Lowyat.NET: Latest topics by rioven

i still love her

rioven — Sat, 25 Aug 2012 05:00:39 +0800

Well i think this is my 1st post here..most of the time i just read and reply some that not seriously. 1st of all im sorry coz i dont know how to explain plus my english is very very bad. I'll try to explain in short and clean. We were in relationship almost 6-7 years..like other couple..there is up and down..but the most important we manage to clear things up. Almost 1 year ago..she finished her studies while i still stuck in uni (we know each other from diploma...later we continue different uni.). So she start looking for job...she interview here and there..at last she manage get a job. She was happy so do i.
About 6 months back..i feel like she start to change bit by bit..i told her but she explain that im still in her heart. About a month ago (well before puasa aka fasting month)..i start to threatenin her because there are lack of call and sms (which we were used to be)..not to be mention to see her..which i remember the last i see her is around mei or june. She..i can say always used reason she quite bz with her work (which i at 1st i can accept)...later always used that reason..i became mad. 1 day i threaten her that i broke off with her i she doesnt manage to see me in some sort of like time bomb..like a game over if u dont complete in given time. Well she doesnt manage at that period time...from that we were "gaduh besar".
Since fasting month is start..i ask myself to forgive her..and i told myself.."buang yang keruh..ambil yang jernih"..what i did is i ask forgiveness from her..and thing quite run well (well that was which i believe). She said that she will visiting me during "Hari Raya". (during fasting month..i just using email to contact her). During almost end of fasting month to this morning...i couldnt contact her because she said her sim card problem..so she asked me to contact using email..which i did try..but i know her that she will not reply that soon i expected. What i do is i msg to her family to pass message to her. This is where part i like...suddenly i got a call this morning (1 hour ago) from unknown number. He explain he is her bf..that they start 6 month ago.. She is there too..i try to ask lots of question..(since i got angry..suddenly i speak in high tone)..suddenly he warning me because of the tone..and try to explain dont "kacau" her family etc2 (i dont know if they using loudspeaker..according to them they at kedai mamak).
Okay..i think that it..any advice?? She is still in my heart...

(edit to make paragraph..hoppefully better..thanks woit)

[WTA] My tyre 'makan sebelah'

rioven — Mon, 20 Jun 2011 18:21:36 +0800

Okay as title..my tyre 'makan sebelah'..was happen before and after change new tyre and new absorber..only at driver side...the left side no problem. What else i need to check? (the change was done about 3 weeks ago)

infected by virus n spyware

rioven — Sat, 01 Sep 2007 15:46:49 +0800

HijackTHis Log file :

Logfile of HijackThis v1.99.1
Scan saved at 3:44:23 PM, on 9/1/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\PROGRA~1\CACHEM~1\CachemanXP.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
C:\Program Files\Winamp\winampa.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBHP.EXE
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RtkBtMnt.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Hacked by Godzilla
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [INPROCOMMWireless] C:\Program Files\Atheros\Wireless\Utility\WlanUtil.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [EPSON Stylus C59 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBHP.EXE /FU "C:\WINDOWS\TEMP\E_S83.tmp" /EF "HKLM"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Bluetooth.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: CachemanXP (CachemanXPService) - OuterTechnologies - C:\PROGRA~1\CACHEM~1\CachemanXP.exe
O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

im not sure if my friend computer clean or not..but internet explorer being infected by "hacked by godzilla"

windows corrupt

rioven — Sat, 01 Sep 2007 15:19:28 +0800

when i start computer...

"Windows could not start because the following file is missing or corrupt:
\WINDOWS\SYSTEM32\CONFIG\SYSTEM

You can attempt to repair this file by starting Windows Setup Using the original setup CD-ROM.
Select 'r' at the first screen to start repair".

can anyone guide to repair..if possible i dont wanna format/reinstall..since i have some file to in my documents i didnt manage to backup yet.

cant edit all programs list

rioven — Thu, 30 Aug 2007 02:27:59 +0800

as title..plz view picture in attachment. cant remember when this happen. as far as i know...when i edit/add..it will revert to original state.
btw..in HKEY_CURRENT_USER\Software\Mirosoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2..is the same list in my all programs..could be this the culprit??

» Click to show Spoiler - click again to hide... «

edit : grammar mistake...my english so poor..

virus n spyware

rioven — Fri, 13 Jul 2007 14:22:15 +0800

helping my friend only..after scan by anti-virus n spyware..

HijackThis Log

Logfile of HijackThis v1.99.1
Scan saved at 2:17:52 PM, on 7/13/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe
C:\Program Files\Fujitsu\Application Panel\QuickTouch.exe
C:\Program Files\Fujitsu\BtnHnd\BtnHnd.exe
C:\Program Files\Java\j2re1.4.2_07\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Eset\nod32kui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\PROGRA~1\CACHEM~1\CachemanXP.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\HijackThis\HijackThis.exe

F2 - REG:system.ini: Shell=Explorer.exe RVHOST.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [IndicatorUtility] C:\Program Files\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe
O4 - HKLM\..\Run: [LoadFujitsuQuickTouch] C:\Program Files\Fujitsu\Application Panel\QuickTouch.exe
O4 - HKLM\..\Run: [LoadBtnHnd] C:\Program Files\Fujitsu\BtnHnd\BtnHnd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [AntiSpyware] C:\Program Files\AntiSpyware\AntiSpyware.exe -boot
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.adobe.com/pub/shockwave/...ash/swflash.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: CachemanXP (CachemanXPService) - OuterTechnologies - C:\PROGRA~1\CACHEM~1\CachemanXP.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe

zyb.com

rioven — Mon, 18 Jun 2007 16:21:01 +0800

as topic..wanna try sync with zyb.com...but donno how to setting (nokia 6020)..everytime to sync..it failed.. reason "subcribe gprs service first"

infected by virus n spyware

rioven — Mon, 14 May 2007 20:35:42 +0800

hijack this log

Logfile of HijackThis v1.99.1
Scan saved at 20:10:50, on 14/05/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\System32\RunDll32.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
C:\Program Files\Trojan Guarder Gold Version\Trojan Guarder.exe
C:\Program Files\LimeWire\LimeWire.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.yahoo.com/search/ie.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
F2 - REG:system.ini: Shell=Explorer.exe SVICHOSSST.exe
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\RunServices: [Intel Driver] csrs.exe
O4 - HKLM\..\RunServices: [Microsoft Windows Update] C:\WINDOWS\system32\srshost.exe
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [Wedash Antivirus 2005] C:\Documents and Settings\AjiEmS\Desktop\antivirus\WAVBeta\WAV.exe /T
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Microsoft Windows Update] C:\WINDOWS\system32\srshost.exe
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Trojan Guarder Gold Version.lnk = C:\Program Files\Trojan Guarder Gold Version\Trojan Guarder.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

combofix log

"AjiEmS" - 2007-05-14 20:11:16 Service Pack 1
ComboFix 07-05.07.3.V - Running from: "C:\Documents and Settings\AjiEmS\Desktop\"

((((((((((((((((((((((((((((((( Files Created from 2007-04-05 to 2007-05-14 ))))))))))))))))))))))))))))))))))

2007-05-10 17:31 49,152 --a------ C:\WINDOWS\nircmd.exe

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-05-14 12:07:22 0 ----a-w C:\WINDOWS\system32\sys_dll.dll
2007-05-10 09:17:37 -------- d-----w C:\DOCUME~1\AjiEmS\APPLIC~1.\LimeWire
2007-04-17 15:18:49 12,800 ----a-w C:\WINDOWS\system32\svchost.exe
2007-04-10 05:42:55 -------- d-----w C:\Program Files\Trojan Guarder Gold Version
2007-02-05 04:13:58 222,461 ----a-w C:\WINDOWS\SVICHOSSST.exe

(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
"{02478D38-C3F9-4EFB-9B51-7695ECA05670}"="C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll"
"{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897}"="C:\Program Files\Yahoo!\Common\yiesrvc.dll"
"{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}"="C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"ATIPTA"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe"
"NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"Cmaudio"="RunDll32 cmicnfg.cpl,CMICtrlWnd"
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"WinampAgent"="C:\\Program Files\\Winamp\\winampa.exe"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"PCSuiteTrayApplication"="C:\\PROGRA~1\\Nokia\\NOKIAP~1\\LAUNCH~1.EXE -startup"
"iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"HPDJ Taskbar Utility"="C:\\WINDOWS\\System32\\spool\\drivers\\w32x86\\3\\hpztsb09.exe"
"HP Software Update"="\"C:\\Program Files\\Hewlett-Packard\\HP Software Update\\HPWuSchd.exe\""
"HP Component Manager"="\"C:\\Program Files\\HP\\hpcoretech\\hpcmpmgr.exe\""
"DeviceDiscovery"="C:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpotdd01.exe"
"AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVG7\\avgcc.exe /STARTUP"
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_10\\bin\\jusched.exe\""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"PcSync"="C:\\Program Files\\Nokia\\Nokia PC Suite 6\\PcSync2.exe /NoDialog"
"Wedash Antivirus 2005"="C:\\Documents and Settings\\AjiEmS\\Desktop\\antivirus\\WAVBeta\\WAV.exe /T"
"NBJ"="\"C:\\Program Files\\Ahead\\Nero BackItUp\\NBJ.exe\""
"Yahoo! Pager"="\"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe\" -quiet"
"MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"Microsoft Windows Update"="C:\\WINDOWS\\system32\\srshost.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices]
"Intel Driver"="csrs.exe"
"Microsoft Windows Update"="C:\\WINDOWS\\system32\\srshost.exe"

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
Authentication Packages msv1_0\0\0
Security Packages kerberos\0msv1_0\0schannel\0wdigest\0\0
Notification Packages scecli\0\0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost]
LocalService Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService DnsCache\0\0
rpcss RpcSs\0\0
imgsvc StiSvc\0\0
termsvcs TermService\0\0

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost

Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\At1.job

********************************************************************

catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-05-14 20:14:50
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

********************************************************************

Completion time: 2007-05-14 20:15:00
C:\ComboFix-quarantined-files.txt ... 2007-05-14 20:15
C:\ComboFix2.txt ... 2007-05-10 17:31

infected by spyware

rioven — Tue, 08 May 2007 13:02:11 +0800

Hijackthis log file

Logfile of HijackThis v1.99.1
Scan saved at 12:49:01 PM, on 5/8/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
C:\WINDOWS\system32\ZoomingHook.exe
C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
C:\Program Files\Toshiba\Tvs\TvsTray.exe
C:\PROGRA~1\CACHEM~1\CachemanXP.exe
C:\WINDOWS\system32\TCtrlIOHook.exe
C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
C:\WINDOWS\system32\TDispVol.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\system32\TPSMain.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Eset\nod32kui.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\CameraFixer.exe
C:\WINDOWS\tsnpstd3.exe
C:\WINDOWS\system32\lkcitdl.exe
C:\WINDOWS\vsnpstd3.exe
C:\WINDOWS\system32\TPSBattM.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSServ.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\cselect.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\lkads.exe
C:\WINDOWS\system32\lktsrv.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\National Instruments\Shared\Security\nidmsrv.exe
C:\WINDOWS\system32\RAMASST.exe
C:\WINDOWS\system32\nisvcloc.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\Agnitum\Outpost Firewall\outpost.exe
C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\TOSHIBA\ConfigFree\CFXFER.exe
C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.kuittho.edu.my:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;127.0.0.1;*.uthm.edu.my;*.kuittho.edu.my;10.8.*.*;10.9.*.*.;161.139.*.*;172.16.*.*;<local>
F2 - REG:system.ini: UserInit=C:\WINDOWS\SYSTEM32\Userinit.exe,C:\WINDOWS\system32\ntos.exe,
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [TPNF] C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
O4 - HKLM\..\Run: [CeEKEY] C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
O4 - HKLM\..\Run: [ZoomingHook] ZoomingHook.exe
O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
O4 - HKLM\..\Run: [HWSetup] C:\Program Files\TOSHIBA\TOSHIBA Applet\HWSetup.exe hwSetUP
O4 - HKLM\..\Run: [Tvs] C:\Program Files\Toshiba\Tvs\TvsTray.exe
O4 - HKLM\..\Run: [SVPWUTIL] C:\Program Files\Toshiba\Windows Utilities\SVPWUTIL.exe SVPwUTIL
O4 - HKLM\..\Run: [TCtryIOHook] TCtrlIOHook.exe
O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
O4 - HKLM\..\Run: [TDispVol] TDispVol.exe
O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [CameraFixer] C:\WINDOWS\CameraFixer.exe
O4 - HKLM\..\Run: [tsnpstd3] C:\WINDOWS\tsnpstd3.exe
O4 - HKLM\..\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe
O4 - HKLM\..\Run: [CFSServ.exe] CFSServ.exe -NoClient
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Cselect] C:\WINDOWS\system32\cselect.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Outpost Firewall] "C:\Program Files\Agnitum\Outpost Firewall\outpost.exe" /waitservice
O4 - HKLM\..\Run: [OutpostFeedBack] C:\Program Files\Agnitum\Outpost Firewall\feedback.exe /dump:os_startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [userinit] C:\WINDOWS\system32\ntos.exe
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart17.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\yccte.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\yccte.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\yccte.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\yccte.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\yccte.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\yccte.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\yccte.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\yccte.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\yccte.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\yccte.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\yccte.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\yccte.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\yccte.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\yccte.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\yccte.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\yccte.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\yccte.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\yccte.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\yccte.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\yccte.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\yccte.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\yccte.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\yccte.dll
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d...can_unicode.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Agnitum\OUTPOS~1\wl_hook.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: CachemanXP (CachemanXPService) - OuterTechnologies - C:\PROGRA~1\CACHEM~1\CachemanXP.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Lookout Citadel Server (LkCitadelServer) - National Instruments, Inc. - C:\WINDOWS\system32\lkcitdl.exe
O23 - Service: National Instruments PSP Server Locator (lkClassAds) - National Instruments, Inc. - C:\WINDOWS\system32\lkads.exe
O23 - Service: National Instruments Time Synchronization (lkTimeSync) - National Instruments, Inc. - C:\WINDOWS\system32\lktsrv.exe
O23 - Service: National Instruments Domain Service (NIDomainService) - National Instruments, Inc. - C:\Program Files\National Instruments\Shared\Security\nidmsrv.exe
O23 - Service: NI Service Locator (niSvcLoc) - National Instruments Corp. - C:\WINDOWS\system32\nisvcloc.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: Outpost Firewall Service (OutpostFirewall) - Agnitum Ltd. - C:\Program Files\Agnitum\Outpost Firewall\outpost.exe
O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

DirectX Febuary 2007

rioven — Mon, 05 Feb 2007 18:24:57 +0800

Microsoft DirectX is a group of technologies designed to make Windows-based computers an ideal platform for running and displaying applications rich in multimedia elements such as full-color graphics, video, 3D animation, and rich audio. DirectX includes security and performance updates, along with many new features across all technologies, which can be accessed by applications using the DirectX APIs.

DirectX Febuary 2007

need help..being attack by virus/spyware

rioven — Sat, 19 Aug 2006 00:29:28 +0800

here my hijackthis log

CODE

Logfile of HijackThis v1.99.1
Scan saved at 00:18, on 06-08-19
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\PROGRA~1\CACHEM~1\CachemanXP.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\WINDOWS\AGRSMMSG.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\TaskSwitchXP\TaskSwitchXP.exe
C:\Program Files\Free Download Manager\fdm.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKCU\..\Run: [TaskSwitchXP] C:\Program Files\TaskSwitchXP\TaskSwitchXP.exe
O4 - HKCU\..\Run: [Free Download Manager] C:\Program Files\Free Download Manager\fdm.exe -autorun
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Trend Micro ActiveX Scan Agent 6.5) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: CachemanXP (CachemanXPService) - OuterTechnologies - C:\PROGRA~1\CACHEM~1\CachemanXP.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe

my combofix log

CODE

Administrator*Administrators - 06-08-18 21:41:07.75
ComboFix 06.08.17 - Running from: C:\Documents and Settings\Administrator\Desktop

((((((((((((((((((((((((((((((( Files Created from 2006-07-18 to 2006-08-18 ))))))))))))))))))))))))))))))))))

2006-07-29 23:03 476,320 C:\WINDOWS\system32\ImagXpr7.dll
2006-07-29 23:03 471,040 C:\WINDOWS\system32\ImagXRA7.dll
2006-07-29 23:03 38,912 C:\WINDOWS\system32\picn20.dll
2006-07-29 23:03 364,544 C:\WINDOWS\system32\TwnLib4.dll
2006-07-29 23:03 262,144 C:\WINDOWS\system32\ImagXR7.dll
2006-07-29 23:03 155,648 C:\WINDOWS\system32\NeroCheck.exe
2006-07-29 23:03 106,496 C:\WINDOWS\system32\TwnLib20.dll
2006-07-29 23:03 1,568,768 C:\WINDOWS\system32\ImagX7.dll
2006-07-29 22:41 75,264 C:\WINDOWS\system32\MACDec.dll
2006-07-29 22:41 679,936 C:\WINDOWS\system32\xvidcore.dll
2006-07-29 22:41 61,440 C:\WINDOWS\system32\libfaac.dll
2006-07-29 22:41 45,568 C:\WINDOWS\system32\huffyuv.dll
2006-07-29 22:41 446,464 C:\WINDOWS\system32\vp31vfw.dll
2006-07-29 22:41 438,272 C:\WINDOWS\system32\vp6vfw.dll
2006-07-29 22:41 421,888 C:\WINDOWS\system32\OpenQuicktimeLib.dll
2006-07-29 22:41 413,760 C:\WINDOWS\system32\mpg4c32.dll
2006-07-29 22:41 344,064 C:\WINDOWS\system32\msvcr70.dll
2006-07-29 22:41 309,616 C:\WINDOWS\system32\WMV8DMOD.DLL
2006-07-29 22:41 286,720 C:\WINDOWS\system32\3ivxVfWCodec.dll
2006-07-29 22:41 245,408 C:\WINDOWS\system32\unicows.dll
2006-07-29 22:41 19,968 C:\WINDOWS\system32\cpuinf32.dll
2006-07-29 22:41 155,648 C:\WINDOWS\system32\xvidvfw.dll
2006-07-29 22:41 1,824,768 C:\WINDOWS\system32\divx.dll
2006-07-29 22:41 1,415,680 C:\WINDOWS\system32\WMV9VCM.dll
2006-07-29 22:41 1,024,000 C:\WINDOWS\system32\3ivx.dll
2006-07-29 22:40 86,016 C:\WINDOWS\unvise32qt.exe
2006-07-29 22:13 17,920 C:\WINDOWS\system32\mdimon.dll
2006-07-29 22:06 74,240 C:\WINDOWS\system32\usbui.dll
2006-07-29 22:04 85,020 C:\WINDOWS\system32\dgsetup.dll
2006-07-29 22:04 8,704 C:\WINDOWS\system32\batt.dll
2006-07-29 22:04 8,192 C:\WINDOWS\system32\kbdhept.dll
2006-07-29 22:04 74,752 C:\WINDOWS\system32\storprop.dll
2006-07-29 22:04 7,168 C:\WINDOWS\system32\kbdcz.dll
2006-07-29 22:04 69,120 C:\WINDOWS\NOTEPAD.EXE
2006-07-29 22:04 6,656 C:\WINDOWS\system32\kbdycl.dll
2006-07-29 22:04 6,656 C:\WINDOWS\system32\kbdsl1.dll
2006-07-29 22:04 6,656 C:\WINDOWS\system32\kbdsl.dll
2006-07-29 22:04 6,656 C:\WINDOWS\system32\kbdpl.dll
2006-07-29 22:04 6,656 C:\WINDOWS\system32\kbdhu.dll
2006-07-29 22:04 6,656 C:\WINDOWS\system32\kbdhela3.dll
2006-07-29 22:04 6,656 C:\WINDOWS\system32\kbdcz2.dll
2006-07-29 22:04 6,656 C:\WINDOWS\system32\kbdcz1.dll
2006-07-29 22:04 6,656 C:\WINDOWS\system32\kbdcr.dll
2006-07-29 22:04 6,656 C:\WINDOWS\system32\KBDAL.DLL
2006-07-29 22:04 6,144 C:\WINDOWS\system32\kbdtuq.dll
2006-07-29 22:04 6,144 C:\WINDOWS\system32\kbdtuf.dll
2006-07-29 22:04 6,144 C:\WINDOWS\system32\kbdlv1.dll
2006-07-29 22:04 6,144 C:\WINDOWS\system32\kbdlv.dll
2006-07-29 22:04 6,144 C:\WINDOWS\system32\kbdhela2.dll
2006-07-29 22:04 6,144 C:\WINDOWS\system32\kbdgkl.dll
2006-07-29 22:04 6,144 C:\WINDOWS\system32\kbdest.dll
2006-07-29 22:04 5,632 C:\WINDOWS\system32\kbdycc.dll
2006-07-29 22:04 5,632 C:\WINDOWS\system32\kbduzb.dll
2006-07-29 22:04 5,632 C:\WINDOWS\system32\kbdur.dll
2006-07-29 22:04 5,632 C:\WINDOWS\system32\kbdtat.dll
2006-07-29 22:04 5,632 C:\WINDOWS\system32\kbdru1.dll
2006-07-29 22:04 5,632 C:\WINDOWS\system32\kbdru.dll
2006-07-29 22:04 5,632 C:\WINDOWS\system32\kbdro.dll
2006-07-29 22:04 5,632 C:\WINDOWS\system32\kbdpl1.dll
2006-07-29 22:04 5,632 C:\WINDOWS\system32\kbdmon.dll
2006-07-29 22:04 5,632 C:\WINDOWS\system32\kbdlt1.dll
2006-07-29 22:04 5,632 C:\WINDOWS\system32\kbdlt.dll
2006-07-29 22:04 5,632 C:\WINDOWS\system32\kbdkyr.dll
2006-07-29 22:04 5,632 C:\WINDOWS\system32\kbdkaz.dll
2006-07-29 22:04 5,632 C:\WINDOWS\system32\kbdhu1.dll
2006-07-29 22:04 5,632 C:\WINDOWS\system32\kbdhe319.dll
2006-07-29 22:04 5,632 C:\WINDOWS\system32\kbdhe220.dll
2006-07-29 22:04 5,632 C:\WINDOWS\system32\kbdhe.dll
2006-07-29 22:04 5,632 C:\WINDOWS\system32\kbdbu.dll
2006-07-29 22:04 5,632 C:\WINDOWS\system32\kbdblr.dll
2006-07-29 22:04 5,632 C:\WINDOWS\system32\kbdazel.dll
2006-07-29 22:04 5,632 C:\WINDOWS\system32\kbdaze.dll
2006-07-29 22:04 24,661 C:\WINDOWS\system32\spxcoins.dll
2006-07-29 22:04 176,157 C:\WINDOWS\system32\dgrpsetu.dll
2006-07-29 22:04 15,360 C:\WINDOWS\TASKMAN.EXE
2006-07-29 22:04 13,312 C:\WINDOWS\system32\irclass.dll
2006-07-29 22:04 103,424 C:\WINDOWS\system32\EqnClass.Dll
2006-07-29 21:58 90,112 C:\WINDOWS\system32\AVASTSS.scr
2006-07-29 21:58 635,520 C:\WINDOWS\system32\aswBoot.exe
2006-07-29 21:58 1,060,864 C:\WINDOWS\system32\MFC71.dll
2006-07-29 21:57 89,541 C:\WINDOWS\agrsmmsg.exe
2006-07-29 21:57 77,824 C:\WINDOWS\system32\tosmreg.exe
2006-07-29 21:57 68,096 C:\WINDOWS\agrsmdel.exe
2006-07-29 21:57 45,056 C:\WINDOWS\system32\csellang.dll
2006-07-29 21:57 32,768 C:\WINDOWS\system32\RmWLAN.exe
2006-07-29 21:57 32,768 C:\WINDOWS\system32\CloseACU.exe
2006-07-29 21:57 28,672 C:\WINDOWS\system32\InstallInf.exe
2006-07-29 21:57 270,336 C:\WINDOWS\system32\PlugPlayPCIDevice.exe
2006-07-29 21:57 110,592 C:\WINDOWS\system32\cselect.exe
2006-07-29 21:56 94,298 C:\WINDOWS\system32\SynTPAPI.dll
2006-07-29 21:56 82,013 C:\WINDOWS\system32\SynCOM.dll
2006-07-29 21:56 81,920 C:\WINDOWS\system32\SynTPCo2.dll
2006-07-29 21:56 69,722 C:\WINDOWS\system32\SynTPFcs.dll
2006-07-29 21:56 114,688 C:\WINDOWS\system32\SynCtrl.dll
2006-07-29 21:55 40,960 C:\WINDOWS\system32\ChCfg.exe
2006-07-29 21:55 2,879,488 C:\WINDOWS\SkyTel.exe
2006-07-29 21:55 135,168 C:\WINDOWS\system32\RtlCPAPI.dll
2006-07-29 21:54 9,709,568 C:\WINDOWS\RTLCPL.exe
2006-07-29 21:54 86,016 C:\WINDOWS\SoundMan.exe
2006-07-29 21:54 69,632 C:\WINDOWS\Alcmtr.exe
2006-07-29 21:54 487,424 C:\WINDOWS\RtlExUpd.dll
2006-07-29 21:54 4,096 C:\WINDOWS\system32\ksuser.dll
2006-07-29 21:54 364,544 C:\WINDOWS\RtlUpd.exe
2006-07-29 21:54 2,808,832 C:\WINDOWS\alcwzrd.exe
2006-07-29 21:54 2,158,592 C:\WINDOWS\MicCal.exe
2006-07-29 21:54 16,207,872 C:\WINDOWS\RTHDCPL.exe
2006-07-29 21:50 862,464 C:\WINDOWS\system32\ativvaxx.dll
2006-07-29 21:50 77,824 C:\WINDOWS\system32\Oemdspif.dll
2006-07-29 21:50 6,684,672 C:\WINDOWS\system32\atioglx1.dll
2006-07-29 21:50 53,248 C:\WINDOWS\system32\ATIDDC.DLL
2006-07-29 21:50 47,104 C:\WINDOWS\system32\ati2evxx.dll
2006-07-29 21:50 40,960 C:\WINDOWS\system32\ati2edxx.dll
2006-07-29 21:50 4,968,448 C:\WINDOWS\system32\atioglxx.dll
2006-07-29 21:50 393,216 C:\WINDOWS\system32\ati2evxx.exe
2006-07-29 21:50 307,200 C:\WINDOWS\system32\atiiiexx.dll
2006-07-29 21:50 26,112 C:\WINDOWS\system32\Ati2mdxx.exe
2006-07-29 21:50 258,048 C:\WINDOWS\system32\ATIDEMGR.dll
2006-07-29 21:50 252,928 C:\WINDOWS\system32\ati2dvag.dll
2006-07-29 21:50 24,064 C:\WINDOWS\system32\ativcoxx.dll
2006-07-29 21:50 237,568 C:\WINDOWS\system32\ati2cqag.dll
2006-07-29 21:50 2,518,016 C:\WINDOWS\system32\ati3duag.dll
2006-07-29 21:50 17,408 C:\WINDOWS\system32\atitvo32.dll
2006-07-29 21:50 151,552 C:\WINDOWS\system32\atikvmag.dll
2006-07-29 21:50 110,592 C:\WINDOWS\system32\atipdlxx.dll
2006-07-29 14:22 221,184 C:\WINDOWS\system32\wmpns.dll
2006-07-29 14:16 107,132 C:\WINDOWS\UninstallFirefox.exe
2006-07-29 14:15 112,128 C:\WINDOWS\system32\mapi32.dll
2006-07-29 14:15 107,132 C:\WINDOWS\UninstallThunderbird.exe
2006-07-29 14:15 0 C:\MSDOS.SYS
2006-07-29 14:15 0 C:\IO.SYS
2006-07-29 14:15 0 C:\CONFIG.SYS
2006-07-29 14:15 0 C:\AUTOEXEC.BAT
2006-07-29 14:12 8,192 C:\WINDOWS\system32\bitsprx2.dll
2006-07-29 14:12 7,168 C:\WINDOWS\system32\bitsprx3.dll
2006-07-29 14:12 679,424 C:\WINDOWS\system32\inetcomm.dll
2006-07-29 14:12 67,584 C:\WINDOWS\system32\srclient.dll
2006-07-29 14:12 64,512 C:\WINDOWS\system32\acctres.dll
2006-07-29 14:12 6,656 C:\WINDOWS\system32\wuauserv.dll
2006-07-29 14:12 48,128 C:\WINDOWS\system32\inetres.dll
2006-07-29 14:12 465,176 C:\WINDOWS\system32\wuapi.dll
2006-07-29 14:12 45,568 C:\WINDOWS\system32\safrslv.dll
2006-07-29 14:12 43,520 C:\WINDOWS\system32\safrcdlg.dll
2006-07-29 14:12 43,520 C:\WINDOWS\system32\racpldlg.dll
2006-07-29 14:12 41,240 C:\WINDOWS\system32\wups.dll
2006-07-29 14:12 382,464 C:\WINDOWS\system32\qmgr.dll
2006-07-29 14:12 29,696 C:\WINDOWS\system32\safrdm.dll
2006-07-29 14:12 274,944 C:\WINDOWS\system32\mstask.dll
2006-07-29 14:12 252,928 C:\WINDOWS\system32\msoeacct.dll
2006-07-29 14:12 239,104 C:\WINDOWS\system32\srrstr.dll
2006-07-29 14:12 22,528 C:\WINDOWS\system32\fltMc.exe
2006-07-29 14:12 194,328 C:\WINDOWS\system32\wuaueng1.dll
2006-07-29 14:12 190,976 C:\WINDOWS\system32\schedsvc.dll
2006-07-29 14:12 18,944 C:\WINDOWS\system32\qmgrprxy.dll
2006-07-29 14:12 173,536 C:\WINDOWS\system32\wuweb.dll
2006-07-29 14:12 172,312 C:\WINDOWS\system32\wuauclt1.exe
2006-07-29 14:12 170,496 C:\WINDOWS\system32\srsvc.dll
2006-07-29 14:12 16,896 C:\WINDOWS\system32\fltlib.dll
2006-07-29 14:12 127,256 C:\WINDOWS\system32\wucltui.dll
2006-07-29 14:12 124,184 C:\WINDOWS\system32\wuauclt.exe
2006-07-29 14:12 12,288 C:\WINDOWS\system32\mstinit.exe
2006-07-29 14:12 11,264 C:\WINDOWS\system32\atrace.dll
2006-07-29 14:12 105,984 C:\WINDOWS\system32\msoert2.dll
2006-07-29 14:12 1,343,768 C:\WINDOWS\system32\wuaueng.dll
2006-07-29 14:10 97,792 C:\WINDOWS\system32\comrepl.dll
2006-07-29 14:10 946,448 C:\WINDOWS\system32\calc.exe
2006-07-29 14:10 945,152 C:\WINDOWS\system32\msdtctm.dll
2006-07-29 14:10 93,696 C:\WINDOWS\system32\tscfgwmi.dll
2006-07-29 14:10 91,136 C:\WINDOWS\system32\mtxoci.dll
2006-07-29 14:10 9,728 C:\WINDOWS\system32\reset.exe
2006-07-29 14:10 87,176 C:\WINDOWS\system32\rdpwsx.dll
2006-07-29 14:10 85,504 C:\WINDOWS\system32\catsrvps.dll
2006-07-29 14:10 80,384 C:\WINDOWS\system32\charmap.exe
2006-07-29 14:10 753,664 C:\WINDOWS\system32\mstscax.dll
2006-07-29 14:10 73,216 C:\WINDOWS\system32\avwav.dll
2006-07-29 14:10 67,072 C:\WINDOWS\system32\rdshost.exe
2006-07-29 14:10 625,152 C:\WINDOWS\system32\catsrvut.dll
2006-07-29 14:10 62,464 C:\WINDOWS\system32\rdpclip.exe
2006-07-29 14:10 605,696 C:\WINDOWS\system32\getuname.dll
2006-07-29 14:10 60,416 C:\WINDOWS\system32\remotepg.dll
2006-07-29 14:10 60,416 C:\WINDOWS\system32\colbact.dll
2006-07-29 14:10 6,144 C:\WINDOWS\system32\msdtc.exe
2006-07-29 14:10 58,880 C:\WINDOWS\system32\msdtclog.dll
2006-07-29 14:10 58,880 C:\WINDOWS\system32\licwmi.dll
2006-07-29 14:10 56,832 C:\WINDOWS\system32\sol.exe
2006-07-29 14:10 56,320 C:\WINDOWS\system32\servdeps.dll
2006-07-29 14:10 55,296 C:\WINDOWS\system32\freecell.exe
2006-07-29 14:10 540,160 C:\WINDOWS\system32\comuid.dll
2006-07-29 14:10 54,272 C:\WINDOWS\system32\stclient.dll
2006-07-29 14:10 538,624 C:\WINDOWS\system32\spider.exe
2006-07-29 14:10 5,632 C:\WINDOWS\system32\write.exe
2006-07-29 14:10 5,120 C:\WINDOWS\system32\dcomcnfg.exe
2006-07-29 14:10 498,688 C:\WINDOWS\system32\clbcatq.dll
2006-07-29 14:10 44,544 C:\WINDOWS\system32\tscupgrd.exe
2006-07-29 14:10 44,544 C:\WINDOWS\system32\hticons.dll
2006-07-29 14:10 425,472 C:\WINDOWS\system32\msdtcprx.dll
2006-07-29 14:10 420,352 C:\WINDOWS\system32\mstsc.exe
2006-07-29 14:10 4,096 C:\WINDOWS\system32\rdpcfgex.dll
2006-07-29 14:10 4,096 C:\WINDOWS\system32\mtxex.dll
2006-07-29 14:10 38,912 C:\WINDOWS\system32\cfgbkend.dll
2006-07-29 14:10 35,328 C:\WINDOWS\system32\winchat.exe
2006-07-29 14:10 347,136 C:\WINDOWS\system32\hypertrm.dll
2006-07-29 14:10 343,040 C:\WINDOWS\system32\mspaint.exe
2006-07-29 14:10 33,792 C:\WINDOWS\system32\regini.exe
2006-07-29 14:10 295,424 C:\WINDOWS\system32\termsrv.dll
2006-07-29 14:10 25,600 C:\WINDOWS\system32\comaddin.dll
2006-07-29 14:10 25,088 C:\WINDOWS\system32\mtxlegih.dll
2006-07-29 14:10 227,840 C:\WINDOWS\system32\avtapi.dll
2006-07-29 14:10 225,792 C:\WINDOWS\system32\catsrv.dll
2006-07-29 14:10 22,016 C:\WINDOWS\system32\qwinsta.exe
2006-07-29 14:10 20,992 C:\WINDOWS\system32\msg.exe
2006-07-29 14:10 20,480 C:\WINDOWS\system32\qprocess.exe
2006-07-29 14:10 20,480 C:\WINDOWS\system32\mtxdm.dll
2006-07-29 14:10 19,968 C:\WINDOWS\system32\rdpsnd.dll
2006-07-29 14:10 185,344 C:\WINDOWS\system32\cmprops.dll
2006-07-29 14:10 17,408 C:\WINDOWS\system32\mmfutil.dll
2006-07-29 14:10 161,280 C:\WINDOWS\system32\msdtcuiu.dll
2006-07-29 14:10 16,896 C:\WINDOWS\system32\tsshutdn.exe
2006-07-29 14:10 16,896 C:\WINDOWS\system32\qappsrv.exe
2006-07-29 14:10 16,384 C:\WINDOWS\system32\tskill.exe
2006-07-29 14:10 16,384 C:\WINDOWS\system32\avmeter.dll
2006-07-29 14:10 15,872 C:\WINDOWS\system32\rwinsta.exe
2006-07-29 14:10 15,872 C:\WINDOWS\system32\cdmodem.dll
2006-07-29 14:10 15,360 C:\WINDOWS\system32\logoff.exe
2006-07-29 14:10 147,968 C:\WINDOWS\system32\rdchost.dll
2006-07-29 14:10 147,456 C:\WINDOWS\system32\comsnap.dll
2006-07-29 14:10 140,800 C:\WINDOWS\system32\sessmgr.exe
2006-07-29 14:10 14,848 C:\WINDOWS\system32\tsdiscon.exe
2006-07-29 14:10 14,848 C:\WINDOWS\system32\tscon.exe
2006-07-29 14:10 14,848 C:\WINDOWS\system32\shadow.exe
2006-07-29 14:10 138,752 C:\WINDOWS\system32\sndvol32.exe
2006-07-29 14:10 13,824 C:\WINDOWS\system32\rdsaddin.exe
2006-07-29 14:10 126,976 C:\WINDOWS\system32\mshearts.exe
2006-07-29 14:10 119,808 C:\WINDOWS\system32\winmine.exe
2006-07-29 14:10 110,080 C:\WINDOWS\system32\clbcatex.dll
2006-07-29 14:10 11,776 C:\WINDOWS\system32\xolehlp.dll
2006-07-29 14:10 11,264 C:\WINDOWS\system32\icaapi.dll
2006-07-29 14:10 1,267,200 C:\WINDOWS\system32\comsvcs.dll
2006-07-29 14:10 1,161 C:\WINDOWS\system32\usrlogon.cmd

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2006-08-18 21:40 -------- d-------- C:\Documents and Settings\Administrator\Application Data\Free Download Manager
2006-08-18 21:36 -------- d-------- C:\Program Files\HijackThis
2006-08-18 12:11 -------- d-------- C:\Program Files\Free Download Manager
2006-08-17 14:56 -------- d-------- C:\Documents and Settings\Administrator\Application Data\Macromedia
2006-08-17 01:46 -------- d---s---- C:\Documents and Settings\Administrator\Application Data\Microsoft
2006-08-09 00:53 635520 --a------ C:\WINDOWS\system32\aswBoot.exe
2006-08-08 20:21 -------- d-------- C:\Documents and Settings\Administrator\Application Data\CyberLink
2006-08-05 23:25 85952 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2006-08-05 23:24 16352 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2006-08-05 23:22 36176 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2006-08-05 23:20 24304 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2006-08-05 15:11 -------- d-------- C:\Program Files\Mozilla Firefox
2006-08-05 15:10 -------- d-------- C:\Documents and Settings\Administrator\Application Data\Mozilla
2006-08-05 15:09 -------- d-------- C:\Program Files\Mozilla Thunderbird
2006-08-05 15:09 -------- d-------- C:\Documents and Settings\Administrator\Application Data\Talkback
2006-08-05 15:08 -------- d-------- C:\Documents and Settings\Administrator\Application Data\Thunderbird
2006-08-05 14:18 90112 --a------ C:\WINDOWS\system32\AVASTSS.scr
2006-08-01 05:33 -------- d-------- C:\Documents and Settings\Administrator\Application Data\Adobe
2006-07-30 23:01 -------- d-------- C:\Program Files\ScreenMates
2006-07-30 16:12 -------- d-------- C:\Documents and Settings\Administrator\Application Data\Identities
2006-07-30 13:50 -------- d-------- C:\Documents and Settings\Administrator\Application Data\Lavasoft
2006-07-29 23:05 -------- d--h----- C:\Program Files\InstallShield Installation Information
2006-07-29 23:05 -------- d-------- C:\Program Files\CyberLink
2006-07-29 23:03 -------- d-------- C:\Program Files\Common Files\Ahead
2006-07-29 23:03 -------- d-------- C:\Program Files\Common Files
2006-07-29 23:03 -------- d-------- C:\Program Files\Ahead
2006-07-29 22:51 -------- d-------- C:\Documents and Settings\Administrator\Application Data\Leadertech
2006-07-29 22:50 -------- d-------- C:\Program Files\Diskeeper Corporation
2006-07-29 22:42 -------- d-------- C:\Program Files\Lavasoft
2006-07-29 22:42 -------- d-------- C:\Program Files\CachemanXP
2006-07-29 22:41 -------- d-------- C:\Program Files\K-Lite Codec Pack
2006-07-29 22:40 -------- d-------- C:\Program Files\QuickTime
2006-07-29 22:39 -------- d-------- C:\Documents and Settings\Administrator\Application Data\Real
2006-07-29 22:37 -------- d-------- C:\Program Files\Real
2006-07-29 22:37 -------- d-------- C:\Program Files\Common Files\xing shared
2006-07-29 22:37 -------- d-------- C:\Program Files\Common Files\Real
2006-07-29 22:12 -------- d-------- C:\Program Files\Microsoft Office
2006-07-29 22:12 -------- d-------- C:\Program Files\Microsoft ActiveSync
2006-07-29 22:12 -------- d-------- C:\Program Files\Common Files\Microsoft Shared
2006-07-29 22:12 -------- d-------- C:\Program Files\Common Files\DESIGNER
2006-07-29 22:11 -------- d-------- C:\Program Files\Common Files\System
2006-07-29 22:10 -------- d-------- C:\Program Files\Microsoft.NET
2006-07-29 22:04 62 --ahs---- C:\Documents and Settings\Administrator\Application Data\desktop.ini
2006-07-29 22:04 -------- d-------- C:\Program Files\Common Files\SpeechEngines
2006-07-29 22:04 -------- d-------- C:\Program Files\Common Files\ODBC
2006-07-29 22:00 -------- d-------- C:\Documents and Settings\Administrator\Application Data\Help
2006-07-29 21:58 -------- d-------- C:\Program Files\Alwil Software
2006-07-29 21:57 -------- d-------- C:\Program Files\ltmoh
2006-07-29 21:57 -------- d-------- C:\Program Files\Atheros
2006-07-29 21:56 -------- d-------- C:\Program Files\Synaptics
2006-07-29 21:54 -------- d-------- C:\Program Files\Realtek
2006-07-29 21:54 -------- d-------- C:\Program Files\Common Files\InstallShield
2006-07-29 21:54 -------- d-------- C:\Program Files\ATI Technologies
2006-07-29 14:20 -------- d-------- C:\Program Files\Internet Explorer
2006-07-29 14:18 -------- d-------- C:\Program Files\WinRAR
2006-07-29 14:17 -------- d-------- C:\Program Files\MozBackup
2006-07-29 14:17 -------- d-------- C:\Program Files\Common Files\Adobe
2006-07-29 14:17 -------- d-------- C:\Program Files\Adobe
2006-07-29 14:16 107132 --a------ C:\WINDOWS\UninstallFirefox.exe
2006-07-29 14:16 -------- d-------- C:\Program Files\Java
2006-07-29 14:16 -------- d-------- C:\Program Files\Common Files\Java
2006-07-29 14:15 107132 --a------ C:\WINDOWS\UninstallThunderbird.exe
2006-07-29 14:15 0 -rahs---- C:\MSDOS.SYS
2006-07-29 14:15 0 -rahs---- C:\IO.SYS
2006-07-29 14:15 0 --a------ C:\CONFIG.SYS
2006-07-29 14:15 0 --a------ C:\AUTOEXEC.BAT
2006-07-29 14:15 -------- d-------- C:\Program Files\Windows Media Player
2006-07-29 14:13 -------- d--h----- C:\Program Files\WindowsUpdate
2006-07-29 14:13 -------- d-------- C:\Program Files\Online Services
2006-07-29 14:12 -------- d-------- C:\Program Files\Outlook Express
2006-07-29 14:12 -------- d-------- C:\Program Files\Common Files\Services
2006-07-29 14:12 -------- d-------- C:\Program Files\Common Files\MSSoap
2006-07-29 14:11 -------- d-------- C:\Program Files\ComPlus Applications
2006-07-29 14:10 -------- d-------- C:\Program Files\Windows NT
2006-07-29 14:10 -------- d-------- C:\Program Files\Unlocker
2006-07-29 14:10 -------- d-------- C:\Program Files\TaskSwitchXP
2006-07-29 14:10 -------- d-------- C:\Program Files\RegShot
2006-07-29 14:10 -------- d-------- C:\Program Files\MSN Gaming Zone
2006-07-29 14:10 -------- d-------- C:\Program Files\CCleaner
2006-07-29 14:10 -------- d-------- C:\Program Files\Attribute Changer
2006-05-18 14:27 16207872 --a------ C:\WINDOWS\RTHDCPL.exe

(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="\"C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe\""
"RTHDCPL"="RTHDCPL.EXE"
"Alcmtr"="ALCMTR.EXE"
"SynTPEnh"="C:\\Program Files\\Synaptics\\SynTP\\SynTPEnh.exe"
"LtMoh"="C:\\Program Files\\ltmoh\\Ltmoh.exe"
"AGRSMMSG"="AGRSMMSG.exe"
"avast!"="C:\\PROGRA~1\\ALWILS~1\\Avast4\\ashDisp.exe"
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"DiskeeperSystray"="\"C:\\Program Files\\Diskeeper Corporation\\Diskeeper\\DkIcon.exe\""
"NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"RemoteControl"="\"C:\\Program Files\\CyberLink\\PowerDVD\\PDVDServ.exe\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TaskSwitchXP"="C:\\Program Files\\TaskSwitchXP\\TaskSwitchXP.exe"
"Free Download Manager"="C:\\Program Files\\Free Download Manager\\fdm.exe -autorun"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDesktopCleanupWizard"=dword:00000001
"ForceClassicControlPanel"=dword:00000001
"NoRemoteRecursiveEvents"=dword:00000001
"MemCheckBoxInRunDlg"=dword:00000001
"DisableCAD"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001
"NoInternetOpenWith"=dword:00000001
"DisableCAD"=dword:00000001

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
"NoSharedDocuments"=dword:00000001
"ClearRecentDocsOnExit"=dword:00000001
"NoRecentDocsMenu"=dword:00000001
"NoRecentDocsHistory"=dword:00000001
"NoInstrumentation"=dword:00000001
"NoSMHelp"=dword:00000001
"NoSaveSettings"=dword:00000000
"DisableCAD"=dword:00000000
"NoLowDiskSpaceChecks"=dword:00000001

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"DisableCAD"=dword:00000001

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,00,01,00,00,00,00,00,00,00,04,00,00,02,03,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e2,02,\
00,00,04,00,00,40
"RestoredStateInfo"=hex:18,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e2,02,\
00,00,01,00,00,00

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TaskSwitchXP"="C:\\Program Files\\TaskSwitchXP\\TaskSwitchXP.exe"
"Free Download Manager"="C:\\Program Files\\Free Download Manager\\fdm.exe -autorun"

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Runonce]
"nlsf"=hex(2):63,6d,64,2e,65,78,65,20,2f,43,20,6d,6f,76,65,20,2f,59,20,22,25,\
53,79,73,74,65,6d,52,6f,6f,74,25,5c,53,79,73,74,65,6d,33,32,5c,73,79,73,73,\
65,74,75,62,2e,64,6c,6c,22,20,22,25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,53,\
79,73,74,65,6d,33,32,5c,73,79,73,73,65,74,75,70,2e,64,6c,6c,22,00
"nlhr"=hex(2):52,75,6e,44,6c,6c,33,32,2e,65,78,65,20,25,53,79,73,74,65,6d,52,\
6f,6f,74,25,5c,53,79,73,74,65,6d,33,32,5c,41,64,76,50,61,63,6b,2e,44,6c,6c,\
2c,4c,61,75,6e,63,68,49,4e,46,53,65,63,74,69,6f,6e,20,25,53,79,73,74,65,6d,\
52,6f,6f,74,25,5c,69,6e,66,5c,6e,6c,69,74,65,2e,69,6e,66,2c,43,00
"tscuninstall"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,65,6d,\
33,32,5c,74,73,63,75,70,67,72,64,2e,65,78,65,00

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
"NoSharedDocuments"=dword:00000001
"ClearRecentDocsOnExit"=dword:00000001
"NoRecentDocsMenu"=dword:00000001
"NoRecentDocsHistory"=dword:00000001
"NoInstrumentation"=dword:00000001
"NoSMHelp"=dword:00000001

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TaskSwitchXP"="C:\\Program Files\\TaskSwitchXP\\TaskSwitchXP.exe"
"Free Download Manager"="C:\\Program Files\\Free Download Manager\\fdm.exe -autorun"

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Runonce]
"nlsf"=hex(2):63,6d,64,2e,65,78,65,20,2f,43,20,6d,6f,76,65,20,2f,59,20,22,25,\
53,79,73,74,65,6d,52,6f,6f,74,25,5c,53,79,73,74,65,6d,33,32,5c,73,79,73,73,\
65,74,75,62,2e,64,6c,6c,22,20,22,25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,53,\
79,73,74,65,6d,33,32,5c,73,79,73,73,65,74,75,70,2e,64,6c,6c,22,00
"nlhr"=hex(2):52,75,6e,44,6c,6c,33,32,2e,65,78,65,20,25,53,79,73,74,65,6d,52,\
6f,6f,74,25,5c,53,79,73,74,65,6d,33,32,5c,41,64,76,50,61,63,6b,2e,44,6c,6c,\
2c,4c,61,75,6e,63,68,49,4e,46,53,65,63,74,69,6f,6e,20,25,53,79,73,74,65,6d,\
52,6f,6f,74,25,5c,69,6e,66,5c,6e,6c,69,74,65,2e,69,6e,66,2c,43,00
"tscuninstall"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,65,6d,\
33,32,5c,74,73,63,75,70,67,72,64,2e,65,78,65,00

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
"NoSharedDocuments"=dword:00000001
"ClearRecentDocsOnExit"=dword:00000001
"NoRecentDocsMenu"=dword:00000001
"NoRecentDocsHistory"=dword:00000001
"NoInstrumentation"=dword:00000001
"NoSMHelp"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""

Completion time: 06-08-18 21:41:20.71
ComboFix.txt

full patch windows xp...already remove spyware/virus by avast n ad-aware...
slow system login..after welcome screen...and about 5 minute++ later...the desktop appear...and the speed become normal...