Vrtumonde, security 7.1 toolbar, savethisinformation.com troubles

R

rosey911

New member
I got into something nasty a few days ago and my browser was being redirected to savethisinformation.com and I had a security 7.1 toolbar added up top. I have followed the procedures requested before posting, but my Kasersky scan locked up three times so I couldnt get that log. I ran Spybot in safe and now it seems savethis is gone (maybe) but virtuemondo was still coming back after 4 spybot tries. Here is my HJT log. Any help would be so appreciated

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:27:56 PM, on 11/3/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\PROGRA~1\Webshots\webshots.scr
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Linksys\Wireless-B PCI Adapter\OdHost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Linksys\Wireless-B PCI Adapter\WMP11Cfg.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.bearshare.com/sidebar.html?src=ssb
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.bearshare.com/sidebar.html?src=ssb
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Security Toolbar - {11A69AE4-FBED-4832-A2BF-45AF82825583} - C:\WINDOWS\system32\jrfkhhva.dll (file missing)
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [39c8702f] rundll32.exe "C:\WINDOWS\system32\uywnwgkl.dll",b
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKCU\..\Run: [ATI Launchpad] "C:\Program Files\ATI Multimedia\main\launchpd.exe"
O4 - HKCU\..\Run: [ATI Remote Control] C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: Wireless-B Notebook Adapter Utility.lnk = C:\Program Files\Linksys\Wireless-B PCI Adapter\Startup.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - https://my.lennar.com/inotes/iNotes6W.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1133627876228
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1133627864900
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NICSer_WMP11 - Unknown owner - C:\Program Files\Linksys\Wireless-B PCI Adapter\NICServ.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: X10 Device Network Service (x10nets) - Unknown owner - C:\PROGRA~1\ATIMUL~1\RemCtrl\x10nets.exe (file missing)

--
End of file - 10887 bytes
 
Hello rosey911,

While TeaTimer is an excellent tool for the prevention of spyware, it can sometimes prevent HijackThis from fixing certain things.
Please disable TeaTimer for now until you are clean. TeaTimer can be re-activated once your HijackThis log is clean.
  • Open Spybot Search & Destroy.
  • In the Mode menu click "Advanced mode" if not already selected.
  • Choose "Yes" at the Warning prompt.
  • Expand the "Tools" menu.
  • Click "Resident".
  • Uncheck the "Resident "TeaTimer" (Protection of overall system settings) active." box.
  • In the File menu click "Exit" to exit Spybot Search & Destroy.

Open HijackThis, click Config, click Misc Tools
Click "Open Uninstall Manager"
Click "Save List" (generates uninstall_list.txt)
Click Save, copy and paste the results in your next post.

Download ComboFix from Here or Here to your Desktop.
  • Double click combofix.exe and follow the prompts.
  • When finished, it shall produce a log for you. Post that log and a HiJackthis log in your next reply
Note: Do not mouseclick combofix's window while its running. That may cause it to stall
 
Last edited:
I am so sorry, I have been pulling my hair out trying to follow the instructions you gave me in the first post. I got the tea disabled, then went to get you the program log for HJT and every single time I try as soon as I the program closes, no log, no goodbye, nothing. So, I tried the combofix and got equal trouble. I thought all was going well, then I get this:

Preparing log report

Do not run any programs until combofix has finished (I didnt touch a thing) Then this:

access is denied
access is denied
access is denied

SED: Couldn't flush STdout

Then that program shut down

The second time I tried I got :
please wait,
combo fix is preparing to run, then it shut down
I hav tried to reboot the computer and try both of these again. I am just at a loss.
 
Hello rosey911 :)

I am so sorry, I have been pulling my hair out trying to follow the instructions you gave me in the first post. I got the tea disabled, then went to get you the program log for HJT and every single time I try as soon as I the program closes, no log, no goodbye, nothing. So, I tried the combofix and got equal trouble. I thought all was going well, then I get this:
Click to expand...
These things happen quite often, please try not to stress over this problem too much, I trust we'll be able to fix these problems one step at a time. If at any point during these fixes we run you are unsure about something, feel free to ask before performing it.

Please read this post completely, it may make it easier for you if you copy and paste this post to a new text document or print it for reference later.

Boot into Safe Mode:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.
5) Select your normal user account.

Now let's try running combofix again:

  • Double click combofix.exe and follow the prompts.
  • When finished, it shall produce a log for you. Post that log and a HiJackthis log in your next reply
Note: Do not mouseclick combofix's window while its running. That may cause it to stall

Then reboot into normal Windows and let me know how it went.
 
First Rip-chain I just want to say thank you in advance for the help you provide on this forum, not just to me but others as well. Your time is very much appreiated.

Ok, I tried to run combofix in safe mode and here is what I got.

Please wait.
Combo fix is preparing to run.

Then another box pops up (an error box) that says:
(In header) Vfind.cfexe - application error

The exception Breakpoint
A breakpoint has been reached
(0x80000003) occurred in the application at location
07c839a95

Click OK to terminate the program
Click CANCEL to debug the program

Also tried to get you the HJT log under the add/remove programs manager and today the program is not shutting down but when I hit the save list, nothing happens. No log is created, nada.
 
Hello rosey911,

Please download VundoFix.exe to your desktop
  • Double-click VundoFix.exe to run it.
  • Click the Scan for Vundo button.
  • Once it's done scanning, click the Remove Vundo button.
  • You will receive a prompt asking if you want to remove the files, click YES
  • Once you click yes, your desktop will go blank as it starts removing Vundo.
  • When completed, it will prompt that it will reboot your computer, click OK.
  • Please post the contents of C:\vundofix.txt and a new HiJackThis log in a reply to this thread.
Note: It is possible that VundoFix encountered a file it could not remove. In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button" when VundoFix appears upon rebooting.

----------------------------- Part 2 ----------------------------

Please download Deckard's System Scanner (DSS) and save it to your Desktop.
  • Close all other windows before proceeding.
  • Double-click on dss.exe and follow the prompts.
  • When it has finished, dss will open two Notepads main.txt and extra.txt -- please copy (CTRL+A and then CTRL+C) and paste (CTRL+V) the contents of main.txt and extra.txt in your next reply.
 
Rip chain,
Things are just not working out well on this end.

Vundofix - no infected files were found (which is good thing I suppose)

DSS.exe has encountered a problem and will need to close (tried to run three times)

Dont know if it will help or do any good, but I got a new log from HJT and it is below

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:55, on 2007-11-04
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Linksys\Wireless-B PCI Adapter\OdHost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Linksys\Wireless-B PCI Adapter\WMP11Cfg.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [39c8702f] rundll32.exe "C:\WINDOWS\system32\uywnwgkl.dll",b
O4 - HKCU\..\Run: [ATI Launchpad] "C:\Program Files\ATI Multimedia\main\launchpd.exe"
O4 - HKCU\..\Run: [ATI Remote Control] C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: Wireless-B Notebook Adapter Utility.lnk = C:\Program Files\Linksys\Wireless-B PCI Adapter\Startup.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - https://my.lennar.com/inotes/iNotes6W.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1133627876228
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1133627864900
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NICSer_WMP11 - Unknown owner - C:\Program Files\Linksys\Wireless-B PCI Adapter\NICServ.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: X10 Device Network Service (x10nets) - Unknown owner - C:\PROGRA~1\ATIMUL~1\RemCtrl\x10nets.exe (file missing)

--
End of file - 9781 bytes
 
Rip Chain,
What a difference a day makes. I tried combofix today and it worked without a hitch, here is the log from it

ComboFix 07-11-01.1** - Owner 2007-11-05 18:57:10.5 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.162 [GMT -8:00]
Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Start Menu\Live Safety Center.lnk
C:\Documents and Settings\All Users\Start Menu\Online Security Guide.lnk
C:\Documents and Settings\Owner\Desktop\Live Safety Center.lnk
C:\Documents and Settings\Owner\Desktop\Online Security Guide.lnk
C:\Documents and Settings\Owner\Favorites\Online Security Guide.lnk
C:\WINDOWS\cookies.ini
C:\WINDOWS\system32\cwsykwyf.exe
C:\WINDOWS\system32\hhkmp.bak1
C:\WINDOWS\system32\hhkmp.ini
C:\WINDOWS\system32\hjllm.bak1
C:\WINDOWS\system32\hjllm.ini
C:\WINDOWS\system32\ijkmp.bak1
C:\WINDOWS\system32\ijkmp.ini
C:\WINDOWS\system32\ijllm.bak1
C:\WINDOWS\system32\ijllm.ini
C:\WINDOWS\system32\ilnmp.bak1
C:\WINDOWS\system32\ilnmp.bak2
C:\WINDOWS\system32\ilnmp.ini
C:\WINDOWS\system32\m2
C:\WINDOWS\system32\nlmiemkx.exe
C:\WINDOWS\system32\o1
C:\WINDOWS\system32\o1\c124wvr.exe
C:\WINDOWS\system32\oTt04e
C:\WINDOWS\system32\oTt04e\oTt04e1080.exe
C:\WINDOWS\system32\rqtss.bak1
C:\WINDOWS\system32\rqtss.bak2
C:\WINDOWS\system32\rqtss.ini
C:\WINDOWS\system32\sstqr.dll
C:\WINDOWS\system32\v4
C:\WINDOWS\system32\v4\caws83122.exe
C:\WINDOWS\system32\xycdd.bak1
C:\WINDOWS\system32\xycdd.ini

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_DOMAINSERVICE


((((((((((((((((((((((((( Files Created from 2007-10-06 to 2007-11-06 )))))))))))))))))))))))))))))))
.

2007-11-05 16:38 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2007-11-05 07:39 83,008 --a------ C:\WINDOWS\system32\oidxmyqb.dll
2007-11-05 07:35 85,568 --a------ C:\WINDOWS\system32\qayvvbax.dll
2007-11-04 12:53 <DIR> d-------- C:\Deckard
2007-11-04 12:48 <DIR> d-------- C:\VundoFix Backups
2007-11-03 20:14 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-11-03 15:04 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2007-11-03 15:04 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-11-03 14:47 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-11-03 07:29 <DIR> d-------- C:\Program Files\Spyware Doctor
2007-11-03 07:29 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\PC Tools
2007-11-03 07:29 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2007-11-03 07:29 79,688 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
2007-11-03 07:29 62,280 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
2007-11-03 07:29 41,288 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
2007-11-03 07:29 29,000 --a------ C:\WINDOWS\system32\drivers\kcom.sys
2007-11-03 07:28 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll
2007-11-02 13:15 82,496 --a------ C:\WINDOWS\system32\mgxnsskp.dll
2007-11-01 21:43 9,264 --a------ C:\WINDOWS\system32\msqtvcap.dat
2007-11-01 21:39 <DIR> d-------- C:\WINDOWS\system32\aliedit
2007-11-01 21:39 <DIR> d-------- C:\Program Files\Alibaba
2007-10-31 19:06 <DIR> d-------- C:\Program Files\Windows Defender
2007-10-31 18:48 35,840 --a------ C:\WINDOWS\mrofinu1000137.exe
2007-10-31 17:54 269 --a------ C:\WINDOWS\system32\1551.bat
2007-10-31 17:53 32,256 --a------ C:\WINDOWS\system32\khfggfc.dll
2007-10-31 17:51 0 --a------ C:\WINDOWS\system32\taskkill.exe
2007-10-31 17:19 <DIR> d-------- C:\Program Files\PasswordTools
2007-10-30 17:57 <DIR> d-------- C:\WINDOWS\tmpDSM1
2007-10-23 16:46 <DIR> d-------- C:\Program Files\Norton Security Scan
2007-10-17 13:48 <DIR> d-------- C:\Program Files\MySpace
2007-10-17 13:48 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\MySpace
2007-10-11 11:46 582,656 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-05 02:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater
2007-11-04 01:27 --------- d-----w C:\Program Files\Trend Micro
2007-11-01 05:53 --------- d-----w C:\Program Files\motive
2007-11-01 03:00 --------- d-----w C:\Program Files\Microsoft AntiSpyware
2007-11-01 02:32 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2007-11-01 01:57 --------- d-----w C:\Documents and Settings\Owner\Application Data\Apple Computer
2007-11-01 01:12 --------- d-----w C:\Documents and Settings\Owner\Application Data\AdobeUM
2007-11-01 00:52 --------- d-----w C:\Program Files\Trial123FileConvert
2007-10-27 03:46 --------- d-----w C:\Program Files\Microsoft Games
2007-10-02 23:41 --------- d-----w C:\Program Files\Last Seconds Bidder
2007-10-02 17:00 --------- d-----w C:\Program Files\Common Files\Adobe
2007-10-01 16:42 --------- d-----w C:\Program Files\iTunes
2007-10-01 16:42 --------- d-----w C:\Program Files\iPod
2007-09-30 23:45 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll
2007-09-25 00:13 --------- d-----w C:\Program Files\ewido anti-malware
2007-09-25 00:13 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kodak
2007-09-24 22:31 --------- d-----w C:\Program Files\Common Files\xing shared
2007-09-24 22:31 --------- d-----w C:\Program Files\Common Files\Real
2007-09-24 21:38 --------- d-----w C:\Program Files\Kodak
2007-09-24 21:34 --------- d-----w C:\Program Files\HyperVRE
2007-09-24 21:33 --------- d-----w C:\Program Files\DivX
2007-09-24 21:31 --------- d-----w C:\Program Files\Article Distributor
2007-09-24 21:29 --------- d-----w C:\Program Files\Google
2007-09-24 21:23 --------- d-----w C:\Program Files\OpenOffice.org 2.0
2007-09-24 21:21 --------- d-----w C:\Documents and Settings\Owner\Application Data\OpenOffice.org2
2007-09-24 21:05 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL
2007-09-24 20:54 --------- d-----w C:\Program Files\Pure Networks
2007-09-24 20:54 --------- d-----w C:\Program Files\Common Files\AOL
2007-09-24 20:53 --------- d-----w C:\Documents and Settings\Owner\Application Data\AOL
2007-09-20 23:57 --------- d-----w C:\Documents and Settings\All Users\Application Data\DVD Shrink
2007-09-20 23:49 --------- d-----w C:\Documents and Settings\Owner\Application Data\dvdcss
2007-09-09 22:25 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2007-09-09 22:24 --------- d-----w C:\Program Files\QuickTime
2007-09-09 22:22 --------- d-----w C:\Program Files\Common Files\Apple
2007-09-09 22:22 --------- d-----w C:\Program Files\Apple Software Update
2007-09-09 22:22 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
2007-09-01 18:23 24,192 ----a-w C:\Documents and Settings\Owner\usbsermptxp.sys
2007-09-01 18:23 22,768 ----a-w C:\Documents and Settings\Owner\usbsermpt.sys
2007-08-21 06:15 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
2007-01-21 18:30 557 ----a-w C:\Program Files\INSTALL.LOG
2005-09-14 16:24 33,280 ----a-w C:\Program Files\EndProcess.exe
2005-07-29 23:24:26 472 --sha-r C:\WINDOWS\UmFjaGVs\oAI3u3pP.vbs
.

((((((((((((((((((((((((((((( snapshot@2007-11-03_21.33.28.98 )))))))))))))))))))))))))))))))))))))))))
.
- 2007-10-30 01:56:19 136,192 ----a-w C:\WINDOWS\catchme.exe
+ 2007-10-30 02:56:19 136,192 ----a-w C:\WINDOWS\catchme.exe
+ 2007-03-13 18:57:10 163,328 ----a-w C:\WINDOWS\ERDNT\subs\ERDNT.EXE
- 2007-11-03 15:30:42 52,764 ----a-w C:\WINDOWS\system32\perfc009.dat
+ 2007-11-04 14:39:16 52,764 ----a-w C:\WINDOWS\system32\perfc009.dat
- 2007-11-03 15:30:43 380,350 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2007-11-04 14:39:16 380,350 ----a-w C:\WINDOWS\system32\perfh009.dat
- 2007-04-02 21:21:27 139,776 ----a-w C:\WINDOWS\system32\swreg.exe
+ 2007-04-02 22:21:27 139,776 ----a-w C:\WINDOWS\system32\swreg.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25997E08-274A-4217-8F71-C89C754242C1}]
2007-10-31 17:53 32256 --a------ C:\WINDOWS\system32\khfggfc.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5F174EBF-59B4-4F17-9FFC-E2398BD28457}]
C:\WINDOWS\system32\pmnli.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{790f562f-fd72-4f6f-b660-f3ec9325dcf1}]
2007-11-05 07:39 83008 --a------ C:\WINDOWS\system32\oidxmyqb.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2005-10-19 07:59]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-10-19 07:59]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 05:24]
"type32"="C:\Program Files\Microsoft IntelliType Pro\type32.exe" [2005-03-15 01:46]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\point32.exe" [2005-03-23 15:26]
"BJCFD"="C:\Program Files\BroadJump\Client Foundation\CFD.exe" [2002-09-10 21:26]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-09-24 14:31]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-09-26 13:42]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 18:51]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 18:20]
"39c8702f"="C:\WINDOWS\system32\qayvvbax.dll" [2007-11-05 07:35]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATI Launchpad"="C:\Program Files\ATI Multimedia\main\launchpd.exe" [2004-06-15 22:22]
"ATI Remote Control"="C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe" [2004-04-16 06:43]
"PopUpStopperFreeEdition"="C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe" [2005-03-17 11:10]
"RoboForm"="C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2006-06-02 20:23]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:56]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"RunNarrator"=Narrator.exe

C:\Documents and Settings\Owner\Start Menu\Programs\Startup\
Webshots.lnk - C:\Program Files\Webshots\Launcher.exe [2005-12-04 21:07:15]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Acrobat Assistant.lnk - C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [2003-10-23 20:37:56]
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-12-21 06:36:06]
Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2007-09-24 13:29:10]
Wireless-B Notebook Adapter Utility.lnk - C:\Program Files\Linksys\Wireless-B PCI Adapter\Startup.exe [2005-12-02 15:33:28]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{25997E08-274A-4217-8F71-C89C754242C1}"= C:\WINDOWS\system32\khfggfc.dll [2007-10-31 17:53 32256]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\jrfkhhva]
jrfkhhva.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\khfggfc]
khfggfc.dll 2007-10-31 17:53 32256 C:\WINDOWS\system32\khfggfc.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\system32\sstqr.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
backup=C:\WINDOWS\pss\Kodak EasyShare software.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak software updater.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak software updater.lnk
backup=C:\WINDOWS\pss\Kodak software updater.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
backup=C:\WINDOWS\pss\WinZip Quick Pick.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^Webshots.lnk]
path=C:\Documents and Settings\Owner\Start Menu\Programs\Startup\Webshots.lnk
backup=C:\WINDOWS\pss\Webshots.lnkStartup


R3 CBTNDIS5;CBTNDIS5 NDIS Protocol Driver;\??\C:\WINDOWS\System32\CBTNDIS5.SYS
R3 odysseyIM3;Odyssey Network Services Miniport;C:\WINDOWS\system32\DRIVERS\odysseyIM3.sys
S2 Ca533av;Polaroid Digital Cam Video;C:\WINDOWS\system32\Drivers\Ca533av.sys
S3 IPN2120;Wireless-B PCI Adapter Driver;C:\WINDOWS\system32\DRIVERS\LSIPNDS.sys
S3 USBCamera;Icatch(IV) Still Camera Device;C:\WINDOWS\system32\Drivers\Bulk533.sys

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\Shell\AutoRun\command - E:\EE2AutoRun.exe

.
Contents of the 'Scheduled Tasks' folder
"2007-11-05 17:18:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
"2007-11-06 01:47:20 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
"2007-11-02 22:00:00 C:\WINDOWS\Tasks\Norton Security Scan.job"
- C:\Program Files\Norton Security Scan\Nss.exe
.
**************************************************************************

catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-05 19:07:30
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-05 19:09:19 - machine was rebooted
.
--- E O F ---
 
I thought what the heck, let me try the HJT uninstall list to see if I could get that log and wala it worked also, so here is that log as well

Ad-Aware SE Personal
Adobe Acrobat 5.0
Adobe Acrobat 6.0.1 Professional - English, Français, Deutsch
Adobe Flash Player 9 ActiveX
Adobe Photoshop 7.0
Adobe Reader 8.1.1
Age of Empires III
Age of Empires III - The Asian Dynasties Trial
Age of Empires III - The WarChiefs
AI RoboForm (All Users)
Apple Mobile Device Support
Apple Software Update
ArcSoft PhotoImpression
ATI - Software Uninstall Utility
ATI Control Panel
ATI Decoder
ATI Display Driver
ATI HYDRAVISION
ATI Multimedia Center 9.01
ATI Remote Wonder 2.3
BCM V.92 56K Modem
Broadcom 440x 10/100 Integrated Controller
BroadJump Client Foundation
CivCity
Compaq FP7317 INF and ICM software
DAO
Dell ResourceCD
DVD Decrypter (Remove Only)
DVD Shrink 3.2
DVD-Cover Printmaster 1.2
DVDFab Decrypter 2.9.8.3
Empire Earth II
EPSON Print CD
EPSON Printer Software
GameShadow
Google Toolbar for Internet Explorer
Google Updater
HijackThis 2.0.2
Hotfix for Windows XP (KB914440)
Hotfix for Windows XP (KB915865)
Intel(R) Extreme Graphics Driver
iTunes
J2SE Runtime Environment 5.0 Update 6
Kaspersky Online Scanner
Last Seconds Bidder
Lavasoft VX2 Cleaner
Microsoft .NET Framework 1.1
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office Professional Edition 2003
mIRC
Morrowind
MSN Music Assistant
MSXML 4.0 SP2 (KB925672)
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
Namo WebEditor 5
Nero 6 Ultra Edition
Nero Digital
Norton Security Scan
Odyssey Client
PartyPoker
PasswordTools
PeerGuardian 2.0
Polaroid Digital Cam
Pop-Up Stopper Free Edition
PowerDVD
QuickTime
RealPlayer
Security Update for Windows Internet Explorer 7 (KB928090)
Security Update for Windows Internet Explorer 7 (KB929969)
Security Update for Windows Internet Explorer 7 (KB931768)
Security Update for Windows Internet Explorer 7 (KB933566)
Security Update for Windows Internet Explorer 7 (KB937143)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 10 (KB936782)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 9 (KB911565)
Security Update for Windows Media Player 9 (KB917734)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893066)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896422)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB896688)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB905915)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB908531)
Security Update for Windows XP (KB911280)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911567)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912812)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913446)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB916281)
Security Update for Windows XP (KB917159)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB918899)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920214)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB921503)
Security Update for Windows XP (KB921883)
Security Update for Windows XP (KB922616)
Security Update for Windows XP (KB922760)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB923694)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925486)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB933729)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
Security Update for Windows XP (KB936021)
Security Update for Windows XP (KB938829)
Security Update for Windows XP (KB941202)
SimCity 4 Deluxe
SoundMAX
Spybot - Search & Destroy
Spyware Doctor 5.1
TES Construction Set
The Battle for Middle-earth (tm)
The Sims 2
TradeManager
Trial 1-2-3FileConvert
Turbo Lister 2
Update for Windows XP (KB894391)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB904942)
Update for Windows XP (KB910437)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB927891)
Update for Windows XP (KB929338)
Update for Windows XP (KB930916)
Update for Windows XP (KB931836)
Update for Windows XP (KB933360)
Update for Windows XP (KB936357)
Update for Windows XP (KB938828)
VideoLAN VLC media player 0.8.4a
Viewpoint Media Player
Webshots Desktop
WinAVI VideoConverter
WinAVIVideoConverter
Windows Defender
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Media Encoder 9 Series
Windows Media Encoder 9 Series
Windows Media Format Runtime
Windows Media Player 10
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885250
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB887742
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891781
Windows XP Service Pack 2
WinRAR archiver
WinZip
Wireless-B PCI Adapter
 
I was also able to get the combofix to work properly today and I have a log for that also, I dont know what the deal was yesterday, but here is the combofix log

ComboFix 07-11-01.1** - Owner 2007-11-05 18:57:10.5 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.162 [GMT -8:00]
Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Start Menu\Live Safety Center.lnk
C:\Documents and Settings\All Users\Start Menu\Online Security Guide.lnk
C:\Documents and Settings\Owner\Desktop\Live Safety Center.lnk
C:\Documents and Settings\Owner\Desktop\Online Security Guide.lnk
C:\Documents and Settings\Owner\Favorites\Online Security Guide.lnk
C:\WINDOWS\cookies.ini
C:\WINDOWS\system32\cwsykwyf.exe
C:\WINDOWS\system32\hhkmp.bak1
C:\WINDOWS\system32\hhkmp.ini
C:\WINDOWS\system32\hjllm.bak1
C:\WINDOWS\system32\hjllm.ini
C:\WINDOWS\system32\ijkmp.bak1
C:\WINDOWS\system32\ijkmp.ini
C:\WINDOWS\system32\ijllm.bak1
C:\WINDOWS\system32\ijllm.ini
C:\WINDOWS\system32\ilnmp.bak1
C:\WINDOWS\system32\ilnmp.bak2
C:\WINDOWS\system32\ilnmp.ini
C:\WINDOWS\system32\m2
C:\WINDOWS\system32\nlmiemkx.exe
C:\WINDOWS\system32\o1
C:\WINDOWS\system32\o1\c124wvr.exe
C:\WINDOWS\system32\oTt04e
C:\WINDOWS\system32\oTt04e\oTt04e1080.exe
C:\WINDOWS\system32\rqtss.bak1
C:\WINDOWS\system32\rqtss.bak2
C:\WINDOWS\system32\rqtss.ini
C:\WINDOWS\system32\sstqr.dll
C:\WINDOWS\system32\v4
C:\WINDOWS\system32\v4\caws83122.exe
C:\WINDOWS\system32\xycdd.bak1
C:\WINDOWS\system32\xycdd.ini

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_DOMAINSERVICE


((((((((((((((((((((((((( Files Created from 2007-10-06 to 2007-11-06 )))))))))))))))))))))))))))))))
.

2007-11-05 16:38 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2007-11-05 07:39 83,008 --a------ C:\WINDOWS\system32\oidxmyqb.dll
2007-11-05 07:35 85,568 --a------ C:\WINDOWS\system32\qayvvbax.dll
2007-11-04 12:53 <DIR> d-------- C:\Deckard
2007-11-04 12:48 <DIR> d-------- C:\VundoFix Backups
2007-11-03 20:14 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-11-03 15:04 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2007-11-03 15:04 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-11-03 14:47 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-11-03 07:29 <DIR> d-------- C:\Program Files\Spyware Doctor
2007-11-03 07:29 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\PC Tools
2007-11-03 07:29 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2007-11-03 07:29 79,688 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
2007-11-03 07:29 62,280 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
2007-11-03 07:29 41,288 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
2007-11-03 07:29 29,000 --a------ C:\WINDOWS\system32\drivers\kcom.sys
2007-11-03 07:28 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll
2007-11-02 13:15 82,496 --a------ C:\WINDOWS\system32\mgxnsskp.dll
2007-11-01 21:43 9,264 --a------ C:\WINDOWS\system32\msqtvcap.dat
2007-11-01 21:39 <DIR> d-------- C:\WINDOWS\system32\aliedit
2007-11-01 21:39 <DIR> d-------- C:\Program Files\Alibaba
2007-10-31 19:06 <DIR> d-------- C:\Program Files\Windows Defender
2007-10-31 18:48 35,840 --a------ C:\WINDOWS\mrofinu1000137.exe
2007-10-31 17:54 269 --a------ C:\WINDOWS\system32\1551.bat
2007-10-31 17:53 32,256 --a------ C:\WINDOWS\system32\khfggfc.dll
2007-10-31 17:51 0 --a------ C:\WINDOWS\system32\taskkill.exe
2007-10-31 17:19 <DIR> d-------- C:\Program Files\PasswordTools
2007-10-30 17:57 <DIR> d-------- C:\WINDOWS\tmpDSM1
2007-10-23 16:46 <DIR> d-------- C:\Program Files\Norton Security Scan
2007-10-17 13:48 <DIR> d-------- C:\Program Files\MySpace
2007-10-17 13:48 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\MySpace
2007-10-11 11:46 582,656 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-05 02:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater
2007-11-04 01:27 --------- d-----w C:\Program Files\Trend Micro
2007-11-01 05:53 --------- d-----w C:\Program Files\motive
2007-11-01 03:00 --------- d-----w C:\Program Files\Microsoft AntiSpyware
2007-11-01 02:32 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2007-11-01 01:57 --------- d-----w C:\Documents and Settings\Owner\Application Data\Apple Computer
2007-11-01 01:12 --------- d-----w C:\Documents and Settings\Owner\Application Data\AdobeUM
2007-11-01 00:52 --------- d-----w C:\Program Files\Trial123FileConvert
2007-10-27 03:46 --------- d-----w C:\Program Files\Microsoft Games
2007-10-02 23:41 --------- d-----w C:\Program Files\Last Seconds Bidder
2007-10-02 17:00 --------- d-----w C:\Program Files\Common Files\Adobe
2007-10-01 16:42 --------- d-----w C:\Program Files\iTunes
2007-10-01 16:42 --------- d-----w C:\Program Files\iPod
2007-09-30 23:45 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll
2007-09-25 00:13 --------- d-----w C:\Program Files\ewido anti-malware
2007-09-25 00:13 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kodak
2007-09-24 22:31 --------- d-----w C:\Program Files\Common Files\xing shared
2007-09-24 22:31 --------- d-----w C:\Program Files\Common Files\Real
2007-09-24 21:38 --------- d-----w C:\Program Files\Kodak
2007-09-24 21:34 --------- d-----w C:\Program Files\HyperVRE
2007-09-24 21:33 --------- d-----w C:\Program Files\DivX
2007-09-24 21:31 --------- d-----w C:\Program Files\Article Distributor
2007-09-24 21:29 --------- d-----w C:\Program Files\Google
2007-09-24 21:23 --------- d-----w C:\Program Files\OpenOffice.org 2.0
2007-09-24 21:21 --------- d-----w C:\Documents and Settings\Owner\Application Data\OpenOffice.org2
2007-09-24 21:05 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL
2007-09-24 20:54 --------- d-----w C:\Program Files\Pure Networks
2007-09-24 20:54 --------- d-----w C:\Program Files\Common Files\AOL
2007-09-24 20:53 --------- d-----w C:\Documents and Settings\Owner\Application Data\AOL
2007-09-20 23:57 --------- d-----w C:\Documents and Settings\All Users\Application Data\DVD Shrink
2007-09-20 23:49 --------- d-----w C:\Documents and Settings\Owner\Application Data\dvdcss
2007-09-09 22:25 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2007-09-09 22:24 --------- d-----w C:\Program Files\QuickTime
2007-09-09 22:22 --------- d-----w C:\Program Files\Common Files\Apple
2007-09-09 22:22 --------- d-----w C:\Program Files\Apple Software Update
2007-09-09 22:22 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
2007-09-01 18:23 24,192 ----a-w C:\Documents and Settings\Owner\usbsermptxp.sys
2007-09-01 18:23 22,768 ----a-w C:\Documents and Settings\Owner\usbsermpt.sys
2007-08-21 06:15 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
2007-01-21 18:30 557 ----a-w C:\Program Files\INSTALL.LOG
2005-09-14 16:24 33,280 ----a-w C:\Program Files\EndProcess.exe
2005-07-29 23:24:26 472 --sha-r C:\WINDOWS\UmFjaGVs\oAI3u3pP.vbs
.

((((((((((((((((((((((((((((( snapshot@2007-11-03_21.33.28.98 )))))))))))))))))))))))))))))))))))))))))
.
- 2007-10-30 01:56:19 136,192 ----a-w C:\WINDOWS\catchme.exe
+ 2007-10-30 02:56:19 136,192 ----a-w C:\WINDOWS\catchme.exe
+ 2007-03-13 18:57:10 163,328 ----a-w C:\WINDOWS\ERDNT\subs\ERDNT.EXE
- 2007-11-03 15:30:42 52,764 ----a-w C:\WINDOWS\system32\perfc009.dat
+ 2007-11-04 14:39:16 52,764 ----a-w C:\WINDOWS\system32\perfc009.dat
- 2007-11-03 15:30:43 380,350 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2007-11-04 14:39:16 380,350 ----a-w C:\WINDOWS\system32\perfh009.dat
- 2007-04-02 21:21:27 139,776 ----a-w C:\WINDOWS\system32\swreg.exe
+ 2007-04-02 22:21:27 139,776 ----a-w C:\WINDOWS\system32\swreg.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25997E08-274A-4217-8F71-C89C754242C1}]
2007-10-31 17:53 32256 --a------ C:\WINDOWS\system32\khfggfc.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5F174EBF-59B4-4F17-9FFC-E2398BD28457}]
C:\WINDOWS\system32\pmnli.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{790f562f-fd72-4f6f-b660-f3ec9325dcf1}]
2007-11-05 07:39 83008 --a------ C:\WINDOWS\system32\oidxmyqb.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2005-10-19 07:59]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-10-19 07:59]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 05:24]
"type32"="C:\Program Files\Microsoft IntelliType Pro\type32.exe" [2005-03-15 01:46]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\point32.exe" [2005-03-23 15:26]
"BJCFD"="C:\Program Files\BroadJump\Client Foundation\CFD.exe" [2002-09-10 21:26]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-09-24 14:31]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-09-26 13:42]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 18:51]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 18:20]
"39c8702f"="C:\WINDOWS\system32\qayvvbax.dll" [2007-11-05 07:35]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATI Launchpad"="C:\Program Files\ATI Multimedia\main\launchpd.exe" [2004-06-15 22:22]
"ATI Remote Control"="C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe" [2004-04-16 06:43]
"PopUpStopperFreeEdition"="C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe" [2005-03-17 11:10]
"RoboForm"="C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2006-06-02 20:23]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:56]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"RunNarrator"=Narrator.exe

C:\Documents and Settings\Owner\Start Menu\Programs\Startup\
Webshots.lnk - C:\Program Files\Webshots\Launcher.exe [2005-12-04 21:07:15]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Acrobat Assistant.lnk - C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [2003-10-23 20:37:56]
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-12-21 06:36:06]
Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2007-09-24 13:29:10]
Wireless-B Notebook Adapter Utility.lnk - C:\Program Files\Linksys\Wireless-B PCI Adapter\Startup.exe [2005-12-02 15:33:28]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{25997E08-274A-4217-8F71-C89C754242C1}"= C:\WINDOWS\system32\khfggfc.dll [2007-10-31 17:53 32256]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\jrfkhhva]
jrfkhhva.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\khfggfc]
khfggfc.dll 2007-10-31 17:53 32256 C:\WINDOWS\system32\khfggfc.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\system32\sstqr.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
backup=C:\WINDOWS\pss\Kodak EasyShare software.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak software updater.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak software updater.lnk
backup=C:\WINDOWS\pss\Kodak software updater.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
backup=C:\WINDOWS\pss\WinZip Quick Pick.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^Webshots.lnk]
path=C:\Documents and Settings\Owner\Start Menu\Programs\Startup\Webshots.lnk
backup=C:\WINDOWS\pss\Webshots.lnkStartup


R3 CBTNDIS5;CBTNDIS5 NDIS Protocol Driver;\??\C:\WINDOWS\System32\CBTNDIS5.SYS
R3 odysseyIM3;Odyssey Network Services Miniport;C:\WINDOWS\system32\DRIVERS\odysseyIM3.sys
S2 Ca533av;Polaroid Digital Cam Video;C:\WINDOWS\system32\Drivers\Ca533av.sys
S3 IPN2120;Wireless-B PCI Adapter Driver;C:\WINDOWS\system32\DRIVERS\LSIPNDS.sys
S3 USBCamera;Icatch(IV) Still Camera Device;C:\WINDOWS\system32\Drivers\Bulk533.sys

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\Shell\AutoRun\command - E:\EE2AutoRun.exe

.
Contents of the 'Scheduled Tasks' folder
"2007-11-05 17:18:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
"2007-11-06 01:47:20 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
"2007-11-02 22:00:00 C:\WINDOWS\Tasks\Norton Security Scan.job"
- C:\Program Files\Norton Security Scan\Nss.exe
.
**************************************************************************

catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-05 19:07:30
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-05 19:09:19 - machine was rebooted
.
--- E O F ---
 
Hello rosey911,

Using Add Or Remove Programs remove the following entries (if present): (To get into add Or Remove Programs press the START button > Control Panel > Add Or Remove Programs.)

Viewpoint Media Player

A. Please RUN HijackThis
  1. Click the SCAN button to produce a log.

  2. Place a check mark beside each one of the following items:

    O4 - HKLM\..\Run: [39c8702f] rundll32.exe "C:\WINDOWS\system32\uywnwgkl.dll",b

  3. Now with all the items selected, and all windows closed except for HJT, delete them by clicking the FIX checked button. Close the HijackThis window.


B. 1. Please open Notepad
  • Click Start , then Run
  • Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

File::
C:\WINDOWS\system32\mgxnsskp.dll
C:\WINDOWS\system32\msqtvcap.dat
C:\WINDOWS\mrofinu1000137.exe
C:\WINDOWS\system32\1551.bat
C:\WINDOWS\system32\khfggfc.dll
C:\WINDOWS\system32\uywnwgkl.dll

Folder::
C:\VundoFix Backups
C:\WINDOWS\system32\aliedit
C:\Program Files\Alibaba
C:\WINDOWS\tmpDSM1
C:\WINDOWS\UmFjaGVs

Registry::
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"Authentication Packages"=hex(7):6d,73,76,31,5f,30,00,00

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
Click to expand...


3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

CFScript.gif



5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
  • Combofix.txt
  • A new HijackThis log.
 
Combofix log too long, so I am posting in peices

ComboFix 07-11-01.1** - Owner 2007-11-06 8:35:07.6 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.96 [GMT -8:00]
Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe
Command switches used :: C:\CFScript.txt
* Created a new restore point

FILE::
C:\WINDOWS\mrofinu1000137.exe
C:\WINDOWS\system32\1551.bat
C:\WINDOWS\system32\khfggfc.dll
C:\WINDOWS\system32\mgxnsskp.dll
C:\WINDOWS\system32\msqtvcap.dat
C:\WINDOWS\system32\uywnwgkl.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Start Menu\Live Safety Center.lnk
C:\Documents and Settings\All Users\Start Menu\Online Security Guide.lnk
C:\Documents and Settings\Owner\Desktop\Live Safety Center.lnk
C:\Documents and Settings\Owner\Desktop\Online Security Guide.lnk
C:\Documents and Settings\Owner\Favorites\Online Security Guide.lnk
C:\Program Files\Alibaba
C:\Program Files\Alibaba\TradeManager\Ad\1.gif
C:\Program Files\Alibaba\TradeManager\Ad\2.gif
C:\Program Files\Alibaba\TradeManager\Ad\Default.htm
C:\Program Files\Alibaba\TradeManager\Ad\NewUserHelp.htm
C:\Program Files\Alibaba\TradeManager\Alitalk_Update.exe
C:\Program Files\Alibaba\TradeManager\AliUpdateConfigFile.ini
C:\Program Files\Alibaba\TradeManager\AliViewerApi.dll
C:\Program Files\Alibaba\TradeManager\ATabControl2.ocx
C:\Program Files\Alibaba\TradeManager\Beginner\add_contact.gif
C:\Program Files\Alibaba\TradeManager\Beginner\Add_to_contact_list.gif
C:\Program Files\Alibaba\TradeManager\Beginner\Close.gif
C:\Program Files\Alibaba\TradeManager\Beginner\match_bg.jpg
C:\Program Files\Alibaba\TradeManager\Beginner\match_bottom_bg.jpg
C:\Program Files\Alibaba\TradeManager\Beginner\matching_01.html
C:\Program Files\Alibaba\TradeManager\CodingTable\BIG52GBK_S.bin
C:\Program Files\Alibaba\TradeManager\CodingTable\CodingTable.dll
C:\Program Files\Alibaba\TradeManager\CodingTable\GBK2BIG5.bin
C:\Program Files\Alibaba\TradeManager\Config.ini
C:\Program Files\Alibaba\TradeManager\config\IMHistory.htm
C:\Program Files\Alibaba\TradeManager\config\myt_swfw_ct_loading.gif
C:\Program Files\Alibaba\TradeManager\config\SearchContactConfig.ini
C:\Program Files\Alibaba\TradeManager\config\Signin.html
C:\Program Files\Alibaba\TradeManager\config\Signin_INTL_FREE.html
C:\Program Files\Alibaba\TradeManager\config\Signin_INTL_GS.html
C:\Program Files\Alibaba\TradeManager\config\Signin1.html
C:\Program Files\Alibaba\TradeManager\CrashDumper.exe
C:\Program Files\Alibaba\TradeManager\CrashDumper.ini
C:\Program Files\Alibaba\TradeManager\CSUpdateModule.dll
C:\Program Files\Alibaba\TradeManager\dbghelp.dll
C:\Program Files\Alibaba\TradeManager\DefaultPages\BizCard.html
C:\Program Files\Alibaba\TradeManager\DefaultPages\crm_add_pop.htm
C:\Program Files\Alibaba\TradeManager\DefaultPages\default.html
C:\Program Files\Alibaba\TradeManager\DefaultPages\myt_grey.gif
C:\Program Files\Alibaba\TradeManager\DefaultPages\myt_refresh.gif
C:\Program Files\Alibaba\TradeManager\DefaultPages\namecard_404.htm
C:\Program Files\Alibaba\TradeManager\DefaultPages\Product.html
C:\Program Files\Alibaba\TradeManager\DefaultPages\Recommend_Offer.html
C:\Program Files\Alibaba\TradeManager\DefaultPages\refresh.gif
C:\Program Files\Alibaba\TradeManager\DefaultPages\refresh_b.gif
C:\Program Files\Alibaba\TradeManager\DefaultPages\sqdy.html
C:\Program Files\Alibaba\TradeManager\DefaultPages\trust.gif
C:\Program Files\Alibaba\TradeManager\FileTransferLog.txt
C:\Program Files\Alibaba\TradeManager\Industry.db
C:\Program Files\Alibaba\TradeManager\INSTALL.LOG
C:\Program Files\Alibaba\TradeManager\Language.ini
C:\Program Files\Alibaba\TradeManager\MessageManager.dll
C:\Program Files\Alibaba\TradeManager\MessageNotify.dll
C:\Program Files\Alibaba\TradeManager\MultiMedia\AliViewCtrl.dll
C:\Program Files\Alibaba\TradeManager\MultiMedia\AliViewer.exe
C:\Program Files\Alibaba\TradeManager\MultiMedia\AliViewMedia.dll
C:\Program Files\Alibaba\TradeManager\MultiMedia\FileRequired.txt
C:\Program Files\Alibaba\TradeManager\MultiMedia\JsmQEdit.ax
C:\Program Files\Alibaba\TradeManager\MultiMedia\JsmRender.ax
C:\Program Files\Alibaba\TradeManager\MultiMedia\JsmShow.dll
C:\Program Files\Alibaba\TradeManager\MultiMedia\JsmSource.ax
C:\Program Files\Alibaba\TradeManager\MultiMedia\MMCfg.cfg
C:\Program Files\Alibaba\TradeManager\MultiMedia\VideoCap.dll
C:\Program Files\Alibaba\TradeManager\MultiMedia\VLAudio.dll
C:\Program Files\Alibaba\TradeManager\MultiMedia\VLNetwork.dll
C:\Program Files\Alibaba\TradeManager\MultiMedia\xvid.dll
C:\Program Files\Alibaba\TradeManager\MultiMedia\xvidcore.dll
C:\Program Files\Alibaba\TradeManager\MultiMedia\xvidDec.ax
C:\Program Files\Alibaba\TradeManager\pdupdate.ini
C:\Program Files\Alibaba\TradeManager\readme.txt
C:\Program Files\Alibaba\TradeManager\Remind.ini
C:\Program Files\Alibaba\TradeManager\riched20.dll
C:\Program Files\Alibaba\TradeManager\riched32.dll
C:\Program Files\Alibaba\TradeManager\skins\chat_dlg.ico
C:\Program Files\Alibaba\TradeManager\skins\default\add_cnt_center.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\add_contact_center.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\add_contact_invite.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\add_contact_left.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\add_contact_logo.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\add_contact_right.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\add_contact_seach.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\add_contact_top_left.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\add_contact_top_mid.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\add_contact_top_right.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\add_im_cnt_center.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\add_im_cnt_image.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\add_im_cnt_left.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\add_im_cnt_right.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\adduser_bt_add.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\adduser_bt_cancel.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\adduser_bt_next.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\adduser_bt_previous.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\adduser_bt_search.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\adduser_bt_upgrade.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\adduser_tab_search1.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\adduser_tab_search2.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\alarm.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\arrow_left.gif
C:\Program Files\Alibaba\TradeManager\skins\default\arrow_right.gif
C:\Program Files\Alibaba\TradeManager\skins\default\Autoupdate_left.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\beginner_setting.gif
C:\Program Files\Alibaba\TradeManager\skins\default\BottomBorder.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\BottomLeftCorner.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\BottomRightCorner.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\btn_contact_view_add_hover.ico
C:\Program Files\Alibaba\TradeManager\skins\default\btn_contact_view_add_normal.ico
C:\Program Files\Alibaba\TradeManager\skins\default\btn_contact_view_filter_hover.ico
C:\Program Files\Alibaba\TradeManager\skins\default\btn_contact_view_filter_normal.ico
C:\Program Files\Alibaba\TradeManager\skins\default\btn_contact_view_find.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\btn_contact_view_more.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\btn_logoned_mail.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\btn_logoned_nomail.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\btn_logoned_post_offer.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\btn_logoned_search.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\btn_logoned_sms.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\But_AddContact.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\But_Audio.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\But_BlockContact.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\But_Cancel.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\But_ChatIMS_More.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\But_DelUser.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\But_Emotion.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\But_Exit.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\But_Font.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\But_Font_Bold.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\But_Font_Color.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\But_Font_Emotion.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\But_Font_Itali.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\But_Font_Underline.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\But_HideInfo.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\But_InviteContact.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\But_Login.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\But_Logining_Cancel.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\But_MainFunPanel_AddContact.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\But_MainFunPanel_More.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\But_MainFunPanel_SearchContact.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\But_MainView_Search.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\But_Next.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\But_Ok.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\But_OmitUser.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\But_PrivateChat.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\But_RecentHistory.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\But_Recommend.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\But_ReLogin.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\But_Retry.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\But_SelfStatus.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\But_SendFile.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\But_SendIMS.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\But_ShortcutMsg.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\But_Stop.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\But_SuperTip_Close.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\But_Video.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\chat_capture_screen.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\ChatIMS_Client_Separator.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\ChatIMS_ClientBottom_Left.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\ChatIMS_ClientBottom_Mid.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\ChatIMS_ClientBottom_Right.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\ChatIMS_ClientBottom_Right2.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\ChatIMS_ClientLeft.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\ChatIMS_ClientRight.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\ChatIMS_ClientRight2.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\ChatIMS_ClientTop_Left.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\ChatIMS_ClientTop_Mid.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\ChatIMS_ClientTop_Right.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\ChatIMS_ContactLabel_Left.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\ChatIMS_ContactLabel_Mid.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\ChatIMS_ContactLabel_Right.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\ChatIMS_FormatBar_Left.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\ChatIMS_FormatBar_Mid.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\ChatIMS_FormatBar_Right.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\ChatIMS_Notify_Mid.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\ChatIms_right_top_bg.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\ChatIMS_Seperator_Bottom.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\ChatIms_seperator_top_bg.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\ChatIMS_Tab_Server.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\ChatIMS_Tab1.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\ChatIMS_Tab2.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\ChatIMS_ToolBarLeft.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\ChatIMS_ToolBarMid.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\ChatIMS_ToolBarRight.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\ChatMPC_FormatBar_Left.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\ChatMPC_RightBottom_BK.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\contact_detail_infor_bottom_left.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\contact_detail_infor_bottom_mid.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\contact_detail_infor_bottom_right.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\contact_detail_infor_btn_cancel.bmp
 
C:\Program Files\Alibaba\TradeManager\skins\default\contact_detail_infor_btn_confirm.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\contact_detail_infor_left.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\contact_detail_infor_right.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\contact_detail_infor_symbol.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\contact_detail_infor_tab_basic.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\contact_detail_infor_tab_company.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\contact_detail_infor_tab_others.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\contact_detail_infor_tab_personal.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\contact_detail_infor_top_left.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\contact_detail_infor_top_mid.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\contact_detail_infor_top_right.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\ContactList_Bk.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\contactlist_toolbar_left.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\contactlist_toolbar_mid.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\contactlist_toolbar_right.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\CRM.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\drop_down_arrow_black.ico
C:\Program Files\Alibaba\TradeManager\skins\default\drop_down_arrow_white.ico
C:\Program Files\Alibaba\TradeManager\skins\default\emotions.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\Icon_Alert.gif
C:\Program Files\Alibaba\TradeManager\skins\default\Icon_Camera.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\Icon_Club.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\Icon_Find.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\Icon_grp_close.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\Icon_grp_open.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\Icon_gs_away.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\Icon_gs_busy.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\Icon_gs_m_away.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\Icon_gs_m_black.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\Icon_gs_m_busy.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\Icon_gs_m_offline.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\Icon_gs_m_online.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\Icon_gs_offline.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\Icon_gs_online.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\Icon_helper.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\Icon_Mobile.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\Icon_Notice.gif
C:\Program Files\Alibaba\TradeManager\skins\default\Icon_Remind.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\Icon_Right.gif
C:\Program Files\Alibaba\TradeManager\skins\default\Icon_tpu_away.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\Icon_tpu_busy.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\Icon_tpu_m_away.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\Icon_tpu_m_black.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\Icon_tpu_m_busy.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\Icon_tpu_m_offline.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\Icon_tpu_m_online.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\Icon_tpu_offline.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\Icon_tpu_online.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\Icon_u_away.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\Icon_u_busy.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\Icon_u_m_away.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\Icon_u_m_black.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\Icon_u_m_busy.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\Icon_u_m_offline.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\Icon_u_m_online.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\Icon_u_offline.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\Icon_u_online.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\InfoBarBack.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\infocard_fortune1.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\infocard_fortune2.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\infocard_fortune3.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\inforcard_bottom_left.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\inforcard_bottom_mid.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\inforcard_bottom_right.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\inforcard_btn_close.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\inforcard_btn_edit_contact.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\inforcard_btn_email.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\inforcard_btn_mobile.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\inforcard_btn_modify_profile.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\inforcard_btn_sms.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\inforcard_btn_tel.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\inforcard_btn_use_fortune.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\inforcard_center.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\inforcard_left.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\inforcard_right.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\inforcard_top_left.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\inforcard_top_mid.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\inforcard_top_right.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\join_in.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\join_in_arrow.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\LeftBorder.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\login_failed.gif
C:\Program Files\Alibaba\TradeManager\skins\default\Logo.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\logo_normal_away.ico
C:\Program Files\Alibaba\TradeManager\skins\default\logo_normal_busy.ico
C:\Program Files\Alibaba\TradeManager\skins\default\logo_normal_invisible.ico
C:\Program Files\Alibaba\TradeManager\skins\default\logo_normal_online.ico
C:\Program Files\Alibaba\TradeManager\skins\default\Logo_ToolBar.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\logo_tp_away.ico
C:\Program Files\Alibaba\TradeManager\skins\default\logo_tp_busy.ico
C:\Program Files\Alibaba\TradeManager\skins\default\logo_tp_invisible.ico
C:\Program Files\Alibaba\TradeManager\skins\default\logo_tp_online.ico
C:\Program Files\Alibaba\TradeManager\skins\default\Logoned_Bottom_Left.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\Logoned_Bottom_Left2.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\Logoned_Bottom_Mid.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\Logoned_Bottom_Mid2.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\Logoned_Bottom_Right.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\Logoned_Bottom_Right2.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\logoned_head_left.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\logoned_head_left1.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\logoned_head_left2.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\logoned_head_mid.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\logoned_head_mid1.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\logoned_head_mid2.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\logoned_head_right.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\logoned_head_right1.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\logoned_head_right2.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\Logoned_Left.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\Logoned_Right.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\Logoned_Top_Left.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\Logoned_Top_Mid.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\Logoned_Top_Right.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\LogOuted.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\LogOuting.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\MainLogin_Bk.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\MainLogin_Logo.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\MainLogin_Register.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\MainLogining_Bk.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\MainLogining_Image.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\MainLogoffed_Bk.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\MainLogouting_Bk.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\MainView_ToolBar_Left.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\MainView_ToolBar_Right.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\mm_but_advsearch.gif
C:\Program Files\Alibaba\TradeManager\skins\default\mm_but_search.gif
C:\Program Files\Alibaba\TradeManager\skins\default\MN_bottom.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\MN_icon.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\MN_left.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\MN_leftbottom.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\MN_lefttop.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\MN_mid.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\MN_right.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\MN_rightbottom.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\MN_righttop.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\MN_top.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\multichat_client_top_left.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\multichat_client_top_mid.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\multichat_client_top_right.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\MyAlibabaMain.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\normal_contact.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\NotifyMain.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\offline_icon.gif
C:\Program Files\Alibaba\TradeManager\skins\default\online_icon.gif
C:\Program Files\Alibaba\TradeManager\skins\default\online_offline_bg.gif
C:\Program Files\Alibaba\TradeManager\skins\default\online_offline_bg2.gif
C:\Program Files\Alibaba\TradeManager\skins\default\PersonalManage.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\pop_arrow.gif
C:\Program Files\Alibaba\TradeManager\skins\default\pop_bg.gif
C:\Program Files\Alibaba\TradeManager\skins\default\pop_close.gif
C:\Program Files\Alibaba\TradeManager\skins\default\pop_close2.gif
C:\Program Files\Alibaba\TradeManager\skins\default\pop_close3.gif
C:\Program Files\Alibaba\TradeManager\skins\default\quit.gif
C:\Program Files\Alibaba\TradeManager\skins\default\refreshContactInfo.gif
C:\Program Files\Alibaba\TradeManager\skins\default\RightBorder.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\select.cur
C:\Program Files\Alibaba\TradeManager\skins\default\server_bottom_left.gif
C:\Program Files\Alibaba\TradeManager\skins\default\server_bottom_mid.gif
C:\Program Files\Alibaba\TradeManager\skins\default\server_bottom_right.gif
C:\Program Files\Alibaba\TradeManager\skins\default\server_tab_back.gif
C:\Program Files\Alibaba\TradeManager\skins\default\ServiceMain.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\ServiceTipItem1.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\SkinConfig.ini
C:\Program Files\Alibaba\TradeManager\skins\default\StatusBar_Size_Bk.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\StatusBar_Tile_Bk.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\SuperTip_Title_Left.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\SuperTip_Title_Mid.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\SuperTip_Title_Right.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\Tab1.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\Tab1_mini.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\Tab2.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\Tab2_crm.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\Tab3.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\Tab3_mini.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\Tab4.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\TitlebarBk_Bottom.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\TitlebarBk_Bottom_Inactive.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\TitlebarBk_Top.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\TitlebarBk_Top_Inactive.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\universal_bottom_left.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\universal_bottom_mid.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\universal_bottom_right.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\universal_center.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\universal_left.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\universal_right.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\universal_top_left.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\universal_top_mid.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\universal_top_right.bmp
C:\Program Files\Alibaba\TradeManager\skins\default\w_close.gif
C:\Program Files\Alibaba\TradeManager\skins\default\w_close_hover.gif
C:\Program Files\Alibaba\TradeManager\skins\default\w_close_pressed.gif
C:\Program Files\Alibaba\TradeManager\skins\default\w_max.gif
C:\Program Files\Alibaba\TradeManager\skins\default\w_max_hover.gif
C:\Program Files\Alibaba\TradeManager\skins\default\w_max_pressed.gif
C:\Program Files\Alibaba\TradeManager\skins\default\w_mini.gif
C:\Program Files\Alibaba\TradeManager\skins\default\w_mini_hover.gif
C:\Program Files\Alibaba\TradeManager\skins\default\w_mini_pressed.gif
C:\Program Files\Alibaba\TradeManager\skins\default\w_restore.gif
C:\Program Files\Alibaba\TradeManager\skins\default\w_restore_hover.gif
C:\Program Files\Alibaba\TradeManager\skins\default\w_restore_pressed.gif
C:\Program Files\Alibaba\TradeManager\skins\helper.ico
C:\Program Files\Alibaba\TradeManager\skins\Smileys\00.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\01.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\02.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\03.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\04.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\04.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\05.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\06.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\07.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\08.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\08.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\09.gif
 
C:\Program Files\Alibaba\TradeManager\skins\Smileys\10.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\10.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\11.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\11.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\12.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\12.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\13.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\14.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\15.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\16.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\17.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\17.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\18.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\19.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\20.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\21.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\22.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\23.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\24.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\25.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\25.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\26.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\26.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\27.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\27.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\28.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\29.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\30.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\31.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\32.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\33.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\33.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\34.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\35.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\35.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\36.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\37.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\38.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\39.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\39.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\40.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\40.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\41.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\42.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\42.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\43.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\43.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\44.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\44.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\45.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\45.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\46.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\46.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\47.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\47.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\48.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\48.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\49.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\49.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\50.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\50.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\51.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\51.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\52.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\53.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\53.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\config.ini
C:\Program Files\Alibaba\TradeManager\skins\Smileys\old_00.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\old_01.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\old_02.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\old_03.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\old_04.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\old_05.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\old_06.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\old_07.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\old_08.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\old_09.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\old_10.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\old_11.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\old_12.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\old_13.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\old_14.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\old_15.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\old_16.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\old_17.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\old_18.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\old_19.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\old_20.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\old_21.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\old_22.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\old_23.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\old_24.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\old_25.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\old_26.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\old_27.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\old_28.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\old_29.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\old_30.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\old_31.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\old_32.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\old_33.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\old_34.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\old_35.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\old_36.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\old_37.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\old_38.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\old_39.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\old_40.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\old_41.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\old_42.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\old_43.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\old_44.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\old_45.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\old_46.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\old_47.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\old_48.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\old_49.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\old_50.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\old_51.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\old_52.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\old_53.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\old_54.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\old_55.gif
C:\Program Files\Alibaba\TradeManager\skins\Smileys\oldi_00.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\oldi_01.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\oldi_02.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\oldi_03.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\oldi_04.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\oldi_05.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\oldi_06.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\oldi_07.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\oldi_08.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\oldi_09.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\oldi_10.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\oldi_11.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\oldi_12.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\oldi_13.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\oldi_14.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\oldi_15.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\oldi_16.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\oldi_17.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\oldi_18.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\oldi_19.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\oldi_20.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\oldi_21.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\oldi_22.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\oldi_23.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\oldi_24.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\oldi_25.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\oldi_26.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\oldi_27.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\oldi_28.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\oldi_29.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\oldi_30.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\oldi_31.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\oldi_32.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\oldi_33.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\oldi_34.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\oldi_35.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\oldi_36.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\oldi_37.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\oldi_38.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\oldi_39.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\oldi_40.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\oldi_41.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\oldi_42.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\oldi_43.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\oldi_44.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\oldi_45.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\oldi_46.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\oldi_47.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\oldi_48.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\oldi_49.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\oldi_50.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\oldi_51.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\oldi_52.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\oldi_53.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\oldi_54.bmp
C:\Program Files\Alibaba\TradeManager\skins\Smileys\oldi_55.bmp
C:\Program Files\Alibaba\TradeManager\skins\Tray_away.ico
C:\Program Files\Alibaba\TradeManager\skins\Tray_busy.ico
C:\Program Files\Alibaba\TradeManager\skins\Tray_invisible.ico
C:\Program Files\Alibaba\TradeManager\skins\Tray_offline.ico
C:\Program Files\Alibaba\TradeManager\skins\Tray_online.ico
C:\Program Files\Alibaba\TradeManager\sound\alert0.WAV
C:\Program Files\Alibaba\TradeManager\sound\alert1.WAV
C:\Program Files\Alibaba\TradeManager\sound\alert2.WAV
C:\Program Files\Alibaba\TradeManager\sound\Dang.WAV
C:\Program Files\Alibaba\TradeManager\sound\Offline.wav
C:\Program Files\Alibaba\TradeManager\sound\Online.wav
C:\Program Files\Alibaba\TradeManager\sound\Sent.wav
C:\Program Files\Alibaba\TradeManager\SysIdle.dll
C:\Program Files\Alibaba\TradeManager\TradeManager.exe
C:\Program Files\Alibaba\TradeManager\TradeManager_Check.dll
C:\Program Files\Alibaba\TradeManager\TransDB.exe
C:\Program Files\Alibaba\TradeManager\Unwise.exe
C:\Program Files\Alibaba\TradeManager\URLConfig.ini
C:\Program Files\Alibaba\TradeManager\users\enaliintrosey911\CacheDB.db
C:\Program Files\Alibaba\TradeManager\users\enaliintrosey911\Config.bak
C:\Program Files\Alibaba\TradeManager\users\enaliintrosey911\Config.db
C:\Program Files\Alibaba\TradeManager\users\enaliintrosey911\msglog.bak
C:\Program Files\Alibaba\TradeManager\users\enaliintrosey911\msglog.db
C:\Program Files\Alibaba\TradeManager\users\system\Config.db
C:\Program Files\Alibaba\TradeManager\Zone.db
C:\VundoFix Backups
C:\WINDOWS\mrofinu1000137.exe
C:\WINDOWS\system32\1551.bat
C:\WINDOWS\system32\aliedit
C:\WINDOWS\system32\aliedit\aliedit.dll
C:\WINDOWS\system32\bkekqtmh.exe
C:\WINDOWS\system32\cbeeg.bak1
C:\WINDOWS\system32\cbeeg.ini
C:\WINDOWS\system32\geebc.dll
C:\WINDOWS\system32\gslrfoyf.dllbox
C:\WINDOWS\system32\khfggfc.dll
C:\WINDOWS\system32\mgxnsskp.dll
C:\WINDOWS\system32\msqtvcap.dat
 
C:\WINDOWS\tmpDSM1
C:\WINDOWS\tmpDSM1\Pdf\PdfFile.pdf
C:\WINDOWS\tmpDSM1\Pdf\PsFile.ps
C:\WINDOWS\UmFjaGVs
C:\WINDOWS\UmFjaGVs\oAI3u3pP.vbs

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_DOMAINSERVICE
-------\DomainService


((((((((((((((((((((((((( Files Created from 2007-10-06 to 2007-11-06 )))))))))))))))))))))))))))))))
.

2007-11-06 07:24 87,104 --a------ C:\WINDOWS\system32\rvwxugno.dll
2007-11-06 07:21 81,472 --a------ C:\WINDOWS\system32\oatmhcmt.dll
2007-11-06 07:15 340,032 --a------ C:\WINDOWS\system32\kyfxbonj.dll
2007-11-06 07:15 340,032 --a------ C:\WINDOWS\system32\gslrfoyf.dll
2007-11-05 16:38 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2007-11-05 07:39 83,008 --a------ C:\WINDOWS\system32\oidxmyqb.dll
2007-11-04 12:53 <DIR> d-------- C:\Deckard
2007-11-03 20:14 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-11-03 15:04 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2007-11-03 15:04 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-11-03 14:47 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-11-03 07:29 <DIR> d-------- C:\Program Files\Spyware Doctor
2007-11-03 07:29 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\PC Tools
2007-11-03 07:29 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2007-11-03 07:29 79,688 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
2007-11-03 07:29 62,280 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
2007-11-03 07:29 41,288 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
2007-11-03 07:29 29,000 --a------ C:\WINDOWS\system32\drivers\kcom.sys
2007-11-03 07:28 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll
2007-10-31 19:06 <DIR> d-------- C:\Program Files\Windows Defender
2007-10-31 17:51 0 --a------ C:\WINDOWS\system32\taskkill.exe
2007-10-31 17:19 <DIR> d-------- C:\Program Files\PasswordTools
2007-10-23 16:46 <DIR> d-------- C:\Program Files\Norton Security Scan
2007-10-17 13:48 <DIR> d-------- C:\Program Files\MySpace
2007-10-17 13:48 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\MySpace
2007-10-11 11:46 582,656 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-06 03:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater
2007-11-04 01:27 --------- d-----w C:\Program Files\Trend Micro
2007-11-01 05:53 --------- d-----w C:\Program Files\motive
2007-11-01 03:00 --------- d-----w C:\Program Files\Microsoft AntiSpyware
2007-11-01 02:32 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2007-11-01 01:57 --------- d-----w C:\Documents and Settings\Owner\Application Data\Apple Computer
2007-11-01 01:12 --------- d-----w C:\Documents and Settings\Owner\Application Data\AdobeUM
2007-11-01 00:52 --------- d-----w C:\Program Files\Trial123FileConvert
2007-10-27 03:46 --------- d-----w C:\Program Files\Microsoft Games
2007-10-02 23:41 --------- d-----w C:\Program Files\Last Seconds Bidder
2007-10-02 17:00 --------- d-----w C:\Program Files\Common Files\Adobe
2007-10-01 16:42 --------- d-----w C:\Program Files\iTunes
2007-10-01 16:42 --------- d-----w C:\Program Files\iPod
2007-09-25 00:13 --------- d-----w C:\Program Files\ewido anti-malware
2007-09-25 00:13 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kodak
2007-09-24 22:31 --------- d-----w C:\Program Files\Common Files\xing shared
2007-09-24 22:31 --------- d-----w C:\Program Files\Common Files\Real
2007-09-24 21:38 --------- d-----w C:\Program Files\Kodak
2007-09-24 21:34 --------- d-----w C:\Program Files\HyperVRE
2007-09-24 21:33 --------- d-----w C:\Program Files\DivX
2007-09-24 21:31 --------- d-----w C:\Program Files\Article Distributor
2007-09-24 21:29 --------- d-----w C:\Program Files\Google
2007-09-24 21:23 --------- d-----w C:\Program Files\OpenOffice.org 2.0
2007-09-24 21:21 --------- d-----w C:\Documents and Settings\Owner\Application Data\OpenOffice.org2
2007-09-24 21:05 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL
2007-09-24 20:54 --------- d-----w C:\Program Files\Pure Networks
2007-09-24 20:54 --------- d-----w C:\Program Files\Common Files\AOL
2007-09-24 20:53 --------- d-----w C:\Documents and Settings\Owner\Application Data\AOL
2007-09-20 23:57 --------- d-----w C:\Documents and Settings\All Users\Application Data\DVD Shrink
2007-09-20 23:49 --------- d-----w C:\Documents and Settings\Owner\Application Data\dvdcss
2007-09-09 22:25 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2007-09-09 22:24 --------- d-----w C:\Program Files\QuickTime
2007-09-09 22:22 --------- d-----w C:\Program Files\Common Files\Apple
2007-09-09 22:22 --------- d-----w C:\Program Files\Apple Software Update
2007-09-09 22:22 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
2007-09-01 18:23 24,192 ----a-w C:\Documents and Settings\Owner\usbsermptxp.sys
2007-09-01 18:23 22,768 ----a-w C:\Documents and Settings\Owner\usbsermpt.sys
2007-01-21 18:30 557 ----a-w C:\Program Files\INSTALL.LOG
2005-09-14 16:24 33,280 ----a-w C:\Program Files\EndProcess.exe
.

((((((((((((((((((((((((((((( snapshot@2007-11-03_21.33.28.98 )))))))))))))))))))))))))))))))))))))))))
.
- 2007-10-30 01:56:19 136,192 ----a-w C:\WINDOWS\catchme.exe
+ 2007-10-30 02:56:19 136,192 ----a-w C:\WINDOWS\catchme.exe
+ 2007-03-13 18:57:10 163,328 ----a-w C:\WINDOWS\ERDNT\subs\ERDNT.EXE
- 2007-11-03 15:30:42 52,764 ----a-w C:\WINDOWS\system32\perfc009.dat
+ 2007-11-04 14:39:16 52,764 ----a-w C:\WINDOWS\system32\perfc009.dat
- 2007-11-03 15:30:43 380,350 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2007-11-04 14:39:16 380,350 ----a-w C:\WINDOWS\system32\perfh009.dat
- 2007-04-02 21:21:27 139,776 ----a-w C:\WINDOWS\system32\swreg.exe
+ 2007-04-02 22:21:27 139,776 ----a-w C:\WINDOWS\system32\swreg.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{246112fa-388a-4433-9f82-785bcc54ba36}]
2007-11-06 07:21 81472 --a------ C:\WINDOWS\system32\oatmhcmt.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5F174EBF-59B4-4F17-9FFC-E2398BD28457}]
C:\WINDOWS\system32\pmnli.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A95B2816-1D7E-4561-A202-68C0DE02353A}]
2007-11-06 07:15 340032 --a------ C:\WINDOWS\system32\gslrfoyf.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{11A69AE4-FBED-4832-A2BF-45AF82825583}"= C:\WINDOWS\system32\gslrfoyf.dll [2007-11-06 07:15 340032]

[HKEY_CLASSES_ROOT\CLSID\{11A69AE4-FBED-4832-A2BF-45AF82825583}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2005-10-19 07:59]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-10-19 07:59]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 05:24]
"type32"="C:\Program Files\Microsoft IntelliType Pro\type32.exe" [2005-03-15 01:46]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\point32.exe" [2005-03-23 15:26]
"BJCFD"="C:\Program Files\BroadJump\Client Foundation\CFD.exe" [2002-09-10 21:26]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-09-24 14:31]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-09-26 13:42]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 18:51]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 18:20]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATI Launchpad"="C:\Program Files\ATI Multimedia\main\launchpd.exe" [2004-06-15 22:22]
"ATI Remote Control"="C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe" [2004-04-16 06:43]
"PopUpStopperFreeEdition"="C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe" [2005-03-17 11:10]
"RoboForm"="C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2006-06-02 20:23]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:56]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"RunNarrator"=Narrator.exe

C:\Documents and Settings\Owner\Start Menu\Programs\Startup\
Webshots.lnk - C:\Program Files\Webshots\Launcher.exe [2005-12-04 21:07:15]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Acrobat Assistant.lnk - C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [2003-10-23 20:37:56]
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-12-21 06:36:06]
Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2007-09-24 13:29:10]
Wireless-B Notebook Adapter Utility.lnk - C:\Program Files\Linksys\Wireless-B PCI Adapter\Startup.exe [2005-12-02 15:33:28]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\gslrfoyf]
gslrfoyf.dll 2007-11-06 07:15 340032 C:\WINDOWS\system32\gslrfoyf.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\jrfkhhva]
jrfkhhva.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\khfggfc]
khfggfc.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
backup=C:\WINDOWS\pss\Kodak EasyShare software.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak software updater.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak software updater.lnk
backup=C:\WINDOWS\pss\Kodak software updater.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
backup=C:\WINDOWS\pss\WinZip Quick Pick.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^Webshots.lnk]
path=C:\Documents and Settings\Owner\Start Menu\Programs\Startup\Webshots.lnk
backup=C:\WINDOWS\pss\Webshots.lnkStartup


R3 CBTNDIS5;CBTNDIS5 NDIS Protocol Driver;\??\C:\WINDOWS\System32\CBTNDIS5.SYS
R3 odysseyIM3;Odyssey Network Services Miniport;C:\WINDOWS\system32\DRIVERS\odysseyIM3.sys
S2 Ca533av;Polaroid Digital Cam Video;C:\WINDOWS\system32\Drivers\Ca533av.sys
S3 IPN2120;Wireless-B PCI Adapter Driver;C:\WINDOWS\system32\DRIVERS\LSIPNDS.sys
S3 USBCamera;Icatch(IV) Still Camera Device;C:\WINDOWS\system32\Drivers\Bulk533.sys

.
Contents of the 'Scheduled Tasks' folder
"2007-11-05 17:18:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
"2007-11-06 16:51:59 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
"2007-11-02 22:00:00 C:\WINDOWS\Tasks\Norton Security Scan.job"
- C:\Program Files\Norton Security Scan\Nss.exe
.
**************************************************************************

catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-06 08:55:08
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-06 8:56:30 - machine was rebooted
.
--- E O F ---
 
Here is new HJT log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:24:39 AM, on 11/6/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\PROGRA~1\Webshots\webshots.scr
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Linksys\Wireless-B PCI Adapter\OdHost.exe
C:\Program Files\Linksys\Wireless-B PCI Adapter\WMP11Cfg.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: {63ab45cc-b587-28f9-3344-a883af211642} - {246112fa-388a-4433-9f82-785bcc54ba36} - C:\WINDOWS\system32\oatmhcmt.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5F174EBF-59B4-4F17-9FFC-E2398BD28457} - C:\WINDOWS\system32\pmnli.dll (file missing)
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: (no name) - {A95B2816-1D7E-4561-A202-68C0DE02353A} - C:\WINDOWS\system32\gslrfoyf.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Security Toolbar - {11A69AE4-FBED-4832-A2BF-45AF82825583} - C:\WINDOWS\system32\gslrfoyf.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKCU\..\Run: [ATI Launchpad] "C:\Program Files\ATI Multimedia\main\launchpd.exe"
O4 - HKCU\..\Run: [ATI Remote Control] C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: Wireless-B Notebook Adapter Utility.lnk = C:\Program Files\Linksys\Wireless-B PCI Adapter\Startup.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - https://my.lennar.com/inotes/iNotes6W.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1133627876228
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1133627864900
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O20 - Winlogon Notify: gslrfoyf - C:\WINDOWS\SYSTEM32\gslrfoyf.dll
O20 - Winlogon Notify: jrfkhhva - jrfkhhva.dll (file missing)
O20 - Winlogon Notify: khfggfc - khfggfc.dll (file missing)
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NICSer_WMP11 - Unknown owner - C:\Program Files\Linksys\Wireless-B PCI Adapter\NICServ.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: X10 Device Network Service (x10nets) - Unknown owner - C:\PROGRA~1\ATIMUL~1\RemCtrl\x10nets.exe (file missing)

--
End of file - 11281 bytes
 
Hello rosey911,

A. Please RUN HijackThis
  1. Click the SCAN button to produce a log.

  2. Place a check mark beside each one of the following items:

    O2 - BHO: {63ab45cc-b587-28f9-3344-a883af211642} - {246112fa-388a-4433-9f82-785bcc54ba36} - C:\WINDOWS\system32\oatmhcmt.dll
    O2 - BHO: (no name) - {5F174EBF-59B4-4F17-9FFC-E2398BD28457} - C:\WINDOWS\system32\pmnli.dll (file missing)
    O2 - BHO: (no name) - {A95B2816-1D7E-4561-A202-68C0DE02353A} - C:\WINDOWS\system32\gslrfoyf.dll
    O3 - Toolbar: Security Toolbar - {11A69AE4-FBED-4832-A2BF-45AF82825583} - C:\WINDOWS\system32\gslrfoyf.dll
    O20 - Winlogon Notify: gslrfoyf - C:\WINDOWS\SYSTEM32\gslrfoyf.dll
    O20 - Winlogon Notify: jrfkhhva - jrfkhhva.dll (file missing)
    O20 - Winlogon Notify: khfggfc - khfggfc.dll (file missing)

  3. Now with all the items selected, and all windows closed except for HJT, delete them by clicking the FIX checked button. Close the HijackThis window.


B. 1. Please open Notepad
  • Click Start , then Run
  • Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

Code: 
File::
C:\WINDOWS\system32\rvwxugno.dll
C:\WINDOWS\system32\oatmhcmt.dll
C:\WINDOWS\system32\kyfxbonj.dll
C:\WINDOWS\system32\gslrfoyf.dll
C:\WINDOWS\system32\oidxmyqb.dll

3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

CFScript.gif



5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
  • Combofix.txt
  • A new HijackThis log.
 
ComboFix 07-11-01.1** - Owner 2007-11-06 16:12:53.7 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.180 [GMT -8:00]
Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe
Command switches used :: C:\CFScript.txt
* Created a new restore point

FILE::
C:\WINDOWS\system32\gslrfoyf.dll
C:\WINDOWS\system32\kyfxbonj.dll
C:\WINDOWS\system32\oatmhcmt.dll
C:\WINDOWS\system32\oidxmyqb.dll
C:\WINDOWS\system32\rvwxugno.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\gslrfoyf.dllbox
C:\WINDOWS\system32\oidxmyqb.dll
C:\WINDOWS\system32\rvwxugno.dll

.
((((((((((((((((((((((((( Files Created from 2007-10-07 to 2007-11-07 )))))))))))))))))))))))))))))))
.

2007-11-05 16:38 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2007-11-04 12:53 <DIR> d-------- C:\Deckard
2007-11-03 20:14 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-11-03 15:04 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2007-11-03 15:04 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-11-03 14:47 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-11-03 07:29 <DIR> d-------- C:\Program Files\Spyware Doctor
2007-11-03 07:29 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\PC Tools
2007-11-03 07:29 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2007-11-03 07:29 79,688 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
2007-11-03 07:29 62,280 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
2007-11-03 07:29 41,288 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
2007-11-03 07:29 29,000 --a------ C:\WINDOWS\system32\drivers\kcom.sys
2007-11-03 07:28 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll
2007-10-31 19:06 <DIR> d-------- C:\Program Files\Windows Defender
2007-10-31 17:51 0 --a------ C:\WINDOWS\system32\taskkill.exe
2007-10-31 17:19 <DIR> d-------- C:\Program Files\PasswordTools
2007-10-23 16:46 <DIR> d-------- C:\Program Files\Norton Security Scan
2007-10-17 13:48 <DIR> d-------- C:\Program Files\MySpace
2007-10-17 13:48 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\MySpace
2007-10-11 11:46 582,656 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-06 17:42 --------- d-----w C:\Program Files\Google
2007-11-06 03:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater
2007-11-04 01:27 --------- d-----w C:\Program Files\Trend Micro
2007-11-01 05:53 --------- d-----w C:\Program Files\motive
2007-11-01 03:00 --------- d-----w C:\Program Files\Microsoft AntiSpyware
2007-11-01 02:32 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2007-11-01 01:57 --------- d-----w C:\Documents and Settings\Owner\Application Data\Apple Computer
2007-11-01 01:12 --------- d-----w C:\Documents and Settings\Owner\Application Data\AdobeUM
2007-11-01 00:52 --------- d-----w C:\Program Files\Trial123FileConvert
2007-10-27 03:46 --------- d-----w C:\Program Files\Microsoft Games
2007-10-02 23:41 --------- d-----w C:\Program Files\Last Seconds Bidder
2007-10-02 17:00 --------- d-----w C:\Program Files\Common Files\Adobe
2007-10-01 16:42 --------- d-----w C:\Program Files\iTunes
2007-10-01 16:42 --------- d-----w C:\Program Files\iPod
2007-09-25 00:13 --------- d-----w C:\Program Files\ewido anti-malware
2007-09-25 00:13 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kodak
2007-09-24 22:31 --------- d-----w C:\Program Files\Common Files\xing shared
2007-09-24 22:31 --------- d-----w C:\Program Files\Common Files\Real
2007-09-24 21:38 --------- d-----w C:\Program Files\Kodak
2007-09-24 21:34 --------- d-----w C:\Program Files\HyperVRE
2007-09-24 21:33 --------- d-----w C:\Program Files\DivX
2007-09-24 21:31 --------- d-----w C:\Program Files\Article Distributor
2007-09-24 21:23 --------- d-----w C:\Program Files\OpenOffice.org 2.0
2007-09-24 21:21 --------- d-----w C:\Documents and Settings\Owner\Application Data\OpenOffice.org2
2007-09-24 21:05 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL
2007-09-24 20:54 --------- d-----w C:\Program Files\Pure Networks
2007-09-24 20:54 --------- d-----w C:\Program Files\Common Files\AOL
2007-09-24 20:53 --------- d-----w C:\Documents and Settings\Owner\Application Data\AOL
2007-09-20 23:57 --------- d-----w C:\Documents and Settings\All Users\Application Data\DVD Shrink
2007-09-20 23:49 --------- d-----w C:\Documents and Settings\Owner\Application Data\dvdcss
2007-09-09 22:25 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2007-09-09 22:24 --------- d-----w C:\Program Files\QuickTime
2007-09-09 22:22 --------- d-----w C:\Program Files\Common Files\Apple
2007-09-09 22:22 --------- d-----w C:\Program Files\Apple Software Update
2007-09-09 22:22 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
2007-09-01 18:23 24,192 ----a-w C:\Documents and Settings\Owner\usbsermptxp.sys
2007-09-01 18:23 22,768 ----a-w C:\Documents and Settings\Owner\usbsermpt.sys
2007-01-21 18:30 557 ----a-w C:\Program Files\INSTALL.LOG
2005-09-14 16:24 33,280 ----a-w C:\Program Files\EndProcess.exe
.

((((((((((((((((((((((((((((( snapshot@2007-11-03_21.33.28.98 )))))))))))))))))))))))))))))))))))))))))
.
- 2007-10-30 01:56:19 136,192 ----a-w C:\WINDOWS\catchme.exe
+ 2007-10-30 02:56:19 136,192 ----a-w C:\WINDOWS\catchme.exe
+ 2007-10-02 20:29:32 224,256 ----a-w C:\WINDOWS\Downloaded Program Files\GoogleGadgetPluginIEWin.dll
+ 2007-03-13 18:57:10 163,328 ----a-w C:\WINDOWS\ERDNT\subs\ERDNT.EXE
- 2007-11-03 15:30:42 52,764 ----a-w C:\WINDOWS\system32\perfc009.dat
+ 2007-11-04 14:39:16 52,764 ----a-w C:\WINDOWS\system32\perfc009.dat
- 2007-11-03 15:30:43 380,350 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2007-11-04 14:39:16 380,350 ----a-w C:\WINDOWS\system32\perfh009.dat
- 2007-04-02 21:21:27 139,776 ----a-w C:\WINDOWS\system32\swreg.exe
+ 2007-04-02 22:21:27 139,776 ----a-w C:\WINDOWS\system32\swreg.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2005-10-19 07:59]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-10-19 07:59]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 05:24]
"type32"="C:\Program Files\Microsoft IntelliType Pro\type32.exe" [2005-03-15 01:46]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\point32.exe" [2005-03-23 15:26]
"BJCFD"="C:\Program Files\BroadJump\Client Foundation\CFD.exe" [2002-09-10 21:26]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-09-24 14:31]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-09-26 13:42]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 18:51]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 18:20]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2007-11-06 09:43]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATI Launchpad"="C:\Program Files\ATI Multimedia\main\launchpd.exe" [2004-06-15 22:22]
"ATI Remote Control"="C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe" [2004-04-16 06:43]
"PopUpStopperFreeEdition"="C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe" [2005-03-17 11:10]
"RoboForm"="C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2006-06-02 20:23]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:56]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"RunNarrator"=Narrator.exe

C:\Documents and Settings\Owner\Start Menu\Programs\Startup\
Webshots.lnk - C:\Program Files\Webshots\Launcher.exe [2005-12-04 21:07:15]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Acrobat Assistant.lnk - C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [2003-10-23 20:37:56]
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-12-21 06:36:06]
Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2007-09-24 13:29:10]
Wireless-B Notebook Adapter Utility.lnk - C:\Program Files\Linksys\Wireless-B PCI Adapter\Startup.exe [2005-12-02 15:33:28]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
backup=C:\WINDOWS\pss\Kodak EasyShare software.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak software updater.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak software updater.lnk
backup=C:\WINDOWS\pss\Kodak software updater.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
backup=C:\WINDOWS\pss\WinZip Quick Pick.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^Webshots.lnk]
path=C:\Documents and Settings\Owner\Start Menu\Programs\Startup\Webshots.lnk
backup=C:\WINDOWS\pss\Webshots.lnkStartup


R3 CBTNDIS5;CBTNDIS5 NDIS Protocol Driver;\??\C:\WINDOWS\System32\CBTNDIS5.SYS
R3 odysseyIM3;Odyssey Network Services Miniport;C:\WINDOWS\system32\DRIVERS\odysseyIM3.sys
S2 Ca533av;Polaroid Digital Cam Video;C:\WINDOWS\system32\Drivers\Ca533av.sys
S3 GoogleDesktopManager-093007-112848;Google Desktop Manager 5.5.709.30344;"C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe"
S3 IPN2120;Wireless-B PCI Adapter Driver;C:\WINDOWS\system32\DRIVERS\LSIPNDS.sys
S3 USBCamera;Icatch(IV) Still Camera Device;C:\WINDOWS\system32\Drivers\Bulk533.sys

.
Contents of the 'Scheduled Tasks' folder
"2007-11-05 17:18:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
"2007-11-07 00:03:15 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
"2007-11-02 22:00:00 C:\WINDOWS\Tasks\Norton Security Scan.job"
- C:\Program Files\Norton Security Scan\Nss.exe
.
**************************************************************************

catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-06 16:19:57
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-06 16:21:56 - machine was rebooted
C:\ComboFix2.txt ... 2007-11-06 08:56
.
--- E O F ---
 
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:24:36 PM, on 11/6/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\PROGRA~1\Webshots\webshots.scr
C:\Program Files\Linksys\Wireless-B PCI Adapter\OdHost.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Linksys\Wireless-B PCI Adapter\WMP11Cfg.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKCU\..\Run: [ATI Launchpad] "C:\Program Files\ATI Multimedia\main\launchpd.exe"
O4 - HKCU\..\Run: [ATI Remote Control] C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: Wireless-B Notebook Adapter Utility.lnk = C:\Program Files\Linksys\Wireless-B PCI Adapter\Startup.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - https://my.lennar.com/inotes/iNotes6W.cab
O16 - DPF: {5D80A6D1-B500-47DA-82B8-EB9875F85B4D} (Google Gadget Control) - http://dl.google.com/dl/desktop/nv/GoogleGadgetPluginIEWin.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1133627876228
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1133627864900
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Google Desktop Manager 5.5.709.30344 (GoogleDesktopManager-093007-112848) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NICSer_WMP11 - Unknown owner - C:\Program Files\Linksys\Wireless-B PCI Adapter\NICServ.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: X10 Device Network Service (x10nets) - Unknown owner - C:\PROGRA~1\ATIMUL~1\RemCtrl\x10nets.exe (file missing)

--
End of file - 11353 bytes
 
You must log in or register to reply here.
Back
Top