Services.exe terminated with status code 1073741819 (disconnecting from internet)

[janoochen]

I've been having the following error around 10 minutes after I connect to the internet:

Services.exe terminated with status code 1073741819

I used Malwarebytes Anti-Malware to removed the following files:

C:\WINDOWS\system32|drivers\obg2b14.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\obg2b14
C:\WINDOWS\system32\drivers\kde821b.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kde821b
D:\Downloads\Designing\CRACLCS4\FOR ALL\keygen.exe
C:\Document and Settings\Alex.AUTOINSTALL.001\Local Settings\Temp\ie8.tmp
C:\Document and Settings\Alex.AUTOINSTALL.001\Local Settings\Temp\ie3.tmp

But I'm still having the problem

THE LOG:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 下午 06:12:21, on 2010/7/14
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
D:\Program Files\Launchy\Launchy.exe
C:\Documents and Settings\Alex.AUTOINSTALL.001\Local Settings\Application Data\Google\Update\1.2.183.23\GoogleCrashHandler.exe
C:\Program Files\Application Updater\ApplicationUpdater.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\msiexec.exe
C:\Documents and Settings\Alex.AUTOINSTALL.001\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Alex.AUTOINSTALL.001\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Alex.AUTOINSTALL.001\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Alex.AUTOINSTALL.001\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Alex.AUTOINSTALL.001\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\WINDOWS\system32\conime.exe
C:\PROGRA~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE
C:\DOCUME~1\ALEXAU~1.001\LOCALS~1\Temp\ie4B.tmp
C:\Documents and Settings\Alex.AUTOINSTALL.001\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Alex.AUTOINSTALL.001\桌面\HijackThis.exe

R3 - URLSearchHook: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - D:\Program Files\BitComet\tools\BitCometBHO_1.3.7.16.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - (no file)
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [ClamWin] "D:\Program Files\ClamWin\bin\ClamTray.exe" --logon
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SpyHunter Security Suite] C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter4.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Alex.AUTOINSTALL.001\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [HumanizedEnso] C:\Documents and Settings\Alex.AUTOINSTALL.001\Local Settings\Application Data\HumanizedEnso\Enso.exe --disable-monologue-boxes
O4 - HKUS\S-1-5-19\..\Run: [ctfmon.exe] ctfmon.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [ctfmon.exe] ctfmon.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] ctfmon.exe (User 'Default user')
O8 - Extra context menu item: &D&ownload &with BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\WEB2~1\Office12\REFIEBAR.DLL
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://D:\Program Files\BitComet\tools\BitCometBHO_1.3.7.16.dll/206 (file missing)
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll
O15 - ESC Trusted Zone: http://*.update.microsoft.com
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab56986.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{D3D04113-CB79-424B-A1DD-FA985A8F9675}: NameServer = 61.64.127.2 61.64.127.1
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Application Updater - Spigot, Inc. - C:\Program Files\Application Updater\ApplicationUpdater.exe
O23 - Service: Bonjour 服務 (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: ForceWare IP service (nSvcIp) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SpyHunter 4 Service - Enigma Software Group USA, LLC. - C:\PROGRA~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE
O23 - Service: wampapache - Apache Software Foundation - D:\wamp\bin\apache\apache2.2.11\bin\httpd.exe
O23 - Service: wampmysqld - Unknown owner - D:\wamp\bin\mysql\mysql5.1.36\bin\mysqld.exe

--
End of file - 8423 bytes


I'm using Windows XP

[janoochen]

I just ran ComboFix here's the log ( forgot to rename Combofix but I think I worked):


ComboFix 10-07-13.08 - Alex /07/14 星期三 19:02:12.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.2.950.886.1028.18.2047.1469 [GMT 8:00]
Position of Execution: C:\Documents and Settings\Alex.AUTOINSTALL.001\桌面\FIX\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Deleted files )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\drivers\obg2b14.sys
c:\windows\System32\drivers\ogf5a30.sys
D:\install.exe

Found to be infected C:\WINDOWS\system32\drivers\AmdK8.sys successful detoxification
From - Kitty had a snack :p Restoration of original file
Found to be infected C:\WINDOWS\system32\userinit.exe successful detoxification
From - C:\WINDOWS\system32\dllcache\userinit.exe Restoration of original file

.
((((((((((((((((((((((((((((((((((((((( Driver / Service )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_ogf5a30
-------\Service_ogf5a30


((((((((((((((((((((((((( 2010-06-14 至 2010-07-14 of new file )))))))))))))))))))))))))))))))
.

2010-07-14 10:02:11 . 2010-07-14 10:02:11 -------- d-----w- C:\Program Files\Enigma Software Group
2010-07-14 10:02:01 . 2010-07-14 10:19:23 -------- d-----w- C:\WINDOWS\4FC9DA9DF608454E8191D7EFFDCC5726.TMP
2010-07-14 10:01:58 . 2010-07-14 10:01:58 -------- d-----w- C:\Program Files\Common Files\Wise Installation Wizard
2010-07-14 06:29:28 . 2010-07-14 06:29:28 -------- d-----w- C:\Documents and Settings\Alex.AUTOINSTALL.001\Application Data\Malwarebytes
2010-07-14 06:29:27 . 2010-04-29 07:39:26 20952 ----a-w- C:\WINDOWS\system32\drivers\mbam.sys
2010-07-14 06:29:24 . 2010-04-29 07:39:38 38224 ----a-w- C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2010-07-14 06:29:20 . 2010-07-14 06:29:20 -------- d-----w- C:\Documents and Settings\All Users.WINDOWS\Application Data\Malwarebytes
2010-07-13 19:29:52 . 2004-08-03 08:48:06 23552 ----a-w- C:\WINDOWS\system32\stu2.exe
2010-06-29 23:38:23 . 2010-06-29 23:38:23 -------- d-----w- C:\Documents and Settings\Alex.AUTOINSTALL.001\vimperator
2010-06-29 23:33:33 . 2010-06-02 02:28:18 865792 ----a-w- C:\Documents and Settings\Alex.AUTOINSTALL.001\Application Data\Mozilla\Firefox\Profiles\pk10xjf3.default\extensions\{e3f6c2cc-d8db-498c-af6c-499fb211db97}\platform\WINNT_x86-msvc\components\pagespeed.dll
2010-06-29 12:48:28 . 2010-06-29 12:48:29 -------- d-----w- C:\Program Files\Bonjour
2010-06-29 12:48:13 . 2010-06-29 12:48:13 -------- d-----w- C:\Program Files\Common Files\Apple
2010-06-29 12:47:57 . 2010-06-29 12:47:58 -------- d-----w- C:\Program Files\Apple Software Update
2010-06-29 02:13:51 . 2010-06-29 02:13:51 -------- d-----w- C:\Documents and Settings\All Users.WINDOWS\Application Data\McAfee
2010-06-29 02:13:45 . 2010-06-29 02:13:46 1025992 ----a-w- C:\Documents and Settings\All Users.WINDOWS\Application Data\NOS\Adobe_Downloads\SecurityScan_Release.exe
2010-06-29 02:13:39 . 2010-06-29 06:24:57 -------- d-----w- C:\Documents and Settings\All Users.WINDOWS\Application Data\NOS
2010-06-22 02:54:12 . 2010-06-22 02:57:09 -------- d-----w- C:\~Ruby191
2010-06-21 14:59:21 . 2010-06-22 01:17:33 -------- d-----w- C:\Ruby191

.
(((((((((((((((((((((((((((((((((((((((( Three months ago modified files ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-14 11:05:50 . 2001-09-05 12:00:00 405012 ----a-w- C:\WINDOWS\system32\prfh0404.dat
2010-07-14 11:05:49 . 2009-11-11 10:36:03 4526 ----a-w- C:\WINDOWS\system32\PerfStringBackup.TMP
2010-07-14 11:05:49 . 2001-09-05 12:00:00 155496 ----a-w- C:\WINDOWS\system32\prfc0404.dat
2010-07-13 22:46:57 . 2009-11-13 16:22:33 -------- d-----w- C:\Documents and Settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy
2010-07-13 19:20:00 . 2009-11-17 14:51:12 -------- d-----w- C:\Documents and Settings\Alex.AUTOINSTALL.001\Application Data\FileZilla
2010-07-13 11:08:51 . 2009-12-05 17:17:51 -------- d-----w- C:\Documents and Settings\Alex.AUTOINSTALL.001\Application Data\Skype
2010-07-13 09:43:13 . 2009-11-11 10:25:51 -------- d-----w- C:\Documents and Settings\Alex.AUTOINSTALL.001\Application Data\Audacity
2010-07-12 14:21:19 . 2010-04-28 14:09:07 -------- d-----w- C:\Documents and Settings\Alex.AUTOINSTALL.001\Application Data\skypePM
2010-07-11 19:21:00 . 2009-11-11 10:30:07 7038096 ----a-w- C:\Documents and Settings\LocalService.NT AUTHORITY.001\Local Settings\Application Data\FontCache3.0.0.0.dat
2010-07-07 08:42:46 . 2010-06-02 16:03:37 -------- d-----w- C:\Documents and Settings\Alex.AUTOINSTALL.001\Application Data\vlc
2010-07-03 00:38:36 . 2009-11-13 23:07:19 -------- d-----w- C:\Documents and Settings\Alex.AUTOINSTALL.001\Application Data\gtk-2.0
2010-07-02 22:07:57 . 2009-11-17 15:45:07 1 ----a-w- C:\Documents and Settings\Alex.AUTOINSTALL.001\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-06-30 04:03:37 . 2010-02-18 06:49:26 -------- d-----w- C:\Documents and Settings\Alex.AUTOINSTALL.001\Application Data\Launchy
2010-06-29 12:15:56 . 2009-09-16 18:26:15 -------- d-----w- C:\Program Files\Yahoo!
2010-06-24 20:24:51 . 2009-09-16 18:21:03 -------- d-----w- C:\Program Files\Microsoft Silverlight
2010-06-24 20:08:36 . 2009-11-23 04:28:42 37032 ---ha-w- C:\WINDOWS\system32\mlfcache.dat
2010-06-21 22:05:42 . 2010-06-13 10:00:53 -------- d-----w- C:\Program Files\Norton Security Scan
2010-06-21 22:05:42 . 2010-04-19 16:10:03 -------- d-----w- C:\Documents and Settings\All Users.WINDOWS\Application Data\Norton
2010-06-04 04:29:12 . 2010-06-04 04:29:12 71992 ----a-w- C:\Documents and Settings\All Users.WINDOWS\Application Data\Apple Computer\Installer Cache\Safari 5.33.16.0\SetupAdmin.exe
2010-05-18 08:35:16 . 2010-05-18 08:35:16 91424 ----a-w- C:\WINDOWS\system32\dnssd.dll
2010-05-18 08:35:16 . 2010-05-18 08:35:16 107808 ----a-w- C:\WINDOWS\system32\dns-sd.exe
2010-04-28 14:09:07 . 2010-04-28 14:09:07 56 ---ha-w- C:\WINDOWS\system32\ezsidmv.dat
.

((((((((((((((((((((((((((((((((((((( Important point of entry ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
Note * empty and the legal default login will not be displayed
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="C:\Documents and Settings\Alex.AUTOINSTALL.001\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-11-11 07:28:52 135664]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 08:44:34 3883856]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-12-26 07:40:40 39408]
"HumanizedEnso"="C:\Documents and Settings\Alex.AUTOINSTALL.001\Local Settings\Application Data\HumanizedEnso\Enso.exe" [2008-01-14 20:42:04 117232]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 08:47:54 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" [2004-08-03 06:32:00 208952]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 08:48:06 455168]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 08:48:06 455168]
"RTHDCPL"="RTHDCPL.EXE" [2008-07-31 07:05:30 16806912]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-03 22:46:00 13529088]
"nwiz"="nwiz.exe" [2008-05-03 22:46:00 1630208]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-02 20:08:38 35696]
"Adobe ARM"="C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 04:08:30 935288]
"SunJavaUpdateSched"="C:\Program Files\Java\jre6\bin\jusched.exe" [2009-11-22 07:51:59 149280]
"ClamWin"="D:\Program Files\ClamWin\bin\ClamTray.exe" [2010-05-24 06:10:14 86016]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-03 22:46:00 86016]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="ctfmon.exe" [2004-08-03 08:47:54 15360]

C:\Documents and Settings\All Users.WINDOWS\「開始」功能表\程式集\啟動\
autohotkeys.lnk - D:\Program Files\AutoHotkey\Scripts\autohotkeys.ahk [2010-1-27 950]
Launchy.lnk - D:\Program Files\Launchy\Launchy.exe [2010-2-18 286720]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitComet]
2009-07-31 09:05:32 2674488 ----a-w- D:\Program Files\BitComet\BitComet.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ClamWin]
2010-05-24 06:10:14 86016 ----a-w- D:\Program Files\ClamWin\bin\ClamTray.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"D:\\Program Files\\Opera\\opera.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"D:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"D:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"4451:TCP"= 4451:TCP:aakfmuie
"27301:TCP"= 27301:TCP:BitComet 27301 TCP
"27301:UDP"= 27301:UDP:BitComet 27301 UDP

R2 Application Updater;Application Updater;C:\Program Files\Application Updater\ApplicationUpdater.exe [2010/1/8 上午 12:51:02 380928]
R2 vnccom;vnccom;C:\WINDOWS\system32\drivers\vnccom.SYS [2010/4/6 上午 10:08:48 6016]
R3 WinMTBus;WinMount Bus;C:\WINDOWS\system32\drivers\WinMTBus.sys [2009/11/11 下午 04:21:52 196224]
S2 cusbw;Universal Helper;C:\WINDOWS\system32\svchost.exe -k netsvcs [2004/8/3 下午 04:48:06 14336]
S2 lruxzb;Manager Support;C:\WINDOWS\system32\svchost.exe -k netsvcs [2004/8/3 下午 04:48:06 14336]
S2 mfoshacx;System Time;C:\WINDOWS\system32\svchost.exe -k netsvcs [2004/8/3 下午 04:48:06 14336]
S2 ntpbf;Security Monitor;C:\WINDOWS\system32\svchost.exe -k netsvcs [2004/8/3 下午 04:48:06 14336]
S2 oapusdnjp;Support Universal;C:\WINDOWS\system32\svchost.exe -k netsvcs [2004/8/3 下午 04:48:06 14336]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
cusbw
oapusdnjp
mfoshacx
ntpbf
lruxzb
.
'Scheduled Tasks' folder contents

2010-07-05 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 04:34:12 . 2008-07-30 04:34:12]

2010-07-14 C:\WINDOWS\Tasks\Google Software Updater.job
- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-12-26 07:40:37 . 2010-02-02 18:54:17]

2010-07-13 C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-861567501-1220945662-725345543-1003Core.job
- C:\Documents and Settings\Alex.AUTOINSTALL.001\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-11-11 07:28:52 . 2009-11-11 07:28:52]

2010-07-14 C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-861567501-1220945662-725345543-1003UA.job
- C:\Documents and Settings\Alex.AUTOINSTALL.001\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-11-11 07:28:52 . 2009-11-11 07:28:52]
.
.
------- Scanning suits -------
.
IE: &D&ownload &with BitComet - D:\Program Files\BitComet\BitComet.exe/AddLink.htm
IE: &D&ownload all video with BitComet - D:\Program Files\BitComet\BitComet.exe/AddVideo.htm
IE: &D&ownload all with BitComet - D:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
LSP: %SYSTEMROOT%\system32\nvLsp.dll
FF - ProfilePath - C:\Documents and Settings\Alex.AUTOINSTALL.001\Application Data\Mozilla\Firefox\Profiles\pk10xjf3.default\
FF - component: C:\Documents and Settings\Alex.AUTOINSTALL.001\Application Data\Mozilla\Firefox\Profiles\pk10xjf3.default\extensions\{e3f6c2cc-d8db-498c-af6c-499fb211db97}\platform\WINNT_x86-msvc\components\pagespeed.dll
FF - plugin: C:\Documents and Settings\Alex.AUTOINSTALL.001\Local Settings\Application Data\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: C:\Program Files\Google\Google Updater\2.4.1851.5542\npCIDetect14.dll
FF - plugin: D:\Program Files\Opera\program\plugins\npdsplay.dll
FF - plugin: D:\Program Files\Opera\program\plugins\npqtplugin.dll
FF - plugin: D:\Program Files\Opera\program\plugins\npqtplugin2.dll
FF - plugin: D:\Program Files\Opera\program\plugins\npqtplugin3.dll
FF - plugin: D:\Program Files\Opera\program\plugins\npqtplugin4.dll
FF - plugin: D:\Program Files\Opera\program\plugins\npqtplugin5.dll
FF - plugin: D:\Program Files\Opera\program\plugins\npqtplugin6.dll
FF - plugin: D:\Program Files\Opera\program\plugins\npwmsdrm.dll

---- Firefox profile ----
D:\Program Files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
D:\Program Files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
D:\Program Files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
D:\Program Files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
D:\Program Files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
D:\Program Files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
D:\Program Files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
D:\Program Files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
D:\Program Files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
D:\Program Files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
D:\Program Files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
D:\Program Files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
D:\Program Files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
D:\Program Files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
D:\Program Files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
D:\Program Files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
D:\Program Files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
D:\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
D:\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
D:\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
D:\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
D:\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
D:\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
D:\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
D:\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - ORPHANS REMOVED - - - -

Toolbar-{B922D405-6D13-4A2B-AE89-08A030DA4402} - (no file)

(sorry the log was in Chinese so i translated it into English)