Solved Bad-pool-caller, physical memory dump

[Resolved] Bad-pool-caller, physical memory dump

please help me

Original thread here ....

http://www.windowsbbs.com/windows-xp/87075-bad-pool-caller-physical-memory-dump.html#post475953

DDS (Ver_09-06-26.01) - FAT32x86
Run by acer at 22:36:59.81 on Mon 09/14/2009
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_16
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.502.72 [GMT 8:00]

AV: Kaspersky Anti-Virus *On-access scanning enabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\WINDOWS\system32\agrsmsvc.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
svchost.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\lxdpcoms.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
C:\WINDOWS\system32\nipalsm.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Acer\Acer Arcade\PCMService.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Lexmark Z2300 Series\ezprint.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Windows Live Messenger Khalid Edition v5.1\msnmsgr.exe
C:\Program Files\Webshots\webshots.scr
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\DOCUME~1\acer\LOCALS~1\Temp\RtkBtMnt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\acer\Desktop\STORE\fil\software installer\dds.EXE

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.msn.com
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mWinlogon: Userinit=c:\windows\system32\userinit.exe,userinit.exe
mWinlogon: Taskman=c:\recycler\s-1-5-21-4318864056-7453383873-609194000-3364\sysdate.exe
BHO: IDMIEHlprObj Class: {0055c089-8582-441b-a0bf-17b458c2a3a8} - c:\program files\internet download manager\IDMIECC.dll
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: Skype add-on (mastermind): {22bf413b-c6d2-4d91-82a9-a0f997ba588c} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
BHO: BitComet Helper: {39f7e362-828a-4b5a-bcaf-5b79bfdfea60} - c:\program files\bitcomet\tools\BitCometBHO_1.3.7.16.dll
BHO: IEVkbdBHO Class: {59273ab4-e7d3-40f9-a1a8-6fa9cca1862c} - c:\program files\kaspersky lab\kaspersky anti-virus 2009\ievkbd.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Acer eDataSecurity Management: {5cbe3b7c-1e47-477e-a7dd-396db0476e29} - c:\windows\system32\eDStoolbar.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [IDMan] c:\program files\internet download manager\IDMan.exe /onboot
uRun: [msnmsgr] "c:\program files\windows live messenger khalid edition v5.1\msnmsgr.exe" /background
mRun: [LaunchApp] Alaunch
mRun: [SkyTel] SkyTel.EXE
mRun: [PCMService] "c:\program files\acer\acer arcade\PCMService.exe "
mRun: [eDataSecurity Loader] c:\acer\empowering technology\edatasecurity\eDSloader.exe 1
mRun: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
mRun: [RemoteControl] "c:\program files\cyberlink\powerdvd\PDVDServ.exe "
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [AzMixerSel] c:\program files\realtek\installshield\AzMixerSel.exe
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [AVP] "c:\program files\kaspersky lab\kaspersky anti-virus 2009\avp.exe "
mRun: [lxdpmon.exe] "c:\program files\lexmark z2300 series\lxdpmon.exe "
mRun: [EzPrint] "c:\program files\lexmark z2300 series\ezprint.exe "
StartupFolder: c:\docume~1\acer\startm~1\programs\startup\webshots.lnk - c:\program files\webshots\Launcher.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe
IE: &D&ownload &with BitComet - c:\program files\bitcomet\BitComet.exe/AddLink.htm
IE: &D&ownload all video with BitComet - c:\program files\bitcomet\BitComet.exe/AddVideo.htm
IE: &D&ownload all with BitComet - c:\program files\bitcomet\BitComet.exe/AddAllLink.htm
IE: Download all links with IDM - c:\program files\internet download manager\IEGetAll.htm
IE: Download FLV video content with IDM - c:\program files\internet download manager\IEGetVL.htm
IE: Download with IDM - c:\program files\internet download manager\IEExt.htm
IE: E&xport to Microsoft Excel - d:\msoffi~1\office12\EXCEL.EXE/3000
IE: {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://c:\program files\bitcomet\tools\BitCometBHO_1.3.7.16.dll/206
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - {85E0B171-04FA-11D1-B7DA-00A0C90348D6} - c:\program files\kaspersky lab\kaspersky anti-virus 2009\SCIEPlgn.dll
IE: {77BF5300-1474-4EC7-9980-D32B190E9B07} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - d:\msoffi~1\office12\REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
TCP: {8A5C5CD7-ACCB-4AD9-8AB6-0A05B07F35EC} = 202.188.0.133,202.188.1.5
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: igfxcui - igfxdev.dll
Notify: klogon - c:\windows\system32\klogon.dll
AppInit_DLLs: c:\progra~1\kasper~1\kasper~1\mzvkbd3.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\acer\applic~1\mozilla\firefox\profiles\o8w3og9n.default\
FF - prefs.js: browser.startup.homepage - hxxp://apps.facebook.com/inthemafia/index.php?xw_controller=index&xw_action=view|http://apps.facebook.com/piratesrul...n-world.com/space.php?action=viewpro&uid=6692
FF - prefs.js: keyword.URL - hxxp://mye.yhs.search.yahoo.com/avg/search?fr=yhs-avg&type=yahoo_avg_hs2-tb-web_mye&p=
FF - component: c:\documents and settings\acer\application data\idm\idmmzcc2\components\idmmzcc.dll
FF - component: c:\documents and settings\acer\application data\mozilla\firefox\profiles\o8w3og9n.default\extensions\{b042753d-f57e-4e8e-a01b-7379a6d4cefb}\components\IBitCometExtension.dll
FF - component: c:\program files\mozilla firefox\extensions\search@searchsettings.com\components\SearchSettingsFF.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
997c:\program files\mozilla firefox\greprefs\all.js - pref( "media.enforce_same_site_origin ", false);
c:\program files\mozilla firefox\greprefs\all.js - pref( "media.cache_size ", 51200);
c:\program files\mozilla firefox\greprefs\all.js - pref( "media.ogg.enabled ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "media.wave.enabled ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "media.autoplay.enabled ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.urlbar.autocomplete.enabled ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "capability.policy.mailnews.*.wholeText ", "noAccess ");
c:\program files\mozilla firefox\greprefs\all.js - pref( "dom.storage.default_quota ", 5120);
c:\program files\mozilla firefox\greprefs\all.js - pref( "content.sink.event_probe_rate ", 3);
c:\program files\mozilla firefox\greprefs\all.js - pref( "network.http.prompt-temp-redirect ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "layout.css.dpi ", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref( "layout.css.devPixelsPerPx ", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref( "gestures.enable_single_finger_input ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "dom.max_chrome_script_run_time ", 0);
c:\program files\mozilla firefox\greprefs\all.js - pref( "network.tcp.sendbuffer ", 131072);
c:\program files\mozilla firefox\greprefs\all.js - pref( "geo.enabled ", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref( "security.remember_cert_checkbox_default_setting ", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref( "browser.search.param.yahoo-fr ", "moz35 ");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref( "browser.search.param.yahoo-fr-cjkt ", "moz35 ");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "extensions.blocklist.level ", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "browser.urlbar.restrict.typed ", "~ ");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "browser.urlbar.default.behavior ", 0);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "privacy.clearOnShutdown.history ", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "privacy.clearOnShutdown.formdata ", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "privacy.clearOnShutdown.passwords ", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "privacy.clearOnShutdown.downloads ", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "privacy.clearOnShutdown.cookies ", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "privacy.clearOnShutdown.cache ", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "privacy.clearOnShutdown.sessions ", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "privacy.clearOnShutdown.offlineApps ", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "privacy.clearOnShutdown.siteSettings ", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "privacy.cpd.history ", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "privacy.cpd.formdata ", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "privacy.cpd.passwords ", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "privacy.cpd.downloads ", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "privacy.cpd.cookies ", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "privacy.cpd.cache ", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "privacy.cpd.sessions ", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "privacy.cpd.offlineApps ", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "privacy.cpd.siteSettings ", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "privacy.sanitize.migrateFx3Prefs ", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "browser.ssl_override_behavior ", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "security.alternate_certificate_error_page ", "certerror ");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "browser.privatebrowsing.autostart ", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "browser.privatebrowsing.dont_prompt_on_enter ", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "geo.wifi.uri ", "https://www.google.com/loc/json ");

============= SERVICES / DRIVERS ===============

R0 bzfdjmyz;bzfdjmyz;c:\windows\system32\drivers\bzfdjmyz.sys --> c:\windows\system32\drivers\bzfdjmyz.sys [?]
R0 kl1;Kl1;c:\windows\system32\drivers\kl1.sys [2008-7-21 121872]
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-1-29 33808]
R1 KLIF;Kaspersky Lab Driver;c:\windows\system32\drivers\klif.sys [2009-9-12 226832]
R2 {95808DC4-FA4A-4c74-92FE-5B863F82066B};{95808DC4-FA4A-4c74-92FE-5B863F82066B};c:\program files\cyberlink\powerdvd\000.fcl [2006-12-6 6656]
R2 AVP;Kaspersky Anti-Virus;c:\program files\kaspersky lab\kaspersky anti-virus 2009\avp.exe [2008-11-11 208616]
R2 lxdp_device;lxdp_device;c:\windows\system32\lxdpcoms.exe -service --> c:\windows\system32\lxdpcoms.exe -service [?]
R2 nidimk;nidimk;c:\windows\system32\drivers\nidimk.dll [2003-4-23 107102]
R2 nipxirmk;nipxirmk;c:\windows\system32\drivers\nipxirmk.dll [2003-4-18 36463]
R2 NwSapAgent;SAP Agent;c:\windows\system32\svchost.exe -k netsvcs [2004-8-4 14336]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2008-4-30 24592]
S2 lxdpCATSCustConnectService;lxdpCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\lxdpserv.exe [2009-9-12 98984]
S3 FANTOM;LEGO MINDSTORMS NXT Driver;c:\windows\system32\drivers\fantom.sys [2006-3-10 39424]
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\magix\common\database\bin\fbserver.exe [2009-8-28 1527900]
S3 LTower;LEGO USB Tower Driver;c:\windows\system32\drivers\LTower.sys [2007-5-31 39936]
S3 lv321av;Logitech USB PC Camera (VC0321);c:\windows\system32\drivers\lv321av.sys [2006-6-20 1097728]
S3 NiViPxiK;NiViPxiK;c:\windows\system32\drivers\NiViPxiK.sys [2003-6-24 17920]

=============== Created Last 30 ================

2009-09-13 21:40 <DIR> --dsh--- C:\FOUND.011
2009-09-13 20:56 <DIR> --d----- C:\symbols
2009-09-13 18:16 <DIR> --d----- c:\program files\Debugging Tools for Windows (x86)
2009-09-13 17:25 <DIR> --dsh--- C:\FOUND.010
2009-09-13 17:12 <DIR> --dsh--- C:\FOUND.009
2009-09-13 17:06 <DIR> --dsh--- C:\FOUND.008
2009-09-13 16:37 <DIR> --dsh--- C:\FOUND.007
2009-09-13 16:02 <DIR> --dsh--- C:\FOUND.006
2009-09-12 22:57 <DIR> --d----- c:\documents and settings\all users\Lx_cats
2009-09-12 22:56 <DIR> --d----- C:\logs
2009-09-12 22:55 40,960 a------- c:\windows\system32\lxdpvs.dll
2009-09-12 22:55 348,160 a------- c:\windows\system32\lxdpcoin.dll
2009-09-12 22:55 77,304 a------- c:\windows\system32\lxdpprpr.chm
2009-09-12 22:54 <DIR> --d----- c:\program files\Lexmark Toolbar
2009-09-12 22:53 <DIR> --d----- c:\program files\Lexmark Z2300 Series
2009-09-12 22:42 <DIR> --dsh--- C:\FOUND.005
2009-09-12 21:11 107,547 a------- c:\windows\system32\drivers\klin.dat
2009-09-12 21:11 95,259 a------- c:\windows\system32\drivers\klick.dat
2009-09-12 21:10 215,072 a--sh--- c:\windows\system32\drivers\fidbox.dat
2009-09-12 21:10 16,416 a--sh--- c:\windows\system32\drivers\fidbox2.dat
2009-09-12 21:10 2,760 a--sh--- c:\windows\system32\drivers\fidbox.idx
2009-09-12 21:10 1,136 a--sh--- c:\windows\system32\drivers\fidbox2.idx
2009-09-12 21:10 <DIR> --d----- c:\program files\Kaspersky Lab
2009-09-12 21:10 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Kaspersky Lab
2009-09-11 23:30 <DIR> --dsh--- C:\FOUND.004
2009-09-11 22:35 <DIR> --dsh--- C:\FOUND.003
2009-09-11 20:20 <DIR> --dsh--- C:\FOUND.002
2009-09-10 20:26 <DIR> --dsh--- C:\FOUND.001
2009-09-10 20:07 <DIR> --dsh--- C:\FOUND.000
2009-09-09 21:48 33,440 a------- c:\windows\system32\drivers\bzfdjmyz.sys
2009-09-09 21:48 41,984 ----h--- c:\windows\system32\secupdat.dat
2009-09-09 20:31 411,368 a------- c:\windows\system32\deploytk.dll
2009-09-07 00:53 <DIR> --d----- c:\windows\system32\wbem\Repository
2009-08-28 09:39 <DIR> --d----- c:\docume~1\acer\applic~1\MAGIX
2009-08-28 08:29 <DIR> --d----- c:\program files\common files\xara
2009-08-28 08:29 <DIR> --d----- c:\program files\common files\MAGIX Shared
2009-08-28 08:27 <DIR> --d----- c:\docume~1\alluse~1\applic~1\MAGIX
2009-08-28 08:27 120,200 a------- c:\windows\system32\DLLDEV32i.dll
2009-08-28 08:27 <DIR> --d----- c:\program files\MAGIX
2009-08-28 08:26 700,416 a------- c:\windows\system32\mgxoschk.dll
2009-08-28 08:26 6,211 a------- c:\windows\mgxoschk.ini
2009-08-28 08:26 <DIR> --d----- c:\windows\system32\MAGIX
2009-08-21 17:16 <DIR> --d----- c:\documents and settings\acer\DoctorWeb
2009-08-17 21:47 <DIR> --d----- c:\program files\CometBird
2009-08-17 21:43 <DIR> --d----- C:\Downloads
2009-08-17 21:41 <DIR> --d----- c:\program files\BitComet

==================== Find3M ====================

2009-09-12 21:50 33,808 a------- c:\windows\system32\drivers\klbg.sys
2009-07-28 16:33 55,656 a------- c:\windows\system32\drivers\avgntflt.sys
2008-03-21 18:46 32 a------- c:\docume~1\alluse~1\applic~1\ezsid.dat
2006-05-03 17:06 163,328 ---shr-- c:\windows\system32\flvDX.dll
2007-02-21 18:47 31,232 ---shr-- c:\windows\system32\msfDX.dll
2007-12-17 20:43 27,648 ---sh--- c:\windows\system32\Smab0.dll

============= FINISH: 22:38:00.81 ===============

 

ok thank you all very much. heres another log

Opened log file 'c:debuglog.txt'

Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini091409-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINDOWS;C:\WINDOWS\system32;C:\WINDOWS\system32\drivers

 

thank you sir

ComboFix 09-09-14.02 - acer 09/15/2009 19:04.2.2 - FAT32x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.502.201 [GMT 8:00]
Running from: c:\documents and settings\acer\Desktop\ComboFix.exe
AV: Kaspersky Anti-Virus *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\recycler\S-1-5-21-0625435643-2614788638-568478194-1342
c:\recycler\S-1-5-21-2804821815-7805587957-208817934-0978
c:\recycler\S-1-5-21-4318864056-7453383873-609194000-3364
c:\recycler\S-1-5-21-5859817965-1504477116-172076330-1126
c:\recycler\S-1-5-21-7627835389-2094931725-424742363-1273
c:\windows\Installer\21b579.msi
c:\windows\Installer\416b63.msi
c:\windows\system32\secupdat.dat . . . . failed to delete

.
((((((((((((((((((((((((( Files Created from 2009-08-15 to 2009-09-15 )))))))))))))))))))))))))))))))
.

2009-09-15 10:57 . 2009-09-15 10:57 -------- d-----w- C:\FOUND.017
2009-09-15 10:24 . 2009-09-15 10:24 -------- d-----w- C:\FOUND.016
2009-09-15 10:16 . 2009-09-15 10:16 -------- d-----w- C:\FOUND.015
2009-09-14 15:14 . 2009-09-14 15:14 -------- d-----w- C:\FOUND.014
2009-09-14 14:55 . 2009-09-14 14:55 -------- d-----w- C:\FOUND.013
2009-09-14 14:44 . 2009-09-14 14:44 -------- d-----w- C:\FOUND.012
2009-09-13 13:40 . 2009-09-13 13:40 -------- d-----w- C:\FOUND.011
2009-09-13 12:56 . 2009-09-13 12:56 -------- d-----w- C:\symbols
2009-09-13 10:16 . 2009-09-13 10:16 -------- d-----w- c:\program files\Debugging Tools for Windows (x86)
2009-09-13 09:25 . 2009-09-13 09:25 -------- d-----w- C:\FOUND.010
2009-09-13 09:12 . 2009-09-13 09:12 -------- d-----w- C:\FOUND.009
2009-09-13 09:06 . 2009-09-13 09:06 -------- d-----w- C:\FOUND.008
2009-09-13 08:37 . 2009-09-13 08:37 -------- d-----w- C:\FOUND.007
2009-09-13 08:02 . 2009-09-13 08:02 -------- d-----w- C:\FOUND.006
2009-09-12 14:57 . 2009-09-12 14:57 -------- d-----w- c:\documents and settings\All Users\Lx_cats
2009-09-12 14:56 . 2009-09-12 14:56 -------- d-----w- C:\logs
2009-09-12 14:55 . 2007-11-28 17:51 40960 ----a-w- c:\windows\system32\lxdpvs.dll
2009-09-12 14:55 . 2007-10-10 21:40 348160 ----a-w- c:\windows\system32\lxdpcoin.dll
2009-09-12 14:53 . 2009-09-12 14:53 -------- d-----w- c:\program files\Lexmark Z2300 Series
2009-09-12 14:42 . 2009-09-12 14:42 -------- d-----w- C:\FOUND.005
2009-09-12 13:11 . 2009-09-12 13:49 107547 ----a-w- c:\windows\system32\drivers\klin.dat
2009-09-12 13:11 . 2009-09-12 13:49 95259 ----a-w- c:\windows\system32\drivers\klick.dat
2009-09-12 13:10 . 2009-09-15 11:09 24608 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2009-09-12 13:10 . 2009-09-15 11:09 215072 --sha-w- c:\windows\system32\drivers\fidbox.dat
2009-09-12 13:10 . 2009-09-12 13:10 -------- d-----w- c:\program files\Kaspersky Lab
2009-09-12 13:10 . 2009-09-12 13:10 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-09-11 15:30 . 2009-09-11 15:30 -------- d-----w- C:\FOUND.004
2009-09-11 14:35 . 2009-09-11 14:35 -------- d-----w- C:\FOUND.003
2009-09-11 12:49 . 2009-09-11 12:49 -------- d-----w- c:\program files\Alwil Software
2009-09-11 12:20 . 2009-09-11 12:20 -------- d-----w- C:\FOUND.002
2009-09-10 12:26 . 2009-09-10 12:26 -------- d-----w- C:\FOUND.001
2009-09-10 12:07 . 2009-09-10 12:07 -------- d-----w- C:\FOUND.000
2009-09-09 13:48 . 2009-09-09 13:48 33440 ----a-w- c:\windows\system32\drivers\bzfdjmyz.sys
2009-09-09 13:48 . 2009-09-09 13:48 41984 ---h--w- c:\windows\system32\secupdat.dat
2009-09-09 12:31 . 2009-09-09 12:30 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-09-06 16:53 . 2009-09-06 16:53 -------- d-----w- c:\windows\system32\wbem\Repository
2009-08-28 01:39 . 2009-08-28 01:39 -------- d-----w- c:\documents and settings\acer\Application Data\MAGIX
2009-08-28 00:31 . 2009-08-28 00:31 -------- d-----w- c:\documents and settings\acer\Local Settings\Application Data\Xara
2009-08-28 00:27 . 2009-08-28 00:27 -------- d-----w- c:\documents and settings\All Users\Application Data\MAGIX
2009-08-28 00:27 . 2009-08-28 00:27 -------- d-----w- c:\program files\MAGIX
2009-08-28 00:27 . 2007-04-27 01:43 120200 ----a-w- c:\windows\system32\DLLDEV32i.dll
2009-08-28 00:26 . 2009-08-28 00:26 -------- d-----w- c:\windows\system32\MAGIX
2009-08-28 00:26 . 2008-04-15 07:14 700416 ----a-w- c:\windows\system32\mgxoschk.dll
2009-08-21 09:16 . 2009-08-21 09:16 -------- d-----w- c:\documents and settings\acer\DoctorWeb
2009-08-17 13:49 . 2009-08-17 13:49 0 ----a-w- c:\windows\nsreg.dat
2009-08-17 13:49 . 2009-08-17 13:49 -------- d-----w- c:\documents and settings\acer\Local Settings\Application Data\CometNetwork
2009-08-17 13:47 . 2009-08-17 13:47 -------- d-----w- c:\program files\CometBird
2009-08-17 13:43 . 2009-08-17 13:43 -------- d-----w- C:\Downloads
2009-08-17 13:41 . 2009-08-17 13:41 -------- d-----w- c:\program files\BitComet

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-15 11:09 . 2009-09-12 13:10 1164 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2009-09-15 11:09 . 2009-09-12 13:10 2760 --sha-w- c:\windows\system32\drivers\fidbox.idx
2009-09-15 11:08 . 2006-08-01 09:01 12 ----a-w- c:\windows\bthservsdp.dat
2009-09-12 14:54 . 2009-09-12 14:54 -------- d-----w- c:\program files\Lexmark Toolbar
2009-09-12 13:50 . 2008-01-29 09:29 33808 ----a-w- c:\windows\system32\drivers\klbg.sys
2009-09-02 12:38 . 2006-08-01 08:41 1324 ----a-w- c:\windows\system32\d3d9caps.dat
2009-08-28 05:05 . 2006-12-06 22:15 131176 ----a-w- c:\documents and settings\acer\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-28 00:29 . 2009-08-28 00:29 -------- d-----w- c:\program files\Common Files\xara
2009-08-28 00:29 . 2009-08-28 00:29 -------- d-----w- c:\program files\Common Files\MAGIX Shared
2009-08-08 10:43 . 2009-08-08 10:43 -------- d-----w- c:\documents and settings\All Users\Application Data\NortonInstaller
2009-08-07 06:08 . 2009-08-07 06:08 -------- d-----w- c:\program files\LingoPad
2009-08-07 05:12 . 2009-08-07 05:12 -------- d-----w- c:\documents and settings\acer\Application Data\Lingo4u
2009-08-06 15:18 . 2009-08-06 15:18 -------- d-----w- c:\program files\Graph
2009-08-06 11:52 . 2009-08-06 11:52 -------- d-----w- c:\program files\Microsoft Works
2009-08-06 11:52 . 2009-08-06 11:52 -------- d-----w- c:\program files\MSBuild
2009-08-06 11:51 . 2009-08-06 11:51 -------- d-----w- c:\program files\Microsoft.NET
2009-08-06 11:42 . 2009-08-06 11:42 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-08-05 16:54 . 2009-08-05 16:53 -------- d-----w- c:\program files\Trend Micro
2009-08-04 12:22 . 2009-08-03 09:20 188 ----a-w- c:\windows\system32\eDataSecurity.dat
2009-08-03 12:56 . 2009-08-03 12:56 -------- d-----w- c:\program files\iPod
2009-08-03 12:56 . 2009-08-03 12:56 -------- d-----w- c:\program files\iTunes
2009-08-03 12:54 . 2009-08-03 12:54 -------- d-----w- c:\program files\QuickTime
2009-08-03 12:54 . 2009-08-03 12:54 -------- d-----w- c:\program files\Common Files\Apple
2009-07-30 12:57 . 2009-07-30 12:57 -------- d-----w- c:\documents and settings\All Users\Application Data\Messenger Plus!
2009-07-30 12:57 . 2009-07-30 12:57 -------- d-----w- c:\documents and settings\acer\Application Data\AVG8
2009-07-30 12:56 . 2009-07-30 12:56 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2009-07-28 08:33 . 2009-08-10 14:15 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-07-27 06:23 . 2009-07-27 06:23 -------- d-----w- c:\documents and settings\acer\Application Data\Kingsoft
2009-07-27 06:21 . 2009-07-27 06:21 -------- d-----w- c:\program files\PowerWord 2006
2009-07-27 06:21 . 2009-07-27 06:21 -------- d-----w- c:\program files\Common Files\Kingsoft
2009-07-27 05:11 . 2009-07-27 05:11 -------- d-----w- c:\documents and settings\acer\Application Data\IDM
2009-07-27 05:11 . 2009-07-27 05:11 -------- d-----w- c:\documents and settings\acer\Application Data\DMCache
2009-07-27 05:11 . 2009-07-27 05:11 -------- d-----w- c:\program files\Internet Download Manager
2009-07-20 07:05 . 2009-07-20 07:05 -------- d-----w- c:\program files\Common Files\xing shared
2009-07-20 06:41 . 2009-07-20 06:41 -------- d-----w- c:\documents and settings\acer\Application Data\Search Settings
2009-07-19 12:52 . 2009-07-19 12:52 -------- d-----w- c:\program files\eRightSoft
2009-07-19 12:49 . 2009-07-19 12:49 -------- d-----w- c:\documents and settings\acer\Application Data\GRETECH
2009-07-19 12:47 . 2009-07-19 12:47 -------- d-----w- c:\program files\GRETECH
2009-07-19 11:12 . 2009-07-19 11:12 -------- d-----w- c:\documents and settings\acer\Application Data\Media Player Classic
2009-07-19 10:43 . 2009-07-19 10:43 -------- d-----w- c:\documents and settings\acer\Application Data\URSoft
2009-07-19 10:43 . 2009-07-19 10:43 -------- d-----w- c:\documents and settings\All Users\Application Data\TEMP
2009-07-18 03:46 . 2009-07-18 03:46 -------- d-----w- c:\program files\Microsoft Silverlight
2006-05-03 09:06 . 2009-07-19 12:52 163328 --sh--r- c:\windows\system32\flvDX.dll
2007-02-21 10:47 . 2009-07-19 12:52 31232 --sh--r- c:\windows\system32\msfDX.dll
2007-12-17 12:43 . 2009-07-19 12:52 27648 --sh--w- c:\windows\system32\Smab0.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IDMan "= "c:\program files\Internet Download Manager\IDMan.exe" [2009-07-27 2606512]
"msnmsgr "= "c:\program files\Windows Live Messenger Khalid Edition v5.1\msnmsgr.exe" [2009-07-04 5675376]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LaunchApp "= "Alaunch" [X]
"PCMService "= "c:\program files\Acer\Acer Arcade\PCMService.exe" [2006-05-17 151552]
"eDataSecurity Loader "= "c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2006-03-17 345088]
"RemoteControl "= "c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2005-01-11 32768]
"AzMixerSel "= "c:\program files\Realtek\InstallShield\AzMixerSel.exe" [2006-07-19 53248]
"QuickTime Task "= "c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"AVP "= "c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" [2009-09-12 208616]
"lxdpmon.exe "= "c:\program files\Lexmark Z2300 Series\lxdpmon.exe" [2007-12-07 656040]
"EzPrint "= "c:\program files\Lexmark Z2300 Series\ezprint.exe" [2007-12-07 107176]
"SkyTel "= "SkyTel.EXE" - c:\windows\SkyTel.exe [2006-07-19 2879488]
"BluetoothAuthenticationAgent "= "bthprops.cpl" - c:\windows\system32\bthprops.cpl [2004-08-03 110592]
"RTHDCPL "= "RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2006-07-19 16248320]

c:\documents and settings\acer\Start Menu\Programs\Startup\
Webshots.lnk - c:\program files\Webshots\Launcher.exe [2006-12-6 45056]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\bzfdjmyz.sys]
@= "Driver "

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring "=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring "=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"c:\\Program Files\\Acer\\Acer Arcade\\PCMService.exe "=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe "=
"c:\\Program Files\\DNA\\btdna.exe "=
"c:\\Program Files\\PowerWord 2006\\XDICT.EXE "=
"c:\\Program Files\\Windows Live Messenger Khalid Edition v5.1\\msnmsgr.exe "=
"c:\\Program Files\\iTunes\\iTunes.exe "=
"d:\\Ms Office 2007\\Office12\\OUTLOOK.EXE "=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe "=
"c:\\Program Files\\BitComet\\BitComet.exe "=
"c:\\Program Files\\Skype\\Phone\\Skype.exe "=
"c:\\WINDOWS\\system32\\lxdpcoms.exe "=
"c:\\WINDOWS\\system32\\spool\\drivers\\W32X86\\3\\lxdppswx.exe "=
"c:\\WINDOWS\\system32\\spool\\drivers\\W32X86\\3\\LXDPtime.exe "=
"c:\\Program Files\\Lexmark Z2300 Series\\lxdpmon.exe "=
"c:\\WINDOWS\\system32\\spool\\drivers\\W32X86\\3\\lxdpjswx.exe "=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"23340:TCP "= 23340:TCP:BitComet 23340 TCP
"23340:UDP "= 23340:UDP:BitComet 23340 UDP

R0 bzfdjmyz;bzfdjmyz;c:\windows\system32\Drivers\bzfdjmyz.sys --> c:\windows\system32\Drivers\bzfdjmyz.sys [?]
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [1/29/2008 5:29 PM 33808]
R2 lxdp_device;lxdp_device;c:\windows\system32\lxdpcoms.exe -service --> c:\windows\system32\lxdpcoms.exe -service [?]
R2 nidimk;nidimk;c:\windows\system32\drivers\nidimk.dll [4/23/2003 8:15 PM 107102]
R2 nipxirmk;nipxirmk;c:\windows\system32\drivers\nipxirmk.dll [4/18/2003 1:45 PM 36463]
R2 NwSapAgent;SAP Agent;c:\windows\system32\svchost.exe -k netsvcs [8/4/2004 5:00 AM 14336]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [4/30/2008 5:06 PM 24592]
S2 lxdpCATSCustConnectService;lxdpCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\lxdpserv.exe [9/12/2009 10:55 PM 98984]
S3 FANTOM;LEGO MINDSTORMS NXT Driver;c:\windows\system32\drivers\fantom.sys [3/10/2006 3:55 PM 39424]
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\MAGIX\Common\Database\bin\fbserver.exe [8/28/2009 8:30 AM 1527900]
S3 LTower;LEGO USB Tower Driver;c:\windows\system32\drivers\LTower.sys [5/31/2007 8:39 AM 39936]
S3 lv321av;Logitech USB PC Camera (VC0321);c:\windows\system32\drivers\lv321av.sys [6/20/2006 3:20 AM 1097728]
S3 NiViPxiK;NiViPxiK;c:\windows\system32\drivers\NiViPxiK.sys [6/24/2003 6:41 PM 17920]
.
Contents of the 'Scheduled Tasks' folder

2009-08-21 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 04:34]

2009-09-15 c:\windows\Tasks\User_Feed_Synchronization-{67906372-F73E-4E7F-B2DD-39B1F643450E}.job
- c:\windows\system32\msfeedssync.exe [2009-03-07 20:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.msn.com
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &D&ownload &with BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm
IE: &D&ownload all video with BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm
IE: &D&ownload all with BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm
IE: Download all links with IDM - c:\program files\Internet Download Manager\IEGetAll.htm
IE: Download FLV video content with IDM - c:\program files\Internet Download Manager\IEGetVL.htm
IE: Download with IDM - c:\program files\Internet Download Manager\IEExt.htm
IE: E&xport to Microsoft Excel - d:\msoffi~1\Office12\EXCEL.EXE/3000
TCP: {8A5C5CD7-ACCB-4AD9-8AB6-0A05B07F35EC} = 202.188.0.133,202.188.1.5
FF - ProfilePath - c:\documents and settings\acer\Application Data\Mozilla\Firefox\Profiles\o8w3og9n.default\
FF - prefs.js: browser.startup.homepage - hxxp://apps.facebook.com/inthemafia/index.php?xw_controller=index&xw_action=view|http://apps.facebook.com/piratesrul...n-world.com/space.php?action=viewpro&uid=6692
FF - prefs.js: keyword.URL - hxxp://mye.yhs.search.yahoo.com/avg/search?fr=yhs-avg&type=yahoo_avg_hs2-tb-web_mye&p=
FF - component: c:\documents and settings\acer\Application Data\IDM\idmmzcc2\components\idmmzcc.dll
FF - component: c:\documents and settings\acer\Application Data\Mozilla\Firefox\Profiles\o8w3og9n.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}\components\IBitCometExtension.dll
FF - component: c:\program files\Mozilla Firefox\extensions\search@searchsettings.com\components\SearchSettingsFF.dll

---- FIREFOX POLICIES ----
997.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-15 19:10
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{95808DC4-FA4A-4c74-92FE-5B863F82066B}]
"ImagePath "= "\??\c:\program files\CyberLink\PowerDVD\000.fcl "
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(1792)
c:\windows\system32\WININET.dll
c:\windows\system32\MSNCHATHOOK.DLL
c:\windows\system32\sysenv.dll
c:\windows\system32\CryptoAPI.dll
c:\windows\system32\MFC71U.DLL
c:\program files\iTunes\iTunesMiniPlayer.dll
c:\program files\iTunes\iTunesMiniPlayer.Resources\en.lproj\iTunesMiniPlayerLocalized.dll
c:\program files\iTunes\iTunesMiniPlayer.Resources\iTunesMiniPlayer.dll
c:\windows\system32\msi.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
------------------------ Other Running Processes ------------------------
.
c:\acer\Empowering Technology\ePerformance\MemCheck.exe
c:\windows\system32\agrsmsvc.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
c:\program files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
c:\program files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\windows\system32\lxdpcoms.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\CyberLink\Shared Files\RichVideo.exe
c:\windows\system32\wdfmgr.exe
c:\program files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
c:\windows\system32\nipalsm.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\rundll32.exe
c:\program files\Internet Download Manager\IEMonitor.exe
c:\program files\Webshots\webshots.scr
c:\docume~1\acer\LOCALS~1\Temp\RtkBtMnt.exe
.
**************************************************************************
.
Completion time: 2009-09-15 19:12 - machine was rebooted
ComboFix-quarantined-files.txt 2009-09-15 11:12
ComboFix2.txt 2009-08-03 15:44

Pre-Run: 10,200,367,104 bytes free
Post-Run: 10,218,405,888 bytes free

269 --- E O F --- 2008-04-07 04:09





Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:13:59 PM, on 9/15/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\WINDOWS\system32\agrsmsvc.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\lxdpcoms.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
C:\WINDOWS\system32\nipalsm.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Acer\Acer Arcade\PCMService.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Lexmark Z2300 Series\lxdpmon.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Windows Live Messenger Khalid Edition v5.1\msnmsgr.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Webshots\webshots.scr
C:\WINDOWS\system32\wuauclt.exe
C:\DOCUME~1\acer\LOCALS~1\Temp\RtkBtMnt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.3.7.16.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Acer\Acer Arcade\PCMService.exe "
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 1
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe "
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe "
O4 - HKLM\..\Run: [lxdpmon.exe] "C:\Program Files\Lexmark Z2300 Series\lxdpmon.exe "
O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark Z2300 Series\ezprint.exe "
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live Messenger Khalid Edition v5.1\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Download all links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\MSOFFI~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\MSOFFI~1\Office12\REFIEBAR.DLL
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.3.7.16.dll/206 (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{8A5C5CD7-ACCB-4AD9-8AB6-0A05B07F35EC}: NameServer = 202.188.0.133,202.188.1.5
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\WINDOWS\system32\agrsmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: lxdpCATSCustConnectService - Lexmark International, Inc. - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxdpserv.exe
O23 - Service: lxdp_device - - C:\WINDOWS\system32\lxdpcoms.exe
O23 - Service: nipxirmu - National Instruments Corporation - C:\WINDOWS\system32\nipalsm.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

--
End of file - 9295 bytes

 

thanks

ComboFix 09-09-14.02 - acer 09/16/2009 14:53.3.2 - FAT32x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.502.212 [GMT 8:00]
Running from: c:\documents and settings\acer\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\acer\Desktop\CFScript.txt
AV: Kaspersky Anti-Virus *On-access scanning disabled* (Outdated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}

FILE ::
"c:\windows\system32\DLLDEV32i.dll "
"c:\windows\system32\drivers\avgntflt.sys "
"c:\windows\system32\drivers\bzfdjmyz.sys "
"c:\windows\system32\drivers\klick.dat "
"c:\windows\system32\drivers\klin.dat "
"c:\windows\system32\secupdat.dat "
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\DLLDEV32i.dll
c:\windows\system32\drivers\avgntflt.sys
c:\windows\system32\drivers\bzfdjmyz.sys
c:\windows\system32\drivers\klick.dat
c:\windows\system32\drivers\klin.dat
c:\windows\system32\secupdat.dat

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_BZFDJMYZ
-------\Service_bzfdjmyz


((((((((((((((((((((((((( Files Created from 2009-08-16 to 2009-09-16 )))))))))))))))))))))))))))))))
.

2009-09-16 07:00 . 2009-09-16 07:00 -------- d-----w- C:\FOUND.022
2009-09-15 11:58 . 2009-09-15 11:58 -------- d-----w- C:\FOUND.021
2009-09-15 11:36 . 2009-09-15 11:36 -------- d-----w- C:\FOUND.020
2009-09-15 11:30 . 2009-09-15 11:30 -------- d-----w- C:\FOUND.019
2009-09-15 11:19 . 2009-09-15 11:19 -------- d-----w- C:\FOUND.018
2009-09-15 10:57 . 2009-09-15 10:57 -------- d-----w- C:\FOUND.017
2009-09-15 10:24 . 2009-09-15 10:24 -------- d-----w- C:\FOUND.016
2009-09-15 10:16 . 2009-09-15 10:16 -------- d-----w- C:\FOUND.015
2009-09-14 15:14 . 2009-09-14 15:14 -------- d-----w- C:\FOUND.014
2009-09-14 14:55 . 2009-09-14 14:55 -------- d-----w- C:\FOUND.013
2009-09-14 14:44 . 2009-09-14 14:44 -------- d-----w- C:\FOUND.012
2009-09-13 13:40 . 2009-09-13 13:40 -------- d-----w- C:\FOUND.011
2009-09-13 12:56 . 2009-09-13 12:56 -------- d-----w- C:\symbols
2009-09-13 09:25 . 2009-09-13 09:25 -------- d-----w- C:\FOUND.010
2009-09-13 09:12 . 2009-09-13 09:12 -------- d-----w- C:\FOUND.009
2009-09-13 09:06 . 2009-09-13 09:06 -------- d-----w- C:\FOUND.008
2009-09-13 08:37 . 2009-09-13 08:37 -------- d-----w- C:\FOUND.007
2009-09-13 08:02 . 2009-09-13 08:02 -------- d-----w- C:\FOUND.006
2009-09-12 14:57 . 2009-09-12 14:57 -------- d-----w- c:\documents and settings\All Users\Lx_cats
2009-09-12 14:56 . 2009-09-12 14:56 -------- d-----w- C:\logs
2009-09-12 14:55 . 2007-11-28 17:51 40960 ----a-w- c:\windows\system32\lxdpvs.dll
2009-09-12 14:55 . 2007-10-10 21:40 348160 ----a-w- c:\windows\system32\lxdpcoin.dll
2009-09-12 14:53 . 2009-09-12 14:53 -------- d-----w- c:\program files\Lexmark Z2300 Series
2009-09-12 14:42 . 2009-09-12 14:42 -------- d-----w- C:\FOUND.005
2009-09-12 13:10 . 2009-09-16 06:57 24608 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2009-09-12 13:10 . 2009-09-16 06:57 215072 --sha-w- c:\windows\system32\drivers\fidbox.dat
2009-09-12 13:10 . 2009-09-12 13:10 -------- d-----w- c:\program files\Kaspersky Lab
2009-09-12 13:10 . 2009-09-12 13:10 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-09-11 15:30 . 2009-09-11 15:30 -------- d-----w- C:\FOUND.004
2009-09-11 14:35 . 2009-09-11 14:35 -------- d-----w- C:\FOUND.003
2009-09-11 12:49 . 2009-09-11 12:49 -------- d-----w- c:\program files\Alwil Software
2009-09-11 12:20 . 2009-09-11 12:20 -------- d-----w- C:\FOUND.002
2009-09-10 12:26 . 2009-09-10 12:26 -------- d-----w- C:\FOUND.001
2009-09-10 12:07 . 2009-09-10 12:07 -------- d-----w- C:\FOUND.000
2009-09-09 12:31 . 2009-09-09 12:30 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-09-06 16:53 . 2009-09-06 16:53 -------- d-----w- c:\windows\system32\wbem\Repository
2009-08-28 01:39 . 2009-08-28 01:39 -------- d-----w- c:\documents and settings\acer\Application Data\MAGIX
2009-08-28 00:31 . 2009-08-28 00:31 -------- d-----w- c:\documents and settings\acer\Local Settings\Application Data\Xara
2009-08-28 00:27 . 2009-08-28 00:27 -------- d-----w- c:\documents and settings\All Users\Application Data\MAGIX
2009-08-28 00:27 . 2009-08-28 00:27 -------- d-----w- c:\program files\MAGIX
2009-08-28 00:26 . 2009-08-28 00:26 -------- d-----w- c:\windows\system32\MAGIX
2009-08-28 00:26 . 2008-04-15 07:14 700416 ----a-w- c:\windows\system32\mgxoschk.dll
2009-08-21 09:16 . 2009-08-21 09:16 -------- d-----w- c:\documents and settings\acer\DoctorWeb
2009-08-17 13:49 . 2009-08-17 13:49 0 ----a-w- c:\windows\nsreg.dat
2009-08-17 13:49 . 2009-08-17 13:49 -------- d-----w- c:\documents and settings\acer\Local Settings\Application Data\CometNetwork
2009-08-17 13:47 . 2009-08-17 13:47 -------- d-----w- c:\program files\CometBird
2009-08-17 13:43 . 2009-08-17 13:43 -------- d-----w- C:\Downloads
2009-08-17 13:41 . 2009-08-17 13:41 -------- d-----w- c:\program files\BitComet

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-16 06:57 . 2009-09-12 13:10 2760 --sha-w- c:\windows\system32\drivers\fidbox.idx
2009-09-16 06:57 . 2009-09-12 13:10 1164 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2009-09-16 06:57 . 2006-08-01 09:01 12 ----a-w- c:\windows\bthservsdp.dat
2009-09-12 14:54 . 2009-09-12 14:54 -------- d-----w- c:\program files\Lexmark Toolbar
2009-09-12 13:50 . 2008-01-29 09:29 33808 ----a-w- c:\windows\system32\drivers\klbg.sys
2009-09-02 12:38 . 2006-08-01 08:41 1324 ----a-w- c:\windows\system32\d3d9caps.dat
2009-08-28 05:05 . 2006-12-06 22:15 131176 ----a-w- c:\documents and settings\acer\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-28 00:29 . 2009-08-28 00:29 -------- d-----w- c:\program files\Common Files\xara
2009-08-28 00:29 . 2009-08-28 00:29 -------- d-----w- c:\program files\Common Files\MAGIX Shared
2009-08-08 10:43 . 2009-08-08 10:43 -------- d-----w- c:\documents and settings\All Users\Application Data\NortonInstaller
2009-08-07 06:08 . 2009-08-07 06:08 -------- d-----w- c:\program files\LingoPad
2009-08-07 05:12 . 2009-08-07 05:12 -------- d-----w- c:\documents and settings\acer\Application Data\Lingo4u
2009-08-06 15:18 . 2009-08-06 15:18 -------- d-----w- c:\program files\Graph
2009-08-06 11:52 . 2009-08-06 11:52 -------- d-----w- c:\program files\Microsoft Works
2009-08-06 11:52 . 2009-08-06 11:52 -------- d-----w- c:\program files\MSBuild
2009-08-06 11:51 . 2009-08-06 11:51 -------- d-----w- c:\program files\Microsoft.NET
2009-08-06 11:42 . 2009-08-06 11:42 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-08-05 16:54 . 2009-08-05 16:53 -------- d-----w- c:\program files\Trend Micro
2009-08-04 12:22 . 2009-08-03 09:20 188 ----a-w- c:\windows\system32\eDataSecurity.dat
2009-08-03 12:56 . 2009-08-03 12:56 -------- d-----w- c:\program files\iPod
2009-08-03 12:56 . 2009-08-03 12:56 -------- d-----w- c:\program files\iTunes
2009-08-03 12:54 . 2009-08-03 12:54 -------- d-----w- c:\program files\QuickTime
2009-08-03 12:54 . 2009-08-03 12:54 -------- d-----w- c:\program files\Common Files\Apple
2009-07-30 12:57 . 2009-07-30 12:57 -------- d-----w- c:\documents and settings\All Users\Application Data\Messenger Plus!
2009-07-30 12:57 . 2009-07-30 12:57 -------- d-----w- c:\documents and settings\acer\Application Data\AVG8
2009-07-30 12:56 . 2009-07-30 12:56 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2009-07-27 06:23 . 2009-07-27 06:23 -------- d-----w- c:\documents and settings\acer\Application Data\Kingsoft
2009-07-27 06:21 . 2009-07-27 06:21 -------- d-----w- c:\program files\PowerWord 2006
2009-07-27 06:21 . 2009-07-27 06:21 -------- d-----w- c:\program files\Common Files\Kingsoft
2009-07-27 05:11 . 2009-07-27 05:11 -------- d-----w- c:\documents and settings\acer\Application Data\IDM
2009-07-27 05:11 . 2009-07-27 05:11 -------- d-----w- c:\documents and settings\acer\Application Data\DMCache
2009-07-27 05:11 . 2009-07-27 05:11 -------- d-----w- c:\program files\Internet Download Manager
2009-07-20 07:05 . 2009-07-20 07:05 -------- d-----w- c:\program files\Common Files\xing shared
2009-07-20 06:41 . 2009-07-20 06:41 -------- d-----w- c:\documents and settings\acer\Application Data\Search Settings
2009-07-19 12:52 . 2009-07-19 12:52 -------- d-----w- c:\program files\eRightSoft
2009-07-19 12:49 . 2009-07-19 12:49 -------- d-----w- c:\documents and settings\acer\Application Data\GRETECH
2009-07-19 12:47 . 2009-07-19 12:47 -------- d-----w- c:\program files\GRETECH
2009-07-19 11:12 . 2009-07-19 11:12 -------- d-----w- c:\documents and settings\acer\Application Data\Media Player Classic
2009-07-19 10:43 . 2009-07-19 10:43 -------- d-----w- c:\documents and settings\acer\Application Data\URSoft
2009-07-19 10:43 . 2009-07-19 10:43 -------- d-----w- c:\documents and settings\All Users\Application Data\TEMP
2006-05-03 09:06 . 2009-07-19 12:52 163328 --sh--r- c:\windows\system32\flvDX.dll
2007-02-21 10:47 . 2009-07-19 12:52 31232 --sh--r- c:\windows\system32\msfDX.dll
2007-12-17 12:43 . 2009-07-19 12:52 27648 --sh--w- c:\windows\system32\Smab0.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-09-15_11.10.54 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-09-16 07:01 . 2009-09-16 07:01 16384 c:\windows\Temp\Perflib_Perfdata_774.dat
+ 2009-09-16 06:48 . 2009-09-16 06:49 16384 c:\windows\Temp\Perflib_Perfdata_668.dat
+ 2009-09-16 07:01 . 2009-09-16 07:01 16384 c:\windows\Temp\Perflib_Perfdata_28c.dat
+ 2006-12-06 06:07 . 2009-09-15 11:59 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2006-12-06 06:07 . 2009-09-15 10:58 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2006-12-06 06:07 . 2009-09-15 10:58 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2006-12-06 06:07 . 2009-09-15 11:59 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2006-12-06 06:07 . 2009-09-15 10:58 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2009-09-15 11:31 . 2009-09-15 11:59 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IDMan "= "c:\program files\Internet Download Manager\IDMan.exe" [2009-07-27 2606512]
"msnmsgr "= "c:\program files\Windows Live Messenger Khalid Edition v5.1\msnmsgr.exe" [2009-07-04 5675376]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LaunchApp "= "Alaunch" [X]
"PCMService "= "c:\program files\Acer\Acer Arcade\PCMService.exe" [2006-05-17 151552]
"eDataSecurity Loader "= "c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2006-03-17 345088]
"RemoteControl "= "c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2005-01-11 32768]
"AzMixerSel "= "c:\program files\Realtek\InstallShield\AzMixerSel.exe" [2006-07-19 53248]
"QuickTime Task "= "c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"lxdpmon.exe "= "c:\program files\Lexmark Z2300 Series\lxdpmon.exe" [2007-12-07 656040]
"EzPrint "= "c:\program files\Lexmark Z2300 Series\ezprint.exe" [2007-12-07 107176]
"AVP "= "c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" [2009-09-12 208616]
"SkyTel "= "SkyTel.EXE" - c:\windows\SkyTel.exe [2006-07-19 2879488]
"BluetoothAuthenticationAgent "= "bthprops.cpl" - c:\windows\system32\bthprops.cpl [2004-08-03 110592]
"RTHDCPL "= "RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2006-07-19 16248320]

c:\documents and settings\acer\Start Menu\Programs\Startup\
Webshots.lnk - c:\program files\Webshots\Launcher.exe [2006-12-6 45056]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring "=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring "=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"c:\\Program Files\\Acer\\Acer Arcade\\PCMService.exe "=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe "=
"c:\\Program Files\\DNA\\btdna.exe "=
"c:\\Program Files\\PowerWord 2006\\XDICT.EXE "=
"c:\\Program Files\\Windows Live Messenger Khalid Edition v5.1\\msnmsgr.exe "=
"c:\\Program Files\\iTunes\\iTunes.exe "=
"d:\\Ms Office 2007\\Office12\\OUTLOOK.EXE "=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe "=
"c:\\Program Files\\BitComet\\BitComet.exe "=
"c:\\Program Files\\Skype\\Phone\\Skype.exe "=
"c:\\WINDOWS\\system32\\lxdpcoms.exe "=
"c:\\WINDOWS\\system32\\spool\\drivers\\W32X86\\3\\lxdppswx.exe "=
"c:\\WINDOWS\\system32\\spool\\drivers\\W32X86\\3\\LXDPtime.exe "=
"c:\\Program Files\\Lexmark Z2300 Series\\lxdpmon.exe "=
"c:\\WINDOWS\\system32\\spool\\drivers\\W32X86\\3\\lxdpjswx.exe "=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"23340:TCP "= 23340:TCP:BitComet 23340 TCP
"23340:UDP "= 23340:UDP:BitComet 23340 UDP

R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [1/29/2008 5:29 PM 33808]
R2 lxdp_device;lxdp_device;c:\windows\system32\lxdpcoms.exe -service --> c:\windows\system32\lxdpcoms.exe -service [?]
R2 nidimk;nidimk;c:\windows\system32\drivers\nidimk.dll [4/23/2003 8:15 PM 107102]
R2 nipxirmk;nipxirmk;c:\windows\system32\drivers\nipxirmk.dll [4/18/2003 1:45 PM 36463]
R2 NwSapAgent;SAP Agent;c:\windows\system32\svchost.exe -k netsvcs [8/4/2004 5:00 AM 14336]
S2 lxdpCATSCustConnectService;lxdpCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\lxdpserv.exe [9/12/2009 10:55 PM 98984]
S3 FANTOM;LEGO MINDSTORMS NXT Driver;c:\windows\system32\drivers\fantom.sys [3/10/2006 3:55 PM 39424]
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\MAGIX\Common\Database\bin\fbserver.exe [8/28/2009 8:30 AM 1527900]
S3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\DRIVERS\klim5.sys --> c:\windows\system32\DRIVERS\klim5.sys [?]
S3 LTower;LEGO USB Tower Driver;c:\windows\system32\drivers\LTower.sys [5/31/2007 8:39 AM 39936]
S3 lv321av;Logitech USB PC Camera (VC0321);c:\windows\system32\drivers\lv321av.sys [6/20/2006 3:20 AM 1097728]
S3 NiViPxiK;NiViPxiK;c:\windows\system32\drivers\NiViPxiK.sys [6/24/2003 6:41 PM 17920]
.
Contents of the 'Scheduled Tasks' folder

2009-08-21 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 04:34]

2009-09-15 c:\windows\Tasks\User_Feed_Synchronization-{67906372-F73E-4E7F-B2DD-39B1F643450E}.job
- c:\windows\system32\msfeedssync.exe [2009-03-07 20:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.msn.com
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &D&ownload &with BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm
IE: &D&ownload all video with BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm
IE: &D&ownload all with BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm
IE: Download all links with IDM - c:\program files\Internet Download Manager\IEGetAll.htm
IE: Download FLV video content with IDM - c:\program files\Internet Download Manager\IEGetVL.htm
IE: Download with IDM - c:\program files\Internet Download Manager\IEExt.htm
IE: E&xport to Microsoft Excel - d:\msoffi~1\Office12\EXCEL.EXE/3000
TCP: {8A5C5CD7-ACCB-4AD9-8AB6-0A05B07F35EC} = 202.188.0.133,202.188.1.5
FF - ProfilePath - c:\documents and settings\acer\Application Data\Mozilla\Firefox\Profiles\o8w3og9n.default\
FF - prefs.js: browser.startup.homepage - hxxp://apps.facebook.com/inthemafia/index.php?xw_controller=index&xw_action=view|http://apps.facebook.com/piratesrul...n-world.com/space.php?action=viewpro&uid=6692
FF - prefs.js: keyword.URL - hxxp://mye.yhs.search.yahoo.com/avg/search?fr=yhs-avg&type=yahoo_avg_hs2-tb-web_mye&p=
FF - component: c:\documents and settings\acer\Application Data\IDM\idmmzcc2\components\idmmzcc.dll
FF - component: c:\documents and settings\acer\Application Data\Mozilla\Firefox\Profiles\o8w3og9n.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}\components\IBitCometExtension.dll
FF - component: c:\program files\Mozilla Firefox\extensions\search@searchsettings.com\components\SearchSettingsFF.dll

---- FIREFOX POLICIES ----
997.
- - - - ORPHANS REMOVED - - - -

SafeBoot-bzfdjmyz.sys



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-16 15:01
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{95808DC4-FA4A-4c74-92FE-5B863F82066B}]
"ImagePath "= "\??\c:\program files\CyberLink\PowerDVD\000.fcl "
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3232)
c:\windows\system32\WININET.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\MSNCHATHOOK.DLL
c:\windows\system32\sysenv.dll
c:\windows\system32\CryptoAPI.dll
c:\windows\system32\MFC71U.DLL
c:\program files\iTunes\iTunesMiniPlayer.dll
c:\program files\iTunes\iTunesMiniPlayer.Resources\en.lproj\iTunesMiniPlayerLocalized.dll
c:\program files\iTunes\iTunesMiniPlayer.Resources\iTunesMiniPlayer.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\msi.dll
c:\windows\system32\webcheck.dll
.
------------------------ Other Running Processes ------------------------
.
c:\acer\Empowering Technology\ePerformance\MemCheck.exe
c:\windows\system32\agrsmsvc.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
c:\program files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLService.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\windows\system32\lxdpcoms.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\CyberLink\Shared Files\RichVideo.exe
c:\windows\system32\wdfmgr.exe
c:\windows\system32\nipalsm.exe
c:\program files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\rundll32.exe
c:\program files\Internet Download Manager\IEMonitor.exe
c:\program files\Webshots\webshots.scr
c:\docume~1\acer\LOCALS~1\Temp\RtkBtMnt.exe
.
**************************************************************************
.
Completion time: 2009-09-16 15:05 - machine was rebooted
ComboFix-quarantined-files.txt 2009-09-16 07:05
ComboFix2.txt 2009-09-15 11:12
ComboFix3.txt 2009-08-03 15:44

Pre-Run: 9,388,490,752 bytes free
Post-Run: 8,867,954,688 bytes free

289 --- E O F --- 2008-04-07 04:09





Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:06:36 PM, on 9/16/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\WINDOWS\system32\agrsmsvc.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLService.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\lxdpcoms.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\nipalsm.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Acer\Acer Arcade\PCMService.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lexmark Z2300 Series\lxdpmon.exe
C:\Program Files\Lexmark Z2300 Series\ezprint.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Program Files\Webshots\webshots.scr
C:\DOCUME~1\acer\LOCALS~1\Temp\RtkBtMnt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.3.7.16.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Acer\Acer Arcade\PCMService.exe "
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 1
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe "
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [lxdpmon.exe] "C:\Program Files\Lexmark Z2300 Series\lxdpmon.exe "
O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark Z2300 Series\ezprint.exe "
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe "
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live Messenger Khalid Edition v5.1\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Download all links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\MSOFFI~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\MSOFFI~1\Office12\REFIEBAR.DLL
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.3.7.16.dll/206 (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{8A5C5CD7-ACCB-4AD9-8AB6-0A05B07F35EC}: NameServer = 202.188.0.133,202.188.1.5
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\WINDOWS\system32\agrsmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: lxdpCATSCustConnectService - Lexmark International, Inc. - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxdpserv.exe
O23 - Service: lxdp_device - - C:\WINDOWS\system32\lxdpcoms.exe
O23 - Service: nipxirmu - National Instruments Corporation - C:\WINDOWS\system32\nipalsm.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

--
End of file - 9219 bytes

 

thank you sir for the problem doesnt appear anymore. it's caused by malware?
excuse me sir.. why do i need to uninstall kaspersky?

 

AVP tool
isnt it kaspesky virus removal tool?
does it remove the kaspersky?

 

sir, i cant dl the file
the link says that 'failed to connect'
i have my internet connected

 

sir. i have scan for 5 times. but the button 'save report' couldnt be pressed

 

here is the log. thanks




Malwarebytes' Anti-Malware 1.41
Database version: 3011
Windows 5.1.2600 Service Pack 2

10/23/2009 12:05:51 AM
mbam-log-2009-10-23 (00-05-51).txt

Scan type: Full Scan (C:\|D:\|)
Objects scanned: 185189
Time elapsed: 42 minute(s), 38 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 4

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Documents and Settings\acer\My Documents\Downloads\Compressed\Rar.Repair.Tool.3.1\Patch.exe (Malware.Packer) -> Quarantined and deleted successfully.
C:\Documents and Settings\acer\Desktop\STORE\fil\rar file\rapid 2\CryptLoad_1.0.4\router\FRITZ!Box\nc.exe (PUP.KeyLogger) -> Quarantined and deleted successfully.
C:\Program Files\Rar Repair Tool\Patch.exe (Malware.Packer) -> Quarantined and deleted successfully.
C:\Recycled\Dc132.exe (Trojan.Agent) -> Quarantined and deleted successfully.




and

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 10/22/2009 at 09:24 PM

Application Version : 4.29.1004

Core Rules Database Version : 4162
Trace Rules Database Version: 0

Scan type : Complete Scan
Total Scan Time : 01:08:43

Memory items scanned : 211
Memory threats detected : 0
Registry items scanned : 5876
Registry threats detected : 0
File items scanned : 19939
File threats detected : 40

Adware.Tracking Cookie
C:\Documents and Settings\acer\Cookies\acer@ads.admaxasia[2].txt
C:\Documents and Settings\acer\Cookies\acer@ad.yieldmanager[2].txt
C:\Documents and Settings\acer\Cookies\acer@ads.touregypt[1].txt
C:\Documents and Settings\acer\Cookies\acer@socialmedia[2].txt
C:\Documents and Settings\acer\Cookies\acer@xxxblackbook[2].txt
C:\Documents and Settings\acer\Cookies\acer@ad2.doublepimp[1].txt
C:\Documents and Settings\acer\Cookies\acer@ad2.clickhype[1].txt
C:\Documents and Settings\acer\Cookies\acer@www.xxxblackbook[1].txt
C:\Documents and Settings\acer\Cookies\acer@statcounter[1].txt
C:\Documents and Settings\acer\Cookies\acer@ad.primetimeanytime[1].txt
C:\Documents and Settings\acer\Cookies\acer@adtech[1].txt
C:\Documents and Settings\acer\Cookies\acer@media.photobucket[2].txt
C:\Documents and Settings\acer\Cookies\acer@collective-media[1].txt
C:\Documents and Settings\acer\Cookies\acer@mediafire[2].txt
C:\Documents and Settings\acer\Cookies\acer@adsrevenue[1].txt
C:\Documents and Settings\acer\Cookies\acer@www.googleadservices[1].txt
C:\Documents and Settings\acer\Cookies\acer@media6degrees[2].txt
C:\Documents and Settings\acer\Cookies\acer@account.live[2].txt
C:\Documents and Settings\acer\Cookies\acer@accessexcellence[2].txt
C:\Documents and Settings\acer\Cookies\acer@bs.serving-sys[1].txt
C:\Documents and Settings\acer\Cookies\acer@zedo[2].txt
C:\Documents and Settings\acer\Cookies\acer@atdmt[1].txt
C:\Documents and Settings\acer\Cookies\acer@apmebf[1].txt
C:\Documents and Settings\acer\Cookies\acer@tribalfusion[2].txt
C:\Documents and Settings\acer\Cookies\acer@doubleclick[1].txt
C:\Documents and Settings\acer\Cookies\acer@adbrite[1].txt
C:\Documents and Settings\acer\Cookies\acer@msnportal.112.2o7[1].txt
C:\Documents and Settings\acer\Cookies\acer@lfstmedia[2].txt
C:\Documents and Settings\acer\Cookies\acer@serving-sys[2].txt
C:\Documents and Settings\acer\Cookies\acer@content.yieldmanager[2].txt
C:\Documents and Settings\acer\Cookies\acer@ads.infinisource[2].txt
C:\Documents and Settings\acer\Cookies\acer@cimbclicks.com[2].txt
C:\Documents and Settings\acer\Cookies\acer@www.jartrack[1].txt
C:\Documents and Settings\acer\Cookies\acer@yadro[2].txt
C:\Documents and Settings\acer\Cookies\acer@kaspersky.122.2o7[1].txt
C:\Documents and Settings\acer\Cookies\acer@mediaplex[1].txt
C:\Documents and Settings\acer\Cookies\acer@content.yieldmanager[3].txt
C:\Documents and Settings\acer\Cookies\acer@imrworldwide[2].txt
C:\Documents and Settings\acer\Cookies\acer@www.socialtrack[1].txt
C:\Documents and Settings\acer\Cookies\acer@mywebsearch[1].txt


and


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:42:08 PM, on 10/23/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\WINDOWS\system32\agrsmsvc.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\lxdpcoms.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
C:\WINDOWS\system32\nipalsm.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Acer\Acer Arcade\PCMService.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Lexmark Z2300 Series\lxdpmon.exe
C:\Program Files\Lexmark Z2300 Series\ezprint.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\DOCUME~1\acer\LOCALS~1\Temp\RtkBtMnt.exe
C:\Program Files\Webshots\webshots.scr
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\wuauclt.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ievkbd.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Acer\Acer Arcade\PCMService.exe "
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 1
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe "
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [lxdpmon.exe] "C:\Program Files\Lexmark Z2300 Series\lxdpmon.exe "
O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark Z2300 Series\ezprint.exe "
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe "
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ie_banner_deny.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\MSOFFI~1\Office12\EXCEL.EXE/3000
O9 - Extra button: &Virtual keyboard - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\MSOFFI~1\Office12\REFIEBAR.DLL
O9 - Extra button: URLs c&heck - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{8A5C5CD7-ACCB-4AD9-8AB6-0A05B07F35EC}: NameServer = 202.188.0.133,202.188.1.5
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll
O20 - Winlogon Notify: !SASWinLogon - C:\WINDOWS\
O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\WINDOWS\system32\agrsmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: lxdpCATSCustConnectService - Lexmark International, Inc. - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxdpserv.exe
O23 - Service: lxdp_device - - C:\WINDOWS\system32\lxdpcoms.exe
O23 - Service: nipxirmu - National Instruments Corporation - C:\WINDOWS\system32\nipalsm.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

--
End of file - 9051 bytes


thank you

 

Here it is


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:05:23 AM, on 10/25/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\agrsmsvc.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\lxdpcoms.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
C:\WINDOWS\system32\nipalsm.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\WINDOWS\system32\wuauclt.exe
C:\DOCUME~1\acer\LOCALS~1\Temp\RtkBtMnt.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ievkbd.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 1
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe "
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe "
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ie_banner_deny.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\MSOFFI~1\Office12\EXCEL.EXE/3000
O9 - Extra button: &Virtual keyboard - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\MSOFFI~1\Office12\REFIEBAR.DLL
O9 - Extra button: URLs c&heck - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{8A5C5CD7-ACCB-4AD9-8AB6-0A05B07F35EC}: NameServer = 202.188.0.133,202.188.1.5
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll
O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\WINDOWS\system32\agrsmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: lxdpCATSCustConnectService - Lexmark International, Inc. - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxdpserv.exe
O23 - Service: lxdp_device - - C:\WINDOWS\system32\lxdpcoms.exe
O23 - Service: nipxirmu - National Instruments Corporation - C:\WINDOWS\system32\nipalsm.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

--
End of file - 7975 bytes

thank u ^^