Solved Security Tool. Removed and came back

[Resolved] Security Tool. Removed and came back

Hi, I have been infected with the Security Tool malware two days ago. I have searched the web for removing the malware, and I have tried everything. I have used every method on the web (and manual removal as well) to remove Security Tool, but it came back. How can I know for sure that I have removed the malware?

Thank you for helping me. Your a big saver.

Sorry that I cannot find any attachment option, so I post it directly.

Here is my DDS:


DDS (Ver_09-10-13.01) - NTFSx86
Run by Wilson at 22:54:30.48 on 10/19/2009 Mon
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_15
Microsoft Windows XP Professional 5.1.2600.3.932.81.1033.18.1023.346 [GMT -7:00]

AV: ZoneAlarm Security Suite Antivirus *On-access scanning enabled* (Outdated) {5D467B10-818C-4CAB-9FF7-6893B5B8F3CF}
AV: Avira AntiVir PersonalEdition *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
FW: ZoneAlarm Security Suite Firewall *enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}

============== Running Processes ===============

D:\WINDOWS\system32\svchost -k DcomLaunch
D:\WINDOWS\system32\svchost -k rpcss
D:\WINDOWS\System32\svchost.exe -k netsvcs
D:\WINDOWS\system32\svchost.exe -k NetworkService
D:\WINDOWS\system32\svchost.exe -k LocalService
D:\WINDOWS\system32\ZoneLabs\vsmon.exe
D:\WINDOWS\system32\ZoneLabs\avsys\ScanningProcess.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
D:\WINDOWS\system32\svchost.exe -k LocalService
D:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
D:\Program Files\Bonjour\mDNSResponder.exe
D:\Program Files\Java\jre6\bin\jqs.exe
D:\WINDOWS\system32\nvsvc32.exe
D:\Side Programs\Spyware Doctor\pctsAuxs.exe
D:\Side Programs\Spyware Doctor\pctsSvc.exe
D:\WINDOWS\system32\svchost.exe -k imgsvc
"D:\WINDOWS\system32\svchost.exe "
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\SOUNDMAN.EXE
D:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\Side Programs\HP\HP Software Update\HPWuSchd2.exe
D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
D:\SIDEPR~1\SsAAD.exe
D:\Side Programs\CyberLink\PowerDVD\PDVDServ.exe
D:\WINDOWS\system32\dla\tfswctrl.exe
D:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
D:\WINDOWS\VM_STI.EXE
D:\WINDOWS\system32\RUNDLL32.EXE
D:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
D:\Side Programs\Zone Labs\ZoneAlarm\zlclient.exe
D:\Program Files\Java\jre6\bin\jusched.exe
D:\Program Files\Unlocker\UnlockerAssistant.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Program Files\Windows Live\Messenger\msnmsgr.exe
D:\Side Programs\HP\Digital Imaging\bin\hpqtra08.exe
D:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
D:\WINDOWS\System32\alg.exe
D:\Side Programs\HP\Digital Imaging\bin\hpqSTE08.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\WINDOWS\SYSTEM32\userinit.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\SOUNDMAN.EXE
D:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\Side Programs\HP\HP Software Update\HPWuSchd2.exe
D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
D:\SIDEPR~1\SsAAD.exe
D:\Side Programs\CyberLink\PowerDVD\PDVDServ.exe
D:\WINDOWS\system32\dla\tfswctrl.exe
D:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
D:\WINDOWS\VM_STI.EXE
D:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
D:\Side Programs\Zone Labs\ZoneAlarm\zlclient.exe
D:\Program Files\Java\jre6\bin\jusched.exe
D:\Program Files\Unlocker\UnlockerAssistant.exe
D:\Program Files\Messenger\msmsgs.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Side Programs\HP\Digital Imaging\bin\hpqtra08.exe
D:\Side Programs\HP\Digital Imaging\bin\hpqSTE08.exe
D:\WINDOWS\system32\HPZipm12.exe
D:\WINDOWS\SYSTEM32\userinit.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\SOUNDMAN.EXE
D:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\Side Programs\HP\HP Software Update\HPWuSchd2.exe
D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
D:\SIDEPR~1\SsAAD.exe
D:\Side Programs\CyberLink\PowerDVD\PDVDServ.exe
D:\WINDOWS\system32\dla\tfswctrl.exe
D:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
D:\WINDOWS\VM_STI.EXE
D:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
D:\Side Programs\Zone Labs\ZoneAlarm\zlclient.exe
D:\Program Files\Java\jre6\bin\jusched.exe
D:\Program Files\Unlocker\UnlockerAssistant.exe
D:\Side Programs\Spyware Doctor\pctsTray.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Side Programs\HP\Digital Imaging\bin\hpqtra08.exe
D:\Side Programs\HP\Digital Imaging\bin\hpqSTE08.exe
D:\Side Programs\Trend Micro\HijackThis\HijackThis.exe
D:\WINDOWS\system32\NOTEPAD.EXE
D:\Program Files\Mozilla Firefox\firefox.exe
D:\Documents and Settings\Wilson\Desktop\dds.scr
D:\WINDOWS\system32\conime.exe
D:\WINDOWS\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = about:blank
uInternet Settings,ProxyOverride = *.local
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - d:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - d:\windows\system32\dla\tfswshx.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - d:\program files\microsoft office\office12\GrooveShellExtensions.dll
BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - d:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - d:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - d:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
uRun: [CTFMON.EXE] d:\windows\system32\ctfmon.exe
mRun: [IMJPMIG8.1] "d:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
mRun: [PHIME2002ASync] d:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC
mRun: [PHIME2002A] d:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName
mRun: [SoundMan] SOUNDMAN.EXE
mRun: [TkBellExe] "d:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [HP Software Update] d:\side programs\hp\hp software update\HPWuSchd2.exe
mRun: [Adobe Reader Speed Launcher] "d:\program files\adobe\reader 8.0\reader\Reader_sl.exe "
mRun: [GrooveMonitor] "d:\program files\microsoft office\office12\GrooveMonitor.exe "
mRun: [SsAAD.exe] d:\sidepr~1\SsAAD.exe
mRun: [RemoteControl] "d:\side programs\cyberlink\powerdvd\PDVDServ.exe "
mRun: [dla] d:\windows\system32\dla\tfswctrl.exe
mRun: [ISUSPM Startup] d:\progra~1\common~1\instal~1\update~1\ISUSPM.exe -startup
mRun: [ISUSScheduler] "d:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [BigDogPath] d:\windows\VM_STI.EXE HiCam USB 1.1 VM
mRun: [NvCplDaemon] RUNDLL32.EXE d:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [NvMediaCenter] RUNDLL32.EXE d:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [avgnt] "d:\program files\avira\antivir personaledition classic\avgnt.exe" /min
mRun: [ZoneAlarm Client] "d:\side programs\zone labs\zonealarm\zlclient.exe "
mRun: [SunJavaUpdateSched] "d:\program files\java\jre6\bin\jusched.exe "
mRun: [UnlockerAssistant] "d:\program files\unlocker\UnlockerAssistant.exe "
mRun: [Malwarebytes Anti-Malware (reboot)] "d:\side programs\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
mRun: [ISTray] "d:\side programs\spyware doctor\pctsTray.exe "
dRun: [CTFMON.EXE] d:\windows\system32\CTFMON.EXE
StartupFolder: d:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - d:\side programs\hp\digital imaging\bin\hpqtra08.exe
IE: E&xport to Microsoft Excel - d:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - d:\program files\messenger\msmsgs.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - d:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - d:\progra~1\micros~2\office12\REFIEBAR.DLL
DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} - hxxp://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} - hxxp://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1219184584046
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - hxxp://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {DA758BB1-5F89-4465-975F-8D7179A4BCF3} - hxxp://messenger.zone.msn.com/binary/WoF.cab57176.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - d:\program files\microsoft office\office12\GrooveSystemServices.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - d:\program files\microsoft office\office12\GrooveShellExtensions.dll

================= FIREFOX ===================

FF - ProfilePath - d:\docume~1\wilson\applic~1\mozilla\firefox\profiles\832pkz8h.default\
FF - plugin: c:\program files\real\realplayer\netscape6\nppl3260.dll
FF - plugin: c:\program files\real\realplayer\netscape6\nprjplug.dll
FF - plugin: c:\program files\real\realplayer\netscape6\nprpjplug.dll
FF - plugin: d:\program files\mozilla firefox\plugins\NPinfotl.dll
FF - plugin: d:\side programs\divx\divx player\npDivxPlayerPlugin.dll
FF - plugin: d:\side programs\divx\divx web player\npdivx32.dll
FF - HiddenExtension: Java Console: No Registry Reference - d:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - d:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - d:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - d:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

============= SERVICES / DRIVERS ===============

R0 PCTCore;PCTools KDS;d:\windows\system32\drivers\PCTCore.sys [2009-10-18 206256]
R2 sdAuxService;PC Tools Auxiliary Service;d:\side programs\spyware doctor\pctsAuxs.exe [2009-10-18 348824]
S3 NPF;WinPcap Packet Driver (NPF);d:\windows\system32\drivers\npf.sys [2007-11-15 34064]

=============== Created Last 30 ================

2009-10-19 18:00 <DIR> --d----- d:\program files\WinPcap
2009-10-19 11:10 236,544 a------- d:\windows\PEV.exe
2009-10-19 11:10 161,792 a------- d:\windows\SWREG.exe
2009-10-19 11:10 98,816 a------- d:\windows\sed.exe
2009-10-18 23:27 <DIR> --d----- d:\docume~1\wilson\applic~1\Malwarebytes
2009-10-18 18:06 38,224 a------- d:\windows\system32\drivers\mbamswissarmy.sys
2009-10-18 18:06 <DIR> --d----- d:\docume~1\alluse~1\applic~1\Malwarebytes
2009-10-18 18:06 19,160 a------- d:\windows\system32\drivers\mbam.sys
2009-10-18 14:52 159,600 a------- d:\windows\system32\drivers\pctgntdi.sys
2009-10-18 14:52 206,256 a------- d:\windows\system32\drivers\PCTCore.sys
2009-10-18 14:52 86,888 a------- d:\windows\system32\drivers\PCTAppEvent.sys
2009-10-18 14:52 7,396 a------- d:\windows\system32\drivers\pctcore.cat
2009-10-18 14:52 <DIR> --d----- d:\program files\common files\PC Tools
2009-10-18 14:52 64,392 a------- d:\windows\system32\drivers\pctplsg.sys
2009-10-18 13:16 <DIR> --d----- d:\docume~1\alluse~1\applic~1\PC Tools
2009-10-18 11:10 26,112 a------- d:\windows\system32\stu2.exe
2009-10-13 18:42 <DIR> --d----- d:\docume~1\wilson\applic~1\KannagiAcc01
2009-10-13 18:42 2,429 -------- d:\windows\setup_028b37bauninst_kan_acc01.ini
2009-10-13 18:42 608,256 -------- d:\windows\setup_028b37bauninst_kan_acc01.exe
2009-10-13 18:42 9,604,608 -------- d:\windows\縺九ｓ縺ｪ縺・鄒手｡馴Κ蜩｡)繧ｹ繧ｯ繝ｪ繝ｼ繝ｳ繧ｻ繝ｼ繝舌・.scr
2009-10-13 18:42 11,144,192 -------- d:\windows\縺九ｓ縺ｪ縺・繝翫ぐ)繧ｹ繧ｯ繝ｪ繝ｼ繝ｳ繧ｻ繝ｼ繝舌・.scr
2009-10-13 18:42 2,496,000 -------- d:\windows\縺九ｓ縺ｪ縺・繝槭せ繧ｳ繝・ヨ)繧ｹ繧ｯ繝ｪ繝ｼ繝ｳ繧ｻ繝ｼ繝舌・.scr
2009-10-13 18:42 5,986,304 -------- d:\windows\縺九ｓ縺ｪ縺・縺､縺舌∩)繧ｹ繧ｯ繝ｪ繝ｼ繝ｳ繧ｻ繝ｼ繝舌・.scr
2009-10-13 18:42 9,075,200 -------- d:\windows\縺九ｓ縺ｪ縺・縺悶ｓ縺偵■繧・ｓ)繧ｹ繧ｯ繝ｪ繝ｼ繝ｳ繧ｻ繝ｼ繝舌・.scr
2009-10-09 13:20 <DIR> --d----- d:\program files\Unlocker
2009-09-22 23:50 515,416 a------- d:\windows\system32\XAudio2_5.dll
2009-09-22 23:50 238,936 a------- d:\windows\system32\xactengine3_5.dll
2009-09-22 23:49 1,974,616 a------- d:\windows\system32\D3DCompiler_42.dll
2009-09-22 23:49 5,501,792 a------- d:\windows\system32\d3dcsx_42.dll
2009-09-22 23:49 235,344 a------- d:\windows\system32\d3dx11_42.dll
2009-09-22 23:49 453,456 a------- d:\windows\system32\d3dx10_42.dll
2009-09-22 23:49 1,892,184 a------- d:\windows\system32\D3DX9_42.dll

==================== Find3M ====================

2009-10-19 21:44 11,127,548 a--sh--- d:\windows\system32\drivers\fidbox.idx
2009-10-19 21:44 839,066,400 a--sh--- d:\windows\system32\drivers\fidbox.dat
2009-10-18 11:09 68,096 a------- d:\windows\system32\userinit.exe
2009-10-13 18:42 9,604,608 -------- d:\windows\縺九ｓ縺ｪ縺・鄒手｡馴Κ蜩｡)繧ｹ繧ｯ繝ｪ繝ｼ繝ｳ繧ｻ繝ｼ繝舌・.scr
2009-10-13 18:42 11,144,192 -------- d:\windows\縺九ｓ縺ｪ縺・繝翫ぐ)繧ｹ繧ｯ繝ｪ繝ｼ繝ｳ繧ｻ繝ｼ繝舌・.scr
2009-10-13 18:42 2,496,000 -------- d:\windows\縺九ｓ縺ｪ縺・繝槭せ繧ｳ繝・ヨ)繧ｹ繧ｯ繝ｪ繝ｼ繝ｳ繧ｻ繝ｼ繝舌・.scr
2009-10-13 18:42 5,986,304 -------- d:\windows\縺九ｓ縺ｪ縺・縺､縺舌∩)繧ｹ繧ｯ繝ｪ繝ｼ繝ｳ繧ｻ繝ｼ繝舌・.scr
2009-10-13 18:42 9,075,200 -------- d:\windows\縺九ｓ縺ｪ縺・縺悶ｓ縺偵■繧・ｓ)繧ｹ繧ｯ繝ｪ繝ｼ繝ｳ繧ｻ繝ｼ繝舌・.scr
2009-10-13 06:51 4,212 a---h--- d:\windows\system32\zllictbl.dat
2009-09-11 07:18 136,192 a------- d:\windows\system32\msv1_0.dll
2009-09-04 17:44 69,464 a------- d:\windows\system32\XAPOFX1_3.dll
2009-09-04 14:03 58,880 a------- d:\windows\system32\msasn1.dll
2009-08-29 01:08 916,480 -------- d:\windows\system32\wininet.dll
2009-08-26 01:00 247,326 a------- d:\windows\system32\strmdll.dll
2009-08-17 23:33 1,193,832 a------- d:\windows\system32\FM20.DLL
2009-08-05 02:01 204,800 a------- d:\windows\system32\mswebdvd.dll
2009-08-04 20:44 2,189,184 -------- d:\windows\system32\ntoskrnl.exe
2009-08-04 07:20 2,066,048 -------- d:\windows\system32\ntkrnlpa.exe
2009-07-25 05:23 411,368 a------- d:\windows\system32\deploytk.dll
2008-08-19 12:11 22,328 a------- d:\docume~1\wilson\applic~1\PnkBstrK.sys
2009-03-30 15:01 32,768 a--sh--- d:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012009033020090331\index.dat

============= FINISH: 22:57:06.43 ===============


And my attach.txt


UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-10-13.01)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 3/1/2008 12:03:12 AM
System Uptime: 10/19/2009 09:44:26 PM (1 hours ago)

Motherboard: ASUSTeK Computer INC. | | A8N-E
Processor: AMD Athlon(tm) 64 Processor 3500+ | Socket 939 | 2211/200mhz

==== Disk Partitions =========================

A: is Removable
C: is FIXED (NTFS) - 131 GiB total, 4.975 GiB free.
D: is FIXED (NTFS) - 59 GiB total, 4.947 GiB free.
E: is CDROM ()
F: is CDROM ()
G: is CDROM ()
H: is CDROM ()

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP250: 9/5/2009 08:03:13 PM - Removed Prototype(TM)
RP251: 9/5/2009 09:33:55 PM - Installed Tom Clancy's Rainbow Six: Lockdown
RP252: 9/5/2009 10:15:47 PM - Installed DirectX 9.0
RP253: 9/6/2009 07:27:05 AM - Software Distribution Service 3.0
RP254: 9/6/2009 01:03:51 PM - Removed Tom Clancy's Rainbow Six: Lockdown
RP255: 9/6/2009 01:40:13 PM - Installed DirectX
RP256: 9/7/2009 08:25:39 AM - Software Distribution Service 3.0
RP257: 9/8/2009 08:09:45 AM - Software Distribution Service 3.0
RP258: 9/9/2009 09:40:49 AM - Software Distribution Service 3.0
RP259: 9/10/2009 08:12:10 AM - Software Distribution Service 3.0
RP260: 9/13/2009 03:00:59 AM - Software Distribution Service 3.0
RP261: 9/14/2009 09:22:04 AM - Software Distribution Service 3.0
RP262: 9/15/2009 08:06:00 AM - Software Distribution Service 3.0
RP263: 9/16/2009 09:37:40 AM - Software Distribution Service 3.0
RP264: 9/17/2009 08:25:35 AM - Software Distribution Service 3.0
RP265: 9/18/2009 09:50:57 AM - Software Distribution Service 3.0
RP266: 9/19/2009 01:04:33 AM - Software Distribution Service 3.0
RP267: 9/20/2009 09:56:55 AM - Software Distribution Service 3.0
RP268: 9/21/2009 09:10:47 AM - Software Distribution Service 3.0
RP269: 9/22/2009 08:10:58 AM - Software Distribution Service 3.0
RP270: 9/22/2009 11:49:01 PM - Installed DirectX
RP271: 9/23/2009 09:32:14 AM - Software Distribution Service 3.0
RP272: 9/23/2009 06:40:19 PM - Installed DirectX
RP273: 9/23/2009 07:28:31 PM - Removed Microsoft Games for Windows - LIVE
RP274: 9/23/2009 07:29:33 PM - Removed Microsoft Games for Windows - LIVE Redistributable
RP275: 9/24/2009 07:57:36 AM - Software Distribution Service 3.0
RP276: 9/25/2009 09:59:50 AM - Software Distribution Service 3.0
RP277: 9/25/2009 06:42:34 PM - Installed Battlefield 2(TM)
RP278: 9/26/2009 09:13:15 AM - Software Distribution Service 3.0
RP279: 9/27/2009 07:51:13 AM - Software Distribution Service 3.0
RP280: 9/28/2009 09:53:20 AM - Software Distribution Service 3.0
RP281: 9/29/2009 11:25:34 AM - System Checkpoint
RP282: 9/30/2009 09:36:55 AM - Software Distribution Service 3.0
RP283: 10/1/2009 08:10:57 AM - Software Distribution Service 3.0
RP284: 10/2/2009 10:07:00 AM - Software Distribution Service 3.0
RP285: 10/3/2009 10:53:39 AM - Software Distribution Service 3.0
RP286: 10/4/2009 10:33:06 AM - Software Distribution Service 3.0
RP287: 10/5/2009 07:39:42 AM - Software Distribution Service 3.0
RP288: 10/6/2009 07:12:23 AM - Software Distribution Service 3.0
RP289: 10/7/2009 09:33:26 AM - Software Distribution Service 3.0
RP290: 10/8/2009 08:10:25 AM - Software Distribution Service 3.0
RP291: 10/9/2009 09:12:06 AM - Software Distribution Service 3.0
RP292: 10/10/2009 03:00:47 AM - Software Distribution Service 3.0
RP293: 10/11/2009 10:57:55 AM - Software Distribution Service 3.0
RP294: 10/12/2009 03:00:56 AM - Software Distribution Service 3.0
RP295: 10/12/2009 11:18:37 AM - Software Distribution Service 3.0
RP296: 10/13/2009 02:35:53 PM - System Checkpoint
RP297: 10/14/2009 03:13:39 PM - System Checkpoint
RP298: 10/15/2009 07:34:39 AM - Software Distribution Service 3.0
RP299: 10/16/2009 11:41:07 AM - System Checkpoint
RP300: 10/17/2009 11:46:31 AM - System Checkpoint
RP301: 10/18/2009 06:35:12 PM - System Checkpoint
RP302: 10/19/2009 08:03:00 AM - Software Distribution Service 3.0
RP303: 10/19/2009 10:59:09 AM - Restore Operation

==== Installed Programs ======================

「かんなぎ」ですくとっぷあくせさり～
３Ｄカスタム少女
5600
5600_Help
5600Trb
7-Zip 4.57
Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)
Adobe Anchor Service CS3
Adobe Asset Services CS3
Adobe Bridge CS3
Adobe Bridge Start Meeting
Adobe Camera Raw 4.0
Adobe CMaps
Adobe Color - Photoshop Specific
Adobe Color Common Settings
Adobe Color EU Extra Settings
Adobe Color JA Extra Settings
Adobe Color NA Recommended Settings
Adobe Default Language CS3
Adobe Device Central CS3
Adobe ExtendScript Toolkit 2
Adobe Flash CS3
Adobe Flash CS3 Professional
Adobe Flash Player 10 Plugin
Adobe Flash Player 9 ActiveX
Adobe Flash Player ActiveX
Adobe Fonts All
Adobe Help Viewer CS3
Adobe Linguistics CS3
Adobe PDF Library Files
Adobe Photoshop CS3
Adobe Reader 8.1.2
Adobe Reader 8.1.2 Security Update 1 (KB403742)
Adobe Setup
Adobe Stock Photos CS3
Adobe Type Support
Adobe Update Manager CS3
Adobe Version Cue CS3 Client
Adobe WinSoft Linguistics Plugin
Adobe XMP Panels CS3
AGEIA PhysX v7.07.09
AiO_Scan
AiOSoftware
Audacity 1.2.6
Auto Gordian Knot 2.45
AutoUpdate
Avira AntiVir Personal - Free Antivirus
AviSynth 2.5
Battlefield 2(TM)
BitComet 0.56
BufferChm
Chinese Traditional Fonts Support For Adobe Reader 8
CP_Package_Variety1
CP_Package_Variety2
CP_Package_Variety3
CutePDF Writer 2.7
DesktopK-ON!
Destinations
DeviceManagementQFolder
DivX Codec
DivX Converter
DivX Player
DivX Web Player
DocProc
DVD Decrypter (Remove Only)
eSupportQFolder
Fax
ffdshow [rev 2202] [2008-10-10]
FileZilla Client 3.0.10
HijackThis 2.0.2
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
HP Image Zone Express
HP Imaging Device Functions 5.3
HP PSC & OfficeJet 5.3.B
HP Solution Center & Imaging Support Tools 5.3
HP Update
HPProductAssistant
ISO Recorder
Jagged Alliance 2 Gold
Jagged Alliance 2 v1.13 (EN) [1.0.0.2085]
Java(TM) 6 Update 15
Java(TM) 6 Update 5
Java(TM) 6 Update 7
JMP 7
LEGO Star Wars II
Malwarebytes' Anti-Malware
Messenger Plus! Live
MetalGearSolid2 Substance
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Software Update for Web Folders (English) 12
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Mozilla Firefox (3.0.14)
MSN
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
NewCopy
OpenMG Limited Patch 4.1-05-13-31-01
OpenMG Secure Module 4.1.00
PDF Settings
PowerDVD
ProductContext
Readme
RealPlayer
Realtek AC'97 Audio
Rhapsody Player Engine
SAS Private JRE (J2SE(tm) Java Runtime Environment 1.4.2_09)
Scan
ScannerCopy
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB969679)
Security Update for CAPICOM (KB931906)
Security Update for Microsoft Office Excel 2007 (KB969682)
Security Update for Microsoft Office Outlook 2007 (KB972363)
Security Update for Microsoft Office PowerPoint 2007 (KB957789)
Security Update for Microsoft Office Publisher 2007 (KB969693)
Security Update for Microsoft Office system 2007 (972581)
Security Update for Microsoft Office system 2007 (KB969613)
Security Update for Microsoft Office system 2007 (KB974234)
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
Security Update for Microsoft Office Word 2007 (KB969604)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 7 (KB969897)
Security Update for Windows Internet Explorer 7 (KB972260)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB972260)
Security Update for Windows Internet Explorer 8 (KB974455)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 9 (KB936782)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB938464-v2)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
SolutionCenter
Sonic DLA
Sonic RecordNow!
Sonic Update Manager
SonicStage 3.0
SpyHunter
Spyware Doctor 6.1
Status
TrayApp
Unload
Unlocker 1.8.7
Update for 2007 Microsoft Office System (KB967642)
Update for Outlook 2007 Junk Email Filter (KB974810)
Update for Windows Internet Explorer 8 (KB972636)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB973815)
VC 9.0 Runtime
VideoLAN VLC media player 0.8.6e
VobSub v2.23 (Remove Only)
VSO Image Resizer 2.0.1.17
WebFldrs XP
WebReg
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Imaging Component
Windows Internet Explorer 7
Windows Internet Explorer 8
Windows Live installer
Windows Live Messenger
Windows Live Sign-in Assistant
Windows XP Service Pack 3
WinFast(R) Display Driver
WinRAR
XviD MPEG4 Video Codec (remove only)
ZoneAlarm Security Suite
マジカルバトルアリーナ・魔法少女武闘祭
神様なんていらない

==== End Of File ===========================

 

Here is my combofix log:

ComboFix 09-10-20.03 - Lily 20/10/2009 19:56.1.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.932.81.1033.18.1023.663 [GMT -7:00]
Running from: d:\documents and settings\Lily\Desktop\ComboFix.exe
AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
AV: ZoneAlarm Security Suite Antivirus *On-access scanning disabled* (Outdated) {5D467B10-818C-4CAB-9FF7-6893B5B8F3CF}
FW: ZoneAlarm Security Suite Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

d:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
d:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
d:\documents and settings\Lily\Application Data\Desktopicon
d:\program files\WinPCap
d:\program files\WinPCap\rpcapd.exe
d:\windows\Installer\11c66a.msi
d:\windows\Installer\be45f.msi
d:\windows\Installer\f3d02a2.msi
d:\windows\system32\drivers\npf.sys
d:\windows\system32\Packet.dll
d:\windows\system32\pthreadVC.dll
d:\windows\system32\WanPacket.dll
d:\windows\system32\wpcap.dll

----- BITS: Possible infected sites -----

hxxp://mastoblastobrevodo.com
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_NPF
-------\Service_NPF


((((((((((((((((((((((((( Files Created from 2009-09-21 to 2009-10-21 )))))))))))))))))))))))))))))))
.

2009-10-20 22:06 . 2009-10-20 22:06 -------- d-----w- d:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-10-20 22:05 . 2009-10-20 22:05 -------- d-----w- d:\documents and settings\Wilson\Application Data\SUPERAntiSpyware.com
2009-10-20 15:16 . 2009-10-20 15:16 -------- d-----w- d:\documents and settings\Lily\Application Data\Malwarebytes
2009-10-20 15:06 . 2009-10-20 15:06 -------- d-sh--w- d:\documents and settings\Administrator\IETldCache
2009-10-19 06:27 . 2009-10-19 06:27 -------- d-----w- d:\documents and settings\Wilson\Application Data\Malwarebytes
2009-10-19 01:06 . 2009-10-19 01:06 -------- d-----w- d:\documents and settings\Tricia\Application Data\Malwarebytes
2009-10-19 01:06 . 2009-09-10 21:54 38224 ----a-w- d:\windows\system32\drivers\mbamswissarmy.sys
2009-10-19 01:06 . 2009-10-19 01:06 -------- d-----w- d:\documents and settings\All Users\Application Data\Malwarebytes
2009-10-19 01:06 . 2009-09-10 21:53 19160 ----a-w- d:\windows\system32\drivers\mbam.sys
2009-10-18 20:16 . 2009-10-18 20:16 -------- d-----w- d:\documents and settings\Tricia\Application Data\PC Tools
2009-10-18 20:16 . 2009-10-18 20:16 -------- d-----w- d:\documents and settings\All Users\Application Data\PC Tools
2009-10-18 20:15 . 2009-10-20 22:14 -------- d---a-w- d:\documents and settings\All Users\Application Data\TEMP
2009-10-16 03:56 . 2009-10-16 03:56 -------- d-sh--w- d:\windows\system32\config\systemprofile\IETldCache
2009-10-14 01:42 . 2009-10-14 01:48 -------- d-----w- d:\documents and settings\Wilson\Application Data\KannagiAcc01
2009-10-14 01:42 . 2009-10-14 01:42 608256 ------w- d:\windows\setup_028b37bauninst_kan_acc01.exe
2009-10-14 01:42 . 2009-10-14 01:42 9604608 ------w- d:\windows\縺九ｓ縺ｪ縺・鄒手｡馴Κ蜩｡)繧ｹ繧ｯ繝ｪ繝ｼ繝ｳ繧ｻ繝ｼ繝舌・.scr
2009-10-14 01:42 . 2009-10-14 01:42 11144192 ------w- d:\windows\縺九ｓ縺ｪ縺・繝翫ぐ)繧ｹ繧ｯ繝ｪ繝ｼ繝ｳ繧ｻ繝ｼ繝舌・.scr
2009-10-14 01:42 . 2009-10-14 01:42 2496000 ------w- d:\windows\縺九ｓ縺ｪ縺・繝槭せ繧ｳ繝・ヨ)繧ｹ繧ｯ繝ｪ繝ｼ繝ｳ繧ｻ繝ｼ繝舌・.scr
2009-10-14 01:42 . 2009-10-14 01:42 5986304 ------w- d:\windows\縺九ｓ縺ｪ縺・縺､縺舌∩)繧ｹ繧ｯ繝ｪ繝ｼ繝ｳ繧ｻ繝ｼ繝舌・.scr
2009-10-14 01:42 . 2009-10-14 01:42 9075200 ------w- d:\windows\縺九ｓ縺ｪ縺・縺悶ｓ縺偵■繧・ｓ)繧ｹ繧ｯ繝ｪ繝ｼ繝ｳ繧ｻ繝ｼ繝舌・.scr
2009-10-09 20:20 . 2009-10-10 04:54 -------- d-----w- d:\program files\Unlocker
2009-09-23 06:50 . 2009-09-05 00:44 515416 ----a-w- d:\windows\system32\XAudio2_5.dll
2009-09-23 06:50 . 2009-09-05 00:44 238936 ----a-w- d:\windows\system32\xactengine3_5.dll
2009-09-23 06:49 . 2009-09-05 00:29 1974616 ----a-w- d:\windows\system32\D3DCompiler_42.dll
2009-09-23 06:49 . 2009-09-05 00:29 5501792 ----a-w- d:\windows\system32\d3dcsx_42.dll
2009-09-23 06:49 . 2009-09-05 00:29 235344 ----a-w- d:\windows\system32\d3dx11_42.dll
2009-09-23 06:49 . 2009-09-05 00:29 453456 ----a-w- d:\windows\system32\d3dx10_42.dll
2009-09-23 06:49 . 2009-09-05 00:29 1892184 ----a-w- d:\windows\system32\D3DX9_42.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-21 03:08 . 2009-01-07 01:43 11150516 --sha-w- d:\windows\system32\drivers\fidbox.idx
2009-10-21 03:08 . 2009-01-07 01:43 839066400 --sha-w- d:\windows\system32\drivers\fidbox.dat
2009-10-20 22:04 . 2008-08-30 22:39 -------- d-----w- d:\program files\Common Files\Wise Installation Wizard
2009-10-15 14:50 . 2008-03-09 15:12 -------- d-----w- d:\documents and settings\All Users\Application Data\Microsoft Help
2009-10-14 01:42 . 2009-10-14 01:42 9604608 ------w- d:\windows\縺九ｓ縺ｪ縺・鄒手｡馴Κ蜩｡)繧ｹ繧ｯ繝ｪ繝ｼ繝ｳ繧ｻ繝ｼ繝舌・.scr
2009-10-14 01:42 . 2009-10-14 01:42 11144192 ------w- d:\windows\縺九ｓ縺ｪ縺・繝翫ぐ)繧ｹ繧ｯ繝ｪ繝ｼ繝ｳ繧ｻ繝ｼ繝舌・.scr
2009-10-14 01:42 . 2009-10-14 01:42 2496000 ------w- d:\windows\縺九ｓ縺ｪ縺・繝槭せ繧ｳ繝・ヨ)繧ｹ繧ｯ繝ｪ繝ｼ繝ｳ繧ｻ繝ｼ繝舌・.scr
2009-10-14 01:42 . 2009-10-14 01:42 5986304 ------w- d:\windows\縺九ｓ縺ｪ縺・縺､縺舌∩)繧ｹ繧ｯ繝ｪ繝ｼ繝ｳ繧ｻ繝ｼ繝舌・.scr
2009-10-14 01:42 . 2009-10-14 01:42 9075200 ------w- d:\windows\縺九ｓ縺ｪ縺・縺悶ｓ縺偵■繧・ｓ)繧ｹ繧ｯ繝ｪ繝ｼ繝ｳ繧ｻ繝ｼ繝舌・.scr
2009-10-13 13:51 . 2009-01-07 01:30 4212 ---ha-w- d:\windows\system32\zllictbl.dat
2009-10-08 16:33 . 2008-05-22 05:26 -------- d-----w- d:\documents and settings\Wilson\Application Data\Image Zone Express
2009-09-26 01:42 . 2008-03-01 08:56 -------- d--h--w- d:\program files\InstallShield Installation Information
2009-09-19 22:40 . 2009-09-06 20:45 -------- d-----w- d:\documents and settings\Lily\Application Data\Bioshock
2009-09-11 14:18 . 2004-08-04 12:00 136192 ----a-w- d:\windows\system32\msv1_0.dll
2009-09-07 19:59 . 2009-09-07 19:59 -------- d--h--r- d:\documents and settings\Wilson\Application Data\SecuROM
2009-09-07 04:40 . 2008-03-01 21:22 77336 ----a-w- d:\documents and settings\Lily\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-09-06 20:45 . 2009-09-06 20:45 -------- d--h--r- d:\documents and settings\Lily\Application Data\SecuROM
2009-09-05 00:44 . 2009-08-17 13:31 69464 ----a-w- d:\windows\system32\XAPOFX1_3.dll
2009-09-04 21:03 . 2004-08-04 12:00 58880 ----a-w- d:\windows\system32\msasn1.dll
2009-09-01 17:22 . 2008-03-08 06:37 77336 ----a-w- d:\documents and settings\Wilson\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-29 19:42 . 2008-03-09 22:14 77336 ----a-w- d:\documents and settings\Tricia\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-29 08:08 . 2004-08-04 12:00 916480 ------w- d:\windows\system32\wininet.dll
2009-08-29 06:37 . 2008-03-09 15:26 -------- d-----w- d:\program files\Microsoft Works
2009-08-26 08:00 . 2004-08-04 12:00 247326 ----a-w- d:\windows\system32\strmdll.dll
2009-08-18 06:33 . 2009-08-18 06:33 1193832 ----a-w- d:\windows\system32\FM20.DLL
2009-08-05 09:01 . 2004-08-04 12:00 204800 ----a-w- d:\windows\system32\mswebdvd.dll
2009-08-05 03:44 . 2004-08-04 12:00 2189184 ------w- d:\windows\system32\ntoskrnl.exe
2009-08-04 14:20 . 2004-08-03 22:59 2066048 ------w- d:\windows\system32\ntkrnlpa.exe
2009-07-25 12:23 . 2009-01-07 02:15 411368 ----a-w- d:\windows\system32\deploytk.dll
.

------- Sigcheck -------

[7] 2008-04-14 . 6D4FEB43EE538FC5428CC7F0565AA656 . 56320 . . [5.1.2600.5512] . . d:\windows\ERDNT\cache\eventlog.dll
[7] 2008-04-14 . 6D4FEB43EE538FC5428CC7F0565AA656 . 56320 . . [5.1.2600.5512] . . d:\windows\ServicePackFiles\i386\eventlog.dll
[-] 2004-08-04 . 82B24CB70E5944E6E34662205A2A5B78 . 55808 . . [5.1.2600.2180] . . d:\windows\$NtServicePackUninstall$\eventlog.dll

d:\windows\system32\eventlog.dll ... is missing !!
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS "= "d:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"ctfmon.exe "= "d:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1 "= "d:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"PHIME2002ASync "= "d:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"PHIME2002A "= "d:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"TkBellExe "= "d:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-03-01 185896]
"HP Software Update "= "d:\side programs\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"Adobe Reader Speed Launcher "= "d:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]
"GrooveMonitor "= "d:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"SsAAD.exe "= "d:\sidepr~1\SsAAD.exe" [2005-01-25 81920]
"RemoteControl "= "d:\side programs\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-03 32768]
"dla "= "d:\windows\system32\dla\tfswctrl.exe" [2004-03-25 122939]
"ISUSPM Startup "= "d:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"ISUSScheduler "= "d:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"BigDogPath "= "d:\windows\VM_STI.EXE" [2004-06-09 40960]
"NvCplDaemon "= "d:\windows\system32\NvCpl.dll" [2005-07-21 7110656]
"NvMediaCenter "= "d:\windows\system32\NvMcTray.dll" [2005-07-21 86016]
"avgnt "= "d:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"ZoneAlarm Client "= "d:\side programs\Zone Labs\ZoneAlarm\zlclient.exe" [2009-04-01 982408]
"SunJavaUpdateSched "= "d:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"UnlockerAssistant "= "d:\program files\Unlocker\UnlockerAssistant.exe" [2008-05-02 15872]
"Malwarebytes Anti-Malware (reboot) "= "d:\side programs\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"SoundMan "= "SOUNDMAN.EXE" - d:\windows\SOUNDMAN.EXE [2004-11-15 77824]
"nwiz "= "nwiz.exe" - d:\windows\system32\nwiz.exe [2005-07-21 1519616]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE "= "d:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

d:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - d:\side programs\HP\Digital Imaging\bin\hpqtra08.exe [2005-5-12 282624]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} "= "d:\side programs\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 ----a-w- d:\side programs\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall "= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"d:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe "=
"d:\\Program Files\\Grisoft\\AVG7\\avgemc.exe "=
"d:\\Side Programs\\HP\\Digital Imaging\\bin\\hpqtra08.exe "=
"d:\\Side Programs\\HP\\Digital Imaging\\bin\\hpqste08.exe "=
"d:\\Side Programs\\HP\\Digital Imaging\\bin\\hpofxm08.exe "=
"d:\\Side Programs\\HP\\Digital Imaging\\bin\\hposfx08.exe "=
"d:\\Side Programs\\HP\\Digital Imaging\\bin\\hposid01.exe "=
"d:\\Side Programs\\HP\\Digital Imaging\\bin\\hpqscnvw.exe "=
"d:\\Side Programs\\HP\\Digital Imaging\\bin\\hpqkygrp.exe "=
"d:\\Side Programs\\HP\\Digital Imaging\\bin\\hpqCopy.exe "=
"d:\\Side Programs\\HP\\Digital Imaging\\bin\\hpfccopy.exe "=
"d:\\Side Programs\\HP\\Digital Imaging\\bin\\hpzwiz01.exe "=
"d:\\Side Programs\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe "=
"d:\\Side Programs\\HP\\Digital Imaging\\Unload\\HpqDIA.exe "=
"d:\\Side Programs\\HP\\Digital Imaging\\bin\\hpoews01.exe "=
"d:\\Side Programs\\BitComet\\BitComet.exe "=
"d:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE "=
"d:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE "=
"d:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE "=
"d:\\Program Files\\Bonjour\\mDNSResponder.exe "=
"d:\\WINDOWS\\system32\\rtcshare.exe "=
"d:\\WINDOWS\\system32\\PnkBstrB.exe "=
"d:\\WINDOWS\\system32\\spoolsv.exe "=
"d:\\Program Files\\Messenger\\msmsgs.exe "=
"d:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
"d:\\Program Files\\Windows Live\\Messenger\\livecall.exe "=
"d:\\WINDOWS\\system32\\ZoneLabs\\vsmon.exe "=
"c:\\Games\\EA GAMES\\Battlefield 2\\BF2.exe "=

R1 SASDIFSV;SASDIFSV;d:\side programs\SUPERAntiSpyware\sasdifsv.sys [12/10/2009 9:24 PM 9968]
R1 SASKUTIL;SASKUTIL;d:\side programs\SUPERAntiSpyware\SASKUTIL.SYS [12/10/2009 9:24 PM 74480]
S3 SASENUM;SASENUM;d:\side programs\SUPERAntiSpyware\SASENUM.SYS [12/10/2009 9:24 PM 7408]
.
Contents of the 'Scheduled Tasks' folder

2009-10-20 d:\windows\Tasks\User_Feed_Synchronization-{1D4C3355-983D-4488-BE4D-D4F1702BF2EE}.job
- d:\windows\system32\msfeedssync.exe [2007-08-14 11:31]
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
uInternet Settings,ProxyOverride = local
IE: E&xport to Microsoft Excel - d:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - d:\documents and settings\Lily\Application Data\Mozilla\Firefox\Profiles\jvwo3pno.default\
FF - plugin: c:\program files\Real\RealPlayer\Netscape6\nppl3260.dll
FF - plugin: c:\program files\Real\RealPlayer\Netscape6\nprjplug.dll
FF - plugin: c:\program files\Real\RealPlayer\Netscape6\nprpjplug.dll
FF - plugin: d:\program files\Mozilla Firefox\plugins\NPinfotl.dll
FF - plugin: d:\side programs\DivX\DivX Player\npDivxPlayerPlugin.dll
FF - plugin: d:\side programs\DivX\DivX Web Player\npdivx32.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-20 20:11
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
@DACL=(02 0000)
"Installed "= "1 "
@=" "

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
@DACL=(02 0000)
"NoChange "= "1 "
"Installed "= "1 "
@=" "

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
@DACL=(02 0000)
"Installed "= "1 "
@=" "
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(704)
d:\side programs\SUPERAntiSpyware\SASWINLO.dll
d:\windows\system32\WININET.dll

- - - - - - - > 'explorer.exe'(3852)
d:\windows\system32\WININET.dll
d:\program files\Unlocker\UnlockerHook.dll
d:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\MSVCR80.dll
d:\windows\system32\ieframe.dll
d:\windows\system32\webcheck.dll
.
------------------------ Other Running Processes ------------------------
.
d:\windows\system32\ZoneLabs\vsmon.exe
d:\windows\system32\ZoneLabs\avsys\ScanningProcess.exe
d:\program files\Avira\AntiVir PersonalEdition Classic\sched.exe
d:\program files\Avira\AntiVir PersonalEdition Classic\avguard.exe
d:\program files\Bonjour\mDNSResponder.exe
d:\program files\Java\jre6\bin\jqs.exe
d:\windows\system32\nvsvc32.exe
d:\windows\system32\HPZipm12.exe
d:\combofix\CF3437.exe
d:\program files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
d:\side programs\HP\Digital Imaging\bin\hpqSTE08.exe
d:\combofix\PEV.cfxxe
.
**************************************************************************
.
Completion time: 2009-10-21 20:20 - machine was rebooted
ComboFix-quarantined-files.txt 2009-10-21 03:20
ComboFix2.txt 2009-10-19 18:27
ComboFix3.txt 2009-01-10 00:33
ComboFix4.txt 2009-01-07 23:24

Pre-Run: 5,261,971,456 bytes free
Post-Run: 5,211,533,312 bytes free

- - End Of File - - 96A10F371E65DAEE02CD136DE26F3F59

And here is my HijackThis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:26:54 PM, on 20/10/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\ZoneLabs\vsmon.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
D:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
D:\Program Files\Bonjour\mDNSResponder.exe
D:\Program Files\Java\jre6\bin\jqs.exe
D:\WINDOWS\system32\nvsvc32.exe
D:\WINDOWS\system32\HPZipm12.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\SOUNDMAN.EXE
D:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\Side Programs\HP\HP Software Update\HPWuSchd2.exe
D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
D:\SIDEPR~1\SsAAD.exe
D:\Side Programs\CyberLink\PowerDVD\PDVDServ.exe
D:\WINDOWS\system32\dla\tfswctrl.exe
D:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
D:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
D:\WINDOWS\VM_STI.EXE
D:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
D:\Side Programs\Zone Labs\ZoneAlarm\zlclient.exe
D:\Program Files\Java\jre6\bin\jusched.exe
D:\Program Files\Unlocker\UnlockerAssistant.exe
D:\Program Files\Messenger\msmsgs.exe
D:\Side Programs\HP\Digital Imaging\bin\hpqtra08.exe
D:\Side Programs\HP\Digital Imaging\bin\hpqSTE08.exe
D:\WINDOWS\system32\ctfmon.exe
D:\WINDOWS\explorer.exe
D:\WINDOWS\system32\conime.exe
D:\Side Programs\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - D:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - D:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "D:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] D:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] D:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [HP Software Update] D:\Side Programs\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe "
O4 - HKLM\..\Run: [GrooveMonitor] "D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe "
O4 - HKLM\..\Run: [SsAAD.exe] D:\SIDEPR~1\SsAAD.exe
O4 - HKLM\..\Run: [RemoteControl] "D:\Side Programs\CyberLink\PowerDVD\PDVDServ.exe "
O4 - HKLM\..\Run: [dla] D:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ISUSPM Startup] D:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "D:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [BigDogPath] D:\WINDOWS\VM_STI.EXE HiCam USB 1.1 VM
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avgnt] "D:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [ZoneAlarm Client] "D:\Side Programs\Zone Labs\ZoneAlarm\zlclient.exe "
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre6\bin\jusched.exe "
O4 - HKLM\..\Run: [UnlockerAssistant] "D:\Program Files\Unlocker\UnlockerAssistant.exe "
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "D:\Side Programs\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = D:\Side Programs\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O15 - ESC Trusted Zone: http://*.update.microsoft.com
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1219184584046
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {DA758BB1-5F89-4465-975F-8D7179A4BCF3} (WheelofFortune Object) - http://messenger.zone.msn.com/binary/WoF.cab57176.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O20 - Winlogon Notify: !SASWinLogon - D:\Side Programs\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - D:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - D:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - D:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - D:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Imapi Helper - Alex Feinman - D:\Side Programs\Alex Feinman\ISO Recorder\ImapiHelper.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - D:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: MSCSPTISRV - Sony Corporation - D:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: WinFast(R) Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - D:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Pml Driver HPZ12 - HP - D:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - D:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - D:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - D:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 9137 bytes

 

Following suggestions

The files that looks strange is no harm, it's just in another language.

Here is my new combofix log:

ComboFix 09-10-20.03 - Wilson 1/2009 Wed 19:48.2.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.932.81.1033.18.1023.697 [GMT -7:00]
Running from: d:\documents and settings\Wilson\Desktop\ComboFix.exe
Command switches used :: d:\documents and settings\Wilson\Desktop\CFScript.txt
AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
AV: ZoneAlarm Security Suite Antivirus *On-access scanning disabled* (Outdated) {5D467B10-818C-4CAB-9FF7-6893B5B8F3CF}
FW: ZoneAlarm Security Suite Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
"d:\windows\setup_028b37bauninst_kan_acc01.exe "
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

d:\windows\setup_028b37bauninst_kan_acc01.exe

.
((((((((((((((((((((((((( Files Created from 2009-09-22 to 2009-10-22 )))))))))))))))))))))))))))))))
.

2009-10-22 02:38 . 2008-04-14 00:11 56320 -c--a-w- d:\windows\system32\dllcache\eventlog.dll
2009-10-22 02:38 . 2008-04-14 00:11 56320 ----a-w- d:\windows\system32\eventlog.dll
2009-10-20 22:06 . 2009-10-20 22:06 -------- d-----w- d:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-10-20 22:05 . 2009-10-20 22:05 -------- d-----w- d:\documents and settings\Wilson\Application Data\SUPERAntiSpyware.com
2009-10-20 15:16 . 2009-10-20 15:16 -------- d-----w- d:\documents and settings\Lily\Application Data\Malwarebytes
2009-10-20 15:06 . 2009-10-20 15:06 -------- d-sh--w- d:\documents and settings\Administrator\IETldCache
2009-10-19 06:27 . 2009-10-19 06:27 -------- d-----w- d:\documents and settings\Wilson\Application Data\Malwarebytes
2009-10-19 01:06 . 2009-10-19 01:06 -------- d-----w- d:\documents and settings\Tricia\Application Data\Malwarebytes
2009-10-19 01:06 . 2009-09-10 21:54 38224 ----a-w- d:\windows\system32\drivers\mbamswissarmy.sys
2009-10-19 01:06 . 2009-10-19 01:06 -------- d-----w- d:\documents and settings\All Users\Application Data\Malwarebytes
2009-10-19 01:06 . 2009-09-10 21:53 19160 ----a-w- d:\windows\system32\drivers\mbam.sys
2009-10-18 20:16 . 2009-10-18 20:16 -------- d-----w- d:\documents and settings\Tricia\Application Data\PC Tools
2009-10-18 20:16 . 2009-10-18 20:16 -------- d-----w- d:\documents and settings\All Users\Application Data\PC Tools
2009-10-18 20:15 . 2009-10-20 22:14 -------- d---a-w- d:\documents and settings\All Users\Application Data\TEMP
2009-10-16 03:56 . 2009-10-16 03:56 -------- d-sh--w- d:\windows\system32\config\systemprofile\IETldCache
2009-10-14 01:42 . 2009-10-14 01:48 -------- d-----w- d:\documents and settings\Wilson\Application Data\KannagiAcc01
2009-10-14 01:42 . 2009-10-14 01:42 9604608 ------w- d:\windows\縺九ｓ縺ｪ縺・鄒手｡馴Κ蜩｡)繧ｹ繧ｯ繝ｪ繝ｼ繝ｳ繧ｻ繝ｼ繝舌・.scr
2009-10-14 01:42 . 2009-10-14 01:42 11144192 ------w- d:\windows\縺九ｓ縺ｪ縺・繝翫ぐ)繧ｹ繧ｯ繝ｪ繝ｼ繝ｳ繧ｻ繝ｼ繝舌・.scr
2009-10-14 01:42 . 2009-10-14 01:42 2496000 ------w- d:\windows\縺九ｓ縺ｪ縺・繝槭せ繧ｳ繝・ヨ)繧ｹ繧ｯ繝ｪ繝ｼ繝ｳ繧ｻ繝ｼ繝舌・.scr
2009-10-14 01:42 . 2009-10-14 01:42 5986304 ------w- d:\windows\縺九ｓ縺ｪ縺・縺､縺舌∩)繧ｹ繧ｯ繝ｪ繝ｼ繝ｳ繧ｻ繝ｼ繝舌・.scr
2009-10-14 01:42 . 2009-10-14 01:42 9075200 ------w- d:\windows\縺九ｓ縺ｪ縺・縺悶ｓ縺偵■繧・ｓ)繧ｹ繧ｯ繝ｪ繝ｼ繝ｳ繧ｻ繝ｼ繝舌・.scr
2009-10-09 20:20 . 2009-10-10 04:54 -------- d-----w- d:\program files\Unlocker
2009-09-23 06:50 . 2009-09-05 00:44 515416 ----a-w- d:\windows\system32\XAudio2_5.dll
2009-09-23 06:50 . 2009-09-05 00:44 238936 ----a-w- d:\windows\system32\xactengine3_5.dll
2009-09-23 06:49 . 2009-09-05 00:29 1974616 ----a-w- d:\windows\system32\D3DCompiler_42.dll
2009-09-23 06:49 . 2009-09-05 00:29 5501792 ----a-w- d:\windows\system32\d3dcsx_42.dll
2009-09-23 06:49 . 2009-09-05 00:29 235344 ----a-w- d:\windows\system32\d3dx11_42.dll
2009-09-23 06:49 . 2009-09-05 00:29 453456 ----a-w- d:\windows\system32\d3dx10_42.dll
2009-09-23 06:49 . 2009-09-05 00:29 1892184 ----a-w- d:\windows\system32\D3DX9_42.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-21 08:11 . 2009-01-07 01:43 11158028 --sha-w- d:\windows\system32\drivers\fidbox.idx
2009-10-21 08:11 . 2009-01-07 01:43 839066400 --sha-w- d:\windows\system32\drivers\fidbox.dat
2009-10-20 22:04 . 2008-08-30 22:39 -------- d-----w- d:\program files\Common Files\Wise Installation Wizard
2009-10-15 14:50 . 2008-03-09 15:12 -------- d-----w- d:\documents and settings\All Users\Application Data\Microsoft Help
2009-10-14 01:42 . 2009-10-14 01:42 9604608 ------w- d:\windows\縺九ｓ縺ｪ縺・鄒手｡馴Κ蜩｡)繧ｹ繧ｯ繝ｪ繝ｼ繝ｳ繧ｻ繝ｼ繝舌・.scr
2009-10-14 01:42 . 2009-10-14 01:42 11144192 ------w- d:\windows\縺九ｓ縺ｪ縺・繝翫ぐ)繧ｹ繧ｯ繝ｪ繝ｼ繝ｳ繧ｻ繝ｼ繝舌・.scr
2009-10-14 01:42 . 2009-10-14 01:42 2496000 ------w- d:\windows\縺九ｓ縺ｪ縺・繝槭せ繧ｳ繝・ヨ)繧ｹ繧ｯ繝ｪ繝ｼ繝ｳ繧ｻ繝ｼ繝舌・.scr
2009-10-14 01:42 . 2009-10-14 01:42 5986304 ------w- d:\windows\縺九ｓ縺ｪ縺・縺､縺舌∩)繧ｹ繧ｯ繝ｪ繝ｼ繝ｳ繧ｻ繝ｼ繝舌・.scr
2009-10-14 01:42 . 2009-10-14 01:42 9075200 ------w- d:\windows\縺九ｓ縺ｪ縺・縺悶ｓ縺偵■繧・ｓ)繧ｹ繧ｯ繝ｪ繝ｼ繝ｳ繧ｻ繝ｼ繝舌・.scr
2009-10-13 13:51 . 2009-01-07 01:30 4212 ---ha-w- d:\windows\system32\zllictbl.dat
2009-10-08 16:33 . 2008-05-22 05:26 -------- d-----w- d:\documents and settings\Wilson\Application Data\Image Zone Express
2009-09-26 01:42 . 2008-03-01 08:56 -------- d--h--w- d:\program files\InstallShield Installation Information
2009-09-19 22:40 . 2009-09-06 20:45 -------- d-----w- d:\documents and settings\Lily\Application Data\Bioshock
2009-09-11 14:18 . 2004-08-04 12:00 136192 ----a-w- d:\windows\system32\msv1_0.dll
2009-09-07 19:59 . 2009-09-07 19:59 -------- d--h--r- d:\documents and settings\Wilson\Application Data\SecuROM
2009-09-07 04:40 . 2008-03-01 21:22 77336 ----a-w- d:\documents and settings\Lily\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-09-06 20:45 . 2009-09-06 20:45 -------- d--h--r- d:\documents and settings\Lily\Application Data\SecuROM
2009-09-05 00:44 . 2009-08-17 13:31 69464 ----a-w- d:\windows\system32\XAPOFX1_3.dll
2009-09-04 21:03 . 2004-08-04 12:00 58880 ----a-w- d:\windows\system32\msasn1.dll
2009-09-01 17:22 . 2008-03-08 06:37 77336 ----a-w- d:\documents and settings\Wilson\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-29 19:42 . 2008-03-09 22:14 77336 ----a-w- d:\documents and settings\Tricia\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-29 08:08 . 2004-08-04 12:00 916480 ------w- d:\windows\system32\wininet.dll
2009-08-29 06:37 . 2008-03-09 15:26 -------- d-----w- d:\program files\Microsoft Works
2009-08-26 08:00 . 2004-08-04 12:00 247326 ----a-w- d:\windows\system32\strmdll.dll
2009-08-18 06:33 . 2009-08-18 06:33 1193832 ----a-w- d:\windows\system32\FM20.DLL
2009-08-05 09:01 . 2004-08-04 12:00 204800 ----a-w- d:\windows\system32\mswebdvd.dll
2009-08-05 03:44 . 2004-08-04 12:00 2189184 ------w- d:\windows\system32\ntoskrnl.exe
2009-08-04 14:20 . 2004-08-03 22:59 2066048 ------w- d:\windows\system32\ntkrnlpa.exe
2009-07-25 12:23 . 2009-01-07 02:15 411368 ----a-w- d:\windows\system32\deploytk.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-10-21_03.11.33 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-03-01 08:51 . 2009-10-21 04:29 32768 d:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2008-03-01 08:51 . 2009-10-18 03:56 32768 d:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2008-03-01 08:51 . 2009-10-21 04:29 32768 d:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2008-03-01 08:51 . 2009-10-18 03:56 32768 d:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2009-10-21 04:29 . 2009-10-21 04:29 16384 d:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2009-04-01 19:21 . 2009-10-22 02:43 221652 d:\windows\system32\ZoneLabs\avsys\bases\sfdb.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SUPERAntiSpyware "= "d:\side programs\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-10-13 2000112]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1 "= "d:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"PHIME2002ASync "= "d:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"PHIME2002A "= "d:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"TkBellExe "= "d:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-03-01 185896]
"HP Software Update "= "d:\side programs\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"Adobe Reader Speed Launcher "= "d:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]
"GrooveMonitor "= "d:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"SsAAD.exe "= "d:\sidepr~1\SsAAD.exe" [2005-01-25 81920]
"RemoteControl "= "d:\side programs\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-03 32768]
"dla "= "d:\windows\system32\dla\tfswctrl.exe" [2004-03-25 122939]
"ISUSPM Startup "= "d:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"ISUSScheduler "= "d:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"BigDogPath "= "d:\windows\VM_STI.EXE" [2004-06-09 40960]
"NvCplDaemon "= "d:\windows\system32\NvCpl.dll" [2005-07-21 7110656]
"NvMediaCenter "= "d:\windows\system32\NvMcTray.dll" [2005-07-21 86016]
"avgnt "= "d:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"ZoneAlarm Client "= "d:\side programs\Zone Labs\ZoneAlarm\zlclient.exe" [2009-04-01 982408]
"SunJavaUpdateSched "= "d:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"UnlockerAssistant "= "d:\program files\Unlocker\UnlockerAssistant.exe" [2008-05-02 15872]
"Malwarebytes Anti-Malware (reboot) "= "d:\side programs\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"SoundMan "= "SOUNDMAN.EXE" - d:\windows\SOUNDMAN.EXE [2004-11-15 77824]
"nwiz "= "nwiz.exe" - d:\windows\system32\nwiz.exe [2005-07-21 1519616]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE "= "d:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

d:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - d:\side programs\HP\Digital Imaging\bin\hpqtra08.exe [2005-5-12 282624]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} "= "d:\side programs\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 ----a-w- d:\side programs\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall "= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"d:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe "=
"d:\\Program Files\\Grisoft\\AVG7\\avgemc.exe "=
"d:\\Side Programs\\HP\\Digital Imaging\\bin\\hpqtra08.exe "=
"d:\\Side Programs\\HP\\Digital Imaging\\bin\\hpqste08.exe "=
"d:\\Side Programs\\HP\\Digital Imaging\\bin\\hpofxm08.exe "=
"d:\\Side Programs\\HP\\Digital Imaging\\bin\\hposfx08.exe "=
"d:\\Side Programs\\HP\\Digital Imaging\\bin\\hposid01.exe "=
"d:\\Side Programs\\HP\\Digital Imaging\\bin\\hpqscnvw.exe "=
"d:\\Side Programs\\HP\\Digital Imaging\\bin\\hpqkygrp.exe "=
"d:\\Side Programs\\HP\\Digital Imaging\\bin\\hpqCopy.exe "=
"d:\\Side Programs\\HP\\Digital Imaging\\bin\\hpfccopy.exe "=
"d:\\Side Programs\\HP\\Digital Imaging\\bin\\hpzwiz01.exe "=
"d:\\Side Programs\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe "=
"d:\\Side Programs\\HP\\Digital Imaging\\Unload\\HpqDIA.exe "=
"d:\\Side Programs\\HP\\Digital Imaging\\bin\\hpoews01.exe "=
"d:\\Side Programs\\BitComet\\BitComet.exe "=
"d:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE "=
"d:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE "=
"d:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE "=
"d:\\Program Files\\Bonjour\\mDNSResponder.exe "=
"d:\\WINDOWS\\system32\\rtcshare.exe "=
"d:\\WINDOWS\\system32\\PnkBstrB.exe "=
"d:\\WINDOWS\\system32\\spoolsv.exe "=
"d:\\Program Files\\Messenger\\msmsgs.exe "=
"d:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
"d:\\Program Files\\Windows Live\\Messenger\\livecall.exe "=
"d:\\WINDOWS\\system32\\ZoneLabs\\vsmon.exe "=
"c:\\Games\\EA GAMES\\Battlefield 2\\BF2.exe "=

R1 SASDIFSV;SASDIFSV;d:\side programs\SUPERAntiSpyware\sasdifsv.sys [10/12/2009 09:24 PM 9968]
R1 SASKUTIL;SASKUTIL;d:\side programs\SUPERAntiSpyware\SASKUTIL.SYS [10/12/2009 09:24 PM 74480]
R3 SASENUM;SASENUM;d:\side programs\SUPERAntiSpyware\SASENUM.SYS [10/12/2009 09:24 PM 7408]
.
Contents of the 'Scheduled Tasks' folder

2009-10-20 d:\windows\Tasks\User_Feed_Synchronization-{1D4C3355-983D-4488-BE4D-D4F1702BF2EE}.job
- d:\windows\system32\msfeedssync.exe [2007-08-14 11:31]
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - d:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - d:\documents and settings\Wilson\Application Data\Mozilla\Firefox\Profiles\832pkz8h.default\
FF - plugin: c:\program files\Real\RealPlayer\Netscape6\nppl3260.dll
FF - plugin: c:\program files\Real\RealPlayer\Netscape6\nprjplug.dll
FF - plugin: c:\program files\Real\RealPlayer\Netscape6\nprpjplug.dll
FF - plugin: d:\program files\Mozilla Firefox\plugins\NPinfotl.dll
FF - plugin: d:\side programs\DivX\DivX Player\npDivxPlayerPlugin.dll
FF - plugin: d:\side programs\DivX\DivX Web Player\npdivx32.dll
.
- - - - ORPHANS REMOVED - - - -

AddRemove-kan_acc01 - d:\windows\setup_028b37bauninst_kan_acc01.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-21 19:57
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-448539723-308236825-839522115-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"?慴 "=hex:9a,de,9c,3d,17,64,ba,40,d0,d4,d9,2c,82,02,76,5e,d4,18,b4,0c,de,90,f7,
df,c1,79,69,26,8d,d2,ec,b0,a6,7b,cb,28,00,7d,91,4a,fd,42,b6,da,6c,04,7c,d4,\
"?祥 "=hex:5a,5f,2f,15,94,f6,df,e2,d3,85,8f,02,27,af,e0,de

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
@DACL=(02 0000)
"Installed "= "1 "
@=" "

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
@DACL=(02 0000)
"NoChange "= "1 "
"Installed "= "1 "
@=" "

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
@DACL=(02 0000)
"Installed "= "1 "
@=" "
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(700)
d:\side programs\SUPERAntiSpyware\SASWINLO.dll
d:\windows\system32\WININET.dll
.
Completion time: 2009-10-22 20:03
ComboFix-quarantined-files.txt 2009-10-22 03:02
ComboFix2.txt 2009-10-21 03:20
ComboFix3.txt 2009-10-19 18:27
ComboFix4.txt 2009-01-10 00:33
ComboFix5.txt 2009-10-22 02:44

Pre-Run: 5,082,488,832 bytes free
Post-Run: 5,045,051,392 bytes free

- - End Of File - - A38C81CD7E7FD61E78CA7E510EA2FF25


And here is my hijackthis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:18:34, on 10/21/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
D:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
D:\Program Files\Bonjour\mDNSResponder.exe
D:\WINDOWS\system32\nvsvc32.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\SOUNDMAN.EXE
D:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\Side Programs\HP\HP Software Update\HPWuSchd2.exe
D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
D:\Side Programs\CyberLink\PowerDVD\PDVDServ.exe
D:\WINDOWS\system32\dla\tfswctrl.exe
D:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
D:\WINDOWS\VM_STI.EXE
D:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
D:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Side Programs\HP\Digital Imaging\bin\hpqtra08.exe
D:\WINDOWS\System32\svchost.exe
D:\Side Programs\HP\Digital Imaging\bin\hpqSTE08.exe
D:\WINDOWS\system32\wscntfy.exe
D:\WINDOWS\system32\notepad.exe
D:\WINDOWS\system32\conime.exe
D:\WINDOWS\explorer.exe
d:\program files\avira\antivir personaledition classic\avcenter.exe
D:\Side Programs\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - D:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - D:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "D:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] D:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] D:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [HP Software Update] D:\Side Programs\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe "
O4 - HKLM\..\Run: [GrooveMonitor] "D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe "
O4 - HKLM\..\Run: [SsAAD.exe] D:\SIDEPR~1\SsAAD.exe
O4 - HKLM\..\Run: [RemoteControl] "D:\Side Programs\CyberLink\PowerDVD\PDVDServ.exe "
O4 - HKLM\..\Run: [dla] D:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ISUSPM Startup] D:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "D:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [BigDogPath] D:\WINDOWS\VM_STI.EXE HiCam USB 1.1 VM
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avgnt] "D:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [ZoneAlarm Client] "D:\Side Programs\Zone Labs\ZoneAlarm\zlclient.exe "
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre6\bin\jusched.exe "
O4 - HKLM\..\Run: [UnlockerAssistant] "D:\Program Files\Unlocker\UnlockerAssistant.exe "
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "D:\Side Programs\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [SUPERAntiSpyware] D:\Side Programs\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = D:\Side Programs\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O15 - ESC Trusted Zone: http://*.update.microsoft.com
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1219184584046
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {DA758BB1-5F89-4465-975F-8D7179A4BCF3} (WheelofFortune Object) - http://messenger.zone.msn.com/binary/WoF.cab57176.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O20 - Winlogon Notify: !SASWinLogon - D:\Side Programs\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - D:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - D:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - D:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - D:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Imapi Helper - Alex Feinman - D:\Side Programs\Alex Feinman\ISO Recorder\ImapiHelper.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - D:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: MSCSPTISRV - Sony Corporation - D:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: WinFast(R) Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - D:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Pml Driver HPZ12 - HP - D:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - D:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - D:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - D:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 8996 bytes


For both times I let the combofix to finish it's processing, but I never encounter a windows that says intalling recovering console.

 

I am familiar with these d:\windows\縺九ｓ縺ｪ縺・鄒手｡馴Κ蜩｡)繧ｹ繧ｯ繝ｪ繝ｼ繝ｳ繧ｻ繝ｼ繝舌・.scr files

And here is my new combofix log:

ComboFix 09-10-21.02 - Wilson 2/2009 Thu 22:03.3.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.932.81.1033.18.1023.641 [GMT -7:00]
Running from: d:\documents and settings\Wilson\Desktop\ComboFix.exe
Command switches used :: d:\documents and settings\Wilson\Desktop\WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
AV: ZoneAlarm Security Suite Antivirus *On-access scanning disabled* (Outdated) {5D467B10-818C-4CAB-9FF7-6893B5B8F3CF}
FW: ZoneAlarm Security Suite Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
.

((((((((((((((((((((((((( Files Created from 2009-09-23 to 2009-10-23 )))))))))))))))))))))))))))))))
.

2009-10-22 02:38 . 2008-04-14 00:11 56320 -c--a-w- d:\windows\system32\dllcache\eventlog.dll
2009-10-22 02:38 . 2008-04-14 00:11 56320 ------w- d:\windows\system32\eventlog.dll
2009-10-20 22:06 . 2009-10-20 22:06 -------- d-----w- d:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-10-20 22:05 . 2009-10-20 22:05 -------- d-----w- d:\documents and settings\Wilson\Application Data\SUPERAntiSpyware.com
2009-10-20 15:16 . 2009-10-20 15:16 -------- d-----w- d:\documents and settings\Lily\Application Data\Malwarebytes
2009-10-20 15:06 . 2009-10-20 15:06 -------- d-sh--w- d:\documents and settings\Administrator\IETldCache
2009-10-19 06:27 . 2009-10-19 06:27 -------- d-----w- d:\documents and settings\Wilson\Application Data\Malwarebytes
2009-10-19 01:06 . 2009-10-19 01:06 -------- d-----w- d:\documents and settings\Tricia\Application Data\Malwarebytes
2009-10-19 01:06 . 2009-09-10 21:54 38224 ----a-w- d:\windows\system32\drivers\mbamswissarmy.sys
2009-10-19 01:06 . 2009-10-19 01:06 -------- d-----w- d:\documents and settings\All Users\Application Data\Malwarebytes
2009-10-19 01:06 . 2009-09-10 21:53 19160 ----a-w- d:\windows\system32\drivers\mbam.sys
2009-10-18 20:16 . 2009-10-18 20:16 -------- d-----w- d:\documents and settings\Tricia\Application Data\PC Tools
2009-10-18 20:16 . 2009-10-18 20:16 -------- d-----w- d:\documents and settings\All Users\Application Data\PC Tools
2009-10-18 20:15 . 2009-10-20 22:14 -------- d---a-w- d:\documents and settings\All Users\Application Data\TEMP
2009-10-16 03:56 . 2009-10-16 03:56 -------- d-sh--w- d:\windows\system32\config\systemprofile\IETldCache
2009-10-14 01:42 . 2009-10-14 01:48 -------- d-----w- d:\documents and settings\Wilson\Application Data\KannagiAcc01
2009-10-14 01:42 . 2009-10-14 01:42 9604608 ------w- d:\windows\縺九ｓ縺ｪ縺・鄒手｡馴Κ蜩｡)繧ｹ繧ｯ繝ｪ繝ｼ繝ｳ繧ｻ繝ｼ繝舌・.scr
2009-10-14 01:42 . 2009-10-14 01:42 11144192 ------w- d:\windows\縺九ｓ縺ｪ縺・繝翫ぐ)繧ｹ繧ｯ繝ｪ繝ｼ繝ｳ繧ｻ繝ｼ繝舌・.scr
2009-10-14 01:42 . 2009-10-14 01:42 2496000 ------w- d:\windows\縺九ｓ縺ｪ縺・繝槭せ繧ｳ繝・ヨ)繧ｹ繧ｯ繝ｪ繝ｼ繝ｳ繧ｻ繝ｼ繝舌・.scr
2009-10-14 01:42 . 2009-10-14 01:42 5986304 ------w- d:\windows\縺九ｓ縺ｪ縺・縺､縺舌∩)繧ｹ繧ｯ繝ｪ繝ｼ繝ｳ繧ｻ繝ｼ繝舌・.scr
2009-10-14 01:42 . 2009-10-14 01:42 9075200 ------w- d:\windows\縺九ｓ縺ｪ縺・縺悶ｓ縺偵■繧・ｓ)繧ｹ繧ｯ繝ｪ繝ｼ繝ｳ繧ｻ繝ｼ繝舌・.scr
2009-10-09 20:20 . 2009-10-10 04:54 -------- d-----w- d:\program files\Unlocker
2009-09-23 06:50 . 2009-09-05 00:44 515416 ----a-w- d:\windows\system32\XAudio2_5.dll
2009-09-23 06:50 . 2009-09-05 00:44 238936 ----a-w- d:\windows\system32\xactengine3_5.dll
2009-09-23 06:49 . 2009-09-05 00:29 1974616 ----a-w- d:\windows\system32\D3DCompiler_42.dll
2009-09-23 06:49 . 2009-09-05 00:29 5501792 ----a-w- d:\windows\system32\d3dcsx_42.dll
2009-09-23 06:49 . 2009-09-05 00:29 235344 ----a-w- d:\windows\system32\d3dx11_42.dll
2009-09-23 06:49 . 2009-09-05 00:29 453456 ----a-w- d:\windows\system32\d3dx10_42.dll
2009-09-23 06:49 . 2009-09-05 00:29 1892184 ----a-w- d:\windows\system32\D3DX9_42.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-23 02:19 . 2009-01-07 01:43 11191724 --sha-w- d:\windows\system32\drivers\fidbox.idx
2009-10-23 02:19 . 2009-01-07 01:43 839066400 --sha-w- d:\windows\system32\drivers\fidbox.dat
2009-10-20 22:04 . 2008-08-30 22:39 -------- d-----w- d:\program files\Common Files\Wise Installation Wizard
2009-10-15 14:50 . 2008-03-09 15:12 -------- d-----w- d:\documents and settings\All Users\Application Data\Microsoft Help
2009-10-14 01:42 . 2009-10-14 01:42 9604608 ------w- d:\windows\縺九ｓ縺ｪ縺・鄒手｡馴Κ蜩｡)繧ｹ繧ｯ繝ｪ繝ｼ繝ｳ繧ｻ繝ｼ繝舌・.scr
2009-10-14 01:42 . 2009-10-14 01:42 11144192 ------w- d:\windows\縺九ｓ縺ｪ縺・繝翫ぐ)繧ｹ繧ｯ繝ｪ繝ｼ繝ｳ繧ｻ繝ｼ繝舌・.scr
2009-10-14 01:42 . 2009-10-14 01:42 2496000 ------w- d:\windows\縺九ｓ縺ｪ縺・繝槭せ繧ｳ繝・ヨ)繧ｹ繧ｯ繝ｪ繝ｼ繝ｳ繧ｻ繝ｼ繝舌・.scr
2009-10-14 01:42 . 2009-10-14 01:42 5986304 ------w- d:\windows\縺九ｓ縺ｪ縺・縺､縺舌∩)繧ｹ繧ｯ繝ｪ繝ｼ繝ｳ繧ｻ繝ｼ繝舌・.scr
2009-10-14 01:42 . 2009-10-14 01:42 9075200 ------w- d:\windows\縺九ｓ縺ｪ縺・縺悶ｓ縺偵■繧・ｓ)繧ｹ繧ｯ繝ｪ繝ｼ繝ｳ繧ｻ繝ｼ繝舌・.scr
2009-10-13 13:51 . 2009-01-07 01:30 4212 ---ha-w- d:\windows\system32\zllictbl.dat
2009-10-08 16:33 . 2008-05-22 05:26 -------- d-----w- d:\documents and settings\Wilson\Application Data\Image Zone Express
2009-09-26 01:42 . 2008-03-01 08:56 -------- d--h--w- d:\program files\InstallShield Installation Information
2009-09-19 22:40 . 2009-09-06 20:45 -------- d-----w- d:\documents and settings\Lily\Application Data\Bioshock
2009-09-11 14:18 . 2004-08-04 12:00 136192 ----a-w- d:\windows\system32\msv1_0.dll
2009-09-07 19:59 . 2009-09-07 19:59 -------- d--h--r- d:\documents and settings\Wilson\Application Data\SecuROM
2009-09-07 04:40 . 2008-03-01 21:22 77336 ----a-w- d:\documents and settings\Lily\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-09-06 20:45 . 2009-09-06 20:45 -------- d--h--r- d:\documents and settings\Lily\Application Data\SecuROM
2009-09-05 00:44 . 2009-08-17 13:31 69464 ----a-w- d:\windows\system32\XAPOFX1_3.dll
2009-09-04 21:03 . 2004-08-04 12:00 58880 ----a-w- d:\windows\system32\msasn1.dll
2009-09-01 17:22 . 2008-03-08 06:37 77336 ----a-w- d:\documents and settings\Wilson\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-29 19:42 . 2008-03-09 22:14 77336 ----a-w- d:\documents and settings\Tricia\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-29 08:08 . 2004-08-04 12:00 916480 ------w- d:\windows\system32\wininet.dll
2009-08-29 06:37 . 2008-03-09 15:26 -------- d-----w- d:\program files\Microsoft Works
2009-08-26 08:00 . 2004-08-04 12:00 247326 ----a-w- d:\windows\system32\strmdll.dll
2009-08-18 06:33 . 2009-08-18 06:33 1193832 ----a-w- d:\windows\system32\FM20.DLL
2009-08-05 09:01 . 2004-08-04 12:00 204800 ----a-w- d:\windows\system32\mswebdvd.dll
2009-08-05 03:44 . 2004-08-04 12:00 2189184 ------w- d:\windows\system32\ntoskrnl.exe
2009-08-04 14:20 . 2004-08-03 22:59 2066048 ------w- d:\windows\system32\ntkrnlpa.exe
2009-07-25 12:23 . 2009-01-07 02:15 411368 ----a-w- d:\windows\system32\deploytk.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-10-21_03.11.33 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-03-01 08:51 . 2009-10-22 04:29 32768 d:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2008-03-01 08:51 . 2009-10-18 03:56 32768 d:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2008-03-01 08:51 . 2009-10-22 04:29 32768 d:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2008-03-01 08:51 . 2009-10-18 03:56 32768 d:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2009-10-22 04:29 . 2009-10-22 04:29 16384 d:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2009-04-01 19:21 . 2009-10-23 04:36 227756 d:\windows\system32\ZoneLabs\avsys\bases\sfdb.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SUPERAntiSpyware "= "d:\side programs\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-10-13 2000112]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1 "= "d:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"PHIME2002ASync "= "d:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"PHIME2002A "= "d:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"TkBellExe "= "d:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-03-01 185896]
"HP Software Update "= "d:\side programs\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"Adobe Reader Speed Launcher "= "d:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]
"GrooveMonitor "= "d:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"SsAAD.exe "= "d:\sidepr~1\SsAAD.exe" [2005-01-25 81920]
"RemoteControl "= "d:\side programs\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-03 32768]
"dla "= "d:\windows\system32\dla\tfswctrl.exe" [2004-03-25 122939]
"ISUSPM Startup "= "d:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"ISUSScheduler "= "d:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"BigDogPath "= "d:\windows\VM_STI.EXE" [2004-06-09 40960]
"NvCplDaemon "= "d:\windows\system32\NvCpl.dll" [2005-07-21 7110656]
"NvMediaCenter "= "d:\windows\system32\NvMcTray.dll" [2005-07-21 86016]
"avgnt "= "d:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"ZoneAlarm Client "= "d:\side programs\Zone Labs\ZoneAlarm\zlclient.exe" [2009-04-01 982408]
"SunJavaUpdateSched "= "d:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"UnlockerAssistant "= "d:\program files\Unlocker\UnlockerAssistant.exe" [2008-05-02 15872]
"Malwarebytes Anti-Malware (reboot) "= "d:\side programs\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"SoundMan "= "SOUNDMAN.EXE" - d:\windows\SOUNDMAN.EXE [2004-11-15 77824]
"nwiz "= "nwiz.exe" - d:\windows\system32\nwiz.exe [2005-07-21 1519616]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE "= "d:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

d:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - d:\side programs\HP\Digital Imaging\bin\hpqtra08.exe [2005-5-12 282624]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} "= "d:\side programs\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 ----a-w- d:\side programs\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall "= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"d:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe "=
"d:\\Program Files\\Grisoft\\AVG7\\avgemc.exe "=
"d:\\Side Programs\\HP\\Digital Imaging\\bin\\hpqtra08.exe "=
"d:\\Side Programs\\HP\\Digital Imaging\\bin\\hpqste08.exe "=
"d:\\Side Programs\\HP\\Digital Imaging\\bin\\hpofxm08.exe "=
"d:\\Side Programs\\HP\\Digital Imaging\\bin\\hposfx08.exe "=
"d:\\Side Programs\\HP\\Digital Imaging\\bin\\hposid01.exe "=
"d:\\Side Programs\\HP\\Digital Imaging\\bin\\hpqscnvw.exe "=
"d:\\Side Programs\\HP\\Digital Imaging\\bin\\hpqkygrp.exe "=
"d:\\Side Programs\\HP\\Digital Imaging\\bin\\hpqCopy.exe "=
"d:\\Side Programs\\HP\\Digital Imaging\\bin\\hpfccopy.exe "=
"d:\\Side Programs\\HP\\Digital Imaging\\bin\\hpzwiz01.exe "=
"d:\\Side Programs\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe "=
"d:\\Side Programs\\HP\\Digital Imaging\\Unload\\HpqDIA.exe "=
"d:\\Side Programs\\HP\\Digital Imaging\\bin\\hpoews01.exe "=
"d:\\Side Programs\\BitComet\\BitComet.exe "=
"d:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE "=
"d:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE "=
"d:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE "=
"d:\\Program Files\\Bonjour\\mDNSResponder.exe "=
"d:\\WINDOWS\\system32\\rtcshare.exe "=
"d:\\WINDOWS\\system32\\PnkBstrB.exe "=
"d:\\WINDOWS\\system32\\spoolsv.exe "=
"d:\\Program Files\\Messenger\\msmsgs.exe "=
"d:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
"d:\\Program Files\\Windows Live\\Messenger\\livecall.exe "=
"d:\\WINDOWS\\system32\\ZoneLabs\\vsmon.exe "=
"c:\\Games\\EA GAMES\\Battlefield 2\\BF2.exe "=

R1 SASDIFSV;SASDIFSV;d:\side programs\SUPERAntiSpyware\sasdifsv.sys [10/12/2009 09:24 PM 9968]
R1 SASKUTIL;SASKUTIL;d:\side programs\SUPERAntiSpyware\SASKUTIL.SYS [10/12/2009 09:24 PM 74480]
R3 SASENUM;SASENUM;d:\side programs\SUPERAntiSpyware\SASENUM.SYS [10/12/2009 09:24 PM 7408]
.
Contents of the 'Scheduled Tasks' folder

2009-10-23 d:\windows\Tasks\User_Feed_Synchronization-{1D4C3355-983D-4488-BE4D-D4F1702BF2EE}.job
- d:\windows\system32\msfeedssync.exe [2007-08-14 11:31]
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - d:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - d:\documents and settings\Wilson\Application Data\Mozilla\Firefox\Profiles\832pkz8h.default\
FF - plugin: c:\program files\Real\RealPlayer\Netscape6\nppl3260.dll
FF - plugin: c:\program files\Real\RealPlayer\Netscape6\nprjplug.dll
FF - plugin: c:\program files\Real\RealPlayer\Netscape6\nprpjplug.dll
FF - plugin: d:\program files\Mozilla Firefox\plugins\NPinfotl.dll
FF - plugin: d:\side programs\DivX\DivX Player\npDivxPlayerPlugin.dll
FF - plugin: d:\side programs\DivX\DivX Web Player\npdivx32.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-22 22:13
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-448539723-308236825-839522115-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"?慴 "=hex:9a,de,9c,3d,17,64,ba,40,d0,d4,d9,2c,82,02,76,5e,d4,18,b4,0c,de,90,f7,
df,c1,79,69,26,8d,d2,ec,b0,a6,7b,cb,28,00,7d,91,4a,fd,42,b6,da,6c,04,7c,d4,\
"?祥 "=hex:5a,5f,2f,15,94,f6,df,e2,d3,85,8f,02,27,af,e0,de

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
@DACL=(02 0000)
"Installed "= "1 "
@=" "

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
@DACL=(02 0000)
"NoChange "= "1 "
"Installed "= "1 "
@=" "

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
@DACL=(02 0000)
"Installed "= "1 "
@=" "
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(700)
d:\side programs\SUPERAntiSpyware\SASWINLO.dll
d:\windows\system32\WININET.dll

- - - - - - - > 'explorer.exe'(2360)
d:\windows\system32\WININET.dll
d:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\MSVCR80.dll
d:\windows\system32\ieframe.dll
d:\windows\system32\webcheck.dll
.
Completion time: 2009-10-23 22:18
ComboFix-quarantined-files.txt 2009-10-23 05:18
ComboFix2.txt 2009-10-22 03:03
ComboFix3.txt 2009-10-21 03:20
ComboFix4.txt 2009-10-19 18:27
ComboFix5.txt 2009-10-23 04:38

Pre-Run: 4,882,219,008 bytes free
Post-Run: 4,845,527,040 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT= "Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS= "Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 5C9AFBD51EC40D295CCC9A915243E277

And my Hijackthis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:19:29, on 10/22/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
D:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
D:\Program Files\Bonjour\mDNSResponder.exe
D:\WINDOWS\system32\nvsvc32.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\SOUNDMAN.EXE
D:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\Side Programs\HP\HP Software Update\HPWuSchd2.exe
D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
D:\Side Programs\CyberLink\PowerDVD\PDVDServ.exe
D:\WINDOWS\system32\dla\tfswctrl.exe
D:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
D:\WINDOWS\VM_STI.EXE
D:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Side Programs\HP\Digital Imaging\bin\hpqtra08.exe
D:\Side Programs\HP\Digital Imaging\bin\hpqSTE08.exe
D:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
D:\WINDOWS\system32\wscntfy.exe
D:\WINDOWS\explorer.exe
D:\WINDOWS\system32\notepad.exe
D:\WINDOWS\system32\conime.exe
D:\Side Programs\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - D:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - D:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "D:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] D:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] D:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [HP Software Update] D:\Side Programs\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe "
O4 - HKLM\..\Run: [GrooveMonitor] "D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe "
O4 - HKLM\..\Run: [SsAAD.exe] D:\SIDEPR~1\SsAAD.exe
O4 - HKLM\..\Run: [RemoteControl] "D:\Side Programs\CyberLink\PowerDVD\PDVDServ.exe "
O4 - HKLM\..\Run: [dla] D:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ISUSPM Startup] D:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "D:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [BigDogPath] D:\WINDOWS\VM_STI.EXE HiCam USB 1.1 VM
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avgnt] "D:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [ZoneAlarm Client] "D:\Side Programs\Zone Labs\ZoneAlarm\zlclient.exe "
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre6\bin\jusched.exe "
O4 - HKLM\..\Run: [UnlockerAssistant] "D:\Program Files\Unlocker\UnlockerAssistant.exe "
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "D:\Side Programs\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [SUPERAntiSpyware] D:\Side Programs\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = D:\Side Programs\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O15 - ESC Trusted Zone: http://*.update.microsoft.com
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1219184584046
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {DA758BB1-5F89-4465-975F-8D7179A4BCF3} (WheelofFortune Object) - http://messenger.zone.msn.com/binary/WoF.cab57176.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O20 - Winlogon Notify: !SASWinLogon - D:\Side Programs\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - D:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - D:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - D:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - D:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Imapi Helper - Alex Feinman - D:\Side Programs\Alex Feinman\ISO Recorder\ImapiHelper.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - D:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: MSCSPTISRV - Sony Corporation - D:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: WinFast(R) Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - D:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Pml Driver HPZ12 - HP - D:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - D:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - D:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - D:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 8927 bytes

 

Here's my new SUPERAntiSpyware Scan Log:

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 10/23/2009 at 08:06 PM

Application Version : 4.29.1004

Core Rules Database Version : 4187
Trace Rules Database Version: 2103

Scan type : Quick Scan
Total Scan Time : 01:05:28

Memory items scanned : 248
Memory threats detected : 0
Registry items scanned : 497
Registry threats detected : 0
File items scanned : 58129
File threats detected : 0


------------

New Malwarebytes log:

Malwarebytes' Anti-Malware 1.41
Database version: 3022
Windows 5.1.2600 Service Pack 3

10/24/2009 10:32:52 AM
mbam-log-2009-10-24 (10-32-52).txt

Scan type: Full Scan (C:\|D:\|)
Objects scanned: 294013
Time elapsed: 13 hour(s), 57 minute(s), 58 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 3

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
D:\System Volume Information\_restore{1830E9C1-4432-4BFB-9517-05FE7C40D353}\RP302\A0121150.exe (Adware.ADON) -> Quarantined and deleted successfully.
D:\System Volume Information\_restore{1830E9C1-4432-4BFB-9517-05FE7C40D353}\RP303\A0123404.exe (Rogue.SecurityTool) -> Quarantined and deleted successfully.
D:\System Volume Information\_restore{1830E9C1-4432-4BFB-9517-05FE7C40D353}\RP303\A0123422.exe (Trojan.Downloader) -> Quarantined and deleted successfully.


New HijackThis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:55:34, on 10/24/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\ZoneLabs\vsmon.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
D:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
D:\Program Files\Bonjour\mDNSResponder.exe
D:\Program Files\Java\jre6\bin\jqs.exe
D:\WINDOWS\system32\nvsvc32.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\SOUNDMAN.EXE
D:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\Side Programs\HP\HP Software Update\HPWuSchd2.exe
D:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
D:\SIDEPR~1\SsAAD.exe
D:\Side Programs\CyberLink\PowerDVD\PDVDServ.exe
D:\WINDOWS\system32\dla\tfswctrl.exe
D:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
D:\WINDOWS\VM_STI.EXE
D:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
D:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
D:\Side Programs\Zone Labs\ZoneAlarm\zlclient.exe
D:\Program Files\Java\jre6\bin\jusched.exe
D:\Program Files\Unlocker\UnlockerAssistant.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Side Programs\HP\Digital Imaging\bin\hpqtra08.exe
D:\Side Programs\HP\Digital Imaging\bin\hpqSTE08.exe
D:\Side Programs\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - D:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - D:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "D:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] D:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] D:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [HP Software Update] D:\Side Programs\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe "
O4 - HKLM\..\Run: [GrooveMonitor] "D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe "
O4 - HKLM\..\Run: [SsAAD.exe] D:\SIDEPR~1\SsAAD.exe
O4 - HKLM\..\Run: [RemoteControl] "D:\Side Programs\CyberLink\PowerDVD\PDVDServ.exe "
O4 - HKLM\..\Run: [dla] D:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ISUSPM Startup] D:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "D:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [BigDogPath] D:\WINDOWS\VM_STI.EXE HiCam USB 1.1 VM
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avgnt] "D:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [ZoneAlarm Client] "D:\Side Programs\Zone Labs\ZoneAlarm\zlclient.exe "
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre6\bin\jusched.exe "
O4 - HKLM\..\Run: [UnlockerAssistant] "D:\Program Files\Unlocker\UnlockerAssistant.exe "
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "D:\Side Programs\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = D:\Side Programs\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O15 - ESC Trusted Zone: http://*.update.microsoft.com
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1219184584046
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {DA758BB1-5F89-4465-975F-8D7179A4BCF3} (WheelofFortune Object) - http://messenger.zone.msn.com/binary/WoF.cab57176.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O20 - Winlogon Notify: !SASWinLogon - D:\Side Programs\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - D:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - D:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - D:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - D:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Imapi Helper - Alex Feinman - D:\Side Programs\Alex Feinman\ISO Recorder\ImapiHelper.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - D:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: MSCSPTISRV - Sony Corporation - D:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: WinFast(R) Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - D:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Pml Driver HPZ12 - HP - D:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - D:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - D:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - D:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 9069 bytes

 

Here is my new HijackThis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 06:01:32, on 10/24/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\ZoneLabs\vsmon.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
D:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
D:\Program Files\Bonjour\mDNSResponder.exe
D:\Program Files\Java\jre6\bin\jqs.exe
D:\WINDOWS\system32\nvsvc32.exe
D:\WINDOWS\system32\HPZipm12.exe
D:\WINDOWS\system32\svchost.exe
D:\SIDEPR~1\SsAAD.exe
D:\Side Programs\CyberLink\PowerDVD\PDVDServ.exe
D:\WINDOWS\system32\dla\tfswctrl.exe
D:\WINDOWS\VM_STI.EXE
D:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
D:\Side Programs\Zone Labs\ZoneAlarm\zlclient.exe
D:\Program Files\Unlocker\UnlockerAssistant.exe
D:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
D:\WINDOWS\system32\ctfmon.exe
D:\WINDOWS\System32\svchost.exe
D:\Side Programs\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - D:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - D:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [SsAAD.exe] D:\SIDEPR~1\SsAAD.exe
O4 - HKLM\..\Run: [RemoteControl] "D:\Side Programs\CyberLink\PowerDVD\PDVDServ.exe "
O4 - HKLM\..\Run: [dla] D:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [BigDogPath] D:\WINDOWS\VM_STI.EXE HiCam USB 1.1 VM
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avgnt] "D:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [ZoneAlarm Client] "D:\Side Programs\Zone Labs\ZoneAlarm\zlclient.exe "
O4 - HKLM\..\Run: [UnlockerAssistant] "D:\Program Files\Unlocker\UnlockerAssistant.exe "
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O15 - ESC Trusted Zone: http://*.update.microsoft.com
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1219184584046
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {DA758BB1-5F89-4465-975F-8D7179A4BCF3} (WheelofFortune Object) - http://messenger.zone.msn.com/binary/WoF.cab57176.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - D:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - D:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - D:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - D:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Imapi Helper - Alex Feinman - D:\Side Programs\Alex Feinman\ISO Recorder\ImapiHelper.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - D:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: MSCSPTISRV - Sony Corporation - D:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: WinFast(R) Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - D:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Pml Driver HPZ12 - HP - D:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - D:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - D:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - D:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 7027 bytes

 

Thank you very much for your help.

 

Thank you very much for your help, and thank you for your time.