ace16win.dll & msole32.exe

[TigerBomb]

Kapersky:
Monday, October 29, 2007 8:06:18 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 30/10/2007
Kaspersky Anti-Virus database records: 448495


Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true

Scan Target My Computer
C:\
D:\

Scan Statistics
Total number of scanned objects 62270
Number of viruses found 7
Number of infected objects 16
Number of suspicious objects 0
Duration of the scan process 00:57:58

Infected Object Name Virus Name Last Action
C:\Documents and Settings\All Users\Application Data\QSLLPSVCShare Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\2007-10-29_Log.ALUSchedulerSvc.LiveUpdate Object is locked skipped

C:\Documents and Settings\**********\Application Data\Mozilla\Firefox\Profiles\omlbxlnj.default\cert8.db Object is locked skipped

C:\Documents and Settings\**********\Application Data\Mozilla\Firefox\Profiles\omlbxlnj.default\history.dat Object is locked skipped

C:\Documents and Settings\**********\Application Data\Mozilla\Firefox\Profiles\omlbxlnj.default\key3.db Object is locked skipped

C:\Documents and Settings\**********\Application Data\Mozilla\Firefox\Profiles\omlbxlnj.default\parent.lock Object is locked skipped

C:\Documents and Settings\**********\Application Data\Mozilla\Firefox\Profiles\omlbxlnj.default\search.sqlite Object is locked skipped

C:\Documents and Settings\**********\Application Data\Mozilla\Firefox\Profiles\omlbxlnj.default\urlclassifier2.sqlite Object is locked skipped

C:\Documents and Settings\**********\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\**********\Desktop\REPAIR\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped

C:\Documents and Settings\**********\Desktop\REPAIR\SmitfraudFix.exe/data.rar/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped

C:\Documents and Settings\**********\Desktop\REPAIR\SmitfraudFix.exe/data.rar Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped

C:\Documents and Settings\**********\Desktop\REPAIR\SmitfraudFix.exe RarSFX: infected - 2 skipped

C:\Documents and Settings\**********\Desktop\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped

C:\Documents and Settings\**********\Desktop\SmitfraudFix.zip/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped

C:\Documents and Settings\**********\Desktop\SmitfraudFix.zip ZIP: infected - 1 skipped

C:\Documents and Settings\**********\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\**********\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\**********\Local Settings\Application Data\Mozilla\Firefox\Profiles\omlbxlnj.default\Cache\_CACHE_001_ Object is locked skipped

C:\Documents and Settings\**********\Local Settings\Application Data\Mozilla\Firefox\Profiles\omlbxlnj.default\Cache\_CACHE_002_ Object is locked skipped

C:\Documents and Settings\**********\Local Settings\Application Data\Mozilla\Firefox\Profiles\omlbxlnj.default\Cache\_CACHE_003_ Object is locked skipped

C:\Documents and Settings\**********\Local Settings\Application Data\Mozilla\Firefox\Profiles\omlbxlnj.default\Cache\_CACHE_MAP_ Object is locked skipped

C:\Documents and Settings\**********\Local Settings\History\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\**********\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\**********\My Documents\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped

C:\Documents and Settings\**********\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\**********\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Data\settings.dat Object is locked skipped

C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped

C:\Program Files\Webroot\Spy Sweeper\Masters\masters.bak Object is locked skipped

C:\Program Files\Webroot\Spy Sweeper\Masters\Masters.const Object is locked skipped

C:\Program Files\Webroot\Spy Sweeper\Masters\masters.mst Object is locked skipped

C:\Program Files\Webroot\Spy Sweeper\Masters.base Object is locked skipped

C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

C:\WINDOWS\frexup3.exe/stream/data0002 Infected: not-a-virus:Downloader.Win32.Agent.q skipped

C:\WINDOWS\frexup3.exe/stream/data0003 Infected: not-a-virus:AdWare.Win32.AdBand.a skipped

C:\WINDOWS\frexup3.exe/stream Infected: not-a-virus:AdWare.Win32.AdBand.a skipped

C:\WINDOWS\frexup3.exe NSIS: infected - 3 skipped

C:\WINDOWS\plite731.exe Infected: not-a-virus:AdWare.Win32.Agent.lv skipped

C:\WINDOWS\SchedLgU.Txt Object is locked skipped

C:\WINDOWS\SoftwareDistribution\EventCache\{844AA32B-1EF2-41FF-87BA-D68CAD0B71C0}.bin Object is locked skipped

C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped

C:\WINDOWS\Sti_Trace.log Object is locked skipped

C:\WINDOWS\system32\aivskurq.dll Infected: Trojan-Downloader.Win32.VB.bpt skipped

C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped

C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped

C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\DEFAULT Object is locked skipped

C:\WINDOWS\system32\config\default.LOG Object is locked skipped

C:\WINDOWS\system32\config\SAM Object is locked skipped

C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped

C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\SECURITY Object is locked skipped

C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped

C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped

C:\WINDOWS\system32\config\software.LOG Object is locked skipped

C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\SYSTEM Object is locked skipped

C:\WINDOWS\system32\config\system.LOG Object is locked skipped

C:\WINDOWS\system32\dpqaqlqx.bin Object is locked skipped

C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped

C:\WINDOWS\system32\h323log.txt Object is locked skipped

C:\WINDOWS\system32\ldcore.dll Infected: Trojan-Downloader.Win32.Small.gkh skipped

C:\WINDOWS\system32\vvgeowbv.exe Infected: not-virus:Hoax.Win32.Renos.kj skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped

C:\WINDOWS\wiadebug.log Object is locked skipped

C:\WINDOWS\wiaservc.log Object is locked skipped

C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.


HJT
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:12:28 PM, on 10/29/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\system32\vvgeowbv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\vvgeowbv.exe,C:\WINDOWS\system32\userinit.exe
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [MaxtorOneTouch] C:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe
O4 - HKLM\..\Run: [MXOBG] C:\Documents and Settings\**********\Local Settings\Temp\{231F68F4-70E4-41A6-BEDA-7E7934169B54}\MXOALDR.EXE
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe"
O4 - HKLM\..\Run: [Lexmark 1200 Series] "C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common

Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [{C9-98-83-32-ZN}] C:\Documents and Settings\**********\Local Settings\Temp\T0CHD001.exe CHD001
O4 - HKLM\..\Run: [SpyGuardPro] "C:\Program Files\SpyGuardPro\pgs.exe"
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [UserFaultCheck] C:\WINDOWS\system32\dumprep 0 -u
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Octoshape Streaming Services] "C:\Program Files\Octoshape Streaming Services\**********\OctoshapeClient.exe" -inv:bootrun
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKCU\..\Run: [ArtChk] C:\WINDOWS\system32\artchker.exe
O4 - HKCU\..\Run: [ISMPack6] "C:\Program Files\ISM2\ISMPack6.exe"
O4 - S-1-5-19 Startup: TA_Start.lnk = C:\Documents and Settings\**********\Local Settings\Temp\T0CHD001.exe (User 'LOCAL SERVICE')
O4 - S-1-5-18 Startup: TA_Start.lnk = C:\Documents and Settings\**********\Local Settings\Temp\T0CHD001.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: TA_Start.lnk = C:\Documents and Settings\**********\Local Settings\Temp\T0CHD001.exe (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: TA_Start.lnk = C:\Documents and Settings\**********\Local Settings\Temp\T0CHD001.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O15 - Trusted Zone: *.sxload.net (HKLM)
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english...an_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

--
End of file - 9396 bytes

[katana]

Hello and welcome to the forums

My name is Katana and I will be helping you to remove any infection(s) that you may have.

Please observe these rules while we work:
1. If you don't know, stop and ask! Don't keep going on.
2. Please reply to this thread. Do not start a new topic.
3. Please continue to respond until I give you the "All Clear"
(Just because you can't see a problem doesn't mean it isn't there)

If you can do those three things, everything should go smoothly :D

Download and Run ComboFix

• Download Combofix from one of the two links below :
  
  http://download.bleepingcomputer.com/sUBs/ComboFix.exe
  http://www.techsupportforum.com/sect...s/ComboFix.exe
  
• Then double click combofix.exe & follow the prompts.
• When finished, it will produce a log for you. Post that log in your next reply

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

[TigerBomb]

Hi Katana. Thanks for helping, and for your time.


ComboFix 07-11-01.1 - ********** 2007-11-01 18:59:42.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.150 [GMT -7:00]
Running from: C:\Documents and Settings\**********\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data.\salesmonitor
C:\Documents and Settings\**********\Application Data.\AVSystemCare
C:\Documents and Settings\**********\Application Data.\AVSystemCare\avtasks.dat
C:\Documents and Settings\**********\Application Data.\AVSystemCare\Logs\av.log
C:\Documents and Settings\**********\Application Data.\AVSystemCare\Logs\ga6Support.log
C:\Documents and Settings\**********\ResErrors.log
C:\Documents and Settings\**********\Start Menu\Programs\Startup\TA_Start.lnk
C:\Documents and Settings\LocalService\Start Menu\Programs\Startup\ta_start.lnk
C:\Program Files\3721
C:\Program Files\3721\assist\asbar.dll
C:\Program Files\3721\helper.dll
C:\Program Files\Common Files\Yazzle1549OinUninstaller.exe
C:\Program Files\e-zshopper
C:\Program Files\e-zshopper\BarLcher.dll
C:\Program Files\poolsv
C:\Program Files\poolsv\is67389.exe
C:\Program Files\poolsv\k11u72.exe
C:\Program Files\poolsv\svhost.exe
C:\Program Files\poolsv\WinAntiSpyware2007FreeInstall.exe
C:\Program Files\poolsv\wr-1-0000077.exe
C:\Program Files\poolsv\YazzleBundle-1549.exe
C:\temp\0b9
C:\temp\0b9\tmpTF.log
C:\temp\17o7
C:\Temp\1cb
C:\Temp\1cb\syscheck.log
C:\Temp\fCOe
C:\Temp\fCOe\tOasF.log
C:\Temp\fse
C:\UGA6P
C:\WINDOWS\764.exe
C:\WINDOWS\7search.dll
C:\WINDOWS\adbar.dll
C:\WINDOWS\cbinst$.exe
C:\WINDOWS\daxtime.dll
C:\WINDOWS\dp0.dll
C:\WINDOWS\eventlowg.dll
C:\WINDOWS\fhfmm-Uninstaller.exe
C:\WINDOWS\fhfmm.exe
C:\WINDOWS\flt.dll
C:\WINDOWS\ie_32.exe
C:\WINDOWS\iexplorr23.dll
C:\WINDOWS\jd2002.dll
C:\WINDOWS\kkcomp$.exe
C:\WINDOWS\kkcomp.dll
C:\WINDOWS\kkcomp.exe
C:\WINDOWS\kvnab$.exe
C:\WINDOWS\kvnab.dll
C:\WINDOWS\kvnab.exe
C:\WINDOWS\liqad$.exe
C:\WINDOWS\liqad.dll
C:\WINDOWS\liqad.exe
C:\WINDOWS\liqui-Uninstaller.exe
C:\WINDOWS\liqui.dll
C:\WINDOWS\liqui.exe
C:\WINDOWS\ngd.dll
C:\WINDOWS\pbar.dll
C:\WINDOWS\pbsysie.dll
C:\WINDOWS\settn.dll
C:\WINDOWS\spredirect.dll
C:\WINDOWS\system32\abeeg.bak1
C:\WINDOWS\system32\abeeg.ini
C:\WINDOWS\system32\awvvv.dll
C:\WINDOWS\system32\bccdd.ini
C:\WINDOWS\system32\bccdd.ini2
C:\WINDOWS\system32\bccdd.tmp
C:\WINDOWS\system32\d3
C:\WINDOWS\system32\ddaba.dll
C:\WINDOWS\system32\ddcyx.dll
C:\WINDOWS\system32\dirglcoi.ini
C:\WINDOWS\system32\drivers\blank.gif
C:\WINDOWS\system32\drivers\box_1.gif
C:\WINDOWS\system32\drivers\box_2.gif
C:\WINDOWS\system32\drivers\box_3.gif
C:\WINDOWS\system32\drivers\button_buynow.gif
C:\WINDOWS\system32\drivers\button_freescan.gif
C:\WINDOWS\system32\drivers\cell_bg.gif
C:\WINDOWS\system32\drivers\cell_footer.gif
C:\WINDOWS\system32\drivers\cell_header_block.gif
C:\WINDOWS\system32\drivers\cell_header_remove.gif
C:\WINDOWS\system32\drivers\cell_header_scan.gif
C:\WINDOWS\system32\drivers\detect.htm
C:\WINDOWS\system32\drivers\download_box.gif
C:\WINDOWS\system32\drivers\download_btn.jpg
C:\WINDOWS\system32\drivers\download_now_btn.gif
C:\WINDOWS\system32\drivers\footer_back.jpg
C:\WINDOWS\system32\drivers\header_1.gif
C:\WINDOWS\system32\drivers\header_2.gif
C:\WINDOWS\system32\drivers\header_3.gif
C:\WINDOWS\system32\drivers\header_4.gif
C:\WINDOWS\system32\drivers\header_red_bg.gif
C:\WINDOWS\system32\drivers\header_red_free_scan.gif
C:\WINDOWS\system32\drivers\header_red_free_scan_bg.gif
C:\WINDOWS\system32\drivers\header_red_protect_your_pc.gif
C:\WINDOWS\system32\drivers\infected.gif
C:\WINDOWS\system32\drivers\main_back.gif
C:\WINDOWS\system32\drivers\perfect_cleaner_box.jpg
C:\WINDOWS\system32\drivers\product_1_header.gif
C:\WINDOWS\system32\drivers\product_1_name_small.gif
C:\WINDOWS\system32\drivers\product_2_header.gif
C:\WINDOWS\system32\drivers\product_2_name_small.gif
C:\WINDOWS\system32\drivers\product_3_header.gif
C:\WINDOWS\system32\drivers\product_3_name_small.gif
C:\WINDOWS\system32\drivers\product_features.gif
C:\WINDOWS\system32\drivers\pt.htm
C:\WINDOWS\system32\drivers\rating.gif
C:\WINDOWS\system32\drivers\s_detect.htm
C:\WINDOWS\system32\drivers\screenshot.jpg
C:\WINDOWS\system32\drivers\sep_hor.gif
C:\WINDOWS\system32\drivers\sep_vert.gif
C:\WINDOWS\system32\drivers\shadow.jpg
C:\WINDOWS\system32\drivers\shadow_bg.gif
C:\WINDOWS\system32\drivers\spacer.gif
C:\WINDOWS\system32\drivers\spy_away_box.jpg
C:\WINDOWS\system32\drivers\star.gif
C:\WINDOWS\system32\drivers\star_gray.gif
C:\WINDOWS\system32\drivers\star_gray_small.gif
C:\WINDOWS\system32\drivers\star_small.gif
C:\WINDOWS\system32\drivers\style.css
C:\WINDOWS\system32\drivers\v.gif
C:\WINDOWS\system32\drivers\warning_icon.gif
C:\WINDOWS\system32\drivers\win_logo.gif
C:\WINDOWS\system32\drivers\x.gif
C:\WINDOWS\system32\f02WtR
C:\WINDOWS\system32\f22
C:\WINDOWS\system32\fhkmp.ini
C:\WINDOWS\system32\gqauiuae.dll
C:\WINDOWS\system32\ijllm.ini
C:\WINDOWS\system32\ijllm.ini2
C:\WINDOWS\system32\ijllm.tmp
C:\WINDOWS\system32\ioclgrid.dll
C:\WINDOWS\system32\jkhfd.dll
C:\WINDOWS\system32\jkhhe.dll
C:\WINDOWS\system32\jkkjg.dll
C:\WINDOWS\system32\jkkjh.dll
C:\WINDOWS\system32\katzppd.exe
C:\WINDOWS\system32\ldinfo.ldr
C:\WINDOWS\system32\mljjg.dll
C:\WINDOWS\system32\mljji.dll
C:\WINDOWS\system32\mllmk.dll
C:\WINDOWS\system32\opnmlkk.dll
C:\WINDOWS\system32\oTt06e
C:\WINDOWS\system32\oTt08e
C:\WINDOWS\system32\p8
C:\WINDOWS\system32\pac.txt
C:\WINDOWS\system32\pmkhf.dll
C:\WINDOWS\system32\pmkhg.dll
C:\WINDOWS\system32\prutv.tmp
C:\WINDOWS\system32\qttss.ini
C:\WINDOWS\system32\qttss.ini2
C:\WINDOWS\system32\qttss.tmp
C:\WINDOWS\system32\s2
C:\WINDOWS\system32\ssqrq.dll
C:\WINDOWS\system32\T3
C:\WINDOWS\system32\T4
C:\WINDOWS\system32\T6
C:\WINDOWS\system32\T7
C:\WINDOWS\system32\ttstv.ini
C:\WINDOWS\system32\ttstv.ini2
C:\WINDOWS\system32\ttstv.tmp
C:\WINDOWS\system32\u2
C:\WINDOWS\system32\v1
C:\WINDOWS\system32\vturp.dll
C:\WINDOWS\system32\vturr.dll
C:\WINDOWS\system32\vxddsk.exe
C:\WINDOWS\system32\wlfriyka.exe
C:\WINDOWS\system32\wml.exe
C:\WINDOWS\system32\yccdd.ini
C:\WINDOWS\system32\yccdd.ini2
C:\WINDOWS\system32\yccdd.tmp
C:\WINDOWS\vxddsk.exe
C:\WINDOWS\wbeCheck.exe
C:\WINDOWS\wbeInst$.exe
C:\WINDOWS\winshow.exe
C:\WINDOWS\wml.exe
C:\WINDOWS\wr.txt
C:\WINDOWS\xadbrk.dll
C:\WINDOWS\xadbrk.exe
C:\WINDOWS\xadbrk_.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_DOMAINSERVICE
-------\DomainService


((((((((((((((((((((((((( Files Created from 2007-10-02 to 2007-11-02 )))))))))))))))))))))))))))))))
.

2007-11-01 18:55 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-10-29 18:47 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2007-10-29 18:47 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-10-28 01:40 5,564 --a------ C:\WINDOWS\system32\tmp.reg
2007-10-28 01:38 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2007-10-28 01:38 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2007-10-28 01:38 53,248 --a------ C:\WINDOWS\system32\Process.exe
2007-10-28 01:38 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2007-10-28 01:38 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2007-10-28 01:26 <DIR> d-------- C:\Program Files\Trend Micro
2007-10-28 00:53 <DIR> d-------- C:\Documents and Settings\NetworkService\Application Data\Webroot
2007-10-28 00:53 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Jasc Software Inc
2007-10-28 00:53 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Intel
2007-10-28 00:53 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Gtek
2007-10-26 21:30 <DIR> d-------- C:\WINDOWS\system32\acespy
2007-10-26 21:30 4 --a------ C:\WINDOWS\system32\stfv.bin
2007-10-26 21:29 <DIR> d-------- C:\Documents and Settings\**********\Application Data\SpyGuardPro
2007-10-26 21:26 12 --a------ C:\WINDOWS\system32\dpqaqlqx.bin
2007-10-26 21:25 123,908 --a------ C:\WINDOWS\system32\vvgeowbv.exe
2007-10-26 21:25 41 --a------ C:\WINDOWS\plite731_uninstaller_.bat
2007-10-26 21:24 294,668 --a------ C:\WINDOWS\frexup3.exe
2007-10-26 21:22 425,984 --a------ C:\WINDOWS\system32\bkinvmfy.dll
2007-10-26 21:22 118,784 --a------ C:\WINDOWS\system32\artchker.exe
2007-10-26 21:22 45,056 --a------ C:\WINDOWS\system32\katzpdydj.exe
2007-10-26 21:22 44,922 --a------ C:\WINDOWS\system32\IKatzuUninstall.exe
2007-10-21 13:47 20,280 --a------ C:\WINDOWS\system32\drivers\SSFS0BB9.sys
2007-10-12 14:39 <DIR> d-------- C:\Documents and Settings\**********\Application Data\Quantitative Micro Software
2007-10-12 14:30 <DIR> d-------- C:\Program Files\EViews4 SV
2007-10-11 15:17 233,472 --a------ C:\WINDOWS\system32\REX Shared Library.dll
2007-10-11 12:33 <DIR> d-------- C:\Program Files\Alcohol Soft
2007-10-11 12:31 685,816 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2007-10-09 15:37 584,192 --------- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2007-10-05 20:22 1,777,664 --a------ C:\WINDOWS\system32\gdiplus.dll
2007-10-04 13:34 <DIR> d-------- C:\Documents and Settings\**********\Application Data\Ableton
2007-10-04 13:34 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Ableton
2007-10-04 13:27 <DIR> d-------- C:\Program Files\Ableton

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-02 01:27 43,454 ----a-w C:\Documents and Settings\**********\Application Data\wklnhst.dat
2007-10-31 22:58 --------- d-----w C:\Program Files\VstPlugins
2007-10-27 05:42 164 ----a-w C:\install.dat
2007-10-12 21:30 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-10-11 20:30 --------- d-----w C:\Program Files\Octoshape Streaming Services
2007-10-11 19:24 --------- d-----w C:\Documents and Settings\All Users\Application Data\Propellerhead Software
2007-10-11 19:23 --------- d-----w C:\Documents and Settings\**********\Application Data\Propellerhead Software
2007-10-06 03:26 --------- d-----w C:\Program Files\Image-Line
2007-10-01 23:40 1,526,072 ----a-w C:\WINDOWS\WRSetup.dll
2007-10-01 23:24 23,864 ----a-w C:\WINDOWS\system32\drivers\sskbfd.sys
2007-10-01 23:24 21,816 ----a-w C:\WINDOWS\system32\drivers\sshrmd.sys
2007-10-01 23:24 163,640 ----a-w C:\WINDOWS\system32\drivers\ssidrv.sys
2007-10-01 00:09 --------- d-----w C:\Program Files\SEGA
2007-09-17 06:12 --------- d-----w C:\Program Files\Exact Audio Copy
2007-09-14 23:10 --------- d-----w C:\Program Files\MSXML 4.0
2007-06-24 03:26 58,744 ----a-w C:\Documents and Settings\**********\Application Data\GDIPFONTCACHEV1.DAT
2007-04-18 20:23:44 1,399,206 --sha-w C:\WINDOWS\system32\sstwa.bak1
2007-04-20 02:06:03 1,411,788 --sha-w C:\WINDOWS\system32\sstwa.bak2
2007-04-20 05:52:20 1,413,247 --sha-w C:\WINDOWS\system32\sstwa.ini2
.

((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
----a-w 57,344 2005-09-09 08:18:10 C:\Program Files\Adobe\Photoshop Elements 4.0\bak\apdproxy.exe

----a-w 155,648 2004-09-13 21:33:20 C:\Program Files\Apoint\bak\Apoint.exe

----a-w 81,920 2004-07-27 21:50:18 C:\Program Files\Common Files\InstallShield\UpdateService\bak\issch.exe

----a-w 221,184 2004-07-27 21:50:42 C:\Program Files\Common Files\InstallShield\UpdateService\bak\ISUSPM.exe

----a-w 53,248 2005-02-23 21:19:56 C:\Program Files\CyberLink\PowerDVD\bak\DVDLauncher.exe

----a-w 290,816 2004-04-12 01:15:14 C:\Program Files\Dell\Media Experience\bak\PCMService.exe

----a-w 606,208 2005-03-04 16:26:08 C:\Program Files\Dell\QuickSet\bak\quickset.exe

----a-w 49,152 2005-02-17 07:11:42 C:\Program Files\Hewlett-Packard\HP Software Update\bak\HPWuSchd2.exe

----a-w 241,664 2003-12-22 15:38:42 C:\Program Files\HP\hpcoretech\bak\hpcmpmgr.exe

----a-w 385,024 2004-10-30 19:59:54 C:\Program Files\Intel\Wireless\Bin\bak\ifrmewrk.exe

----a-w 278,528 2006-02-23 22:45:20 C:\Program Files\iTunes\bak\iTunesHelper.exe

----a-w 32,881 2003-11-19 22:48:14 C:\Program Files\Java\j2re1.4.2_03\bin\bak\jusched.exe

----a-w 57,344 2006-03-16 07:07:30 C:\Program Files\Lexmark 1200 Series\bak\lxczbmgr.exe

----a-w 823,296 2004-12-22 15:21:48 C:\Program Files\Maxtor\OneTouch\Utils\bak\Onetouch.exe

----a-w 1,694,208 2004-10-13 16:24:37 C:\Program Files\Messenger\bak\msmsgs.exe

----a-w 155,648 2006-05-04 03:50:11 C:\Program Files\QuickTime\bak\qttask.exe

----a-w 33,792 2004-12-20 18:41:22 C:\Program Files\Winamp\bak\winampa.exe
----a-w 35,328 2007-04-25 15:44:52 C:\Program Files\Winamp\winampa.exe

----a-w 126,976 2005-02-15 20:02:56 C:\WINDOWS\system32\bak\hkcmd.exe

----a-w 155,648 2005-02-15 20:02:58 C:\WINDOWS\system32\bak\igfxtray.exe

----a-w 127,035 2004-12-06 06:05:00 C:\WINDOWS\system32\dla\bak\tfswctrl.exe

----a-w 172,032 2004-03-04 15:46:24 C:\WINDOWS\system32\spool\drivers\w32x86\3\bak\hpztsb10.exe

.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{00000000-d9e3-4bc6-a0bd-3d0ca4be5271}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{00000012-890e-4aac-afd9-eff6954a34dd}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{029e02f0-a0e5-4b19-b958-7bf2db29fb13}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06dfedaa-6196-11d5-bfc8-00508b4a487d}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1adbcce8-cf84-441e-9b38-afc7a19c06a4}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2d7cb618-cc1c-4126-a7e3-f5b12d3bcf71}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{51641ef3-8a7a-4d84-8659-b0911e947cc8}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{53C330D6-A4AB-419B-B45D-FD4411C1FEF4}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{54645654-2225-4455-44A1-9F4543D34546}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{669695bc-a811-4a9d-8cdf-ba8c795f261e}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6abc861a-31e7-4d91-b43b-d3c98f22a5c0}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{944864a5-3916-46e2-96a9-a2e84f3f1208}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{a4a435cf-3583-11d4-91bd-0048546a1450}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A6E432B4-D4C2-43B3-BF55-C364F8F7362A}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{b8875bfe-b021-11d4-bfa8-00508b8e9bd3}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{bb936323-19fa-4521-ba29-eca6a121bc78}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c2680e10-1655-4a0e-87f8-4259325a84b7}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c4ca6559-2cf1-48b6-96b2-8340a06fd129}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c5af2622-8c75-4dfb-9693-23ab7686a456}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ca1d1b05-9c66-11d5-a009-000103c1e50b}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{d8efadf1-9009-11d6-8c73-608c5dc19089}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{e9147a0a-a866-4214-b47c-da821891240f}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{e9306072-417e-43e3-81d5-369490beef7c}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EA5159DF-E413-4878-8AE2-D921D41BB942}]
2007-10-26 21:22 425984 --a------ C:\WINDOWS\system32\bkinvmfy.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F302FD2A-F080-476C-9F16-E195BABD6FC7}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" []
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" []
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" []
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" []
"PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" []
"Dell QuickSet"="C:\Program Files\Dell\QuickSet\quickset.exe" []
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" []
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" []
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" []
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" []
"MaxtorOneTouch"="C:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe" []
"MXOBG"="C:\Documents and Settings\**********\Local Settings\Temp\{231F68F4-70E4-41A6-BEDA-7E7934169B54}\MXOALDR.EXE" []
"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe" []
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" []
"HP Software Update"="C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" []
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" []
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" []
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe" []
"Lexmark 1200 Series"="C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe" []
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 18:30]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-04-25 08:44]
"{C9-98-83-32-ZN}"="C:\Documents and Settings\**********\Local Settings\Temp\T0CHD001.exe" []
"SpyGuardPro"="C:\Program Files\SpyGuardPro\pgs.exe" []
"UnlockerAssistant"="C:\Program Files\Unlocker\UnlockerAssistant.exe" [2006-09-07 10:19]
"UserFaultCheck"="C:\WINDOWS\system32\dumprep 0 -u" []
"SpySweeper"="C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" [2007-10-01 16:40]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" []
"Octoshape Streaming Services"="C:\Program Files\Octoshape Streaming Services\**********\OctoshapeClient.exe" []
"AlcoholAutomount"="C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" []
"ArtChk"="C:\WINDOWS\system32\artchker.exe" [2007-10-26 21:22]
"ISMPack6"="C:\Program Files\ISM2\ISMPack6.exe" []

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 23:05:26]
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2005-08-01 07:04:59]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-12 23:01:04]
WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE [2006-08-13 00:32:28]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"=1 (0x1)

[TigerBomb]

[HKEY_CURRENT_USER\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="C:\\WINDOWS\\system32\\vvgeowbv.exe,C:\\WINDOWS\\system32\\userinit.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
C:\Program Files\Intel\Wireless\Bin\LgNotify.dll 2004-09-07 14:08 110592 C:\Program Files\Intel\Wireless\Bin\LgNotify.dll

R0 SSFS0BB9;Spy Sweeper File System Filer Driver: 0BB9;C:\WINDOWS\system32\Drivers\SSFS0BB9.SYS

.
Contents of the 'Scheduled Tasks' folder
"2007-10-30 22:00:42 C:\WINDOWS\Tasks\wrSpySweeperTrialSweep.job"
.
**************************************************************************

catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-01 19:23:53
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

C:\WINDOWS\system32\msole32.exe 14848 bytes
C:\WINDOWS\system32\ace16win.dll 8192 bytes
C:\WINDOWS\system32\wml.exe 27136 bytes
C:\WINDOWS\system32\vxddsk.exe 29952 bytes

scan completed successfully
hidden files: 4

**************************************************************************
.
Completion time: 2007-11-01 19:27:20 - machine was rebooted
.
--- E O F ---

[katana]

Have you installed a Monitoring program on your machine ?

FindAWF
Click here to download FindAWF.exe and save it to your desktop.

Copy the file paths in the quote box below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):

"C:\Program Files\Adobe\Photoshop Elements 4.0\bak\apdproxy.exe"
"C:\Program Files\Apoint\bak\Apoint.exe"
"C:\Program Files\Common Files\InstallShield\UpdateService\bak\issch.exe"
"C:\Program Files\Common Files\InstallShield\UpdateService\bak\ISUSPM.exe"
"C:\Program Files\CyberLink\PowerDVD\bak\DVDLauncher.exe"
"C:\Program Files\Dell\Media Experience\bak\PCMService.exe"
"C:\Program Files\Dell\QuickSet\bak\quickset.exe"
"C:\Program Files\Hewlett-Packard\HP Software Update\bak\HPWuSchd2.exe"
"C:\Program Files\HP\hpcoretech\bak\hpcmpmgr.exe"
"C:\Program Files\Intel\Wireless\Bin\bak\ifrmewrk.exe"
"C:\Program Files\iTunes\bak\iTunesHelper.exe"
"C:\Program Files\Java\j2re1.4.2_03\bin\bak\jusched.exe"
"C:\Program Files\Lexmark 1200 Series\bak\lxczbmgr.exe"
"C:\Program Files\Maxtor\OneTouch\Utils\bak\Onetouch.exe"
"C:\Program Files\Messenger\bak\msmsgs.exe"
"C:\Program Files\QuickTime\bak\qttask.exe"
"C:\Program Files\Winamp\bak\winampa.exe"
"C:\Program Files\Winamp\winampa.exe"
"C:\WINDOWS\system32\bak\hkcmd.exe"
"C:\WINDOWS\system32\bak\igfxtray.exe"
"C:\WINDOWS\system32\dla\bak\tfswctrl.exe"
"C:\WINDOWS\system32\spool\drivers\w32x86\3\bak\hpztsb10.exe"

• Double-click on the FindAWF.exe file to run it.
• It will open a command prompt and ask you to "Press any key to continue".
• Press 2 then Enter
• Notepad will open a file named FindAWF.txt. It will appear with instructions to click below the line and paste the list of files to be restored.
• Right click below this line and select Edit, Paste, to paste the list of files copied to the clipboard earlier. Save and close the document.
• The program will proceed to move the legit files and will perform another scan for bak folders.
• It may take a few minutes to complete, so please be patient.
• When it is complete, it will open a text file in Notepad called AWF.txt.
• Please copy and paste the contents of the AWF.txt file in your next reply.

[TigerBomb]

No, I didn't purposely install a monitoring program. When I run SpySweeper with Antivirus a key logger and activity monitor are found. They have yet to be permanently removed.


Find AWF report by noahdfear ©2006
Version 1.40
Option 2 run successfully

The current date is: Fri 11/02/2007
The current time is: 10:17:29.35


bak folders found
~~~~~~~~~~~


Directory of C:\PROGRA~1\APOINT\BAK

09/13/2004 02:33 PM 155,648 Apoint.exe
1 File(s) 155,648 bytes

Directory of C:\PROGRA~1\ITUNES\BAK

02/23/2006 03:45 PM 278,528 iTunesHelper.exe
1 File(s) 278,528 bytes

Directory of C:\PROGRA~1\LEXMAR~1\BAK

03/16/2006 12:07 AM 57,344 lxczbmgr.exe
1 File(s) 57,344 bytes

Directory of C:\PROGRA~1\MESSEN~1\BAK

10/13/2004 09:24 AM 1,694,208 msmsgs.exe
1 File(s) 1,694,208 bytes

Directory of C:\PROGRA~1\QUICKT~1\BAK

05/03/2006 08:50 PM 155,648 qttask.exe
1 File(s) 155,648 bytes

Directory of C:\PROGRA~1\WINAMP\BAK

12/20/2004 11:41 AM 33,792 winampa.exe
1 File(s) 33,792 bytes

Directory of C:\WINDOWS\SYSTEM32\BAK

02/15/2005 01:02 PM 126,976 hkcmd.exe
02/15/2005 01:02 PM 155,648 igfxtray.exe
2 File(s) 282,624 bytes

Directory of C:\PROGRA~1\ADOBE\PHOTOS~1.0\BAK

09/09/2005 01:18 AM 57,344 apdproxy.exe
1 File(s) 57,344 bytes

Directory of C:\PROGRA~1\CYBERL~1\POWERDVD\BAK

02/23/2005 02:19 PM 53,248 DVDLauncher.exe
1 File(s) 53,248 bytes

Directory of C:\PROGRA~1\DELL\MEDIAE~1\BAK

04/11/2004 06:15 PM 290,816 PCMService.exe
1 File(s) 290,816 bytes

Directory of C:\PROGRA~1\DELL\QUICKSET\BAK

03/04/2005 09:26 AM 606,208 quickset.exe
1 File(s) 606,208 bytes

Directory of C:\PROGRA~1\HEWLET~1\HPSOFT~1\BAK

02/17/2005 12:11 AM 49,152 HPWuSchd2.exe
1 File(s) 49,152 bytes

Directory of C:\PROGRA~1\HP\HPCORE~1\BAK

12/22/2003 08:38 AM 241,664 hpcmpmgr.exe
1 File(s) 241,664 bytes

Directory of C:\WINDOWS\SYSTEM32\DLA\BAK

12/05/2004 11:05 PM 127,035 tfswctrl.exe
1 File(s) 127,035 bytes

Directory of C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\BAK

07/27/2004 02:50 PM 81,920 issch.exe
07/27/2004 02:50 PM 221,184 ISUSPM.exe
2 File(s) 303,104 bytes

Directory of C:\PROGRA~1\INTEL\WIRELESS\BIN\BAK

10/30/2004 12:59 PM 385,024 ifrmewrk.exe
1 File(s) 385,024 bytes

Directory of C:\PROGRA~1\JAVA\J2RE14~1.2_0\BIN\BAK

11/19/2003 03:48 PM 32,881 jusched.exe
1 File(s) 32,881 bytes

Directory of C:\PROGRA~1\MAXTOR\ONETOUCH\UTILS\BAK

12/22/2004 08:21 AM 823,296 Onetouch.exe
1 File(s) 823,296 bytes

Directory of C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\BAK

03/04/2004 08:46 AM 172,032 hpztsb10.exe
1 File(s) 172,032 bytes


Duplicate files of bak directory contents
~~~~~~~~~~~~~~~~~~~~~~~

155648 Sep 13 2004 "C:\Program Files\Apoint\Apoint.exe"
155648 Sep 13 2004 "C:\drivers\mouse\onboard\Apoint.exe"
155648 Sep 13 2004 "C:\Program Files\Apoint\bak\Apoint.exe"
278528 Feb 23 2006 "C:\Program Files\iTunes\iTunesHelper.exe"
278528 Feb 23 2006 "C:\Program Files\iTunes\bak\iTunesHelper.exe"
57344 Mar 16 2006 "C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe"
57344 Mar 16 2006 "C:\Program Files\Lexmark 1200 Series\bak\lxczbmgr.exe"
1694208 Oct 13 2004 "C:\Program Files\Messenger\msmsgs.exe"
1694208 Oct 13 2004 "C:\Program Files\Messenger\bak\msmsgs.exe"
1694208 Oct 13 2004 "C:\WINDOWS\$hf_mig$\KB887472\SP2QFE\msmsgs.exe"
155648 May 3 2006 "C:\Program Files\QuickTime\qttask.exe"
155648 May 3 2006 "C:\Program Files\QuickTime\bak\qttask.exe"
33792 Dec 20 2004 "C:\Program Files\Winamp\winampa.exe"
33792 Dec 20 2004 "C:\Program Files\Winamp\bak\winampa.exe"
126976 Feb 15 2005 "C:\WINDOWS\system32\hkcmd.exe"
126976 Feb 15 2005 "C:\drivers\video\onboard\hkcmd.exe"
126976 Feb 15 2005 "C:\WINDOWS\system32\bak\hkcmd.exe"
155648 Feb 15 2005 "C:\WINDOWS\system32\igfxtray.exe"
155648 Feb 15 2005 "C:\drivers\video\onboard\igfxtray.exe"
155648 Feb 15 2005 "C:\WINDOWS\system32\bak\igfxtray.exe"
57344 Sep 9 2005 "C:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe"
57344 Sep 9 2005 "C:\Program Files\Adobe\Photoshop Elements 4.0\bak\apdproxy.exe"
53248 Feb 23 2005 "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
53248 Feb 23 2005 "C:\Program Files\CyberLink\PowerDVD\bak\DVDLauncher.exe"
290816 Apr 11 2004 "C:\Program Files\Dell\Media Experience\PCMService.exe"
290816 Apr 11 2004 "C:\Program Files\Dell\Media Experience\bak\PCMService.exe"
606208 Mar 4 2005 "C:\Program Files\Dell\QuickSet\quickset.exe"
606208 Mar 4 2005 "C:\Program Files\Dell\QuickSet\bak\quickset.exe"
49152 Feb 17 2005 "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
49152 Feb 17 2005 "C:\Program Files\Hewlett-Packard\HP Software Update\bak\HPWuSchd2.exe"
241664 Dec 22 2003 "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
241664 Dec 22 2003 "C:\Program Files\HP\hpcoretech\bak\hpcmpmgr.exe"
127035 Dec 5 2004 "C:\WINDOWS\system32\dla\tfswctrl.exe"
127035 Dec 5 2004 "C:\Program Files\Sonic\DLA\install\tfswctrl.exe"
127035 Dec 5 2004 "C:\WINDOWS\system32\dla\bak\tfswctrl.exe"
81920 Jul 27 2004 "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe"
81920 Jul 27 2004 "C:\Program Files\Common Files\InstallShield\UpdateService\bak\issch.exe"
221184 Jul 27 2004 "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe"
221184 Jul 27 2004 "C:\Program Files\Common Files\InstallShield\UpdateService\bak\ISUSPM.exe"
385024 Oct 30 2004 "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe"
385024 Oct 30 2004 "C:\Program Files\Intel\Wireless\Bin\bak\ifrmewrk.exe"
32881 Nov 19 2003 "C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe"
32881 Nov 19 2003 "C:\Program Files\Java\j2re1.4.2_03\bin\bak\jusched.exe"
823296 Dec 22 2004 "C:\Program Files\Maxtor\OneTouch\Utils\Onetouch.exe"
823296 Dec 22 2004 "C:\Program Files\Maxtor\OneTouch\Utils\bak\Onetouch.exe"
172032 Mar 4 2004 "C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe"
172032 Mar 4 2004 "C:\WINDOWS\system32\spool\drivers\w32x86\3\bak\hpztsb10.exe"


end of report

[katana]

Custom CFScript

• Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:
  
  

  Folder::
  C:\Program Files\ISM2
  C:\WINDOWS\system32\acespy
  
  File::
  C:\WINDOWS\system32\stfv.bin
  C:\WINDOWS\system32\dpqaqlqx.bin
  C:\WINDOWS\system32\vvgeowbv.exe
  C:\WINDOWS\plite731_uninstaller_.bat
  C:\WINDOWS\frexup3.exe
  C:\WINDOWS\system32\bkinvmfy.dll
  C:\WINDOWS\system32\artchker.exe
  C:\WINDOWS\system32\katzpdydj.exe
  C:\WINDOWS\system32\IKatzuUninstall.exe
  C:\WINDOWS\system32\sstwa.bak1
  C:\WINDOWS\system32\sstwa.bak2
  C:\WINDOWS\system32\sstwa.ini2
  C:\WINDOWS\system32\msole32.exe
  C:\WINDOWS\system32\ace16win.dll
  C:\WINDOWS\system32\wml.exe
  C:\WINDOWS\system32\vxddsk.exe
  
  Registry::
  [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{00000000-d9e3-4bc6-a0bd-3d0ca4be5271}]
  [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{00000012-890e-4aac-afd9-eff6954a34dd}]
  [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{029e02f0-a0e5-4b19-b958-7bf2db29fb13}]
  [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06dfedaa-6196-11d5-bfc8-00508b4a487d}]
  [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1adbcce8-cf84-441e-9b38-afc7a19c06a4}]
  [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2d7cb618-cc1c-4126-a7e3-f5b12d3bcf71}]
  [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{51641ef3-8a7a-4d84-8659-b0911e947cc8}]
  [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{53C330D6-A4AB-419B-B45D-FD4411C1FEF4}]
  [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{54645654-2225-4455-44A1-9F4543D34546}]
  [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{669695bc-a811-4a9d-8cdf-ba8c795f261e}]
  [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6abc861a-31e7-4d91-b43b-d3c98f22a5c0}]
  [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{944864a5-3916-46e2-96a9-a2e84f3f1208}]
  [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{a4a435cf-3583-11d4-91bd-0048546a1450}]
  [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A6E432B4-D4C2-43B3-BF55-C364F8F7362A}]
  [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{b8875bfe-b021-11d4-bfa8-00508b8e9bd3}]
  [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{bb936323-19fa-4521-ba29-eca6a121bc78}]
  [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c2680e10-1655-4a0e-87f8-4259325a84b7}]
  [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c4ca6559-2cf1-48b6-96b2-8340a06fd129}]
  [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c5af2622-8c75-4dfb-9693-23ab7686a456}]
  [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ca1d1b05-9c66-11d5-a009-000103c1e50b}]
  [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{d8efadf1-9009-11d6-8c73-608c5dc19089}]
  [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{e9147a0a-a866-4214-b47c-da821891240f}]
  [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{e9306072-417e-43e3-81d5-369490beef7c}]
  [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EA5159DF-E413-4878-8AE2-D921D41BB942}]
  [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F302FD2A-F080-476C-9F16-E195BABD6FC7}]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "{C9-98-83-32-ZN}"=-
  
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "ArtChk"=-
  "ISMPack6"=-
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
  "DisableTaskMgr"=0 (0x1)
  
  [HKEY_CURRENT_USER\software\microsoft\windows nt\currentversion\winlogon]
  "Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"

• Save this as CFScript.txt and place it on your desktop.
  
  
  
  
  
• Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
• ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
• When finished, it will produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

[TigerBomb]

ComboFix 07-11-01.1 - ********** 2007-11-02 13:52:05.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.177 [GMT -7:00]
Running from: C:\Documents and Settings\**********\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\**********\Desktop\CFScript.txt
* Created a new restore point

FILE::
C:\WINDOWS\frexup3.exe
C:\WINDOWS\plite731_uninstaller_.bat
C:\WINDOWS\system32\ace16win.dll
C:\WINDOWS\system32\artchker.exe
C:\WINDOWS\system32\bkinvmfy.dll
C:\WINDOWS\system32\dpqaqlqx.bin
C:\WINDOWS\system32\IKatzuUninstall.exe
C:\WINDOWS\system32\katzpdydj.exe
C:\WINDOWS\system32\msole32.exe
C:\WINDOWS\system32\sstwa.bak1
C:\WINDOWS\system32\sstwa.bak2
C:\WINDOWS\system32\sstwa.ini2
C:\WINDOWS\system32\stfv.bin
C:\WINDOWS\system32\vvgeowbv.exe
C:\WINDOWS\system32\vxddsk.exe
C:\WINDOWS\system32\wml.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\3721
C:\Program Files\3721\assist\asbar.dll
C:\Program Files\3721\helper.dll
C:\Program Files\e-zshopper
C:\Program Files\e-zshopper\BarLcher.dll
C:\WINDOWS\764.exe
C:\WINDOWS\7search.dll
C:\WINDOWS\adbar.dll
C:\WINDOWS\cbinst$.exe
C:\WINDOWS\daxtime.dll
C:\WINDOWS\dp0.dll
C:\WINDOWS\eventlowg.dll
C:\WINDOWS\fhfmm-Uninstaller.exe
C:\WINDOWS\fhfmm.exe
C:\WINDOWS\flt.dll
C:\WINDOWS\frexup3.exe
C:\WINDOWS\ie_32.exe
C:\WINDOWS\iexplorr23.dll
C:\WINDOWS\jd2002.dll
C:\WINDOWS\kkcomp$.exe
C:\WINDOWS\kkcomp.dll
C:\WINDOWS\kkcomp.exe
C:\WINDOWS\kvnab$.exe
C:\WINDOWS\kvnab.dll
C:\WINDOWS\kvnab.exe
C:\WINDOWS\liqad$.exe
C:\WINDOWS\liqad.dll
C:\WINDOWS\liqad.exe
C:\WINDOWS\liqui-Uninstaller.exe
C:\WINDOWS\liqui.dll
C:\WINDOWS\liqui.exe
C:\WINDOWS\ngd.dll
C:\WINDOWS\pbar.dll
C:\WINDOWS\pbsysie.dll
C:\WINDOWS\plite731_uninstaller_.bat
C:\WINDOWS\settn.dll
C:\WINDOWS\spredirect.dll
C:\WINDOWS\system32\ace16win.dll
C:\WINDOWS\system32\acespy
C:\WINDOWS\system32\acespy\__acelog.ndx
C:\WINDOWS\system32\acespy\systune.exe
C:\WINDOWS\system32\artchker.exe
C:\WINDOWS\system32\bkinvmfy.dll
C:\WINDOWS\system32\dpqaqlqx.bin
C:\WINDOWS\system32\ESHOPEE.exe
C:\WINDOWS\system32\IKatzuUninstall.exe
C:\WINDOWS\system32\katzpdydj.exe
C:\WINDOWS\system32\msole32.exe
C:\WINDOWS\system32\sstwa.bak1
C:\WINDOWS\system32\sstwa.bak2
C:\WINDOWS\system32\sstwa.ini2
C:\WINDOWS\system32\stfv.bin
C:\WINDOWS\system32\vvgeowbv.exe
C:\WINDOWS\system32\vxddsk.exe
C:\WINDOWS\system32\wml.exe
C:\WINDOWS\vxddsk.exe
C:\WINDOWS\wbeCheck.exe
C:\WINDOWS\wbeInst$.exe
C:\WINDOWS\wml.exe
C:\WINDOWS\xadbrk.dll
C:\WINDOWS\xadbrk.exe
C:\WINDOWS\xadbrk_.exe

.
((((((((((((((((((((((((( Files Created from 2007-10-02 to 2007-11-02 )))))))))))))))))))))))))))))))
.

2007-11-02 10:17 155,648 --a------ C:\WINDOWS\system32\igfxtray.exe
2007-11-02 10:17 126,976 --a------ C:\WINDOWS\system32\hkcmd.exe
2007-11-01 18:55 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-10-29 18:47 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2007-10-29 18:47 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-10-28 01:40 5,564 --a------ C:\WINDOWS\system32\tmp.reg
2007-10-28 01:38 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2007-10-28 01:38 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2007-10-28 01:38 53,248 --a------ C:\WINDOWS\system32\Process.exe
2007-10-28 01:38 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2007-10-28 01:38 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2007-10-28 01:26 <DIR> d-------- C:\Program Files\Trend Micro
2007-10-28 00:53 <DIR> d-------- C:\Documents and Settings\NetworkService\Application Data\Webroot
2007-10-28 00:53 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Jasc Software Inc
2007-10-28 00:53 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Intel
2007-10-28 00:53 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Gtek
2007-10-26 21:29 <DIR> d-------- C:\Documents and Settings\**********\Application Data\SpyGuardPro
2007-10-21 13:47 20,280 --a------ C:\WINDOWS\system32\drivers\SSFS0BB9.sys
2007-10-12 14:39 <DIR> d-------- C:\Documents and Settings\**********\Application Data\Quantitative Micro Software
2007-10-12 14:30 <DIR> d-------- C:\Program Files\EViews4 SV
2007-10-11 15:17 233,472 --a------ C:\WINDOWS\system32\REX Shared Library.dll
2007-10-11 12:33 <DIR> d-------- C:\Program Files\Alcohol Soft
2007-10-11 12:31 685,816 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2007-10-09 15:37 584,192 --------- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2007-10-05 20:22 1,777,664 --a------ C:\WINDOWS\system32\gdiplus.dll
2007-10-04 13:34 <DIR> d-------- C:\Documents and Settings\**********\Application Data\Ableton
2007-10-04 13:34 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Ableton
2007-10-04 13:27 <DIR> d-------- C:\Program Files\Ableton

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-02 17:17 --------- d-----w C:\Program Files\Winamp
2007-11-02 17:17 --------- d-----w C:\Program Files\QuickTime
2007-11-02 17:17 --------- d-----w C:\Program Files\Lexmark 1200 Series
2007-11-02 17:17 --------- d-----w C:\Program Files\iTunes
2007-11-02 17:17 --------- d-----w C:\Program Files\Apoint
2007-11-02 01:27 43,454 ----a-w C:\Documents and Settings\**********\Application Data\wklnhst.dat
2007-10-31 22:58 --------- d-----w C:\Program Files\VstPlugins
2007-10-27 05:42 164 ----a-w C:\install.dat
2007-10-12 21:30 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-10-11 20:30 --------- d-----w C:\Program Files\Octoshape Streaming Services
2007-10-11 19:24 --------- d-----w C:\Documents and Settings\All Users\Application Data\Propellerhead Software
2007-10-11 19:23 --------- d-----w C:\Documents and Settings\**********\Application Data\Propellerhead Software
2007-10-06 03:26 --------- d-----w C:\Program Files\Image-Line
2007-10-01 23:40 1,526,072 ----a-w C:\WINDOWS\WRSetup.dll
2007-10-01 23:24 23,864 ----a-w C:\WINDOWS\system32\drivers\sskbfd.sys
2007-10-01 23:24 21,816 ----a-w C:\WINDOWS\system32\drivers\sshrmd.sys
2007-10-01 23:24 163,640 ----a-w C:\WINDOWS\system32\drivers\ssidrv.sys
2007-10-01 00:09 --------- d-----w C:\Program Files\SEGA
2007-09-17 06:12 --------- d-----w C:\Program Files\Exact Audio Copy
2007-09-14 23:10 --------- d-----w C:\Program Files\MSXML 4.0
2007-06-24 03:26 58,744 ----a-w C:\Documents and Settings\**********\Application Data\GDIPFONTCACHEV1.DAT
.

((((((((((((((((((((((((((((( snapshot@2007-11-01_19.24.37.65 )))))))))))))))))))))))))))))))))))))))))
.
+ 2004-12-06 06:05:00 127,035 ----a-w C:\WINDOWS\system32\dla\tfswctrl.exe
+ 2004-03-04 15:46:24 172,032 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 23:05:26]
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2005-08-01 07:04:59]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-12 23:01:04]
WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE [2006-08-13 00:32:28]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
C:\Program Files\Intel\Wireless\Bin\LgNotify.dll 2004-09-07 14:08 110592 C:\Program Files\Intel\Wireless\Bin\LgNotify.dll

R0 SSFS0BB9;Spy Sweeper File System Filer Driver: 0BB9;C:\WINDOWS\system32\Drivers\SSFS0BB9.SYS

.
Contents of the 'Scheduled Tasks' folder
"2007-10-30 22:00:42 C:\WINDOWS\Tasks\wrSpySweeperTrialSweep.job"
.
**************************************************************************

catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-02 13:56:25
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-02 13:57:41 - machine was rebooted
C:\ComboFix2.txt ... 2007-11-01 19:27
.
--- E O F ---

[katana]

That's looking an awful lot better
How are things running now ?

Time for a different scan. If you have any trouble with this scan in FireFox, then try IE.
Run Panda Online Scan
Run Panda's ActiveScan from here and perform a full system scan.
- Once you are on the Panda site click the "Scan your PC" button
- A new window will open...click the big "Check Now" button
- Enter your Country
- Enter your State/Province
- Enter your e-mail address and click send
- Select either Home User or Company
- Click the big Scan Now button
- If it wants to install an ActiveX component allow it
- It will start downloading the files it requires for the scan (Note: It will take a couple minutes)
- Click on "Local Disks" to start the scan
- Save the log file to your desktop

[TigerBomb]

Incident Status Location

Virus:Generic Trojan Disinfected C:\!KillBox\opnmlkk.dll
Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\Documents and Settings\**********\Desktop\ComboFix.exe[nircmd.exe]
Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\Documents and Settings\**********\Desktop\ComboFix.exe[nircmd.cfexe]
Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\**********\Desktop\REPAIR\SmitfraudFix\Process.exe
Virus:Trj/Rebooter.J Disinfected C:\Documents and Settings\**********\Desktop\REPAIR\SmitfraudFix\Reboot.exe
Potentially unwanted tool:Application/SuperFast Not disinfected C:\Documents and Settings\**********\Desktop\REPAIR\SmitfraudFix\restart.exe
Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\**********\Desktop\SmitfraudFix\Process.exe
Virus:Trj/Rebooter.J Disinfected C:\Documents and Settings\**********\Desktop\SmitfraudFix\Reboot.exe
Potentially unwanted tool:Application/SuperFast Not disinfected C:\Documents and Settings\**********\Desktop\SmitfraudFix\restart.exe
Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\**********\Desktop\SmitfraudFix.zip[SmitfraudFix/Process.exe]
Virus:Trj/Rebooter.J Disinfected C:\Documents and Settings\**********\Desktop\SmitfraudFix.zip[SmitfraudFix/Reboot.exe]
Potentially unwanted tool:Application/SuperFast Not disinfected C:\Documents and Settings\**********\Desktop\SmitfraudFix.zip[SmitfraudFix/restart.exe]
Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\**********\My Documents\SmitfraudFix\Process.exe
Virus:Trj/Rebooter.J Disinfected C:\Documents and Settings\**********\My Documents\SmitfraudFix\Reboot.exe
Potentially unwanted tool:Application/SuperFast Not disinfected C:\Documents and Settings\**********\My Documents\SmitfraudFix\restart.exe
Virus:Generic Trojan Disinfected C:\Program Files\Trend Micro\HijackThis\backups\backup-20071029-180013-909.dll
Adware:Adware/Adband Not disinfected C:\qoobox\Quarantine\C\WINDOWS\frexup3.exe.vir[BndDrive5.dll]
Adware:Adware/Amera Not disinfected C:\qoobox\Quarantine\C\WINDOWS\frexup3.exe.vir[ISMPack6.exe]
Adware:Adware/SpywareDetect Not disinfected C:\qoobox\Quarantine\C\WINDOWS\system32\vvgeowbv.exe.vir
Virus:Trj/Downloader.OZB Disinfected C:\qoobox\Quarantine\C\WINDOWS\system32\wlfriyka.exe.vir
Adware:Adware/IST.ISTBar Not disinfected C:\qoobox\Quarantine\C\WINDOWS\winshow.exe.vir
Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\WINDOWS\NirCmd.exe
Potentially unwanted tool:Application/Processor Not disinfected C:\WINDOWS\system32\Process.exe