluginlauncher.dll@vng.com.vn - %profile%\extensions\nppluginlauncher.dll@vng.com.vn
FF - user.js: general.useragent.extra.brc -
.
.
------- File Associations -------
.
.
- - - - ORPHANS REMOVED - - - -

AddRemove-InstallShield_{BE6890C7-31EF-478C-812E-1E2899ABFCA9} - d:\progra~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe
AddRemove-{2B0CDD4D-5C1A-47F7-89E2-9BF604670ABC} - d:\program files\InstallShield Installation Information\{2B0CDD4D-5C1A-47F7-89E2-9BF604670ABC}\Setup.exe
AddRemove-{3E31400D-274E-4647-916C-2CACC3741799} - d:\program files\InstallShield Installation Information\{3E31400D-274E-4647-916C-2CACC3741799}\ENPSETUP.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-12-19 05:04
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: WDC_WD300BB-75DEA0 rev.05.03E05 -> Harddisk0\DR0 -> \Device\Ide\IdePort0 P0T0L0-3

device: opened successfully
user: MBR read successfully

Disk trace:
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x89B2D735]<<
_asm { PUSH EBP; MOV EBP, ESP; PUSH ECX; MOV EAX, [EBP+0x8]; CMP EAX, [0x89b33990]; MOV EAX, [0x89b33a0c]; PUSH EBX; PUSH ESI; MOV ESI, [EBP+0xc]; MOV EBX, [ESI+0x60]; PUSH EDI; JNZ 0x20; MOV [EBP+0x8], EAX; }
1 nt!IofCallDriver[0x804E37C5] -> \Device\Harddisk0\DR0[0x89BBAAB8]
3 CLASSPNP[0xF7637FCF] -> nt!IofCallDriver[0x804E37C5] -> \Device\0000005a[0x89C029E8]
5 ACPI[0xF75AE620] -> nt!IofCallDriver[0x804E37C5] -> [0x89C01940]
\Driver\atapi[0x89BC59F0] -> IRP_MJ_CREATE -> 0x89B2D735
kernel: MBR read successfully
_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; STI ; PUSH AX; POP ES; PUSH AX; POP DS; CLD ; MOV SI, 0x7c1b; MOV DI, 0x61b; PUSH AX; PUSH DI; MOV CX, 0x1e5; REP MOVSB ; RETF ; MOV BP, 0x7be; MOV CL, 0x4; CMP [BP+0x0], CH; JL 0x2e; JNZ 0x3a; }
detected disk devices:
\Device\Ide\IdeDeviceP0T0L0-3 -> \??\IDE#DiskWDC_WD300BB-75DEA0______________________05.03E05#4457572d414d3144313532323534_035_0_0_0_0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found
detected hooks:
\Driver\atapi DriverStartIo -> 0x89B2D57B
user & kernel MBR OK
Warning: possible TDL3 rootkit infection !

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-602162358-1757981266-725345543-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,93,73,bc,5c,a6,83,22,4a,8e,e6,c6,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,93,73,bc,5c,a6,83,22,4a,8e,e6,c6,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):4e,bb,bb,6f,b8,f5,df,06,61,0c,f4,b0,18,7a,a6,c1,93,c4,48,72,ef,
d3,57,6a,ce,ac,4b,03,6c,1d,06,b2,b1,21,ac,8a,12,5f,8c,f6,00,00,00,00,00,00,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{f0d25e13-d111-4d80-a91d-15a5c25b0698}]
@Denied: (Full) (Everyone)
"Model"=dword:000000dc
"Therad"=dword:00000013
"MData"=hex(0):73,d5,cf,b8,a4,07,89,80,31,e4,35,6b,2a,ca,fe,43,b6,1f,81,1f,5a,
1b,4d,36,46,8f,3c,f2,5c,68,ee,21,46,8f,3c,f2,5c,68,ee,21,46,8f,3c,f2,5c,68,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(804)
c:\program files\K.s\miscr3.dll
d:\windows\system32\klogon.dll
c:\program files\K.s\adialhk.dll

- - - - - - - > 'lsass.exe'(860)
c:\program files\K.s\dnsq.dll
c:\program files\K.s\miscr3.dll
c:\program files\K.s\fssync.dll
d:\windows\system32\lsp5B.dll

- - - - - - - > 'explorer.exe'(296)
c:\program files\K.s\miscr3.dll
c:\program files\K.s\fssync.dll
c:\program files\K.s\scrchpg.dll
d:\windows\system32\msi.dll
d:\windows\system32\wpdshserviceobj.dll
d:\windows\system32\portabledevicetypes.dll
d:\windows\system32\portabledeviceapi.dll
.
------------------------ Other Running Processes ------------------------
.
d:\program files\Common Files\EPSON\eEBAPI\eEBSVC.exe
c:\program files\K.s\avp.exe
d:\program files\Java\jre6\bin\jqs.exe
d:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2010-12-19 05:08:44 - machine was rebooted
ComboFix-quarantined-files.txt 2010-12-19 13:08

Pre-Run: 1,022,955,520 bytes free
Post-Run: 1,127,768,064 bytes free

- - End Of File - - 66413719797ABE9C16A6B96BFBAC7FB2

Hi,

Re-running ComboFix to remove infections:

1. Close any open browsers.
   
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
   
3. Open notepad and copy/paste the text in the quotebox below into it:
   

   
   File::
   D:\WINDOWS\system32\lsp5B.tmp
   D:\WINDOWS\system32\lsp5B.dll
   D:\WINDOWS\system32\task.exe
   
   DDS::
   LSP: d:\windows\system32\lsp5B.dll
   
   

4. Save this as CFScript.txt, in the same location as ComboFix.exe
   
   
   
   
5. Referring to the picture above, drag CFScript into ComboFix.exe
   
6. When finished, it shall produce a log for you at C:\ComboFix.txt
   
7. Please post the contents of the log in your next reply.

==============

Please download TDSSKiller from here and save it to your Desktop.

• Doubleclick TDSSKiller.exe to run the tool
  
• Click the Start Scan button
  
• After the scan has finished, click the Close button
  
• Click the Report button and copy/paste the contents of it into your next reply

Note:It will also create a log in the C:\ directory.

ComboFix 10-12-18.02 - Administrator 12/19/2010 22:09:39.4.1 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1252.263.1033.18.2046.1732 [GMT -8:00]
Running from: d:\documents and settings\Administrator\Desktop\Commy.exe
Command switches used :: d:\documents and settings\Administrator\Desktop\CFScript.txt
AV: Kaspersky Security Suite CBE *Disabled/Updated* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Security Suite CBE *Disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}

FILE ::
"d:\windows\system32\lsp5B.dll"
"d:\windows\system32\lsp5B.tmp"
"d:\windows\system32\task.exe"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

d:\documents and settings\NetworkService\Desktop\Improve Your PC.lnk
d:\windows\system32\lsp5B.dll
d:\windows\system32\lsp5B.tmp
d:\windows\system32\task.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_6TO4
-------\Legacy_IAS
-------\Service_6to4
-------\Service_Ias


((((((((((((((((((((((((( Files Created from 2010-11-20 to 2010-12-20 )))))))))))))))))))))))))))))))
.

2010-12-20 05:56 . 2010-12-20 05:56 -------- d-----w- d:\documents and settings\Administrator\Local Settings\Application Data\tjnet
2010-12-20 04:12 . 2010-12-20 04:12 -------- d-----w- d:\documents and settings\Administrator\Application Data\DMCache
2010-12-16 23:43 . 2010-12-16 23:43 -------- d-----w- d:\windows\system32\%APPDATA%
2010-12-13 22:32 . 2010-12-13 22:32 -------- d-----w- d:\windows\system32\wbem\Repository
2010-12-13 22:12 . 2010-12-13 22:12 -------- d--h--w- d:\windows\system32\GroupPolicy
2010-12-12 11:47 . 2010-12-12 11:47 -------- d-----w- D:\FOUND.001
2010-12-10 03:46 . 2010-12-10 03:46 -------- d-----w- d:\windows\Sun
2010-12-09 22:43 . 2010-12-09 22:43 -------- d-----w- D:\FOUND.000
2010-12-09 06:16 . 2010-12-09 12:17 97859 ----a-w- d:\windows\system32\drivers\klick.dat
2010-12-09 06:16 . 2010-12-09 12:17 114243 ----a-w- d:\windows\system32\drivers\klin.dat
2010-12-09 06:13 . 2010-12-20 06:19 32 --sha-w- d:\windows\system32\drivers\fidbox.dat
2010-12-09 06:13 . 2010-12-20 06:16 32 --sha-w- d:\windows\system32\drivers\fidbox2.dat
2010-11-25 04:22 . 2010-11-25 04:22 -------- d-----w- d:\documents and settings\All Users\Application Data\NexonUS

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.

((((((((((((((((((((((((((((( SnapShot@2010-12-14_14.22.27 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-12-20 06:16 . 2010-12-20 06:16 16384 d:\windows\Temp\Perflib_Perfdata_7c4.dat
- 2004-08-04 20:00 . 2010-08-19 11:32 58800 d:\windows\system32\perfc009.dat
+ 2004-08-04 20:00 . 2010-12-15 06:50 58800 d:\windows\system32\perfc009.dat
- 2010-04-25 19:18 . 2010-12-14 10:13 32768 d:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2010-12-20 06:18 . 2010-12-20 06:18 32768 d:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2010-04-25 19:18 . 2010-12-14 10:13 16384 d:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2010-04-25 19:18 . 2010-12-20 06:18 16384 d:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2010-04-25 19:18 . 2010-12-20 06:18 16384 d:\windows\system32\config\systemprofile\Cookies\index.dat
- 2010-04-25 19:18 . 2010-12-14 10:13 16384 d:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2004-08-04 20:00 . 2010-12-15 06:50 392626 d:\windows\system32\perfh009.dat
- 2004-08-04 20:00 . 2010-08-19 11:32 392626 d:\windows\system32\perfh009.dat
- 2010-04-24 23:49 . 2010-11-07 09:20 123728 d:\windows\system32\FNTCACHE.DAT
+ 2010-04-24 23:49 . 2010-12-16 10:41 123728 d:\windows\system32\FNTCACHE.DAT
+ 2010-12-16 23:43 . 2010-07-07 09:45 807744 d:\windows\system32\%APPDATA%\WhiteSmokeSetup\setup.exe
+ 2010-12-16 23:43 . 2010-07-07 09:45 581440 d:\windows\system32\%APPDATA%\WhiteSmokeSetup\ISSetup.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Messenger (Yahoo!)"="c:\progra~1\Yahoo!\Messenger\YahooMessenger.exe" [2010-03-20 5248312]
"UniKey"="c:\program files\UniKey\UniKeyNT.exe" [2006-04-19 217088]
"cdloader"="d:\documents and settings\Administrator\Application Data\mjusbsp\cdloader2.exe" [2010-12-03 50592]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="d:\windows\system32\igfxtray.exe" [2004-02-10 155648]
"HotKeysCmds"="d:\windows\system32\hkcmd.exe" [2004-02-10 118784]
"SunJavaUpdateSched"="d:\program files\Common Files\Java\Java Update\jusched.exe" [BU]
"Adobe Reader Speed Launcher"="c:\program files\Adobe Reader 9\Reader\Reader_sl.exe" [2010-09-23 35760]
"Adobe ARM"="d:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\K.s\adialhk.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"d:\\Program Files\\Internet Download Manager\\IDMan.exe"=
"d:\\Documents and Settings\\All Users\\Application Data\\NexonUS\\NGM\\NGM.exe"=
"c:\\Program files\\Boom online US\\New Folder\\PopTag\\CA.exe"=
"c:\\Program files\\Boom online US\\New Folder\\PopTag\\NMCOSrv.exe"=
"d:\\Documents and Settings\\Administrator\\Application Data\\mjusbsp\\magicJack.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8378:TCP"= 8378:TCP:League of Legends Launcher
"8378:UDP"= 8378:UDP:League of Legends Launcher
"57531:TCP"= 57531:TCP:Pando Media Booster
"57531:UDP"= 57531:UDP:Pando Media Booster

R3 klim5;Kaspersky Anti-Virus NDIS Filter;d:\windows\system32\drivers\klim5.sys [12/13/2007 2:28 PM 24592]
S3 MobileAdapter;Mobile Adapter USB Modem and USB Serial;d:\windows\system32\drivers\qscnusb.sys [5/22/2010 1:20 AM 103552]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://domredi.com/1/
uInternet Settings,ProxyServer = http=127.0.0.1:59274
uInternet Settings,ProxyOverride =
IE: Download all links with IDM - d:\program files\Internet Download Manager\IEGetAll.htm
IE: Download FLV video content with IDM - d:\program files\Internet Download Manager\IEGetVL.htm
IE: Download FLV videos with IDM from 10 last requested - d:\program files\Internet Download Manager\IEGetVL2.htm
IE: Download with IDM - d:\program files\Internet Download Manager\IEExt.htm
FF - ProfilePath - d:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\kn808e1s.default\
FF - prefs.js: browser.startup.homepage - hxxps://www.google.com/
FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?pc=Z006&form=ZGAADF&q=
FF - prefs.js: network.proxy.type - 0
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - c:\program files\Firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}
FF - Ext: Java Quick Starter: jqs@sun.com - d:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: IDM CC: mozilla_cc@internetdownloadmanager.com - d:\documents and settings\Administrator\Application Data\IDM\idmmzcc3
FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
FF - Ext: Fire.fm: {6F0976E6-26F3-4AFE-BBEC-9E99E27E4DF3} - %profile%\extensions\{6F0976E6-26F3-4AFE-BBEC-9E99E27E4DF3}
FF - Ext: Lazarus: Form Recovery: lazarus@interclue.com - %profile%\extensions\lazarus@interclue.com
FF - Ext: VNG Launcher Firefox Integration: nppluginlauncher.dll@vng.com.vn - %profile%\extensions\nppluginlauncher.dll@vng.com.vn
FF - user.js: general.useragent.extra.brc -
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-GMorphCl - d:\windows\system32\task.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-12-19 22:19
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-602162358-1757981266-725345543-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,93,73,bc,5c,a6,83,22,4a,8e,e6,c6,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,93,73,bc,5c,a6,83,22,4a,8e,e6,c6,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):4e,bb,bb,6f,b8,f5,df,06,61,0c,f4,b0,18,7a,a6,c1,93,c4,48,72,ef,
d3,57,6a,ce,ac,4b,03,6c,1d,06,b2,b1,21,ac,8a,12,5f,8c,f6,00,00,00,00,00,00,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{f0d25e13-d111-4d80-a91d-15a5c25b0698}]
@Denied: (Full) (Everyone)
"Model"=dword:000000dc
"Therad"=dword:00000013
"MData"=hex(0):73,d5,cf,b8,a4,07,89,80,31,e4,35,6b,2a,ca,fe,43,b6,1f,81,1f,5a,
1b,4d,36,46,8f,3c,f2,5c,68,ee,21,46,8f,3c,f2,5c,68,ee,21,46,8f,3c,f2,5c,68,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(800)
c:\program files\K.s\miscr3.dll
d:\windows\system32\klogon.dll
c:\program files\K.s\adialhk.dll

- - - - - - - > 'lsass.exe'(856)
c:\program files\K.s\dnsq.dll
c:\program files\K.s\miscr3.dll
c:\program files\K.s\fssync.dll

- - - - - - - > 'explorer.exe'(3408)
c:\program files\K.s\miscr3.dll
c:\program files\K.s\fssync.dll
c:\program files\K.s\scrchpg.dll
d:\windows\system32\msi.dll
d:\windows\system32\wpdshserviceobj.dll
d:\windows\system32\portabledevicetypes.dll
d:\windows\system32\portabledeviceapi.dll
.
------------------------ Other Running Processes ------------------------
.
d:\program files\Common Files\EPSON\eEBAPI\eEBSVC.exe
c:\program files\K.s\avp.exe
d:\program files\Java\jre6\bin\jqs.exe
c:\program files\K.s\avp.exe
d:\windows\system32\wscntfy.exe
c:\progra~1\Yahoo!\Messenger\ymsgr_tray.exe
.
**************************************************************************
.
Completion time: 2010-12-19 22:22:57 - machine was rebooted
ComboFix-quarantined-files.txt 2010-12-20 06:22
ComboFix2.txt 2010-12-19 13:08

Pre-Run: 1,255,088,128 bytes free
Post-Run: 1,189,953,536 bytes free

- - End Of File - - 93A9EAD1DB5F43A500451EC96016DDCA



------------------

TDSSkiller

2010/12/19 21:53:51.0937 TDSS rootkit removing tool 2.4.12.0 Dec 16 2010 09:46:46
2010/12/19 21:53:51.0937 ================================================================================
2010/12/19 21:53:51.0937 SystemInfo:
2010/12/19 21:53:51.0937
2010/12/19 21:53:51.0937 OS Version: 5.1.2600 ServicePack: 2.0
2010/12/19 21:53:51.0937 Product type: Workstation
2010/12/19 21:53:51.0937 ComputerName: RAWR-07055BA756
2010/12/19 21:53:51.0937 UserName: Administrator
2010/12/19 21:53:51.0937 Windows directory: D:\WINDOWS
2010/12/19 21:53:51.0937 System windows directory: D:\WINDOWS
2010/12/19 21:53:51.0937 Processor architecture: Intel x86
2010/12/19 21:53:51.0937 Number of processors: 1
2010/12/19 21:53:51.0937 Page size: 0x1000
2010/12/19 21:53:51.0937 Boot type: Normal boot
2010/12/19 21:53:51.0937 ================================================================================
2010/12/19 21:53:52.0437 Initialize success
2010/12/19 21:53:53.0687 ================================================================================
2010/12/19 21:53:53.0687 Scan started
2010/12/19 21:53:53.0687 Mode: Manual;
2010/12/19 21:53:53.0687 ================================================================================
2010/12/19 21:53:55.0406 ACPI (a10c7534f7223f4a73a948967d00e69b) D:\WINDOWS\system32\DRIVERS\ACPI.sys
2010/12/19 21:53:55.0484 ACPIEC (9859c0f6936e723e4892d7141b1327d5) D:\WINDOWS\system32\drivers\ACPIEC.sys
2010/12/19 21:53:55.0687 aeaudio (11c04b17ed2abbb4833694bcd644ac90) D:\WINDOWS\system32\drivers\aeaudio.sys
2010/12/19 21:53:55.0921 aec (1ee7b434ba961ef845de136224c30fec) D:\WINDOWS\system32\drivers\aec.sys
2010/12/19 21:53:56.0046 AFD (5ac495f4cb807b2b98ad2ad591e6d92e) D:\WINDOWS\System32\drivers\afd.sys
2010/12/19 21:53:57.0312 AsyncMac (02000abf34af4c218c35d257024807d6) D:\WINDOWS\system32\DRIVERS\asyncmac.sys
2010/12/19 21:53:57.0421 atapi (cdfe4411a69c224bd1d11b2da92dac51) D:\WINDOWS\system32\DRIVERS\atapi.sys
2010/12/19 21:53:57.0625 Atmarpc (ec88da854ab7d7752ec8be11a741bb7f) D:\WINDOWS\system32\DRIVERS\atmarpc.sys
2010/12/19 21:53:57.0734 audstub (d9f724aa26c010a217c97606b160ed68) D:\WINDOWS\system32\DRIVERS\audstub.sys
2010/12/19 21:53:57.0828 Beep (da1f27d85e0d1525f6621372e7b685e9) D:\WINDOWS\system32\drivers\Beep.sys
2010/12/19 21:53:58.0000 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) D:\WINDOWS\system32\drivers\cbidf2k.sys
2010/12/19 21:53:58.0093 CCDECODE (6163ed60b684bab19d3352ab22fc48b2) D:\WINDOWS\system32\DRIVERS\CCDECODE.sys
2010/12/19 21:53:58.0296 Cdaudio (c1b486a7658353d33a10cc15211a873b) D:\WINDOWS\system32\drivers\Cdaudio.sys
2010/12/19 21:53:58.0390 Cdfs (cd7d5152df32b47f4e36f710b35aae02) D:\WINDOWS\system32\drivers\Cdfs.sys
2010/12/19 21:53:58.0500 Cdrom (7b53584d94e9d8716b2de91d5f1cb42d) D:\WINDOWS\system32\DRIVERS\cdrom.sys
2010/12/19 21:53:59.0734 Disk (00ca44e4534865f8a3b64f7c0984bff0) D:\WINDOWS\system32\DRIVERS\disk.sys
2010/12/19 21:53:59.0921 dmboot (c0fbb516e06e243f0cf31f597e7ebf7d) D:\WINDOWS\system32\drivers\dmboot.sys
2010/12/19 21:54:00.0093 dmio (f5e7b358a732d09f4bcf2824b88b9e28) D:\WINDOWS\system32\drivers\dmio.sys
2010/12/19 21:54:00.0250 dmload (e9317282a63ca4d188c0df5e09c6ac5f) D:\WINDOWS\system32\drivers\dmload.sys
2010/12/19 21:54:00.0500 DMusic (a6f881284ac1150e37d9ae47ff601267) D:\WINDOWS\system32\drivers\DMusic.sys
2010/12/19 21:54:00.0796 drmkaud (1ed4dbbae9f5d558dbba4cc450e3eb2e) D:\WINDOWS\system32\drivers\drmkaud.sys
2010/12/19 21:54:01.0078 Fastfat (3117f595e9615e04f05a54fc15a03b20) D:\WINDOWS\system32\drivers\Fastfat.sys
2010/12/19 21:54:01.0250 Fdc (ced2e8396a8838e59d8fd529c680e02c) D:\WINDOWS\system32\DRIVERS\fdc.sys
2010/12/19 21:54:01.0343 Fips (e153ab8a11de5452bcf5ac7652dbf3ed) D:\WINDOWS\system32\drivers\Fips.sys
2010/12/19 21:54:01.0421 Flpydisk (0dd1de43115b93f4d85e889d7a86f548) D:\WINDOWS\system32\DRIVERS\flpydisk.sys
2010/12/19 21:54:01.0609 FltMgr (6cc5181f718820861eeadae38f764b75) D:\WINDOWS\system32\DRIVERS\fltMgr.sys
2010/12/19 21:54:01.0703 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) D:\WINDOWS\system32\drivers\Fs_Rec.sys
2010/12/19 21:54:01.0796 Ftdisk (6ac26732762483366c3969c9e4d2259d) D:\WINDOWS\system32\DRIVERS\ftdisk.sys
2010/12/19 21:54:01.0890 Gpc (c0f1d4a21de5a415df8170616703debf) D:\WINDOWS\system32\DRIVERS\msgpc.sys
2010/12/19 21:54:02.0000 hidusb (1de6783b918f540149aa69943bdfeba8) D:\WINDOWS\system32\DRIVERS\hidusb.sys
2010/12/19 21:54:02.0328 HTTP (ca9a02a72cc7cbda40afb457aea77d2e) D:\WINDOWS\system32\Drivers\HTTP.sys
2010/12/19 21:54:02.0718 i8042prt (5502b58eef7486ee6f93f3f164dcb808) D:\WINDOWS\system32\DRIVERS\i8042prt.sys
2010/12/19 21:54:02.0984 ialm (da58a8be6a445835f603720c4bc8837e) D:\WINDOWS\system32\DRIVERS\ialmnt5.sys
2010/12/19 21:54:03.0156 Imapi (12c59b8929121ace2f55acc86682cf12) D:\WINDOWS\system32\DRIVERS\imapi.sys
2010/12/19 21:54:03.0609 IntelIde (2d722b2b54ab55b2fa475eb58d7b2aad) D:\WINDOWS\system32\DRIVERS\intelide.sys
2010/12/19 21:54:03.0703 intelppm (bf736db0517d2b5efaecf3a7d2c65228) D:\WINDOWS\system32\DRIVERS\intelppm.sys
2010/12/19 21:54:03.0796 Ip6Fw (4448006b6bc60e6c027932cfc38d6855) D:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
2010/12/19 21:54:03.0890 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) D:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
2010/12/19 21:54:04.0000 IpInIp (e1ec7f5da720b640cd8fb8424f1b14bb) D:\WINDOWS\system32\DRIVERS\ipinip.sys
2010/12/19 21:54:04.0187 IpNat (472c75f85e631f8aa87d21c9fee6238d) D:\WINDOWS\system32\DRIVERS\ipnat.sys
2010/12/19 21:54:04.0312 IPSec (64537aa5c003a6afeee1df819062d0d1) D:\WINDOWS\system32\DRIVERS\ipsec.sys
2010/12/19 21:54:04.0531 isapnp (e504f706ccb699c2596e9a3da1596e87) D:\WINDOWS\system32\DRIVERS\isapnp.sys
2010/12/19 21:54:04.0656 Kbdclass (ebdee8a2ee5393890a1acee971c4c246) D:\WINDOWS\system32\DRIVERS\kbdclass.sys
2010/12/19 21:54:04.0796 kl1 (8eb0825b9d9f38c7ace67f012776c323) D:\WINDOWS\system32\drivers\kl1.sys
2010/12/19 21:54:05.0000 klif (854167a8a1c7300282ee5e157c3e1fbe) D:\WINDOWS\system32\drivers\klif.sys
2010/12/19 21:54:05.0187 klim5 (fab690ad3d3949b9ed227508734c8a85) D:\WINDOWS\system32\DRIVERS\klim5.sys
2010/12/19 21:54:05.0515 kmixer (8531438246ce9474e41ee1599904c0c7) D:\WINDOWS\system32\drivers\kmixer.sys
2010/12/19 21:54:05.0625 KSecDD (eb7ffe87fd367ea8fca0506f74a87fbb) D:\WINDOWS\system32\drivers\KSecDD.sys
2010/12/19 21:54:06.0015 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) D:\WINDOWS\system32\drivers\mnmdd.sys
2010/12/19 21:54:06.0218 MobileAdapter (83c97f6d9feb37af9d785ac099e41a42) D:\WINDOWS\system32\DRIVERS\qscnusb.sys
2010/12/19 21:54:06.0328 Modem (6fc6f9d7acc36dca9b914565a3aeda05) D:\WINDOWS\system32\drivers\Modem.sys
2010/12/19 21:54:06.0500 Mouclass (34e1f0031153e491910e12551400192c) D:\WINDOWS\system32\DRIVERS\mouclass.sys
2010/12/19 21:54:06.0578 mouhid (b1c303e17fb9d46e87a98e4ba6769685) D:\WINDOWS\system32\DRIVERS\mouhid.sys
2010/12/19 21:54:06.0671 MountMgr (65653f3b4477f3c63e68a9659f85ee2e) D:\WINDOWS\system32\drivers\MountMgr.sys
2010/12/19 21:54:06.0984 MRxDAV (9921d9df98f266560ec28b3bdb580180) D:\WINDOWS\system32\DRIVERS\mrxdav.sys
2010/12/19 21:54:07.0140 MRxSmb (321fe492903d8a07f79b7099d71ff578) D:\WINDOWS\system32\DRIVERS\mrxsmb.sys
2010/12/19 21:54:07.0281 Msfs (561b3a4333ca2dbdba28b5b956822519) D:\WINDOWS\system32\drivers\Msfs.sys
2010/12/19 21:54:07.0468 MSKSSRV (ae431a8dd3c1d0d0610cdbac16057ad0) D:\WINDOWS\system32\drivers\MSKSSRV.sys
2010/12/19 21:54:07.0578 MSPCLOCK (13e75fef9dfeb08eeded9d0246e1f448) D:\WINDOWS\system32\drivers\MSPCLOCK.sys
2010/12/19 21:54:07.0718 MSPQM (1988a33ff19242576c3d0ef9ce785da7) D:\WINDOWS\system32\drivers\MSPQM.sys
2010/12/19 21:54:07.0843 mssmbios (469541f8bfd2b32659d5d463a6714bce) D:\WINDOWS\system32\DRIVERS\mssmbios.sys
2010/12/19 21:54:08.0015 MSTEE (bf13612142995096ab084f2db7f40f77) D:\WINDOWS\system32\drivers\MSTEE.sys
2010/12/19 21:54:08.0125 Mup (a1dd45cdcd2bf8c57a9a0493c09b00b3) D:\WINDOWS\system32\drivers\Mup.sys
2010/12/19 21:54:08.0390 NABTSFEC (5c8dc6429c43dc6177c1fa5b76290d1a) D:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
2010/12/19 21:54:08.0531 NDIS (558635d3af1c7546d26067d5d9b6959e) D:\WINDOWS\system32\drivers\NDIS.sys
2010/12/19 21:54:08.0953 NdisIP (520ce427a8b298f54112857bcf6bde15) D:\WINDOWS\system32\DRIVERS\NdisIP.sys
2010/12/19 21:54:09.0015 NdisTapi (08d43bbdacdf23f34d79e44ed35c1b4c) D:\WINDOWS\system32\DRIVERS\ndistapi.sys
2010/12/19 21:54:09.0125 Ndisuio (77d9bf86b912104c229d4f0d25be3c12) D:\WINDOWS\system32\DRIVERS\ndisuio.sys
2010/12/19 21:54:09.0234 NdisWan (0b90e255a9490166ab368cd55a529893) D:\WINDOWS\system32\DRIVERS\ndiswan.sys
2010/12/19 21:54:09.0359 NDProxy (59fc3fb44d2669bc144fd87826bb571f) D:\WINDOWS\system32\drivers\NDProxy.sys
2010/12/19 21:54:09.0468 NetBIOS (3a2aca8fc1d7786902ca434998d7ceb4) D:\WINDOWS\system32\DRIVERS\netbios.sys
2010/12/19 21:54:09.0578 NetBT (0c80e410cd2f47134407ee7dd19cc86b) D:\WINDOWS\system32\DRIVERS\netbt.sys
2010/12/19 21:54:09.0718 Npfs (4f601bcb8f64ea3ac0994f98fed03f8e) D:\WINDOWS\system32\drivers\Npfs.sys
2010/12/19 21:54:09.0843 Ntfs (52723e766051ac8f0b70491ad91f0079) D:\WINDOWS\system32\drivers\Ntfs.sys
2010/12/19 21:54:10.0000 Null (73c1e1f395918bc2c6dd67af7591a3ad) D:\WINDOWS\system32\drivers\Null.sys
2010/12/19 21:54:10.0062 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) D:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
2010/12/19 21:54:10.0140 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) D:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
2010/12/19 21:54:10.0265 Parport (29744eb4ce659dfe3b4122deb45bc478) D:\WINDOWS\system32\DRIVERS\parport.sys
2010/12/19 21:54:10.0375 PartMgr (1628710c352bd79abeba234356e2b586) D:\WINDOWS\system32\drivers\PartMgr.sys
2010/12/19 21:54:10.0703 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) D:\WINDOWS\system32\drivers\ParVdm.sys
2010/12/19 21:54:10.0890 PCI (8086d9979234b603ad5bc2f5d890b234) D:\WINDOWS\system32\DRIVERS\pci.sys
2010/12/19 21:54:11.0093 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) D:\WINDOWS\system32\drivers\PCIIde.sys
2010/12/19 21:54:11.0218 Pcmcia (82a087207decec8456fbe8537947d579) D:\WINDOWS\system32\drivers\Pcmcia.sys
2010/12/19 21:54:12.0062 PptpMiniport (1c5cc65aac0783c344f16353e60b72ac) D:\WINDOWS\system32\DRIVERS\raspptp.sys
2010/12/19 21:54:12.0437 PSched (48671f327553dcf1d27f6197f622a668) D:\WINDOWS\system32\DRIVERS\psched.sys
2010/12/19 21:54:12.0531 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) D:\WINDOWS\system32\DRIVERS\ptilink.sys
2010/12/19 21:54:13.0187 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) D:\WINDOWS\system32\DRIVERS\rasacd.sys
2010/12/19 21:54:13.0296 Rasl2tp (98faeb4a4dcf812ba1c6fca4aa3e115c) D:\WINDOWS\system32\DRIVERS\rasl2tp.sys
2010/12/19 21:54:13.0453 RasPppoe (7306eeed8895454cbed4669be9f79faa) D:\WINDOWS\system32\DRIVERS\raspppoe.sys
2010/12/19 21:54:13.0500 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) D:\WINDOWS\system32\DRIVERS\raspti.sys
2010/12/19 21:54:13.0875 Rdbss (b48441a6dc703ee4c36db14ee51a189c) D:\WINDOWS\system32\DRIVERS\rdbss.sys
2010/12/19 21:54:13.0953 RDPCDD (4912d5b403614ce99c28420f75353332) D:\WINDOWS\system32\DRIVERS\RDPCDD.sys
2010/12/19 21:54:14.0156 rdpdr (a2cae2c60bc37e0751ef9dda7ceaf4ad) D:\WINDOWS\system32\DRIVERS\rdpdr.sys
2010/12/19 21:54:14.0312 RDPWD (047bea21274c8a4a233674a76c958c2c) D:\WINDOWS\system32\drivers\RDPWD.sys
2010/12/19 21:54:14.0484 redbook (b31b4588e4086d8d84adbf9845c2402b) D:\WINDOWS\system32\DRIVERS\redbook.sys
2010/12/19 21:54:14.0640 rspndr (0e11b35e972796042044bc27ce13b065) D:\WINDOWS\system32\DRIVERS\rspndr.sys
2010/12/19 21:54:14.0765 rtl8139 (d507c1400284176573224903819ffda3) D:\WINDOWS\system32\DRIVERS\RTL8139.SYS
2010/12/19 21:54:14.0921 Secdrv (7570380037993520842c2868121a01f9) D:\WINDOWS\system32\DRIVERS\secdrv.sys
2010/12/19 21:54:15.0046 serenum (a2d868aeeff612e70e213c451a70cafb) D:\WINDOWS\system32\DRIVERS\serenum.sys
2010/12/19 21:54:15.0171 Serial (cd9404d115a00d249f70a371b46d5a26) D:\WINDOWS\system32\DRIVERS\serial.sys
2010/12/19 21:54:15.0281 Sfloppy (0d13b6df6e9e101013a7afb0ce629fe0) D:\WINDOWS\system32\drivers\Sfloppy.sys
2010/12/19 21:54:15.0609 SLIP (5caeed86821fa2c6139e32e9e05ccdc9) D:\WINDOWS\system32\DRIVERS\SLIP.sys
2010/12/19 21:54:15.0828 smwdm (70b8dd8707dbf6142530c106365df67d) D:\WINDOWS\system32\drivers\smwdm.sys
2010/12/19 21:54:16.0078 splitter (9bb1dd670cb7505a90fc4e61d4aa8227) D:\WINDOWS\system32\drivers\splitter.sys
2010/12/19 21:54:16.0250 sr (e41b6d037d6cd08461470af04500dc24) D:\WINDOWS\system32\DRIVERS\sr.sys
2010/12/19 21:54:16.0390 Srv (5230953c21c811b5fc1ff31ae2b48097) D:\WINDOWS\system32\DRIVERS\srv.sys
2010/12/19 21:54:16.0625 streamip (284c57df5dc7abca656bc2b96a667afb) D:\WINDOWS\system32\DRIVERS\StreamIP.sys
2010/12/19 21:54:16.0718 swenum (03c1bae4766e2450219d20b993d6e046) D:\WINDOWS\system32\DRIVERS\swenum.sys
2010/12/19 21:54:16.0921 swmidi (94abc808fc4b6d7d2bbf42b85e25bb4d) D:\WINDOWS\system32\drivers\swmidi.sys
2010/12/19 21:54:17.0546 sysaudio (650ad082d46bac0e64c9c0e0928492fd) D:\WINDOWS\system32\drivers\sysaudio.sys
2010/12/19 21:54:17.0703 Tcpip (64798ecfa43d78c7178375fcdd16d8c8) D:\WINDOWS\system32\DRIVERS\tcpip.sys
2010/12/19 21:54:17.0890 TDPIPE (38d437cf2d98965f239b0abcd66dcb0f) D:\WINDOWS\system32\drivers\TDPIPE.sys
2010/12/19 21:54:18.0000 TDTCP (ed0580af02502d00ad8c4c066b156be9) D:\WINDOWS\system32\drivers\TDTCP.sys
2010/12/19 21:54:18.0109 TermDD (a540a99c281d933f3d69d55e48727f47) D:\WINDOWS\system32\DRIVERS\termdd.sys
2010/12/19 21:54:18.0421 Udfs (12f70256f140cd7d52c58c7048fde657) D:\WINDOWS\system32\drivers\Udfs.sys
2010/12/19 21:54:19.0000 Update (1f03139b77b21c6d84c688798808bc28) D:\WINDOWS\system32\DRIVERS\update.sys
2010/12/19 21:54:19.0171 usbaudio (2f005eb50645d537fff23b472691c269) D:\WINDOWS\system32\drivers\usbaudio.sys
2010/12/19 21:54:19.0296 usbccgp (bffd9f120cc63bcbaa3d840f3eef9f79) D:\WINDOWS\system32\DRIVERS\usbccgp.sys
2010/12/19 21:54:19.0390 usbehci (35e69410d5a2f1de386b37f4fc17aeb7) D:\WINDOWS\system32\DRIVERS\usbehci.sys
2010/12/19 21:54:19.0515 usbhub (db53e336c44cb0975d7dcb35bac0ecda) D:\WINDOWS\system32\DRIVERS\usbhub.sys
2010/12/19 21:54:19.0640 usbprint (a42369b7cd8886cd7c70f33da6fcbcf5) D:\WINDOWS\system32\DRIVERS\usbprint.sys
2010/12/19 21:54:19.0781 usbscan (a6bc71402f4f7dd5b77fd7f4a8ddba85) D:\WINDOWS\system32\DRIVERS\usbscan.sys
2010/12/19 21:54:19.0875 USBSTOR (6cd7b22193718f1d17a47a1cd6d37e75) D:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
2010/12/19 21:54:19.0968 usbuhci (b3671fbc569afe9390175561f1ab335c) D:\WINDOWS\system32\DRIVERS\usbuhci.sys
2010/12/19 21:54:20.0109 usbvideo (1c7bcd04dea750586db4c74da6dc337d) D:\WINDOWS\system32\Drivers\usbvideo.sys
2010/12/19 21:54:20.0218 VgaSave (8a60edd72b4ea5aea8202daf0e427925) D:\WINDOWS\System32\drivers\vga.sys
2010/12/19 21:54:20.0453 VolSnap (ee4660083deba849ff6c485d944b379b) D:\WINDOWS\system32\drivers\VolSnap.sys
2010/12/19 21:54:20.0734 Wanarp (984ef0b9788abf89974cfed4bfbaacbc) D:\WINDOWS\system32\DRIVERS\wanarp.sys
2010/12/19 21:54:20.0984 wdmaud (0bfa8203b8148fb4e54bc212c41ce497) D:\WINDOWS\system32\drivers\wdmaud.sys
2010/12/19 21:54:21.0218 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) D:\WINDOWS\System32\drivers\ws2ifsl.sys
2010/12/19 21:54:21.0375 WSTCODEC (d5842484f05e12121c511aa93f6439ec) D:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
2010/12/19 21:54:21.0515 WudfPf (f15feafffbb3644ccc80c5da584e6311) D:\WINDOWS\system32\DRIVERS\WudfPf.sys
2010/12/19 21:54:21.0671 WudfRd (28b524262bce6de1f7ef9f510ba3985b) D:\WINDOWS\system32\DRIVERS\wudfrd.sys
2010/12/19 21:54:21.0828 \HardDisk0 - detected Rootkit.Win32.TDSS.tdl4 (0)
2010/12/19 21:54:21.0843 ================================================================================
2010/12/19 21:54:21.0843 Scan finished
2010/12/19 21:54:21.0843 ================================================================================
2010/12/19 21:54:21.0875 Detected object count: 1
2010/12/19 21:54:34.0187 \HardDisk0 - will be cured after reboot
2010/12/19 21:54:34.0187 Rootkit.Win32.TDSS.tdl4(\HardDisk0) - User select action: Cure
2010/12/19 21:55:24.0312 Deinitialize success

Hi,

Re-running ComboFix to remove infections:

1. Close any open browsers.
   
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
   
3. Open notepad and copy/paste the text in the quotebox below into it:
   

   
   DDS::
   uInternet Settings,ProxyServer = http=127.0.0.1:59274
   
   

4. Save this as CFScript.txt, in the same location as ComboFix.exe
   
   
   
   
5. Referring to the picture above, drag CFScript into ComboFix.exe
   
6. When finished, it shall produce a log for you at C:\ComboFix.txt
   
7. Please post the contents of the log in your next reply.

Here is the log:

ComboFix 10-12-20.01 - Administrator 12/20/2010 19:22:25.5.1 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1252.263.1033.18.2046.1631 [GMT -8:00]
Running from: d:\documents and settings\Administrator\Desktop\Commy.exe
Command switches used :: d:\documents and settings\Administrator\Desktop\CFScript.txt
AV: Kaspersky Security Suite CBE *Disabled/Updated* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Security Suite CBE *Disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
.

((((((((((((((((((((((((( Files Created from 2010-11-21 to 2010-12-21 )))))))))))))))))))))))))))))))
.

2010-12-20 05:56 . 2010-12-20 05:56 -------- d-----w- d:\documents and settings\Administrator\Local Settings\Application Data\tjnet
2010-12-20 04:12 . 2010-12-20 04:12 -------- d-----w- d:\documents and settings\Administrator\Application Data\DMCache
2010-12-16 23:43 . 2010-12-16 23:43 -------- d-----w- d:\windows\system32\%APPDATA%
2010-12-13 22:32 . 2010-12-13 22:32 -------- d-----w- d:\windows\system32\wbem\Repository
2010-12-13 22:12 . 2010-12-13 22:12 -------- d--h--w- d:\windows\system32\GroupPolicy
2010-12-12 11:47 . 2010-12-12 11:47 -------- d-----w- D:\FOUND.001
2010-12-10 03:46 . 2010-12-10 03:46 -------- d-----w- d:\windows\Sun
2010-12-09 22:43 . 2010-12-09 22:43 -------- d-----w- D:\FOUND.000
2010-12-09 06:16 . 2010-12-09 12:17 97859 ----a-w- d:\windows\system32\drivers\klick.dat
2010-12-09 06:16 . 2010-12-09 12:17 114243 ----a-w- d:\windows\system32\drivers\klin.dat
2010-12-09 06:13 . 2010-12-21 03:21 32 --sha-w- d:\windows\system32\drivers\fidbox.dat
2010-12-09 06:13 . 2010-12-20 06:16 32 --sha-w- d:\windows\system32\drivers\fidbox2.dat
2010-11-25 04:22 . 2010-11-25 04:22 -------- d-----w- d:\documents and settings\All Users\Application Data\NexonUS

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.

((((((((((((((((((((((((((((( SnapShot@2010-12-14_14.22.27 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-12-20 06:16 . 2010-12-20 06:16 16384 d:\windows\Temp\Perflib_Perfdata_7c4.dat
- 2004-08-04 20:00 . 2010-08-19 11:32 58800 d:\windows\system32\perfc009.dat
+ 2004-08-04 20:00 . 2010-12-15 06:50 58800 d:\windows\system32\perfc009.dat
- 2010-04-25 19:18 . 2010-12-14 10:13 32768 d:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2010-12-20 06:18 . 2010-12-20 06:18 32768 d:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2010-04-25 19:18 . 2010-12-14 10:13 16384 d:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2010-04-25 19:18 . 2010-12-20 06:18 16384 d:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2010-04-25 19:18 . 2010-12-20 06:18 16384 d:\windows\system32\config\systemprofile\Cookies\index.dat
- 2010-04-25 19:18 . 2010-12-14 10:13 16384 d:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2004-08-04 20:00 . 2010-12-15 06:50 392626 d:\windows\system32\perfh009.dat
- 2004-08-04 20:00 . 2010-08-19 11:32 392626 d:\windows\system32\perfh009.dat
- 2010-04-24 23:49 . 2010-11-07 09:20 123728 d:\windows\system32\FNTCACHE.DAT
+ 2010-04-24 23:49 . 2010-12-16 10:41 123728 d:\windows\system32\FNTCACHE.DAT
+ 2010-12-16 23:43 . 2010-07-07 09:45 807744 d:\windows\system32\%APPDATA%\WhiteSmokeSetup\setup.exe
+ 2010-12-16 23:43 . 2010-07-07 09:45 581440 d:\windows\system32\%APPDATA%\WhiteSmokeSetup\ISSetup.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Messenger (Yahoo!)"="c:\progra~1\Yahoo!\Messenger\YahooMessenger.exe" [2010-03-20 5248312]
"UniKey"="c:\program files\UniKey\UniKeyNT.exe" [2006-04-19 217088]
"cdloader"="d:\documents and settings\Administrator\Application Data\mjusbsp\cdloader2.exe" [2010-12-03 50592]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="d:\windows\system32\igfxtray.exe" [2004-02-10 155648]
"HotKeysCmds"="d:\windows\system32\hkcmd.exe" [2004-02-10 118784]
"SunJavaUpdateSched"="d:\program files\Common Files\Java\Java Update\jusched.exe" [BU]
"Adobe Reader Speed Launcher"="c:\program files\Adobe Reader 9\Reader\Reader_sl.exe" [2010-09-23 35760]
"Adobe ARM"="d:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\K.s\adialhk.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"d:\\Program Files\\Internet Download Manager\\IDMan.exe"=
"d:\\Documents and Settings\\All Users\\Application Data\\NexonUS\\NGM\\NGM.exe"=
"c:\\Program files\\Boom online US\\New Folder\\PopTag\\CA.exe"=
"c:\\Program files\\Boom online US\\New Folder\\PopTag\\NMCOSrv.exe"=
"d:\\Documents and Settings\\Administrator\\Application Data\\mjusbsp\\magicJack.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8378:TCP"= 8378:TCP:League of Legends Launcher
"8378:UDP"= 8378:UDP:League of Legends Launcher
"57531:TCP"= 57531:TCP:Pando Media Booster
"57531:UDP"= 57531:UDP:Pando Media Booster

R3 klim5;Kaspersky Anti-Virus NDIS Filter;d:\windows\system32\drivers\klim5.sys [12/13/2007 2:28 PM 24592]
S3 MobileAdapter;Mobile Adapter USB Modem and USB Serial;d:\windows\system32\drivers\qscnusb.sys [5/22/2010 1:20 AM 103552]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://domredi.com/1/
uInternet Settings,ProxyOverride =
IE: Add to Anti-Banner - c:\program files\K.s\ie_banner_deny.htm
IE: Download all links with IDM - d:\program files\Internet Download Manager\IEGetAll.htm
IE: Download FLV video content with IDM - d:\program files\Internet Download Manager\IEGetVL.htm
IE: Download FLV videos with IDM from 10 last requested - d:\program files\Internet Download Manager\IEGetVL2.htm
IE: Download with IDM - d:\program files\Internet Download Manager\IEExt.htm
FF - ProfilePath - d:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\kn808e1s.default\
FF - prefs.js: browser.startup.homepage - hxxps://www.google.com/
FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?pc=Z006&form=ZGAADF&q=
FF - prefs.js: network.proxy.type - 0
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - c:\program files\Firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}
FF - Ext: Java Quick Starter: jqs@sun.com - d:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: IDM CC: mozilla_cc@internetdownloadmanager.com - d:\documents and settings\Administrator\Application Data\IDM\idmmzcc3
FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
FF - Ext: Fire.fm: {6F0976E6-26F3-4AFE-BBEC-9E99E27E4DF3} - %profile%\extensions\{6F0976E6-26F3-4AFE-BBEC-9E99E27E4DF3}
FF - Ext: Lazarus: Form Recovery: lazarus@interclue.com - %profile%\extensions\lazarus@interclue.com
FF - Ext: VNG Launcher Firefox Integration: nppluginlauncher.dll@vng.com.vn - %profile%\extensions\nppluginlauncher.dll@vng.com.vn
FF - user.js: general.useragent.extra.brc -
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-12-20 19:27
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-602162358-1757981266-725345543-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,93,73,bc,5c,a6,83,22,4a,8e,e6,c6,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,93,73,bc,5c,a6,83,22,4a,8e,e6,c6,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):4e,bb,bb,6f,b8,f5,df,06,61,0c,f4,b0,18,7a,a6,c1,93,c4,48,72,ef,
d3,57,6a,ce,ac,4b,03,6c,1d,06,b2,b1,21,ac,8a,12,5f,8c,f6,00,00,00,00,00,00,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{f0d25e13-d111-4d80-a91d-15a5c25b0698}]
@Denied: (Full) (Everyone)
"Model"=dword:000000dc
"Therad"=dword:00000013
"MData"=hex(0):73,d5,cf,b8,a4,07,89,80,31,e4,35,6b,2a,ca,fe,43,b6,1f,81,1f,5a,
1b,4d,36,46,8f,3c,f2,5c,68,ee,21,46,8f,3c,f2,5c,68,ee,21,46,8f,3c,f2,5c,68,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(800)
c:\program files\K.s\miscr3.dll
d:\windows\system32\klogon.dll
c:\program files\K.s\adialhk.dll
d:\windows\system32\DNSAPI.dll

- - - - - - - > 'lsass.exe'(856)
c:\program files\K.s\dnsq.dll
c:\program files\K.s\miscr3.dll
c:\program files\K.s\fssync.dll

- - - - - - - > 'explorer.exe'(2808)
c:\program files\K.s\miscr3.dll
c:\program files\K.s\fssync.dll
c:\program files\K.s\scrchpg.dll
d:\windows\system32\msi.dll
d:\windows\system32\wpdshserviceobj.dll
d:\windows\system32\portabledevicetypes.dll
d:\windows\system32\portabledeviceapi.dll
.
Completion time: 2010-12-20 19:30:22
ComboFix-quarantined-files.txt 2010-12-21 03:30
ComboFix2.txt 2010-12-20 06:23
ComboFix3.txt 2010-12-19 13:08

Pre-Run: 1,047,019,520 bytes free
Post-Run: 1,045,135,360 bytes free

- - End Of File - - CA415C803747E8A32121A805CAFD6E09

Hi,

Please download Malwarebytes Anti-Malware from Here.


Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes Anti-Malware and Launch Malwarebytes Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
  
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  
• Copy&Paste the entire report in your next reply.
  

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediatly.

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 5380

Windows 5.1.2600 Service Pack 2
Internet Explorer 7.0.5730.13

12/22/2010 10:14:51 PM
mbam-log-2010-12-22 (22-14-51).txt

Scan type: Quick scan
Objects scanned: 125095
Time elapsed: 2 minute(s), 29 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\qnpn7rjv93lf (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page (Hijack.StartPage) -> Bad: (http://domredi.com/1/) Good: (http://www.google.com) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Hi,

Please run a free online scan with the ESET Online Scanner
Note: You will need to use Internet Explorer for this scan

• Tick the box next to YES, I accept the Terms of Use
  
• Click Start
  
• When asked, allow the ActiveX control to install
  
• Click Start
  
• Make sure that the options Remove found threats and the option Scan unwanted applications is checked
  
• Click Scan (This scan can take several hours, so please be patient)
  
• Once the scan is completed, you may close the window
  
• Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
  
• Copy and paste that log as a reply to this topic