virtumonde got me too

[didymustoo]

Help! I went to Kapersky and ran the scanner. It found 15 viruses and 135 (not sure) places. When it finished there was a notification at the bottom of the webpage stating "error on page". There was no button visible to save as text. Next, I ran spybot in safe mode and it found Virtumonde and several other items. I clicked fix problems and all came up with green check. I then rebooted back into windows and launced IE explorer 7 to dl Hijackthis. IE then opened up 14 windows. I ctrl-alt-del and shut down IE. I fired up Opera 9.24, dl'd HJT 2.0.2 and ran it. Here is the log: Thanks in advance!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:10:25 PM, on 2/16/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
c:\Program Files\Common Files\Command Software\dvpapi.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\atiptaxx.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\WINDOWS\system32\ctfmon .exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
F3 - REG:win.ini: load=C:\WINDOWS\system32\oppop.exe
F2 - REG:system.ini: UserInit=userinit.exe
N3 - Netscape 7: user_pref("browser.search.defaultengine", "http://www.google.com/"); (C:\Documents and Settings\FJW\Application Data\Mozilla\Profiles\default\brw22mi9.slt\prefs.js)
O3 - Toolbar: (no name) - {2C0A5F28-48D8-408B-9172-9C6121025BCE} - (no file)
O3 - Toolbar: TextAloud - {F053C368-5458-45B2-9B4D-D8914BDDDBFF} - C:\PROGRA~1\TEXTAL~1\TAForIE.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe
O4 - HKLM\..\Run: [d422d49c] rundll32.exe "C:\WINDOWS\system32\uwdnihak.dll",b
O4 - HKLM\..\Run: [BMd711e700] Rundll32.exe "C:\WINDOWS\system32\qogdaoim.dll",s
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Search - ?p=ZJfox000
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {03A0F84E-3E69-4B3E-B4D3-019CB73B57B3} (AuthWebWizardMain.DHTMLPage1) - http://www3.authentium.com/cssrelease/bin/WizMain.exe
O16 - DPF: {1B4F9DD7-2D7C-44B5-9126-73206DA0AE75} (CNavigationManager Object) - http://www3.authentium.com/cssrelease/bin/wizard.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photo.walgreens.com/WalgreensActivia.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-3-36.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111401/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {7C5D062A-7A1E-4A46-A02B-A928084CBD66} (MLauncherNew Class) - http://legendofares.netgame.com/download/MusaLauncherNew.cab
O16 - DPF: {9C024426-7859-4B2D-AB4C-B1E370AE7549} - http://us.mcafee.com/Apps/WSC/en-us/WscWlanScannerCtrl.cab
O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex/EPSControl_v1-32.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?326
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,1,0,4692/mcfscan.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - c:\Program Files\Common Files\Command Software\dvpapi.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 5657 bytes

[Shaba]

Hi didymustoo

Rename HijackThis.exe to didymustoo.exe and post back a fresh HijackThis log, please :)

[didymustoo]

Thanks for your help. I really appreciate it.

Here is the listing of HJT renamed didymustoo.exe.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:29:02 AM, on 2/19/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
c:\Program Files\Common Files\Command Software\dvpapi.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\atiptaxx.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\Program Files\Opera\Opera.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
F3 - REG:win.ini: load=C:\WINDOWS\system32\oppop.exe
F2 - REG:system.ini: UserInit=userinit.exe
N3 - Netscape 7: user_pref("browser.search.defaultengine", "http://www.google.com/"); (C:\Documents and Settings\FJW\Application Data\Mozilla\Profiles\default\brw22mi9.slt\prefs.js)
O3 - Toolbar: (no name) - {2C0A5F28-48D8-408B-9172-9C6121025BCE} - (no file)
O3 - Toolbar: TextAloud - {F053C368-5458-45B2-9B4D-D8914BDDDBFF} - C:\PROGRA~1\TEXTAL~1\TAForIE.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe
O4 - HKLM\..\Run: [d422d49c] rundll32.exe "C:\WINDOWS\system32\eyhltecu.dll",b
O4 - HKLM\..\Run: [BMd711e700] Rundll32.exe "C:\WINDOWS\system32\iijfonay.dll",s
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Search - ?p=ZJfox000
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {03A0F84E-3E69-4B3E-B4D3-019CB73B57B3} (AuthWebWizardMain.DHTMLPage1) - http://www3.authentium.com/cssrelease/bin/WizMain.exe
O16 - DPF: {1B4F9DD7-2D7C-44B5-9126-73206DA0AE75} (CNavigationManager Object) - http://www3.authentium.com/cssrelease/bin/wizard.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photo.walgreens.com/WalgreensActivia.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-3-36.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111401/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {7C5D062A-7A1E-4A46-A02B-A928084CBD66} (MLauncherNew Class) - http://legendofares.netgame.com/download/MusaLauncherNew.cab
O16 - DPF: {9C024426-7859-4B2D-AB4C-B1E370AE7549} - http://us.mcafee.com/Apps/WSC/en-us/WscWlanScannerCtrl.cab
O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex/EPSControl_v1-32.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?326
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,1,0,4692/mcfscan.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - c:\Program Files\Common Files\Command Software\dvpapi.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 5624 bytes

[Shaba]

Hi

Unfortunately it didn't went right.

Rename HijackThis.exe to didymustoo.exe by doing the following;

Navigate here using Windows Explorer (windows button + E) or My Computer -> Local Disk C: -> C:\Program Files\Trend Micro\HijackThis
Right-click on the HijackThis.exe
Choose from the pull-down menu; "Rename"
And now Rename HijackThis.exe to didymustoo.exe
When you've renamed HijackThis, open HijackThis again.
Take a fresh HijackThis log (click Do a system scan and save a log file)
Post the fresh HijackThis log here.

[didymustoo]

Oops sorry! I only renamed the shortcut the first time. Duh!. Here it is.

C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\atiptaxx.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\Program Files\Opera\Opera.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\PROGRAM FILES\LOGITECH\VIDEO\FXSVR2.EXE
C:\WINDOWS\SYSTEM32\LVCOMSX.EXE
C:\Program Files\Trend Micro\HijackThis\didymustoo.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
F3 - REG:win.ini: load=C:\WINDOWS\system32\oppop.exe
F2 - REG:system.ini: UserInit=userinit.exe
N3 - Netscape 7: user_pref("browser.search.defaultengine", "http://www.google.com/"); (C:\Documents and Settings\FJW\Application Data\Mozilla\Profiles\default\brw22mi9.slt\prefs.js)
O2 - BHO: (no name) - {3C7195F6-D788-4D50-BA72-2EE212EDAC78} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {57CDE877-1115-4B40-8455-6D159A00CA36} - C:\WINDOWS\system32\oppop.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll
O2 - BHO: {6ac86db7-7385-301b-c404-be1d10e3c93c} - {c39c3e01-d1eb-404c-b103-58377bd68ca6} - C:\WINDOWS\system32\pohwibin.dll
O2 - BHO: (no name) - {CA4F0D8D-5F2B-4F16-838A-8D52249EAB21} - C:\WINDOWS\system32\wvuurpq.dll (file missing)
O3 - Toolbar: (no name) - {2C0A5F28-48D8-408B-9172-9C6121025BCE} - (no file)
O3 - Toolbar: TextAloud - {F053C368-5458-45B2-9B4D-D8914BDDDBFF} - C:\PROGRA~1\TEXTAL~1\TAForIE.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe
O4 - HKLM\..\Run: [d422d49c] rundll32.exe "C:\WINDOWS\system32\eyhltecu.dll",b
O4 - HKLM\..\Run: [BMd711e700] Rundll32.exe "C:\WINDOWS\system32\iijfonay.dll",s
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Search - ?p=ZJfox000
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {03A0F84E-3E69-4B3E-B4D3-019CB73B57B3} (AuthWebWizardMain.DHTMLPage1) - http://www3.authentium.com/cssrelease/bin/WizMain.exe
O16 - DPF: {1B4F9DD7-2D7C-44B5-9126-73206DA0AE75} (CNavigationManager Object) - http://www3.authentium.com/cssrelease/bin/wizard.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photo.walgreens.com/WalgreensActivia.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-3-36.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111401/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {7C5D062A-7A1E-4A46-A02B-A928084CBD66} (MLauncherNew Class) - http://legendofares.netgame.com/download/MusaLauncherNew.cab
O16 - DPF: {9C024426-7859-4B2D-AB4C-B1E370AE7549} - http://us.mcafee.com/Apps/WSC/en-us/WscWlanScannerCtrl.cab
O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex/EPSControl_v1-32.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?326
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,1,0,4692/mcfscan.cab
O20 - Winlogon Notify: MS-DOS Emulation - C:\WINDOWS\
O20 - Winlogon Notify: wvuurpq - wvuurpq.dll (file missing)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - c:\Program Files\Common Files\Command Software\dvpapi.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 6638 bytes

[Shaba]

Hi

Yes, now it's better :)

Is this up-to-date?

O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - c:\Program Files\Common Files\Command Software\dvpapi.exe

1. Download combofix from any of these links and save it to Desktop:
Link 1 (http://download.bleepingcomputer.com/sUBs/ComboFix.exe)
Link 2 (http://www.forospyware.com/sUBs/ComboFix.exe)
Link 3 (http://subs.geekstogo.com/ComboFix.exe)

**Note: It is important that it is saved directly to your desktop**

2. Double click combofix.exe & follow the prompts.
3. When finished, it shall produce a log for you (C:\ComboFix.txt). Post that log in your next reply

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Combofix should never take more that 20 minutes including the reboot if malware is detected.
If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
If that happened we want to know, and also what process you had to end.

If you have problems with Combofix usage, see here (http://www.bleepingcomputer.com/combofix/how-to-use-combofix)

Post:

- a fresh HijackThis log
- combofix report

[didymustoo]

The HJT version I used was downloaded two days ago when I made my first post.

Here is the combofix log. Note I had to break it into two posts to fit.

ComboFix 08-02-19.2 - fjw 2008-02-19 8:43:24.1 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.678 [GMT -6:00]
Running from: C:\Documents and Settings\fjw\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\guard.tmp
C:\Documents and Settings\fjw\Application Data\ICROSO~1
C:\Documents and Settings\fjw\Application Data\macromedia\Flash Player\#SharedObjects\K7BXFSVM\www.broadcaster.com
C:\Documents and Settings\fjw\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com
C:\Documents and Settings\fjw\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol
C:\Program Files\winupdate
C:\WINDOWS\cookies.ini
C:\WINDOWS\start.exe
C:\WINDOWS\SYSTEM32\000070.exe
C:\WINDOWS\SYSTEM32\000080.exe
C:\WINDOWS\SYSTEM32\akferhlk.ini
C:\WINDOWS\system32\asgtxevg.dll
C:\WINDOWS\system32\bvmivvlm.dll
C:\WINDOWS\system32\cfwyjgkd.dll
C:\WINDOWS\system32\cqmmbeyu.dll
C:\WINDOWS\system32\ctfmon.exe.tmp
C:\WINDOWS\system32\cunbxjyh.dll
C:\WINDOWS\system32\dawlrvkx.dll
C:\WINDOWS\system32\dhlytgul.dll
C:\WINDOWS\SYSTEM32\druamxel.ini
C:\WINDOWS\SYSTEM32\dryvguvn.ini
C:\WINDOWS\SYSTEM32\ebafspdw.ini
C:\WINDOWS\system32\ehvhsute.dll
C:\WINDOWS\system32\enipjeie.dll
C:\WINDOWS\system32\epmuqjre.dll
C:\WINDOWS\system32\eyhltecu.dll
C:\WINDOWS\system32\fgvgeoyw.dll
C:\WINDOWS\system32\gqktdkul.dll
C:\WINDOWS\SYSTEM32\gyqgrkyn.ini
C:\WINDOWS\system32\htjqefbw.dll
C:\WINDOWS\SYSTEM32\hwdxwbsn.ini
C:\WINDOWS\SYSTEM32\hxqtkrje.ini
C:\WINDOWS\system32\hyuluxek.dll
C:\WINDOWS\system32\ibnxcxsu.dll
C:\WINDOWS\system32\ifrobeor.dll
C:\WINDOWS\SYSTEM32\iijcpufg.ini
C:\WINDOWS\system32\iijfonay.dll
C:\WINDOWS\system32\infidjge.dll
C:\WINDOWS\SYSTEM32\jbtgrwlq.ini
C:\WINDOWS\system32\jikklstw.dll
C:\WINDOWS\system32\jjfyafpe.dll
C:\WINDOWS\system32\jopiwaiu.dll
C:\WINDOWS\system32\kaynflju.dll
C:\WINDOWS\system32\kgqfyeng.dll
C:\WINDOWS\system32\kpiygyod.dll
C:\WINDOWS\SYSTEM32\ledbbvnc.ini
C:\WINDOWS\system32\lexmaurd.dll
C:\WINDOWS\SYSTEM32\lgxvyhov.ini
C:\WINDOWS\system32\lixxmeks.dll
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\mrjtduel.dll
C:\WINDOWS\SYSTEM32\mrynfgiy.ini
C:\WINDOWS\system32\nmrheveg.dll
C:\WINDOWS\SYSTEM32\noiqhjda.ini
C:\WINDOWS\system32\nojhboue.dll
C:\WINDOWS\system32\nsbwxdwh.dll
C:\WINDOWS\system32\okgterca.dll
C:\WINDOWS\system32\omfsyygy.dll
C:\WINDOWS\system32\onxlwkmd.dll
C:\WINDOWS\system32\oppop.dll
C:\WINDOWS\system32\oppop.exe
C:\WINDOWS\system32\pohwibin.dll
C:\WINDOWS\SYSTEM32\poppo.ini
C:\WINDOWS\SYSTEM32\poppo.ini2
C:\WINDOWS\system32\pvmfdxkx.dll
C:\WINDOWS\system32\qogdaoim.dll
C:\WINDOWS\SYSTEM32\qtvaitnp.ini
C:\WINDOWS\system32\qvkdjrrn.dll
C:\WINDOWS\system32\qwlbrbhh.dll
C:\WINDOWS\system32\RCXD.tmp
C:\WINDOWS\system32\rdjrctnw.dll
C:\WINDOWS\system32\rplvmnnr.dll
C:\WINDOWS\system32\rsapyvfp.dll
C:\WINDOWS\system32\rvckajue.dll
C:\WINDOWS\system32\sqhaxkas.dll
C:\WINDOWS\system32\thvdfbkm.dll
C:\WINDOWS\SYSTEM32\ucetlhye.ini
C:\WINDOWS\system32\uguedion.dll
C:\WINDOWS\SYSTEM32\uiawipoj.ini
C:\WINDOWS\system32\uwjxnmwa.dll
C:\WINDOWS\SYSTEM32\valgnqxf.ini
C:\WINDOWS\system32\vaubnybh.dll
C:\WINDOWS\system32\vkcnjxyt.dll
C:\WINDOWS\system32\vmckrlyo.dll
C:\WINDOWS\system32\vohyvxgl.dll
C:\WINDOWS\system32\xcyeawxw.dll
C:\WINDOWS\system32\xebrdxtv.dll
C:\WINDOWS\SYSTEM32\xkxdfmvp.ini
C:\WINDOWS\SYSTEM32\xqacmxny.ini
C:\WINDOWS\system32\xqpvyafu.dll
C:\WINDOWS\system32\ycariooq.dll
C:\WINDOWS\system32\yhdnkuln.dll
C:\WINDOWS\system32\yltfcxlb.dll
C:\WINDOWS\winsysupd71.dat

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_WINDOWS_OVERLAY_COMPONENTS


((((((((((((((((((((((((( Files Created from 2008-01-19 to 2008-02-19 )))))))))))))))))))))))))))))))
.

2008-02-18 07:19 . 2008-02-18 07:19 <DIR> d--hs---- C:\FOUND.000
2008-02-17 13:13 . 2008-02-18 13:14 2,034,575 ---hs---- C:\WINDOWS\SYSTEM32\oxyfjhwa.ini
2008-02-16 21:09 . 2008-02-16 21:09 <DIR> d-------- C:\Program Files\Trend Micro
2008-02-16 14:48 . 2008-02-16 14:48 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-02-16 14:47 . 2008-02-16 14:47 <DIR> d-------- C:\WINDOWS\SYSTEM32\Kaspersky Lab
2008-02-16 09:10 . 2008-02-17 13:11 2,396,761 ---hs---- C:\WINDOWS\SYSTEM32\kahindwu.ini
2008-02-15 09:04 . 2008-02-18 13:10 6,014 --a------ C:\WINDOWS\BMd711e700.xml
2008-02-15 09:04 . 2008-02-19 07:11 22 --a------ C:\WINDOWS\pskt.ini
2008-02-15 08:33 . 2008-02-15 08:33 <DIR> d-------- C:\mGame
2008-02-14 09:14 . 2008-02-15 07:22 1,944,987 ---hs---- C:\WINDOWS\SYSTEM32\tpkoyoea.ini
2008-02-14 09:11 . 2008-02-14 09:12 2,061,204 ---hs---- C:\WINDOWS\SYSTEM32\jpiqejvx.ini
2008-02-13 09:11 . 2008-02-14 07:12 2,507,492 ---hs---- C:\WINDOWS\SYSTEM32\tqhttets.ini
2008-02-13 09:08 . 2008-02-13 09:08 2,140,513 ---hs---- C:\WINDOWS\SYSTEM32\pprijqhf.ini
2008-02-12 09:11 . 2008-02-13 07:05 2,107,305 ---hs---- C:\WINDOWS\SYSTEM32\gxgjmrhb.ini
2008-02-12 09:08 . 2008-02-12 09:08 2,119,031 ---hs---- C:\WINDOWS\SYSTEM32\chwxhmmf.ini
2008-02-11 09:11 . 2008-02-12 07:11 2,075,362 ---hs---- C:\WINDOWS\SYSTEM32\xpdbncvm.ini
2008-02-11 09:08 . 2008-02-11 09:09 2,092,109 ---hs---- C:\WINDOWS\SYSTEM32\xooaomjm.ini
2008-02-10 09:10 . 2008-02-11 07:06 2,088,273 ---hs---- C:\WINDOWS\SYSTEM32\vsrrdylm.ini
2008-02-10 09:07 . 2008-02-10 09:08 2,090,475 ---hs---- C:\WINDOWS\SYSTEM32\cirueasx.ini
2008-02-09 09:09 . 2008-02-10 06:44 2,092,776 ---hs---- C:\WINDOWS\SYSTEM32\kltgfybn.ini
2008-02-09 09:06 . 2008-02-09 09:07 2,095,002 ---hs---- C:\WINDOWS\SYSTEM32\ofxflobj.ini
2008-02-08 09:12 . 2008-02-09 07:37 2,094,453 ---hs---- C:\WINDOWS\SYSTEM32\lkgjgnxy.ini
2008-02-08 09:06 . 2008-02-08 09:06 2,098,133 ---hs---- C:\WINDOWS\SYSTEM32\xotboipg.ini
2008-02-07 18:15 . 2008-02-07 18:15 67 --a------ C:\WINDOWS\101_ASB.INI
2008-02-07 18:14 . 2008-02-07 18:14 <DIR> d-------- C:\DISNEY
2008-02-07 09:11 . 2008-02-08 07:12 2,075,018 ---hs---- C:\WINDOWS\SYSTEM32\oufrpeds.ini
2008-02-07 09:05 . 2008-02-07 09:05 2,077,268 ---hs---- C:\WINDOWS\SYSTEM32\xgqyrpni.ini
2008-02-06 09:04 . 2008-02-07 09:04 2,080,720 ---hs---- C:\WINDOWS\SYSTEM32\tytemlnm.ini
2008-02-05 09:08 . 2008-02-06 08:46 2,059,879 ---hs---- C:\WINDOWS\SYSTEM32\lujpuouu.ini
2008-02-05 09:02 . 2008-02-05 09:04 2,061,632 ---hs---- C:\WINDOWS\SYSTEM32\puculuhy.ini
2008-02-03 20:39 . 2008-02-05 08:57 2,058,177 ---hs---- C:\WINDOWS\SYSTEM32\btvxjnce.ini
2008-02-03 20:33 . 2008-02-03 20:33 2,054,401 ---hs---- C:\WINDOWS\SYSTEM32\koxuytol.ini
2008-02-02 21:39 . 2008-02-02 21:39 <DIR> d-------- C:\Documents and Settings\fjw\DoctorWeb
2008-01-31 22:34 . 2008-01-31 22:34 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-01-31 20:34 . 2008-02-03 07:10 2,082,396 ---hs---- C:\WINDOWS\SYSTEM32\jinvuulv.ini
2008-01-31 20:31 . 2008-01-31 20:32 1,959,292 ---hs---- C:\WINDOWS\SYSTEM32\rewjlbep.ini
2008-01-31 07:49 . 2008-01-31 18:00 2,004,858 ---hs---- C:\WINDOWS\SYSTEM32\nkgudkqh.ini
2008-01-31 07:43 . 2008-01-31 07:47 2,053,516 ---hs---- C:\WINDOWS\SYSTEM32\ytytwepr.ini
2008-01-30 07:35 . 2008-01-31 07:42 2,095,133 ---hs---- C:\WINDOWS\SYSTEM32\oognqwkq.ini
2008-01-25 16:27 . 2008-01-25 16:27 110 --a------ C:\WINDOWS\HandySnap.INI
2008-01-22 22:01 . 2008-01-22 22:01 <DIR> d-------- C:\OutputFolder
2008-01-22 21:59 . 2008-01-22 21:59 <DIR> d-------- C:\Program Files\FLV to AVI MPEG WMV 3GP MP4 iPod Converter

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-17 19:10 15,360 ----a-w C:\WINDOWS\SYSTEM32\ctfmon .exe
2008-01-16 14:39 186,000 ----a-w C:\Documents and Settings\fjw\Application Data\GDIPFONTCACHEV1.DAT
2008-01-14 13:49 155,648 ----a-w C:\WINDOWS\SYSTEM32\NeroCheck .exe
2008-01-11 05:53 44,544 ----a-w C:\WINDOWS\SYSTEM32\dllcache\pngfilt.dll
2007-12-26 05:07 8,413 ----a-w C:\WINDOWS\system32\drivers\mcstrm.sys
2007-12-26 05:07 --------- d-----w C:\Program Files\Common Files\Real
2007-12-26 05:03 --------- d-----w C:\Program Files\Best Buy Rhapsody
2007-12-19 23:01 347,136 ----a-w C:\WINDOWS\SYSTEM32\dllcache\dxtmsft.dll
2007-12-18 09:51 179,584 ----a-w C:\WINDOWS\SYSTEM32\dllcache\mrxdav.sys
2007-12-14 17:32 12,632 ----a-w C:\WINDOWS\SYSTEM32\lsdelete.exe
2007-12-08 05:21 3,592,192 ------w C:\WINDOWS\SYSTEM32\dllcache\mshtml.dll
2007-12-06 11:01 625,664 ------w C:\WINDOWS\SYSTEM32\dllcache\iexplore.exe
2007-12-06 11:00 70,656 ------w C:\WINDOWS\SYSTEM32\dllcache\ie4uinit.exe
2007-12-06 11:00 13,824 ------w C:\WINDOWS\SYSTEM32\dllcache\ieudinit.exe
2007-12-06 04:59 161,792 ------w C:\WINDOWS\SYSTEM32\dllcache\ieakui.dll
2007-12-04 18:38 550,912 ----a-w C:\WINDOWS\SYSTEM32\dllcache\oleaut32.dll
2007-12-04 18:38 550,912 ------w C:\WINDOWS\SYSTEM32\oleaut32.dll
2006-12-23 16:04 32 ----a-r C:\Documents and Settings\All Users\hash.dat
2006-01-11 02:13 159,312 ----a-w C:\Documents and Settings\Jeremy\Application Data\GDIPFONTCACHEV1.DAT
2005-04-04 22:23 0 ---h--w C:\Program Files\AppUpdate.log
2004-09-21 20:07 86,016 ----a-w C:\Program Files\SPInstall.exe
2004-09-21 16:54 975 ----a-w C:\Program Files\ReadMe.txt
2004-09-21 16:05 1,841 ----a-w C:\Program Files\PackingList.txt
2004-09-21 15:36 908 ----a-w C:\Program Files\Setup.ini
2004-09-21 15:36 19,443,744 ----a-w C:\Program Files\Data1.cab
2004-09-21 15:36 1,591,952 ----a-w C:\Program Files\SundayPlus.msi
2004-09-21 15:35 225,280 ----a-w C:\Program Files\SPSetupHelper.exe
2004-09-15 02:35 49,152 ----a-w C:\Program Files\EnglishUI.dll
2004-04-23 00:02 560 ----a-w C:\Program Files\Global.sw
2004-01-10 02:34 266 --sh--w C:\Program Files\desktop.ini
2003-02-25 15:04 4,632 ----a-w C:\Program Files\0x0409.ini
2006-03-27 03:50 3,766 --sha-w C:\WINDOWS\SYSTEM32\KGyGaAvL.sys
2006-03-27 03:50 88 --sh--r C:\WINDOWS\SYSTEM32\D4B12B0226.sys
.

<pre>
----a-w 155,648 2008-01-14 13:49:00 C:\WINDOWS\SYSTEM32\NeroCheck .exe
----a-w 15,360 2008-02-17 19:10:12 C:\WINDOWS\SYSTEM32\ctfmon .exe
----a-w 158,208 2008-02-17 03:04:04 C:\WINDOWS\pchealth\helpctr\binaries\MSConfig .exe
----a-w 649,728 2008-01-14 22:45:12 C:\Program Files\QuickTime\qttask .exe
----a-w 649,728 2008-01-15 05:18:12 C:\Program Files\QuickTime\qttask .exe
----a-w 649,728 2008-01-15 13:34:46 C:\Program Files\QuickTime\qttask .exe
----a-w 649,728 2008-01-16 04:01:32 C:\Program Files\QuickTime\qttask .exe
----a-w 649,728 2008-01-16 13:52:08 C:\Program Files\QuickTime\qttask .exe
----a-w 649,728 2008-01-17 13:34:58 C:\Program Files\QuickTime\qttask .exe
----a-w 282,624 2008-01-17 13:35:46 C:\Program Files\QuickTime\qttask .exe
----a-w 1,235,456 2008-01-15 05:18:08 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-15 13:34:42 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-16 04:01:30 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-16 13:52:06 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-17 13:34:56 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-18 13:01:00 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-19 05:28:52 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-19 14:49:44 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-19 22:07:26 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-20 13:05:32 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-21 00:57:40 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-21 13:45:58 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-22 13:30:02 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-24 13:23:50 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-25 13:12:52 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-26 14:00:48 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-27 13:10:08 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-28 00:02:38 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-29 13:21:38 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-30 13:26:08 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-30 15:22:54 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-30 16:10:46 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-31 12:52:42 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-31 13:46:00 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-01 04:46:42 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-01 13:14:42 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-02 13:54:24 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-02 16:06:34 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-02 23:20:48 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-03 00:33:20 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-03 03:53:04 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-03 13:09:24 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-04 13:50:12 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-05 14:56:58 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-05 18:28:32 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-06 14:46:12 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-06 16:40:16 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-06 17:39:54 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-07 13:29:04 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-08 13:12:16 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-09 13:36:42 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-10 12:43:56 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-11 13:05:44 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-12 13:11:24 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-13 13:05:02 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-14 01:54:00 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-14 13:11:14 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-15 13:22:34 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-16 14:04:36 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-16 16:48:18 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-16 19:32:28 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-16 20:49:34 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,743,360 2008-01-14 22:45:08 C:\Program Files\TGTSoft\StyleXP\StyleXP .exe
----a-w 1,372,160 2008-01-17 13:35:48 C:\Program Files\TGTSoft\StyleXP\StyleXP .exe
----a-w 1,694,208 2008-02-14 00:24:30 C:\Program Files\Messenger\msmsgs .exe
</pre>

[didymustoo]

Section two of combofix log:


-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SlowFile Icon Overlay]
@={7D688A77-C613-11D0-999B-00C04FD655E1}

[HKEY_CLASSES_ROOT\CLSID\{7D688A77-C613-11D0-999B-00C04FD655E1}]
2007-10-25 21:34 8460288 --a------ C:\WINDOWS\SYSTEM32\SHELL32.DLL

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:07 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-06-01 16:22 7618560]
"nwiz"="nwiz.exe" [2006-06-01 16:22 1519616 C:\WINDOWS\SYSTEM32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-06-01 16:22 86016]
"Tweak UI"="TWEAKUI.CPL" [2000-06-18 14:03 106544 C:\WINDOWS\SYSTEM32\TWEAKUI.CPL]
"ATIPTA"="atiptaxx.exe" [2001-09-27 01:39 245760 C:\WINDOWS\SYSTEM32\atiptaxx.exe]

C:\Documents and Settings\fjw\Start Menu\Programs\Startup\
Stardock ObjectDock.lnk - C:\Program Files\Stardock\ObjectDock\ObjectDock.exe [2007-01-08 21:22:17 2746104]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"<NO NAME>"= 00000000
"NoFavoritesMenu"= 01000000
"NoLogoff"= 0 (0x0)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"<NO NAME>"= 00000000
"NoFavoritesMenu"= 01000000
"NoActiveDesktopChanges"= 0 (0x0)
"NoLogoff"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="C:\\WINDOWS\\system32\\logonuiX.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wvuurpq]
wvuurpq.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Corel MEDIA FOLDERS INDEXER 8.LNK]
backup=C:\WINDOWS\pss\Corel MEDIA FOLDERS INDEXER 8.LNKCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Encoder Agent.lnk]
backup=C:\WINDOWS\pss\Encoder Agent.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone Fast Start.lnk]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Cody^Start Menu^Programs^Startup^LimeWire On Startup.lnk]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AtiPTA]
--a------ 2001-09-27 01:39 245760 C:\WINDOWS\SYSTEM32\atiptaxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AuthConsoleStart]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearShare]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cmaudio]


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Corel Photo Downloader]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\d422d49c]
C:\WINDOWS\system32\ynxmcaqx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DesktopIconToy]
--a------ 2006-10-26 21:03 278528 C:\Program Files\Desktop Icon Toy\DesktopIconToy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ESP]
--a------ 2006-07-30 12:09 63008 C:\Program Files\Cox\Applications\app\start.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FolderShare]
--a------ 2008-02-16 14:49 1235456 C:\Program Files\FolderShare\FolderShare .exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a------ 2004-09-13 15:49 49152 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
--a------ 2003-03-26 05:34 172032 C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
--a------ 2005-06-10 10:44 249856 C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
--a------ 2005-06-10 10:44 81920 C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
C:\WINDOWS\system32\dumprep 0 -k

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogonStudio]
C:\Program Files\WinCustomize\LogonStudio\logonstudio.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MediaGateway]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Mobipocket Reader Notifications]
--a------ 2006-06-20 16:54 57344 C:\Program Files\Mobipocket.com\Mobipocket Reader\readernotify.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2008-02-13 18:24 2226688 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-01-17 07:35 282624 C:\Program Files\QuickTime\qttask .exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
--a------ 2008-02-16 14:49 2441216 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StarSkin]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\STYLEXP]
--a------ 2008-01-17 07:35 1372160 C:\Program Files\TGTSoft\StyleXP\StyleXP .exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TheMonitor]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a------ 2007-05-14 17:22 35328 C:\Program Files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\winupdate]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"UPS"=3 (0x3)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"msnmsgr"="C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE" /background
"LogitechSoftwareUpdate"="C:\PROGRAM FILES\LOGITECH\VIDEO\MANIFESTENGINE.EXE" boot

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\setup\disabledrunkeys]
"Tweak UI"=RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
"SiS Tray"=C:\WINDOWS\SYSTEM32\sistray.exe
"StillImageMonitor"=C:\WINDOWS\SYSTEM32\stimon.exe

R2 ppsio2;PPDevice;C:\WINDOWS\system32\drivers\ppsio2.sys [1999-04-01 19:16]
R3 ati2mtaa;ati2mtaa;C:\WINDOWS\system32\DRIVERS\ati2mtaa.sys [2001-09-27 00:32]
S3 BCM42XX;Broadcom iLine10(tm) Network Adapter Driver;C:\WINDOWS\system32\DRIVERS\bcm42xx5.sys [2001-08-17 12:11]
S3 dump_wmimmc;dump_wmimmc;C:\Program Files\Gpotato\Flyff\GameGuard\dump_wmimmc.sys []
S3 PhilCam8116;Logitech QuickCam Pro 3000 (08B0);C:\WINDOWS\system32\DRIVERS\CamDrO21.sys [2001-08-17 14:05]
S3 XDva090;XDva090;C:\WINDOWS\system32\XDva090.sys []


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\MmoptPreferredAudioDevices]
rundll32.exe shell32.dll,Control_RunDLL mmsys.cpl,@0,SUSB\VID_046D&PID_08B0&MI_01\1USB&VID_046D&PID_08B0&INST_0

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9EF0045A-CDD9-438e-95E6-02B9AFEC8E11}]
C:\WINDOWS\SYSTEM32\updcrl.exe -e -u C:\WINDOWS\SYSTEM\verisignpub1.crl
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-19 08:53:06
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\explorer.exe [6.00.2900.3156]
-> C:\Program Files\Stardock\ObjectDock\DockShellHook.dll
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
c:\Program Files\Common Files\Command Software\dvpapi.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
.
**************************************************************************
.
Completion time: 2008-02-19 8:55:00 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-19 14:54:58
.
2008-02-15 05:58:29 --- E O F ---

[Shaba]

Hi

No, I mean Command Antivirus. Is it up-to-date?

[didymustoo]

Oops again! No it probably is not.:oops:

[Shaba]

Hi

Thanks for the info.

We don't install another antivirus yet as you have vundo file infector which might infect that.

Open notepad and copy/paste the text in the quotebox below into it:


RenV::
----a-w 155,648 2008-01-14 13:49:00 C:\WINDOWS\SYSTEM32\NeroCheck .exe
----a-w 15,360 2008-02-17 19:10:12 C:\WINDOWS\SYSTEM32\ctfmon .exe
----a-w 158,208 2008-02-17 03:04:04 C:\WINDOWS\pchealth\helpctr\binaries\MSConfig .exe
----a-w 649,728 2008-01-14 22:45:12 C:\Program Files\QuickTime\qttask .exe
----a-w 649,728 2008-01-15 05:18:12 C:\Program Files\QuickTime\qttask .exe
----a-w 649,728 2008-01-15 13:34:46 C:\Program Files\QuickTime\qttask .exe
----a-w 649,728 2008-01-16 04:01:32 C:\Program Files\QuickTime\qttask .exe
----a-w 649,728 2008-01-16 13:52:08 C:\Program Files\QuickTime\qttask .exe
----a-w 649,728 2008-01-17 13:34:58 C:\Program Files\QuickTime\qttask .exe
----a-w 282,624 2008-01-17 13:35:46 C:\Program Files\QuickTime\qttask .exe
----a-w 1,235,456 2008-01-15 05:18:08 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-15 13:34:42 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-16 04:01:30 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-16 13:52:06 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-17 13:34:56 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-18 13:01:00 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-19 05:28:52 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-19 14:49:44 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-19 22:07:26 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-20 13:05:32 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-21 00:57:40 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-21 13:45:58 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-22 13:30:02 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-24 13:23:50 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-25 13:12:52 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-26 14:00:48 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-27 13:10:08 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-28 00:02:38 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-29 13:21:38 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-30 13:26:08 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-30 15:22:54 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-30 16:10:46 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-31 12:52:42 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-31 13:46:00 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-01 04:46:42 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-01 13:14:42 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-02 13:54:24 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-02 16:06:34 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-02 23:20:48 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-03 00:33:20 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-03 03:53:04 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-03 13:09:24 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-04 13:50:12 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-05 14:56:58 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-05 18:28:32 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-06 14:46:12 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-06 16:40:16 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-06 17:39:54 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-07 13:29:04 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-08 13:12:16 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-09 13:36:42 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-10 12:43:56 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-11 13:05:44 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-12 13:11:24 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-13 13:05:02 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-14 01:54:00 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-14 13:11:14 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-15 13:22:34 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-16 14:04:36 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-16 16:48:18 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-16 19:32:28 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-16 20:49:34 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,743,360 2008-01-14 22:45:08 C:\Program Files\TGTSoft\StyleXP\StyleXP .exe
----a-w 1,372,160 2008-01-17 13:35:48 C:\Program Files\TGTSoft\StyleXP\StyleXP .exe
----a-w 1,694,208 2008-02-14 00:24:30 C:\Program Files\Messenger\msmsgs .exe

File::
C:\WINDOWS\SYSTEM32\oxyfjhwa.ini
C:\WINDOWS\SYSTEM32\kahindwu.ini
C:\WINDOWS\SYSTEM32\tpkoyoea.ini
C:\WINDOWS\SYSTEM32\jpiqejvx.ini
C:\WINDOWS\SYSTEM32\tqhttets.ini
C:\WINDOWS\SYSTEM32\pprijqhf.ini
C:\WINDOWS\SYSTEM32\gxgjmrhb.ini
C:\WINDOWS\SYSTEM32\chwxhmmf.ini
C:\WINDOWS\SYSTEM32\xpdbncvm.ini
C:\WINDOWS\SYSTEM32\xooaomjm.ini
C:\WINDOWS\SYSTEM32\vsrrdylm.ini
C:\WINDOWS\SYSTEM32\cirueasx.ini
C:\WINDOWS\SYSTEM32\kltgfybn.ini
C:\WINDOWS\SYSTEM32\ofxflobj.ini
C:\WINDOWS\SYSTEM32\lkgjgnxy.ini
C:\WINDOWS\SYSTEM32\xotboipg.ini
C:\WINDOWS\SYSTEM32\oufrpeds.ini
C:\WINDOWS\SYSTEM32\xgqyrpni.ini
C:\WINDOWS\SYSTEM32\tytemlnm.ini
C:\WINDOWS\SYSTEM32\lujpuouu.ini
C:\WINDOWS\SYSTEM32\puculuhy.ini
C:\WINDOWS\SYSTEM32\btvxjnce.ini
C:\WINDOWS\SYSTEM32\koxuytol.ini
C:\WINDOWS\SYSTEM32\jinvuulv.ini
C:\WINDOWS\SYSTEM32\rewjlbep.ini
C:\WINDOWS\SYSTEM32\nkgudkqh.ini
C:\WINDOWS\SYSTEM32\ytytwepr.ini
C:\WINDOWS\SYSTEM32\oognqwkq.ini

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wvuurpq]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\d422d49c]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MediaGateway]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\winupdate]


Save this as "CFScript"

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

http://users.pandora.be/bluepatchy/miekiemoes/images/CFScript.gif

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.

Combofix should never take more that 20 minutes including the reboot if malware is detected.
If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
If that happened we want to know, and also what process you had to end.

[didymustoo]

Here is the combofix log:

ComboFix 08-02-19.2 - fjw 2008-02-19 12:42:30.2 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.739 [GMT -6:00]
Running from: C:\Documents and Settings\fjw\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\fjw\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\WINDOWS\SYSTEM32\btvxjnce.ini
C:\WINDOWS\SYSTEM32\chwxhmmf.ini
C:\WINDOWS\SYSTEM32\cirueasx.ini
C:\WINDOWS\SYSTEM32\gxgjmrhb.ini
C:\WINDOWS\SYSTEM32\jinvuulv.ini
C:\WINDOWS\SYSTEM32\jpiqejvx.ini
C:\WINDOWS\SYSTEM32\kahindwu.ini
C:\WINDOWS\SYSTEM32\kltgfybn.ini
C:\WINDOWS\SYSTEM32\koxuytol.ini
C:\WINDOWS\SYSTEM32\lkgjgnxy.ini
C:\WINDOWS\SYSTEM32\lujpuouu.ini
C:\WINDOWS\SYSTEM32\nkgudkqh.ini
C:\WINDOWS\SYSTEM32\ofxflobj.ini
C:\WINDOWS\SYSTEM32\oognqwkq.ini
C:\WINDOWS\SYSTEM32\oufrpeds.ini
C:\WINDOWS\SYSTEM32\oxyfjhwa.ini
C:\WINDOWS\SYSTEM32\pprijqhf.ini
C:\WINDOWS\SYSTEM32\puculuhy.ini
C:\WINDOWS\SYSTEM32\rewjlbep.ini
C:\WINDOWS\SYSTEM32\tpkoyoea.ini
C:\WINDOWS\SYSTEM32\tqhttets.ini
C:\WINDOWS\SYSTEM32\tytemlnm.ini
C:\WINDOWS\SYSTEM32\vsrrdylm.ini
C:\WINDOWS\SYSTEM32\xgqyrpni.ini
C:\WINDOWS\SYSTEM32\xooaomjm.ini
C:\WINDOWS\SYSTEM32\xotboipg.ini
C:\WINDOWS\SYSTEM32\xpdbncvm.ini
C:\WINDOWS\SYSTEM32\ytytwepr.ini
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\SYSTEM32\btvxjnce.ini
C:\WINDOWS\SYSTEM32\chwxhmmf.ini
C:\WINDOWS\SYSTEM32\cirueasx.ini
C:\WINDOWS\SYSTEM32\gxgjmrhb.ini
C:\WINDOWS\SYSTEM32\jinvuulv.ini
C:\WINDOWS\SYSTEM32\jpiqejvx.ini
C:\WINDOWS\SYSTEM32\kahindwu.ini
C:\WINDOWS\SYSTEM32\kltgfybn.ini
C:\WINDOWS\SYSTEM32\koxuytol.ini
C:\WINDOWS\SYSTEM32\lkgjgnxy.ini
C:\WINDOWS\SYSTEM32\lujpuouu.ini
C:\WINDOWS\SYSTEM32\nkgudkqh.ini
C:\WINDOWS\SYSTEM32\ofxflobj.ini
C:\WINDOWS\SYSTEM32\oognqwkq.ini
C:\WINDOWS\SYSTEM32\oufrpeds.ini
C:\WINDOWS\SYSTEM32\oxyfjhwa.ini
C:\WINDOWS\SYSTEM32\pprijqhf.ini
C:\WINDOWS\SYSTEM32\puculuhy.ini
C:\WINDOWS\SYSTEM32\rewjlbep.ini
C:\WINDOWS\SYSTEM32\tpkoyoea.ini
C:\WINDOWS\SYSTEM32\tqhttets.ini
C:\WINDOWS\SYSTEM32\tytemlnm.ini
C:\WINDOWS\SYSTEM32\vsrrdylm.ini
C:\WINDOWS\SYSTEM32\xgqyrpni.ini
C:\WINDOWS\SYSTEM32\xooaomjm.ini
C:\WINDOWS\SYSTEM32\xotboipg.ini
C:\WINDOWS\SYSTEM32\xpdbncvm.ini
C:\WINDOWS\SYSTEM32\ytytwepr.ini

.
((((((((((((((((((((((((( Files Created from 2008-01-19 to 2008-02-19 )))))))))))))))))))))))))))))))
.

2008-02-18 07:19 . 2008-02-18 07:19 <DIR> d--hs---- C:\FOUND.000
2008-02-16 21:09 . 2008-02-16 21:09 <DIR> d-------- C:\Program Files\Trend Micro
2008-02-16 14:48 . 2008-02-16 14:48 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-02-16 14:47 . 2008-02-16 14:47 <DIR> d-------- C:\WINDOWS\SYSTEM32\Kaspersky Lab
2008-02-15 09:04 . 2008-02-18 13:10 6,014 --a------ C:\WINDOWS\BMd711e700.xml
2008-02-15 09:04 . 2008-02-19 07:11 22 --a------ C:\WINDOWS\pskt.ini
2008-02-15 08:33 . 2008-02-15 08:33 <DIR> d-------- C:\mGame
2008-02-07 18:15 . 2008-02-07 18:15 67 --a------ C:\WINDOWS\101_ASB.INI
2008-02-07 18:14 . 2008-02-07 18:14 <DIR> d-------- C:\DISNEY
2008-02-02 21:39 . 2008-02-02 21:39 <DIR> d-------- C:\Documents and Settings\fjw\DoctorWeb
2008-01-31 22:34 . 2008-01-31 22:34 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-01-25 16:27 . 2008-01-25 16:27 110 --a------ C:\WINDOWS\HandySnap.INI
2008-01-22 22:01 . 2008-01-22 22:01 <DIR> d-------- C:\OutputFolder
2008-01-22 21:59 . 2008-01-22 21:59 <DIR> d-------- C:\Program Files\FLV to AVI MPEG WMV 3GP MP4 iPod Converter

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-17 19:10 15,360 ----a-w C:\WINDOWS\SYSTEM32\ctfmon .exe
2008-02-17 03:04 158,208 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\MSConfig .exe
2008-02-17 02:23 500,736 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe.tmp
2008-01-16 14:39 186,000 ----a-w C:\Documents and Settings\fjw\Application Data\GDIPFONTCACHEV1.DAT
2008-01-14 13:49 155,648 ----a-w C:\WINDOWS\SYSTEM32\NeroCheck .exe
2008-01-11 05:53 44,544 ----a-w C:\WINDOWS\SYSTEM32\dllcache\pngfilt.dll
2007-12-26 05:07 8,413 ----a-w C:\WINDOWS\system32\drivers\mcstrm.sys
2007-12-26 05:07 --------- d-----w C:\Program Files\Common Files\Real
2007-12-26 05:03 --------- d-----w C:\Program Files\Best Buy Rhapsody
2007-12-19 23:01 347,136 ----a-w C:\WINDOWS\SYSTEM32\dllcache\dxtmsft.dll
2007-12-18 09:51 179,584 ----a-w C:\WINDOWS\SYSTEM32\dllcache\mrxdav.sys
2007-12-14 17:32 12,632 ----a-w C:\WINDOWS\SYSTEM32\lsdelete.exe
2007-12-08 05:21 3,592,192 ------w C:\WINDOWS\SYSTEM32\dllcache\mshtml.dll
2007-12-06 11:01 625,664 ------w C:\WINDOWS\SYSTEM32\dllcache\iexplore.exe
2007-12-06 11:00 70,656 ------w C:\WINDOWS\SYSTEM32\dllcache\ie4uinit.exe
2007-12-06 11:00 13,824 ------w C:\WINDOWS\SYSTEM32\dllcache\ieudinit.exe
2007-12-06 04:59 161,792 ------w C:\WINDOWS\SYSTEM32\dllcache\ieakui.dll
2007-12-04 18:38 550,912 ----a-w C:\WINDOWS\SYSTEM32\dllcache\oleaut32.dll
2007-12-04 18:38 550,912 ------w C:\WINDOWS\SYSTEM32\oleaut32.dll
2006-12-23 16:04 32 ----a-r C:\Documents and Settings\All Users\hash.dat
2006-01-11 02:13 159,312 ----a-w C:\Documents and Settings\Jeremy\Application Data\GDIPFONTCACHEV1.DAT
2005-11-05 03:58 33,750 ----a-w C:\WINDOWS\Internet Logs\GLB98_2nd_2005_11_04_21_58_33.dmp.zip
2005-11-05 03:58 33,668 ------w C:\WINDOWS\Internet Logs\GLB8F_2nd_2005_11_04_21_57_55.dmp.zip
2005-10-05 00:50 89,304 ------w C:\WINDOWS\Internet Logs\vsmon_2nd_2005_10_04_18_41_53_small.dmp.zip
2005-10-05 00:50 79,592 ------w C:\WINDOWS\Internet Logs\vsmon_2nd_2005_10_04_18_41_35_small.dmp.zip
2005-10-05 00:50 79,542 ------w C:\WINDOWS\Internet Logs\vsmon_2nd_2005_10_04_18_42_35_small.dmp.zip
2005-10-05 00:40 12,377,066 ------w C:\WINDOWS\Internet Logs\ZLCLIENT_2nd_2005_10_04_17_59_25_full.dmp.zip
2005-04-04 22:23 0 ---h--w C:\Program Files\AppUpdate.log
2004-09-21 20:07 86,016 ----a-w C:\Program Files\SPInstall.exe
2004-09-21 16:54 975 ----a-w C:\Program Files\ReadMe.txt
2004-09-21 16:05 1,841 ----a-w C:\Program Files\PackingList.txt
2004-09-21 15:36 908 ----a-w C:\Program Files\Setup.ini
2004-09-21 15:36 19,443,744 ----a-w C:\Program Files\Data1.cab
2004-09-21 15:36 1,591,952 ----a-w C:\Program Files\SundayPlus.msi
2004-09-21 15:35 225,280 ----a-w C:\Program Files\SPSetupHelper.exe
2004-09-15 02:35 49,152 ----a-w C:\Program Files\EnglishUI.dll
2004-04-23 00:02 560 ----a-w C:\Program Files\Global.sw
2004-01-10 02:34 266 --sh--w C:\Program Files\desktop.ini
2003-02-25 15:04 4,632 ----a-w C:\Program Files\0x0409.ini
2006-03-27 03:50 3,766 --sha-w C:\WINDOWS\SYSTEM32\KGyGaAvL.sys
2006-03-27 03:50 88 --sh--r C:\WINDOWS\SYSTEM32\D4B12B0226.sys
.

<pre>
----a-w 155,648 2008-01-14 13:49:00 C:\WINDOWS\SYSTEM32\NeroCheck .exe
----a-w 15,360 2008-02-17 19:10:12 C:\WINDOWS\SYSTEM32\ctfmon .exe
----a-w 158,208 2008-02-17 03:04:04 C:\WINDOWS\pchealth\helpctr\binaries\MSConfig .exe
----a-w 649,728 2008-01-14 22:45:12 C:\Program Files\QuickTime\qttask .exe
----a-w 649,728 2008-01-15 05:18:12 C:\Program Files\QuickTime\qttask .exe
----a-w 649,728 2008-01-15 13:34:46 C:\Program Files\QuickTime\qttask .exe
----a-w 649,728 2008-01-16 04:01:32 C:\Program Files\QuickTime\qttask .exe
----a-w 649,728 2008-01-16 13:52:08 C:\Program Files\QuickTime\qttask .exe
----a-w 649,728 2008-01-17 13:34:58 C:\Program Files\QuickTime\qttask .exe
----a-w 282,624 2008-01-17 13:35:46 C:\Program Files\QuickTime\qttask .exe
----a-w 1,235,456 2008-01-15 05:18:08 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-15 13:34:42 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-16 04:01:30 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-16 13:52:06 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-17 13:34:56 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-18 13:01:00 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-19 05:28:52 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-19 14:49:44 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-19 22:07:26 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-20 13:05:32 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-21 00:57:40 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-21 13:45:58 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-22 13:30:02 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-24 13:23:50 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-25 13:12:52 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-26 14:00:48 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-27 13:10:08 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-28 00:02:38 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-29 13:21:38 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-30 13:26:08 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-30 15:22:54 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-30 16:10:46 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-31 12:52:42 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-31 13:46:00 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-01 04:46:42 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-01 13:14:42 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-02 13:54:24 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-02 16:06:34 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-02 23:20:48 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-03 00:33:20 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-03 03:53:04 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-03 13:09:24 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-04 13:50:12 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-05 14:56:58 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-05 18:28:32 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-06 14:46:12 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-06 16:40:16 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-06 17:39:54 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-07 13:29:04 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-08 13:12:16 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-09 13:36:42 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-10 12:43:56 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-11 13:05:44 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-12 13:11:24 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-13 13:05:02 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-14 01:54:00 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-14 13:11:14 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-15 13:22:34 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-16 14:04:36 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-16 16:48:18 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-16 19:32:28 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-16 20:49:34 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,743,360 2008-01-14 22:45:08 C:\Program Files\TGTSoft\StyleXP\StyleXP .exe
----a-w 1,372,160 2008-01-17 13:35:48 C:\Program Files\TGTSoft\StyleXP\StyleXP .exe
----a-w 1,694,208 2008-02-14 00:24:30 C:\Program Files\Messenger\msmsgs .exe
</pre>


-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SlowFile Icon Overlay]
@={7D688A77-C613-11D0-999B-00C04FD655E1}

[HKEY_CLASSES_ROOT\CLSID\{7D688A77-C613-11D0-999B-00C04FD655E1}]
2007-10-25 21:34 8460288 --a------ C:\WINDOWS\SYSTEM32\SHELL32.DLL

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:07 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-06-01 16:22 7618560]
"nwiz"="nwiz.exe" [2006-06-01 16:22 1519616 C:\WINDOWS\SYSTEM32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-06-01 16:22 86016]
"Tweak UI"="TWEAKUI.CPL" [2000-06-18 14:03 106544 C:\WINDOWS\SYSTEM32\TWEAKUI.CPL]
"ATIPTA"="atiptaxx.exe" [2001-09-27 01:39 245760 C:\WINDOWS\SYSTEM32\atiptaxx.exe]

C:\Documents and Settings\fjw\Start Menu\Programs\Startup\
Stardock ObjectDock.lnk - C:\Program Files\Stardock\ObjectDock\ObjectDock.exe [2007-01-08 21:22:17 2746104]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"<NO NAME>"= 00000000
"NoFavoritesMenu"= 01000000
"NoLogoff"= 0 (0x0)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"<NO NAME>"= 00000000
"NoFavoritesMenu"= 01000000
"NoActiveDesktopChanges"= 0 (0x0)
"NoLogoff"= 0 (0x0)



Continued in next post

[didymustoo]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="C:\\WINDOWS\\system32\\logonuiX.exe"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Corel MEDIA FOLDERS INDEXER 8.LNK]
backup=C:\WINDOWS\pss\Corel MEDIA FOLDERS INDEXER 8.LNKCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Encoder Agent.lnk]
backup=C:\WINDOWS\pss\Encoder Agent.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone Fast Start.lnk]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Cody^Start Menu^Programs^Startup^LimeWire On Startup.lnk]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AtiPTA]
--a------ 2001-09-27 01:39 245760 C:\WINDOWS\SYSTEM32\atiptaxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AuthConsoleStart]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearShare]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cmaudio]


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Corel Photo Downloader]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DesktopIconToy]
--a------ 2006-10-26 21:03 278528 C:\Program Files\Desktop Icon Toy\DesktopIconToy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ESP]
--a------ 2006-07-30 12:09 63008 C:\Program Files\Cox\Applications\app\start.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FolderShare]
--a------ 2008-02-16 14:49 1235456 C:\Program Files\FolderShare\FolderShare .exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a------ 2004-09-13 15:49 49152 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
--a------ 2003-03-26 05:34 172032 C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
--a------ 2005-06-10 10:44 249856 C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
--a------ 2005-06-10 10:44 81920 C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
C:\WINDOWS\system32\dumprep 0 -k

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogonStudio]
C:\Program Files\WinCustomize\LogonStudio\logonstudio.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Mobipocket Reader Notifications]
--a------ 2006-06-20 16:54 57344 C:\Program Files\Mobipocket.com\Mobipocket Reader\readernotify.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2008-02-13 18:24 2226688 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-01-17 07:35 282624 C:\Program Files\QuickTime\qttask .exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
--a------ 2008-02-16 14:49 2441216 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StarSkin]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\STYLEXP]
--a------ 2008-01-17 07:35 1372160 C:\Program Files\TGTSoft\StyleXP\StyleXP .exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TheMonitor]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a------ 2007-05-14 17:22 35328 C:\Program Files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"UPS"=3 (0x3)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"msnmsgr"="C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE" /background
"LogitechSoftwareUpdate"="C:\PROGRAM FILES\LOGITECH\VIDEO\MANIFESTENGINE.EXE" boot

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\setup\disabledrunkeys]
"Tweak UI"=RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
"SiS Tray"=C:\WINDOWS\SYSTEM32\sistray.exe
"StillImageMonitor"=C:\WINDOWS\SYSTEM32\stimon.exe

R2 ppsio2;PPDevice;C:\WINDOWS\system32\drivers\ppsio2.sys [1999-04-01 19:16]
R3 ati2mtaa;ati2mtaa;C:\WINDOWS\system32\DRIVERS\ati2mtaa.sys [2001-09-27 00:32]
S3 BCM42XX;Broadcom iLine10(tm) Network Adapter Driver;C:\WINDOWS\system32\DRIVERS\bcm42xx5.sys [2001-08-17 12:11]
S3 dump_wmimmc;dump_wmimmc;C:\Program Files\Gpotato\Flyff\GameGuard\dump_wmimmc.sys []
S3 PhilCam8116;Logitech QuickCam Pro 3000 (08B0);C:\WINDOWS\system32\DRIVERS\CamDrO21.sys [2001-08-17 14:05]
S3 XDva090;XDva090;C:\WINDOWS\system32\XDva090.sys []


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\MmoptPreferredAudioDevices]
rundll32.exe shell32.dll,Control_RunDLL mmsys.cpl,@0,SUSB\VID_046D&PID_08B0&MI_01\1USB&VID_046D&PID_08B0&INST_0

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9EF0045A-CDD9-438e-95E6-02B9AFEC8E11}]
C:\WINDOWS\SYSTEM32\updcrl.exe -e -u C:\WINDOWS\SYSTEM\verisignpub1.crl
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-19 12:43:45
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-19 12:44:14
ComboFix-quarantined-files.txt 2008-02-19 18:44:14
ComboFix2.txt 2008-02-19 14:55:02
.
2008-02-15 05:58:29 --- E O F ---


and here is the HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:47:14 PM, on 2/19/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
c:\Program Files\Common Files\Command Software\dvpapi.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\atiptaxx.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\WINDOWS\SYSTEM32\LVCOMSX.EXE
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Opera\Opera.exe
C:\Program Files\Trend Micro\HijackThis\didymustoo.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
N3 - Netscape 7: user_pref("browser.search.defaultengine", "http://www.google.com/"); (C:\Documents and Settings\FJW\Application Data\Mozilla\Profiles\default\brw22mi9.slt\prefs.js)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll
O3 - Toolbar: (no name) - {2C0A5F28-48D8-408B-9172-9C6121025BCE} - (no file)
O3 - Toolbar: TextAloud - {F053C368-5458-45B2-9B4D-D8914BDDDBFF} - C:\PROGRA~1\TEXTAL~1\TAForIE.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Search - ?p=ZJfox000
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {03A0F84E-3E69-4B3E-B4D3-019CB73B57B3} (AuthWebWizardMain.DHTMLPage1) - http://www3.authentium.com/cssrelease/bin/WizMain.exe
O16 - DPF: {1B4F9DD7-2D7C-44B5-9126-73206DA0AE75} (CNavigationManager Object) - http://www3.authentium.com/cssrelease/bin/wizard.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photo.walgreens.com/WalgreensActivia.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-3-36.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111401/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {7C5D062A-7A1E-4A46-A02B-A928084CBD66} (MLauncherNew Class) - http://legendofares.netgame.com/download/MusaLauncherNew.cab
O16 - DPF: {9C024426-7859-4B2D-AB4C-B1E370AE7549} - http://us.mcafee.com/Apps/WSC/en-us/WscWlanScannerCtrl.cab
O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex/EPSControl_v1-32.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?326
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,1,0,4692/mcfscan.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - c:\Program Files\Common Files\Command Software\dvpapi.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 5640 bytes

[Shaba]

Hi

Boot in safe mode

Open notepad and copy/paste the text in the quotebox below into it:


RenV::
----a-w 155,648 2008-01-14 13:49:00 C:\WINDOWS\SYSTEM32\NeroCheck .exe
----a-w 15,360 2008-02-17 19:10:12 C:\WINDOWS\SYSTEM32\ctfmon .exe
----a-w 158,208 2008-02-17 03:04:04 C:\WINDOWS\pchealth\helpctr\binaries\MSConfig .exe
----a-w 649,728 2008-01-14 22:45:12 C:\Program Files\QuickTime\qttask .exe
----a-w 649,728 2008-01-15 05:18:12 C:\Program Files\QuickTime\qttask .exe
----a-w 649,728 2008-01-15 13:34:46 C:\Program Files\QuickTime\qttask .exe
----a-w 649,728 2008-01-16 04:01:32 C:\Program Files\QuickTime\qttask .exe
----a-w 649,728 2008-01-16 13:52:08 C:\Program Files\QuickTime\qttask .exe
----a-w 649,728 2008-01-17 13:34:58 C:\Program Files\QuickTime\qttask .exe
----a-w 282,624 2008-01-17 13:35:46 C:\Program Files\QuickTime\qttask .exe
----a-w 1,235,456 2008-01-15 05:18:08 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-15 13:34:42 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-16 04:01:30 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-16 13:52:06 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-17 13:34:56 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-18 13:01:00 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-19 05:28:52 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-19 14:49:44 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-19 22:07:26 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-20 13:05:32 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-21 00:57:40 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-21 13:45:58 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-22 13:30:02 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-24 13:23:50 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-25 13:12:52 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-26 14:00:48 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-27 13:10:08 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-28 00:02:38 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-29 13:21:38 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-30 13:26:08 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-30 15:22:54 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-30 16:10:46 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-31 12:52:42 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-31 13:46:00 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-01 04:46:42 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-01 13:14:42 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-02 13:54:24 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-02 16:06:34 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-02 23:20:48 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-03 00:33:20 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-03 03:53:04 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-03 13:09:24 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-04 13:50:12 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-05 14:56:58 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-05 18:28:32 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-06 14:46:12 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-06 16:40:16 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-06 17:39:54 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-07 13:29:04 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-08 13:12:16 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-09 13:36:42 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-10 12:43:56 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-11 13:05:44 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-12 13:11:24 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-13 13:05:02 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-14 01:54:00 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-14 13:11:14 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-15 13:22:34 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-16 14:04:36 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-16 16:48:18 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-16 19:32:28 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-16 20:49:34 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,743,360 2008-01-14 22:45:08 C:\Program Files\TGTSoft\StyleXP\StyleXP .exe
----a-w 1,372,160 2008-01-17 13:35:48 C:\Program Files\TGTSoft\StyleXP\StyleXP .exe
----a-w 1,694,208 2008-02-14 00:24:30 C:\Program Files\Messenger\msmsgs .exe


Save this as "CFScript"

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

http://users.pandora.be/bluepatchy/miekiemoes/images/CFScript.gif

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.

Combofix should never take more that 20 minutes including the reboot if malware is detected.
If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
If that happened we want to know, and also what process you had to end.

[didymustoo]

Combofix log part 1:

ComboFix 08-02-19.2 - fjw 2008-02-19 13:12:14.3 - FAT32x86 MINIMAL
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.794 [GMT -6:00]
Running from: C:\Documents and Settings\fjw\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\fjw\Desktop\CFScript.txt

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-01-19 to 2008-02-19 )))))))))))))))))))))))))))))))
.

2008-02-18 07:19 . 2008-02-18 07:19 <DIR> d--hs---- C:\FOUND.000
2008-02-16 21:09 . 2008-02-16 21:09 <DIR> d-------- C:\Program Files\Trend Micro
2008-02-16 14:48 . 2008-02-16 14:48 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-02-16 14:47 . 2008-02-16 14:47 <DIR> d-------- C:\WINDOWS\SYSTEM32\Kaspersky Lab
2008-02-15 09:04 . 2008-02-18 13:10 6,014 --a------ C:\WINDOWS\BMd711e700.xml
2008-02-15 09:04 . 2008-02-19 07:11 22 --a------ C:\WINDOWS\pskt.ini
2008-02-15 08:33 . 2008-02-15 08:33 <DIR> d-------- C:\mGame
2008-02-07 18:15 . 2008-02-07 18:15 67 --a------ C:\WINDOWS\101_ASB.INI
2008-02-07 18:14 . 2008-02-07 18:14 <DIR> d-------- C:\DISNEY
2008-02-02 21:39 . 2008-02-02 21:39 <DIR> d-------- C:\Documents and Settings\fjw\DoctorWeb
2008-01-31 22:34 . 2008-01-31 22:34 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-01-25 16:27 . 2008-01-25 16:27 110 --a------ C:\WINDOWS\HandySnap.INI
2008-01-22 22:01 . 2008-01-22 22:01 <DIR> d-------- C:\OutputFolder
2008-01-22 21:59 . 2008-01-22 21:59 <DIR> d-------- C:\Program Files\FLV to AVI MPEG WMV 3GP MP4 iPod Converter

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-17 19:10 15,360 ----a-w C:\WINDOWS\SYSTEM32\ctfmon .exe
2008-02-17 03:04 158,208 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\MSConfig .exe
2008-02-17 02:23 500,736 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe.tmp
2008-01-16 14:39 186,000 ----a-w C:\Documents and Settings\fjw\Application Data\GDIPFONTCACHEV1.DAT
2008-01-14 13:49 155,648 ----a-w C:\WINDOWS\SYSTEM32\NeroCheck.exe
2008-01-11 05:53 44,544 ----a-w C:\WINDOWS\SYSTEM32\dllcache\pngfilt.dll
2007-12-26 05:07 8,413 ----a-w C:\WINDOWS\system32\drivers\mcstrm.sys
2007-12-26 05:07 --------- d-----w C:\Program Files\Common Files\Real
2007-12-26 05:03 --------- d-----w C:\Program Files\Best Buy Rhapsody
2007-12-19 23:01 347,136 ----a-w C:\WINDOWS\SYSTEM32\dllcache\dxtmsft.dll
2007-12-18 09:51 179,584 ----a-w C:\WINDOWS\SYSTEM32\dllcache\mrxdav.sys
2007-12-14 17:32 12,632 ----a-w C:\WINDOWS\SYSTEM32\lsdelete.exe
2007-12-08 05:21 3,592,192 ------w C:\WINDOWS\SYSTEM32\dllcache\mshtml.dll
2007-12-06 11:01 625,664 ------w C:\WINDOWS\SYSTEM32\dllcache\iexplore.exe
2007-12-06 11:00 70,656 ------w C:\WINDOWS\SYSTEM32\dllcache\ie4uinit.exe
2007-12-06 11:00 13,824 ------w C:\WINDOWS\SYSTEM32\dllcache\ieudinit.exe
2007-12-06 04:59 161,792 ------w C:\WINDOWS\SYSTEM32\dllcache\ieakui.dll
2007-12-04 18:38 550,912 ----a-w C:\WINDOWS\SYSTEM32\dllcache\oleaut32.dll
2007-12-04 18:38 550,912 ------w C:\WINDOWS\SYSTEM32\oleaut32.dll
2006-12-23 16:04 32 ----a-r C:\Documents and Settings\All Users\hash.dat
2006-01-11 02:13 159,312 ----a-w C:\Documents and Settings\Jeremy\Application Data\GDIPFONTCACHEV1.DAT
2005-11-05 03:58 33,750 ----a-w C:\WINDOWS\Internet Logs\GLB98_2nd_2005_11_04_21_58_33.dmp.zip
2005-11-05 03:58 33,668 ------w C:\WINDOWS\Internet Logs\GLB8F_2nd_2005_11_04_21_57_55.dmp.zip
2005-10-05 00:50 89,304 ------w C:\WINDOWS\Internet Logs\vsmon_2nd_2005_10_04_18_41_53_small.dmp.zip
2005-10-05 00:50 79,592 ------w C:\WINDOWS\Internet Logs\vsmon_2nd_2005_10_04_18_41_35_small.dmp.zip
2005-10-05 00:50 79,542 ------w C:\WINDOWS\Internet Logs\vsmon_2nd_2005_10_04_18_42_35_small.dmp.zip
2005-10-05 00:40 12,377,066 ------w C:\WINDOWS\Internet Logs\ZLCLIENT_2nd_2005_10_04_17_59_25_full.dmp.zip
2005-04-04 22:23 0 ---h--w C:\Program Files\AppUpdate.log
2004-09-21 20:07 86,016 ----a-w C:\Program Files\SPInstall.exe
2004-09-21 16:54 975 ----a-w C:\Program Files\ReadMe.txt
2004-09-21 16:05 1,841 ----a-w C:\Program Files\PackingList.txt
2004-09-21 15:36 908 ----a-w C:\Program Files\Setup.ini
2004-09-21 15:36 19,443,744 ----a-w C:\Program Files\Data1.cab
2004-09-21 15:36 1,591,952 ----a-w C:\Program Files\SundayPlus.msi
2004-09-21 15:35 225,280 ----a-w C:\Program Files\SPSetupHelper.exe
2004-09-15 02:35 49,152 ----a-w C:\Program Files\EnglishUI.dll
2004-04-23 00:02 560 ----a-w C:\Program Files\Global.sw
2004-01-10 02:34 266 --sh--w C:\Program Files\desktop.ini
2003-02-25 15:04 4,632 ----a-w C:\Program Files\0x0409.ini
2006-03-27 03:50 3,766 --sha-w C:\WINDOWS\SYSTEM32\KGyGaAvL.sys
2006-03-27 03:50 88 --sh--r C:\WINDOWS\SYSTEM32\D4B12B0226.sys
.

<pre>
----a-w 15,360 2008-02-17 19:10:12 C:\WINDOWS\SYSTEM32\ctfmon .exe
----a-w 158,208 2008-02-17 03:04:04 C:\WINDOWS\pchealth\helpctr\binaries\MSConfig .exe
----a-w 649,728 2008-01-14 22:45:12 C:\Program Files\QuickTime\qttask .exe
----a-w 649,728 2008-01-15 05:18:12 C:\Program Files\QuickTime\qttask .exe
----a-w 649,728 2008-01-15 13:34:46 C:\Program Files\QuickTime\qttask .exe
----a-w 649,728 2008-01-16 04:01:32 C:\Program Files\QuickTime\qttask .exe
----a-w 649,728 2008-01-16 13:52:08 C:\Program Files\QuickTime\qttask .exe
----a-w 649,728 2008-01-17 13:34:58 C:\Program Files\QuickTime\qttask .exe
----a-w 282,624 2008-01-17 13:35:46 C:\Program Files\QuickTime\qttask .exe
----a-w 1,235,456 2008-01-15 05:18:08 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-15 13:34:42 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-16 04:01:30 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-16 13:52:06 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-17 13:34:56 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-18 13:01:00 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-19 05:28:52 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-19 14:49:44 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-19 22:07:26 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-20 13:05:32 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-21 00:57:40 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-21 13:45:58 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-22 13:30:02 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-24 13:23:50 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-25 13:12:52 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-26 14:00:48 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-27 13:10:08 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-28 00:02:38 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-29 13:21:38 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-30 13:26:08 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-30 15:22:54 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-30 16:10:46 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-31 12:52:42 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-01-31 13:46:00 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-01 04:46:42 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-01 13:14:42 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-02 13:54:24 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-02 16:06:34 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-02 23:20:48 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-03 00:33:20 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-03 03:53:04 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-03 13:09:24 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-04 13:50:12 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-05 14:56:58 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-05 18:28:32 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-06 14:46:12 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-06 16:40:16 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-06 17:39:54 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-07 13:29:04 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-08 13:12:16 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-09 13:36:42 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-10 12:43:56 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-11 13:05:44 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-12 13:11:24 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-13 13:05:02 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-14 01:54:00 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-14 13:11:14 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-15 13:22:34 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-16 14:04:36 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-16 16:48:18 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-16 19:32:28 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,235,456 2008-02-16 20:49:34 C:\Program Files\FolderShare\FolderShare .exe
----a-w 1,743,360 2008-01-14 22:45:08 C:\Program Files\TGTSoft\StyleXP\StyleXP .exe
----a-w 1,372,160 2008-01-17 13:35:48 C:\Program Files\TGTSoft\StyleXP\StyleXP .exe
----a-w 1,694,208 2008-02-14 00:24:30 C:\Program Files\Messenger\msmsgs .exe
</pre>


-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SlowFile Icon Overlay]
@={7D688A77-C613-11D0-999B-00C04FD655E1}

[HKEY_CLASSES_ROOT\CLSID\{7D688A77-C613-11D0-999B-00C04FD655E1}]
2007-10-25 21:34 8460288 --a------ C:\WINDOWS\SYSTEM32\SHELL32.DLL

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:07 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-06-01 16:22 7618560]
"nwiz"="nwiz.exe" [2006-06-01 16:22 1519616 C:\WINDOWS\SYSTEM32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-06-01 16:22 86016]
"Tweak UI"="TWEAKUI.CPL" [2000-06-18 14:03 106544 C:\WINDOWS\SYSTEM32\TWEAKUI.CPL]
"ATIPTA"="atiptaxx.exe" [2001-09-27 01:39 245760 C:\WINDOWS\SYSTEM32\atiptaxx.exe]

C:\Documents and Settings\fjw\Start Menu\Programs\Startup\
Stardock ObjectDock.lnk - C:\Program Files\Stardock\ObjectDock\ObjectDock.exe [2007-01-08 21:22:17 2746104]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"<NO NAME>"= 00000000
"NoFavoritesMenu"= 01000000
"NoLogoff"= 0 (0x0)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"<NO NAME>"= 00000000
"NoFavoritesMenu"= 01000000
"NoActiveDesktopChanges"= 0 (0x0)
"NoLogoff"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="C:\\WINDOWS\\system32\\logonuiX.exe"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Corel MEDIA FOLDERS INDEXER 8.LNK]
backup=C:\WINDOWS\pss\Corel MEDIA FOLDERS INDEXER 8.LNKCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Encoder Agent.lnk]
backup=C:\WINDOWS\pss\Encoder Agent.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone Fast Start.lnk]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Cody^Start Menu^Programs^Startup^LimeWire On Startup.lnk]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AtiPTA]
--a------ 2001-09-27 01:39 245760 C:\WINDOWS\SYSTEM32\atiptaxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AuthConsoleStart]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearShare]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cmaudio]


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Corel Photo Downloader]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DesktopIconToy]
--a------ 2006-10-26 21:03 278528 C:\Program Files\Desktop Icon Toy\DesktopIconToy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ESP]
--a------ 2006-07-30 12:09 63008 C:\Program Files\Cox\Applications\app\start.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FolderShare]
--a------ 2008-02-16 14:49 1235456 C:\Program Files\FolderShare\FolderShare .exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a------ 2004-09-13 15:49 49152 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
--a------ 2003-03-26 05:34 172032 C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
--a------ 2005-06-10 10:44 249856 C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe

[didymustoo]

Combofix log part 2:


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
--a------ 2005-06-10 10:44 81920 C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
C:\WINDOWS\system32\dumprep 0 -k

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogonStudio]
C:\Program Files\WinCustomize\LogonStudio\logonstudio.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Mobipocket Reader Notifications]
--a------ 2006-06-20 16:54 57344 C:\Program Files\Mobipocket.com\Mobipocket Reader\readernotify.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2008-02-13 18:24 2226688 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2008-01-14 07:49 155648 C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-01-17 07:35 282624 C:\Program Files\QuickTime\qttask .exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
--a------ 2008-02-16 14:49 2441216 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StarSkin]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\STYLEXP]
--a------ 2008-01-17 07:35 1372160 C:\Program Files\TGTSoft\StyleXP\StyleXP .exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TheMonitor]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a------ 2007-05-14 17:22 35328 C:\Program Files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"UPS"=3 (0x3)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"msnmsgr"="C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE" /background
"LogitechSoftwareUpdate"="C:\PROGRAM FILES\LOGITECH\VIDEO\MANIFESTENGINE.EXE" boot

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\setup\disabledrunkeys]
"Tweak UI"=RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
"SiS Tray"=C:\WINDOWS\SYSTEM32\sistray.exe
"StillImageMonitor"=C:\WINDOWS\SYSTEM32\stimon.exe

S2 ppsio2;PPDevice;C:\WINDOWS\system32\drivers\ppsio2.sys [1999-04-01 19:16]
S3 ati2mtaa;ati2mtaa;C:\WINDOWS\system32\DRIVERS\ati2mtaa.sys [2001-09-27 00:32]
S3 BCM42XX;Broadcom iLine10(tm) Network Adapter Driver;C:\WINDOWS\system32\DRIVERS\bcm42xx5.sys [2001-08-17 12:11]
S3 dump_wmimmc;dump_wmimmc;C:\Program Files\Gpotato\Flyff\GameGuard\dump_wmimmc.sys []
S3 PhilCam8116;Logitech QuickCam Pro 3000 (08B0);C:\WINDOWS\system32\DRIVERS\CamDrO21.sys [2001-08-17 14:05]
S3 XDva090;XDva090;C:\WINDOWS\system32\XDva090.sys []

*Newly Created Service* - MVDCODEC

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\MmoptPreferredAudioDevices]
rundll32.exe shell32.dll,Control_RunDLL mmsys.cpl,@0,SUSB\VID_046D&PID_08B0&MI_01\1USB&VID_046D&PID_08B0&INST_0

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9EF0045A-CDD9-438e-95E6-02B9AFEC8E11}]
C:\WINDOWS\SYSTEM32\updcrl.exe -e -u C:\WINDOWS\SYSTEM\verisignpub1.crl
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-19 13:15:34
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-19 13:16:21
ComboFix-quarantined-files.txt 2008-02-19 19:16:18
ComboFix3.txt 2008-02-19 14:55:02
ComboFix2.txt 2008-02-19 18:44:16
.
2008-02-15 05:58:29 --- E O F ---


HFT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:17:22 PM, on 2/19/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Safe mode

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\didymustoo.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
N3 - Netscape 7: user_pref("browser.search.defaultengine", "http://www.google.com/"); (C:\Documents and Settings\FJW\Application Data\Mozilla\Profiles\default\brw22mi9.slt\prefs.js)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll
O3 - Toolbar: (no name) - {2C0A5F28-48D8-408B-9172-9C6121025BCE} - (no file)
O3 - Toolbar: TextAloud - {F053C368-5458-45B2-9B4D-D8914BDDDBFF} - C:\PROGRA~1\TEXTAL~1\TAForIE.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Search - ?p=ZJfox000
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {03A0F84E-3E69-4B3E-B4D3-019CB73B57B3} (AuthWebWizardMain.DHTMLPage1) - http://www3.authentium.com/cssrelease/bin/WizMain.exe
O16 - DPF: {1B4F9DD7-2D7C-44B5-9126-73206DA0AE75} (CNavigationManager Object) - http://www3.authentium.com/cssrelease/bin/wizard.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photo.walgreens.com/WalgreensActivia.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-3-36.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111401/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {7C5D062A-7A1E-4A46-A02B-A928084CBD66} (MLauncherNew Class) - http://legendofares.netgame.com/download/MusaLauncherNew.cab
O16 - DPF: {9C024426-7859-4B2D-AB4C-B1E370AE7549} - http://us.mcafee.com/Apps/WSC/en-us/WscWlanScannerCtrl.cab
O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex/EPSControl_v1-32.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?326
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,1,0,4692/mcfscan.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - c:\Program Files\Common Files\Command Software\dvpapi.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 5233 bytes

[Shaba]

Hi

Yes, no go.

That will mean that you will need to re-install some startup programs.

Make windows to show file extensions, see here (http://www.granneman.com/techinfo/windows/showextensions/)

Rename these files:

C:\WINDOWS\SYSTEM32\ctfmon .exe
C:\WINDOWS\pchealth\helpctr\binaries\MSConfig .exe
C:\Program Files\Messenger\msmsgs .exe

to these:

C:\WINDOWS\SYSTEM32\ctfmon.exe
C:\WINDOWS\pchealth\helpctr\binaries\MSConfig.exe
C:\Program Files\Messenger\msmsgs.exe

Uninstall via add/remove programs:

QuickTime
FolderShare
StyleXP

Open notepad and copy/paste the text in the quotebox below into it:


File::
C:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe.tmp

Folder::
C:\Program Files\TGTSoft\StyleXP
C:\Program Files\FolderShare
C:\Program Files\QuickTime


Save this as "CFScript"

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

http://users.pandora.be/bluepatchy/miekiemoes/images/CFScript.gif

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.

Combofix should never take more that 20 minutes including the reboot if malware is detected.
If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
If that happened we want to know, and also what process you had to end.

[didymustoo]

I tried renaming ctfmon .exe to ctfmon.exe. I received this message, “Cannot rename ctfmon : A file with the name you specified already exists. Specify a different name.”

So I tried renaming ctfmon.exe to ctfmon.exe.bak. I got the same message.
So I decided to try renaming MSConfig .exe to MSConfig.exe, got the same message. I renamed MSConfig.exe to MSConfig.exe.bak and still got the same message. I then decided to rename MSConfig.exe.bak back to MSConfig.exe and the computer won’t let me telling me a file with the same name already exists. Same problem with ctfmon.exe.bak. So,

I now have the following files on my computer:
ctfmon.exe
ctfmon .exe
ctfmon.exe.bak

MSConfig exe
MSConfig.exe
MSConfig.exe.bak
msconfig.exe.tmp

I thought I’d better let you know before I went on to the uninstall programs step.

[Shaba]

Hi

Delete all these:

ctfmon .exe
ctfmon.exe.bak
MSConfig exe
MSConfig.exe
MSConfig.exe.bak

Download this (http://www.svrops.com/svrops/downloads/zipfiles/msconfig.zip)
and unzip it to here:

C:\WINDOWS\pchealth\helpctr\binaries

Then just continue with my previous instructions, please :)

[didymustoo]

I appreciate your help and patience.

I was able to delete all files except for ctfmon.exe.bak. When I attempt to do so I get a message, "Cannot delete ctfmon.exe: Access is denied.":rolleyes:

[Shaba]

Hi

Ok, let it be for now and just continue :)

[didymustoo]

Leaving for work now. Will continue when I return.

[didymustoo]

I decided to cancel work. My computer and I both have a virus.

Here is the Combofix log:
It is very long and will take 4 posts!

ComboFix 08-02-19.2 - fjw 2008-02-20 9:17:13.4 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.658 [GMT -6:00]
Running from: C:\Documents and Settings\fjw\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\fjw\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe.tmp
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\FolderShare
C:\Program Files\FolderShare\FolderShare .exe
C:\Program Files\FolderShare\FolderShare .exe
C:\Program Files\FolderShare\FolderShare .exe
C:\Program Files\FolderShare\FolderShare .exe
C:\Program Files\FolderShare\FolderShare .exe
C:\Program Files\FolderShare\FolderShare .exe
C:\Program Files\FolderShare\FolderShare .exe
C:\Program Files\FolderShare\FolderShare .exe
C:\Program Files\FolderShare\FolderShare .exe
C:\Program Files\FolderShare\FolderShare .exe
C:\Program Files\FolderShare\FolderShare .exe
C:\Program Files\FolderShare\FolderShare .exe
C:\Program Files\FolderShare\FolderShare .exe
C:\Program Files\FolderShare\FolderShare .exe
C:\Program Files\FolderShare\FolderShare .exe
C:\Program Files\FolderShare\FolderShare .exe
C:\Program Files\FolderShare\FolderShare .exe
C:\Program Files\FolderShare\FolderShare .exe
C:\Program Files\FolderShare\FolderShare .exe
C:\Program Files\FolderShare\FolderShare .exe
C:\Program Files\FolderShare\FolderShare .exe
C:\Program Files\FolderShare\FolderShare .exe
C:\Program Files\FolderShare\FolderShare .exe
C:\Program Files\FolderShare\FolderShare .exe
C:\Program Files\FolderShare\FolderShare .exe
C:\Program Files\FolderShare\FolderShare .exe
C:\Program Files\FolderShare\FolderShare .exe
C:\Program Files\FolderShare\FolderShare .exe
C:\Program Files\FolderShare\FolderShare .exe
C:\Program Files\FolderShare\FolderShare .exe
C:\Program Files\FolderShare\FolderShare .exe
C:\Program Files\FolderShare\FolderShare .exe
C:\Program Files\FolderShare\FolderShare .exe
C:\Program Files\FolderShare\FolderShare .exe
C:\Program Files\FolderShare\FolderShare .exe
C:\Program Files\FolderShare\FolderShare .exe
C:\Program Files\FolderShare\FolderShare .exe
C:\Program Files\FolderShare\FolderShare .exe
C:\Program Files\FolderShare\FolderShare .exe
C:\Program Files\FolderShare\FolderShare .exe
C:\Program Files\FolderShare\FolderShare .exe
C:\Program Files\FolderShare\FolderShare .exe
C:\Program Files\FolderShare\FolderShare .exe
C:\Program Files\FolderShare\FolderShare .exe
C:\Program Files\FolderShare\FolderShare .exe
C:\Program Files\FolderShare\FolderShare .exe
C:\Program Files\FolderShare\FolderShare .exe
C:\Program Files\FolderShare\FolderShare .exe
C:\Program Files\FolderShare\FolderShare .exe
C:\Program Files\FolderShare\FolderShare .exe
C:\Program Files\FolderShare\FolderShare .exe
C:\Program Files\FolderShare\FolderShare .exe
C:\Program Files\QuickTime
C:\Program Files\QuickTime\PictureViewer.exe
C:\Program Files\QuickTime\PictureViewer.Resources\da.lproj\PictureViewerLocalized.dll
C:\Program Files\QuickTime\PictureViewer.Resources\da.lproj\PictureViewerLocalized.qtr
C:\Program Files\QuickTime\PictureViewer.Resources\de.lproj\PictureViewerLocalized.dll
C:\Program Files\QuickTime\PictureViewer.Resources\de.lproj\PictureViewerLocalized.qtr
C:\Program Files\QuickTime\PictureViewer.Resources\en.lproj\PictureViewerLocalized.dll
C:\Program Files\QuickTime\PictureViewer.Resources\en.lproj\PictureViewerLocalized.qtr
C:\Program Files\QuickTime\PictureViewer.Resources\es.lproj\PictureViewerLocalized.dll
C:\Program Files\QuickTime\PictureViewer.Resources\es.lproj\PictureViewerLocalized.qtr
C:\Program Files\QuickTime\PictureViewer.Resources\fi.lproj\PictureViewerLocalized.dll
C:\Program Files\QuickTime\PictureViewer.Resources\fi.lproj\PictureViewerLocalized.qtr
C:\Program Files\QuickTime\PictureViewer.Resources\fr.lproj\PictureViewerLocalized.dll
C:\Program Files\QuickTime\PictureViewer.Resources\fr.lproj\PictureViewerLocalized.qtr
C:\Program Files\QuickTime\PictureViewer.Resources\it.lproj\PictureViewerLocalized.dll
C:\Program Files\QuickTime\PictureViewer.Resources\it.lproj\PictureViewerLocalized.qtr
C:\Program Files\QuickTime\PictureViewer.Resources\ja.lproj\PictureViewerLocalized.dll
C:\Program Files\QuickTime\PictureViewer.Resources\ja.lproj\PictureViewerLocalized.qtr
C:\Program Files\QuickTime\PictureViewer.Resources\ko.lproj\PictureViewerLocalized.dll
C:\Program Files\QuickTime\PictureViewer.Resources\ko.lproj\PictureViewerLocalized.qtr
C:\Program Files\QuickTime\PictureViewer.Resources\nl.lproj\PictureViewerLocalized.dll
C:\Program Files\QuickTime\PictureViewer.Resources\nl.lproj\PictureViewerLocalized.qtr
C:\Program Files\QuickTime\PictureViewer.Resources\no.lproj\PictureViewerLocalized.dll
C:\Program Files\QuickTime\PictureViewer.Resources\no.lproj\PictureViewerLocalized.qtr
C:\Program Files\QuickTime\PictureViewer.Resources\PictureViewer.dll
C:\Program Files\QuickTime\PictureViewer.Resources\PictureViewer.qtr
C:\Program Files\QuickTime\PictureViewer.Resources\sv.lproj\PictureViewerLocalized.dll
C:\Program Files\QuickTime\PictureViewer.Resources\sv.lproj\PictureViewerLocalized.qtr
C:\Program Files\QuickTime\PictureViewer.Resources\zh_CN.lproj\PictureViewerLocalized.dll
C:\Program Files\QuickTime\PictureViewer.Resources\zh_CN.lproj\PictureViewerLocalized.qtr
C:\Program Files\QuickTime\PictureViewer.Resources\zh_TW.lproj\PictureViewerLocalized.dll
C:\Program Files\QuickTime\PictureViewer.Resources\zh_TW.lproj\PictureViewerLocalized.qtr
C:\Program Files\QuickTime\Plugins\nsIQTScriptablePlugin.xpt
C:\Program Files\QuickTime\PropertyPanels\annoanno.pdef
C:\Program Files\QuickTime\PropertyPanels\moovaudi.pdef
C:\Program Files\QuickTime\PropertyPanels\moovpres.pdef
C:\Program Files\QuickTime\PropertyPanels\PanelHelperBase.qpa
C:\Program Files\QuickTime\PropertyPanels\PanelHelperBase.Resources\da.lproj\PanelHelperBaseLocalized.qtr
C:\Program Files\QuickTime\PropertyPanels\PanelHelperBase.Resources\de.lproj\PanelHelperBaseLocalized.qtr
C:\Program Files\QuickTime\PropertyPanels\PanelHelperBase.Resources\en.lproj\PanelHelperBaseLocalized.qtr
C:\Program Files\QuickTime\PropertyPanels\PanelHelperBase.Resources\es.lproj\PanelHelperBaseLocalized.qtr
C:\Program Files\QuickTime\PropertyPanels\PanelHelperBase.Resources\fi.lproj\PanelHelperBaseLocalized.qtr
C:\Program Files\QuickTime\PropertyPanels\PanelHelperBase.Resources\fr.lproj\PanelHelperBaseLocalized.qtr
C:\Program Files\QuickTime\PropertyPanels\PanelHelperBase.Resources\it.lproj\PanelHelperBaseLocalized.qtr
C:\Program Files\QuickTime\PropertyPanels\PanelHelperBase.Resources\ja.lproj\PanelHelperBaseLocalized.qtr
C:\Program Files\QuickTime\PropertyPanels\PanelHelperBase.Resources\ko.lproj\PanelHelperBaseLocalized.qtr
C:\Program Files\QuickTime\PropertyPanels\PanelHelperBase.Resources\nl.lproj\PanelHelperBaseLocalized.qtr
C:\Program Files\QuickTime\PropertyPanels\PanelHelperBase.Resources\no.lproj\PanelHelperBaseLocalized.qtr
C:\Program Files\QuickTime\PropertyPanels\PanelHelperBase.Resources\PanelHelperBase.qtr
C:\Program Files\QuickTime\PropertyPanels\PanelHelperBase.Resources\sv.lproj\PanelHelperBaseLocalized.qtr
C:\Program Files\QuickTime\PropertyPanels\PanelHelperBase.Resources\zh_CN.lproj\PanelHelperBaseLocalized.qtr
C:\Program Files\QuickTime\PropertyPanels\PanelHelperBase.Resources\zh_TW.lproj\PanelHelperBaseLocalized.qtr
C:\Program Files\QuickTime\PropertyPanels\PropertyPanels.plist
C:\Program Files\QuickTime\PropertyPanels\PropPanelHelpers.qpa
C:\Program Files\QuickTime\PropertyPanels\PropPanelHelpers.Resources\da.lproj\PropPanelHelpersLocalized.qtr
C:\Program Files\QuickTime\PropertyPanels\PropPanelHelpers.Resources\de.lproj\PropPanelHelpersLocalized.qtr
C:\Program Files\QuickTime\PropertyPanels\PropPanelHelpers.Resources\en.lproj\PropPanelHelpersLocalized.qtr
C:\Program Files\QuickTime\PropertyPanels\PropPanelHelpers.Resources\es.lproj\PropPanelHelpersLocalized.qtr
C:\Program Files\QuickTime\PropertyPanels\PropPanelHelpers.Resources\fi.lproj\PropPanelHelpersLocalized.qtr
C:\Program Files\QuickTime\PropertyPanels\PropPanelHelpers.Resources\fr.lproj\PropPanelHelpersLocalized.qtr
C:\Program Files\QuickTime\PropertyPanels\PropPanelHelpers.Resources\it.lproj\PropPanelHelpersLocalized.qtr
C:\Program Files\QuickTime\PropertyPanels\PropPanelHelpers.Resources\ja.lproj\PropPanelHelpersLocalized.qtr
C:\Program Files\QuickTime\PropertyPanels\PropPanelHelpers.Resources\ko.lproj\PropPanelHelpersLocalized.qtr
C:\Program Files\QuickTime\PropertyPanels\PropPanelHelpers.Resources\nl.lproj\PropPanelHelpersLocalized.qtr
C:\Program Files\QuickTime\PropertyPanels\PropPanelHelpers.Resources\no.lproj\PropPanelHelpersLocalized.qtr
C:\Program Files\QuickTime\PropertyPanels\PropPanelHelpers.Resources\PropPanelHelpers.qtr
C:\Program Files\QuickTime\PropertyPanels\PropPanelHelpers.Resources\sv.lproj\PropPanelHelpersLocalized.qtr
C:\Program Files\QuickTime\PropertyPanels\PropPanelHelpers.Resources\zh_CN.lproj\PropPanelHelpersLocalized.qtr
C:\Program Files\QuickTime\PropertyPanels\PropPanelHelpers.Resources\zh_TW.lproj\PropPanelHelpersLocalized.qtr
C:\Program Files\QuickTime\PropertyPanels\rsrcrsrc.pdef
C:\Program Files\QuickTime\PropertyPanels\trakaudi.pdef
C:\Program Files\QuickTime\PropertyPanels\trakhint.pdef
C:\Program Files\QuickTime\PropertyPanels\trakothr.pdef
C:\Program Files\QuickTime\PropertyPanels\trakstrm.pdef
C:\Program Files\QuickTime\PropertyPanels\trakvisl.pdef
C:\Program Files\QuickTime\QTOControl.dll
C:\Program Files\QuickTime\QTOLibrary.dll
C:\Program Files\QuickTime\QTPlugin.ocx
C:\Program Files\QuickTime\QTSystem\CFCharacterSetBitmaps.bitmap
C:\Program Files\QuickTime\QTSystem\CFUniCharPropertyDatabase.data
C:\Program Files\QuickTime\QTSystem\CFUnicodeData-B.mapping
C:\Program Files\QuickTime\QTSystem\CFUnicodeData-L.mapping
C:\Program Files\QuickTime\QTSystem\CoreVideo.qtx
C:\Program Files\QuickTime\QTSystem\CoreVideo.Resources\CoreVideo.qtr
C:\Program Files\QuickTime\QTSystem\CoreVideo.Resources\da.lproj\CoreVideoLocalized.qtr
C:\Program Files\QuickTime\QTSystem\CoreVideo.Resources\de.lproj\CoreVideoLocalized.qtr
C:\Program Files\QuickTime\QTSystem\CoreVideo.Resources\en.lproj\CoreVideoLocalized.qtr
C:\Program Files\QuickTime\QTSystem\CoreVideo.Resources\es.lproj\CoreVideoLocalized.qtr
C:\Program Files\QuickTime\QTSystem\CoreVideo.Resources\fi.lproj\CoreVideoLocalized.qtr
C:\Program Files\QuickTime\QTSystem\CoreVideo.Resources\fr.lproj\CoreVideoLocalized.qtr
C:\Program Files\QuickTime\QTSystem\CoreVideo.Resources\it.lproj\CoreVideoLocalized.qtr
C:\Program Files\QuickTime\QTSystem\CoreVideo.Resources\ja.lproj\CoreVideoLocalized.qtr
C:\Program Files\QuickTime\QTSystem\CoreVideo.Resources\ko.lproj\CoreVideoLocalized.qtr
C:\Program Files\QuickTime\QTSystem\CoreVideo.Resources\nl.lproj\CoreVideoLocalized.qtr
C:\Program Files\QuickTime\QTSystem\CoreVideo.Resources\no.lproj\CoreVideoLocalized.qtr
C:\Program Files\QuickTime\QTSystem\CoreVideo.Resources\sv.lproj\CoreVideoLocalized.qtr
C:\Program Files\QuickTime\QTSystem\CoreVideo.Resources\zh_CN.lproj\CoreVideoLocalized.qtr
C:\Program Files\QuickTime\QTSystem\CoreVideo.Resources\zh_TW.lproj\CoreVideoLocalized.qtr
C:\Program Files\QuickTime\QTSystem\Indeo4.qtx
C:\Program Files\QuickTime\QTSystem\Ir41_qc.dll
C:\Program Files\QuickTime\QTSystem\Ir41_qcx.dll
C:\Program Files\QuickTime\QTSystem\QTMLClient.dll
C:\Program Files\QuickTime\QTSystem\QTPluginInstaller.exe
C:\Program Files\QuickTime\QTSystem\QuickTime.cpl
C:\Program Files\QuickTime\QTSystem\QuickTime.qts
C:\Program Files\QuickTime\QTSystem\QuickTime.Resources\da.lproj\QuickTimeLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTime.Resources\da.lproj\QuickTimeLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTime.Resources\de.lproj\QuickTimeLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTime.Resources\de.lproj\QuickTimeLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTime.Resources\en.lproj\QuickTimeLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTime.Resources\en.lproj\QuickTimeLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTime.Resources\es.lproj\QuickTimeLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTime.Resources\es.lproj\QuickTimeLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTime.Resources\fi.lproj\QuickTimeLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTime.Resources\fi.lproj\QuickTimeLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTime.Resources\fr.lproj\QuickTimeLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTime.Resources\fr.lproj\QuickTimeLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTime.Resources\it.lproj\QuickTimeLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTime.Resources\it.lproj\QuickTimeLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTime.Resources\ja.lproj\QuickTimeLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTime.Resources\ja.lproj\QuickTimeLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTime.Resources\ko.lproj\QuickTimeLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTime.Resources\ko.lproj\QuickTimeLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTime.Resources\nl.lproj\QuickTimeLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTime.Resources\nl.lproj\QuickTimeLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTime.Resources\no.lproj\QuickTimeLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTime.Resources\no.lproj\QuickTimeLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTime.Resources\QuickTime.dll
C:\Program Files\QuickTime\QTSystem\QuickTime.Resources\QuickTime.qtr
C:\Program Files\QuickTime\QTSystem\QuickTime.Resources\sv.lproj\QuickTimeLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTime.Resources\sv.lproj\QuickTimeLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTime.Resources\zh_CN.lproj\QuickTimeLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTime.Resources\zh_CN.lproj\QuickTimeLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTime.Resources\zh_TW.lproj\QuickTimeLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTime.Resources\zh_TW.lproj\QuickTimeLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTime3GPP.qtx
C:\Program Files\QuickTime\QTSystem\QuickTime3GPP.Resources\da.lproj\QuickTime3GPPLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTime3GPP.Resources\de.lproj\QuickTime3GPPLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTime3GPP.Resources\en.lproj\QuickTime3GPPLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTime3GPP.Resources\es.lproj\QuickTime3GPPLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTime3GPP.Resources\fi.lproj\QuickTime3GPPLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTime3GPP.Resources\fr.lproj\QuickTime3GPPLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTime3GPP.Resources\it.lproj\QuickTime3GPPLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTime3GPP.Resources\ja.lproj\QuickTime3GPPLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTime3GPP.Resources\ko.lproj\QuickTime3GPPLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTime3GPP.Resources\nl.lproj\QuickTime3GPPLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTime3GPP.Resources\no.lproj\QuickTime3GPPLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTime3GPP.Resources\QuickTime3GPP.qtr
C:\Program Files\QuickTime\QTSystem\QuickTime3GPP.Resources\sv.lproj\QuickTime3GPPLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTime3GPP.Resources\zh_CN.lproj\QuickTime3GPPLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTime3GPP.Resources\zh_TW.lproj\QuickTime3GPPLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTime3GPPAuthoring.qtx
C:\Program Files\QuickTime\QTSystem\QuickTime3GPPAuthoring.Resources\da.lproj\QuickTime3GPPAuthoringLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTime3GPPAuthoring.Resources\de.lproj\QuickTime3GPPAuthoringLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTime3GPPAuthoring.Resources\en.lproj\QuickTime3GPPAuthoringLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTime3GPPAuthoring.Resources\es.lproj\QuickTime3GPPAuthoringLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTime3GPPAuthoring.Resources\fi.lproj\QuickTime3GPPAuthoringLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTime3GPPAuthoring.Resources\fr.lproj\QuickTime3GPPAuthoringLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTime3GPPAuthoring.Resources\it.lproj\QuickTime3GPPAuthoringLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTime3GPPAuthoring.Resources\ja.lproj\QuickTime3GPPAuthoringLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTime3GPPAuthoring.Resources\ko.lproj\QuickTime3GPPAuthoringLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTime3GPPAuthoring.Resources\nl.lproj\QuickTime3GPPAuthoringLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTime3GPPAuthoring.Resources\no.lproj\QuickTime3GPPAuthoringLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTime3GPPAuthoring.Resources\QuickTime3GPPAuthoring.qtr
C:\Program Files\QuickTime\QTSystem\QuickTime3GPPAuthoring.Resources\sv.lproj\QuickTime3GPPAuthoringLocalized.qtr

[Shaba]

Hi

Please post also the rest of combofix report and a fresh HijackThis log :)

[didymustoo]

C:\Program Files\QuickTime\QTSystem\QuickTime3GPPAuthoring.Resources\zh_CN.lproj\QuickTime3GPPAuthoringLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTime3GPPAuthoring.Resources\zh_TW.lproj\QuickTime3GPPAuthoringLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeAudioSupport.qtx
C:\Program Files\QuickTime\QTSystem\QuickTimeAudioSupport.Resources\da.lproj\QuickTimeAudioSupportLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTimeAudioSupport.Resources\da.lproj\QuickTimeAudioSupportLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeAudioSupport.Resources\de.lproj\QuickTimeAudioSupportLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTimeAudioSupport.Resources\de.lproj\QuickTimeAudioSupportLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeAudioSupport.Resources\en.lproj\QuickTimeAudioSupportLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTimeAudioSupport.Resources\en.lproj\QuickTimeAudioSupportLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeAudioSupport.Resources\es.lproj\QuickTimeAudioSupportLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTimeAudioSupport.Resources\es.lproj\QuickTimeAudioSupportLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeAudioSupport.Resources\fi.lproj\QuickTimeAudioSupportLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTimeAudioSupport.Resources\fi.lproj\QuickTimeAudioSupportLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeAudioSupport.Resources\fr.lproj\QuickTimeAudioSupportLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTimeAudioSupport.Resources\fr.lproj\QuickTimeAudioSupportLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeAudioSupport.Resources\it.lproj\QuickTimeAudioSupportLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTimeAudioSupport.Resources\it.lproj\QuickTimeAudioSupportLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeAudioSupport.Resources\ja.lproj\QuickTimeAudioSupportLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTimeAudioSupport.Resources\ja.lproj\QuickTimeAudioSupportLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeAudioSupport.Resources\ko.lproj\QuickTimeAudioSupportLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTimeAudioSupport.Resources\ko.lproj\QuickTimeAudioSupportLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeAudioSupport.Resources\nl.lproj\QuickTimeAudioSupportLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTimeAudioSupport.Resources\nl.lproj\QuickTimeAudioSupportLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeAudioSupport.Resources\no.lproj\QuickTimeAudioSupportLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTimeAudioSupport.Resources\no.lproj\QuickTimeAudioSupportLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeAudioSupport.Resources\QuickTimeAudioSupport.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeAudioSupport.Resources\sv.lproj\QuickTimeAudioSupportLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTimeAudioSupport.Resources\sv.lproj\QuickTimeAudioSupportLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeAudioSupport.Resources\zh_CN.lproj\QuickTimeAudioSupportLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTimeAudioSupport.Resources\zh_CN.lproj\QuickTimeAudioSupportLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeAudioSupport.Resources\zh_TW.lproj\QuickTimeAudioSupportLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTimeAudioSupport.Resources\zh_TW.lproj\QuickTimeAudioSupportLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeAuthoring.qtx
C:\Program Files\QuickTime\QTSystem\QuickTimeAuthoring.Resources\da.lproj\QuickTimeAuthoringLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTimeAuthoring.Resources\da.lproj\QuickTimeAuthoringLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeAuthoring.Resources\de.lproj\QuickTimeAuthoringLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTimeAuthoring.Resources\de.lproj\QuickTimeAuthoringLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeAuthoring.Resources\en.lproj\QuickTimeAuthoringLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTimeAuthoring.Resources\en.lproj\QuickTimeAuthoringLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeAuthoring.Resources\es.lproj\QuickTimeAuthoringLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTimeAuthoring.Resources\es.lproj\QuickTimeAuthoringLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeAuthoring.Resources\fi.lproj\QuickTimeAuthoringLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTimeAuthoring.Resources\fi.lproj\QuickTimeAuthoringLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeAuthoring.Resources\fr.lproj\QuickTimeAuthoringLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTimeAuthoring.Resources\fr.lproj\QuickTimeAuthoringLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeAuthoring.Resources\it.lproj\QuickTimeAuthoringLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTimeAuthoring.Resources\it.lproj\QuickTimeAuthoringLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeAuthoring.Resources\ja.lproj\QuickTimeAuthoringLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTimeAuthoring.Resources\ja.lproj\QuickTimeAuthoringLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeAuthoring.Resources\ko.lproj\QuickTimeAuthoringLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTimeAuthoring.Resources\ko.lproj\QuickTimeAuthoringLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeAuthoring.Resources\nl.lproj\QuickTimeAuthoringLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTimeAuthoring.Resources\nl.lproj\QuickTimeAuthoringLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeAuthoring.Resources\no.lproj\QuickTimeAuthoringLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTimeAuthoring.Resources\no.lproj\QuickTimeAuthoringLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeAuthoring.Resources\QuickTimeAuthoring.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeAuthoring.Resources\sv.lproj\QuickTimeAuthoringLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTimeAuthoring.Resources\sv.lproj\QuickTimeAuthoringLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeAuthoring.Resources\zh_CN.lproj\QuickTimeAuthoringLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTimeAuthoring.Resources\zh_CN.lproj\QuickTimeAuthoringLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeAuthoring.Resources\zh_TW.lproj\QuickTimeAuthoringLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTimeAuthoring.Resources\zh_TW.lproj\QuickTimeAuthoringLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeCapture.qtx
C:\Program Files\QuickTime\QTSystem\QuickTimeCapture.Resources\da.lproj\QuickTimeCaptureLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeCapture.Resources\de.lproj\QuickTimeCaptureLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeCapture.Resources\en.lproj\QuickTimeCaptureLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeCapture.Resources\es.lproj\QuickTimeCaptureLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeCapture.Resources\fi.lproj\QuickTimeCaptureLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeCapture.Resources\fr.lproj\QuickTimeCaptureLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeCapture.Resources\it.lproj\QuickTimeCaptureLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeCapture.Resources\ja.lproj\QuickTimeCaptureLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeCapture.Resources\ko.lproj\QuickTimeCaptureLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeCapture.Resources\nl.lproj\QuickTimeCaptureLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeCapture.Resources\no.lproj\QuickTimeCaptureLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeCapture.Resources\QuickTimeCapture.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeCapture.Resources\sv.lproj\QuickTimeCaptureLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeCapture.Resources\zh_CN.lproj\QuickTimeCaptureLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeCapture.Resources\zh_TW.lproj\QuickTimeCaptureLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeCheck.ocx
C:\Program Files\QuickTime\QTSystem\QuickTimeEffects.qtx
C:\Program Files\QuickTime\QTSystem\QuickTimeEffects.Resources\da.lproj\QuickTimeEffectsLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeEffects.Resources\de.lproj\QuickTimeEffectsLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeEffects.Resources\en.lproj\QuickTimeEffectsLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeEffects.Resources\es.lproj\QuickTimeEffectsLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeEffects.Resources\fi.lproj\QuickTimeEffectsLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeEffects.Resources\fr.lproj\QuickTimeEffectsLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeEffects.Resources\it.lproj\QuickTimeEffectsLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeEffects.Resources\ja.lproj\QuickTimeEffectsLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeEffects.Resources\ko.lproj\QuickTimeEffectsLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeEffects.Resources\nl.lproj\QuickTimeEffectsLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeEffects.Resources\no.lproj\QuickTimeEffectsLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeEffects.Resources\QuickTimeEffects.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeEffects.Resources\sv.lproj\QuickTimeEffectsLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeEffects.Resources\zh_CN.lproj\QuickTimeEffectsLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeEffects.Resources\zh_TW.lproj\QuickTimeEffectsLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeEssentials.qtx
C:\Program Files\QuickTime\QTSystem\QuickTimeEssentials.Resources\da.lproj\QuickTimeEssentialsLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeEssentials.Resources\de.lproj\QuickTimeEssentialsLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeEssentials.Resources\en.lproj\QuickTimeEssentialsLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeEssentials.Resources\es.lproj\QuickTimeEssentialsLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeEssentials.Resources\fi.lproj\QuickTimeEssentialsLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeEssentials.Resources\fr.lproj\QuickTimeEssentialsLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeEssentials.Resources\it.lproj\QuickTimeEssentialsLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeEssentials.Resources\ja.lproj\QuickTimeEssentialsLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeEssentials.Resources\ko.lproj\QuickTimeEssentialsLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeEssentials.Resources\nl.lproj\QuickTimeEssentialsLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeEssentials.Resources\no.lproj\QuickTimeEssentialsLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeEssentials.Resources\QuickTimeEssentials.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeEssentials.Resources\sv.lproj\QuickTimeEssentialsLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeEssentials.Resources\zh_CN.lproj\QuickTimeEssentialsLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeEssentials.Resources\zh_TW.lproj\QuickTimeEssentialsLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeH264.qtx

[didymustoo]

C:\Program Files\QuickTime\QTSystem\QuickTimeH264.qtx
C:\Program Files\QuickTime\QTSystem\QuickTimeH264.Resources\da.lproj\QuickTimeH264Localized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeH264.Resources\de.lproj\QuickTimeH264Localized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeH264.Resources\en.lproj\QuickTimeH264Localized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeH264.Resources\es.lproj\QuickTimeH264Localized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeH264.Resources\fi.lproj\QuickTimeH264Localized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeH264.Resources\fr.lproj\QuickTimeH264Localized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeH264.Resources\it.lproj\QuickTimeH264Localized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeH264.Resources\ja.lproj\QuickTimeH264Localized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeH264.Resources\ko.lproj\QuickTimeH264Localized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeH264.Resources\nl.lproj\QuickTimeH264Localized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeH264.Resources\no.lproj\QuickTimeH264Localized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeH264.Resources\QuickTimeH264.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeH264.Resources\sv.lproj\QuickTimeH264Localized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeH264.Resources\zh_CN.lproj\QuickTimeH264Localized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeH264.Resources\zh_TW.lproj\QuickTimeH264Localized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeImage.qtx
C:\Program Files\QuickTime\QTSystem\QuickTimeImage.Resources\da.lproj\QuickTimeImageLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeImage.Resources\de.lproj\QuickTimeImageLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeImage.Resources\en.lproj\QuickTimeImageLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeImage.Resources\es.lproj\QuickTimeImageLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeImage.Resources\fi.lproj\QuickTimeImageLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeImage.Resources\fr.lproj\QuickTimeImageLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeImage.Resources\it.lproj\QuickTimeImageLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeImage.Resources\ja.lproj\QuickTimeImageLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeImage.Resources\ko.lproj\QuickTimeImageLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeImage.Resources\nl.lproj\QuickTimeImageLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeImage.Resources\no.lproj\QuickTimeImageLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeImage.Resources\QuickTimeImage.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeImage.Resources\sv.lproj\QuickTimeImageLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeImage.Resources\zh_CN.lproj\QuickTimeImageLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeImage.Resources\zh_TW.lproj\QuickTimeImageLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeInternetExtras.qtx
C:\Program Files\QuickTime\QTSystem\QuickTimeInternetExtras.Resources\da.lproj\QuickTimeInternetExtrasLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeInternetExtras.Resources\de.lproj\QuickTimeInternetExtrasLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeInternetExtras.Resources\en.lproj\QuickTimeInternetExtrasLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeInternetExtras.Resources\es.lproj\QuickTimeInternetExtrasLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeInternetExtras.Resources\fi.lproj\QuickTimeInternetExtrasLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeInternetExtras.Resources\fr.lproj\QuickTimeInternetExtrasLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeInternetExtras.Resources\it.lproj\QuickTimeInternetExtrasLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeInternetExtras.Resources\ja.lproj\QuickTimeInternetExtrasLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeInternetExtras.Resources\ko.lproj\QuickTimeInternetExtrasLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeInternetExtras.Resources\nl.lproj\QuickTimeInternetExtrasLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeInternetExtras.Resources\no.lproj\QuickTimeInternetExtrasLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeInternetExtras.Resources\QuickTimeInternetExtras.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeInternetExtras.Resources\sv.lproj\QuickTimeInternetExtrasLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeInternetExtras.Resources\zh_CN.lproj\QuickTimeInternetExtrasLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeInternetExtras.Resources\zh_TW.lproj\QuickTimeInternetExtrasLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeMPEG.qtx
C:\Program Files\QuickTime\QTSystem\QuickTimeMPEG.Resources\da.lproj\QuickTimeMPEGLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeMPEG.Resources\de.lproj\QuickTimeMPEGLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeMPEG.Resources\en.lproj\QuickTimeMPEGLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeMPEG.Resources\es.lproj\QuickTimeMPEGLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeMPEG.Resources\fi.lproj\QuickTimeMPEGLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeMPEG.Resources\fr.lproj\QuickTimeMPEGLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeMPEG.Resources\it.lproj\QuickTimeMPEGLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeMPEG.Resources\ja.lproj\QuickTimeMPEGLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeMPEG.Resources\ko.lproj\QuickTimeMPEGLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeMPEG.Resources\nl.lproj\QuickTimeMPEGLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeMPEG.Resources\no.lproj\QuickTimeMPEGLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeMPEG.Resources\QuickTimeMPEG.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeMPEG.Resources\sv.lproj\QuickTimeMPEGLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeMPEG.Resources\zh_CN.lproj\QuickTimeMPEGLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeMPEG.Resources\zh_TW.lproj\QuickTimeMPEGLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeMPEG4.qtx
C:\Program Files\QuickTime\QTSystem\QuickTimeMPEG4.Resources\da.lproj\QuickTimeMPEG4Localized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeMPEG4.Resources\de.lproj\QuickTimeMPEG4Localized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeMPEG4.Resources\en.lproj\QuickTimeMPEG4Localized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeMPEG4.Resources\es.lproj\QuickTimeMPEG4Localized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeMPEG4.Resources\fi.lproj\QuickTimeMPEG4Localized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeMPEG4.Resources\fr.lproj\QuickTimeMPEG4Localized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeMPEG4.Resources\it.lproj\QuickTimeMPEG4Localized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeMPEG4.Resources\ja.lproj\QuickTimeMPEG4Localized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeMPEG4.Resources\ko.lproj\QuickTimeMPEG4Localized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeMPEG4.Resources\nl.lproj\QuickTimeMPEG4Localized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeMPEG4.Resources\no.lproj\QuickTimeMPEG4Localized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeMPEG4.Resources\QuickTimeMPEG4.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeMPEG4.Resources\sv.lproj\QuickTimeMPEG4Localized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeMPEG4.Resources\zh_CN.lproj\QuickTimeMPEG4Localized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeMPEG4.Resources\zh_TW.lproj\QuickTimeMPEG4Localized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeMPEG4Authoring.qtx
C:\Program Files\QuickTime\QTSystem\QuickTimeMPEG4Authoring.Resources\da.lproj\QuickTimeMPEG4AuthoringLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeMPEG4Authoring.Resources\de.lproj\QuickTimeMPEG4AuthoringLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeMPEG4Authoring.Resources\en.lproj\QuickTimeMPEG4AuthoringLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeMPEG4Authoring.Resources\es.lproj\QuickTimeMPEG4AuthoringLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeMPEG4Authoring.Resources\fi.lproj\QuickTimeMPEG4AuthoringLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeMPEG4Authoring.Resources\fr.lproj\QuickTimeMPEG4AuthoringLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeMPEG4Authoring.Resources\it.lproj\QuickTimeMPEG4AuthoringLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeMPEG4Authoring.Resources\ja.lproj\QuickTimeMPEG4AuthoringLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeMPEG4Authoring.Resources\ko.lproj\QuickTimeMPEG4AuthoringLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeMPEG4Authoring.Resources\nl.lproj\QuickTimeMPEG4AuthoringLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeMPEG4Authoring.Resources\no.lproj\QuickTimeMPEG4AuthoringLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeMPEG4Authoring.Resources\QuickTimeMPEG4Authoring.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeMPEG4Authoring.Resources\sv.lproj\QuickTimeMPEG4AuthoringLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeMPEG4Authoring.Resources\zh_CN.lproj\QuickTimeMPEG4AuthoringLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeMPEG4Authoring.Resources\zh_TW.lproj\QuickTimeMPEG4AuthoringLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeMusic.qtx
C:\Program Files\QuickTime\QTSystem\QuickTimeMusic.Resources\da.lproj\QuickTimeMusicLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeMusic.Resources\de.lproj\QuickTimeMusicLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeMusic.Resources\en.lproj\QuickTimeMusicLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeMusic.Resources\es.lproj\QuickTimeMusicLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeMusic.Resources\fi.lproj\QuickTimeMusicLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeMusic.Resources\fr.lproj\QuickTimeMusicLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeMusic.Resources\it.lproj\QuickTimeMusicLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeMusic.Resources\ja.lproj\QuickTimeMusicLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeMusic.Resources\ko.lproj\QuickTimeMusicLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeMusic.Resources\nl.lproj\QuickTimeMusicLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeMusic.Resources\no.lproj\QuickTimeMusicLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeMusic.Resources\QuickTimeMusic.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeMusic.Resources\sv.lproj\QuickTimeMusicLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeMusic.Resources\zh_CN.lproj\QuickTimeMusicLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeMusic.Resources\zh_TW.lproj\QuickTimeMusicLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeMusicalInstruments.qtx
C:\Program Files\QuickTime\QTSystem\QuickTimeQD3D.qtx
C:\Program Files\QuickTime\QTSystem\QuickTimeQD3D.Resources\da.lproj\QuickTimeQD3DLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeQD3D.Resources\de.lproj\QuickTimeQD3DLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeQD3D.Resources\en.lproj\QuickTimeQD3DLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeQD3D.Resources\es.lproj\QuickTimeQD3DLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeQD3D.Resources\fi.lproj\QuickTimeQD3DLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeQD3D.Resources\fr.lproj\QuickTimeQD3DLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeQD3D.Resources\it.lproj\QuickTimeQD3DLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeQD3D.Resources\ja.lproj\QuickTimeQD3DLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeQD3D.Resources\ko.lproj\QuickTimeQD3DLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeQD3D.Resources\nl.lproj\QuickTimeQD3DLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeQD3D.Resources\no.lproj\QuickTimeQD3DLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeQD3D.Resources\QuickTimeQD3D.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeQD3D.Resources\sv.lproj\QuickTimeQD3DLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeQD3D.Resources\zh_CN.lproj\QuickTimeQD3DLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeQD3D.Resources\zh_TW.lproj\QuickTimeQD3DLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeStreaming.qtx
C:\Program Files\QuickTime\QTSystem\QuickTimeStreaming.Resources\da.lproj\QuickTimeStreamingLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTimeStreaming.Resources\da.lproj\QuickTimeStreamingLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeStreaming.Resources\de.lproj\QuickTimeStreamingLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTimeStreaming.Resources\de.lproj\QuickTimeStreamingLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeStreaming.Resources\en.lproj\QuickTimeStreamingLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTimeStreaming.Resources\en.lproj\QuickTimeStreamingLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeStreaming.Resources\es.lproj\QuickTimeStreamingLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTimeStreaming.Resources\es.lproj\QuickTimeStreamingLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeStreaming.Resources\fi.lproj\QuickTimeStreamingLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTimeStreaming.Resources\fi.lproj\QuickTimeStreamingLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeStreaming.Resources\fr.lproj\QuickTimeStreamingLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTimeStreaming.Resources\fr.lproj\QuickTimeStreamingLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeStreaming.Resources\it.lproj\QuickTimeStreamingLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTimeStreaming.Resources\it.lproj\QuickTimeStreamingLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeStreaming.Resources\ja.lproj\QuickTimeStreamingLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTimeStreaming.Resources\ja.lproj\QuickTimeStreamingLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeStreaming.Resources\ko.lproj\QuickTimeStreamingLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTimeStreaming.Resources\ko.lproj\QuickTimeStreamingLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeStreaming.Resources\nl.lproj\QuickTimeStreamingLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTimeStreaming.Resources\nl.lproj\QuickTimeStreamingLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeStreaming.Resources\no.lproj\QuickTimeStreamingLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTimeStreaming.Resources\no.lproj\QuickTimeStreamingLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeStreaming.Resources\QuickTimeStreaming.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeStreaming.Resources\sv.lproj\QuickTimeStreamingLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTimeStreaming.Resources\sv.lproj\QuickTimeStreamingLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeStreaming.Resources\zh_CN.lproj\QuickTimeStreamingLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTimeStreaming.Resources\zh_CN.lproj\QuickTimeStreamingLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeStreaming.Resources\zh_TW.lproj\QuickTimeStreamingLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTimeStreaming.Resources\zh_TW.lproj\QuickTimeStreamingLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeStreamingAuthoring.qtx

[didymustoo]

C:\Program Files\QuickTime\QTSystem\QuickTimeStreamingAuthoring.Resources\da.lproj\QuickTimeStreamingAuthoringLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeStreamingAuthoring.Resources\de.lproj\QuickTimeStreamingAuthoringLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeStreamingAuthoring.Resources\en.lproj\QuickTimeStreamingAuthoringLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeStreamingAuthoring.Resources\es.lproj\QuickTimeStreamingAuthoringLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeStreamingAuthoring.Resources\fi.lproj\QuickTimeStreamingAuthoringLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeStreamingAuthoring.Resources\fr.lproj\QuickTimeStreamingAuthoringLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeStreamingAuthoring.Resources\it.lproj\QuickTimeStreamingAuthoringLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeStreamingAuthoring.Resources\ja.lproj\QuickTimeStreamingAuthoringLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeStreamingAuthoring.Resources\ko.lproj\QuickTimeStreamingAuthoringLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeStreamingAuthoring.Resources\nl.lproj\QuickTimeStreamingAuthoringLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeStreamingAuthoring.Resources\no.lproj\QuickTimeStreamingAuthoringLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeStreamingAuthoring.Resources\QuickTimeStreamingAuthoring.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeStreamingAuthoring.Resources\sv.lproj\QuickTimeStreamingAuthoringLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeStreamingAuthoring.Resources\zh_CN.lproj\QuickTimeStreamingAuthoringLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeStreamingAuthoring.Resources\zh_TW.lproj\QuickTimeStreamingAuthoringLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeStreamingExtras.qtx
C:\Program Files\QuickTime\QTSystem\QuickTimeStreamingExtras.Resources\da.lproj\QuickTimeStreamingExtrasLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeStreamingExtras.Resources\de.lproj\QuickTimeStreamingExtrasLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeStreamingExtras.Resources\en.lproj\QuickTimeStreamingExtrasLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeStreamingExtras.Resources\es.lproj\QuickTimeStreamingExtrasLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeStreamingExtras.Resources\fi.lproj\QuickTimeStreamingExtrasLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeStreamingExtras.Resources\fr.lproj\QuickTimeStreamingExtrasLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeStreamingExtras.Resources\it.lproj\QuickTimeStreamingExtrasLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeStreamingExtras.Resources\ja.lproj\QuickTimeStreamingExtrasLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeStreamingExtras.Resources\ko.lproj\QuickTimeStreamingExtrasLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeStreamingExtras.Resources\nl.lproj\QuickTimeStreamingExtrasLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeStreamingExtras.Resources\no.lproj\QuickTimeStreamingExtrasLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeStreamingExtras.Resources\QuickTimeStreamingExtras.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeStreamingExtras.Resources\sv.lproj\QuickTimeStreamingExtrasLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeStreamingExtras.Resources\zh_CN.lproj\QuickTimeStreamingExtrasLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeStreamingExtras.Resources\zh_TW.lproj\QuickTimeStreamingExtrasLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeUpdateHelper.exe
C:\Program Files\QuickTime\QTSystem\QuickTimeVR.qtx
C:\Program Files\QuickTime\QTSystem\QuickTimeVR.Resources\da.lproj\QuickTimeVRLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeVR.Resources\de.lproj\QuickTimeVRLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeVR.Resources\en.lproj\QuickTimeVRLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeVR.Resources\es.lproj\QuickTimeVRLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeVR.Resources\fi.lproj\QuickTimeVRLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeVR.Resources\fr.lproj\QuickTimeVRLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeVR.Resources\it.lproj\QuickTimeVRLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeVR.Resources\ja.lproj\QuickTimeVRLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeVR.Resources\ko.lproj\QuickTimeVRLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeVR.Resources\nl.lproj\QuickTimeVRLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeVR.Resources\no.lproj\QuickTimeVRLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeVR.Resources\QuickTimeVR.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeVR.Resources\sv.lproj\QuickTimeVRLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeVR.Resources\zh_CN.lproj\QuickTimeVRLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeVR.Resources\zh_TW.lproj\QuickTimeVRLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeVRAuthoring.qtx
C:\Program Files\QuickTime\QTSystem\QuickTimeVRAuthoring.Resources\da.lproj\QuickTimeVRAuthoringLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeVRAuthoring.Resources\de.lproj\QuickTimeVRAuthoringLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeVRAuthoring.Resources\en.lproj\QuickTimeVRAuthoringLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeVRAuthoring.Resources\es.lproj\QuickTimeVRAuthoringLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeVRAuthoring.Resources\fi.lproj\QuickTimeVRAuthoringLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeVRAuthoring.Resources\fr.lproj\QuickTimeVRAuthoringLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeVRAuthoring.Resources\it.lproj\QuickTimeVRAuthoringLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeVRAuthoring.Resources\ja.lproj\QuickTimeVRAuthoringLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeVRAuthoring.Resources\ko.lproj\QuickTimeVRAuthoringLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeVRAuthoring.Resources\nl.lproj\QuickTimeVRAuthoringLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeVRAuthoring.Resources\no.lproj\QuickTimeVRAuthoringLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeVRAuthoring.Resources\QuickTimeVRAuthoring.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeVRAuthoring.Resources\sv.lproj\QuickTimeVRAuthoringLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeVRAuthoring.Resources\zh_CN.lproj\QuickTimeVRAuthoringLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeVRAuthoring.Resources\zh_TW.lproj\QuickTimeVRAuthoringLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeWebHelper.qtx
C:\Program Files\QuickTime\QTSystem\QuickTimeWebHelper.Resources\da.lproj\QuickTimeWebHelperLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTimeWebHelper.Resources\da.lproj\QuickTimeWebHelperLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeWebHelper.Resources\de.lproj\QuickTimeWebHelperLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTimeWebHelper.Resources\de.lproj\QuickTimeWebHelperLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeWebHelper.Resources\en.lproj\QuickTimeWebHelperLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTimeWebHelper.Resources\en.lproj\QuickTimeWebHelperLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeWebHelper.Resources\es.lproj\QuickTimeWebHelperLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTimeWebHelper.Resources\es.lproj\QuickTimeWebHelperLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeWebHelper.Resources\fi.lproj\QuickTimeWebHelperLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTimeWebHelper.Resources\fi.lproj\QuickTimeWebHelperLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeWebHelper.Resources\fr.lproj\QuickTimeWebHelperLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTimeWebHelper.Resources\fr.lproj\QuickTimeWebHelperLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeWebHelper.Resources\it.lproj\QuickTimeWebHelperLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTimeWebHelper.Resources\it.lproj\QuickTimeWebHelperLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeWebHelper.Resources\ja.lproj\QuickTimeWebHelperLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTimeWebHelper.Resources\ja.lproj\QuickTimeWebHelperLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeWebHelper.Resources\ko.lproj\QuickTimeWebHelperLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTimeWebHelper.Resources\ko.lproj\QuickTimeWebHelperLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeWebHelper.Resources\nl.lproj\QuickTimeWebHelperLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTimeWebHelper.Resources\nl.lproj\QuickTimeWebHelperLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeWebHelper.Resources\no.lproj\QuickTimeWebHelperLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTimeWebHelper.Resources\no.lproj\QuickTimeWebHelperLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeWebHelper.Resources\QuickTimeWebHelper.dll
C:\Program Files\QuickTime\QTSystem\QuickTimeWebHelper.Resources\QuickTimeWebHelper.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeWebHelper.Resources\sv.lproj\QuickTimeWebHelperLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTimeWebHelper.Resources\sv.lproj\QuickTimeWebHelperLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeWebHelper.Resources\zh_CN.lproj\QuickTimeWebHelperLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTimeWebHelper.Resources\zh_CN.lproj\QuickTimeWebHelperLocalized.qtr
C:\Program Files\QuickTime\QTSystem\QuickTimeWebHelper.Resources\zh_TW.lproj\QuickTimeWebHelperLocalized.dll
C:\Program Files\QuickTime\QTSystem\QuickTimeWebHelper.Resources\zh_TW.lproj\QuickTimeWebHelperLocalized.qtr
C:\Program Files\QuickTime\qttask .exe
C:\Program Files\QuickTime\qttask .exe
C:\Program Files\QuickTime\qttask .exe
C:\Program Files\QuickTime\qttask .exe
C:\Program Files\QuickTime\qttask .exe
C:\Program Files\QuickTime\qttask .exe
C:\Program Files\QuickTime\qttask .exe
C:\Program Files\QuickTime\QTUIPanelControl.dll
C:\Program Files\QuickTime\QuickTime Read Me.htm
C:\Program Files\QuickTime\QuickTimePlayer.exe
C:\Program Files\QuickTime\QuickTimePlayer.Resources\QuickTimePlayer.qtr
C:\Program Files\QuickTime\Sample.mov
C:\Program Files\QuickTime\Sample.qtif
C:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe.tmp

[didymustoo]

.
((((((((((((((((((((((((( Files Created from 2008-01-20 to 2008-02-20 )))))))))))))))))))))))))))))))
.

2008-02-18 07:19 . 2008-02-18 07:19 <DIR> d--hs---- C:\FOUND.000
2008-02-16 21:09 . 2008-02-16 21:09 <DIR> d-------- C:\Program Files\Trend Micro
2008-02-16 14:48 . 2008-02-16 14:48 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-02-16 14:47 . 2008-02-16 14:47 <DIR> d-------- C:\WINDOWS\SYSTEM32\Kaspersky Lab
2008-02-15 09:04 . 2008-02-18 13:10 6,014 --a------ C:\WINDOWS\BMd711e700.xml
2008-02-15 09:04 . 2008-02-19 07:11 22 --a------ C:\WINDOWS\pskt.ini
2008-02-15 08:33 . 2008-02-15 08:33 <DIR> d-------- C:\mGame
2008-02-07 18:15 . 2008-02-07 18:15 67 --a------ C:\WINDOWS\101_ASB.INI
2008-02-07 18:14 . 2008-02-07 18:14 <DIR> d-------- C:\DISNEY
2008-02-02 21:39 . 2008-02-02 21:39 <DIR> d-------- C:\Documents and Settings\fjw\DoctorWeb
2008-01-31 22:34 . 2008-01-31 22:34 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-01-25 16:27 . 2008-01-25 16:27 110 --a------ C:\WINDOWS\HandySnap.INI
2008-01-22 22:01 . 2008-01-22 22:01 <DIR> d-------- C:\OutputFolder
2008-01-22 21:59 . 2008-01-22 21:59 <DIR> d-------- C:\Program Files\FLV to AVI MPEG WMV 3GP MP4 iPod Converter

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-16 14:39 186,000 ----a-w C:\Documents and Settings\fjw\Application Data\GDIPFONTCACHEV1.DAT
2008-01-14 13:49 155,648 ----a-w C:\WINDOWS\SYSTEM32\NeroCheck.exe
2008-01-11 05:53 44,544 ----a-w C:\WINDOWS\SYSTEM32\dllcache\pngfilt.dll
2007-12-26 05:07 8,413 ----a-w C:\WINDOWS\system32\drivers\mcstrm.sys
2007-12-26 05:07 --------- d-----w C:\Program Files\Common Files\Real
2007-12-26 05:03 --------- d-----w C:\Program Files\Best Buy Rhapsody
2007-12-19 23:01 347,136 ----a-w C:\WINDOWS\SYSTEM32\dllcache\dxtmsft.dll
2007-12-18 09:51 179,584 ----a-w C:\WINDOWS\SYSTEM32\dllcache\mrxdav.sys
2007-12-14 17:32 12,632 ----a-w C:\WINDOWS\SYSTEM32\lsdelete.exe
2007-12-08 05:21 3,592,192 ------w C:\WINDOWS\SYSTEM32\dllcache\mshtml.dll
2007-12-06 11:01 625,664 ------w C:\WINDOWS\SYSTEM32\dllcache\iexplore.exe
2007-12-06 11:00 70,656 ------w C:\WINDOWS\SYSTEM32\dllcache\ie4uinit.exe
2007-12-06 11:00 13,824 ------w C:\WINDOWS\SYSTEM32\dllcache\ieudinit.exe
2007-12-06 04:59 161,792 ------w C:\WINDOWS\SYSTEM32\dllcache\ieakui.dll
2007-12-04 18:38 550,912 ----a-w C:\WINDOWS\SYSTEM32\dllcache\oleaut32.dll
2007-12-04 18:38 550,912 ------w C:\WINDOWS\SYSTEM32\oleaut32.dll
2006-12-23 16:04 32 ----a-r C:\Documents and Settings\All Users\hash.dat
2006-01-11 02:13 159,312 ----a-w C:\Documents and Settings\Jeremy\Application Data\GDIPFONTCACHEV1.DAT
2005-11-05 03:58 33,750 ----a-w C:\WINDOWS\Internet Logs\GLB98_2nd_2005_11_04_21_58_33.dmp.zip
2005-11-05 03:58 33,668 ------w C:\WINDOWS\Internet Logs\GLB8F_2nd_2005_11_04_21_57_55.dmp.zip
2005-10-05 00:50 89,304 ------w C:\WINDOWS\Internet Logs\vsmon_2nd_2005_10_04_18_41_53_small.dmp.zip
2005-10-05 00:50 79,592 ------w C:\WINDOWS\Internet Logs\vsmon_2nd_2005_10_04_18_41_35_small.dmp.zip
2005-10-05 00:50 79,542 ------w C:\WINDOWS\Internet Logs\vsmon_2nd_2005_10_04_18_42_35_small.dmp.zip
2005-10-05 00:40 12,377,066 ------w C:\WINDOWS\Internet Logs\ZLCLIENT_2nd_2005_10_04_17_59_25_full.dmp.zip
2005-04-04 22:23 0 ---h--w C:\Program Files\AppUpdate.log
2004-09-21 20:07 86,016 ----a-w C:\Program Files\SPInstall.exe
2004-09-21 16:54 975 ----a-w C:\Program Files\ReadMe.txt
2004-09-21 16:05 1,841 ----a-w C:\Program Files\PackingList.txt
2004-09-21 15:36 908 ----a-w C:\Program Files\Setup.ini
2004-09-21 15:36 19,443,744 ----a-w C:\Program Files\Data1.cab
2004-09-21 15:36 1,591,952 ----a-w C:\Program Files\SundayPlus.msi
2004-09-21 15:35 225,280 ----a-w C:\Program Files\SPSetupHelper.exe
2004-09-15 02:35 49,152 ----a-w C:\Program Files\EnglishUI.dll
2004-04-23 00:02 560 ----a-w C:\Program Files\Global.sw
2004-01-10 02:34 266 --sh--w C:\Program Files\desktop.ini
2003-02-25 15:04 4,632 ----a-w C:\Program Files\0x0409.ini
2006-03-27 03:50 3,766 --sha-w C:\WINDOWS\SYSTEM32\KGyGaAvL.sys
2006-03-27 03:50 88 --sh--r C:\WINDOWS\SYSTEM32\D4B12B0226.sys
.

<pre>
----a-w 1,743,360 2008-01-14 22:45:08 C:\RECYCLED\Dc6\StyleXP .exe
----a-w 1,372,160 2008-01-17 13:35:48 C:\RECYCLED\Dc6\StyleXP .exe
</pre>


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SlowFile Icon Overlay]
@={7D688A77-C613-11D0-999B-00C04FD655E1}

[HKEY_CLASSES_ROOT\CLSID\{7D688A77-C613-11D0-999B-00C04FD655E1}]
2007-10-25 21:34 8460288 --a------ C:\WINDOWS\SYSTEM32\SHELL32.DLL

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:07 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-06-01 16:22 7618560]
"nwiz"="nwiz.exe" [2006-06-01 16:22 1519616 C:\WINDOWS\SYSTEM32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-06-01 16:22 86016]
"Tweak UI"="TWEAKUI.CPL" [2000-06-18 14:03 106544 C:\WINDOWS\SYSTEM32\TWEAKUI.CPL]
"ATIPTA"="atiptaxx.exe" [2001-09-27 01:39 245760 C:\WINDOWS\SYSTEM32\atiptaxx.exe]

C:\Documents and Settings\fjw\Start Menu\Programs\Startup\
Stardock ObjectDock.lnk - C:\Program Files\Stardock\ObjectDock\ObjectDock.exe [2007-01-08 21:22:17 2746104]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"<NO NAME>"= 00000000
"NoFavoritesMenu"= 01000000
"NoLogoff"= 0 (0x0)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"<NO NAME>"= 00000000
"NoFavoritesMenu"= 01000000
"NoActiveDesktopChanges"= 0 (0x0)
"NoLogoff"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="C:\\WINDOWS\\system32\\logonuiX.exe"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Corel MEDIA FOLDERS INDEXER 8.LNK]
backup=C:\WINDOWS\pss\Corel MEDIA FOLDERS INDEXER 8.LNKCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Encoder Agent.lnk]
backup=C:\WINDOWS\pss\Encoder Agent.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone Fast Start.lnk]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Cody^Start Menu^Programs^Startup^LimeWire On Startup.lnk]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AtiPTA]
--a------ 2001-09-27 01:39 245760 C:\WINDOWS\SYSTEM32\atiptaxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AuthConsoleStart]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearShare]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cmaudio]


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Corel Photo Downloader]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DesktopIconToy]
--a------ 2006-10-26 21:03 278528 C:\Program Files\Desktop Icon Toy\DesktopIconToy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ESP]
--a------ 2006-07-30 12:09 63008 C:\Program Files\Cox\Applications\app\start.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FolderShare]
C:\Program Files\FolderShare\FolderShare .exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a------ 2004-09-13 15:49 49152 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
--a------ 2003-03-26 05:34 172032 C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
--a------ 2005-06-10 10:44 249856 C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
--a------ 2005-06-10 10:44 81920 C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
C:\WINDOWS\system32\dumprep 0 -k

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogonStudio]
C:\Program Files\WinCustomize\LogonStudio\logonstudio.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Mobipocket Reader Notifications]
--a------ 2006-06-20 16:54 57344 C:\Program Files\Mobipocket.com\Mobipocket Reader\readernotify.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2008-02-13 18:24 2226688 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2008-01-14 07:49 155648 C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask .exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
--a------ 2008-02-16 14:49 2441216 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StarSkin]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\STYLEXP]
C:\Program Files\TGTSoft\StyleXP\StyleXP .exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TheMonitor]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a------ 2007-05-14 17:22 35328 C:\Program Files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"UPS"=3 (0x3)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"msnmsgr"="C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE" /background
"LogitechSoftwareUpdate"="C:\PROGRAM FILES\LOGITECH\VIDEO\MANIFESTENGINE.EXE" boot

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\setup\disabledrunkeys]
"Tweak UI"=RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
"SiS Tray"=C:\WINDOWS\SYSTEM32\sistray.exe
"StillImageMonitor"=C:\WINDOWS\SYSTEM32\stimon.exe

R2 ppsio2;PPDevice;C:\WINDOWS\system32\drivers\ppsio2.sys [1999-04-01 19:16]
R3 ati2mtaa;ati2mtaa;C:\WINDOWS\system32\DRIVERS\ati2mtaa.sys [2001-09-27 00:32]
S3 BCM42XX;Broadcom iLine10(tm) Network Adapter Driver;C:\WINDOWS\system32\DRIVERS\bcm42xx5.sys [2001-08-17 12:11]
S3 dump_wmimmc;dump_wmimmc;C:\Program Files\Gpotato\Flyff\GameGuard\dump_wmimmc.sys []
S3 PhilCam8116;Logitech QuickCam Pro 3000 (08B0);C:\WINDOWS\system32\DRIVERS\CamDrO21.sys [2001-08-17 14:05]
S3 XDva090;XDva090;C:\WINDOWS\system32\XDva090.sys []


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\MmoptPreferredAudioDevices]
rundll32.exe shell32.dll,Control_RunDLL mmsys.cpl,@0,SUSB\VID_046D&PID_08B0&MI_01\1USB&VID_046D&PID_08B0&INST_0

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9EF0045A-CDD9-438e-95E6-02B9AFEC8E11}]
C:\WINDOWS\SYSTEM32\updcrl.exe -e -u C:\WINDOWS\SYSTEM\verisignpub1.crl
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-20 09:19:47
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-20 9:20:14
ComboFix-quarantined-files.txt 2008-02-20 15:20:14
ComboFix4.txt 2008-02-19 14:55:02
ComboFix3.txt 2008-02-19 18:44:16
ComboFix2.txt 2008-02-19 19:16:22
.
2008-02-15 05:58:29 --- E O F ---

[didymustoo]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:01:25 PM, on 2/20/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
c:\Program Files\Common Files\Command Software\dvpapi.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\atiptaxx.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\WINDOWS\SYSTEM32\LVCOMSX.EXE
C:\WINDOWS\explorer.exe
C:\Program Files\Opera\Opera.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\didymustoo.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
N3 - Netscape 7: user_pref("browser.search.defaultengine", "http://www.google.com/"); (C:\Documents and Settings\FJW\Application Data\Mozilla\Profiles\default\brw22mi9.slt\prefs.js)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll (file missing)
O3 - Toolbar: (no name) - {2C0A5F28-48D8-408B-9172-9C6121025BCE} - (no file)
O3 - Toolbar: TextAloud - {F053C368-5458-45B2-9B4D-D8914BDDDBFF} - C:\PROGRA~1\TEXTAL~1\TAForIE.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Search - ?p=ZJfox000
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {03A0F84E-3E69-4B3E-B4D3-019CB73B57B3} (AuthWebWizardMain.DHTMLPage1) - http://www3.authentium.com/cssrelease/bin/WizMain.exe
O16 - DPF: {1B4F9DD7-2D7C-44B5-9126-73206DA0AE75} (CNavigationManager Object) - http://www3.authentium.com/cssrelease/bin/wizard.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photo.walgreens.com/WalgreensActivia.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-3-36.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111401/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {7C5D062A-7A1E-4A46-A02B-A928084CBD66} (MLauncherNew Class) - http://legendofares.netgame.com/download/MusaLauncherNew.cab
O16 - DPF: {9C024426-7859-4B2D-AB4C-B1E370AE7549} - http://us.mcafee.com/Apps/WSC/en-us/WscWlanScannerCtrl.cab
O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex/EPSControl_v1-32.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?326
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,1,0,4692/mcfscan.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - c:\Program Files\Common Files\Command Software\dvpapi.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 5688 bytes

[Shaba]

Hi

Please download and install CCleaner Slim (http://www.ccleaner.com/download/builds/downloading-slim).
Once installed, double click on the desktop shortcut created.
On the leftmost column, click on Tools.
On the middle column, click on Uninstall.
At the bottom right hand corner, click on the Save to text file... button.
By default, it saves this file to C:\Program Files\CCleaner named install.txt. You may want to save it to your desktop to find it easily. Click Save.
Close CCleaner.

[didymustoo]

You didn't say but I'm guessing you want a copy of install.txt posted.

101 Dalmatians StoryBook
3D Morris 2.02
ABC Coloring Book
ACDSee Classic
Ad-Aware 2007
Add-Remove Manager
Adobe Flash Player 9 ActiveX
Adobe MPEG Encoder
Adobe Photoshop Elements 2.0
ATI Display Driver
Audacity 1.2.4
Authentium
AVG Anti-Spyware 7.5
Browser Mouse
BufferChm
Business Cards & Certificates
CameraDrivers
CCleaner (remove only)
Church Helpmate 2006
Cleanse Uninstaller 2.57
ClearType Tuning Control Panel Applet
Coloring Book - SHAREWARE
Creative Painter
CreativeProjects
CreativeProjectsTemplates
CueTour
Destinations
Direct WAV MP3 Splitter 2.4
Director
DivX Codec
DivX Converter
dMap
East-Tec Eraser 2007 Version 8.5
Elprime Media Recovery 1.0
ESP
EVEREST Home Edition v2.20
FLV to AVI MPEG WMV 3GP MP4 iPod Converter 3.9.1108
Font-Effects 2
FreeRIP v2.951
G-Force
Google Earth
Google Video Player
HijackThis 2.0.2
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB909394)
Hotfix for Windows XP (KB914440)
hp deskjet 5100
HP Image Zone 4.5
HP Photosmart Cameras 4.5
HP Product Assistant
HPSystemDiagnostics
Hyplay
IcePattern 1.22 for Adobe Photoshop
iCorrect Entrée 4.0
InstantShare
J2SE Runtime Environment 5.0 Update 1
J2SE Runtime Environment 5.0 Update 4
J2SE Runtime Environment 5.0 Update 6
Java 2 Runtime Environment, SE v1.4.2_01
Java 2 Runtime Environment, SE v1.4.2_04
JPGVideo 1.05.0.0
Kaspersky Online Scanner
Kids Colouring Book 2006
K-Lite Codec Pack 2.85 Full
Liquid Story Binder XE 1.71
Logitech ImageStudio
Macromedia Shockwave Player
Melody Assistant
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0
Microsoft Access 2002 Runtime
Microsoft Bootvis
Microsoft IntelliPoint 4.1
Microsoft Office 2000 Disc 2
Microsoft Office Professional Edition 2003
Microsoft Office XP Professional with FrontPage
Microsoft Office XP Web Components
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft XML Parser
Mobipocket Reader 5.2
Monkey's Audio
Mozilla Firefox (2.0.0.12)
MSN Messenger 6.2
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 Parser and SDK
Nero 6 Ultra Edition
neroxml
NVIDIA Drivers
ObjectDock
Opera 9.24
PanoStandAlone
PhotoGallery
Pocket e-Sword (2003)
QFolder
Real Alternative 1.50
Registry Commander v1.04
RIP v1.1.0
RoAClient
Security Update for Microsoft .NET Framework 2.0 (KB917283)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB899589)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB908531)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911567)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913446)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB917159)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920214)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB921503)
Security Update for Windows XP (KB921883)
Security Update for Windows XP (KB922616)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB923694)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB933729)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
Security Update for Windows XP (KB936021)
Security Update for Windows XP (KB937894)
Security Update for Windows XP (KB938829)
Security Update for Windows XP (KB941202)
Security Update for Windows XP (KB941568)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB941644)
Security Update for Windows XP (KB943055)
Security Update for Windows XP (KB943460)
Security Update for Windows XP (KB943485)
Security Update for Windows XP (KB944653)
Security Update for Windows XP (KB946026)
SkinsHP1
SmartFTP Client
SmartSound Quicktracks Plugin
Sonic RecordNow DX
Spybot - Search & Destroy
Spybot - Search & Destroy 1.4
Spyware Terminator
StopTime
SundayPlus
SundayPlus Media
SWiSHmax
System Requirements Lab
TextAloud
The Battle for Middle-earth (tm)
TrayApp
Tux Paint 0.9.16
Tux Paint Stamps 2006-10-21
Unload
Unreal Tournament G.O.T.Y. Edition
Update for Windows XP (KB900485)
Update for Windows XP (KB904942)
Update for Windows XP (KB910437)
Update for Windows XP (KB911280)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB927891)
Update for Windows XP (KB929338)
Update for Windows XP (KB930916)
Update for Windows XP (KB931836)
Update for Windows XP (KB933360)
Update for Windows XP (KB938828)
Update for Windows XP (KB942763)
VideoLAN VLC media player 0.8.6a
Visioneer 3300 Scanner Driver
WebFldrs XP
WebReg
Win2PDF 2.80
Winamp (remove only)
Windows Genuine Advantage v1.3.0254.0
Windows Internet Explorer 7
Windows Media Player Firefox Plugin
WINTREB
WIRELESS NETWORKER
WisePixel HandySnap 1.2
Xilisoft FLV Converter
Zoner Draw 3

[Shaba]

Hi

Oops, my bad :oops:

Uninstall these via Ccleaner (Tools - Uninstall):

Authentium
J2SE Runtime Environment 5.0 Update 1
J2SE Runtime Environment 5.0 Update 4
Java 2 Runtime Environment, SE v1.4.2_01
Java 2 Runtime Environment, SE v1.4.2_04

After that, install one antivirus from below:

Looking over your log, it seems you don't have any evidence of an anti-virus software.

Anti-virus software are programs that detect, cleanse, and erase harmful virus files on a computer, Web server, or network. Unchecked, virus files can unintentionally be forwarded to others, including trading partners and thereby spreading infection. Because new viruses regularly emerge, anti-virus software should be updated frequently. Anti-virus software can scan the computer memory and disk drives for malicious code. They can alert the user if a virus is present, and will clean, delete (or quarantine) infected files or directories. Please download a free anti-virus software from one these excellent vendors NOW:

1) Antivir PersonalEdition Classic (http://www.free-av.com/)- Free anti-virus software for Windows. Detects and removes more than 50,000 viruses. Free support.
2) avast! 4 Home Edition (http://www.avast.com/eng/avast_4_home.html) - Anti-virus program for Windows. The home edition is freeware for noncommercial users.
3) AVG Anti-Virus Free Edition (http://free.grisoft.com/doc/1) - Free edition of the AVG anti-virus program for Windows.

It is strongly recommended that you run only one antivirus program at a time. Having more than one antivirus program active in memory uses additional resources and can result in program conflicts and false virus alerts. If you choose to install more than one antivirus program on your computer, then only one of them should be active in memory at a time.

Post back a fresh HijackThis log.

[didymustoo]

I uninstalled the programs you indicated. It asked if I wanted the computer restarted and I said No to each instance.

I then downloaded Antivir and ran it. I chose to let it update but the update failed and I closed the program without running it.

I have just run HJT. Here is the log. Note: I have not restarted the computer yet.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:34:49 PM, on 2/20/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
c:\Program Files\Common Files\Command Software\dvpapi.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\atiptaxx.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\WINDOWS\SYSTEM32\LVCOMSX.EXE
C:\WINDOWS\explorer.exe
C:\Program Files\Opera\Opera.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Trend Micro\HijackThis\didymustoo.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
N3 - Netscape 7: user_pref("browser.search.defaultengine", "http://www.google.com/"); (C:\Documents and Settings\FJW\Application Data\Mozilla\Profiles\default\brw22mi9.slt\prefs.js)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll (file missing)
O3 - Toolbar: (no name) - {2C0A5F28-48D8-408B-9172-9C6121025BCE} - (no file)
O3 - Toolbar: TextAloud - {F053C368-5458-45B2-9B4D-D8914BDDDBFF} - C:\PROGRA~1\TEXTAL~1\TAForIE.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Search - ?p=ZJfox000
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM32\MSJAVA.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM32\MSJAVA.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {03A0F84E-3E69-4B3E-B4D3-019CB73B57B3} (AuthWebWizardMain.DHTMLPage1) - http://www3.authentium.com/cssrelease/bin/WizMain.exe
O16 - DPF: {1B4F9DD7-2D7C-44B5-9126-73206DA0AE75} (CNavigationManager Object) - http://www3.authentium.com/cssrelease/bin/wizard.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photo.walgreens.com/WalgreensActivia.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-3-36.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111401/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {7C5D062A-7A1E-4A46-A02B-A928084CBD66} (MLauncherNew Class) - http://legendofares.netgame.com/download/MusaLauncherNew.cab
O16 - DPF: {9C024426-7859-4B2D-AB4C-B1E370AE7549} - http://us.mcafee.com/Apps/WSC/en-us/WscWlanScannerCtrl.cab
O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex/EPSControl_v1-32.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?326
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,1,0,4692/mcfscan.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - c:\Program Files\Common Files\Command Software\dvpapi.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 6663 bytes

[Shaba]

Hi

Please reboot computer and post back after that a fresh HijackThis log :)

[didymustoo]

Rebooted and here is the fresh HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:47:28 PM, on 2/20/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
c:\Program Files\Common Files\Command Software\dvpapi.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\atiptaxx.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\didymustoo.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
N3 - Netscape 7: user_pref("browser.search.defaultengine", "http://www.google.com/"); (C:\Documents and Settings\FJW\Application Data\Mozilla\Profiles\default\brw22mi9.slt\prefs.js)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll (file missing)
O3 - Toolbar: (no name) - {2C0A5F28-48D8-408B-9172-9C6121025BCE} - (no file)
O3 - Toolbar: TextAloud - {F053C368-5458-45B2-9B4D-D8914BDDDBFF} - C:\PROGRA~1\TEXTAL~1\TAForIE.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Search - ?p=ZJfox000
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM32\MSJAVA.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM32\MSJAVA.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {03A0F84E-3E69-4B3E-B4D3-019CB73B57B3} (AuthWebWizardMain.DHTMLPage1) - http://www3.authentium.com/cssrelease/bin/WizMain.exe
O16 - DPF: {1B4F9DD7-2D7C-44B5-9126-73206DA0AE75} (CNavigationManager Object) - http://www3.authentium.com/cssrelease/bin/wizard.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photo.walgreens.com/WalgreensActivia.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-3-36.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111401/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {7C5D062A-7A1E-4A46-A02B-A928084CBD66} (MLauncherNew Class) - http://legendofares.netgame.com/download/MusaLauncherNew.cab
O16 - DPF: {9C024426-7859-4B2D-AB4C-B1E370AE7549} - http://us.mcafee.com/Apps/WSC/en-us/WscWlanScannerCtrl.cab
O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex/EPSControl_v1-32.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?326
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,1,0,4692/mcfscan.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - c:\Program Files\Common Files\Command Software\dvpapi.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 6596 bytes

[Shaba]

Hi

Ok Command antivirus removal wasn't complete

Open HijackThis, click do a system scan only and checkmark these:

O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll (file missing)
O3 - Toolbar: (no name) - {2C0A5F28-48D8-408B-9172-9C6121025BCE} - (no file)
O8 - Extra context menu item: &Search - ?p=ZJfox000
O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - c:\Program Files\Common Files\Command Software\dvpapi.exe

Close all windows including browser and press fix checked.

Reboot.

Delete if present:

c:\Program Files\Common Files\Command Software

Empty Recycle Bin.

Post back a fresh HijackThis log.

[didymustoo]

Command Software folder is present after reboot. When I attempt to delete it error message says, "Cannot delete dvpapi.exe: Access is denied. When I check folder all items are still present.:sad:

[didymustoo]

Latest HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:08:52 PM, on 2/20/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
c:\Program Files\Common Files\Command Software\dvpapi.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\atiptaxx.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Opera\Opera.exe
C:\WINDOWS\SYSTEM32\LVCOMSX.EXE
C:\Program Files\Java\jre1.5.0_06\bin\jucheck.exe
C:\Program Files\Trend Micro\HijackThis\didymustoo.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
N3 - Netscape 7: user_pref("browser.search.defaultengine", "http://www.google.com/"); (C:\Documents and Settings\FJW\Application Data\Mozilla\Profiles\default\brw22mi9.slt\prefs.js)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: TextAloud - {F053C368-5458-45B2-9B4D-D8914BDDDBFF} - C:\PROGRA~1\TEXTAL~1\TAForIE.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM32\MSJAVA.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM32\MSJAVA.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {03A0F84E-3E69-4B3E-B4D3-019CB73B57B3} (AuthWebWizardMain.DHTMLPage1) - http://www3.authentium.com/cssrelease/bin/WizMain.exe
O16 - DPF: {1B4F9DD7-2D7C-44B5-9126-73206DA0AE75} (CNavigationManager Object) - http://www3.authentium.com/cssrelease/bin/wizard.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photo.walgreens.com/WalgreensActivia.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-3-36.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111401/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {7C5D062A-7A1E-4A46-A02B-A928084CBD66} (MLauncherNew Class) - http://legendofares.netgame.com/download/MusaLauncherNew.cab
O16 - DPF: {9C024426-7859-4B2D-AB4C-B1E370AE7549} - http://us.mcafee.com/Apps/WSC/en-us/WscWlanScannerCtrl.cab
O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex/EPSControl_v1-32.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?326
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,1,0,4692/mcfscan.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - c:\Program Files\Common Files\Command Software\dvpapi.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 6402 bytes

[didymustoo]

I ran Antivir. It found 6 viruses and quarantined them. I then tried to delete Command Software and failed. I then went to Windows Task Manager and shut down dvpapi.exe process. I was then able to delete Command Software. I then ran Hijackthis and here is the log.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:49:54 PM, on 2/20/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\atiptaxx.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRAM FILES\LOGITECH\VIDEO\FXSVR2.EXE
C:\WINDOWS\SYSTEM32\LVCOMSX.EXE
C:\Program Files\Trend Micro\HijackThis\didymustoo.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
N3 - Netscape 7: user_pref("browser.search.defaultengine", "http://www.google.com/"); (C:\Documents and Settings\FJW\Application Data\Mozilla\Profiles\default\brw22mi9.slt\prefs.js)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: TextAloud - {F053C368-5458-45B2-9B4D-D8914BDDDBFF} - C:\PROGRA~1\TEXTAL~1\TAForIE.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM32\MSJAVA.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM32\MSJAVA.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {03A0F84E-3E69-4B3E-B4D3-019CB73B57B3} (AuthWebWizardMain.DHTMLPage1) - http://www3.authentium.com/cssrelease/bin/WizMain.exe
O16 - DPF: {1B4F9DD7-2D7C-44B5-9126-73206DA0AE75} (CNavigationManager Object) - http://www3.authentium.com/cssrelease/bin/wizard.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photo.walgreens.com/WalgreensActivia.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-3-36.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111401/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {7C5D062A-7A1E-4A46-A02B-A928084CBD66} (MLauncherNew Class) - http://legendofares.netgame.com/download/MusaLauncherNew.cab
O16 - DPF: {9C024426-7859-4B2D-AB4C-B1E370AE7549} - http://us.mcafee.com/Apps/WSC/en-us/WscWlanScannerCtrl.cab
O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex/EPSControl_v1-32.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?326
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,1,0,4692/mcfscan.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: DvpApi (dvpapi) - Unknown owner - c:\Program Files\Common Files\Command Software\dvpapi.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 6300 bytes

[Shaba]

Hi

Yes, services can be stubborn


Please click Start > Run and type in: services.msc
Click OK
In the Services window find: DvpApi (dvpapi)
Select/highlight and right click the entry, and choose: Properties
On the General tab, under Service Status click the Stop button
Beside: Startup Type, in the drop menu, select: Disabled
Click Apply, then OK

Now, go to Start > Run, and copy/paste the following into the Open box:
sc delete dvpapi
Click: OK

Reboot.

Post back a fresh HijackThis log.

[didymustoo]

Here is the HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:34:38 AM, on 2/21/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\atiptaxx.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\Program Files\Trend Micro\HijackThis\didymustoo.exe
C:\WINDOWS\system32\wuauclt.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
N3 - Netscape 7: user_pref("browser.search.defaultengine", "http://www.google.com/"); (C:\Documents and Settings\FJW\Application Data\Mozilla\Profiles\default\brw22mi9.slt\prefs.js)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: TextAloud - {F053C368-5458-45B2-9B4D-D8914BDDDBFF} - C:\PROGRA~1\TEXTAL~1\TAForIE.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM32\MSJAVA.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM32\MSJAVA.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {03A0F84E-3E69-4B3E-B4D3-019CB73B57B3} (AuthWebWizardMain.DHTMLPage1) - http://www3.authentium.com/cssrelease/bin/WizMain.exe
O16 - DPF: {1B4F9DD7-2D7C-44B5-9126-73206DA0AE75} (CNavigationManager Object) - http://www3.authentium.com/cssrelease/bin/wizard.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photo.walgreens.com/WalgreensActivia.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-3-36.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111401/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {7C5D062A-7A1E-4A46-A02B-A928084CBD66} (MLauncherNew Class) - http://legendofares.netgame.com/download/MusaLauncherNew.cab
O16 - DPF: {9C024426-7859-4B2D-AB4C-B1E370AE7549} - http://us.mcafee.com/Apps/WSC/en-us/WscWlanScannerCtrl.cab
O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex/EPSControl_v1-32.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?326
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,1,0,4692/mcfscan.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 6100 bytes

[Shaba]

Hi

Please do an online scan with Kaspersky Online Scanner (http://www.kaspersky.com/downloads/kws/kavwebscan.html). You will be prompted to install an ActiveX component from Kaspersky, Click Yes.
The program will launch and then start to download the latest definition files.
Once the scanner is installed and the definitions downloaded, click Next.
Now click on Scan Settings
In the scan settings make sure that the following are selected:

o Scan using the following Anti-Virus database:

+ Extended (If available otherwise Standard)

o Scan Options:

+ Scan Archives
+ Scan Mail Bases

Click OK
Now under select a target to scan select My Computer
The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected.
Now click on the Save as Text button
Save the file to your desktop.
Copy and paste that information in your next post.

Note: This scanner will work with Internet Explorer Only!

Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the license, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%.

Post:

- a fresh HijackThis log
- kaspersky report

[didymustoo]

Ok, here is the HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:36:38 AM, on 2/21/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\atiptaxx.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\Program Files\Java\jre1.5.0_06\bin\jucheck.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Opera\Opera.exe
C:\Program Files\Trend Micro\HijackThis\didymustoo.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
N3 - Netscape 7: user_pref("browser.search.defaultengine", "http://www.google.com/"); (C:\Documents and Settings\FJW\Application Data\Mozilla\Profiles\default\brw22mi9.slt\prefs.js)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: TextAloud - {F053C368-5458-45B2-9B4D-D8914BDDDBFF} - C:\PROGRA~1\TEXTAL~1\TAForIE.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM32\MSJAVA.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM32\MSJAVA.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {03A0F84E-3E69-4B3E-B4D3-019CB73B57B3} (AuthWebWizardMain.DHTMLPage1) - http://www3.authentium.com/cssrelease/bin/WizMain.exe
O16 - DPF: {1B4F9DD7-2D7C-44B5-9126-73206DA0AE75} (CNavigationManager Object) - http://www3.authentium.com/cssrelease/bin/wizard.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photo.walgreens.com/WalgreensActivia.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-3-36.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111401/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {7C5D062A-7A1E-4A46-A02B-A928084CBD66} (MLauncherNew Class) - http://legendofares.netgame.com/download/MusaLauncherNew.cab
O16 - DPF: {9C024426-7859-4B2D-AB4C-B1E370AE7549} - http://us.mcafee.com/Apps/WSC/en-us/WscWlanScannerCtrl.cab
O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex/EPSControl_v1-32.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?326
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,1,0,4692/mcfscan.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 6186 bytes

[didymustoo]

And here is the Kapersky scan report:
In 3 parts
-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Thursday, February 21, 2008 11:35:26 AM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 21/02/2008
Kaspersky Anti-Virus database records: 574456
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\
G:\

Scan Statistics:
Total number of scanned objects: 99575
Number of viruses found: 7
Number of infected objects: 325
Number of suspicious objects: 0
Duration of the scan process: 01:41:05

Infected Object Name / Virus Name / Last Action
C:\WINDOWS\SYSTEM32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\SYSTEM32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\SYSTEM32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\SYSTEM32\config\system.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\config\software.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\config\default.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\config\Internet.evt Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SECURITY Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SOFTWARE Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SYSTEM Object is locked skipped
C:\WINDOWS\SYSTEM32\config\DEFAULT Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SAM Object is locked skipped
C:\WINDOWS\SYSTEM32\h323log.txt Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\SchedLog.Txt Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe Infected: Virus.Win32.Trats.d skipped
C:\Program Files\Messenger\msmsgs.exe Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\ctfmon.exe.tmp.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\RCXD.tmp.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\000080.exe.vir/stream/data0001 Infected: not-a-virus:AdWare.Win32.Agent.vv skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\000080.exe.vir/stream Infected: not-a-virus:AdWare.Win32.Agent.vv skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\000080.exe.vir NSIS: infected - 2 skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\oppop.exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\asgtxevg.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\bvmivvlm.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\cfwyjgkd.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\cqmmbeyu.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\cunbxjyh.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\dawlrvkx.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\dhlytgul.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\ehvhsute.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\enipjeie.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\epmuqjre.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\eyhltecu.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\fgvgeoyw.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\gqktdkul.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\htjqefbw.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\hyuluxek.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\ibnxcxsu.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\ifrobeor.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\iijfonay.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\infidjge.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\jikklstw.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\jjfyafpe.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\jopiwaiu.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\kaynflju.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\kgqfyeng.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\kpiygyod.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\lexmaurd.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\lixxmeks.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\mrjtduel.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\nmrheveg.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\nojhboue.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\nsbwxdwh.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.eby skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\okgterca.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\omfsyygy.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\onxlwkmd.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\oppop.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\pohwibin.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\pvmfdxkx.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.eby skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\qogdaoim.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\qvkdjrrn.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\qwlbrbhh.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\rdjrctnw.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\rplvmnnr.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\rsapyvfp.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\rvckajue.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\sqhaxkas.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\thvdfbkm.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\uguedion.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\uwjxnmwa.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\vaubnybh.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\vkcnjxyt.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\vmckrlyo.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\vohyvxgl.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\xcyeawxw.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\xebrdxtv.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\xqpvyafu.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\ycariooq.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\yhdnkuln.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\yltfcxlb.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\pchealth\helpctr\binaries\msconfig.exe.tmp.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\FolderShare\FolderShare .exe.vir Infected: Virus.Win32.Trats.d skipped

[didymustoo]

C:\QooBox\Quarantine\C\Program Files\FolderShare\FolderShare .exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\FolderShare\FolderShare .exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\FolderShare\FolderShare .exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\FolderShare\FolderShare .exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\FolderShare\FolderShare .exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\FolderShare\FolderShare .exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\FolderShare\FolderShare .exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\FolderShare\FolderShare .exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\FolderShare\FolderShare .exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\FolderShare\FolderShare .exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\FolderShare\FolderShare .exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\FolderShare\FolderShare .exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\FolderShare\FolderShare .exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\FolderShare\FolderShare .exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\FolderShare\FolderShare .exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\FolderShare\FolderShare .exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\FolderShare\FolderShare .exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\FolderShare\FolderShare .exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\FolderShare\FolderShare .exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\FolderShare\FolderShare .exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\FolderShare\FolderShare .exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\FolderShare\FolderShare .exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\FolderShare\FolderShare .exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\FolderShare\FolderShare .exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\FolderShare\FolderShare .exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\FolderShare\FolderShare .exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\FolderShare\FolderShare .exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\FolderShare\FolderShare .exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\FolderShare\FolderShare .exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\FolderShare\FolderShare .exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\FolderShare\FolderShare .exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\FolderShare\FolderShare .exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\FolderShare\FolderShare .exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\FolderShare\FolderShare .exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\FolderShare\FolderShare .exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\FolderShare\FolderShare .exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\FolderShare\FolderShare .exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\FolderShare\FolderShare .exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\FolderShare\FolderShare .exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\FolderShare\FolderShare .exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\FolderShare\FolderShare .exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\FolderShare\FolderShare .exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\FolderShare\FolderShare .exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\FolderShare\FolderShare .exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\FolderShare\FolderShare .exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\FolderShare\FolderShare .exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\FolderShare\FolderShare .exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\FolderShare\FolderShare .exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\FolderShare\FolderShare .exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\FolderShare\FolderShare .exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\FolderShare\FolderShare .exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\QuickTime\qttask .exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\QuickTime\qttask .exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\QuickTime\qttask .exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\QuickTime\qttask .exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\QuickTime\qttask .exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\QuickTime\qttask .exe.vir Infected: Virus.Win32.Trats.d skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\fjw\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\fjw\Local Settings\History\History.IE5\MSHist012008022120080222\index.dat Object is locked skipped
C:\Documents and Settings\fjw\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\fjw\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\fjw\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
C:\Documents and Settings\fjw\Local Settings\Application Data\Microsoft\Outlook\outlook.pst/Personal Folders/Deleted Items/Junk E-mail/16 May 2004 18:01 from sales:Re: Payment approved (invoce #5989)/report.zip/report.exe Infected: Trojan-Downloader.Win32.Small.ju skipped
C:\Documents and Settings\fjw\Local Settings\Application Data\Microsoft\Outlook\outlook.pst/Personal Folders/Deleted Items/Junk E-mail/16 May 2004 18:01 from sales:Re: Payment approved (invoce #5989)/report.zip Infected: Trojan-Downloader.Win32.Small.ju skipped
C:\Documents and Settings\fjw\Local Settings\Application Data\Microsoft\Outlook\outlook.pst/Personal Folders/Deleted Items/Junk E-mail/20 May 2004 06:50 from sales/report.zip/report.pif Infected: Trojan-Downloader.Win32.Small.ju skipped
C:\Documents and Settings\fjw\Local Settings\Application Data\Microsoft\Outlook\outlook.pst/Personal Folders/Deleted Items/Junk E-mail/20 May 2004 06:50 from sales/report.zip Infected: Trojan-Downloader.Win32.Small.ju skipped
C:\Documents and Settings\fjw\Local Settings\Application Data\Microsoft\Outlook\outlook.pst/Personal Folders/Deleted Items/Junk E-mail/05 Sep 2004 15:08 from pegasoft@cc.ruu.nl:Re: A!p$ghsa/details03.zip/document.txt .exe Infected: Email-Worm.Win32.NetSky.q skipped
C:\Documents and Settings\fjw\Local Settings\Application Data\Microsoft\Outlook\outlook.pst/Personal Folders/Deleted Items/Junk E-mail/05 Sep 2004 15:08 from pegasoft@cc.ruu.nl:Re: A!p$ghsa/details03.zip Infected: Email-Worm.Win32.NetSky.q skipped
C:\Documents and Settings\fjw\Local Settings\Application Data\Microsoft\Outlook\outlook.pst Mail MS Mail: infected - 6 skipped
C:\Documents and Settings\fjw\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\fjw\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\fjw\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped
C:\Documents and Settings\fjw\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\fjw\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\zach\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jvmimpro.jar-3ad601a5-386a88f2.zip/vmain.class Infected: Exploit.Java.Gimsh.b skipped
C:\Documents and Settings\zach\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jvmimpro.jar-3ad601a5-386a88f2.zip ZIP: infected - 1 skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP318\A0071689.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP318\A0071690.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP318\A0071697.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP319\A0071738.EXE Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP319\A0072732.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP319\A0072733.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP320\A0072740.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP320\A0072742.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP320\A0072776.EXE Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP320\A0072778.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP320\A0073770.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP320\A0073775.EXE Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP320\A0073784.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP320\A0074776.EXE Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP320\A0074779.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP321\A0074825.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP322\A0074865.DLL Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP322\A0074866.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP322\A0074873.EXE Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP322\A0074875.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP323\A0074910.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP323\A0074911.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP323\A0074918.EXE Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP323\A0074919.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP324\A0074964.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP324\A0074965.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP324\A0074972.EXE Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP324\A0074974.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP325\A0075014.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP325\A0075015.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP325\A0075021.EXE Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP325\A0075027.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP326\A0075065.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP326\A0075066.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP326\A0075073.EXE Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP326\A0075099.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP326\A0075100.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped

[didymustoo]

C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP326\A0075107.EXE Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP327\A0075151.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP327\A0075194.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP327\A0075202.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP327\A0075203.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP327\A0075212.EXE Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP329\A0075329.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP329\A0075330.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP329\A0075354.EXE Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP329\A0075356.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP330\A0075392.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP330\A0075398.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP330\A0075402.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP330\A0075405.EXE Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP330\A0075407.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP331\A0075474.EXE Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP331\A0075482.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP331\A0075485.EXE Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP331\A0075502.EXE Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP331\A0075554.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP331\A0075556.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP331\A0075568.EXE Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP331\A0075570.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP331\A0075571.EXE Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP331\A0075572.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP331\A0075573.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP331\A0075612.EXE Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP331\A0075616.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP332\A0076608.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP332\A0076614.EXE Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP332\A0076646.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP333\A0076690.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP333\A0076696.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076712.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Agent.vv skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076712.exe/stream Infected: not-a-virus:AdWare.Win32.Agent.vv skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076712.exe NSIS: infected - 2 skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076713.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076714.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076715.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076716.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076717.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076718.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076719.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076720.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076721.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076722.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076723.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076724.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076725.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076726.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076727.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076728.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076729.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076730.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076731.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076732.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076733.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076734.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076735.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076736.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076737.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076738.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076739.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076740.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076741.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076742.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076743.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076744.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.eby skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076745.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076746.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076747.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076748.DLL Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076749.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076750.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.eby skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076751.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076752.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076753.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076754.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076755.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076756.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076757.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076758.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076759.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076760.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076761.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076762.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076763.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076764.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076765.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076766.DLL Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076767.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076768.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076769.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076770.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076771.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077079.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077080.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077081.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077082.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077083.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077084.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077085.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077086.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077087.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077088.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077089.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077090.exe Infected: Virus.Win32.Trats.d skipped

[didymustoo]

C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077091.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077092.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077093.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077094.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077095.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077096.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077097.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077098.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077099.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077100.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077101.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077102.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077103.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077104.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077105.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077106.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077107.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077108.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077109.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077110.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077111.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077112.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077113.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077114.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077115.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077116.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077117.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077118.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077119.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077120.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077121.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077122.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077123.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077124.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077125.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077126.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077127.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077128.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077129.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077130.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077137.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077138.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077139.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077140.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077141.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077142.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077247.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP343\change.log Object is locked skipped

Scan process completed.

[Shaba]

Hi

Uninstall via add/remove programs:

Spybot Search & Destroy

Empty these folders:

C:\QooBox\Quarantine
C:\Documents and Settings\zach\Application Data\Sun\Java\Deployment\cache

Delete these:

C:\Program Files\Spybot - Search & Destroy
C:\Program Files\Messenger\msmsgs.exe

Empty Recycle Bin

Delete these mails:

C:\Documents and Settings\fjw\Local Settings\Application Data\Microsoft\Outlook\outlook.pst/Personal Folders/Deleted Items/Junk E-mail/16 May 2004 18:01 from sales:Re: Payment approved (invoce #5989)/report.zip/report.exe Infected: Trojan-Downloader.Win32.Small.ju skipped
C:\Documents and Settings\fjw\Local Settings\Application Data\Microsoft\Outlook\outlook.pst/Personal Folders/Deleted Items/Junk E-mail/16 May 2004 18:01 from sales:Re: Payment approved (invoce #5989)/report.zip Infected: Trojan-Downloader.Win32.Small.ju skipped
C:\Documents and Settings\fjw\Local Settings\Application Data\Microsoft\Outlook\outlook.pst/Personal Folders/Deleted Items/Junk E-mail/20 May 2004 06:50 from sales/report.zip/report.pif Infected: Trojan-Downloader.Win32.Small.ju skipped
C:\Documents and Settings\fjw\Local Settings\Application Data\Microsoft\Outlook\outlook.pst/Personal Folders/Deleted Items/Junk E-mail/20 May 2004 06:50 from sales/report.zip Infected: Trojan-Downloader.Win32.Small.ju skipped
C:\Documents and Settings\fjw\Local Settings\Application Data\Microsoft\Outlook\outlook.pst/Personal Folders/Deleted Items/Junk E-mail/05 Sep 2004 15:08 from :Re: A!p$ghsa/details03.zip/document.txt .exe Infected: Email-Worm.Win32.NetSky.q skipped
C:\Documents and Settings\fjw\Local Settings\Application Data\Microsoft\Outlook\outlook.pst/Personal Folders/Deleted Items/Junk E-mail/05 Sep 2004 15:08 from :Re: A!p$ghsa/details03.zip Infected: Email-Worm.Win32.NetSky.q skipped

Re-scan with kaspersky.

Post:

- a fresh HijackThis log
- kaspersky report

[didymustoo]

Latest HJT log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:56:25 PM, on 2/21/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\atiptaxx.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\SYSTEM32\LVCOMSX.EXE
C:\Program Files\Java\jre1.5.0_06\bin\jucheck.exe
C:\Program Files\Trend Micro\HijackThis\didymustoo.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
N3 - Netscape 7: user_pref("browser.search.defaultengine", "http://www.google.com/"); (C:\Documents and Settings\FJW\Application Data\Mozilla\Profiles\default\brw22mi9.slt\prefs.js)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: TextAloud - {F053C368-5458-45B2-9B4D-D8914BDDDBFF} - C:\PROGRA~1\TEXTAL~1\TAForIE.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM32\MSJAVA.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM32\MSJAVA.DLL
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {03A0F84E-3E69-4B3E-B4D3-019CB73B57B3} (AuthWebWizardMain.DHTMLPage1) - http://www3.authentium.com/cssrelease/bin/WizMain.exe
O16 - DPF: {1B4F9DD7-2D7C-44B5-9126-73206DA0AE75} (CNavigationManager Object) - http://www3.authentium.com/cssrelease/bin/wizard.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photo.walgreens.com/WalgreensActivia.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-3-36.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111401/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {7C5D062A-7A1E-4A46-A02B-A928084CBD66} (MLauncherNew Class) - http://legendofares.netgame.com/download/MusaLauncherNew.cab
O16 - DPF: {9C024426-7859-4B2D-AB4C-B1E370AE7549} - http://us.mcafee.com/Apps/WSC/en-us/WscWlanScannerCtrl.cab
O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex/EPSControl_v1-32.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?326
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,1,0,4692/mcfscan.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 5717 bytes

[didymustoo]

Kapersky report:

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Thursday, February 21, 2008 1:56:07 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 21/02/2008
Kaspersky Anti-Virus database records: 574609
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\
G:\

Scan Statistics:
Total number of scanned objects: 98745
Number of viruses found: 4
Number of infected objects: 193
Number of suspicious objects: 0
Duration of the scan process: 01:32:38

Infected Object Name / Virus Name / Last Action
C:\WINDOWS\SYSTEM32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\SYSTEM32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\SYSTEM32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\SYSTEM32\config\system.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\config\software.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\config\default.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\config\Internet.evt Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SECURITY Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SOFTWARE Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SYSTEM Object is locked skipped
C:\WINDOWS\SYSTEM32\config\DEFAULT Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SAM Object is locked skipped
C:\WINDOWS\SYSTEM32\h323log.txt Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{1F24D84A-1D68-4504-891B-C347A194B924}.bin Object is locked skipped
C:\WINDOWS\SchedLog.Txt Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\fjw\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\fjw\Local Settings\History\History.IE5\MSHist012008022120080222\index.dat Object is locked skipped
C:\Documents and Settings\fjw\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\fjw\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\fjw\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
C:\Documents and Settings\fjw\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\fjw\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\fjw\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped
C:\Documents and Settings\fjw\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\fjw\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP318\A0071689.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP318\A0071690.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP318\A0071697.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP319\A0071738.EXE Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP319\A0072732.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP319\A0072733.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP320\A0072740.exe Infected: Virus.Win32.Trats.d skipped

[didymustoo]

C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP320\A0072742.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP320\A0072776.EXE Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP320\A0072778.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP320\A0073770.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP320\A0073775.EXE Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP320\A0073784.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP320\A0074776.EXE Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP320\A0074779.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP321\A0074825.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP322\A0074865.DLL Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP322\A0074866.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP322\A0074873.EXE Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP322\A0074875.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP323\A0074910.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP323\A0074911.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP323\A0074918.EXE Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP323\A0074919.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP324\A0074964.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP324\A0074965.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP324\A0074972.EXE Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP324\A0074974.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP325\A0075014.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP325\A0075015.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP325\A0075021.EXE Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP325\A0075027.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP326\A0075065.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP326\A0075066.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP326\A0075073.EXE Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP326\A0075099.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP326\A0075100.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP326\A0075107.EXE Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP327\A0075151.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP327\A0075194.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP327\A0075202.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP327\A0075203.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP327\A0075212.EXE Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP329\A0075329.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP329\A0075330.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP329\A0075354.EXE Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP329\A0075356.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP330\A0075392.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP330\A0075398.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP330\A0075402.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP330\A0075405.EXE Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP330\A0075407.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP331\A0075474.EXE Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP331\A0075482.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP331\A0075485.EXE Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP331\A0075502.EXE Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP331\A0075554.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP331\A0075556.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP331\A0075568.EXE Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP331\A0075570.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP331\A0075571.EXE Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP331\A0075572.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP331\A0075573.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP331\A0075612.EXE Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP331\A0075616.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP332\A0076608.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP332\A0076614.EXE Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP332\A0076646.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP333\A0076690.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP333\A0076696.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076712.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Agent.vv skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076712.exe/stream Infected: not-a-virus:AdWare.Win32.Agent.vv skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076712.exe NSIS: infected - 2 skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076713.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076714.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076715.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076716.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076717.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076718.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076719.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076720.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076721.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076722.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076723.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped

[didymustoo]

C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076724.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076725.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076726.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076727.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076728.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076729.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076730.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076731.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076732.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076733.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076734.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076735.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076736.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076737.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076738.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076739.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076740.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076741.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076742.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076743.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076744.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.eby skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076745.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076746.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076747.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076748.DLL Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076749.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076750.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.eby skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076751.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076752.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076753.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076754.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076755.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076756.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076757.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076758.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076759.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076760.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076761.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076762.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076763.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076764.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076765.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076766.DLL Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076767.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076768.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076769.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076770.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP334\A0076771.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077079.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077080.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077081.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077082.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077083.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077084.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077085.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077086.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077087.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077088.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077089.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077090.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077091.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077092.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077093.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077094.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077095.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077096.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077097.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077098.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077099.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077100.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077101.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077102.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077103.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077104.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077105.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077106.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077107.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077108.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077109.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077110.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077111.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077112.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077113.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077114.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077115.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077116.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077117.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077118.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077119.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077120.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077121.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077122.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077123.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077124.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077125.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077126.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077127.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077128.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077129.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077130.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077137.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077138.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077139.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077140.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077141.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077142.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP338\A0077247.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP343\A0077856.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP343\A0077939.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP343\change.log Object is locked skipped
D:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP343\change.log Object is locked skipped
E:\System Volume Information\_restore{8490C9E5-32C0-4598-8428-3D67B6E7B1A8}\RP343\change.log Object is locked skipped

Scan process completed.

[Shaba]

Hi

Logs look good.

All viruses are in system restore and inactive.

I give you later instructions how to empty it.

Other than that, any problems left?

[didymustoo]

Everythng seems to be working right. Thank you for all your hard work in clearing this up.

Yahoo!!!:laugh:

[Shaba]

Hi

Then you're clean!

Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

Looking over your log, it seems you don't have any evidence of a third party firewall.

As the term conveys, a firewall is an extra layer of security installed onto computers, which restricts access to systems from the outside world. Firewalls protect against hackers and malicious intruders. I want you to download a free firewall NOW from one of these excellent vendors:

1) Comodo (http://www.personalfirewall.comodo.com/)
2) Online Armor (http://www.tallemu.com/online_armor_free.html)
3) Sunbelt/Kerio (http://www.sunbelt-software.com/Kerio-Download.cfm)
4) Agnitum (http://www.agnitum.com/products/outpostfree/download.php)
5) ZoneAlarm (http://www.zonelabs.com/store/content/catalog/products/sku_list_za.jsp?dc=12bms&ctry=US&lang=en&lid=nav_za) (uncheck ZoneAlarm Spy Blocker during installation if you choose this one)

If you are using the built-in Windows XP firewall, it is not recommended as it does not block outgoing connections. This means that any malware on your computer is free to "phone home" for more instructions. Simply put, Windows XP contains a mediocre firewall. This firewall is NO replacement for a dedicated software solution. Remember to use only one firewall at the same time.

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. A malicious site could render Java content under older, vulnerable versions of Sun's software if the user has not removed them. Please follow these steps to remove older version Java components and update: Download the latest version of Java Runtime Environment (JRE) 6 Update 4 (http://java.sun.com/javase/downloads/index.jsp) and save it to your desktop.
Scroll down to where it saysThe J2SE Runtime Environment (JRE) allows end-users to run Java applications.
Click the Download button to the right.
Select Windows on platform combobox and check the box that says:
Accept License Agreement. Click continue.
The page will refresh.
Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6u4-windows-i586-p.exe to install the newest version.

Next we remove all used tools.

Please download OTMoveIt2 (http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe) and save it to desktop.

Double-click OTMoveIt2.exe.
Click the CleanUp! button.
Select Yes when the "Begin cleanup Process?" prompt appears.
If you are prompted to Reboot during the cleanup, select Yes.
The tool will delete itself once it finishes, if not delete it by yourself.


Note: If you receive a warning from your firewall or other security programs regarding OTMoveIt2 attempting to contact the internet, please allow it to do so.

Disable and Enable System Restore. - If you are using Windows XP then you should disable and re-enable system restore to make sure there are no infected files found in a restore point.

You can find instructions on how to enable and re-enable system restore here:

Windows XP System Restore Guide (http://www.bleepingcomputer.com/forums/tutorial56.html)

Re-enable system restore with instructions from tutorial above

Make your Internet Explorer more secure - This can be done by following these simple instructions:
From within Internet Explorer click on the Tools menu and then click on Options.
Click once on the Security tab
Click once on the Internet icon so it becomes highlighted.
Click once on the Custom Level button.
Change the Download signed ActiveX controls to Prompt

Change the Download unsigned ActiveX controls to Disable

Change the Initialize and script ActiveX controls not marked as safe to Disable

Change the Installation of desktop items to Prompt

Change the Launching programs and files in an IFRAME to Prompt

Change the Navigate sub-frames across different domains to Prompt

When all these settings have been made, click on the OK button.

If it prompts you as to whether or not you want to save the settings, press the Yes button.
Next press the Apply button and then the OK to exit the Internet Properties page.

Update your AntiVirus Software - It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.


Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com (http://www.windowsupdate.com) regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option.

This will provide real-time spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an anti virus software. A tutorial on installing & using this product can be found here:

Instructions for Spybot S & D (http://www.bleepingcomputer.com/forums/?showtutorial=43)


Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.

A tutorial on installing & using this product can be found here:

Using SpywareBlaster to protect your computer from Spyware and Malware (http://www.bleepingcomputer.com/tutorials/tutorial49.html)


Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.
Follow this list and your potential for being infected again will reduce dramatically.

Here are some additional utilities that will enhance your safety

MVPS Hosts file (http://mvps.org/winhelp2002/hosts.htm) <= The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer
Google Toolbar (http://toolbar.google.com/) <= Get the free google toolbar to help stop pop up windows.
Comodo BOCLEAN (http://www.comodo.com/boclean/boclean.html) <= Stop identity thieves from getting personal information. Instantly detects well over 1,000,000 unique, variant and repack malware in total. And it's free.
Winpatrol (http://www.winpatrol.com/) <= Download and install the free version of Winpatrol. a tutorial for this product is located here:
Using Winpatrol to protect your computer from malicious software (http://www.winpatrol.com/features.html)

Stand Up and Be Counted ---> Malware Complaints (http://www.malwarecomplaints.info/index.php) <--- where you can make difference!

The site offers people who have been (or are) victims of malware the opportunity to document their story and, in that way, launch a complaint against the malware and the makers of the malware.

Also, please read this great article by Tony Klein So How Did I Get Infected In First Place (http://castlecops.com/postlite7736-.html)

Happy surfing and stay clean! :bigthumb:

[didymustoo]

Everything is working good. I installed the programs you suggested in your last post and following the precautions suggested.

Thank you so very much for all your time and effort, they are greatly appreciated.:bigthumb:

[Shaba]

Since this issue appears to be resolved ... this Topic has been closed. Glad I could help.

Note: If it has been five days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include a fresh HijackThis log and a link to your previous thread.

If it has been less than five days since your last response and you need the thread re-opened, please send me or your helper a private message (pm). A valid, working link to the closed topic is required.