Unsure, but think at least some kind of Key Logger

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:18:01 PM, on 1/5/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal
Running processes:
I:\\\\WINDOWS\\\\System32\\\\smss.exe
I:\\\\WINDOWS\\\\system32\\\\winlogon.exe
I:\\\\WINDOWS\\\\system32\\\\services.exe
I:\\\\WINDOWS\\\\system32\\\\lsass.exe
I:\\\\WINDOWS\\\\system32\\\\svchost.exe
I:\\\\WINDOWS\\\\System32\\\\svchost.exe
J:\\\\Program Files\\\\WIDCOMM\\\\Bluetooth Software\\\\bin\\\\btwdins.exe
I:\\\\WINDOWS\\\\Explorer.EXE
J:\\\\Program Files\\\\Alwil Software\\\\Avast4\\\\aswUpdSv.exe
J:\\\\Program Files\\\\Alwil Software\\\\Avast4\\\\ashServ.exe
I:\\\\WINDOWS\\\\system32\\\\rundll32.exe
I:\\\\Program Files\\\\Creative\\\\SBAudigy2ZS\\\\Surround Mixer\\\\CTSysVol.exe
I:\\\\Program Files\\\\Java\\\\jre6\\\\bin\\\\jusched.exe
J:\\\\PROGRA~1\\\\ALWILS~1\\\\Avast4\\\\ashDisp.exe
J:\\\\Program Files\\\\Adobe\\\\Acrobat 9.0\\\\Acrobat\\\\Acrotray.exe
I:\\\\Program Files\\\\iTunes\\\\iTunesHelper.exe
I:\\\\Program Files\\\\QuickTime\\\\QTTask.exe
I:\\\\WINDOWS\\\\system32\\\\CTHELPER.EXE
I:\\\\Program Files\\\\Creative\\\\SBAudigy2ZS\\\\DVDAudio\\\\CTDVDDET.EXE
I:\\\\WINDOWS\\\\system32\\\\RUNDLL32.EXE
I:\\\\Program Files\\\\Microsoft IntelliType Pro\\\\itype.exe
I:\\\\WINDOWS\\\\system32\\\\ctfmon.exe
I:\\\\Program Files\\\\Microsoft ActiveSync\\\\wcescomm.exe
I:\\\\PROGRA~1\\\\MICROS~3\\\\rapimgr.exe
J:\\\\Program Files\\\\DAEMON Tools Lite\\\\daemon.exe
K:\\\\Program Files\\\\Curse\\\\CurseClient.exe
I:\\\\WINDOWS\\\\system32\\\\spoolsv.exe
I:\\\\Program Files\\\\Common Files\\\\Apple\\\\Mobile Device Support\\\\bin\\\\AppleMobileDeviceService.exe
I:\\\\Program Files\\\\Grisoft\\\\AVG Anti-Spyware 7.5\\\\guard.exe
I:\\\\Program Files\\\\Bonjour\\\\mDNSResponder.exe
I:\\\\WINDOWS\\\\system32\\\\CTsvcCDA.exe
I:\\\\Program Files\\\\Java\\\\jre6\\\\bin\\\\jqs.exe
I:\\\\WINDOWS\\\\system32\\\\nvsvc32.exe
I:\\\\WINDOWS\\\\system32\\\\PnkBstrA.exe
J:\\\\Program Files\\\\Alcohol Soft\\\\Alcohol 120\\\\StarWind\\\\StarWindServiceAE.exe
I:\\\\WINDOWS\\\\system32\\\\svchost.exe
I:\\\\WINDOWS\\\\System32\\\\svchost.exe
I:\\\\Program Files\\\\Webroot\\\\Spy Sweeper\\\\SpySweeper.exe
I:\\\\WINDOWS\\\\system32\\\\SearchIndexer.exe
I:\\\\Program Files\\\\iPod\\\\bin\\\\iPodService.exe
J:\\\\Program Files\\\\Alwil Software\\\\Avast4\\\\ashMaiSv.exe
J:\\\\Program Files\\\\Alwil Software\\\\Avast4\\\\ashWebSv.exe
I:\\\\Program Files\\\\Internet Explorer\\\\iexplore.exe
K:\\\\Program Files\\\\Trend Micro\\\\HijackThis\\\\HijackThis.exe
R0 - HKCU\\\\Software\\\\Microsoft\\\\Internet Explorer\\\\Main,Start Page = about:blank
R1 - HKLM\\\\Software\\\\Microsoft\\\\Internet Explorer\\\\Main,Default_Page_URL = about:blank
R1 - HKLM\\\\Software\\\\Microsoft\\\\Internet Explorer\\\\Main,Default_Search_URL = www.google.com
R0 - HKLM\\\\Software\\\\Microsoft\\\\Internet Explorer\\\\Main,Start Page = about:blank
R0 - HKLM\\\\Software\\\\Microsoft\\\\Internet Explorer\\\\Search,SearchAssistant =
R0 - HKLM\\\\Software\\\\Microsoft\\\\Internet Explorer\\\\Search,CustomizeSearch =
R1 - HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - I:\\\\Program Files\\\\Common Files\\\\Adobe\\\\Acrobat\\\\ActiveX\\\\AcroIEHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - I:\\\\Program Files\\\\Common Files\\\\Adobe\\\\Acrobat\\\\ActiveX\\\\AcroIEHelperShim.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - I:\\\\PROGRA~1\\\\SPYBOT~1\\\\SDHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - I:\\\\Program Files\\\\Java\\\\jre6\\\\bin\\\\ssv.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - I:\\\\Program Files\\\\Common Files\\\\Adobe\\\\Acrobat\\\\ActiveX\\\\AcroIEFavClient.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - I:\\\\Program Files\\\\Java\\\\jre6\\\\bin\\\\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - I:\\\\Program Files\\\\Java\\\\jre6\\\\lib\\\\deploy\\\\jqs\\\\ie\\\\jqs_plugin.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - I:\\\\Program Files\\\\Common Files\\\\Adobe\\\\Acrobat\\\\ActiveX\\\\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - I:\\\\Program Files\\\\Common Files\\\\Adobe\\\\Acrobat\\\\ActiveX\\\\AcroIEFavClient.dll
O4 - HKLM\\\\..\\\\Run: [NvCplDaemon] RUNDLL32.EXE I:\\\\WINDOWS\\\\system32\\\\NvCpl.dll,NvStartup
O4 - HKLM\\\\..\\\\Run: [NeroFilterCheck] I:\\\\Program Files\\\\Common Files\\\\Ahead\\\\Lib\\\\NeroCheck.exe
O4 - HKLM\\\\..\\\\Run: [nwiz] nwiz.exe /install
O4 - HKLM\\\\..\\\\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\\\\..\\\\Run: [CTSysVol] I:\\\\Program Files\\\\Creative\\\\SBAudigy2ZS\\\\Surround Mixer\\\\CTSysVol.exe /r
O4 - HKLM\\\\..\\\\Run: [SBDrvDet] I:\\\\Program Files\\\\Creative\\\\SB Drive Det\\\\SBDrvDet.exe /r
O4 - HKLM\\\\..\\\\Run: [SunJavaUpdateSched] "I:\\\\Program Files\\\\Java\\\\jre6\\\\bin\\\\jusched.exe"
O4 - HKLM\\\\..\\\\Run: [avast!] J:\\\\PROGRA~1\\\\ALWILS~1\\\\Avast4\\\\ashDisp.exe
O4 - HKLM\\\\..\\\\Run: [KernelFaultCheck] %systemroot%\\\\system32\\\\dumprep 0 -k
O4 - HKLM\\\\..\\\\Run: [Adobe Acrobat Speed Launcher] "J:\\\\Program Files\\\\Adobe\\\\Acrobat 9.0\\\\Acrobat\\\\Acrobat_sl.exe"
O4 - HKLM\\\\..\\\\Run: [Acrobat Assistant 8.0] "J:\\\\Program Files\\\\Adobe\\\\Acrobat 9.0\\\\Acrobat\\\\Acrotray.exe"
O4 - HKLM\\\\..\\\\Run: [iTunesHelper] "I:\\\\Program Files\\\\iTunes\\\\iTunesHelper.exe"
O4 - HKLM\\\\..\\\\Run: [QuickTime Task] "I:\\\\Program Files\\\\QuickTime\\\\QTTask.exe" -atboottime
O4 - HKLM\\\\..\\\\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\\\\..\\\\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\\\\..\\\\Run: [CTDVDDET] "I:\\\\Program Files\\\\Creative\\\\SBAudigy2ZS\\\\DVDAudio\\\\CTDVDDET.EXE"
O4 - HKLM\\\\..\\\\Run: [NvMediaCenter] RUNDLL32.EXE I:\\\\WINDOWS\\\\system32\\\\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\\\\..\\\\Run: [itype] "I:\\\\Program Files\\\\Microsoft IntelliType Pro\\\\itype.exe"
O4 - HKCU\\\\..\\\\Run: [ctfmon.exe] I:\\\\WINDOWS\\\\system32\\\\ctfmon.exe
O4 - HKCU\\\\..\\\\Run: [H/PC Connection Agent] "I:\\\\Program Files\\\\Microsoft ActiveSync\\\\wcescomm.exe"
O4 - HKCU\\\\..\\\\Run: [AlcoholAutomount] "J:\\\\Program Files\\\\Alcohol Soft\\\\Alcohol 120\\\\axcmd.exe" /automount
O4 - HKCU\\\\..\\\\Run: [DAEMON Tools Lite] "J:\\\\Program Files\\\\DAEMON Tools Lite\\\\daemon.exe" -autorun
O4 - HKCU\\\\..\\\\Run: [CurseClient] K:\\\\Program Files\\\\Curse\\\\CurseClient.exe -silent
O8 - Extra context menu item: Append Link Target to Existing PDF - res://I:\\\\Program Files\\\\Common Files\\\\Adobe\\\\Acrobat\\\\ActiveX\\\\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Append to Existing PDF - res://I:\\\\Program Files\\\\Common Files\\\\Adobe\\\\Acrobat\\\\ActiveX\\\\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert Link Target to Adobe PDF - res://I:\\\\Program Files\\\\Common Files\\\\Adobe\\\\Acrobat\\\\ActiveX\\\\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert to Adobe PDF - res://I:\\\\Program Files\\\\Common Files\\\\Adobe\\\\Acrobat\\\\ActiveX\\\\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://I:\\\\PROGRA~1\\\\MICROS~2\\\\OFFICE11\\\\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth Device... - J:\\\\Program Files\\\\WIDCOMM\\\\Bluetooth Software\\\\btsendto_ie_ctx.htm
O8 - Extra context menu item: Send To Bluetooth - J:\\\\Program Files\\\\WIDCOMM\\\\Bluetooth Software\\\\btsendto_ie.htm
O9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (no file)
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - I:\\\\PROGRA~1\\\\MICROS~3\\\\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - I:\\\\PROGRA~1\\\\MICROS~3\\\\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - I:\\\\PROGRA~1\\\\MICROS~3\\\\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - I:\\\\PROGRA~1\\\\MICROS~2\\\\OFFICE11\\\\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - J:\\\\Program Files\\\\WIDCOMM\\\\Bluetooth Software\\\\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - J:\\\\Program Files\\\\WIDCOMM\\\\Bluetooth Software\\\\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - I:\\\\WINDOWS\\\\Network Diagnostic\\\\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - I:\\\\WINDOWS\\\\Network Diagnostic\\\\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - I:\\\\Program Files\\\\Messenger\\\\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - I:\\\\Program Files\\\\Messenger\\\\msmsgs.exe
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/softwareupdate/su/ocx/15031/CTSUEng.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1172958259655
O16 - DPF: {6C269571-C6D7-4818-BCA4-32A035E8C884} (Creative Software AutoUpdate) - http://www.creative.com/softwareupdate/su/ocx/15101/CTSUEng.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1172958877623
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/softwareupdate/su/ocx/15106/CTPID.cab
O17 - HKLM\\\\System\\\\CCS\\\\Services\\\\Tcpip\\\\..\\\\{41F4C6D2-56A5-4F93-9C4E-F2ECB3D3FABF}: NameServer = 192.168.255.3

(Continued)

O18 - Protocol: bw+0 - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll

(Continued)

O18 - Protocol: bwo0s - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: offline-8876480 - {986CD646-C321-4884-91BB-C2F4338819A9} - I:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\BWPlugProtocol-8876480.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - I:\\\\\\\\PROGRA~1\\\\\\\\COMMON~1\\\\\\\\Skype\\\\\\\\SKYPE4~1.DLL
O20 - AppInit_DLLs: acaptuser32.dll
O23 - Service: Apple Mobile Device - Apple Inc. - I:\\\\\\\\Program Files\\\\\\\\Common Files\\\\\\\\Apple\\\\\\\\Mobile Device Support\\\\\\\\bin\\\\\\\\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - J:\\\\\\\\Program Files\\\\\\\\Alwil Software\\\\\\\\Avast4\\\\\\\\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - J:\\\\\\\\Program Files\\\\\\\\Alwil Software\\\\\\\\Avast4\\\\\\\\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - J:\\\\\\\\Program Files\\\\\\\\Alwil Software\\\\\\\\Avast4\\\\\\\\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - J:\\\\\\\\Program Files\\\\\\\\Alwil Software\\\\\\\\Avast4\\\\\\\\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - I:\\\\\\\\Program Files\\\\\\\\Grisoft\\\\\\\\AVG Anti-Spyware 7.5\\\\\\\\guard.exe
O23 - Service: Bonjour Service - Apple Inc. - I:\\\\\\\\Program Files\\\\\\\\Bonjour\\\\\\\\mDNSResponder.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - J:\\\\\\\\Program Files\\\\\\\\WIDCOMM\\\\\\\\Bluetooth Software\\\\\\\\bin\\\\\\\\btwdins.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - I:\\\\\\\\WINDOWS\\\\\\\\system32\\\\\\\\CTsvcCDA.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - I:\\\\\\\\Program Files\\\\\\\\Common Files\\\\\\\\Macrovision Shared\\\\\\\\FLEXnet Publisher\\\\\\\\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - I:\\\\\\\\Program Files\\\\\\\\Common Files\\\\\\\\InstallShield\\\\\\\\Driver\\\\\\\\11\\\\\\\\Intel 32\\\\\\\\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - I:\\\\\\\\Program Files\\\\\\\\iPod\\\\\\\\bin\\\\\\\\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - I:\\\\\\\\Program Files\\\\\\\\Java\\\\\\\\jre6\\\\\\\\bin\\\\\\\\jqs.exe
O23 - Service: NBService - Nero AG - I:\\\\\\\\Program Files\\\\\\\\Nero\\\\\\\\Nero 7\\\\\\\\Nero BackItUp\\\\\\\\NBService.exe
O23 - Service: NMIndexingService - Nero AG - I:\\\\\\\\Program Files\\\\\\\\Common Files\\\\\\\\Ahead\\\\\\\\Lib\\\\\\\\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - I:\\\\\\\\WINDOWS\\\\\\\\system32\\\\\\\\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - I:\\\\\\\\WINDOWS\\\\\\\\system32\\\\\\\\PnkBstrA.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - I:\\\\\\\\Program Files\\\\\\\\Spyware Doctor\\\\\\\\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - I:\\\\\\\\Program Files\\\\\\\\Spyware Doctor\\\\\\\\pctsSvc.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - J:\\\\\\\\Program Files\\\\\\\\Alcohol Soft\\\\\\\\Alcohol 120\\\\\\\\StarWind\\\\\\\\StarWindServiceAE.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - I:\\\\\\\\Program Files\\\\\\\\Webroot\\\\\\\\Spy Sweeper\\\\\\\\SpySweeper.exe
--
End of file - 23811 bytes

(Unistall List)
Ad-Aware SE Personal
Adobe Acrobat 9 Pro Extended - English, Français, Deutsch
Adobe Flash Player 10 ActiveX
Adobe Flash Player Plugin
Adobe Shockwave Player
Advanced Spyware Remover Profession Edition
Age of Chivalry
Age of Mythology
AIM 6
Apple Mobile Device Support
Apple Software Update
A-Ray Scanner 2.0.2.3
avast! Antivirus
AVG Anti-Spyware 7.5
AVS DVD Player version 2.4
Belarc Advisor 7.2
Bonjour
Call of Duty(R) 4 - Modern Warfare(TM)
CAM UnZip 4.42
Command & Conquer Generals
Command and ConquerTM Generals Zero Hour
Creative Audio Console
Creative MediaSource 5
Creative MediaSource DVD-Audio Player
Creative System Information
Creative WebCam Center
Creative WebCam Notebook Driver (1.04.01.0322)
CrossLoop 2.20
Curse Client
Day of Defeat
Digital Voice Recorder
EPSON Printer Software
FrostWire 4.13.5
Half-Life Dedicated Server Update Tool
Hauppauge WinTV2000
Hauppauge WinTV-PVR 150 Drivers
HHD Software Free Hex Editor Neo 4.11
HijackThis 2.0.2
Hitman Blood Money
Hitman Pro
Hotfix for Microsoft .NET Framework 3.0 (KB932471)
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB915800-v4)
Hotfix for Windows XP (KB952287)
IconTweaker
InterActual Player
iTunes
J2SE Runtime Environment 5.0 Update 11
Java(TM) 6 Update 11
Java(TM) 6 Update 3
Java(TM) 6 Update 5
Java(TM) 6 Update 7
Line 6 Drivers 3.2.9.2 (Remove Only)
Line 6 Edit (remove only)
Line 6 Monkey 1.15 (Remove Only)
Linksys Wireless-G USB Network Adapter
Logitech Desktop Messenger
Logitech SetPoint
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0 Service Pack 1
Microsoft .NET Framework 3.0 Service Pack 1
Microsoft ActiveSync
Microsoft Base Smart Card Cryptographic Service Provider Package
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office Professional Edition 2003
Microsoft Office Standard Edition 2003
Microsoft Silverlight
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft Works 6-9 Converter
MIDI-OX
Motorola SM56 Speakerphone Modem
Mozilla Firefox (3.0.4)
Mozilla Thunderbird (2.0.0.19)
MSN
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 6.0 Parser (KB933579)
MSXML4 Parser
Nero 7 Ultra Edition
Nero 7 Ultra Edition
neroxml
Nostromo Array Programming Software
NVIDIA Drivers
Palm Desktop
Pantech UMTS Driver
Portal: The First Slice
QuickTime
Security Update for Windows Internet Explorer 7 (KB928090)
Security Update for Windows Internet Explorer 7 (KB931768)
Security Update for Windows Internet Explorer 7 (KB933566)
Security Update for Windows Internet Explorer 7 (KB937143)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 9 (KB917734)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Skype 3.8
Sound Blaster Audigy 2 ZS
Spy Sweeper
Spybot - Search & Destroy 1.4
Spyware Doctor 5.5
SpywareBlaster v3.5.1
SY Manager Version 2.2.2
System Requirements Lab
TeamSpeak 2 RC2
Thunderbird-Tray
Update for Windows XP (KB943729)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
Variax Workbench (remove only)
VersionTracker Pro Windows
WIDCOMM Bluetooth Software
Windows Imaging Component
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Format SDK Hotfix - KB891122
Windows Media Player 11
Windows Media Player 11
Windows Mobile Device Handbook
Windows Presentation Foundation
Windows Search 4.0
Windows XP Service Pack 3
WinMount V2.2.1
WinRAR archiver
WinZip 11.1
World of Warcraft
Zipeg

Do y'all need more information or anything?

Sorry for the delay, I missed your post this morning.

Please download and run this tool.

Download Malwarebytes' Anti-Malware from Here

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
  
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  

Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.

Post the contents of the MBAM Log.

Thanks for helpin me out with this! I've been fighting my computer for over a month now and haven't seemed to get anywhere!

Here's the Log

Malwarebytes' Anti-Malware 1.32
Database version: 1624
Windows 5.1.2600 Service Pack 3
1/6/2009 12:27:41 PM
mbam-log-2009-01-06 (12-27-41).txt
Scan type: Quick Scan
Objects scanned: 73083
Time elapsed: 9 minute(s), 46 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 3
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
I:\WINDOWS\b.exe (Trojan.Agent) -> Quarantined and deleted successfully.
I:\Documents and Settings\Brian Lutman\Cookies\MM2048.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
I:\Documents and Settings\Brian Lutman\Cookies\MM256.DAT (Trojan.Agent) -> Quarantined and deleted successfully.

Hello.

Go to Start > Control Panel > Add/Remove Programs and remove the following programs if present.

J2SE Runtime Environment 5.0 Update 11
Java(TM) 6 Update 3
Java(TM) 6 Update 5
Java(TM) 6 Update 7

• Please download DDS by sUBs to your Desktop (Important!!) from one of these locations:
  Link 1
  Link 2
  Link 3
  
• Double click DDS.scr to run
  
• When complete, DDS.txt will open.
  
• Click No for Optional Scan.
  
• Save the report to your Desktop.
• Copy and paste DDS.txt back here, I don't need to see attach.txt.
  

DDS (Version 1.1.0) - NTFSx86
Run by Brian Lutman at 13:14:51.34 on Tue 01/06/2009
Internet Explorer: 7.0.5730.11 BrowserJavaVersion: 1.6.0_11
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1376 [GMT -6:00]
AV: avast! antivirus 4.8.1296 [VPS 090106-0] *On-access scanning enabled* (Updated)
============== Running Processes ===============
I:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
J:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
svchost.exe
svchost.exe
I:\WINDOWS\Explorer.EXE
J:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
J:\Program Files\Alwil Software\Avast4\ashServ.exe
I:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe
I:\WINDOWS\system32\rundll32.exe
J:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
J:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe
I:\Program Files\iTunes\iTunesHelper.exe
I:\Program Files\QuickTime\QTTask.exe
I:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDET.EXE
I:\WINDOWS\system32\RUNDLL32.EXE
I:\Program Files\Microsoft IntelliType Pro\itype.exe
I:\WINDOWS\system32\CTHELPER.EXE
I:\WINDOWS\system32\ctfmon.exe
I:\Program Files\Microsoft ActiveSync\wcescomm.exe
I:\PROGRA~1\MICROS~3\rapimgr.exe
J:\Program Files\DAEMON Tools Lite\daemon.exe
K:\Program Files\Curse\CurseClient.exe
I:\WINDOWS\system32\spoolsv.exe
I:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
I:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
I:\Program Files\Bonjour\mDNSResponder.exe
I:\WINDOWS\system32\CTsvcCDA.exe
I:\Program Files\Java\jre6\bin\jqs.exe
I:\WINDOWS\system32\nvsvc32.exe
I:\WINDOWS\system32\PnkBstrA.exe
J:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
I:\WINDOWS\System32\svchost.exe -k imgsvc
"I:\WINDOWS\system32\svchost.exe" 92869
I:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
I:\WINDOWS\system32\SearchIndexer.exe
J:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
J:\Program Files\Alwil Software\Avast4\ashWebSv.exe
I:\Program Files\iPod\bin\iPodService.exe
I:\WINDOWS\System32\svchost.exe -k netsvcs
I:\Program Files\Internet Explorer\iexplore.exe
I:\WINDOWS\system32\wuauclt.exe
I:\WINDOWS\system32\msiexec.exe
I:\WINDOWS\system32\SearchProtocolHost.exe
I:\Program Files\Java\jre6\bin\jusched.exe
I:\Documents and Settings\Brian Lutman\Desktop\dds.com
============== Pseudo HJT Report ===============
uStart Page = about:blank
uSearch Page =
uWindow Title =
uSearch Bar =
mDefault_Page_URL = about:blank
mDefault_Search_URL = www.google.com
mSearch Page =
mStart Page = about:blank
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
uCustomizeSearch =
uSearchAssistant =
mSearchAssistant =
mCustomizeSearch =
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - i:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - i:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: : {53707962-6f74-2d53-2644-206d7942484f} - i:\progra~1\spybot~1\SDHelper.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - i:\program files\java\jre6\bin\ssv.dll
BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - i:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - i:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - i:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: SmartSelect Class: {f4971ee7-daa0-4053-9964-665d8ee6a077} - i:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - i:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [ctfmon.exe] i:\windows\system32\ctfmon.exe
uRun: [H/PC Connection Agent] "i:\program files\microsoft activesync\wcescomm.exe"
uRun: [AlcoholAutomount] "j:\program files\alcohol soft\alcohol 120\axcmd.exe" /automount
uRun: [DAEMON Tools Lite] "j:\program files\daemon tools lite\daemon.exe" -autorun
uRun: [CurseClient] k:\program files\curse\CurseClient.exe -silent
mRun: [NvCplDaemon] RUNDLL32.EXE i:\windows\system32\NvCpl.dll,NvStartup
mRun: [NeroFilterCheck] i:\program files\common files\ahead\lib\NeroCheck.exe
mRun: [nwiz] nwiz.exe /install
mRun: [CTxfiHlp] CTXFIHLP.EXE
mRun: [CTSysVol] i:\program files\creative\sbaudigy2zs\surround mixer\CTSysVol.exe /r
mRun: [SBDrvDet] i:\program files\creative\sb drive det\SBDrvDet.exe /r
mRun: [avast!] j:\progra~1\alwils~1\avast4\ashDisp.exe
mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
mRun: [Adobe Acrobat Speed Launcher] "j:\program files\adobe\acrobat 9.0\acrobat\Acrobat_sl.exe"
mRun: []
mRun: [Acrobat Assistant 8.0] "j:\program files\adobe\acrobat 9.0\acrobat\Acrotray.exe"
mRun: [iTunesHelper] "i:\program files\itunes\iTunesHelper.exe"
mRun: [QuickTime Task] "i:\program files\quicktime\QTTask.exe" -atboottime
mRun: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
mRun: [CTDVDDET] "i:\program files\creative\sbaudigy2zs\dvdaudio\CTDVDDET.EXE"
mRun: [NvMediaCenter] RUNDLL32.EXE i:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [itype] "i:\program files\microsoft intellitype pro\itype.exe"
mRun: [CTHelper] CTHELPER.EXE
mRun: [CTXFIREG] CTxfiReg.exe /FAIL0
mRun: [SunJavaUpdateSched] "i:\program files\java\jre6\bin\jusched.exe"
mRunOnce: [Malwarebytes' Anti-Malware] i:\documents and settings\brian lutman\desktop\tools\malwarebytes' anti-malware\mbamgui.exe /install /silent
IE: Append Link Target to Existing PDF - i:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - i:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - i:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - i:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - i:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - j:\program files\widcomm\bluetooth software\btsendto_ie_ctx.htm
IE: Send To Bluetooth - j:\program files\widcomm\bluetooth software\btsendto_ie.htm
IE: {2D663D1A-8670-49D9-A1A5-4C56B4E14E84}
IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - j:\program files\widcomm\bluetooth software\btsendto_ie.htm
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - i:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBC} - i:\program files\java\jre6\bin\jp2iexp.dll
IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - i:\progra~1\micros~3\INetRepl.dll
IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - i:\progra~1\micros~3\INetRepl.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - i:\progra~1\micros~2\office11\REFIEBAR.DLL
Trusted Zone: aol.com\free
TCP: {41F4C6D2-56A5-4F93-9C4E-F2ECB3D3FABF} = 192.168.255.3
Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - i:\program files\belarc\advisor\system\BAVoilaX.dll
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - i:\program files\logitech\desktop messenger\8876480\program\GAPlugProtocol-8876480.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - i:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: WRNotifier - WRLogonNTF.dll
AppInit_DLLs: acaptuser32.dll
SSODL: 0aMCPClient - {F5DF91F9-15E9-416B-A7C3-7519B11ECBFC} - No File
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - i:\windows\system32\WPDShServiceObj.dll
SEH: CShellExecuteHookImpl Object: {57b86673-276a-48b2-bae7-c6dbb3020eb8} - i:\program files\grisoft\avg anti-spyware 7.5\shellexecutehook.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - i:\program files\windows desktop search\MSNLNamespaceMgr.dll
LSA: Notification Packages = scecli scecli scecli
================= FIREFOX ===================
FF - ProfilePath - i:\docume~1\brianl~1\applic~1\mozilla\firefox\profiles\va1sfrdi.default\
FF - plugin: j:\program files\adobe\acrobat 9.0\acrobat\browser\nppdf32.dll
============= SERVICES / DRIVERS ===============
R1 aswSP;avast! Self Protection;i:\windows\system32\drivers\aswSP.sys [2008-5-29 111184]
R1 AVG Anti-Spyware Driver;AVG Anti-Spyware Driver;i:\program files\grisoft\avg anti-spyware 7.5\guard.sys [2006-9-28 11000]
R1 AvgAsCln;AVG Anti-Spyware Clean Driver;i:\windows\system32\drivers\AvgAsCln.sys [2007-3-4 3968]
R3 avast! Mail Scanner;avast! Mail Scanner;j:\program files\alwil software\avast4\ashMaiSv.exe [2008-5-29 254040]
R3 avast! Web Scanner;avast! Web Scanner;j:\program files\alwil software\avast4\ashWebSv.exe [2008-5-29 352920]
R3 COMMONFX.SYS;COMMONFX.SYS;i:\windows\system32\drivers\COMMONFX.sys [2008-6-27 99352]
R3 CTAUDFX.SYS;CTAUDFX.SYS;i:\windows\system32\drivers\CTAUDFX.sys [2008-6-27 555032]
R3 CTSBLFX.SYS;CTSBLFX.SYS;i:\windows\system32\drivers\CTSBLFX.sys [2008-6-27 566296]
R3 ipgd;IC Plus IP1000 Family Gigabit Ethernet Adapter Driver;i:\windows\system32\drivers\ipgdnd51.sys [2007-11-17 33536]
R3 L6DP;L6DP;i:\windows\system32\drivers\l6dp.sys [2007-1-29 29312]
R3 WinMTBus;WinMount Bus;i:\windows\system32\drivers\WinMTBus.sys [2008-2-25 196224]
R4 aswFsBlk;aswFsBlk;i:\windows\system32\drivers\aswFsBlk.sys [2008-5-29 20560]
R4 avast! Antivirus;avast! Antivirus;j:\program files\alwil software\avast4\ashServ.exe [2008-5-29 155160]
R4 AVG Anti-Spyware Guard;AVG Anti-Spyware Guard;i:\program files\grisoft\avg anti-spyware 7.5\guard.exe [2006-9-28 312880]
R4 WebrootSpySweeperService;Webroot Spy Sweeper Engine;i:\program files\webroot\spy sweeper\SpySweeper.exe [2007-5-13 3379264]
S1 vcdrom;Virtual CD-ROM Device Driver;\??\i:\windows\system32\drivers\vcdrom.sys --> i:\windows\system32\drivers\VCdRom.sys [?]
S3 bcgame;Nostromo HID Device Minidriver;i:\windows\system32\drivers\bcgame.sys [2003-7-24 22821]
S3 COMMONFX;COMMONFX;i:\windows\system32\drivers\COMMONFX.sys [2008-6-27 99352]
S3 CTAUDFX;CTAUDFX;i:\windows\system32\drivers\CTAUDFX.sys [2008-6-27 555032]
S3 CTERFXFX.SYS;CTERFXFX.SYS;i:\windows\system32\drivers\CTERFXFX.sys [2008-6-27 100888]
S3 CTERFXFX;CTERFXFX;i:\windows\system32\drivers\CTERFXFX.sys [2008-6-27 100888]
S3 CTSBLFX;CTSBLFX;i:\windows\system32\drivers\CTSBLFX.sys [2008-6-27 566296]
S3 IKFileSec;File Security Driver;i:\windows\system32\drivers\ikfilesec.sys [2007-5-13 42376]
S3 IkSysFlt;System Filter Driver;i:\windows\system32\drivers\iksysflt.sys [2007-5-13 66952]
S3 IKSysSec;System Security Driver;i:\windows\system32\drivers\iksyssec.sys [2007-5-13 81288]
S3 L6PODLV;PODxt Live Service;i:\windows\system32\drivers\L6PODLV.sys [2007-1-29 609408]
S3 P1171VID;Creative WebCam Notebook #2;i:\windows\system32\drivers\P1171Vid.sys [2008-5-18 91392]
S3 ptuc_bus;PANTECH Mobile USB Devices;i:\windows\system32\drivers\ptuc_bus.sys [2008-4-15 22272]
S3 ptuc_flt;PANTECH USB Filter Service;i:\windows\system32\drivers\ptuc_flt.sys [2008-4-15 3584]
S3 ptuc_mdm;PANTECH USB Packet Services;i:\windows\system32\drivers\ptuc_mdm.sys [2008-4-15 40448]
S3 ptuc_prt;PANTECH UMTS Diagnostic Serial Ports;i:\windows\system32\drivers\ptuc_prt.sys [2008-4-15 39296]
S3 sdAuxService;PC Tools Auxiliary Service;i:\program files\spyware doctor\pctsAuxs.exe [2008-5-23 337800]
S3 sdCoreService;PC Tools Security Service;i:\program files\spyware doctor\pctsSvc.exe [2008-5-23 1017224]
S3 uisp;Motorola USB ICP driver;i:\windows\system32\drivers\usbicp.sys --> i:\windows\system32\drivers\usbicp.sys [?]
S4 RPCHE;Remote Procedure Call (RPCE);i:\program files\common files\microsoft shared\speech\csvd.exe [2008-11-23 11573248]
S4 wowsystemcode123;Remote TCP/IP;i:\windows\system32\svchost.exe -k netsvcs [2008-5-19 14336]
=============== Created Last 30 ================
2009-01-06 12:16 --d----- i:\docume~1\brianl~1\applic~1\Malwarebytes
2009-01-06 12:16 15,504 a------- i:\windows\system32\drivers\mbam.sys
2009-01-06 12:16 38,496 a------- i:\windows\system32\drivers\mbamswissarmy.sys
2009-01-06 12:16 -cd----- i:\docume~1\alluse~1\applic~1\Malwarebytes
2009-01-05 22:45 31,812 a------- i:\windows\system32\BMXCtrlState-{00000002-00000000-00000008-00001102-00000004-20021102}.rfx
2009-01-05 22:45 31,812 a------- i:\windows\system32\BMXBkpCtrlState-{00000002-00000000-00000008-00001102-00000004-20021102}.rfx
2009-01-05 22:45 11,564 a------- i:\windows\system32\DVCState-{00000002-00000000-00000008-00001102-00000004-20021102}.rfx
2009-01-05 22:44 4,958,588 ----h--- i:\windows\{00000002-00000000-00000008-00001102-00000004-20021102}.BAK
2009-01-05 22:43 4,958,588 a------- i:\windows\{00000002-00000000-00000008-00001102-00000004-20021102}.CDF
2008-12-21 15:33 0 a------- i:\windows\1.ini
2008-12-15 17:52 --d----- i:\program files\Microsoft IntelliType Pro
2008-12-14 14:28 10,027 a------- i:\windows\system32\mspriv32.dll
2008-12-11 13:01 143,872 a------- i:\windows\system32\wow343_360.dll
2008-12-11 13:01 20 a------- i:\windows\syscheck
2008-12-09 10:39 --d----- i:\windows\NV37043024.TMP
2008-12-08 19:05 410,984 a------- i:\windows\system32\deploytk.dll
==================== Find3M ====================
2009-01-05 22:43 444,952 a------- i:\windows\system32\wrap_oal.dll
2009-01-05 22:43 109,080 a------- i:\windows\system32\OpenAL32.dll
2008-11-27 13:05 108,144 a------- i:\windows\system32\CmdLineExt.dll
2008-11-23 07:59 77,429 a------- i:\windows\War3Unin.dat
2008-11-23 07:58 139,264 a------- i:\windows\War3Unin.exe
2008-11-23 07:58 2,829 a------- i:\windows\War3Unin.pif
2008-11-23 07:47 4,224 a------- i:\windows\system32\drivers\beep.sys
2008-11-11 23:59 717,296 a------- i:\windows\system32\drivers\sptd.sys
2008-10-23 06:36 286,720 a------- i:\windows\system32\gdi32.dll
2008-10-17 13:39 43,520 a------- i:\windows\system32\CmdLineExt03.dll
2008-10-16 14:38 826,368 a------- i:\windows\system32\wininet.dll
2008-10-16 14:06 268,648 a------- i:\windows\system32\mucltui.dll
2008-10-16 14:06 208,744 a------- i:\windows\system32\muweb.dll
2008-07-13 11:24 22,328 a------- i:\docume~1\brianl~1\applic~1\PnkBstrK.sys
2008-06-08 13:07 32,768 ac-sh--- i:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008060820080609\index.dat
============= FINISH: 13:15:23.56 ===============

Hello.
Bad news.

Your computer has multiple infections, including a backdoor. A backdoor gives intruders complete control of your computer, logs your keystrokes, steal personal information, etc.

You are strongly advised to do the following:

• Disconnect the computer from the Internet and from any networked computers until it is cleaned.
  
• Back up all your important data except programs. The programs can be reinstalled back from the original disc or from the Net.
  
• Call all your banks, financial institutions, credit card companies and inform them that you may be a victim of identity theft and put a watch on your accounts. If you don't mind the hassle, change all your account numbers.
  
• From a clean computer, change all your passwords (ISP login password, your email address(es) passwords, financial accounts, PayPal, eBay, Amazon, online groups and forums and any other online activities you carry out which require a username and password).
  

Do NOT change your passwords from this computer as the attacker will be able to get all the new passwords and transaction records.

Due to its backdoor functionality, your computer is very likely to have been compromised and there is no way that it can be trusted again. Many experts in the security community believe that once infected with this type of Trojan, the best course of action would be to do a reformat and reinstallation of the operating system (OS). However, if you do not have the resources to reinstall your OS and would like me to attempt to clean your machine, I will be happy to do so.

To help you understand more, please take some time to read the following articles:

What are Remote Access Trojans and why are they dangerous
How do I respond to a possible identity theft and how do I prevent it
When should do a reformat and reinstallation of my OS
Where to backup your files
How to backup your files in Windows XP
Restoring your backups

Ok, I would really like to try and clean the machine as best as possible. I have many programs installed that I no longer have the ability to reinstall. What steps do I need to take for you to clean it?

We have to use Combofix for this then.

• Download combofix from here, use the top links - combofix.exe
  
• Please disable your local AV (Anti-virus) by right clicking it's icon in the tray, and exit it.
  
• Double click on ComboFix.exe.
  
• Follow the prompts. NOTE:
  
• ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
  ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***
  
  **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will automatically proceed with its scan.
  
  
  
• The Recovery Console provides a recovery/repair mode should a problem occur during a Combofix run.
  
  
  
  
• Allow ComboFix to download the Recovery Console.
  
• Accept the End-User License Agreement.
  
• The Recovery Console will be installed.
  
• You will then get this next prompt that asks if you want to continue the malware scan, select yes
  
  
  
  
• Allow combofix to run
  
• Post C:\combofix.txt back here.
  
  Note:
  Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
  

While that's running, quick question. Were these infections the reason that Firefox would not startup? Also, I was having lots of problems with my Creative Audio Drivers and such.

Not sure, there may be other reasons your sound doesn't work, drivers, etc.
We can focus on the other problems once this malware is gone.

Ok sounds good. In your experience, will this be enough or will I likely have to start from scratch?

ComboFix 09-01-05.05 - Brian Lutman 2009-01-06 14:01:20.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1424 [GMT -6:00]
Running from: i:\\documents and settings\\Brian Lutman\\Desktop\\Tools\\ComboFix.exe
AV: avast! antivirus 4.8.1296 [VPS 090106-0] *On-access scanning disabled* (Updated)
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
i:\\program files\\outlook
.
((((((((((((((((((((((((( Files Created from 2008-12-06 to 2009-01-06 )))))))))))))))))))))))))))))))
.
2009-01-06 13:43 . 2009-01-06 13:43 557,056 --a------ i:\\windows\\Mars Screensaver.scr
2009-01-06 12:16 . 2009-01-06 12:16
d-------- i:\\documents and settings\\Brian Lutman\\Application Data\\Malwarebytes
2009-01-06 12:16 . 2009-01-06 12:16
d----c--- i:\\documents and settings\\All Users\\Application Data\\Malwarebytes
2009-01-06 12:16 . 2009-01-04 18:41 38,496 --a------ i:\\windows\\system32\\drivers\\mbamswissarmy.sys
2009-01-06 12:16 . 2009-01-04 18:41 15,504 --a------ i:\\windows\\system32\\drivers\\mbam.sys
2009-01-05 22:45 . 2009-01-06 14:03 33,732 --a------ i:\\windows\\system32\\BMXCtrlState-{00000002-00000000-00000008-00001102-00000004-20021102}.rfx
2009-01-05 22:45 . 2009-01-06 14:03 33,732 --a------ i:\\windows\\system32\\BMXBkpCtrlState-{00000002-00000000-00000008-00001102-00000004-20021102}.rfx
2009-01-05 22:45 . 2009-01-06 14:03 11,564 --a------ i:\\windows\\system32\\DVCState-{00000002-00000000-00000008-00001102-00000004-20021102}.rfx
2009-01-05 22:44 . 2009-01-06 14:05 4,958,588 --a------ i:\\windows\\{00000002-00000000-00000008-00001102-00000004-20021102}.BAK
2009-01-05 22:43 . 2009-01-06 14:05 4,958,588 --a------ i:\\windows\\{00000002-00000000-00000008-00001102-00000004-20021102}.CDF
2008-12-21 15:33 . 2008-12-31 13:30 0 --a------ i:\\windows\\1.ini
2008-12-15 17:52 . 2008-12-15 17:52
d-------- i:\\program files\\Microsoft IntelliType Pro
2008-12-14 14:28 . 2006-01-01 01:04 10,027 --a------ i:\\windows\\system32\\mspriv32.dll
2008-12-11 13:01 . 2008-12-11 13:01 143,872 --a------ i:\\windows\\system32\\wow343_360.dll
2008-12-11 13:01 . 2008-12-11 13:01 20 --a------ i:\\windows\\syscheck
2008-12-09 10:39 . 2008-12-09 10:41
d-------- i:\\windows\\NV37043024.TMP
2008-12-08 21:47 . 2008-12-08 21:47
d-------- i:\\documents and settings\\NetworkService\\Application Data\\Webroot
2008-12-08 21:47 . 2008-12-08 21:47
d----c--- i:\\documents and settings\\Administrator
2008-12-08 19:05 . 2008-12-08 19:05 410,984 --a------ i:\\windows\\system32\\deploytk.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-06 19:38 --------- d-----w i:\\documents and settings\\Brian Lutman\\Application Data\\com.zipeg
2009-01-06 19:13 --------- d-----w i:\\program files\\Java
2009-01-06 04:43 --------- d--h--w i:\\program files\\InstallShield Installation Information
2009-01-06 04:43 --------- d-----w i:\\program files\\Creative
2009-01-06 04:43 --------- d-----w i:\\documents and settings\\Brian Lutman\\Application Data\\Creative
2008-12-17 23:26 --------- d-----w i:\\documents and settings\\Brian Lutman\\Application Data\\Ahead
2008-12-15 09:19 --------- d-----w i:\\program files\\Hitman Pro
2008-12-15 08:11 --------- d-----w i:\\documents and settings\\All Users\\Application Data\\Spybot - Search & Destroy
2008-12-15 06:27 --------- d-----w i:\\program files\\SpywareBlaster
2008-12-15 05:40 --------- d-----w i:\\documents and settings\\Brian Lutman\\Application Data\\VersionTracker Pro
2008-12-09 16:44 --------- d-----w i:\\documents and settings\\All Users\\Application Data\\nView_Profiles
2008-12-09 16:25 --------- d-----w i:\\program files\\SystemRequirementsLab
2008-12-09 16:25 --------- d-----w i:\\documents and settings\\Brian Lutman\\Application Data\\SystemRequirementsLab
2008-11-29 16:32 --------- dc----w i:\\documents and settings\\All Users\\Application Data\\Avg7
2008-11-29 16:31 --------- d-----w i:\\documents and settings\\All Users\\Application Data\\Grisoft
2008-11-29 09:02 --------- d-----w i:\\program files\\Microsoft ActiveSync
2008-11-29 06:44 --------- d-----w i:\\program files\\QuickTime
2008-11-29 04:18 --------- dc----w i:\\documents and settings\\All Users\\Application Data\\QuickTime
2008-11-29 02:29 --------- d--h--w i:\\program files\\Zero G Registry
2008-11-29 01:09 --------- dc----w i:\\documents and settings\\All Users\\Application Data\\Musicnotes
2008-11-28 16:12 --------- dc----w i:\\documents and settings\\All Users\\Application Data\\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-11-28 16:12 --------- d-----w i:\\program files\\iTunes
2008-11-28 16:12 --------- d-----w i:\\program files\\iPod
2008-11-28 16:12 --------- d-----w i:\\program files\\Common Files\\Apple
2008-11-27 18:55 --------- d-----w i:\\program files\\THQ
2008-11-27 06:27 --------- d-----w i:\\documents and settings\\Brian Lutman\\Application Data\\Windows Search
2008-11-27 06:04 --------- d-----w i:\\program files\\Common Files\\Adobe
2008-11-27 03:47 --------- dc----w i:\\documents and settings\\All Users\\Application Data\\FLEXnet
2008-11-26 19:50 --------- d-----w i:\\program files\\Common Files\\Macrovision Shared
2008-11-24 04:24 --------- d-----w i:\\program files\\TeaTimer (Spybot - Search & Destroy)
2008-11-24 04:24 --------- d-----w i:\\program files\\SDHelper (Spybot - Search & Destroy)
2008-11-24 04:24 --------- d-----w i:\\program files\\Misc. Support Library (Spybot - Search & Destroy)
2008-11-24 04:24 --------- d-----w i:\\program files\\File Scanner Library (Spybot - Search & Destroy)
2008-11-23 14:01 --------- dc----w i:\\documents and settings\\All Users\\Application Data\\Blizzard
2008-11-23 13:58 2,829 ----a-w i:\\windows\\War3Unin.pif
2008-11-23 13:58 139,264 ----a-w i:\\windows\\War3Unin.exe
2008-11-23 13:47 4,224 ----a-w i:\\windows\\system32\\drivers\\beep.sys
2008-11-23 05:41 --------- d-----w i:\\program files\\Common Files\\Blizzard Entertainment
2008-11-13 04:26 --------- d-----w i:\\documents and settings\\Brian Lutman\\Application Data\\Thinstall
2008-11-12 17:41 --------- d-----w i:\\program files\\Belarc
2008-11-12 05:59 717,296 ----a-w i:\\windows\\system32\\drivers\\sptd.sys
2008-11-12 05:59 --------- d-----w i:\\documents and settings\\Brian Lutman\\Application Data\\DAEMON Tools
2008-07-13 17:24 22,328 ----a-w i:\\documents and settings\\Brian Lutman\\Application Data\\PnkBstrK.sys
2008-06-08 19:07 32,768 -csha-w i:\\windows\\system32\\config\\systemprofile\\Local Settings\\History\\History.IE5\\MSHist012008060820080609\\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run]
"ctfmon.exe"="i:\\windows\\system32\\ctfmon.exe" [2008-04-13 15360]
"H/PC Connection Agent"="i:\\program files\\Microsoft ActiveSync\\wcescomm.exe" [2006-11-13 1289000]
"AlcoholAutomount"="j:\\program files\\Alcohol Soft\\Alcohol 120\\axcmd.exe" [2007-08-01 222592]
"DAEMON Tools Lite"="j:\\program files\\DAEMON Tools Lite\\daemon.exe" [2008-08-08 490952]
"CurseClient"="k:\\program files\\Curse\\CurseClient.exe" [2008-10-10 4789760]
[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run]
"NvCplDaemon"="i:\\windows\\system32\\NvCpl.dll" [2008-10-07 13574144]
"NeroFilterCheck"="i:\\program files\\Common Files\\Ahead\\Lib\\NeroCheck.exe" [2007-03-01 153136]
"CTSysVol"="i:\\program files\\Creative\\SBAudigy2ZS\\Surround Mixer\\CTSysVol.exe" [2003-09-17 57344]
"SBDrvDet"="i:\\program files\\Creative\\SB Drive Det\\SBDrvDet.exe" [2002-12-03 45056]
"avast!"="j:\\progra~1\\ALWILS~1\\Avast4\\ashDisp.exe" [2008-11-26 81000]
"Adobe Acrobat Speed Launcher"="j:\\program files\\Adobe\\Acrobat 9.0\\Acrobat\\Acrobat_sl.exe" [2008-06-12 37232]
"Acrobat Assistant 8.0"="j:\\program files\\Adobe\\Acrobat 9.0\\Acrobat\\Acrotray.exe" [2008-06-11 640376]
"iTunesHelper"="i:\\program files\\iTunes\\iTunesHelper.exe" [2008-11-20 290088]
"QuickTime Task"="i:\\program files\\QuickTime\\QTTask.exe" [2008-09-06 413696]
"CTDVDDET"="i:\\program files\\Creative\\SBAudigy2ZS\\DVDAudio\\CTDVDDET.EXE" [2003-06-18 45056]
"NvMediaCenter"="i:\\windows\\system32\\NvMcTray.dll" [2008-10-07 86016]
"itype"="i:\\program files\\Microsoft IntelliType Pro\\itype.exe" [2006-11-21 813912]
"SunJavaUpdateSched"="i:\\program files\\Java\\jre6\\bin\\jusched.exe" [2008-12-08 136600]
"nwiz"="nwiz.exe" [2008-10-07 i:\\windows\\system32\\nwiz.exe]
"CTxfiHlp"="CTXFIHLP.EXE" [2006-08-11 i:\\windows\\system32\\CTXFIHLP.EXE]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2005-07-22 i:\\windows\\KHALMNPR.Exe]
"CTHelper"="CTHELPER.EXE" [2008-06-27 i:\\windows\\system32\\CtHelper.exe]
"CTXFIREG"="CTxfiReg.exe" [2006-08-11 i:\\windows\\system32\\CTXFIREG.EXE]
[hkey_local_machine\\software\\microsoft\\windows\\currentversion\\explorer\\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "i:\\program files\\Windows Desktop Search\\MSNLNamespaceMgr.dll" [2008-05-26 304128]
[HKEY_LOCAL_MACHINE\\software\\microsoft\\windows nt\\currentversion\\windows]
"AppInit_DLLs"=acaptuser32.dll
[HKEY_LOCAL_MACHINE\\software\\microsoft\\shared tools\\msconfig\\startupreg\\Creative WebCam Tray]
--------- 2005-10-27 17:00 299008 i:\\program files\\Creative\\Shared Files\\CamTray.exe
[HKEY_LOCAL_MACHINE\\software\\microsoft\\shared tools\\msconfig\\startupreg\\iTunesHelper]
--a------ 2008-11-20 13:20 290088 i:\\program files\\iTunes\\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\\software\\microsoft\\shared tools\\msconfig\\startupreg\\MtdAcqu]
--------- 2006-03-08 08:56 278528 i:\\progra~1\\Creative\\MEDIAS~1\\MtdAcqu.exe
[HKEY_LOCAL_MACHINE\\software\\microsoft\\shared tools\\msconfig\\startupreg\\UpdReg]
--------- 2000-05-11 01:00 90112 i:\\windows\\Updreg.EXE
[HKLM\\~\\services\\sharedaccess\\parameters\\firewallpolicy\\standardprofile\\AuthorizedApplications\\List]
"i:\\\\WINDOWS\\\\system32\\\\sessmgr.exe"=
"i:\\\\Program Files\\\\iTunes\\\\iTunes.exe"=
"i:\\\\Program Files\\\\Microsoft ActiveSync\\\\rapimgr.exe"=
"k:\\\\Program Files\\\\Curse\\\\CurseClient.exe"=
R1 aswSP;avast! Self Protection;i:\\windows\\system32\\drivers\\aswSP.sys [2008-05-29 111184]
R3 COMMONFX.SYS;COMMONFX.SYS;i:\\windows\\system32\\drivers\\COMMONFX.sys [2008-06-27 99352]
R3 CTAUDFX.SYS;CTAUDFX.SYS;i:\\windows\\system32\\drivers\\CTAUDFX.sys [2008-06-27 555032]
R3 CTSBLFX.SYS;CTSBLFX.SYS;i:\\windows\\system32\\drivers\\CTSBLFX.sys [2008-06-27 566296]
R3 ipgd;IC Plus IP1000 Family Gigabit Ethernet Adapter Driver;i:\\windows\\system32\\drivers\\ipgdnd51.sys [2007-11-17 33536]
R3 L6DP;L6DP;i:\\windows\\system32\\drivers\\l6dp.sys [2007-01-29 29312]
R3 WinMTBus;WinMount Bus;i:\\windows\\system32\\drivers\\WinMTBus.sys [2008-02-25 196224]
R4 aswFsBlk;aswFsBlk;i:\\windows\\system32\\drivers\\aswFsBlk.sys [2008-05-29 20560]
R4 wowsystemcode123;Remote TCP/IP;i:\\windows\\System32\\svchost.exe -k netsvcs [2008-05-19 14336]
S1 vcdrom;Virtual CD-ROM Device Driver;\\??\\i:\\windows\\system32\\drivers\\VCdRom.sys --> i:\\windows\\system32\\drivers\\VCdRom.sys [?]
S3 bcgame;Nostromo HID Device Minidriver;i:\\windows\\system32\\drivers\\bcgame.sys [2003-07-24 22821]
S3 COMMONFX;COMMONFX;i:\\windows\\system32\\drivers\\COMMONFX.sys [2008-06-27 99352]
S3 CTAUDFX;CTAUDFX;i:\\windows\\system32\\drivers\\CTAUDFX.sys [2008-06-27 555032]
S3 CTERFXFX.SYS;CTERFXFX.SYS;i:\\windows\\system32\\drivers\\CTERFXFX.sys [2008-06-27 100888]
S3 CTERFXFX;CTERFXFX;i:\\windows\\system32\\drivers\\CTERFXFX.sys [2008-06-27 100888]
S3 CTSBLFX;CTSBLFX;i:\\windows\\system32\\drivers\\CTSBLFX.sys [2008-06-27 566296]
S3 L6PODLV;PODxt Live Service;i:\\windows\\system32\\drivers\\L6PODLV.sys [2007-01-29 609408]
S3 P1171VID;Creative WebCam Notebook #2;i:\\windows\\system32\\drivers\\P1171Vid.sys [2008-05-18 91392]
S3 ptuc_bus;PANTECH Mobile USB Devices;i:\\windows\\system32\\drivers\\ptuc_bus.sys [2008-04-15 22272]
S3 ptuc_flt;PANTECH USB Filter Service;i:\\windows\\system32\\drivers\\ptuc_flt.sys [2008-04-15 3584]
S3 ptuc_mdm;PANTECH USB Packet Services;i:\\windows\\system32\\drivers\\ptuc_mdm.sys [2008-04-15 40448]
S3 ptuc_prt;PANTECH UMTS Diagnostic Serial Ports;i:\\windows\\system32\\drivers\\ptuc_prt.sys [2008-04-15 39296]
S3 sdAuxService;PC Tools Auxiliary Service;i:\\program files\\Spyware Doctor\\pctsAuxs.exe [2008-05-23 337800]
S3 uisp;Motorola USB ICP driver;i:\\windows\\system32\\Drivers\\usbicp.sys --> i:\\windows\\system32\\Drivers\\usbicp.sys [?]
S4 RPCHE;Remote Procedure Call (RPCE);i:\\program files\\Common Files\\Microsoft Shared\\Speech\\csvd.exe [2008-11-23 11573248]
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Svchost - NetSvcs
wowsystemcode123
[HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\mountpoints2\\{16289d40-e370-11dc-bf99-00121766ddbe}]
\\Shell\\AutoRun\\command - e:\\ctrun\\Start.EXE
[HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\mountpoints2\\{76645146-b0dc-11dd-adb1-00121766ddbe}]
\\Shell\\AutoRun\\command - F:\\Setup.exe
\\Shell\\setup\\command - F:\\setup.exe
[HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\mountpoints2\\{da29fc95-afaa-11dd-adaf-00121766ddbe}]
\\Shell\\AutoRun\\command - C:\\Setup.exe
\\Shell\\setup\\command - C:\\setup.exe
[HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\mountpoints2\\{da29fc97-afaa-11dd-adaf-00121766ddbe}]
\\Shell\\AutoRun\\command - E:\\Setup.exe
\\Shell\\setup\\command - E:\\setup.exe
.
Contents of the 'Scheduled Tasks' folder
2008-12-26 i:\\windows\\Tasks\\AppleSoftwareUpdate.job
- i:\\program files\\Apple Software Update\\SoftwareUpdate.exe [2008-07-30 11:34]
2008-12-22 i:\\windows\\Tasks\\Uniblue SpeedUpMyPC Nag.job
- j:\\program files\\Uniblue\\SpeedUpMyPC 3\\SpeedUpMyPC.exe []
2007-12-08 i:\\windows\\Tasks\\Uniblue SpeedUpMyPC.job
- j:\\program files\\Uniblue\\SpeedUpMyPC 3\\SpeedUpMyPC.exe []
.
.

------- Supplementary Scan -------
.
uStart Page = about:blank
mStart Page = about:blank
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
IE: Append Link Target to Existing PDF - i:\\program files\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - i:\\program files\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - i:\\program files\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - i:\\program files\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - i:\\progra~1\\MICROS~2\\OFFICE11\\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - j:\\program files\\WIDCOMM\\Bluetooth Software\\btsendto_ie_ctx.htm
IE: Send To Bluetooth - j:\\program files\\WIDCOMM\\Bluetooth Software\\btsendto_ie.htm
Trusted Zone: free.aol.com
TCP: {41F4C6D2-56A5-4F93-9C4E-F2ECB3D3FABF} = 192.168.255.3
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - i:\\program files\\Logitech\\Desktop Messenger\\8876480\\Program\\GAPlugProtocol-8876480.dll
i:\\windows\\Downloaded Program Files\\CTSUEng.ocx - i:\\windows\\Downloaded Program Files\\CTSUEngn.ocx
O16 -: {6C269571-C6D7-4818-BCA4-32A035E8C884}
hxxp://www.creative.com/softwareupdate/su/ocx/15101/CTSUEng.cab
i:\\windows\\Downloaded Program Files\\CTSUEng.inf
FF - ProfilePath - i:\\documents and settings\\Brian Lutman\\Application Data\\Mozilla\\Firefox\\Profiles\\va1sfrdi.default\\
FF - plugin: i:\\program files\\Microsoft Silverlight\\2.0.31005.0\\npctrl.1.0.30716.0.dll
FF - plugin: i:\\program files\\Microsoft Silverlight\\2.0.31005.0\\npctrl.dll
FF - plugin: j:\\program files\\Adobe\\Acrobat 9.0\\Acrobat\\browser\\nppdf32.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-06 14:05:26
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run
CTHelper = CTHELPER.EXE?
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(652)
i:\\windows\\system32\\WRLogonNTF.dll
.
------------------------ Other Running Processes ------------------------
.
j:\\program files\\WIDCOMM\\Bluetooth Software\\bin\\btwdins.exe
j:\\program files\\Alwil Software\\Avast4\\aswUpdSv.exe
j:\\program files\\Alwil Software\\Avast4\\ashServ.exe
i:\\program files\\Common Files\\Apple\\Mobile Device Support\\bin\\AppleMobileDeviceService.exe
i:\\program files\\Grisoft\\AVG Anti-Spyware 7.5\\guard.exe
i:\\program files\\Bonjour\\mDNSResponder.exe
i:\\windows\\system32\\CTSVCCDA.EXE
i:\\program files\\Java\\jre6\\bin\\jqs.exe
i:\\windows\\system32\\rundll32.exe
i:\\windows\\system32\\rundll32.exe
i:\\windows\\system32\\nvsvc32.exe
i:\\windows\\system32\\PnkBstrA.exe
i:\\progra~1\\MICROS~3\\rapimgr.exe
j:\\program files\\Alcohol Soft\\Alcohol 120\\StarWind\\StarWindServiceAE.exe
i:\\program files\\Webroot\\Spy Sweeper\\SpySweeper.exe
i:\\windows\\system32\\searchindexer.exe
j:\\program files\\Alwil Software\\Avast4\\ashMaiSv.exe
j:\\program files\\Alwil Software\\Avast4\\ashWebSv.exe
i:\\program files\\iPod\\bin\\iPodService.exe
i:\\windows\\system32\\searchprotocolhost.exe
i:\\windows\\system32\\searchfilterhost.exe
.
**************************************************************************
.
Completion time: 2009-01-06 14:08:48 - machine was rebooted
ComboFix-quarantined-files.txt 2009-01-06 20:08:37
Pre-Run: 58,196,459,520 bytes free
Post-Run: 59,024,551,936 bytes free
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\\WINDOWS
[operating systems]
i:\\cmdcons\\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn
253 --- E O F --- 2008-12-18 16:20:58

Now open a new notepad file.
Input this into the notepad file:

KILLALL::

Driver::
wowsystemcode123

NetSvc::
wowsystemcode123

File::
i:\windows\system32\wow343_360.dll
i:\windows\1.ini

Folder::
i:\windows\syscheck

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{16289d40-e370-11dc-bf99-00121766ddbe}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{76645146-b0dc-11dd-adb1-00121766ddbe}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{da29fc95-afaa-11dd-adaf-00121766ddbe}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{da29fc97-afaa-11dd-adaf-00121766ddbe}]

Save this as CFScript.txt, save it to your desktop also.
Then drag and drop CFScript.txt into combofix as seen below:


This will open combofix.exe again, agree to it's terms and allow it to run, it may want to reboot after it's done. Post the resulting log back here.

ComboFix 09-01-05.05 - Brian Lutman 2009-01-06 14:31:03.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1487 [GMT -6:00]
Running from: i:\\documents and settings\\Brian Lutman\\Desktop\\ComboFix.exe
Command switches used :: i:\\documents and settings\\Brian Lutman\\Desktop\\CFScript.txt
AV: avast! antivirus 4.8.1296 [VPS 090106-1] *On-access scanning disabled* (Updated)
* Created a new restore point
FILE ::
i:\\windows\\1.ini
i:\\windows\\system32\\wow343_360.dll
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
i:\\windows\\1.ini
i:\\windows\\system32\\wow343_360.dll
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\\Legacy_WOWSYSTEMCODE123
-------\\Service_wowsystemcode123

((((((((((((((((((((((((( Files Created from 2008-12-06 to 2009-01-06 )))))))))))))))))))))))))))))))
.
2009-01-06 13:43 . 2009-01-06 13:43 557,056 --a------ i:\\windows\\Mars Screensaver.scr
2009-01-06 12:16 . 2009-01-06 12:16
d-------- i:\\documents and settings\\Brian Lutman\\Application Data\\Malwarebytes
2009-01-06 12:16 . 2009-01-06 12:16
d----c--- i:\\documents and settings\\All Users\\Application Data\\Malwarebytes
2009-01-06 12:16 . 2009-01-04 18:41 38,496 --a------ i:\\windows\\system32\\drivers\\mbamswissarmy.sys
2009-01-06 12:16 . 2009-01-04 18:41 15,504 --a------ i:\\windows\\system32\\drivers\\mbam.sys
2009-01-05 22:45 . 2009-01-06 14:33 31,812 --a------ i:\\windows\\system32\\BMXCtrlState-{00000002-00000000-00000008-00001102-00000004-20021102}.rfx
2009-01-05 22:45 . 2009-01-06 14:33 31,812 --a------ i:\\windows\\system32\\BMXBkpCtrlState-{00000002-00000000-00000008-00001102-00000004-20021102}.rfx
2009-01-05 22:45 . 2009-01-06 14:33 11,564 --a------ i:\\windows\\system32\\DVCState-{00000002-00000000-00000008-00001102-00000004-20021102}.rfx
2009-01-05 22:44 . 2009-01-06 14:35 4,958,588 --a------ i:\\windows\\{00000002-00000000-00000008-00001102-00000004-20021102}.BAK
2009-01-05 22:43 . 2009-01-06 14:35 4,958,588 --a------ i:\\windows\\{00000002-00000000-00000008-00001102-00000004-20021102}.CDF
2008-12-15 17:52 . 2008-12-15 17:52
d-------- i:\\program files\\Microsoft IntelliType Pro
2008-12-14 14:28 . 2006-01-01 01:04 10,027 --a------ i:\\windows\\system32\\mspriv32.dll
2008-12-11 13:01 . 2008-12-11 13:01 20 --a------ i:\\windows\\syscheck
2008-12-09 10:39 . 2008-12-09 10:41
d-------- i:\\windows\\NV37043024.TMP
2008-12-08 21:47 . 2008-12-08 21:47
d-------- i:\\documents and settings\\NetworkService\\Application Data\\Webroot
2008-12-08 21:47 . 2008-12-08 21:47
d----c--- i:\\documents and settings\\Administrator
2008-12-08 19:05 . 2008-12-08 19:05 410,984 --a------ i:\\windows\\system32\\deploytk.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-06 19:38 --------- d-----w i:\\documents and settings\\Brian Lutman\\Application Data\\com.zipeg
2009-01-06 19:13 --------- d-----w i:\\program files\\Java
2009-01-06 04:43 --------- d--h--w i:\\program files\\InstallShield Installation Information
2009-01-06 04:43 --------- d-----w i:\\program files\\Creative
2009-01-06 04:43 --------- d-----w i:\\documents and settings\\Brian Lutman\\Application Data\\Creative
2008-12-17 23:26 --------- d-----w i:\\documents and settings\\Brian Lutman\\Application Data\\Ahead
2008-12-15 09:19 --------- d-----w i:\\program files\\Hitman Pro
2008-12-15 08:11 --------- d-----w i:\\documents and settings\\All Users\\Application Data\\Spybot - Search & Destroy
2008-12-15 06:27 --------- d-----w i:\\program files\\SpywareBlaster
2008-12-15 05:40 --------- d-----w i:\\documents and settings\\Brian Lutman\\Application Data\\VersionTracker Pro
2008-12-09 16:44 --------- d-----w i:\\documents and settings\\All Users\\Application Data\\nView_Profiles
2008-12-09 16:25 --------- d-----w i:\\program files\\SystemRequirementsLab
2008-12-09 16:25 --------- d-----w i:\\documents and settings\\Brian Lutman\\Application Data\\SystemRequirementsLab
2008-11-29 16:32 --------- dc----w i:\\documents and settings\\All Users\\Application Data\\Avg7
2008-11-29 16:31 --------- d-----w i:\\documents and settings\\All Users\\Application Data\\Grisoft
2008-11-29 09:02 --------- d-----w i:\\program files\\Microsoft ActiveSync
2008-11-29 06:44 --------- d-----w i:\\program files\\QuickTime
2008-11-29 04:18 --------- dc----w i:\\documents and settings\\All Users\\Application Data\\QuickTime
2008-11-29 02:29 --------- d--h--w i:\\program files\\Zero G Registry
2008-11-29 01:09 --------- dc----w i:\\documents and settings\\All Users\\Application Data\\Musicnotes
2008-11-28 16:12 --------- dc----w i:\\documents and settings\\All Users\\Application Data\\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-11-28 16:12 --------- d-----w i:\\program files\\iTunes
2008-11-28 16:12 --------- d-----w i:\\program files\\iPod
2008-11-28 16:12 --------- d-----w i:\\program files\\Common Files\\Apple
2008-11-27 18:55 --------- d-----w i:\\program files\\THQ
2008-11-27 06:27 --------- d-----w i:\\documents and settings\\Brian Lutman\\Application Data\\Windows Search
2008-11-27 06:04 --------- d-----w i:\\program files\\Common Files\\Adobe
2008-11-27 03:47 --------- dc----w i:\\documents and settings\\All Users\\Application Data\\FLEXnet
2008-11-26 19:50 --------- d-----w i:\\program files\\Common Files\\Macrovision Shared
2008-11-24 04:24 --------- d-----w i:\\program files\\TeaTimer (Spybot - Search & Destroy)
2008-11-24 04:24 --------- d-----w i:\\program files\\SDHelper (Spybot - Search & Destroy)
2008-11-24 04:24 --------- d-----w i:\\program files\\Misc. Support Library (Spybot - Search & Destroy)
2008-11-24 04:24 --------- d-----w i:\\program files\\File Scanner Library (Spybot - Search & Destroy)
2008-11-23 14:01 --------- dc----w i:\\documents and settings\\All Users\\Application Data\\Blizzard
2008-11-23 13:58 2,829 ----a-w i:\\windows\\War3Unin.pif
2008-11-23 13:58 139,264 ----a-w i:\\windows\\War3Unin.exe
2008-11-23 13:47 4,224 ----a-w i:\\windows\\system32\\drivers\\beep.sys
2008-11-23 05:41 --------- d-----w i:\\program files\\Common Files\\Blizzard Entertainment
2008-11-13 04:26 --------- d-----w i:\\documents and settings\\Brian Lutman\\Application Data\\Thinstall
2008-11-12 17:41 --------- d-----w i:\\program files\\Belarc
2008-11-12 05:59 717,296 ----a-w i:\\windows\\system32\\drivers\\sptd.sys
2008-11-12 05:59 --------- d-----w i:\\documents and settings\\Brian Lutman\\Application Data\\DAEMON Tools
2008-07-13 17:24 22,328 ----a-w i:\\documents and settings\\Brian Lutman\\Application Data\\PnkBstrK.sys
2008-06-08 19:07 32,768 -csha-w i:\\windows\\system32\\config\\systemprofile\\Local Settings\\History\\History.IE5\\MSHist012008060820080609\\index.dat
.
((((((((((((((((((((((((((((( snapshot@2009-01-06_14.07.14.60 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-01-06 20:34:25 16,384 ----atw i:\\windows\\Temp\\Perflib_Perfdata_3d8.dat
+ 2009-01-06 20:34:15 16,384 ----atw i:\\windows\\Temp\\Perflib_Perfdata_618.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run]
"ctfmon.exe"="i:\\windows\\system32\\ctfmon.exe" [2008-04-13 15360]
"H/PC Connection Agent"="i:\\program files\\Microsoft ActiveSync\\wcescomm.exe" [2006-11-13 1289000]
"AlcoholAutomount"="j:\\program files\\Alcohol Soft\\Alcohol 120\\axcmd.exe" [2007-08-01 222592]
"DAEMON Tools Lite"="j:\\program files\\DAEMON Tools Lite\\daemon.exe" [2008-08-08 490952]
"CurseClient"="k:\\program files\\Curse\\CurseClient.exe" [2008-10-10 4789760]
[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run]
"NvCplDaemon"="i:\\windows\\system32\\NvCpl.dll" [2008-10-07 13574144]
"NeroFilterCheck"="i:\\program files\\Common Files\\Ahead\\Lib\\NeroCheck.exe" [2007-03-01 153136]
"CTSysVol"="i:\\program files\\Creative\\SBAudigy2ZS\\Surround Mixer\\CTSysVol.exe" [2003-09-17 57344]
"SBDrvDet"="i:\\program files\\Creative\\SB Drive Det\\SBDrvDet.exe" [2002-12-03 45056]
"avast!"="j:\\progra~1\\ALWILS~1\\Avast4\\ashDisp.exe" [2008-11-26 81000]
"Adobe Acrobat Speed Launcher"="j:\\program files\\Adobe\\Acrobat 9.0\\Acrobat\\Acrobat_sl.exe" [2008-06-12 37232]
"Acrobat Assistant 8.0"="j:\\program files\\Adobe\\Acrobat 9.0\\Acrobat\\Acrotray.exe" [2008-06-11 640376]
"iTunesHelper"="i:\\program files\\iTunes\\iTunesHelper.exe" [2008-11-20 290088]
"QuickTime Task"="i:\\program files\\QuickTime\\QTTask.exe" [2008-09-06 413696]
"CTDVDDET"="i:\\program files\\Creative\\SBAudigy2ZS\\DVDAudio\\CTDVDDET.EXE" [2003-06-18 45056]
"NvMediaCenter"="i:\\windows\\system32\\NvMcTray.dll" [2008-10-07 86016]
"itype"="i:\\program files\\Microsoft IntelliType Pro\\itype.exe" [2006-11-21 813912]
"SunJavaUpdateSched"="i:\\program files\\Java\\jre6\\bin\\jusched.exe" [2008-12-08 136600]
"nwiz"="nwiz.exe" [2008-10-07 i:\\windows\\system32\\nwiz.exe]
"CTxfiHlp"="CTXFIHLP.EXE" [2006-08-11 i:\\windows\\system32\\CTXFIHLP.EXE]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2005-07-22 i:\\windows\\KHALMNPR.Exe]
"CTHelper"="CTHELPER.EXE" [2008-06-27 i:\\windows\\system32\\CtHelper.exe]
"CTXFIREG"="CTxfiReg.exe" [2006-08-11 i:\\windows\\system32\\CTXFIREG.EXE]
[hkey_local_machine\\software\\microsoft\\windows\\currentversion\\explorer\\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "i:\\program files\\Windows Desktop Search\\MSNLNamespaceMgr.dll" [2008-05-26 304128]
[HKEY_LOCAL_MACHINE\\software\\microsoft\\windows nt\\currentversion\\windows]
"AppInit_DLLs"=acaptuser32.dll
[HKEY_LOCAL_MACHINE\\software\\microsoft\\shared tools\\msconfig\\startupreg\\Creative WebCam Tray]
--------- 2005-10-27 17:00 299008 i:\\program files\\Creative\\Shared Files\\CamTray.exe
[HKEY_LOCAL_MACHINE\\software\\microsoft\\shared tools\\msconfig\\startupreg\\iTunesHelper]
--a------ 2008-11-20 13:20 290088 i:\\program files\\iTunes\\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\\software\\microsoft\\shared tools\\msconfig\\startupreg\\MtdAcqu]
--------- 2006-03-08 08:56 278528 i:\\progra~1\\Creative\\MEDIAS~1\\MtdAcqu.exe
[HKEY_LOCAL_MACHINE\\software\\microsoft\\shared tools\\msconfig\\startupreg\\UpdReg]
--------- 2000-05-11 01:00 90112 i:\\windows\\Updreg.EXE
[HKLM\\~\\services\\sharedaccess\\parameters\\firewallpolicy\\standardprofile\\AuthorizedApplications\\List]
"i:\\\\WINDOWS\\\\system32\\\\sessmgr.exe"=
"i:\\\\Program Files\\\\iTunes\\\\iTunes.exe"=
"i:\\\\Program Files\\\\Microsoft ActiveSync\\\\rapimgr.exe"=
"k:\\\\Program Files\\\\Curse\\\\CurseClient.exe"=
R1 aswSP;avast! Self Protection;i:\\windows\\system32\\drivers\\aswSP.sys [2008-05-29 111184]
R3 COMMONFX.SYS;COMMONFX.SYS;i:\\windows\\system32\\drivers\\COMMONFX.sys [2008-06-27 99352]
R3 CTAUDFX.SYS;CTAUDFX.SYS;i:\\windows\\system32\\drivers\\CTAUDFX.sys [2008-06-27 555032]
R3 CTSBLFX.SYS;CTSBLFX.SYS;i:\\windows\\system32\\drivers\\CTSBLFX.sys [2008-06-27 566296]
R3 ipgd;IC Plus IP1000 Family Gigabit Ethernet Adapter Driver;i:\\windows\\system32\\drivers\\ipgdnd51.sys [2007-11-17 33536]
R3 L6DP;L6DP;i:\\windows\\system32\\drivers\\l6dp.sys [2007-01-29 29312]
R3 WinMTBus;WinMount Bus;i:\\windows\\system32\\drivers\\WinMTBus.sys [2008-02-25 196224]
R4 aswFsBlk;aswFsBlk;i:\\windows\\system32\\drivers\\aswFsBlk.sys [2008-05-29 20560]
S1 vcdrom;Virtual CD-ROM Device Driver;\\??\\i:\\windows\\system32\\drivers\\VCdRom.sys --> i:\\windows\\system32\\drivers\\VCdRom.sys [?]
S3 bcgame;Nostromo HID Device Minidriver;i:\\windows\\system32\\drivers\\bcgame.sys [2003-07-24 22821]
S3 COMMONFX;COMMONFX;i:\\windows\\system32\\drivers\\COMMONFX.sys [2008-06-27 99352]
S3 CTAUDFX;CTAUDFX;i:\\windows\\system32\\drivers\\CTAUDFX.sys [2008-06-27 555032]
S3 CTERFXFX.SYS;CTERFXFX.SYS;i:\\windows\\system32\\drivers\\CTERFXFX.sys [2008-06-27 100888]
S3 CTERFXFX;CTERFXFX;i:\\windows\\system32\\drivers\\CTERFXFX.sys [2008-06-27 100888]
S3 CTSBLFX;CTSBLFX;i:\\windows\\system32\\drivers\\CTSBLFX.sys [2008-06-27 566296]
S3 L6PODLV;PODxt Live Service;i:\\windows\\system32\\drivers\\L6PODLV.sys [2007-01-29 609408]
S3 P1171VID;Creative WebCam Notebook #2;i:\\windows\\system32\\drivers\\P1171Vid.sys [2008-05-18 91392]
S3 ptuc_bus;PANTECH Mobile USB Devices;i:\\windows\\system32\\drivers\\ptuc_bus.sys [2008-04-15 22272]
S3 ptuc_flt;PANTECH USB Filter Service;i:\\windows\\system32\\drivers\\ptuc_flt.sys [2008-04-15 3584]
S3 ptuc_mdm;PANTECH USB Packet Services;i:\\windows\\system32\\drivers\\ptuc_mdm.sys [2008-04-15 40448]
S3 ptuc_prt;PANTECH UMTS Diagnostic Serial Ports;i:\\windows\\system32\\drivers\\ptuc_prt.sys [2008-04-15 39296]
S3 sdAuxService;PC Tools Auxiliary Service;i:\\program files\\Spyware Doctor\\pctsAuxs.exe [2008-05-23 337800]
S3 uisp;Motorola USB ICP driver;i:\\windows\\system32\\Drivers\\usbicp.sys --> i:\\windows\\system32\\Drivers\\usbicp.sys [?]
S4 RPCHE;Remote Procedure Call (RPCE);i:\\program files\\Common Files\\Microsoft Shared\\Speech\\csvd.exe [2008-11-23 11573248]
.
Contents of the 'Scheduled Tasks' folder
2008-12-26 i:\\windows\\Tasks\\AppleSoftwareUpdate.job
- i:\\program files\\Apple Software Update\\SoftwareUpdate.exe [2008-07-30 11:34]
2008-12-22 i:\\windows\\Tasks\\Uniblue SpeedUpMyPC Nag.job
- j:\\program files\\Uniblue\\SpeedUpMyPC 3\\SpeedUpMyPC.exe []
2007-12-08 i:\\windows\\Tasks\\Uniblue SpeedUpMyPC.job
- j:\\program files\\Uniblue\\SpeedUpMyPC 3\\SpeedUpMyPC.exe []
.
.

------- Supplementary Scan -------
.
uStart Page = about:blank
mStart Page = about:blank
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
IE: Append Link Target to Existing PDF - i:\\program files\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - i:\\program files\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - i:\\program files\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - i:\\program files\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - i:\\progra~1\\MICROS~2\\OFFICE11\\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - j:\\program files\\WIDCOMM\\Bluetooth Software\\btsendto_ie_ctx.htm
IE: Send To Bluetooth - j:\\program files\\WIDCOMM\\Bluetooth Software\\btsendto_ie.htm
Trusted Zone: free.aol.com
TCP: {41F4C6D2-56A5-4F93-9C4E-F2ECB3D3FABF} = 192.168.255.3
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - i:\\program files\\Logitech\\Desktop Messenger\\8876480\\Program\\GAPlugProtocol-8876480.dll
i:\\windows\\Downloaded Program Files\\CTSUEng.ocx - i:\\windows\\Downloaded Program Files\\CTSUEngn.ocx
O16 -: {6C269571-C6D7-4818-BCA4-32A035E8C884}
hxxp://www.creative.com/softwareupdate/su/ocx/15101/CTSUEng.cab
i:\\windows\\Downloaded Program Files\\CTSUEng.inf
FF - ProfilePath - i:\\documents and settings\\Brian Lutman\\Application Data\\Mozilla\\Firefox\\Profiles\\va1sfrdi.default\\
FF - plugin: i:\\program files\\Microsoft Silverlight\\2.0.31005.0\\npctrl.1.0.30716.0.dll
FF - plugin: i:\\program files\\Microsoft Silverlight\\2.0.31005.0\\npctrl.dll
FF - plugin: j:\\program files\\Adobe\\Acrobat 9.0\\Acrobat\\browser\\nppdf32.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-06 14:35:07
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run
CTHelper = CTHELPER.EXE?
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(656)
i:\\windows\\system32\\WRLogonNTF.dll
.
------------------------ Other Running Processes ------------------------
.
j:\\program files\\WIDCOMM\\Bluetooth Software\\bin\\btwdins.exe
j:\\program files\\Alwil Software\\Avast4\\aswUpdSv.exe
j:\\program files\\Alwil Software\\Avast4\\ashServ.exe
i:\\program files\\Common Files\\Apple\\Mobile Device Support\\bin\\AppleMobileDeviceService.exe
i:\\program files\\Grisoft\\AVG Anti-Spyware 7.5\\guard.exe
i:\\program files\\Bonjour\\mDNSResponder.exe
i:\\windows\\system32\\CTSVCCDA.EXE
i:\\program files\\Java\\jre6\\bin\\jqs.exe
i:\\windows\\system32\\nvsvc32.exe
i:\\windows\\system32\\PnkBstrA.exe
i:\\windows\\system32\\rundll32.exe
i:\\windows\\system32\\rundll32.exe
j:\\program files\\Alcohol Soft\\Alcohol 120\\StarWind\\StarWindServiceAE.exe
i:\\program files\\Webroot\\Spy Sweeper\\SpySweeper.exe
i:\\progra~1\\MICROS~3\\rapimgr.exe
i:\\windows\\system32\\searchindexer.exe
j:\\program files\\Alwil Software\\Avast4\\ashMaiSv.exe
j:\\program files\\Alwil Software\\Avast4\\ashWebSv.exe
i:\\program files\\iPod\\bin\\iPodService.exe
i:\\windows\\system32\\searchprotocolhost.exe
i:\\windows\\system32\\searchfilterhost.exe
.
**************************************************************************
.
Completion time: 2009-01-06 14:38:35 - machine was rebooted
ComboFix-quarantined-files.txt 2009-01-06 20:38:20
ComboFix2.txt 2009-01-06 20:08:51
Pre-Run: 59,003,187,200 bytes free
Post-Run: 58,992,230,400 bytes free
245 --- E O F --- 2008-12-18 16:20:58

Hello.
Please delete folder in bold, CF didn't get it because of my spelling error.
i:\windows\syscheck

What problems remain? (aside from the sound, we already know about that)

I'm not showing a folder labeled "syscheck" I see a file with that label, is that what I need to delete?

It maybe hidden.

1. Open My Computer.
   
2. Go to Tools > Folder Options.
   
3. Select the View tab.
   
4. Scroll down to Hidden files and folders.
   
5. Select Show hidden files and folders.
   
6. Uncheck (untick) Hide extensions of known file types.
   
7. Uncheck (untick) Hide protected operating system files (Recommended).
   
8. Click Yes when prompted.
   
9. Click OK.
   
10. Close My Computer.
    

Can you see the folder now?

I already have the view hidden files option selected, but I checked again to make sure and still no folder by that name.

Ah, okay.
Don't delete the file then.
If no problems remain here, we can focus on the audio problems.

The audio problem has been highly intermittent and the audio is currently functioning fine, although I am not using my surround speakers right now. The problem has usually been fixed by me reinstalling the drivers which, while not that bad, is a pain in the butt!

Ah, okay.
Well if it's working for now, I'm gonna leave it alone, don't fix what isn't broken.

Amen to that! Thanks for all your help! I agree with "flashthedeveloper' that you guys should consider putting up some kind of paypal donation option so that we Noobs can properly thank y'all for all of your time!!

Haha, we don't take donations currently.
But if you want to, PM the Doctor_Inferno and ask him to open a Paypal, if enough ask, he'll do it I'm sure.
We do not ask for donations or how much users donate, what you donate is your choice.

Yeah I will probably do that! One more thing. Is there a good, free firewall that you would recommend to me? Right now I am using the Windows Firewall, but I assume that there are better ones out there?

Haha, I forgot about this bit.

We need to make a new restore point.

To turn off System Restore, follow these steps:
1. Click Start, right-click My Computer, and then click Properties.
2. Click the System Restore tab.
3. Click the Turn off System Restore check box (or the Turn off System Restore on all drives check box), and then click OK.
4. Click Yes when you receive the prompt to the turn off System Restore.

Now we need to make a new restore point.
To turn on System Restore, follow these steps:
1. Click Start, right-click My Computer, and then click Properties.
2. Click the System Restore tab.
3. Click the Turn off System Restore check box (To turn on System Restore), and then click OK.

Below I have included a number of recommendations for how to protect your computer in order to prevent future malware infections. Please take these recommendations seriously; these few simple steps can stave off the vast majority of spyware problems. As happy as we are to help you, for your sake we would rather not have repeat customers.

1) Please navigate to http://windowsupdate.microsoft.com and download all the "critical updates" for Windows. This can patch many of the security holes through which attackers can gain access to your computer.

Please either enable Automatic Updates under Start -> Control Panel -> Automatic Updates , or get into the habit of checking for Windows updates regularly. I cannot stress enough how important this is.

2) In order to protect yourself against spyware, you should consider installing and running the following free programs:

Ad-Aware SE
A tutorial on using Ad-Aware to remove spyware from your computer may be found here.

Spybot-Search & Destroy
A tutorial on using Spybot to remove spyware from your computer may be found here. Please also remember to enable Spybot's "Immunize" and "TeaTimer" features.

SpywareBlaster
A tutorial on using SpywareBlaster to prevent spyware from ever installing on your computer may be found here.

SpywareGuard
A tutorial on using SpywareGuard for realtime protection against spyware and hijackers may be found here.

Make sure to keep these programs up-to-date and to run them regularly, as this can prevent a great deal of spyware hassle.

3) Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in popup blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from here:
http://www.mozilla.org/products/firefox/
I also recommand the following add-ons for Firefox, they will help keep you safe from malicious scripts or activeX exploits.
https://addons.mozilla.org/en-US/firefox/addon/722
https://addons.mozilla.org/en-US/firefox/addon/1865
https://addons.mozilla.org/en-US/firefox/addon/433

4) Also make sure to run your antivirus software regularly, and to keep it up-to-date.

To help you keep your software updated, please considering using this free software program that will check for program updates.
Update Checker

5) Finally, consider maintaining a firewall. Some good free firewalls are Kerio, or
Outpost
A tutorial on understanding and using firewalls may be found here.

Please also read Tony Klein's excellent article: How I got Infected in the First Place

Hopefully this should take care of your problems! Good luck.

Thanks a million!!

Since this issue is resolved, this topic is closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter.

Everyone else, please open a new topic for your questions.