in need of some help

[GNGNUT]

im having troble removing a malwear/virus and if any 1 can help it wood b great full

i have toolbar 888
i have
AVG
AD-ware 2007
XOFTSPY

I AHVE ALSO SERCHED THE WEB AND FOUND A FEW PROGRAMS AND RAN THEM BUT I WONT GET RID OF IT

ITS ALL IN A DLL FILE NAMED
WINBVJ32.DLL LOCATED IN
SYSTEM32 FOLDER

I HAVE TRYED XCLEAN_MICRO AND FOUND A FEW EXTRA WHICH HAVE NOW BEEN DLED BUT KEEP GETTING WRITEN BK ON TO REG FILES

MANY THANKS

GNGNUT

[GNGNUT]

sorry had the letters wrong way round :)

WINBJV32.DLL LOCATED IN
SYSTEM32 FOLDER


MANY THANKS

GNGNUT

[peku006]

Hi GNGNUT and welcome to icrontic Spyware & Virus Removal


Download HJTInstall.exe (http://www.trendsecure.com/portal/en-US/threat_analytics/HJTInstall.exe) to your Desktop.

Doubleclick HJTInstall.exe to install it.
By default it will install to C:\Program Files\Trend Micro\HijackThis .
Click on Install.
It will create a HijackThis icon on the desktop.
Once installed, it will launch Hijackthis.
Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
Copy/Paste the log to your next reply please.Don't use the Analyse This button, its findings are dangerous if misinterpreted.
Don't have Hijackthis fix anything yet. Most of what it finds will be harmless or even required.

[GNGNUT]

my 1st log :)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:13:50, on 28/07/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\Program Files\DynDNS Updater\DynDNS.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\system32\cidaemon.exe
C:\PROGRA~1\MICROS~2\Office12\OUTLOOK.EXE
C:\Program Files\BitComet\BitComet.exe
C:\Program Files\Shareaza\Shareaza.exe
C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.exe
C:\Program Files\Activision\Rome - Total War\RomeTW.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: ImageShack Toolbar - {6932D140-ABC4-4073-A44C-D4A541665E35} - C:\WINDOWS\ImageShackToolbar\ImageShackToolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
O16 - DPF: {6932D140-ABC4-4073-A44C-D4A541665E35} (ImageShack Toolbar) - http://toolbar.imageshack.us/toolbar/ImageShackToolbar.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{7D4FED7B-F305-43D3-939A-D38C350A00F1}: NameServer = 62.24.252.134 62.24.252.135
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: DynDNS Updater Service (DynDNS_Updater_Service) - Kana Solution - C:\Program Files\DynDNS Updater\DynDNS.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe
--
End of file - 5979 bytes

[peku006]

Hi GNGNUT

Not seeing anything Suspicious in your Logfile.

Let us take a deeper look.

Download Deckard's System Scanner (DSS) (http://www.techsupportforum.com/sectools/Deckard/dss.exe) to your Desktop.
Note: You must be logged onto an account with administrator privileges.
Close all applications and windows.
Double-click on dss.exe to run it, and follow the prompts.
When the scan is complete, two text files will open - main.txt <- this one will be maximized and extra.txt<-this one will be minimized
Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of main.txt and the extra.txt to your post. in your reply

[GNGNUT]

Deckard's System Scanner v20070711.54
Run by craig on 2007-07-28 at 18:01:34
Computer is in Normal Mode.
--------------------------------------------------------------------------------
-- System Restore --------------------------------------------------------------
Successfully created a Deckard's System Scanner Restore Point.

-- Last 5 Restore Point(s) --
35: 2007-07-28 17:01:36 UTC - RP74 - Deckard's System Scanner Restore Point
34: 2007-07-28 07:23:15 UTC - RP73 - X-Cleaner: Before removal
33: 2007-07-27 09:13:24 UTC - RP72 - System Checkpoint
32: 2007-07-26 08:56:15 UTC - RP71 - Ad-Aware Restore Point 2007-07-26 09:56:13
31: 2007-07-26 07:26:48 UTC - RP70 - Installed Ad-Aware 2007

-- First Restore Point --
1: 2007-07-09 09:23:53 UTC - RP40 - Installed Battlefield 2142 Update v1.25

Backed up registry hives.
Performed disk cleanup.

-- HijackThis (run as craig.exe) -----------------------------------------------
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:02:27, on 28/07/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\Program Files\DynDNS Updater\DynDNS.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\system32\cidaemon.exe
C:\PROGRA~1\MICROS~2\Office12\OUTLOOK.EXE
C:\Program Files\BitComet\BitComet.exe
C:\Program Files\Shareaza\Shareaza.exe
C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.exe
C:\Program Files\Activision\Rome - Total War\RomeTW.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\craig\Local Settings\Temporary Internet Files\Content.IE5\MCW0O0IT\dss[1].exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\craig.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: H - {30EDD4CB-8BC1-4f9f-99A6-A6938E9AACE0} - C:\WINDOWS\system32\down1.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.6.14.dll
O2 - BHO: (no name) - {67475B4D-150D-44A4-B5DD-BC80D4C9361F} - C:\WINDOWS\system32\urqpoli.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {A0738CDD-5B40-4396-9CB3-06134EA49A16} - C:\WINDOWS\system32\ssqrr.dll
O2 - BHO: H - {D0367266-A0E9-4644-A039-0A0CF65FD09A} - ertw1.dll (file missing)
O2 - BHO: (no name) - {FAE3BD2C-7048-46AA-BA4A-FCEAE95B6D21} - (no file)
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: ImageShack Toolbar - {6932D140-ABC4-4073-A44C-D4A541665E35} - C:\WINDOWS\ImageShackToolbar\ImageShackToolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
O16 - DPF: {6932D140-ABC4-4073-A44C-D4A541665E35} (ImageShack Toolbar) - http://toolbar.imageshack.us/toolbar/ImageShackToolbar.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{7D4FED7B-F305-43D3-939A-D38C350A00F1}: NameServer = 62.24.252.134 62.24.252.135
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O20 - Winlogon Notify: mllmk - C:\WINDOWS\
O20 - Winlogon Notify: ssqrr - C:\WINDOWS\system32\ssqrr.dll
O20 - Winlogon Notify: urqpoli - C:\WINDOWS\SYSTEM32\urqpoli.dll
O20 - Winlogon Notify: winbjv32 - C:\WINDOWS\SYSTEM32\winbjv32.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: DynDNS Updater Service (DynDNS_Updater_Service) - Kana Solution - C:\Program Files\DynDNS Updater\DynDNS.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe
--
End of file - 7501 bytes
-- File Associations -----------------------------------------------------------
All associations okay.

-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------
R1 SCDEmu - c:\windows\system32\drivers\scdemu.sys <Not Verified; PowerISO Computing, Inc.; scdemu>

-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------
R2 aawservice (Ad-Aware 2007 Service) - "c:\program files\lavasoft\ad-aware 2007\aawservice.exe" <Not Verified; Lavasoft AB; Ad-Aware 2007 Service>
R2 DynDNS_Updater_Service (DynDNS Updater Service) - c:\program files\dyndns updater\dyndns.exe <Not Verified; Kana Solution; DynDNS Updater>
S2 PnkBstrA - c:\windows\system32\pnkbstra.exe (file missing)
S3 NBService - c:\program files\nero\nero 7\nero backitup\nbservice.exe
S4 McProxy (McAfee Proxy Service) - c:\progra~1\common~1\mcafee\mcproxy\mcproxy.exe (file missing)

-- Scheduled Tasks -------------------------------------------------------------
2007-07-28 07:11:34 362 --a------ C:\WINDOWS\Tasks\XoftSpySE.job

-- Files created between 2007-06-28 and 2007-07-28 -----------------------------
2007-07-28 17:13:39 0 d-------- C:\Program Files\Trend Micro
2007-07-28 07:32:37 0 d--h----- C:\Documents and Settings\Administrator\Templates
2007-07-28 07:32:37 0 dr------- C:\Documents and Settings\Administrator\Start Menu
2007-07-28 07:32:37 0 dr-h----- C:\Documents and Settings\Administrator\SendTo
2007-07-28 07:32:37 0 d--h----- C:\Documents and Settings\Administrator\Recent
2007-07-28 07:32:37 0 d--h----- C:\Documents and Settings\Administrator\PrintHood
2007-07-28 07:32:37 786432 --ah----- C:\Documents and Settings\Administrator\NTUSER.DAT
2007-07-28 07:32:37 0 d--h----- C:\Documents and Settings\Administrator\NetHood
2007-07-28 07:32:37 0 d-------- C:\Documents and Settings\Administrator\My Documents
2007-07-28 07:32:37 0 d--h----- C:\Documents and Settings\Administrator\Local Settings
2007-07-28 07:32:37 0 d-------- C:\Documents and Settings\Administrator\Favorites
2007-07-28 07:32:37 0 d-------- C:\Documents and Settings\Administrator\Desktop
2007-07-28 07:32:37 0 d---s---- C:\Documents and Settings\Administrator\Cookies
2007-07-28 07:32:37 0 dr-h----- C:\Documents and Settings\Administrator\Application Data
2007-07-28 07:32:37 0 d---s---- C:\Documents and Settings\Administrator\Application Data\Microsoft
2007-07-28 07:09:11 0 d-------- C:\Program Files\XoftSpySE
2007-07-26 08:58:26 0 dr-h----- C:\$VAULT$.AVG
2007-07-26 08:26:50 0 d-------- C:\Program Files\Lavasoft
2007-07-26 06:54:28 1059596 ---hs---- C:\WINDOWS\system32\rrqss.bak2
2007-07-24 18:54:16 1064287 ---hs---- C:\WINDOWS\system32\rrqss.bak1
2007-07-24 18:54:00 228960 --a------ C:\WINDOWS\system32\ssqrr.dll
2007-07-24 13:10:42 77312 --a------ C:\WINDOWS\ua2.dll
2007-07-24 12:46:31 0 d-------- C:\Documents and Settings\craig\Application Data\AVG7
2007-07-24 12:46:23 0 d-------- C:\Documents and Settings\LocalService\Application Data\AVG7
2007-07-24 12:46:14 0 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2007-07-24 11:45:43 0 d-------- C:\Documents and Settings\craig\Application Data\Ahead
2007-07-24 11:42:45 0 d-------- C:\Program Files\Nero
2007-07-24 11:42:44 0 d-------- C:\Program Files\Common Files\Ahead
2007-07-24 11:42:44 0 d-------- C:\Documents and Settings\All Users\Application Data\Nero
2007-07-24 11:42:00 6471 ---hs---- C:\WINDOWS\system32\kmllm.bak1
2007-07-24 11:41:23 10752 --a------ C:\WINDOWS\system32\down1.dll
2007-07-24 11:41:13 31254 --a------ C:\WINDOWS\system32\ljjhijk.dll
2007-07-24 11:41:05 31254 --a------ C:\WINDOWS\system32\ddcawtq.dll
2007-07-24 11:38:47 1 --a------ C:\WINDOWS\system32\ps.dat
2007-07-24 11:38:47 1 --a------ C:\WINDOWS\system32\cookie.dat
2007-07-24 11:36:46 31254 --a------ C:\WINDOWS\system32\urqpoli.dll
2007-07-24 11:36:33 20992 -----n--- C:\WINDOWS\system32\winbjv32.dll
2007-07-24 09:23:07 0 d-------- C:\Program Files\Activision
2007-07-24 08:16:21 0 d-------- C:\NVIDIA
2007-07-24 08:08:36 0 d-------- C:\Program Files\SystemRequirementsLab
2007-07-23 21:53:05 0 d-------- C:\WINDOWS\system32\AGEIA
2007-07-23 21:53:05 0 d-------- C:\Program Files\AGEIA Technologies
2007-07-23 21:45:10 0 d-------- C:\Program Files\UBISOFT
2007-07-23 21:43:52 0 d-------- C:\Documents and Settings\craig\Application Data\InstallShield
2007-07-22 09:39:54 0 d-------- C:\Program Files\Engelmann Media
2007-07-17 18:15:01 0 d-------- C:\Documents and Settings\All Users\Application Data\Avg7
2007-07-17 08:58:08 0 d-------- C:\Program Files\Common Files\EasyInfo
2007-07-12 22:19:47 0 d-------- C:\WINDOWS\Sun
2007-07-11 23:09:51 0 d-------- C:\Program Files\Poker
2007-07-10 23:16:43 0 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-07-10 22:40:07 0 d-------- C:\WINDOWS\network diagnostic
2007-07-10 22:36:03 0 d-------- C:\b45b2043300abf43b93128522c
2007-07-08 08:58:40 0 d-------- C:\WINDOWS\ImageShackToolbar
2007-07-08 07:03:01 73728 --a------ C:\WINDOWS\system32\FLKill.exe <Not Verified; USPTO; Project1>
2007-07-08 07:03:01 0 d-------- C:\Program Files\Folder Lock
2007-07-06 21:03:11 0 d-------- C:\My Downloads
2007-07-06 21:01:38 0 d-------- C:\Program Files\BitTorrent Fastest Tool
2007-07-06 16:27:32 0 d-------- C:\Documents and Settings\craig\Application Data\Sun
2007-07-06 16:25:01 0 d-------- C:\Documents and Settings\craig\Application Data\Leadertech
2007-07-06 12:07:47 0 d-------- C:\Program Files\FolderSecurityGuard
2007-07-05 20:17:42 0 d-------- C:\Documents and Settings\craig\Application Data\teamspeak2
2007-07-05 20:16:40 0 d-------- C:\Program Files\Teamspeak2_RC2
2007-07-05 11:26:20 0 d-------- C:\Program Files\RealVNC
2007-07-05 11:15:31 446464 --a------ C:\WINDOWS\system32\wmvdmoe.dll <Not Verified; Microsoft Corporation; Microsoft® Windows Media Services>
2007-07-05 11:15:18 0 d-------- C:\Documents and Settings\All Users\Application Data\PY_Software
2007-07-05 11:12:53 434688 --a------ C:\WINDOWS\system32\ss2uinst.exe <Not Verified; Virtualzone.de; SetupStream 2>
2007-07-03 18:35:28 0 d-------- C:\Program Files\TalkTalk
2007-07-03 18:35:28 0 d-------- C:\Documents and Settings\All Users\Application Data\SupportSoft
2007-07-03 18:35:22 0 d-------- C:\Program Files\SupportSoft
2007-07-03 18:34:39 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-07-03 18:18:14 0 d-------- C:\Program Files\Thomson
2007-07-02 20:20:25 0 d-------- C:\WINDOWS\system32\appmgmt
2007-07-02 17:31:28 0 d-------- C:\Documents and Settings\craig\Application Data\Adobe
2007-07-02 17:31:18 0 d-------- C:\Program Files\Common Files\Adobe
2007-07-02 17:31:16 0 d-------- C:\Documents and Settings\All Users\Application Data\Adobe
2007-07-02 17:31:12 0 d-------- C:\WINDOWS\Downloaded Installations
2007-07-02 17:30:10 0 d-------- C:\Documents and Settings\All Users\Application Data\Google
2007-07-02 17:30:06 0 d-------- C:\Program Files\Google
2007-07-02 17:21:39 139264 --a------ C:\WINDOWS\system32\SGISAQry.dll <Not Verified; The Sage Group plc; Sage ISAPI Query Engine>
2007-07-02 17:21:39 335872 --a------ C:\WINDOWS\system32\SGINFMR.dll <Not Verified; The Sage Group plc; Sage Informer Manager>
2007-07-02 17:21:38 167936 --a------ C:\WINDOWS\system32\SGXMLQry.dll <Not Verified; The Sage Group plc; Sage Query Engine Component>
2007-07-02 17:21:38 81920 --a------ C:\WINDOWS\system32\SGUserInfo.dll <Not Verified; The Sage Group plc; Sage User Registration Component>
2007-07-02 17:21:38 126976 --a------ C:\WINDOWS\system32\SGInfProgressBar.dll <Not Verified; The Sage Group plc; Sage MIS Progress Bar>
2007-07-02 17:19:46 81920 --a------ C:\WINDOWS\system32\SageNatWestOnline.dll <Not Verified; The Sage Group Plc.; SageNatWestOnline Module>
2007-07-02 17:19:46 86016 --a------ C:\WINDOWS\system32\SageNatWestBankline.dll <Not Verified; The Sage Group Plc.; SageNatWestBankline Module>
2007-07-02 17:19:46 81920 --a------ C:\WINDOWS\system32\sageebanking.dll <Not Verified; The Sage Group Plc.; SageEBanking Module>
2007-07-02 17:19:46 81920 --a------ C:\WINDOWS\system32\SageBarclaysOnline.dll <Not Verified; The Sage Group Plc.; SageBarclaysOnline Module>
2007-07-02 17:19:46 81920 --a------ C:\WINDOWS\system32\SageBarclaysBusinessMasterII.dll <Not Verified; The Sage Group Plc.; SageBarclaysBusinessMasterII Module>
2007-07-02 17:19:46 192512 --a------ C:\WINDOWS\system32\SageBankReconciliation.dll <Not Verified; The Sage Group Plc.; SageBankReconciliation Module>
2007-07-02 17:19:46 86016 --a------ C:\WINDOWS\system32\SageBankPayments.dll <Not Verified; The Sage Group Plc.; SageBankPayments Module>
2007-07-02 17:19:46 69632 --a------ C:\WINDOWS\system32\SageBankBalances.dll <Not Verified; The Sage Group Plc.; SageBankBalances Module>
2007-07-02 17:19:46 61440 --a------ C:\WINDOWS\system32\BankServiceUtilities.dll <Not Verified; The Sage Group Plc.; BankServiceUtilities Module>
2007-07-02 17:19:46 0 d-------- C:\Program Files\Sage EBanking
2007-07-02 17:17:48 368696 --a------ C:\WINDOWS\system32\S10DBC32.dll <Not Verified; Sage (UK) Limited; Microsoft Open Database Connectivity>
2007-07-02 17:16:41 0 d-------- C:\Program Files\Common Files\Sage Line50
2007-07-02 17:16:25 0 d-------- C:\Program Files\Sage
2007-07-02 11:45:36 4212 ---h----- C:\WINDOWS\system32\zllictbl.dat
2007-07-02 11:45:16 0 d-------- C:\WINDOWS\system32\ZoneLabs
2007-07-02 11:44:47 0 d-------- C:\WINDOWS\Internet Logs
2007-07-02 11:23:13 0 d-------- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
2007-07-02 11:12:39 0 d-------- C:\Program Files\Windows Media Connect 2
2007-07-02 11:11:17 0 d-------- C:\WINDOWS\system32\LogFiles
2007-07-02 11:11:17 0 d-------- C:\WINDOWS\system32\drivers\UMDF
2007-07-02 09:31:58 0 d-------- C:\WINDOWS\system32\Lang
2007-07-01 19:58:37 0 d-------- C:\Documents and Settings\craig\Application Data\CyberLink
2007-07-01 19:51:29 0 d-------- C:\Documents and Settings\All Users\Application Data\CyberLink
2007-07-01 19:50:57 0 d-------- C:\Program Files\CyberLink
2007-07-01 19:34:25 0 d-------- C:\Documents and Settings\craig\Application Data\DivX
2007-07-01 19:29:03 0 d-------- C:\Program Files\DivX
2007-07-01 00:05:07 0 d-------- C:\WINDOWS\pss
2007-06-30 15:22:54 80 -r-hs---- C:\WINDOWS\system32\DAA9B96763.dll
2007-06-30 15:22:53 0 d-------- C:\Documents and Settings\All Users\Application Data\Protexis
2007-06-30 15:21:03 306688 --a------ C:\WINDOWS\IsUninst.exe <Not Verified; InstallShield Software Corporation; InstallShield® unInstaller>
2007-06-30 15:19:19 0 d-------- C:\Documents and Settings\All Users\Application Data\Broderbund
2007-06-29 20:04:01 0 d--h----- C:\WINDOWS\PIF
2007-06-29 20:00:56 0 d-------- C:\Documents and Settings\craig\Contacts
2007-06-29 20:00:25 0 d------c- C:\WINDOWS\system32\DRVSTORE
2007-06-29 20:00:16 0 d-------- C:\Program Files\MSN Messenger
2007-06-28 22:15:46 0 d-------- C:\Documents and Settings\craig\Application Data\Command & Conquer 3 Tiberium Wars Demo
2007-06-28 18:39:14 0 d-------- C:\ProgramData
2007-06-28 18:39:14 0 d-------- C:\Program Files\Electronic Arts
2007-06-28 09:38:01 0 d-------- C:\WINDOWS\system32\PreInstall
2007-06-28 08:16:09 0 d-------- C:\Documents and Settings\LocalService\Desktop
2007-06-28 08:00:55 0 d--h----- C:\WINDOWS\$hf_mig$
2007-06-28 02:20:35 0 d-------- C:\Program Files\Shareaza
2007-06-28 02:20:35 0 d-------- C:\Documents and Settings\craig\Application Data\Shareaza
2007-06-28 01:38:52 2038 --a------ C:\Documents and Settings\craig\Application Data\SAS7_000.DAT
2007-06-28 00:22:47 0 d-------- C:\Documents and Settings\craig\Application Data\McAfee
2007-06-28 00:15:32 201 --a------ C:\WINDOWS\nsreg.dat
2007-06-28 00:10:23 0 d-------- C:\Program Files\Common Files\McAfee
2007-06-28 00:10:00 0 d-------- C:\Documents and Settings\All Users\Application Data\McAfee
2007-06-28 00:08:20 0 d-------- C:\Program Files\PowerISO

-- Find3M Report ---------------------------------------------------------------
2007-07-28 00:02:49 0 d-------- C:\Program Files\DynDNS Updater
2007-07-24 09:39:21 0 d--h----- C:\Program Files\InstallShield Installation Information
2007-07-07 13:42:01 0 d-------- C:\Program Files\BitComet
2007-06-28 15:38:50 0 d-------- C:\Program Files\Messenger
2007-06-28 00:33:43 0 d-------- C:\Documents and Settings\craig\Application Data\LimeWire
2007-06-27 22:45:45 2560 --a------ C:\WINDOWS\system32\BitCometRes.dll <Not Verified; BitComet; BitComet BCTP Helper>
2007-06-27 22:43:37 0 d-------- C:\Documents and Settings\craig\Application Data\Macromedia
2007-06-27 22:27:09 0 d-------- C:\Documents and Settings\craig\Application Data\Nuance
2007-06-27 22:25:14 0 d-------- C:\Program Files\Common Files\Scansoft Shared
2007-06-27 22:25:14 0 d-------- C:\Program Files\Common Files\InstallShield
2007-06-27 22:25:05 0 d-------- C:\Program Files\Nuance
2007-06-27 22:22:06 0 d-------- C:\Program Files\DAEMON Tools
2007-06-27 22:08:54 0 d-------- C:\Program Files\Microsoft Works
2007-06-27 22:08:43 0 d-------- C:\Program Files\MSBuild
2007-06-27 22:07:51 0 d-------- C:\Program Files\Common Files\ODBC
2007-06-27 22:07:49 0 d-------- C:\Program Files\Common Files\SpeechEngines
2007-06-27 22:07:28 62 --ahs---- C:\Documents and Settings\craig\Application Data\desktop.ini
2007-06-27 22:02:47 0 d-------- C:\Documents and Settings\craig\Application Data\Kana Solution
2007-06-27 22:02:24 0 d-------- C:\Documents and Settings\craig\Application Data\WinRAR
2007-06-27 22:02:07 0 d-------- C:\Program Files\Java
2007-06-27 22:01:12 0 d-------- C:\Program Files\Common Files\Java
2007-06-27 21:40:34 0 d-------- C:\Program Files\Common Files\SupportSoft
2007-06-27 21:29:09 0 d-------- C:\Program Files\Realtek Sound Manager
2007-06-27 21:29:09 0 d-------- C:\Program Files\AvRack
2007-06-27 21:28:22 0 d-------- C:\Program Files\AMD
2007-06-27 21:24:28 502272 --a------ C:\WINDOWS\system32\winlogon.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2007-06-27 21:21:06 0 d-------- C:\Documents and Settings\craig\Application Data\Identities
2007-06-27 21:17:18 0 d-------- C:\Program Files\microsoft frontpage
2007-06-27 21:16:55 0 -rahs---- C:\MSDOS.SYS
2007-06-27 21:16:55 0 -rahs---- C:\IO.SYS
2007-06-27 21:16:55 0 --a------ C:\CONFIG.SYS
2007-06-27 21:16:55 0 --a------ C:\AUTOEXEC.BAT
2007-06-27 21:15:49 0 d--h----- C:\Program Files\WindowsUpdate
2007-06-27 21:15:10 0 d-------- C:\Program Files\Common Files\MSSoap
2007-06-27 21:15:03 0 d-------- C:\Program Files\Movie Maker
2007-06-27 21:14:20 21640 --a------ C:\WINDOWS\system32\emptyregdb.dat
2007-06-27 21:13:53 0 d-------- C:\Program Files\Online Services
2007-06-27 21:13:43 0 d-------- C:\Program Files\MSN Gaming Zone
2007-06-27 21:13:37 0 d-------- C:\Program Files\Windows NT
2007-05-31 07:44:55 823296 --a------ C:\WINDOWS\system32\divx_xx07.dll <Not Verified; DivX, Inc.; DivX®>
2007-05-31 07:44:54 802816 --a------ C:\WINDOWS\system32\divx_xx11.dll <Not Verified; DivX, Inc.; DivX?>
2007-05-31 07:44:54 823296 --a------ C:\WINDOWS\system32\divx_xx0c.dll <Not Verified; DivX, Inc.; DivX®>
2007-05-31 07:44:54 740442 --a------ C:\WINDOWS\system32\DivX.dll <Not Verified; DivX, Inc.; DivX®>

-- Registry Dump ---------------------------------------------------------------
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{30EDD4CB-8BC1-4f9f-99A6-A6938E9AACE0} C:\WINDOWS\system32\down1.dll
{39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} C:\Program Files\BitComet\tools\BitCometBHO_1.1.6.14.dll
{67475B4D-150D-44A4-B5DD-BC80D4C9361F} C:\WINDOWS\system32\urqpoli.dll
{72853161-30C5-4D22-B7F9-0BBC1D38A37E} C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
{9030D464-4C02-4ABF-8ECC-5164760863C6} C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
{A0738CDD-5B40-4396-9CB3-06134EA49A16} C:\WINDOWS\system32\ssqrr.dll
{D0367266-A0E9-4644-A039-0A0CF65FD09A} ertw1.dll [x]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
"nwiz"="nwiz.exe /install"
"SpeedTouch USB Diagnostics"="\"C:\\Program Files\\Thomson\\SpeedTouch USB\\Dragdiag.exe\" /icon"
"Zone Labs Client"="\"C:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe\""
"NvMediaCenter"="RunDLL32.exe NvMCTray.dll,NvTaskbarInit"
"AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVG7\\avgcc.exe /STARTUP"
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
"MsnMsgr"="\"C:\\Program Files\\MSN Messenger\\MsnMsgr.Exe\" /background"
[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecu tehooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"="Groove GFS Stub Execution Hook"
"{67475B4D-150D-44A4-B5DD-BC80D4C9361F}"=""
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\mllmk
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ssqrr
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\urqpoli
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winbjv32
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
Authentication Packages REG_MULTI_SZ msv1_0\0\0
Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0
Notification Packages REG_MULTI_SZ scecli\0\0
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\aawservice
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^craig^Start Menu^Programs^Startup^Microsoft Office Groove.lnk]
"path"="C:\\Documents and Settings\\craig\\Start Menu\\Programs\\Startup\\Microsoft Office Groove.lnk"
"backup"="C:\\WINDOWS\\pss\\Microsoft Office Groove.lnkStartup"
"location"="Startup"
"command"="C:\\PROGRA~1\\MICROS~2\\Office12\\GROOVE.EXE -background"
"item"="Microsoft Office Groove"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="apdproxy"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Adobe\\Photoshop Album Starter Edition\\3.2\\Apps\\apdproxy.exe\""
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Reader_sl"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Adobe\\Reader 8.0\\Reader\\Reader_sl.exe\""
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DNS7reminder]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ereg"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Nuance\\NaturallySpeaking9\\Program\\ereg.exe\" -r \"C:\\Program Files\\Nuance\\NaturallySpeaking9\\Program\\ereg.ini\""
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EA Core]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Core"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\Electronic Arts\\EA Link\\Core.exe\" -silent"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="GrooveMonitor"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Microsoft Office\\Office12\\GrooveMonitor.exe\""
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ISUSPM"
"hkey"="HKLM"
"command"="C:\\PROGRA~1\\COMMON~1\\INSTAL~1\\UPDATE~1\\ISUSPM.exe -startup"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="issch"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Common Files\\InstallShield\\UpdateService\\issch.exe\" -start"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NeroCheck"
"hkey"="HKLM"
"command"="C:\\Program Files\\Common Files\\Ahead\\Lib\\NeroCheck.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="PWRISOVM"
"hkey"="HKLM"
"command"="C:\\Program Files\\PowerISO\\PWRISOVM.EXE"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="PDVDServ"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\CyberLink\\PowerDVD\\PDVDServ.exe\""
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Shareaza]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Shareaza"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\Shareaza\\Shareaza.exe\" -tray"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SiteAdvisor]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="SiteAdv"
"hkey"="HKLM"
"command"="C:\\Program Files\\SiteAdvisor\\6066\\SiteAdv.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="SOUNDMAN"
"hkey"="HKLM"
"command"="SOUNDMAN.EXE"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="SSBkgdupdate"
"hkey"="HKLM"
"command"="C:\\Program Files\\Common Files\\Scansoft Shared\\SSBkgdUpdate\\SSBkgdupdate.exe -Embedding -boot"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="jusched"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Java\\jre1.6.0_01\\bin\\jusched.exe\""
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TalkTalk]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="sprtcmd"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\TalkTalk\\bin\\sprtcmd.exe\" /P TalkTalk"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\winbo32]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="winbo32"
"hkey"="HKLM"
"command"="winbo32.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zone Labs Client]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="zlclient"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe\""
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"McProxy"=dword:00000002

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0
WudfServiceGroup REG_MULTI_SZ WUDFSvc\0\0

-- End of Deckard's System Scanner: finished at 2007-07-28 at 18:03:38 ---------

many thanks for ur help :):)

[peku006]

Hi GNGNUT

Please do the following...

Step 1

Please download VundoFix.exe (http://www.atribune.org/ccount/click.php?id=4) to your desktop.

Double-click VundoFix.exe to run it.
Click the Scan for Vundo button.
Once it's done scanning, click the Remove Vundo button.
You will receive a prompt asking if you want to remove the files, click YES
Once you click yes, your desktop will go blank as it starts removing Vundo.
When completed, it will prompt that it will reboot your computer, click OK.
Please post the contents of C:\vundofix.txtNote: It is possible that VundoFix encountered a file it could not remove.
In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button." when VundoFix appears at reboot.

Step 2

1. Download combofix from one of these links:
Link1 (http://download.bleepingcomputer.com/sUBs/ComboFix.exe)
Link2 (http://www.techsupportforum.com/sectools/sUBs/ComboFix.exe)
2. Double click combofix.exe & follow the prompts.
3. When finished, it shall produce a log for you. Post that log in your next reply
Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Please, post these logs:
Vundofix.txt
Combofix.txt
a fresh hjT log

[GNGNUT]

here is the log for combo fix

"craig" - 2007-07-29 10:59:09 - ComboFix 07-07-23.6 - Service Pack 2 NTFS

(((((((((((((((((((((((((((((((((((((((((((( V Log )))))))))))))))))))))))))))))))))))))))))))))))))))))))

C:\WINDOWS\system32\ddcawtq.dll
C:\WINDOWS\system32\ljjhijk.dll
C:\WINDOWS\system32\ddcawtq.dll
C:\WINDOWS\system32\ljjhijk.dll
C:\WINDOWS\system32\winbjv32.dll
C:\WINDOWS\system32\efhkj.bak1
C:\WINDOWS\system32\efhkj.ini
C:\WINDOWS\system32\jkhfe.dll
C:\WINDOWS\system32\urqpoli.dll
C:\WINDOWS\system32\urqpoli.dll

* * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\WINDOWS\system32\cookie.dat

((((((((((((((((((((((((( Files Created from 2007-06-28 to 2007-07-29 )))))))))))))))))))))))))))))))

2007-07-29 09:05 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-07-29 08:57 <DIR> d-------- C:\VundoFix Backups
2007-07-28 23:49 <DIR> d-------- C:\Program Files\Nero
2007-07-28 23:49 <DIR> d-------- C:\Program Files\Common Files\Ahead
2007-07-28 23:49 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Nero
2007-07-28 18:01 <DIR> d-------- C:\Deckard
2007-07-28 17:13 <DIR> d-------- C:\Program Files\Trend Micro
2007-07-28 07:32 786,432 --ah----- C:\DOCUME~1\ADMINI~1\NTUSER.DAT
2007-07-28 07:09 <DIR> d-------- C:\Program Files\XoftSpySE
2007-07-26 08:26 <DIR> d-------- C:\Program Files\Lavasoft
2007-07-24 13:10 77,312 --a------ C:\WINDOWS\ua2.dll
2007-07-24 11:45 <DIR> d-------- C:\DOCUME~1\craig\APPLIC~1\Ahead
2007-07-24 11:42 6,471 --ahs---- C:\WINDOWS\system32\kmllm.bak1
2007-07-24 11:41 10,752 --a------ C:\WINDOWS\system32\down1.dll
2007-07-24 11:38 1 --a------ C:\WINDOWS\system32\ps.dat
2007-07-24 09:23 <DIR> d-------- C:\Program Files\Activision
2007-07-24 08:26 9,728 -ra------ C:\WINDOWS\system32\bdco1.dll
2007-07-24 08:26 33,536 -ra------ C:\WINDOWS\system32\drivers\NVENETFD.sys
2007-07-24 08:26 32,256 -ra------ C:\WINDOWS\system32\nvconrm.dll
2007-07-24 08:26 261,888 -ra------ C:\WINDOWS\system32\drivers\nvnrm.sys
2007-07-24 08:26 208,256 -ra------ C:\WINDOWS\system32\drivers\nvsnpu.sys
2007-07-24 08:26 201,728 -ra------ C:\WINDOWS\system32\fdco1.dll
2007-07-24 08:26 176,128 --a------ C:\WINDOWS\system32\nvunrm.exe
2007-07-24 08:26 12,928 -ra------ C:\WINDOWS\system32\drivers\nvnetbus.sys
2007-07-24 08:16 <DIR> d-------- C:\NVIDIA
2007-07-24 08:08 <DIR> d-------- C:\Program Files\SystemRequirementsLab
2007-07-23 21:53 <DIR> d-------- C:\WINDOWS\system32\AGEIA
2007-07-23 21:53 <DIR> d-------- C:\Program Files\AGEIA Technologies
2007-07-23 21:45 <DIR> d-------- C:\Program Files\UBISOFT
2007-07-23 21:43 <DIR> d-------- C:\DOCUME~1\craig\APPLIC~1\InstallShield
2007-07-22 09:39 <DIR> d-------- C:\Program Files\Engelmann Media
2007-07-17 08:58 <DIR> d-------- C:\Program Files\Common Files\EasyInfo
2007-07-11 23:09 <DIR> d-------- C:\Program Files\Poker
2007-07-10 23:16 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-07-10 22:40 <DIR> d-------- C:\WINDOWS\network diagnostic
2007-07-10 22:36 <DIR> d-------- C:\b45b2043300abf43b93128522c
2007-07-09 09:54 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys
2007-07-09 09:54 103,736 --a------ C:\WINDOWS\system32\PnkBstrB.exe
2007-07-08 08:58 <DIR> d-------- C:\WINDOWS\ImageShackToolbar
2007-07-08 07:03 73,728 --a------ C:\WINDOWS\system32\FLKill.exe
2007-07-08 07:03 <DIR> d-------- C:\Program Files\Folder Lock
2007-07-06 21:03 <DIR> d-------- C:\My Downloads
2007-07-06 21:01 <DIR> d-------- C:\Program Files\BitTorrent Fastest Tool
2007-07-06 16:25 <DIR> d-------- C:\DOCUME~1\craig\APPLIC~1\Leadertech
2007-07-06 12:07 <DIR> d-------- C:\Program Files\FolderSecurityGuard
2007-07-05 20:17 <DIR> d-------- C:\DOCUME~1\craig\APPLIC~1\teamspeak2
2007-07-05 20:16 <DIR> d-------- C:\Program Files\Teamspeak2_RC2
2007-07-05 16:51 85,376 --a------ C:\WINDOWS\system32\drivers\NABTSFEC.sys
2007-07-05 16:51 5,504 --a------ C:\WINDOWS\system32\drivers\MSTEE.sys
2007-07-05 16:51 19,328 --a------ C:\WINDOWS\system32\drivers\WSTCODEC.SYS
2007-07-05 16:51 17,024 --a------ C:\WINDOWS\system32\drivers\CCDECODE.sys
2007-07-05 16:51 15,360 --a------ C:\WINDOWS\system32\drivers\StreamIP.sys
2007-07-05 16:51 11,136 --a------ C:\WINDOWS\system32\drivers\SLIP.sys
2007-07-05 16:51 10,880 --a------ C:\WINDOWS\system32\drivers\NdisIP.sys
2007-07-05 16:50 78,464 --a------ C:\WINDOWS\system32\drivers\usbvideo.sys
2007-07-05 16:50 53,760 --a------ C:\WINDOWS\system32\vfwwdm32.dll
2007-07-05 16:50 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll
2007-07-05 16:50 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll
2007-07-05 16:50 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2007-07-05 11:26 <DIR> d-------- C:\Program Files\RealVNC
2007-07-05 11:15 446,464 --a------ C:\WINDOWS\system32\wmvdmoe.dll
2007-07-05 11:15 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\PY_Software
2007-07-05 11:12 434,688 --a------ C:\WINDOWS\system32\ss2uinst.exe
2007-07-03 18:35 <DIR> d-------- C:\Program Files\TalkTalk
2007-07-03 18:35 <DIR> d-------- C:\Program Files\SupportSoft
2007-07-03 18:35 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\SupportSoft
2007-07-03 18:34 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-07-03 18:18 <DIR> d-------- C:\Program Files\Thomson
2007-07-02 20:20 <DIR> d-------- C:\WINDOWS\system32\appmgmt
2007-07-02 17:31 <DIR> d-------- C:\WINDOWS\Downloaded Installations
2007-07-02 17:30 <DIR> d-------- C:\Program Files\Google
2007-07-02 17:30 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
2007-07-02 17:21 81,920 --a------ C:\WINDOWS\system32\SGUserInfo.dll
2007-07-02 17:21 37,224 --a------ C:\WINDOWS\system32\SageStorage.dll
2007-07-02 17:21 335,872 --a------ C:\WINDOWS\system32\SGINFMR.dll
2007-07-02 17:21 167,936 --a------ C:\WINDOWS\system32\SGXMLQry.dll
2007-07-02 17:21 139,264 --a------ C:\WINDOWS\system32\SGISAQry.dll
2007-07-02 17:21 127,352 --a------ C:\WINDOWS\system32\SageSoftwareUpdate.dll
2007-07-02 17:21 126,976 --a------ C:\WINDOWS\system32\SGInfProgressBar.dll
2007-07-02 17:21 119,160 --a------ C:\WINDOWS\system32\SageFolderBrowse.dll
2007-07-02 17:19 86,016 --a------ C:\WINDOWS\system32\SageNatWestBankline.dll
2007-07-02 17:19 86,016 --a------ C:\WINDOWS\system32\SageBankPayments.dll
2007-07-02 17:19 81,920 --a------ C:\WINDOWS\system32\SageNatWestOnline.dll
2007-07-02 17:19 81,920 --a------ C:\WINDOWS\system32\sageebanking.dll
2007-07-02 17:19 81,920 --a------ C:\WINDOWS\system32\SageBarclaysOnline.dll
2007-07-02 17:19 81,920 --a------ C:\WINDOWS\system32\SageBarclaysBusinessMasterII.dll
2007-07-02 17:19 69,632 --a------ C:\WINDOWS\system32\SageBankBalances.dll
2007-07-02 17:19 61,440 --a------ C:\WINDOWS\system32\BankServiceUtilities.dll
2007-07-02 17:19 192,512 --a------ C:\WINDOWS\system32\SageBankReconciliation.dll
2007-07-02 17:19 <DIR> d-------- C:\Program Files\Sage EBanking
2007-07-02 17:17 368,696 --a------ C:\WINDOWS\system32\S10DBC32.dll
2007-07-02 17:17 322,832 --a------ C:\WINDOWS\system32\MFC30.DLL
2007-07-02 17:16 <DIR> d-------- C:\Program Files\Sage
2007-07-02 17:16 <DIR> d-------- C:\Program Files\Common Files\Sage Line50
2007-07-02 11:45 4,212 --ah----- C:\WINDOWS\system32\zllictbl.dat
2007-07-02 11:45 <DIR> d-------- C:\WINDOWS\system32\ZoneLabs
2007-07-02 11:44 <DIR> d-------- C:\WINDOWS\Internet Logs
2007-07-02 11:23 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
2007-07-02 11:12 <DIR> d-------- C:\Program Files\Windows Media Connect 2
2007-07-02 11:11 <DIR> d-------- C:\WINDOWS\system32\LogFiles

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
2007-07-29 07:53:30 -------- d-----w C:\Program Files\BitComet
2007-07-28 23:02:51 -------- d-----w C:\Program Files\DynDNS Updater
2007-07-24 08:40:37 11,973 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-07-24 08:39:21 -------- d--h--w C:\Program Files\InstallShield Installation Information
2007-07-06 17:25:14 -------- d-----w C:\Program Files\Common Files\McAfee
2007-07-06 11:48:10 2,038 ----a-w C:\DOCUME~1\craig\APPLIC~1\SAS7_000.DAT
2007-07-05 19:44:00 -------- d-----w C:\Program Files\Electronic Arts
2007-06-30 00:19:28 359,808 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2007-06-28 21:18:40 -------- d-----w C:\DOCUME~1\craig\APPLIC~1\Command & Conquer 3 Tiberium Wars Demo
2007-06-28 14:38:50 -------- d-----w C:\Program Files\Messenger
2007-06-28 01:20:38 -------- d-----w C:\Program Files\Shareaza
2007-06-28 01:20:35 -------- d-----w C:\DOCUME~1\craig\APPLIC~1\Shareaza
2007-06-27 23:33:43 -------- d-----w C:\DOCUME~1\craig\APPLIC~1\LimeWire
2007-06-27 23:22:47 -------- d-----w C:\DOCUME~1\craig\APPLIC~1\McAfee
2007-06-27 23:15:32 201 ----a-w C:\WINDOWS\nsreg.dat
2007-06-27 23:08:20 -------- d-----w C:\Program Files\PowerISO
2007-06-27 21:45:45 2,560 ----a-w C:\WINDOWS\system32\BitCometRes.dll
2007-06-27 21:27:09 -------- d-----w C:\DOCUME~1\craig\APPLIC~1\Nuance
2007-06-27 21:25:14 -------- d-----w C:\Program Files\Common Files\Scansoft Shared
2007-06-27 21:25:14 -------- d-----w C:\Program Files\Common Files\InstallShield
2007-06-27 21:25:05 -------- d-----w C:\Program Files\Nuance
2007-06-27 21:22:06 -------- d-----w C:\Program Files\DAEMON Tools
2007-06-27 21:09:37 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll
2007-06-27 21:09:37 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll
2007-06-27 21:08:54 -------- d-----w C:\Program Files\Microsoft Works
2007-06-27 21:08:43 -------- d-----w C:\Program Files\MSBuild
2007-06-27 21:08:39 682,232 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2007-06-27 21:07:51 -------- d-----w C:\Program Files\Common Files\ODBC
2007-06-27 21:07:49 -------- d-----w C:\Program Files\Common Files\SpeechEngines
2007-06-27 21:02:47 -------- d-----w C:\DOCUME~1\craig\APPLIC~1\Kana Solution
2007-06-27 21:02:24 -------- d-----w C:\DOCUME~1\craig\APPLIC~1\WinRAR
2007-06-27 20:40:34 -------- d-----w C:\Program Files\Common Files\SupportSoft
2007-06-27 20:29:09 -------- d-----w C:\Program Files\Realtek Sound Manager
2007-06-27 20:29:09 -------- d-----w C:\Program Files\AvRack
2007-06-27 20:28:22 -------- d-----w C:\Program Files\AMD
2007-06-27 20:24:28 502,272 ----a-w C:\WINDOWS\system32\winlogon.exe
2007-06-27 20:17:18 -------- d-----w C:\Program Files\microsoft frontpage
2007-06-27 20:16:55 0 --sha-r C:\MSDOS.SYS
2007-06-27 20:16:55 0 --sha-r C:\IO.SYS
2007-06-27 20:16:55 0 ----a-w C:\CONFIG.SYS
2007-06-27 20:16:55 0 ----a-w C:\AUTOEXEC.BAT
2007-06-27 20:15:49 -------- d--h--w C:\Program Files\WindowsUpdate
2007-06-27 20:15:10 -------- d-----w C:\Program Files\Common Files\MSSoap
2007-06-27 20:15:03 -------- d-----w C:\Program Files\Movie Maker
2007-06-27 20:14:20 21,640 ----a-w C:\WINDOWS\system32\emptyregdb.dat
2007-06-27 20:13:53 -------- d-----w C:\Program Files\Online Services
2007-06-27 20:13:43 -------- d-----w C:\Program Files\MSN Gaming Zone
2007-06-27 20:13:37 -------- d-----w C:\Program Files\Windows NT
2007-06-04 14:18:48 9,344 ----a-w C:\WINDOWS\system32\drivers\NSDriver.sys
2007-06-04 14:17:02 8,320 ----a-w C:\WINDOWS\system32\drivers\AWRTRD.sys
2007-06-04 14:14:56 6,272 ----a-w C:\WINDOWS\system32\drivers\AWRTPD.sys
2007-05-31 06:45:07 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2007-05-31 06:44:55 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2007-05-31 06:44:54 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2007-05-31 06:44:54 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2007-05-31 06:44:54 740,442 ----a-w C:\WINDOWS\system32\DivX.dll
2007-05-16 15:12:02 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
2007-05-15 18:06:58 71,208 ----a-w C:\WINDOWS\system32\PhysXLoader.dll

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30EDD4CB-8BC1-4f9f-99A6-A6938E9AACE0}]
2007-07-24 11:41 10752 --a------ C:\WINDOWS\system32\down1.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A0738CDD-5B40-4396-9CB3-06134EA49A16}]
C:\WINDOWS\system32\ssqrr.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D0367266-A0E9-4644-A039-0A0CF65FD09A}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FAE3BD2C-7048-46AA-BA4A-FCEAE95B6D21}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nwiz"="nwiz.exe" [2007-04-19 13:26 C:\WINDOWS\system32\nwiz.exe]
"SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 11:38]
"Zone Labs Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2006-08-23 23:38]
"NvMediaCenter"="NvMCTray.dll" [2007-04-19 13:26 C:\WINDOWS\system32\nvmctray.dll]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-07-24 12:46]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-09 18:53]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-04-19 13:26]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 13:00]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-03-12 13:49]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\mllmk]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\aawservice]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^craig^Start Menu^Programs^Startup^Microsoft Office Groove.lnk]
path=C:\Documents and Settings\craig\Start Menu\Programs\Startup\Microsoft Office Groove.lnk
backup=C:\WINDOWS\pss\Microsoft Office Groove.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
"C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
"C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DNS7reminder]
"C:\Program Files\Nuance\NaturallySpeaking9\Program\ereg.exe" -r "C:\Program Files\Nuance\NaturallySpeaking9\Program\ereg.ini"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EA Core]
"C:\Program Files\Electronic Arts\EA Link\Core.exe" -silent
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
"C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
"C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
C:\Program Files\PowerISO\PWRISOVM.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
"C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Shareaza]
"C:\Program Files\Shareaza\Shareaza.exe" -tray
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SiteAdvisor]
C:\Program Files\SiteAdvisor\6066\SiteAdv.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
SOUNDMAN.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate]
C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe -Embedding -boot
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TalkTalk]
"C:\Program Files\TalkTalk\bin\sprtcmd.exe" /P TalkTalk
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\winbo32]
winbo32.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zone Labs Client]
"C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"McProxy"=2 (0x2)
R0 srescan;srescan;C:\WINDOWS\system32\ZoneLabs\srescan.sys
R1 AmdK8;AMD Processor Driver;C:\WINDOWS\system32\DRIVERS\AmdK8.sys
R1 SCDEmu;SCDEmu;C:\WINDOWS\system32\drivers\SCDEmu.sys
R2 DynDNS_Updater_Service;DynDNS Updater Service;C:\Program Files\DynDNS Updater\DynDNS.exe
R3 alcan5wn;SpeedTouch USB ADSL PPP Networking Driver (NDISWAN);C:\WINDOWS\system32\DRIVERS\alcan5wn.sys
R3 alcaudsl;SpeedTouch ADSL Modem ATM Transport;C:\WINDOWS\system32\DRIVERS\alcaudsl.sys
R3 irsir;Microsoft Serial Infrared Driver;C:\WINDOWS\system32\DRIVERS\irsir.sys
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service;"C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe"
S3 odserv;Microsoft Office Diagnostics Service;"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE"
S3 usbvideo;USB Video Device (WDM);C:\WINDOWS\system32\Drivers\usbvideo.sys

Contents of the 'Scheduled Tasks' folder
2007-07-29 07:53:13 C:\WINDOWS\tasks\XoftSpySE.job
**************************************************************************
catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-29 11:02:59
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden registry entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
Completion time: 2007-07-29 11:04:38 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-07-29 11:04
--- E O F ---

and the vundo found nothing

new high jack log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:07:24, on 29/07/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\Program Files\DynDNS Updater\DynDNS.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: H - {30EDD4CB-8BC1-4f9f-99A6-A6938E9AACE0} - C:\WINDOWS\system32\down1.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.6.14.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {A0738CDD-5B40-4396-9CB3-06134EA49A16} - C:\WINDOWS\system32\ssqrr.dll (file missing)
O2 - BHO: H - {D0367266-A0E9-4644-A039-0A0CF65FD09A} - ertw1.dll (file missing)
O2 - BHO: (no name) - {FAE3BD2C-7048-46AA-BA4A-FCEAE95B6D21} - (no file)
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: ImageShack Toolbar - {6932D140-ABC4-4073-A44C-D4A541665E35} - C:\WINDOWS\ImageShackToolbar\ImageShackToolbar.dll
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
O16 - DPF: {6932D140-ABC4-4073-A44C-D4A541665E35} (ImageShack Toolbar) - http://toolbar.imageshack.us/toolbar/ImageShackToolbar.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{7D4FED7B-F305-43D3-939A-D38C350A00F1}: NameServer = 62.24.252.135 62.24.252.134
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O20 - Winlogon Notify: mllmk - C:\WINDOWS\
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: DynDNS Updater Service (DynDNS_Updater_Service) - Kana Solution - C:\Program Files\DynDNS Updater\DynDNS.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe
--
End of file - 7282 bytes

[peku006]

Hi GNGNUT
how is your system running now?

Please do the following...

Step 1
Run HijackThis
Click on the Scan button
Put a check beside all of the items listed below (if present):

O2 - BHO: H - {30EDD4CB-8BC1-4f9f-99A6-A6938E9AACE0} - C:\WINDOWS\system32\down1.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {A0738CDD-5B40-4396-9CB3-06134EA49A16} - C:\WINDOWS\system32\ssqrr.dll (file missing)
O2 - BHO: H - {D0367266-A0E9-4644-A039-0A0CF65FD09A} - ertw1.dll (file missing)
O2 - BHO: (no name) - {FAE3BD2C-7048-46AA-BA4A-FCEAE95B6D21} - (no file)
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O20 - Winlogon Notify: mllmk - C:\WINDOWS\
Close all open windows and browsers/email, etc...
Click on the "Fix Checked" button
When completed, close the application.Step 2
Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\WINDOWS\system32\down1.dll
C:\WINDOWS\system32\ssqrr.dll
C:\WINDOWS\system32\kmllm.bak1

Folder::
C:\b45b2043300abf43b93128522c

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\mllmk]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\winbo32]
Save this as "CFScript"

http://img.photobucket.com/albums/v666/sUBs/CFScript.gif

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThislog.

[GNGNUT]

ok my system is still running fine i dont seem to get overwelmed with pop up now i still get 1 - 2 every now and then but befor i was getting every time i open ie and going to differnt sites

here is fresh combo log

"craig" - 2007-07-29 18:31:06 - ComboFix 07-07-23.6 - Service Pack 2 NTFS

((((((((((((((((((((((((( Files Created from 2007-06-28 to 2007-07-29 )))))))))))))))))))))))))))))))

2007-07-29 11:09 <DIR> d-------- C:\Program Files\MSXML 4.0
2007-07-29 09:05 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-07-29 08:57 <DIR> d-------- C:\VundoFix Backups
2007-07-28 23:49 <DIR> d-------- C:\Program Files\Nero
2007-07-28 23:49 <DIR> d-------- C:\Program Files\Common Files\Ahead
2007-07-28 23:49 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Nero
2007-07-28 18:01 <DIR> d-------- C:\Deckard
2007-07-28 17:13 <DIR> d-------- C:\Program Files\Trend Micro
2007-07-28 07:32 786,432 --ah----- C:\DOCUME~1\ADMINI~1\NTUSER.DAT
2007-07-28 07:09 <DIR> d-------- C:\Program Files\XoftSpySE
2007-07-26 08:26 <DIR> d-------- C:\Program Files\Lavasoft
2007-07-24 13:10 77,312 --a------ C:\WINDOWS\ua2.dll
2007-07-24 11:45 <DIR> d-------- C:\DOCUME~1\craig\APPLIC~1\Ahead
2007-07-24 11:42 6,471 --ahs---- C:\WINDOWS\system32\kmllm.bak1
2007-07-24 11:38 1 --a------ C:\WINDOWS\system32\ps.dat
2007-07-24 09:23 <DIR> d-------- C:\Program Files\Activision
2007-07-24 08:26 9,728 -ra------ C:\WINDOWS\system32\bdco1.dll
2007-07-24 08:26 33,536 -ra------ C:\WINDOWS\system32\drivers\NVENETFD.sys
2007-07-24 08:26 32,256 -ra------ C:\WINDOWS\system32\nvconrm.dll
2007-07-24 08:26 261,888 -ra------ C:\WINDOWS\system32\drivers\nvnrm.sys
2007-07-24 08:26 208,256 -ra------ C:\WINDOWS\system32\drivers\nvsnpu.sys
2007-07-24 08:26 201,728 -ra------ C:\WINDOWS\system32\fdco1.dll
2007-07-24 08:26 176,128 --a------ C:\WINDOWS\system32\nvunrm.exe
2007-07-24 08:26 12,928 -ra------ C:\WINDOWS\system32\drivers\nvnetbus.sys
2007-07-24 08:16 <DIR> d-------- C:\NVIDIA
2007-07-24 08:08 <DIR> d-------- C:\Program Files\SystemRequirementsLab
2007-07-23 21:53 <DIR> d-------- C:\WINDOWS\system32\AGEIA
2007-07-23 21:53 <DIR> d-------- C:\Program Files\AGEIA Technologies
2007-07-23 21:45 <DIR> d-------- C:\Program Files\UBISOFT
2007-07-23 21:43 <DIR> d-------- C:\DOCUME~1\craig\APPLIC~1\InstallShield
2007-07-22 09:39 <DIR> d-------- C:\Program Files\Engelmann Media
2007-07-17 08:58 <DIR> d-------- C:\Program Files\Common Files\EasyInfo
2007-07-11 23:09 <DIR> d-------- C:\Program Files\Poker
2007-07-10 23:16 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-07-10 22:40 <DIR> d-------- C:\WINDOWS\network diagnostic
2007-07-10 22:36 <DIR> d-------- C:\b45b2043300abf43b93128522c
2007-07-09 09:54 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys
2007-07-09 09:54 103,736 --a------ C:\WINDOWS\system32\PnkBstrB.exe
2007-07-08 08:58 <DIR> d-------- C:\WINDOWS\ImageShackToolbar
2007-07-08 07:03 73,728 --a------ C:\WINDOWS\system32\FLKill.exe
2007-07-08 07:03 <DIR> d-------- C:\Program Files\Folder Lock
2007-07-06 21:03 <DIR> d-------- C:\My Downloads
2007-07-06 21:01 <DIR> d-------- C:\Program Files\BitTorrent Fastest Tool
2007-07-06 16:25 <DIR> d-------- C:\DOCUME~1\craig\APPLIC~1\Leadertech
2007-07-06 12:07 <DIR> d-------- C:\Program Files\FolderSecurityGuard
2007-07-05 20:17 <DIR> d-------- C:\DOCUME~1\craig\APPLIC~1\teamspeak2
2007-07-05 20:16 <DIR> d-------- C:\Program Files\Teamspeak2_RC2
2007-07-05 16:51 85,376 --a------ C:\WINDOWS\system32\drivers\NABTSFEC.sys
2007-07-05 16:51 5,504 --a------ C:\WINDOWS\system32\drivers\MSTEE.sys
2007-07-05 16:51 19,328 --a------ C:\WINDOWS\system32\drivers\WSTCODEC.SYS
2007-07-05 16:51 17,024 --a------ C:\WINDOWS\system32\drivers\CCDECODE.sys
2007-07-05 16:51 15,360 --a------ C:\WINDOWS\system32\drivers\StreamIP.sys
2007-07-05 16:51 11,136 --a------ C:\WINDOWS\system32\drivers\SLIP.sys
2007-07-05 16:51 10,880 --a------ C:\WINDOWS\system32\drivers\NdisIP.sys
2007-07-05 16:50 78,464 --a------ C:\WINDOWS\system32\drivers\usbvideo.sys
2007-07-05 16:50 53,760 --a------ C:\WINDOWS\system32\vfwwdm32.dll
2007-07-05 16:50 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll
2007-07-05 16:50 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll
2007-07-05 16:50 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2007-07-05 11:26 <DIR> d-------- C:\Program Files\RealVNC
2007-07-05 11:15 446,464 --a------ C:\WINDOWS\system32\wmvdmoe.dll
2007-07-05 11:15 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\PY_Software
2007-07-05 11:12 434,688 --a------ C:\WINDOWS\system32\ss2uinst.exe
2007-07-03 18:35 <DIR> d-------- C:\Program Files\TalkTalk
2007-07-03 18:35 <DIR> d-------- C:\Program Files\SupportSoft
2007-07-03 18:35 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\SupportSoft
2007-07-03 18:34 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-07-03 18:18 <DIR> d-------- C:\Program Files\Thomson
2007-07-02 20:20 <DIR> d-------- C:\WINDOWS\system32\appmgmt
2007-07-02 17:31 <DIR> d-------- C:\WINDOWS\Downloaded Installations
2007-07-02 17:30 <DIR> d-------- C:\Program Files\Google
2007-07-02 17:30 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
2007-07-02 17:21 81,920 --a------ C:\WINDOWS\system32\SGUserInfo.dll
2007-07-02 17:21 37,224 --a------ C:\WINDOWS\system32\SageStorage.dll
2007-07-02 17:21 335,872 --a------ C:\WINDOWS\system32\SGINFMR.dll
2007-07-02 17:21 167,936 --a------ C:\WINDOWS\system32\SGXMLQry.dll
2007-07-02 17:21 139,264 --a------ C:\WINDOWS\system32\SGISAQry.dll
2007-07-02 17:21 127,352 --a------ C:\WINDOWS\system32\SageSoftwareUpdate.dll
2007-07-02 17:21 126,976 --a------ C:\WINDOWS\system32\SGInfProgressBar.dll
2007-07-02 17:21 119,160 --a------ C:\WINDOWS\system32\SageFolderBrowse.dll
2007-07-02 17:19 86,016 --a------ C:\WINDOWS\system32\SageNatWestBankline.dll
2007-07-02 17:19 86,016 --a------ C:\WINDOWS\system32\SageBankPayments.dll
2007-07-02 17:19 81,920 --a------ C:\WINDOWS\system32\SageNatWestOnline.dll
2007-07-02 17:19 81,920 --a------ C:\WINDOWS\system32\sageebanking.dll
2007-07-02 17:19 81,920 --a------ C:\WINDOWS\system32\SageBarclaysOnline.dll
2007-07-02 17:19 81,920 --a------ C:\WINDOWS\system32\SageBarclaysBusinessMasterII.dll
2007-07-02 17:19 69,632 --a------ C:\WINDOWS\system32\SageBankBalances.dll
2007-07-02 17:19 61,440 --a------ C:\WINDOWS\system32\BankServiceUtilities.dll
2007-07-02 17:19 192,512 --a------ C:\WINDOWS\system32\SageBankReconciliation.dll
2007-07-02 17:19 <DIR> d-------- C:\Program Files\Sage EBanking
2007-07-02 17:17 368,696 --a------ C:\WINDOWS\system32\S10DBC32.dll
2007-07-02 17:17 322,832 --a------ C:\WINDOWS\system32\MFC30.DLL
2007-07-02 17:16 <DIR> d-------- C:\Program Files\Sage
2007-07-02 17:16 <DIR> d-------- C:\Program Files\Common Files\Sage Line50
2007-07-02 11:45 4,212 --ah----- C:\WINDOWS\system32\zllictbl.dat
2007-07-02 11:45 <DIR> d-------- C:\WINDOWS\system32\ZoneLabs
2007-07-02 11:44 <DIR> d-------- C:\WINDOWS\Internet Logs
2007-07-02 11:23 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
2007-07-02 11:12 <DIR> d-------- C:\Program Files\Windows Media Connect 2
2007-07-02 11:11 <DIR> d-------- C:\WINDOWS\system32\LogFiles

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
2007-07-29 07:53:30 -------- d-----w C:\Program Files\BitComet
2007-07-28 23:02:51 -------- d-----w C:\Program Files\DynDNS Updater
2007-07-24 08:40:37 11,973 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-07-24 08:39:21 -------- d--h--w C:\Program Files\InstallShield Installation Information
2007-07-06 17:25:14 -------- d-----w C:\Program Files\Common Files\McAfee
2007-07-06 11:48:10 2,038 ----a-w C:\DOCUME~1\craig\APPLIC~1\SAS7_000.DAT
2007-07-05 19:44:00 -------- d-----w C:\Program Files\Electronic Arts
2007-06-30 00:19:28 359,808 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2007-06-28 21:18:40 -------- d-----w C:\DOCUME~1\craig\APPLIC~1\Command & Conquer 3 Tiberium Wars Demo
2007-06-28 14:38:50 -------- d-----w C:\Program Files\Messenger
2007-06-28 01:20:38 -------- d-----w C:\Program Files\Shareaza
2007-06-28 01:20:35 -------- d-----w C:\DOCUME~1\craig\APPLIC~1\Shareaza
2007-06-27 23:33:43 -------- d-----w C:\DOCUME~1\craig\APPLIC~1\LimeWire
2007-06-27 23:22:47 -------- d-----w C:\DOCUME~1\craig\APPLIC~1\McAfee
2007-06-27 23:15:32 201 ----a-w C:\WINDOWS\nsreg.dat
2007-06-27 23:08:20 -------- d-----w C:\Program Files\PowerISO
2007-06-27 21:45:45 2,560 ----a-w C:\WINDOWS\system32\BitCometRes.dll
2007-06-27 21:27:09 -------- d-----w C:\DOCUME~1\craig\APPLIC~1\Nuance
2007-06-27 21:25:14 -------- d-----w C:\Program Files\Common Files\Scansoft Shared
2007-06-27 21:25:14 -------- d-----w C:\Program Files\Common Files\InstallShield
2007-06-27 21:25:05 -------- d-----w C:\Program Files\Nuance
2007-06-27 21:22:06 -------- d-----w C:\Program Files\DAEMON Tools
2007-06-27 21:09:37 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll
2007-06-27 21:09:37 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll
2007-06-27 21:08:54 -------- d-----w C:\Program Files\Microsoft Works
2007-06-27 21:08:43 -------- d-----w C:\Program Files\MSBuild
2007-06-27 21:08:39 682,232 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2007-06-27 21:07:51 -------- d-----w C:\Program Files\Common Files\ODBC
2007-06-27 21:07:49 -------- d-----w C:\Program Files\Common Files\SpeechEngines
2007-06-27 21:02:47 -------- d-----w C:\DOCUME~1\craig\APPLIC~1\Kana Solution
2007-06-27 21:02:24 -------- d-----w C:\DOCUME~1\craig\APPLIC~1\WinRAR
2007-06-27 20:40:34 -------- d-----w C:\Program Files\Common Files\SupportSoft
2007-06-27 20:29:09 -------- d-----w C:\Program Files\Realtek Sound Manager
2007-06-27 20:29:09 -------- d-----w C:\Program Files\AvRack
2007-06-27 20:28:22 -------- d-----w C:\Program Files\AMD
2007-06-27 20:24:28 502,272 ----a-w C:\WINDOWS\system32\winlogon.exe
2007-06-27 20:17:18 -------- d-----w C:\Program Files\microsoft frontpage
2007-06-27 20:16:55 0 --sha-r C:\MSDOS.SYS
2007-06-27 20:16:55 0 --sha-r C:\IO.SYS
2007-06-27 20:16:55 0 ----a-w C:\CONFIG.SYS
2007-06-27 20:16:55 0 ----a-w C:\AUTOEXEC.BAT
2007-06-27 20:15:49 -------- d--h--w C:\Program Files\WindowsUpdate
2007-06-27 20:15:10 -------- d-----w C:\Program Files\Common Files\MSSoap
2007-06-27 20:15:03 -------- d-----w C:\Program Files\Movie Maker
2007-06-27 20:14:20 21,640 ----a-w C:\WINDOWS\system32\emptyregdb.dat
2007-06-27 20:13:53 -------- d-----w C:\Program Files\Online Services
2007-06-27 20:13:43 -------- d-----w C:\Program Files\MSN Gaming Zone
2007-06-27 20:13:37 -------- d-----w C:\Program Files\Windows NT
2007-06-04 14:18:48 9,344 ----a-w C:\WINDOWS\system32\drivers\NSDriver.sys
2007-06-04 14:17:02 8,320 ----a-w C:\WINDOWS\system32\drivers\AWRTRD.sys
2007-06-04 14:14:56 6,272 ----a-w C:\WINDOWS\system32\drivers\AWRTPD.sys
2007-05-31 06:45:07 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2007-05-31 06:44:55 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2007-05-31 06:44:54 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2007-05-31 06:44:54 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2007-05-31 06:44:54 740,442 ----a-w C:\WINDOWS\system32\DivX.dll
2007-05-16 15:12:02 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
2007-05-15 18:06:58 71,208 ----a-w C:\WINDOWS\system32\PhysXLoader.dll

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nwiz"="nwiz.exe" [2007-04-19 13:26 C:\WINDOWS\system32\nwiz.exe]
"SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 11:38]
"Zone Labs Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2006-08-23 23:38]
"NvMediaCenter"="NvMCTray.dll" [2007-04-19 13:26 C:\WINDOWS\system32\nvmctray.dll]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-07-24 12:46]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-09 18:53]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 13:00]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-03-12 13:49]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\aawservice]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^craig^Start Menu^Programs^Startup^Microsoft Office Groove.lnk]
path=C:\Documents and Settings\craig\Start Menu\Programs\Startup\Microsoft Office Groove.lnk
backup=C:\WINDOWS\pss\Microsoft Office Groove.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
"C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
"C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DNS7reminder]
"C:\Program Files\Nuance\NaturallySpeaking9\Program\ereg.exe" -r "C:\Program Files\Nuance\NaturallySpeaking9\Program\ereg.ini"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EA Core]
"C:\Program Files\Electronic Arts\EA Link\Core.exe" -silent
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
"C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
"C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
C:\Program Files\PowerISO\PWRISOVM.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
"C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Shareaza]
"C:\Program Files\Shareaza\Shareaza.exe" -tray
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SiteAdvisor]
C:\Program Files\SiteAdvisor\6066\SiteAdv.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
SOUNDMAN.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate]
C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe -Embedding -boot
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TalkTalk]
"C:\Program Files\TalkTalk\bin\sprtcmd.exe" /P TalkTalk
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\winbo32]
winbo32.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zone Labs Client]
"C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"McProxy"=2 (0x2)
R0 srescan;srescan;C:\WINDOWS\system32\ZoneLabs\srescan.sys
R1 AmdK8;AMD Processor Driver;C:\WINDOWS\system32\DRIVERS\AmdK8.sys
R1 SCDEmu;SCDEmu;C:\WINDOWS\system32\drivers\SCDEmu.sys
R2 DynDNS_Updater_Service;DynDNS Updater Service;C:\Program Files\DynDNS Updater\DynDNS.exe
R3 alcan5wn;SpeedTouch USB ADSL PPP Networking Driver (NDISWAN);C:\WINDOWS\system32\DRIVERS\alcan5wn.sys
R3 alcaudsl;SpeedTouch ADSL Modem ATM Transport;C:\WINDOWS\system32\DRIVERS\alcaudsl.sys
R3 irsir;Microsoft Serial Infrared Driver;C:\WINDOWS\system32\DRIVERS\irsir.sys
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service;"C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe"
S3 odserv;Microsoft Office Diagnostics Service;"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE"
S3 usbvideo;USB Video Device (WDM);C:\WINDOWS\system32\Drivers\usbvideo.sys
*Newly Created Service* - CATCHME
Contents of the 'Scheduled Tasks' folder
2007-07-29 07:53:13 C:\WINDOWS\tasks\XoftSpySE.job
**************************************************************************
catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-29 18:32:40
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden registry entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
Completion time: 2007-07-29 18:33:21
C:\ComboFix-quarantined-files.txt ... 2007-07-29 18:33
C:\ComboFix2.txt ... 2007-07-29 11:04
--- E O F ---


fresh jack

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:36:58, on 29/07/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\DynDNS Updater\DynDNS.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\BitComet\BitComet.exe
C:\WINDOWS\explorer.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.6.14.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: ImageShack Toolbar - {6932D140-ABC4-4073-A44C-D4A541665E35} - C:\WINDOWS\ImageShackToolbar\ImageShackToolbar.dll
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
O16 - DPF: {6932D140-ABC4-4073-A44C-D4A541665E35} (ImageShack Toolbar) - http://toolbar.imageshack.us/toolbar/ImageShackToolbar.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{7D4FED7B-F305-43D3-939A-D38C350A00F1}: NameServer = 62.24.252.135 62.24.252.134
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: DynDNS Updater Service (DynDNS_Updater_Service) - Kana Solution - C:\Program Files\DynDNS Updater\DynDNS.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe
--
End of file - 6710 bytes


many thanks
craig

[peku006]

Hi GNGNUT

Please do the following...

Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\WINDOWS\system32\kmllm.bak1

Folder::
C:\b45b2043300abf43b93128522c

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\winbo32]
Save this as "CFScript"

http://img.photobucket.com/albums/v666/sUBs/CFScript.gif

Refering to the picture above, drag CFScript.txt into ComboFix.exe

When finished, it shall produce a log for you, C:\ComboFix.txt. Post that log in your next reply.

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Please do an online scan with Kaspersky Online Scanner (http://www.kaspersky.com/downloads/kws/kavwebscan.html). You will be prompted to install an ActiveX component from Kaspersky, Click Yes.
The program will launch and then start to download the latest definition files.
Once the scanner is installed and the definitions downloaded, click Next.
Now click on Scan Settings
In the scan settings make sure that the following are selected:

o Scan using the following Anti-Virus database:

+ Extended (If available otherwise Standard)

o Scan Options:

+ Scan Archives
+ Scan Mail Bases
Click OK
Now under select a target to scan select My Computer
The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected.
Now click on the Save as Text button
Save the file to your desktop.
Copy and paste that information in your next post.Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%.

Please, post these logs:

Kaspersky Online Scan result
Combofix.txt

[GNGNUT]

log form com

"craig" - 2007-07-29 20:41:49 - ComboFix 07-07-23.6 - Service Pack 2 NTFS
Command switches used :: E:\programmes\spywear programs\cfscript.txt

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\b45b2043300abf43b93128522c
C:\b45b2043300abf43b93128522c\admparse.dll
C:\b45b2043300abf43b93128522c\admparse.dll.mui
C:\b45b2043300abf43b93128522c\advpack.dll
C:\b45b2043300abf43b93128522c\advpack.dll.mui
C:\b45b2043300abf43b93128522c\browseui.dll
C:\b45b2043300abf43b93128522c\corpol.dll
C:\b45b2043300abf43b93128522c\custsat.dll
C:\b45b2043300abf43b93128522c\dxtmsft.dll
C:\b45b2043300abf43b93128522c\dxtrans.dll
C:\b45b2043300abf43b93128522c\extmgr.dll
C:\b45b2043300abf43b93128522c\extmgr.dll.mui
C:\b45b2043300abf43b93128522c\feeddisc.wav
C:\b45b2043300abf43b93128522c\hmmapi.dll
C:\b45b2043300abf43b93128522c\hmmapi.dll.mui
C:\b45b2043300abf43b93128522c\html.iec
C:\b45b2043300abf43b93128522c\html.iec.mui
C:\b45b2043300abf43b93128522c\icardie.dll
C:\b45b2043300abf43b93128522c\icardie.dll.mui
C:\b45b2043300abf43b93128522c\icrav03.rat
C:\b45b2043300abf43b93128522c\ie4uinit.exe
C:\b45b2043300abf43b93128522c\ie4uinit.exe.mui
C:\b45b2043300abf43b93128522c\ieakeng.dll
C:\b45b2043300abf43b93128522c\ieakeng.dll.mui
C:\b45b2043300abf43b93128522c\ieakmmc.chm
C:\b45b2043300abf43b93128522c\ieaksie.dll
C:\b45b2043300abf43b93128522c\ieaksie.dll.mui
C:\b45b2043300abf43b93128522c\ieakui.dll
C:\b45b2043300abf43b93128522c\ieakui.dll.mui
C:\b45b2043300abf43b93128522c\ieapfltr.dat
C:\b45b2043300abf43b93128522c\ieapfltr.dll
C:\b45b2043300abf43b93128522c\iedkcs32.dll
C:\b45b2043300abf43b93128522c\iedkcs32.dll.mui
C:\b45b2043300abf43b93128522c\iedw.exe
C:\b45b2043300abf43b93128522c\iedw.exe.mui
C:\b45b2043300abf43b93128522c\ieencode.dll
C:\b45b2043300abf43b93128522c\ieeula.chm
C:\b45b2043300abf43b93128522c\ieframe.dll
C:\b45b2043300abf43b93128522c\ieframe.dll.mui
C:\b45b2043300abf43b93128522c\iepeers.dll
C:\b45b2043300abf43b93128522c\iepeers.dll.mui
C:\b45b2043300abf43b93128522c\ieproxy.dll
C:\b45b2043300abf43b93128522c\iernonce.dll
C:\b45b2043300abf43b93128522c\iernonce.dll.mui
C:\b45b2043300abf43b93128522c\iertutil.dll
C:\b45b2043300abf43b93128522c\iesetup.dll
C:\b45b2043300abf43b93128522c\iesetup.dll.mui
C:\b45b2043300abf43b93128522c\iesupp.chm
C:\b45b2043300abf43b93128522c\ieudinit.exe
C:\b45b2043300abf43b93128522c\ieui.dll
C:\b45b2043300abf43b93128522c\ieui.dll.mui
C:\b45b2043300abf43b93128522c\ieuinit.inf
C:\b45b2043300abf43b93128522c\ieunatt.exe.mui
C:\b45b2043300abf43b93128522c\iexplore.chm
C:\b45b2043300abf43b93128522c\iexplore.exe
C:\b45b2043300abf43b93128522c\iexplore.exe.mui
C:\b45b2043300abf43b93128522c\imgutil.dll
C:\b45b2043300abf43b93128522c\inetcorp.iem
C:\b45b2043300abf43b93128522c\inetcpl.cpl
C:\b45b2043300abf43b93128522c\inetcpl.cpl.mui
C:\b45b2043300abf43b93128522c\inetres.adm
C:\b45b2043300abf43b93128522c\inetset.iem
C:\b45b2043300abf43b93128522c\infobar.wav
C:\b45b2043300abf43b93128522c\inseng.dll
C:\b45b2043300abf43b93128522c\inseng.dll.mui
C:\b45b2043300abf43b93128522c\install.ins
C:\b45b2043300abf43b93128522c\jscript.dll
C:\b45b2043300abf43b93128522c\jsproxy.dll
C:\b45b2043300abf43b93128522c\licmgr10.dll
C:\b45b2043300abf43b93128522c\licmgr10.dll.mui
C:\b45b2043300abf43b93128522c\msfeeds.dll
C:\b45b2043300abf43b93128522c\msfeeds.mof
C:\b45b2043300abf43b93128522c\msfeedsbs.dll
C:\b45b2043300abf43b93128522c\msfeedsbs.dll.mui
C:\b45b2043300abf43b93128522c\msfeedsbs.mof
C:\b45b2043300abf43b93128522c\msfeedssync.exe
C:\b45b2043300abf43b93128522c\mshta.exe
C:\b45b2043300abf43b93128522c\mshta.exe.mui
C:\b45b2043300abf43b93128522c\mshtml.dll
C:\b45b2043300abf43b93128522c\mshtml.dll.mui
C:\b45b2043300abf43b93128522c\mshtml.tlb
C:\b45b2043300abf43b93128522c\mshtmled.dll
C:\b45b2043300abf43b93128522c\mshtmled.dll.mui
C:\b45b2043300abf43b93128522c\mshtmler.dll
C:\b45b2043300abf43b93128522c\mshtmler.dll.mui
C:\b45b2043300abf43b93128522c\msls31.dll
C:\b45b2043300abf43b93128522c\msrating.dll
C:\b45b2043300abf43b93128522c\msrating.dll.mui
C:\b45b2043300abf43b93128522c\mstime.dll
C:\b45b2043300abf43b93128522c\navstart.wav
C:\b45b2043300abf43b93128522c\occache.dll
C:\b45b2043300abf43b93128522c\occache.dll.mui
C:\b45b2043300abf43b93128522c\occache.ini
C:\b45b2043300abf43b93128522c\pngfilt.dll
C:\b45b2043300abf43b93128522c\popupblk.wav
C:\b45b2043300abf43b93128522c\shdocvw.dll
C:\b45b2043300abf43b93128522c\shlwapi.dll
C:\b45b2043300abf43b93128522c\spmsg.dll
C:\b45b2043300abf43b93128522c\spuninst.exe
C:\b45b2043300abf43b93128522c\spupdsvc.exe
C:\b45b2043300abf43b93128522c\tdc.ocx
C:\b45b2043300abf43b93128522c\ticrf.rat
C:\b45b2043300abf43b93128522c\update\eula.rtf
C:\b45b2043300abf43b93128522c\update\idndl.exe
C:\b45b2043300abf43b93128522c\update\ie7.cat
C:\b45b2043300abf43b93128522c\update\iecustom.dll
C:\b45b2043300abf43b93128522c\update\iereseticons.exe
C:\b45b2043300abf43b93128522c\update\iesetup.exe
C:\b45b2043300abf43b93128522c\update\legitlibm.dll
C:\b45b2043300abf43b93128522c\update\nlsdl.exe
C:\b45b2043300abf43b93128522c\update\update.exe
C:\b45b2043300abf43b93128522c\update\update.exe.manifest
C:\b45b2043300abf43b93128522c\update\update.inf
C:\b45b2043300abf43b93128522c\update\update.ver
C:\b45b2043300abf43b93128522c\update\updspapi.dll
C:\b45b2043300abf43b93128522c\update\xmllitesetup.exe
C:\b45b2043300abf43b93128522c\url.dll
C:\b45b2043300abf43b93128522c\urlmon.dll
C:\b45b2043300abf43b93128522c\urlmon.dll.mui
C:\b45b2043300abf43b93128522c\vbscript.dll
C:\b45b2043300abf43b93128522c\vgx.dll
C:\b45b2043300abf43b93128522c\webcheck.dll
C:\b45b2043300abf43b93128522c\webcheck.dll.mui
C:\b45b2043300abf43b93128522c\webcheck.ini
C:\b45b2043300abf43b93128522c\winfxdocobj.exe
C:\b45b2043300abf43b93128522c\winfxdocobj.exe.mui
C:\b45b2043300abf43b93128522c\wininet.dll
C:\b45b2043300abf43b93128522c\wininet.dll.mui
C:\WINDOWS\system32\kmllm.bak1

((((((((((((((((((((((((( Files Created from 2007-06-28 to 2007-07-29 )))))))))))))))))))))))))))))))

2007-07-29 11:09 <DIR> d-------- C:\Program Files\MSXML 4.0
2007-07-29 09:05 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-07-29 08:57 <DIR> d-------- C:\VundoFix Backups
2007-07-28 23:49 <DIR> d-------- C:\Program Files\Nero
2007-07-28 23:49 <DIR> d-------- C:\Program Files\Common Files\Ahead
2007-07-28 23:49 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Nero
2007-07-28 18:01 <DIR> d-------- C:\Deckard
2007-07-28 17:13 <DIR> d-------- C:\Program Files\Trend Micro
2007-07-28 07:32 786,432 --ah----- C:\DOCUME~1\ADMINI~1\NTUSER.DAT
2007-07-28 07:09 <DIR> d-------- C:\Program Files\XoftSpySE
2007-07-26 08:26 <DIR> d-------- C:\Program Files\Lavasoft
2007-07-24 13:10 77,312 --a------ C:\WINDOWS\ua2.dll
2007-07-24 11:45 <DIR> d-------- C:\DOCUME~1\craig\APPLIC~1\Ahead
2007-07-24 11:38 1 --a------ C:\WINDOWS\system32\ps.dat
2007-07-24 09:23 <DIR> d-------- C:\Program Files\Activision
2007-07-24 08:26 9,728 -ra------ C:\WINDOWS\system32\bdco1.dll
2007-07-24 08:26 33,536 -ra------ C:\WINDOWS\system32\drivers\NVENETFD.sys
2007-07-24 08:26 32,256 -ra------ C:\WINDOWS\system32\nvconrm.dll
2007-07-24 08:26 261,888 -ra------ C:\WINDOWS\system32\drivers\nvnrm.sys
2007-07-24 08:26 208,256 -ra------ C:\WINDOWS\system32\drivers\nvsnpu.sys
2007-07-24 08:26 201,728 -ra------ C:\WINDOWS\system32\fdco1.dll
2007-07-24 08:26 176,128 --a------ C:\WINDOWS\system32\nvunrm.exe
2007-07-24 08:26 12,928 -ra------ C:\WINDOWS\system32\drivers\nvnetbus.sys
2007-07-24 08:16 <DIR> d-------- C:\NVIDIA
2007-07-24 08:08 <DIR> d-------- C:\Program Files\SystemRequirementsLab
2007-07-23 21:53 <DIR> d-------- C:\WINDOWS\system32\AGEIA
2007-07-23 21:53 <DIR> d-------- C:\Program Files\AGEIA Technologies
2007-07-23 21:45 <DIR> d-------- C:\Program Files\UBISOFT
2007-07-23 21:43 <DIR> d-------- C:\DOCUME~1\craig\APPLIC~1\InstallShield
2007-07-22 09:39 <DIR> d-------- C:\Program Files\Engelmann Media
2007-07-17 08:58 <DIR> d-------- C:\Program Files\Common Files\EasyInfo
2007-07-11 23:09 <DIR> d-------- C:\Program Files\Poker
2007-07-10 23:16 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-07-10 22:40 <DIR> d-------- C:\WINDOWS\network diagnostic
2007-07-09 09:54 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys
2007-07-09 09:54 103,736 --a------ C:\WINDOWS\system32\PnkBstrB.exe
2007-07-08 08:58 <DIR> d-------- C:\WINDOWS\ImageShackToolbar
2007-07-08 07:03 73,728 --a------ C:\WINDOWS\system32\FLKill.exe
2007-07-08 07:03 <DIR> d-------- C:\Program Files\Folder Lock
2007-07-06 21:03 <DIR> d-------- C:\My Downloads
2007-07-06 21:01 <DIR> d-------- C:\Program Files\BitTorrent Fastest Tool
2007-07-06 16:25 <DIR> d-------- C:\DOCUME~1\craig\APPLIC~1\Leadertech
2007-07-06 12:07 <DIR> d-------- C:\Program Files\FolderSecurityGuard
2007-07-05 20:17 <DIR> d-------- C:\DOCUME~1\craig\APPLIC~1\teamspeak2
2007-07-05 20:16 <DIR> d-------- C:\Program Files\Teamspeak2_RC2
2007-07-05 16:51 85,376 --a------ C:\WINDOWS\system32\drivers\NABTSFEC.sys
2007-07-05 16:51 5,504 --a------ C:\WINDOWS\system32\drivers\MSTEE.sys
2007-07-05 16:51 19,328 --a------ C:\WINDOWS\system32\drivers\WSTCODEC.SYS
2007-07-05 16:51 17,024 --a------ C:\WINDOWS\system32\drivers\CCDECODE.sys
2007-07-05 16:51 15,360 --a------ C:\WINDOWS\system32\drivers\StreamIP.sys
2007-07-05 16:51 11,136 --a------ C:\WINDOWS\system32\drivers\SLIP.sys
2007-07-05 16:51 10,880 --a------ C:\WINDOWS\system32\drivers\NdisIP.sys
2007-07-05 16:50 78,464 --a------ C:\WINDOWS\system32\drivers\usbvideo.sys
2007-07-05 16:50 53,760 --a------ C:\WINDOWS\system32\vfwwdm32.dll
2007-07-05 16:50 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll
2007-07-05 16:50 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll
2007-07-05 16:50 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2007-07-05 11:26 <DIR> d-------- C:\Program Files\RealVNC
2007-07-05 11:15 446,464 --a------ C:\WINDOWS\system32\wmvdmoe.dll
2007-07-05 11:15 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\PY_Software
2007-07-05 11:12 434,688 --a------ C:\WINDOWS\system32\ss2uinst.exe
2007-07-03 18:35 <DIR> d-------- C:\Program Files\TalkTalk
2007-07-03 18:35 <DIR> d-------- C:\Program Files\SupportSoft
2007-07-03 18:35 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\SupportSoft
2007-07-03 18:34 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-07-03 18:18 <DIR> d-------- C:\Program Files\Thomson
2007-07-02 20:20 <DIR> d-------- C:\WINDOWS\system32\appmgmt
2007-07-02 17:31 <DIR> d-------- C:\WINDOWS\Downloaded Installations
2007-07-02 17:30 <DIR> d-------- C:\Program Files\Google
2007-07-02 17:30 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
2007-07-02 17:21 81,920 --a------ C:\WINDOWS\system32\SGUserInfo.dll
2007-07-02 17:21 37,224 --a------ C:\WINDOWS\system32\SageStorage.dll
2007-07-02 17:21 335,872 --a------ C:\WINDOWS\system32\SGINFMR.dll
2007-07-02 17:21 167,936 --a------ C:\WINDOWS\system32\SGXMLQry.dll
2007-07-02 17:21 139,264 --a------ C:\WINDOWS\system32\SGISAQry.dll
2007-07-02 17:21 127,352 --a------ C:\WINDOWS\system32\SageSoftwareUpdate.dll
2007-07-02 17:21 126,976 --a------ C:\WINDOWS\system32\SGInfProgressBar.dll
2007-07-02 17:21 119,160 --a------ C:\WINDOWS\system32\SageFolderBrowse.dll
2007-07-02 17:19 86,016 --a------ C:\WINDOWS\system32\SageNatWestBankline.dll
2007-07-02 17:19 86,016 --a------ C:\WINDOWS\system32\SageBankPayments.dll
2007-07-02 17:19 81,920 --a------ C:\WINDOWS\system32\SageNatWestOnline.dll
2007-07-02 17:19 81,920 --a------ C:\WINDOWS\system32\sageebanking.dll
2007-07-02 17:19 81,920 --a------ C:\WINDOWS\system32\SageBarclaysOnline.dll
2007-07-02 17:19 81,920 --a------ C:\WINDOWS\system32\SageBarclaysBusinessMasterII.dll
2007-07-02 17:19 69,632 --a------ C:\WINDOWS\system32\SageBankBalances.dll
2007-07-02 17:19 61,440 --a------ C:\WINDOWS\system32\BankServiceUtilities.dll
2007-07-02 17:19 192,512 --a------ C:\WINDOWS\system32\SageBankReconciliation.dll
2007-07-02 17:19 <DIR> d-------- C:\Program Files\Sage EBanking
2007-07-02 17:17 368,696 --a------ C:\WINDOWS\system32\S10DBC32.dll
2007-07-02 17:17 322,832 --a------ C:\WINDOWS\system32\MFC30.DLL
2007-07-02 17:16 <DIR> d-------- C:\Program Files\Sage
2007-07-02 17:16 <DIR> d-------- C:\Program Files\Common Files\Sage Line50
2007-07-02 11:45 4,212 --ah----- C:\WINDOWS\system32\zllictbl.dat
2007-07-02 11:45 <DIR> d-------- C:\WINDOWS\system32\ZoneLabs
2007-07-02 11:44 <DIR> d-------- C:\WINDOWS\Internet Logs
2007-07-02 11:23 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
2007-07-02 11:12 <DIR> d-------- C:\Program Files\Windows Media Connect 2
2007-07-02 11:11 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2007-07-02 11:11 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF
2007-07-02 09:31 <DIR> d-------- C:\WINDOWS\system32\Lang

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
2007-07-29 07:53:30 -------- d-----w C:\Program Files\BitComet
2007-07-28 23:02:51 -------- d-----w C:\Program Files\DynDNS Updater
2007-07-24 08:40:37 11,973 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-07-24 08:39:21 -------- d--h--w C:\Program Files\InstallShield Installation Information
2007-07-06 17:25:14 -------- d-----w C:\Program Files\Common Files\McAfee
2007-07-06 11:48:10 2,038 ----a-w C:\DOCUME~1\craig\APPLIC~1\SAS7_000.DAT
2007-07-05 19:44:00 -------- d-----w C:\Program Files\Electronic Arts
2007-06-30 00:19:28 359,808 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2007-06-28 21:18:40 -------- d-----w C:\DOCUME~1\craig\APPLIC~1\Command & Conquer 3 Tiberium Wars Demo
2007-06-28 14:38:50 -------- d-----w C:\Program Files\Messenger
2007-06-28 01:20:38 -------- d-----w C:\Program Files\Shareaza
2007-06-28 01:20:35 -------- d-----w C:\DOCUME~1\craig\APPLIC~1\Shareaza
2007-06-27 23:33:43 -------- d-----w C:\DOCUME~1\craig\APPLIC~1\LimeWire
2007-06-27 23:22:47 -------- d-----w C:\DOCUME~1\craig\APPLIC~1\McAfee
2007-06-27 23:15:32 201 ----a-w C:\WINDOWS\nsreg.dat
2007-06-27 23:08:20 -------- d-----w C:\Program Files\PowerISO
2007-06-27 21:45:45 2,560 ----a-w C:\WINDOWS\system32\BitCometRes.dll
2007-06-27 21:27:09 -------- d-----w C:\DOCUME~1\craig\APPLIC~1\Nuance
2007-06-27 21:25:14 -------- d-----w C:\Program Files\Common Files\Scansoft Shared
2007-06-27 21:25:14 -------- d-----w C:\Program Files\Common Files\InstallShield
2007-06-27 21:25:05 -------- d-----w C:\Program Files\Nuance
2007-06-27 21:22:06 -------- d-----w C:\Program Files\DAEMON Tools
2007-06-27 21:09:37 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll
2007-06-27 21:09:37 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll
2007-06-27 21:08:54 -------- d-----w C:\Program Files\Microsoft Works
2007-06-27 21:08:43 -------- d-----w C:\Program Files\MSBuild
2007-06-27 21:08:39 682,232 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2007-06-27 21:07:51 -------- d-----w C:\Program Files\Common Files\ODBC
2007-06-27 21:07:49 -------- d-----w C:\Program Files\Common Files\SpeechEngines
2007-06-27 21:02:47 -------- d-----w C:\DOCUME~1\craig\APPLIC~1\Kana Solution
2007-06-27 21:02:24 -------- d-----w C:\DOCUME~1\craig\APPLIC~1\WinRAR
2007-06-27 20:40:34 -------- d-----w C:\Program Files\Common Files\SupportSoft
2007-06-27 20:29:09 -------- d-----w C:\Program Files\Realtek Sound Manager
2007-06-27 20:29:09 -------- d-----w C:\Program Files\AvRack
2007-06-27 20:28:22 -------- d-----w C:\Program Files\AMD
2007-06-27 20:24:28 502,272 ----a-w C:\WINDOWS\system32\winlogon.exe
2007-06-27 20:17:18 -------- d-----w C:\Program Files\microsoft frontpage
2007-06-27 20:16:55 0 --sha-r C:\MSDOS.SYS
2007-06-27 20:16:55 0 --sha-r C:\IO.SYS
2007-06-27 20:16:55 0 ----a-w C:\CONFIG.SYS
2007-06-27 20:16:55 0 ----a-w C:\AUTOEXEC.BAT
2007-06-27 20:15:49 -------- d--h--w C:\Program Files\WindowsUpdate
2007-06-27 20:15:10 -------- d-----w C:\Program Files\Common Files\MSSoap
2007-06-27 20:15:03 -------- d-----w C:\Program Files\Movie Maker
2007-06-27 20:14:20 21,640 ----a-w C:\WINDOWS\system32\emptyregdb.dat
2007-06-27 20:13:53 -------- d-----w C:\Program Files\Online Services
2007-06-27 20:13:43 -------- d-----w C:\Program Files\MSN Gaming Zone
2007-06-27 20:13:37 -------- d-----w C:\Program Files\Windows NT
2007-06-04 14:18:48 9,344 ----a-w C:\WINDOWS\system32\drivers\NSDriver.sys
2007-06-04 14:17:02 8,320 ----a-w C:\WINDOWS\system32\drivers\AWRTRD.sys
2007-06-04 14:14:56 6,272 ----a-w C:\WINDOWS\system32\drivers\AWRTPD.sys
2007-05-31 06:45:07 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2007-05-31 06:44:55 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2007-05-31 06:44:54 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2007-05-31 06:44:54 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2007-05-31 06:44:54 740,442 ----a-w C:\WINDOWS\system32\DivX.dll
2007-05-16 15:12:02 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
2007-05-15 18:06:58 71,208 ----a-w C:\WINDOWS\system32\PhysXLoader.dll

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nwiz"="nwiz.exe" [2007-04-19 13:26 C:\WINDOWS\system32\nwiz.exe]
"SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 11:38]
"Zone Labs Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2006-08-23 23:38]
"NvMediaCenter"="NvMCTray.dll" [2007-04-19 13:26 C:\WINDOWS\system32\nv