Help! I Can't Get Rid Of Zlob Virusprotectpro

I need help! I have tried lots of "cleaners" and can't get rid of this Trojan.
HJT log file attached.


Logfile of HijackThis v1.99.1
Scan saved at 11:11:51 PM, on 7/20/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\IOGEAR\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\SiteAdvisor\6066\SAService.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe
C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WUSB54Gv42.exe
C:\WINDOWS\Explorer.EXE
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
C:\WINDOWS\system32\usb.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\SiteAdvisor\6066\SiteAdv.exe
C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
C:\Program Files\lg_fwupdate\fwupdate.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\windows\system\hpsysdrv.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2F1.EXE
C:\PROGRA~1\MUSICM~1\MUSICM~1\MMDiag.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mim.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\McAfee\Common Framework\UpdaterUI.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\PROGRA~1\PANICW~1\SPAMWA~1\SWasher.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
C:\PROGRA~1\Ahead\Ahead\data\Xtras\mssysmgr.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\IOGEAR\Bluetooth Software\BTTray.exe
C:\Program Files\CConnect\CConnect.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\PROGRA~1\IOGEAR\BLUETO~1\BTSTAC~1.EXE
C:\WINDOWS\system32\ntvdm.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqimzone.exe
C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
c:\program files\mcafee\msc\mcuimgr.exe
C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Documents and Settings\Owner\Desktop\HILACKTHIS\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.transworldevangelism.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us4.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://go.microsoft.com/fwlink/?LinkId=54843
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Cox High Speed Internet
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
O2 - BHO: DgnWebIE - {2843DAC1-05EF-11D2-95BA-0060083493D6} - C:\Program Files\Dragon Systems\NaturallySpeaking\Program\web_ie.dll
O2 - BHO: Freedom BHO - {56071E0D-C61B-11D3-B41C-00E02927A304} - C:\Program Files\Zero Knowledge\Freedom\FreeBHOR.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - c:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll
O3 - Toolbar: (no name) - {29C5A3B6-9A8D-4FA0-B5AD-3E20F4AA5C00} - (no file)
O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKLM\..\Run: [USB] C:\WINDOWS\system32\usb.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [SiteAdvisor] "C:\Program Files\SiteAdvisor\6066\SiteAdv.exe"
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~1\mimboot.exe
O4 - HKLM\..\Run: [LGODDFU] "C:\Program Files\lg_fwupdate\fwupdate.exe"
O4 - HKLM\..\Run: [InCD] "C:\Program Files\Ahead\InCD\InCD.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [EPSON Stylus Photo R300 Series] "C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2F1.EXE" /P30 "EPSON Stylus Photo R300 Series" /O6 "USB002" /M "Stylus Photo R300"
O4 - HKLM\..\Run: [DVDTray] "C:\Program Files\HP" DVD\Umbrella\DVDTray.exe
O4 - HKLM\..\Run: [DVDBitSet] "C:\Program Files\HP" DVD\Umbrella\DVDBitSet.exe /NOUI
O4 - HKLM\..\Run: [BJCFD] "C:\Program Files\BroadJump\Client Foundation\CFD.exe"
O4 - HKLM\..\Run: [-FreedomNeedsReboot] "C:\Program Files\Radialpoint\Radialpoint Security Services\ZkRunOnceR.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [masqform.exe] "C:\Program Files\PureEdge\Viewer 6.0\masqform.exe" -UpdateCurrentUser
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKCU\..\Run: [EPSON Stylus Photo R300 Series] "C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2F1.EXE" /P30 "EPSON Stylus Photo R300 Series" /M "Stylus Photo R300" /EF "HKCU"
O4 - HKCU\..\Run: [SpamWasher] "C:\PROGRA~1\PANICW~1\SPAMWA~1\SWasher.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] C:\PROGRA~1\Ahead\Ahead\data\Xtras\mssysmgr.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [EPSON Stylus Photo R260 Series] "C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBNA.EXE" /FU "C:\WINDOWS\TEMP\E_S38A.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [Zero Knowledge Freedom] "C:\Program Files\Zero Knowledge\Freedom\Freedom.exe"
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: CorrectConnect.lnk = C:\Program Files\CConnect\CConnect.exe
O4 - Global Startup: hp center UI.lnk = C:\Program Files\hp center\137903\Shadow\ShadowBar.exe
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/…html?p=ZJfox000
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth Device… - C:\Program Files\IOGEAR\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\npjpi160_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\npjpi160_01.dll
O9 - Extra button: MktBrowser - {17A27031-71FC-11d4-815C-005004D0F1FA} - C:\Program Files\MarketBrowser\lmt\MarketBrowser_Launch.xpy
O9 - Extra 'Tools' menuitem: MarketBrowser - {17A27031-71FC-11d4-815C-005004D0F1FA} - C:\Program Files\MarketBrowser\lmt\MarketBrowser_Launch.xpy
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\IOGEAR\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\IOGEAR\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - c:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.cox.net
O15 - Trusted Zone: musicoffaith.aavalue.com
O15 - Trusted Zone: *.canaca.com
O15 - Trusted Zone: *.cox.com
O15 - Trusted Zone: *.cox.net
O15 - Trusted Zone: http://www.dhl.com
O15 - Trusted Zone: http://www.dotster.com
O15 - Trusted Zone: *.gate.com
O15 - Trusted Zone: *.gmail.com
O15 - Trusted Zone: *.hotmail.com
O15 - Trusted Zone: http://forums.majorgeeks.com
O15 - Trusted Zone: *.majorgeeks.com
O15 - Trusted Zone: http://*.majorgeeks.com
O15 - Trusted Zone: http://us.mcafee.com
O15 - Trusted Zone: *.miracle-valley.org
O15 - Trusted Zone: *.miraclerevival.net
O15 - Trusted Zone: http://www.mycreditkeeper.com
O15 - Trusted Zone: homepage.ntl.com
O15 - Trusted Zone: homepage.ntlworld.com
O15 - Trusted Zone: http://www2.secureie.com
O15 - Trusted Zone: http://www.transworldevangelism.com
O15 - Trusted Zone: http://download.windowsupdate.com
O16 - DPF: {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} (MiniBugTransporterX Class) - http://wdownload.weatherbug.com/minibug/tr…Transporter.cab?
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m…84/mcinsctl.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m…,21/mcgdmgr.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {DBA230D1-8467-4e69-987E-5FAE815A3B45} -
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\IOGEAR\Bluetooth Software\bin\btwdins.exe
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Unknown owner - C:\Program Files\McAfee\Common Framework\FrameworkService.exe" /ServiceStart (file missing)
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - Unknown owner - C:\DOCUME~1\ALLUSE~1\APPLIC~1\McAfee\MSC\Updates\Installs\1\vso\%VSINS~1\mcods.exe (file missing)
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SiteAdvisor Service - McAfee, Inc. - C:\Program Files\SiteAdvisor\6066\SAService.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
O23 - Service: WUSB54Gv42SVC - Unknown owner - C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe" "WUSB54Gv42.exe (file missing)

I just ran Combo fix. Here is the log.

"Owner" - 2007-07-21 12:05:53 - ComboFix 07-07-14.6 - Service Pack 2 NTFS


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\Program Files\winupdates
C:\z.txt


((((((((((((((((((((((((( Files Created from 2007-06-21 to 2007-07-21 )))))))))))))))))))))))))))))))


2007-07-21 12:03 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-07-21 00:29 d——– C:\WINDOWS\LastGood
2007-07-21 00:28 374,752 –a—— C:\WINDOWS\SYSTEM32\WUSBGXP.sys
2007-07-21 00:28 339,488 –a—— C:\WINDOWS\SYSTEM32\WUSB20XP.sys
2007-07-21 00:28 245,376 –a—— C:\WINDOWS\SYSTEM32\rt2500usb.sys
2007-07-21 00:28 20,747 –a—— C:\WINDOWS\SYSTEM32\drivers\AegisP.sys
2007-07-21 00:27 d——– C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor
2007-07-21 00:02 53,248 –a—— C:\WINDOWS\SYSTEM32\Process.exe
2007-07-21 00:02 51,200 –a—— C:\WINDOWS\SYSTEM32\dumphive.exe
2007-07-21 00:02 288,417 –a—— C:\WINDOWS\SYSTEM32\SrchSTS.exe
2007-07-19 01:45 81,768 –a—— C:\WINDOWS\SYSTEM32\xinput1_3.dll
2007-07-19 01:45 443,752 –a—— C:\WINDOWS\SYSTEM32\d3dx10_34.dll
2007-07-19 01:45 443,752 –a—— C:\WINDOWS\SYSTEM32\d3dx10_33.dll
2007-07-19 01:45 3,497,832 –a—— C:\WINDOWS\SYSTEM32\d3dx9_34.dll
2007-07-19 01:45 3,495,784 –a—— C:\WINDOWS\SYSTEM32\d3dx9_33.dll
2007-07-19 01:45 3,426,072 –a—— C:\WINDOWS\SYSTEM32\d3dx9_32.dll
2007-07-19 01:45 266,088 –a—— C:\WINDOWS\SYSTEM32\xactengine2_8.dll
2007-07-19 01:45 261,480 –a—— C:\WINDOWS\SYSTEM32\xactengine2_7.dll
2007-07-19 01:45 255,848 –a—— C:\WINDOWS\SYSTEM32\xactengine2_6.dll
2007-07-19 01:45 251,672 –a—— C:\WINDOWS\SYSTEM32\xactengine2_5.dll
2007-07-19 01:45 237,848 –a—— C:\WINDOWS\SYSTEM32\xactengine2_4.dll
2007-07-19 01:45 2,414,360 –a—— C:\WINDOWS\SYSTEM32\d3dx9_31.dll
2007-07-19 01:45 18,280 –a—— C:\WINDOWS\SYSTEM32\x3daudio1_2.dll
2007-07-19 01:45 15,128 –a—— C:\WINDOWS\SYSTEM32\x3daudio1_1.dll
2007-07-19 01:45 1,124,720 –a—— C:\WINDOWS\SYSTEM32\D3DCompiler_34.dll
2007-07-19 01:45 1,123,696 –a—— C:\WINDOWS\SYSTEM32\D3DCompiler_33.dll
2007-07-19 01:44 62,744 –a—— C:\WINDOWS\SYSTEM32\xinput1_2.dll
2007-07-19 01:44 236,824 –a—— C:\WINDOWS\SYSTEM32\xactengine2_3.dll
2007-07-19 01:44 2,297,552 –a—— C:\WINDOWS\SYSTEM32\d3dx9_26.dll
2007-07-18 15:34 23,864 –a—— C:\WINDOWS\SYSTEM32\drivers\sskbfd.sys
2007-07-18 15:34 21,816 –a—— C:\WINDOWS\SYSTEM32\drivers\sshrmd.sys
2007-07-18 15:34 20,280 –a—— C:\WINDOWS\SYSTEM32\drivers\SSFS0BB8.sys
2007-07-18 15:34 160,056 –a—— C:\WINDOWS\SYSTEM32\drivers\ssidrv.sys
2007-07-18 15:34 1,520,952 –a—— C:\WINDOWS\WRSetup.dll
2007-07-18 15:34 d——– C:\Program Files\Webroot
2007-07-18 15:34 d——– C:\DOCUME~1\Owner\APPLIC~1\Webroot
2007-07-18 15:34 d——– C:\DOCUME~1\LOCALS~1\APPLIC~1\Webroot
2007-07-18 15:34 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Webroot
2007-07-18 11:12 164 –a—— C:\install.dat
2007-07-17 13:56 71,496 –a—— C:\WINDOWS\SYSTEM32\drivers\mfeavfk.sys
2007-07-17 10:29 d——– C:\DOCUME~1\ADMINI~1.WOR\APPLIC~1\Share-to-Web Upload Folder
2007-07-17 10:26 1,310,720 –ah—– C:\DOCUME~1\ADMINI~1.WOR\NTUSER.DAT
2007-07-17 10:26 d——– C:\DOCUME~1\ADMINI~1.WOR\WINDOWS
2007-07-17 10:26 d——– C:\DOCUME~1\ADMINI~1.WOR\APPLIC~1\InterTrust
2007-07-17 10:26 d——– C:\DOCUME~1\ADMINI~1.WOR\APPLIC~1\Corel
2007-07-16 23:58 d——– C:\QUARANTINE
2007-07-16 22:43 d——– C:\Program Files\Common Files\Cisco Systems
2007-07-16 22:43 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Network Associates
2007-07-15 22:44 d——– C:\Program Files\Registrar Registry Manager
2007-07-14 20:37 737,280 –a—— C:\WINDOWS\iun6002.exe
2007-07-14 20:37 135,168 –a—— C:\WINDOWS\SYSTEM32\DSKernel2.dll
2007-07-14 20:37 1,936,528 –a—— C:\WINDOWS\SYSTEM32\ltmm15.dll
2007-07-14 20:36 d——– C:\WINDOWS\Replay Media Catcher
2007-07-14 20:36 d——– C:\Program Files\Replay Media Catcher
2007-07-14 20:35 3,655,608 –a—— C:\Program Files\FLV PlayerRCATSetup.exe
2007-07-14 20:35 d——– C:\Program Files\Replay Converter
2007-07-14 20:34 25,990,432 –a—— C:\Program Files\FLV PlayerRCSetup.exe
2007-07-14 20:33 d——– C:\WINDOWS\FLV Player
2007-07-02 00:11 d——– C:\DOCUME~1\Owner\Bluetooth Software
2007-07-01 23:18 d——– C:\Program Files\IOGEAR


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-21 17:12:59 ——– d—–w C:\Program Files\lg_fwupdate
2007-07-21 05:02:47 5,436 —-a-w C:\WINDOWS\system32\tmp.reg
2007-07-21 03:29:48 ——– d—–w C:\DOCUME~1\Owner\APPLIC~1\Skype
2007-07-17 22:17:00 ——– d—–w C:\Program Files\McAfee
2007-07-17 17:18:34 ——– d—–w C:\Program Files\Common Files\McAfee
2007-07-17 14:58:43 ——– d—–w C:\Program Files\SiteAdvisor
2007-07-16 03:31:00 ——– d–h–w C:\Program Files\InstallShield Installation Information
2007-07-15 23:44:18 872 —-a-w C:\WINDOWS\freedom.backup.dat
2007-07-15 05:03:23 8,704 –s-a-w C:\WINDOWS\system32\onljweo.dll
2007-07-15 05:03:23 ——– d—–w C:\Program Files\EPSON Print CD
2007-07-12 16:37:42 ——– d—–w C:\Program Files\e-Sword
2007-06-22 10:34:47 ——– d—–w C:\DOCUME~1\Owner\APPLIC~1\Byte Readme Dart
2007-06-17 02:58:19 ——– d—–w C:\DOCUME~1\Owner\APPLIC~1\PureEdge
2007-06-17 02:56:22 ——– d—–w C:\Program Files\PureEdge
2007-06-13 20:09:47 ——– d—–w C:\Program Files\Avery Wizard 3.0
2007-06-13 19:42:30 ——– d—–w C:\Program Files\Common Files\Avery
2007-06-12 04:10:07 ——– d—–w C:\DOCUME~1\Owner\APPLIC~1\Freedom
2007-06-12 03:30:16 ——– d—–w C:\Program Files\Zero Knowledge
2007-06-12 03:28:08 ——– d—–w C:\DOCUME~1\Owner\APPLIC~1\Radialpoint
2007-06-12 02:54:01 ——– d—–w C:\Program Files\PC-Doctor for Windows XP
2007-06-04 04:01:28 ——– d—–w C:\Program Files\QuickTime
2007-06-01 02:04:30 ——– d—–w C:\DOCUME~1\Owner\APPLIC~1\Share-to-Web Upload Folder
2007-05-29 14:48:47 ——– d—–w C:\DOCUME~1\Owner\APPLIC~1\AdobeUM
2007-05-27 22:20:13 ——– d—–w C:\Program Files\SpywareBlaster
2007-05-16 15:12:02 683,520 —-a-w C:\WINDOWS\system32\inetcomm.dll
2007-05-11 17:54:15 524,288 —-a-w C:\WINDOWS\system32\DivXsm.exe
2007-05-11 04:37:15 823,296 —-a-w C:\WINDOWS\system32\divx_xx0c.dll
2007-05-11 04:37:15 823,296 —-a-w C:\WINDOWS\system32\divx_xx07.dll
2007-05-11 04:37:15 802,816 —-a-w C:\WINDOWS\system32\divx_xx11.dll
2007-05-11 04:37:15 740,442 —-a-w C:\WINDOWS\system32\DivX.dll
2007-04-25 14:21:15 144,896 —-a-w C:\WINDOWS\system32\schannel.dll
2007-04-23 00:15:29 3,596,288 —-a-w C:\WINDOWS\system32\qt-dx331.dll
2007-04-23 00:15:24 129,784 ——w C:\WINDOWS\system32\pxafs.dll
2007-04-23 00:15:24 118,520 -c—-w C:\WINDOWS\system32\pxinsi64.exe
2007-04-23 00:15:24 116,472 -c—-w C:\WINDOWS\system32\pxcpyi64.exe
2007-04-23 00:15:18 200,704 —-a-w C:\WINDOWS\system32\ssldivx.dll
2007-04-23 00:15:18 1,044,480 —-a-w C:\WINDOWS\system32\libdivx.dll
2007-04-23 00:02:34 73,728 —-a-w C:\WINDOWS\system32\dpl100.dll
2007-04-23 00:02:34 196,608 —-a-w C:\WINDOWS\system32\dtu100.dll
2007-04-23 00:02:33 53,248 -c–a-w C:\WINDOWS\system32\dpuGUI10.dll
2007-04-23 00:02:31 593,920 —-a-w C:\WINDOWS\system32\dpuGUI11.dll
2007-04-23 00:02:31 57,344 —-a-w C:\WINDOWS\system32\dpv11.dll
2007-04-23 00:02:31 344,064 —-a-w C:\WINDOWS\system32\dpus11.dll
2007-04-23 00:02:31 294,912 -c–a-w C:\WINDOWS\system32\dpu10.dll
2007-04-23 00:02:31 294,912 —-a-w C:\WINDOWS\system32\dpu11.dll
2007-04-23 00:01:47 12,288 —-a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2007-04-23 00:01:46 124,472 —-a-w C:\WINDOWS\system32\DivXCodecUpdateChecker.exe
2006-12-06 07:04:29 19,380 —ha-w C:\DOCUME~1\Owner\APPLIC~1\hpothb07.dat
2006-11-24 01:59:41 81,920 —-a-w C:\DOCUME~1\Owner\APPLIC~1\ezpinst.exe
2006-11-24 01:59:40 47,360 —-a-w C:\DOCUME~1\Owner\APPLIC~1\pcouffin.sys
2006-11-17 03:33:49 344 —-a-w C:\DOCUME~1\Owner\APPLIC~1\internaldb1942.dat
2005-01-21 18:17:58 592,671 -c–a-w C:\Program Files\wab.WAB
2004-10-01 21:00:16 40,960 -c–a-w C:\Program Files\Uninstall_CDS.exe
2007-03-09 07:12:32 27,648 –sha-w C:\WINDOWS\SYSTEM32\AVSredirect.dll


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2006-10-22 23:08 62080 –a—— C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{089FD14D-132B-48FC-8861-0048AE113215}]
2007-03-30 10:41 1099304 –a—— C:\Program Files\SiteAdvisor\6066\SiteAdv.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{22BF413B-C6D2-4d91-82A9-A0F997BA588C}]
2006-12-18 18:30 726568 –a—— C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2843DAC1-05EF-11D2-95BA-0060083493D6}]
2002-06-11 17:38 372790 –a—— C:\Program Files\Dragon Systems\NaturallySpeaking\Program\web_ie.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{56071E0D-C61B-11D3-B41C-00E02927A304}]
2002-07-19 17:28 143415 –a—— C:\Program Files\Zero Knowledge\Freedom\FreeBHOR.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
2007-03-14 03:43 501400 –a—— C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7DB2D5A0-7241-4E79-B68D-6309F01C5231}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FDD3B846-8D59-4ffb-8758-209B6AD74ACC}]
2001-07-25 13:00 143420 –a—— c:\Program Files\Microsoft Money\System\mnyviewer.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VirtualCloneDrive"="C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2004-08-20 05:28]
"USB"="C:\WINDOWS\system32\usb.exe" [2001-07-03 17:14]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2005-08-20 12:24]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]
"SiteAdvisor"="C:\Program Files\SiteAdvisor\6066\SiteAdv.exe" [2006-12-19 21:37]
"RemoteControl"="C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" [2003-12-08 18:35]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2001-06-15 18:34]
"NvCplDaemon"="RUNDLL32.exe" [2004-08-04 02:56 C:\WINDOWS\SYSTEM32\rundll32.exe]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50]
"MimBoot"="C:\PROGRA~1\MUSICM~1\MUSICM~1\mimboot.exe" [2006-01-19 11:06]
"LGODDFU"="C:\Program Files\lg_fwupdate\fwupdate.exe" [2005-04-12 11:11]
"InCD"="C:\Program Files\Ahead\InCD\InCD.exe" [2005-07-08 09:25]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2001-08-07 20:25]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 12:04]
"HP Software Update"="C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2006-02-19 03:41]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2001-08-07 19:36]
"EPSON Stylus Photo R300 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2F1.exe" [2003-06-04 03:00]
"DVDTray"="C:\Program Files\HP DVD\Umbrella\DVDTray.exe" [2003-07-23 12:42]
"DVDBitSet"="C:\Program Files\HP DVD\Umbrella\DVDBitSet.exe" [2003-07-18 12:49]
"BJCFD"="C:\Program Files\BroadJump\Client Foundation\CFD.exe" [2001-10-18 14:37]
"-FreedomNeedsReboot"="C:\Program Files\Radialpoint\Radialpoint Security Services\ZkRunOnceR.exe" []
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 11:09]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
"masqform.exe"="C:\Program Files\PureEdge\Viewer 6.0\masqform.exe" [2003-12-03 12:43]
"McAfeeUpdaterUI"="C:\Program Files\McAfee\Common Framework\UpdaterUI.exe" [2005-10-26 15:50]
"SpySweeper"="C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" [2007-06-21 18:57]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PowerBar"="" []
"EPSON Stylus Photo R300 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2F1.exe" [2003-06-04 03:00]
"SpamWasher"="C:\PROGRA~1\PANICW~1\SPAMWA~1\SWasher.exe" [2005-05-25 15:59]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2006-12-18 18:32]
"PopUpStopperFreeEdition"="C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe" [2003-10-29 12:01]
"PhotoShow Deluxe Media Manager"="C:\PROGRA~1\Ahead\Ahead\data\Xtras\mssysmgr.exe" [2004-11-11 20:50]
"NBJ"="C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" [2005-06-02 17:03]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 11:24]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 13:54]
"EPSON Stylus Photo R260 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBNA.exe" [2006-05-19 04:00]
"Zero Knowledge Freedom"="C:\Program Files\Zero Knowledge\Freedom\Freedom.exe" [2002-07-19 17:25]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{93994DE8-8239-4655-B1D1-5F4E91300429}"="C:\PROGRA~1\DVDREG~1\DVDShell.dll" [2004-10-09 16:18]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\WebrootSpySweeperService]

*Newly Created Service* - GTNDIS5
*Newly Created Service* - WUSB54GV42SVC

Contents of the 'Scheduled Tasks' folder
2007-07-15 02:36:11 C:\WINDOWS\tasks\AppleSoftwareUpdate.job
2007-07-15 06:23:35 C:\WINDOWS\tasks\McDefragTask.job
2007-07-02 04:42:43 C:\WINDOWS\tasks\McQcTask.job
2007-07-19 04:00:10 C:\WINDOWS\tasks\wrSpySweeper_L1568500EE1454FEF92CFE8436677E922.job

**************************************************************************

catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-21 12:14:24
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
PowerBar = ????????l?@?????????D??????w???????????????wl?@?l?@????? ???????????g??w???w???????w???wx??????????w???????? ??????????????|x???0????????????P?????w????????????????JY??????????????l?@?l?@????????w????t?@?????l?@?8?@?l?@?3??s????????????????????8?@?_??s8?@?8?@

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-21 12:17:01
C:\ComboFix-quarantined-files.txt … 2007-07-21 12:16

— E O F —