Thanks again for the help dan12. Here are the logs you requested.
ComboFix 08-04-13.3 - Owner 2008-04-15 13:44:02.2 - NTFSx86Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.351 [GMT -5:00]
Running from: C:\Documents and Settings\Owner.KevinP\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Owner.KevinP\Desktop\CFScript.txt
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!FILE ::
C:\Documents and Settings\All Users\Application Data\qdenmpan.dll
C:\oomF.exe
C:\WINDOWS\ctshkrch.dll
C:\WINDOWS\system32\dslaruhm.exe
C:\WINDOWS\system32\edkzoxgr.exe
C:\WINDOWS\system32\lwruzwpk.exe
C:\WINDOWS\trictions.dll
.
The following files were disabled during the run:C:\Program Files\Enigma Software Group\SpyHunter\SpyHunterMonitor.dll
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\All Users\Application Data\kpytkdel
C:\Documents and Settings\All Users\Application Data\kpytkdel\uvcdwbqj.exe
C:\Documents and Settings\All Users\Application Data\qdenmpan.dll
C:\Documents and Settings\All Users\Application Data\Rabio
C:\oomF.exe
C:\Program Files\Bat
C:\Program Files\Bat\Bat.dll
C:\Program Files\Bat\Bat.dll.intermediate.manifest
C:\Program Files\Bat\Bat.exe
C:\Program Files\Bat\Bat.info
C:\Program Files\Bat\Bat.original
C:\Program Files\Bat\Info.dll
C:\Program Files\Bat\un_BatSetup_15041.exe
C:\Program Files\Bat\un_BatSetup_15041.txt
C:\Program Files\Bat\X_Bat.exe
C:\Program Files\Bat\X_Bat.log
C:\WINDOWS\ctshkrch.dll
C:\WINDOWS\cuawsppw
C:\WINDOWS\cuawsppw\1.png
C:\WINDOWS\cuawsppw\2.png
C:\WINDOWS\cuawsppw\3.png
C:\WINDOWS\cuawsppw\4.png
C:\WINDOWS\cuawsppw\5.png
C:\WINDOWS\cuawsppw\6.png
C:\WINDOWS\cuawsppw\7.png
C:\WINDOWS\cuawsppw\8.png
C:\WINDOWS\cuawsppw\9.png
C:\WINDOWS\cuawsppw\bottom-rc.gif
C:\WINDOWS\cuawsppw\config.png
C:\WINDOWS\cuawsppw\content.png
C:\WINDOWS\cuawsppw\download.gif
C:\WINDOWS\cuawsppw\frame-bg.gif
C:\WINDOWS\cuawsppw\frame-bottom-left.gif
C:\WINDOWS\cuawsppw\frame-h1bg.gif
C:\WINDOWS\cuawsppw\head.png
C:\WINDOWS\cuawsppw\icon.png
C:\WINDOWS\cuawsppw\indexwp.html
C:\WINDOWS\cuawsppw\main.css
C:\WINDOWS\cuawsppw\memory-prots.png
C:\WINDOWS\cuawsppw\net.png
C:\WINDOWS\cuawsppw\pc-mag.gif
C:\WINDOWS\cuawsppw\pc.gif
C:\WINDOWS\cuawsppw\poloska1.png
C:\WINDOWS\cuawsppw\poloska2.png
C:\WINDOWS\cuawsppw\poloska3.png
C:\WINDOWS\cuawsppw\promowp1.html
C:\WINDOWS\cuawsppw\promowp2.html
C:\WINDOWS\cuawsppw\promowp3.html
C:\WINDOWS\cuawsppw\promowp4.html
C:\WINDOWS\cuawsppw\promowp5.html
C:\WINDOWS\cuawsppw\reg.png
C:\WINDOWS\cuawsppw\repair.png
C:\WINDOWS\cuawsppw\scr-1.png
C:\WINDOWS\cuawsppw\scr-2.png
C:\WINDOWS\cuawsppw\start.png
C:\WINDOWS\cuawsppw\styles.css
C:\WINDOWS\cuawsppw\Thumbs.db
C:\WINDOWS\cuawsppw\top-rc.gif
C:\WINDOWS\cuawsppw\vline.gif
C:\WINDOWS\cuawsppw\wp.png
C:\WINDOWS\system32\dslaruhm.exe
C:\WINDOWS\system32\edkzoxgr.exe
C:\WINDOWS\system32\lwruzwpk.exe
C:\WINDOWS\trictions.dll
.
((((((((((((((((((((((((( Files Created from 2008-03-15 to 2008-04-15 )))))))))))))))))))))))))))))))
.
2008-04-15 13:25 . 2008-04-15 13:25 110,592 --a------ C:\WINDOWS\system32\olefudsr.exe
2008-04-15 03:36 . 2008-04-15 03:36 94,208 --a------ C:\WINDOWS\system32\ynobklwf.exe
2008-04-14 15:22 . 2008-04-14 15:22 102,400 --a------ C:\WINDOWS\system32\qjkxgxyp.exe
2008-04-14 14:50 . 2008-04-14 14:50 <DIR> d-------- C:\Program Files\CCleaner
2008-04-13 19:41 . 2008-04-13 19:41 <DIR> d-------- C:\Program Files\Trend Micro
2008-04-13 16:43 . 2008-04-13 16:43 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Grisoft
2008-04-13 14:38 . 2008-04-13 14:40 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\AVG7
2008-04-13 13:25 . 2008-04-13 13:25 86 --a------ C:\WINDOWS\wininit.ini
2008-04-13 12:41 . 2008-04-13 12:41 <DIR> d-------- C:\Program Files\RogueRemover FREE
2008-04-13 12:39 . 2008-04-13 12:39 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-04-13 12:39 . 2008-04-13 12:40 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-04-13 12:35 . 2008-04-13 12:35 <DIR> d-------- C:\Program Files\Lavasoft
2008-04-13 12:35 . 2008-04-13 12:36 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-04-13 12:22 . 2008-04-13 12:22 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-04-13 09:17 . 2008-04-13 09:18 <DIR> d-------- C:\Documents and Settings\Owner.KevinP\Application Data\NeroDCTemplates
2008-04-12 17:10 . 2008-04-12 17:10 <DIR> d-------- C:\Documents and Settings\Owner.KevinP\Application Data\Uniblue
2008-04-12 15:32 . 2008-04-12 15:32 14,848 --a------ C:\EsPI.exe
2008-04-12 12:27 . 2008-04-12 12:27 <DIR> d-------- C:\Documents and Settings\Owner.KevinP\Application Data\AD ON Multimedia
2008-04-12 12:27 . 2008-04-12 12:49 <DIR> d-------- C:\Documents and Settings\Owner.KevinP\Application Data\AccurateRip
2008-04-11 12:46 . 2008-04-12 14:16 <DIR> d-------- C:\Program Files\Blaze Media Pro
2008-04-11 12:45 . 2008-04-11 12:46 <DIR> d--h----- C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}
2008-03-18 15:01 . 2008-03-18 15:01 <DIR> d-------- C:\Program Files\Conduit
2008-03-18 15:01 . 2008-03-18 15:01 <DIR> d-------- C:\Program Files\Arrowheads_Plus
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-15 18:25 --------- d-----w C:\Documents and Settings\Owner.KevinP\Application Data\AVG7
2008-04-14 00:24 --------- d-----w C:\Documents and Settings\Owner.KevinP\Application Data\uTorrent
2008-04-14 00:22 --------- d-----w C:\Program Files\PeerGuardian2
2008-04-12 17:49 --------- d-----w C:\Documents and Settings\Owner.KevinP\Application Data\Vso
2008-04-09 08:04 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-03-27 20:28 --------- d-----w C:\Program Files\Java
2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-16 15:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\WinZip
2008-03-08 00:44 --------- d-----w C:\Program Files\Motorola Phone Tools
2008-03-08 00:42 --------- d-----w C:\Program Files\Avanquest update
2008-03-07 22:09 --------- d-----w C:\Program Files\America Online 9.0
2008-03-07 03:36 --------- d-----w C:\Program Files\Common Files\aolshare
2008-03-07 03:12 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL
2008-03-07 03:08 --------- d-----w C:\Documents and Settings\Owner.KevinP\Application Data\AOL
2008-03-01 13:06 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-02-24 16:59 --------- d-----w C:\Documents and Settings\Owner.KevinP\Application Data\Nero
2008-02-24 16:57 --------- d-----w C:\Program Files\Common Files\Nero
2008-02-24 16:55 --------- d-----w C:\Program Files\Nero
2008-02-24 16:55 --------- d-----w C:\Documents and Settings\All Users\Application Data\Nero
2008-02-24 16:45 --------- d-----w C:\Program Files\Common Files\Ahead
2008-02-23 16:38 --------- d-----w C:\Program Files\Common Files\Adobe
2008-02-23 16:38 --------- d-----w C:\Program Files\Bonjour
2008-02-23 16:31 --------- d-----w C:\Program Files\Common Files\Macrovision Shared
2008-02-23 16:28 --------- d-----w C:\Program Files\Adobe Photoshop CS3
2008-02-23 08:31 --------- d-----w C:\Program Files\Enigma Software Group
2008-02-23 08:07 --------- d-----w C:\Documents and Settings\Owner.KevinP\Application Data\Grisoft
2008-02-23 08:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft
2008-02-22 23:15 --------- d-----w C:\Documents and Settings\All Users\Application Data\BVRP Software
2008-02-22 23:13 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-02-22 23:12 --------- d-----w C:\Documents and Settings\Owner.KevinP\Application Data\InstallShield
2008-02-22 22:18 0 ---ha-w C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-02-22 22:18 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_motmodem_01005.Wdf
2008-02-22 22:14 --------- d-----w C:\Program Files\Common Files\Motorola Shared
2008-02-20 19:11 --------- d-----w C:\Program Files\Family Tree Maker 16
2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-02-20 05:32 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
2008-02-09 15:28 323,584 ----a-w C:\WINDOWS\system32\AudioGenie2.dll
2008-01-28 21:08 1,140,152 ----a-w C:\WINDOWS\system32\NMSDVDX.dll
2008-01-26 03:32 47,360 ----a-w C:\Documents and Settings\Owner.KevinP\Application Data\pcouffin.sys
.
(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
---- Directory of C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43} ----
2008-04-11 12:46 97 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\instance.dat
2008-04-11 12:46 8567 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\setup_blazemp.par
2008-04-11 12:46 196 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\setup_blazemp.dat
2008-04-11 12:46 0 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\{56759C22-EA1E-4BE5-A903-72F67D450F43}
2008-04-11 12:46 0 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\{C8C8387B-A98B-44E8-807A-1A9B7F51FFDA}
2008-04-11 12:45 0 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\WinRun6-SP6\{56759C22-EA1E-4BE5-A903-72F67D450F43}
2008-03-20 14:26 3017402 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\setup_blazemp.res
2008-03-20 14:26 2370880 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\setup_blazemp.exe
2008-03-20 14:25 579156 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\mia.lib
2008-03-20 14:25 3486048 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\59F37AFC\8917324D\BMP.exe
2008-03-20 14:25 299008 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\setup_blazemp.msi
2008-03-20 13:54 888832 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\5640A05\BE9F39B8\viscomflvdec_licenseto_MystikMedia.dll
2008-03-19 17:44 278528 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\D8CABF01\BE9F39B8\VideoEdit.ocx
2008-03-12 23:46 114688 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\B56D42E\1D442A03\dvdripper.ocx
2008-03-12 21:42 192512 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\D50C4D1B\1D442A03\viscommpgdecrip.dll
2008-03-09 23:24 401408 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\87A7D043\32F7A4D1\Asoedmms.ocx
2008-03-09 22:39 880640 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\5CB83A3B\A730A4AF\asrecmms.ocx
2008-03-09 21:34 155648 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\7EC83F15\8917324D\cp.exe
2008-03-09 15:54 1099264 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\3D2919A7\32F7A4D1\AdjMmsEng.dll
2008-03-05 20:05 1462272 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\C90C6D8F\1D442A03\viscomavenc.dll
2008-03-05 15:28 323584 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\691CA9DF\1D442A03\viscomdvds.dll
2008-02-09 10:28 323584 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\AFC491F9\AF8C2D79\AudioGenie2.dll
2008-01-28 16:08 1140152 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\64EE1E3F\21DDFF8E\NMSDVDX.dll
2008-01-07 14:23 339968 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\AD38ADA6\BE9F39B8\viscomqtde.dll
2007-12-27 02:55 484 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\3439E350\8917324D\BMP.exe.manifest
2007-11-16 14:52 188416 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\5E036521\BE9F39B8\viscommpgdec.dll
2007-10-12 08:34 71096 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\EF85244B\21DDFF8E\NMSAccess.exe
2007-09-28 20:48 192512 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\9F630A2F\4CE0045E\DirectEncode.dll
2007-09-28 20:48 184320 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\581ACB33\4CE0045E\erdmpg-5.3.dll
2007-09-23 15:23 1462272 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\2267BC26\BE9F39B8\viscomflvenc_licenseto_MystikMedia.dll
2007-09-21 23:00 1454080 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\E12C82FD\BE9F39B8\viscomdata2.dll
2007-06-27 14:43 143360 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\879D649D\BE9F39B8\viscomqtenc.dll
2007-05-29 17:57 425262 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\9955E409\2E9DA2D4\blazemp.zip
2007-05-09 22:40 1462272 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\A5327326\BE9F39B8\viscom3gpenc.dll
2007-04-22 15:53 1470464 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\86784D0\BE9F39B8\viscomdata3.dll
2007-04-02 19:23 1462272 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\30AB743C\BE9F39B8\viscomdata1.dll
2007-03-11 04:32 229376 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\404E5980\6721F1B2\AudioConverterAX.ocx
2007-03-04 16:54 86016 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\DA6E97FC\BE9F39B8\viscomframe.dll
2007-02-26 15:13 6963712 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\C25E605E\BE9F39B8\videotrans.dll
2007-02-26 15:13 452608 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\20A462E5\BE9F39B8\videoformat.dll
2007-02-26 15:13 19456 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\D77A6370\BE9F39B8\videocore.dll
2007-02-18 10:05 1225216 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\E0B3AB96\6721F1B2\dx8vb.dll
2006-12-06 11:59 94208 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\B18CBFF8\BE9F39B8\viscomaudiodata.dll
2006-12-05 15:19 110592 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\240ECBFB\BE9F39B8\viscomaudioencoder.dll
2006-11-06 14:30 262144 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\99CA5061\BE9F39B8\lame_enc.dll
2006-10-21 12:59 262144 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\7DC8CFBD\F4168408\Manipulate.dll
2006-09-24 20:53 268242 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\E00BAD2A\4CE0045E\erdmpg-parse.dll
2006-09-24 20:53 2518779 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\65466D78\4CE0045E\erdmpg-enc.dll
2006-09-24 20:52 30693 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\E95C0819\4CE0045E\erdmpg-int.dll
2006-08-19 22:42 439121 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\9955E409\2E9DA2D4\blazemp.chm
2006-07-13 19:57 382976 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\WinRun6-SP6\mVB.dll\mVBExec.dll
2006-06-25 14:56 176128 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\C427F1D\D80F3F6C\dvdauthor.ocx
2006-05-02 21:16 98304 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\63B71039\BE9F39B8\viscomtran.dll
2006-01-17 17:50 98304 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\C7412475\3A450264\VideoInfo.dll
2005-12-31 09:19 1097728 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\803D441E\6721F1B2\vorbis.dll
2005-12-31 09:13 24576 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\DF1B41F1\6721F1B2\ogg.dll
2005-11-30 06:49 161792 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\7A838819\6721F1B2\lame_enc.dll
2005-11-05 17:34 145408 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\46DCAF14\431AE4FA\Lame.exe
2005-10-14 22:10 65536 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\CCE4E3A6\1AD538CD\comLyricGetter.dll
2005-07-10 10:58 483401 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\39E281B2\A01B9A47\Input32X.ocx
2005-06-10 13:31 643 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\D45CC34F\AF8C2D79\AudioGenie2.exe.manifest
2005-06-01 12:15 966144 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\EA6EBFA3\FFFF89BC\NCTAudioInformation2.dll
2005-05-31 13:09 14511 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\65327F3B\8917324D\blazemp.lng
2005-04-15 18:58 1071088 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\85E36AE0\8FD17A8B\MSCOMCTL.OCX
2005-03-18 15:01 626688 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\CED1CDE5\F0B0E335\NCTImageFile.dll
2005-02-09 23:26 86016 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\1BFDA811\F62D5284\ExControl.dll
2005-02-05 17:18 32768 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\1C419080\387EEA1E\IsDRM.dll
2005-02-02 15:07 1773568 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\D5CB3195\BE9F39B8\gdiplus.dll
2004-12-07 19:18 679936 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\D3DAA1F0\1207037A\videocapx.ocx
2004-11-12 20:27 74960 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\WinRun6-SP6\mVB.dll\ADVPACK.DLL
2004-11-12 20:27 598288 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\WinRun6-SP6\mVB.dll\oleaut32.dll
2004-11-12 20:27 4608 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\WinRun6-SP6\mVB.dll\W95INF32.DLL
2004-11-12 20:27 2272 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\WinRun6-SP6\mVB.dll\W95INF16.DLL
2004-11-12 20:27 22288 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\WinRun6-SP6\mVB.dll\comcat.dll
2004-11-12 20:27 17920 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\WinRun6-SP6\mVB.dll\stdole2.tlb
2004-11-12 20:27 164112 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\WinRun6-SP6\mVB.dll\olepro32.dll
2004-11-12 20:27 147728 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\WinRun6-SP6\mVB.dll\asycfilt.dll
2004-11-12 20:27 1386496 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\WinRun6-SP6\mVB.dll\msvbvm60.dll
2004-11-12 20:27 1069 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\WinRun6-SP6\mVB.dll\vbrun60.inf
2004-07-26 21:30 86016 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\F664D8C2\E1A92373\etOneOnly.ocx
2004-06-24 18:48 139264 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\AC55F148\97F5527C\voltoCDX.dll
2004-05-01 11:41 368640 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\3A539185\E87F2805\VCDBurner.ocx
2004-04-06 16:55 235520 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\EDB26782\3B42FB20\fldrvw51.ocx
2004-03-09 00:00 152848 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\89A0310F\8FD17A8B\COMDLG32.OCX
2004-02-23 00:00 78848 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\DA06123E\431AE4FA\MSBIND.DLL
2004-02-01 14:21 97280 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\D7552C32\B7886AB6\Uncommon.dll
2003-10-29 09:43 253952 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\24A1ED17\2302A1E7\SkinBoxer43.dll
2003-08-27 15:43 499712 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\E06A9868\39093834\msvcp71.dll
2003-08-19 03:31 81920 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\4978668B\BE9F39B8\viscomwave.dll
2003-05-14 21:07 389120 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\FE0C59A2\431AE4FA\actskn43.ocx
2003-05-13 19:20 24576 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\1EB8D3D\5D8C36FC\AffCreatorDLL.dll
2003-04-19 23:28 73728 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\75CF61C5\2D911E49\vumeter.ax
2003-03-19 13:19 1060864 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\70D4C4DC\39093834\MFC71.dll
2003-03-19 12:12 1047552 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\439155E1\1D442A03\MFC71u.dll
2003-02-21 20:42 348160 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\5B78C3B4\39093834\msvcr71.dll
2002-11-02 00:27 143360 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\AD299E2E\2D911E49\Media.ocx
2002-10-04 18:37 135168 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\A3949050\8917324D\Lyrics.mdb
2002-09-22 18:41 5765 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\71747601\2302A1E7\memman.vxd
2002-09-22 16:16 7809 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\811793EB\8917324D\autoupdate.jpg
2002-09-15 22:32 676 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\1E7EFA60\97F5527C\volto_CR5AXQ.lic
2002-07-19 10:48 157696 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\63E85F6B\431AE4FA\OggEnc.exe
2002-06-25 06:28 40960 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\41BBA404\FFFF89BC\wavdest.ax
2001-12-07 08:45 448192 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\CD4A9BF0\1D139F4\Tab32x30.ocx
2000-11-29 03:07 307200 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\85ECF41D\CDC1F3D7\msvcr70.dll
1998-12-02 09:11 143360 --a------ C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}\offline\E8DCC26C\CDC1F3D7\Unzip32.dll
((((((((((((((((((((((((((((( snapshot@2008-04-14_15.26.08.07 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-04-15 18:25:42 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_a38.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c3dc0ae9-021f-4af7-90a3-bf3fa55ddd25}]
2008-03-13 10:30 1524248 --a------ C:\Program Files\Arrowheads_Plus\tbArro.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{C3DC0AE9-021F-4AF7-90A3-BF3FA55DDD25}"= "C:\Program Files\Arrowheads_Plus\tbArro.dll" [2008-03-13 10:30 1524248]
[HKEY_CLASSES_ROOT\clsid\{c3dc0ae9-021f-4af7-90a3-bf3fa55ddd25}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{C3DC0AE9-021F-4AF7-90A3-BF3FA55DDD25}"= C:\Program Files\Arrowheads_Plus\tbArro.dll [2008-03-13 10:30 1524248]
[HKEY_CLASSES_ROOT\clsid\{c3dc0ae9-021f-4af7-90a3-bf3fa55ddd25}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2008-01-21 00:32 171448]
"DAEMON Tools Pro Agent"="C:\Program Files\DAEMON Tools Pro\DTProAgent.exe" [2007-09-06 08:08 136136]
"LightScribe Control Panel"="C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-12-05 13:30 2295072]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 14:00 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-05 23:56 64512]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-01-20 23:48 169984]
"readericon"="C:\Program Files\Digital Media Reader\readericon45G.exe" [2005-12-09 21:44 139264]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-09-18 11:32 7204864]
"nwiz"="nwiz.exe" [2005-09-18 11:32 1519616 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2005-09-18 11:32 86016]
"CHotkey"="zHotkey.exe" [2004-12-08 20:57 550912 C:\WINDOWS\zHotkey.exe]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-07 20:07 61952 C:\WINDOWS\system32\HdAShCut.exe]
"HostManager"="C:\Program Files\Common Files\AOL\1200891526\EE\AOLHostManager.exe" [2004-11-03 16:03 125528]
"AOL Spyware Protection"="C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe" [2004-10-18 20:42 79448]
"RTHDCPL"="RTHDCPL.EXE" [2005-09-14 14:38 14820864 C:\WINDOWS\RTHDCPL.EXE]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 12:09 63712]
"MSKDetectorExe"="C:\Program Files\McAfee\SpamKiller\MSKDetct.exe" [2005-08-12 19:16 1121792]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-01-25 22:29 579072]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 01:47 31016]
"OpwareSE2"="C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" [2003-05-08 12:00 49152]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-01-20 23:59 98304]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 04:25 6731312]
"NeroFilterCheck"="C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe" [2007-03-01 15:57 153136]
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-09-20 09:51 1836328]
"Spyhunter Security Suite"="C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe" [2008-01-23 15:47 847872]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-01-25 22:28 219136]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"C:\\Program Files\\America Online 9.0\\waol.exe"=
"C:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltsmon.exe"=
"C:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltpspd.exe"=
"C:\\Program Files\\Common Files\\AOL\\1200891526\\EE\\AOLServiceHost.exe"=
"C:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe"=
"C:\\Program Files\\Common Files\\AOL\\AOL Spyware Protection\\AOLSP Scheduler.exe"=
"C:\\Program Files\\Common Files\\AOL\\AOL Spyware Protection\\asp.exe"=
"C:\\Program Files\\Common Files\\AolCoach\\en_en\\player\\AOLNySEV.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
S3 MotDev;Motorola Inc. USB Device;C:\WINDOWS\system32\DRIVERS\motodrv.sys [2006-12-14 01:39]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7fa12f01-c7da-11dc-ba6e-806d6172696f}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe folder.htt 480 480
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
.
Contents of the 'Scheduled Tasks' folder
"2008-01-21 05:27:28 C:\WINDOWS\Tasks\ISP signup reminder 1.job"
- C:\WINDOWS\system32\OOBE\oobebaln.exe
.
**************************************************************************
catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2008-04-15 13:46:31
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\Program Files\Enigma Software Group\SpyHunter\SpyHunterMonitor.dll
PROCESS: C:\WINDOWS\system32\lsass.exe
-> C:\Program Files\Enigma Software Group\SpyHunter\SpyHunterMonitor.dll
.
Completion time: 2008-04-15 13:47:12
ComboFix-quarantined-files.txt 2008-04-15 18:46:57
ComboFix2.txt 2008-04-14 20:26:42
Pre-Run: 130,044,776,448 bytes free
Post-Run: 130,028,118,016 bytes free
.
2008-04-11 08:03:26 --- E O F ---
Malwarebytes' Anti-Malware 1.11Database version: 633
Scan type: Full Scan (C:\|D:\|J:\|)
Objects scanned: 185939
Time elapsed: 47 minute(s), 32 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 11
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 16
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
HKEY_CLASSES_ROOT\AppID\{f663b917-591f-4172-8d87-3d7d729007ca} (Adware.Batco) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\bat.batbho (Adware.Batco) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\bat.batbho.1 (Adware.Batco) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{d279bc2b-a85b-4559-8fd9-ddc55f5d402d} (Adware.Batco) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{b80a3586-caa5-41c8-89bf-e617f0b6cfbf} (Adware.Batco) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\BATCO (Adware.Batco) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Batco (Adware.Batco) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\bat.DLL (Adware.Batco) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Bat (Adware.Batco) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Bat (Adware.Batco) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\xflock (Malware.Trace) -> Quarantined and deleted successfully.
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
C:\QooBox\Quarantine\C\Documents and Settings\All Users\Application Data\kpytkdel\uvcdwbqj.exe.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\Program Files\Bat\Bat.dll.vir (Adware.Batco) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\Program Files\Bat\Bat.exe.vir (Adware.Batco) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\Program Files\Bat\un_BatSetup_15041.exe.vir (Adware.Rabio) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\Program Files\Bat\X_Bat.exe.vir (Adware.Batco) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\000090.exe.vir (Trojan.Agent) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\dslaruhm.exe.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\edkzoxgr.exe.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\lwruzwpk.exe.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP1\A0000004.exe (Adware.Batco) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP2\A0000063.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP2\A0000064.dll (Adware.Batco) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP2\A0000066.exe (Adware.Batco) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP2\A0000068.exe (Adware.Rabio) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP2\A0000069.exe (Adware.Batco) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner.KevinP\Start Menu\Programs\Startup\Bat - Auto Update.lnk (Adware.Batco) -> Quarantined and deleted successfully.
File: EsPI.exe Status: INFECTED/MALWARE (Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database)
MD5: 0f1b3028a446db8ba1a7de4c19fc77bb
Packers detected: -
Bit9 reports: File not found
Scan taken on 15 Apr 2008 18:30:17 (GMT)
A-Squared Found nothing
AntiVir Found TR/Crypt.XPACK.Gen
ArcaVir Found nothing
Avast Found nothing
AVG Antivirus Found nothing
BitDefender Found nothing
ClamAV Found nothing
CPsecure Found nothing
Dr.Web Found nothing
F-Prot Antivirus Found nothing
F-Secure Anti-Virus Found nothing
Fortinet Found nothing
Ikarus Found nothing
Kaspersky Anti-Virus Found nothing
NOD32 Found nothing
Norman Virus Control Found nothing
Panda Antivirus Found nothing
Sophos Antivirus Found Sus/UnkPacker (probable variant)
VirusBuster Found nothing
VBA32 Found nothing
Logfile of Trend Micro HijackThis v2.0.2Scan saved at 2:41:53 PM, on 4/15/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltpspd.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Digital Media Reader\readericon45G.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\WINDOWS\zHotkey.exe
C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopDisplay.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\PROGRA~1\COMMON~1\AOL\120089~1\EE\AOLHOS~1.EXE
C:\WINDOWS\eHome\ehmsas.exe
C:\PROGRA~1\COMMON~1\AOL\120089~1\EE\AOLServiceHost.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\DAEMON Tools Pro\DTProAgent.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\BigFix\bigfix.exe
C:\Program Files\MagicDisc\MagicDisc.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\sol.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://my.att.net/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Arrowheads Plus Toolbar - {c3dc0ae9-021f-4af7-90a3-bf3fa55ddd25} - C:\Program Files\Arrowheads_Plus\tbArro.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Arrowheads Plus Toolbar - {c3dc0ae9-021f-4af7-90a3-bf3fa55ddd25} - C:\Program Files\Arrowheads_Plus\tbArro.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Arrowheads Plus Toolbar - {c3dc0ae9-021f-4af7-90a3-bf3fa55ddd25} - C:\Program Files\Arrowheads_Plus\tbArro.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [readericon] C:\Program Files\Digital Media Reader\readericon45G.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [CHotkey] zHotkey.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1200891526\EE\AOLHostManager.exe
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [Spyhunter Security Suite] "C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe" -minimized
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe"
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Startup: MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe
O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\bigfix.exe
O8 - Extra context menu item: E&xport to Microsoft Excel -
res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List -
res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print -
res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview -
res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print -
res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MIC273~1\Office12\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) -
http://ax.emsisoft.com/asquared.cabO16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) -
http://www.adobe.com/products/acrobat/nos/gp.cabO18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
--
End of file - 12004 bytes