[Resolved] Help With Popup Removal/virus Protect Pro

Hi! Welcome to the WTT forums.
I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research.
Please be patient and I'd be grateful if you would note the following:

• I will working be on your Malware issues, this may or may not, solve other issues you have with your machine.
• The fixes are specific to your problem and should only be used for this issue on this machine.
• Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
• It's often worth reading through these instructions and printing them for ease of reference.
• If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
• Please reply to this thread. Do not start a new topic.

Download Deckard's System Scanner (DSS) to your Desktop. Note: You must be logged onto an account with administrator privileges.

• Close all applications and windows.
• Double-click on dss.exe to run it, and follow the prompts.
• When the scan is complete, two text files will open - main.txt <- this one will be maximized and extra.txt<-this one will be minimized
• Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of main.txt and the extra.txt to your post. in your reply

Scotty (also known as Mac70 at PCA)

Deckard's System Scanner v20070905.67
Run by [removed] on 2007-09-16 13:04:18
Computer is in Normal Mode.
——————————————————————————–

– System Restore ————————————————————–

Successfully created a Deckard's System Scanner Restore Point.


– Last 5 Restore Point(s) –
44: 2007-09-16 12:04:27 UTC - RP678 - Deckard's System Scanner Restore Point
43: 2007-09-13 00:29:09 UTC - RP677 - Software Distribution Service 3.0
42: 2007-09-12 17:23:41 UTC - RP676 - Removed SUPERAntiSpyware Free Edition
41: 2007-09-12 17:22:44 UTC - RP675 - Removed SUPERAntiSpyware Free Edition
40: 2007-09-12 17:21:27 UTC - RP674 - Removed Sonic RecordNow!


– First Restore Point –
1: 2007-06-16 12:52:20 UTC - RP635 - Software Distribution Service 3.0


Backed up registry hives.
Performed disk cleanup.



– HijackThis Clone ————————————————————

Emulating logfile of HijackThis v1.99.1
Scan saved at 2007-09-16 13:06:48
Platform: Windows XP Service Pack 2 (5.01.2600)
MSIE: Internet Explorer (6.00.2900.2180)

Running processes:
C:\WINDOWS\SYSTEM32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\SYSTEM32\services.exe
C:\WINDOWS\SYSTEM32\lsass.exe
C:\WINDOWS\SYSTEM32\ati2evxx.exe
C:\WINDOWS\SYSTEM32\svchost.exe
C:\WINDOWS\SYSTEM32\svchost.exe
C:\WINDOWS\SYSTEM32\ati2evxx.exe
C:\WINDOWS\SYSTEM32\spoolsv.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\WINDOWS\SYSTEM32\DSentry.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\McAfee.com\VSO\mcvsshld.exe
C:\Program Files\Thomson\SpeedTouch USB\dragdiag.exe
C:\Program Files\McAfee.com\VSO\McVSEscn.exe
C:\WINDOWS\SYSTEM32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\Program Files\Sony\SonicStage\SSAAD.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
F:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\SYSTEM32\ctfmon.exe
C:\Program Files\Kontiki\KHost.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
F:\Program Files\WirelessWii\ZDWlan.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Kontiki\KService.exe
C:\Program Files\McAfee.com\Agent\Mcdetect.exe
C:\Program Files\McAfee.com\Agent\McTskshd.exe
C:\Program Files\Common Files\Teleca Shared\Generic.exe
F:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Program Files\McAfee.com\VSO\mcvsrte.exe
C:\WINDOWS\SYSTEM32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\SYSTEM32\svchost.exe
C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\SYSTEM32\svchost.exe
C:\Program Files\McAfee.com\VSO\McShield.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Documents and Settings\Simon\Desktop\dss.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://news.bbc.co.uk/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.com/search?q=%s
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=17
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Freeserve
R1 - HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.freeserve.com/
R1 - HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
R1 - HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
R1 - HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
R0 - HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.euro.dell.com/countries/uk/enu/gen/default.htm
R1 - HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
R1 - HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - C:\Program Files\McAfee.com\VSO\mcvsshl.dll
O4 - HKEY_LOCAL_MACHINE\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKEY_LOCAL_MACHINE\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
O4 - HKEY_LOCAL_MACHINE\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKEY_LOCAL_MACHINE\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKEY_LOCAL_MACHINE\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKEY_LOCAL_MACHINE\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKEY_LOCAL_MACHINE\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKEY_LOCAL_MACHINE\..\Run: [VirusScan] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
O4 - HKEY_LOCAL_MACHINE\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKEY_LOCAL_MACHINE\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKEY_LOCAL_MACHINE\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKEY_LOCAL_MACHINE\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKEY_LOCAL_MACHINE\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKEY_LOCAL_MACHINE\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKEY_LOCAL_MACHINE\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKEY_LOCAL_MACHINE\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - HKEY_LOCAL_MACHINE\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKEY_LOCAL_MACHINE\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKEY_LOCAL_MACHINE\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKEY_LOCAL_MACHINE\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKEY_LOCAL_MACHINE\..\Run: [Sony Ericsson PC Suite] "F:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKEY_LOCAL_MACHINE\..\Run: [SpyHunter] C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter.exe
O4 - HKEY_LOCAL_MACHINE\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKEY_LOCAL_MACHINE\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [kdx] C:\Program Files\Kontiki\KHost.exe -all
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: AOL 8.0 Tray Icon.lnk = C:\Program Files\AOL 8.0\aoltray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: ZDWLan Utility.lnk = F:\Program Files\WirelessWii\ZDWlan.exe
O8 - Extra context menu item: + &Download; Express: download this file - f:\Program Files\Download Express\Add_Url.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (file missing)
O9 - Extra 'Tools' menuitem: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: Diagnose Connection Problems… - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} () - http://static.windupdates.com/cab/Download…/bridge-c11.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://fpdownload.macromedia.com/get/shock…director/sw.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/cha…v45/yacscom.cab
O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} () - http://download.microsoft.com/download/e/2…78f/wvc1dmo.cab
O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} (InstallShield Setup Player 2K2) - http://sib1.od2.com/common/Member/ClientIn…6/OCI/setup.exe
O16 - DPF: {4E62C4DE-627D-4604-B157-4B7D6B09F02E} (AccountTracking Profile Manager Class) - https://moneymanager.egg.com/Pinsafe/accounttracking.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by101fd.bay101.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} () - http://a1540.g.akamai.net/7/1540/52/200404…meInstaller.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1127126653289
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} (DmiReader Class) - http://support.euro.dell.com/global/apps/s…er/PROFILER.CAB
O16 - DPF: {B1E2B96C-12FE-45E2-BEF1-44A219113CDD} (SABScanProcesses Class) - http://www.superadblocker.com/activex/sabspx.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab Class) - http://www.systemrequirementslab.com/sysreqlab.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa…ash/swflash.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: C:\WINDOWS\system32\__c007606.dat
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - "C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe"
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - C:\Program Files\McAfee.com\Agent\Mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - C:\Program Files\McAfee.com\VSO\McShield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - C:\Program Files\McAfee.com\Agent\McTskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\Program Files\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe /Embedding
O23 - Service: MSCSPTISRV - Sony Corporation - "C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe"
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: PACSPTISVR - Sony Corporation - "C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe"
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - "C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe"
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - "C:\Program Files\Viewpoint\Common\ViewpointService.exe"
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - "C:\WINDOWS\wanmpsvc.exe"


– File Associations ———————————————————–

All associations okay.


– Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ———————

R0 agp440 (Intel AGP Bus Filter) - c:\windows\\systemroot\system32\drivers\agp440.sys (file missing)
R0 prohlp02 (StarForce Protection Helper Driver v2) - c:\windows\system32\drivers\prohlp02.sys

ComboFix 07-09-28.1 - Simon 2007-09-27 19:46:13.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.561 [GMT 1:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Simon\Application Data\macromedia\Flash Player\#SharedObjects\ZAVBZQC6\iforex.com
C:\Documents and Settings\Simon\Application Data\macromedia\Flash Player\#SharedObjects\ZAVBZQC6\iforex.com\Emerp\Events\flash_object.swf\user_data.sol
C:\Documents and Settings\Simon\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com
C:\Documents and Settings\Simon\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com\settings.sol
C:\WINDOWS\system32\__c007606.dat

.
((((((((((((((((((((((((( Files Created from 2007-08-28 to 2007-09-28 )))))))))))))))))))))))))))))))
.

2007-09-27 19:45 51,200 –a—— C:\WINDOWS\NirCmd.exe
2007-09-16 13:04 d——– C:\Deckard
2007-09-10 20:08 10,872 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\AvgAsCln.sys
2007-09-08 13:32 4,762 –a—— C:\WINDOWS\SYSTEM32\tmp.reg
2007-09-07 21:02 d——– C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2007-09-06 19:45 d——– C:\Program Files\Enigma Software Group
2007-09-06 13:59 d-a—— C:\Documents and Settings\All Users\Application Data\TEMP
2007-08-29 19:29 15,840 ——— C:\WINDOWS\SYSTEM32\DRIVERS\PFMODNT.SYS
2007-08-29 19:29 d——– C:\Program Files\Creative

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-28 19:53 ——— d——– C:\Documents and Settings\All Users\Application Data\Kontiki
2007-09-12 18:21 ——— d–h—– C:\Program Files\InstallShield Installation Information
2007-09-12 18:21 ——— d——– C:\Program Files\Sonic
2007-09-07 22:24 ——— d——– C:\Program Files\Ogwycey
2007-08-19 04:28 ——— d——– C:\Program Files\Kontiki
2007-08-19 04:28 ——— d——– C:\Program Files\Channel4
2007-08-19 04:26 ——— d——– C:\Documents and Settings\All Users\Application Data\Channel4
2007-07-28 06:44 45296 –a—— C:\WINDOWS\system32\drivers\ativvpxx.vp
2007-07-28 04:30 2371584 –a—— C:\WINDOWS\system32\drivers\ati2mtag.sys
2007-07-28 03:45 49152 –a—— C:\WINDOWS\system32\drivers\ati2erec.dll
.

– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [2003-11-19 17:48]
"IntelMeM"="C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe" [2003-09-03 20:12]
"PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [2003-08-26 19:47]
"DVDSentry"="C:\WINDOWS\System32\DSentry.exe" [2003-08-13 10:27]
"VSOCheckTask"="c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" [2003-08-08 18:02]
"MCAgentExe"="c:\PROGRA~1\mcafee.com\agent\mcagent.exe" [2005-09-22 19:29]
"MCUpdateExe"="C:\PROGRA~1\mcafee.com\agent\mcupdate.exe" [2006-01-11 13:05]
"VirusScan"="c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe" [2003-08-17 21:50]
"VirusScan Online"="c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe" [2003-08-17 21:50]
"SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 11:38]
"LVCOMSX"="C:\WINDOWS\System32\LVCOMSX.EXE" [2004-05-21 19:11]
"LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2004-06-01 11:09]
"LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2004-06-01 11:03]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-08-25 12:52]
"UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 02:01]
"SsAAD.exe"="C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe" [2005-06-03 08:16]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" []
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-16 18:15]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2006-10-30 10:36]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-12-19 20:19]
"Sony Ericsson PC Suite"="F:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 17:17]
"SpyHunter"="C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter.exe" [2007-04-26 16:04]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="" []
"LogitechSoftwareUpdate"="C:\Program Files\Logitech\Video\ManifestEngine.exe" [2004-06-01 10:46]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-28 17:17]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 08:56]
"kdx"="C:\Program Files\Kontiki\KHost.exe" [2007-04-23 11:23]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 21:05]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 23:05:26]
AOL 8.0 Tray Icon.lnk - C:\Program Files\AOL 8.0\aoltray.exe [2004-05-19 14:27:43]
DESKTOP.INI [2002-09-03 09:00:00]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 21:05:56]
ZDWLan Utility.lnk - F:\Program Files\WirelessWii\ZDWlan.exe [2007-01-13 19:23:29]

C:\Documents and Settings\Guest\Start Menu\Programs\Startup\
DESKTOP.INI [2002-09-03 09:00:00]

C:\Documents and Settings\Simon\Start Menu\Programs\Startup\
DESKTOP.INI [2002-09-03 09:00:00]
PowerReg Scheduler V3.exe [2005-03-14 17:12:23]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 23:05:26]
AOL 8.0 Tray Icon.lnk - C:\Program Files\AOL 8.0\aoltray.exe [2004-05-19 14:27:43]
DESKTOP.INI [2002-09-03 09:00:00]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 21:05:56]
ZDWLan Utility.lnk - F:\Program Files\WirelessWii\ZDWlan.exe [2007-01-13 19:23:29]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=C:\WINDOWS\system32\__c007606.dat

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WildTangent CDA]
RUNDLL32.exe "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain

R2 STEC3;STEC3;\??\C:\WINDOWS\system32\STEC3.sys
R3 NaiFiltr;NaiFiltr;C:\WINDOWS\system32\DRIVERS\NaiFiltr.sys
S3 efipsk;efipsk;\??\C:\DOCUME~1\Simon\LOCALS~1\Temp\efipsk.sys
S3 portio;portio;\??\C:\Program Files\Zinf\portio.sys
S3 SE27bus;Sony Ericsson Device 039 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\SE27bus.sys
S3 SE27mdfl;Sony Ericsson Device 039 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\SE27mdfl.sys
S3 SE27mdm;Sony Ericsson Device 039 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\SE27mdm.sys
S3 SE27mgmt;Sony Ericsson Device 039 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\SE27mgmt.sys
S3 se27nd5;Sony Ericsson Device 039 USB Ethernet Emulation SEMC39 (NDIS);C:\WINDOWS\system32\DRIVERS\se27nd5.sys
S3 SE27obex;Sony Ericsson Device 039 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\SE27obex.sys
S3 se27unic;Sony Ericsson Device 039 USB Ethernet Emulation SEMC39 (WDM);C:\WINDOWS\system32\DRIVERS\se27unic.sys
S3 ss_bus;Samsung Mobile USB Device 1.0 driver (WDM);C:\WINDOWS\system32\DRIVERS\ss_bus.sys
S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;C:\WINDOWS\system32\DRIVERS\ss_mdfl.sys
S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;C:\WINDOWS\system32\DRIVERS\ss_mdm.sys

.
Contents of the 'Scheduled Tasks' folder
"2006-12-10 20:01:40 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-28 19:52:50
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-09-28 19:55:54 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-09-28 19:55
.
— E O F —


I am unable to download and run HiJackthis -
"An error occured while trying to rename a file in the destination directory:
Movefile failed; code 5.
Access is denied."

Hi

Deckards System Scanner has HJT built in so no need to worry about that.

Open Notepad and Copy/Paste the text in the codebox below into it:

File::
C:\DOCUME~1\Simon\LOCALS~1\Temp\efipsk.sys
C:\WINDOWS\system32\__c007606.dat
C:\WINDOWS\orun32.isu

Folder::
C:\Program Files\Enigma Software Group
C:\Program Files\Ogwycey
C:\Program Files\Video ActiveX Access

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpyHunter"=-
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=""
 
Driver::
efipsk

Save this as "CFScript"

[external image: Posted Image]


Refering to the picture above, drag CFScript into ComboFix.exe
Then post the resultant log.

I see you are using Wild Tangent. It is not malware, but is sometimes thought to bring malware along. Wild Tangent is a video game software company specializing in online games. It has even made a partnership with AOL to include itself as part of the AOL Instant Messenger for their AIM games section. The WildTangent Web Driver is their technology that allows you to play 3D games over the Internet. Although it’s not technically considered spyware, it does have built in components to update itself and gather information about the computer system including

• Operating System Version
• CPU Type and Speed
• Memory Amount
  Video Card type and Driver Version
• Sound Card type and Driver Version
• DirectX Version
  Location that the Web Driver was installed from
• It is also a MAJOR resource hog.

For more information, see WildTangent Removal Instructions and Help and Inside Wild Tangent-Delivering High-End 3-D Content To A Web Site Near You.
Unless you are an extremely avid games player, I recommend you uninstall Wild Tangent: To uninstall Wild Tangent:

• Click Start, point to Settings, and then click Control Panel.
• In Control Panel, double-click Add or Remove Programs.
• In Add or Remove Programs, highlight Wild Tangent, click Remove.
• Close the Add or Remove Programs and the Control Panel windows.

I see that Viewpoint Manager, Viewpoint Media Player is installed. Viewpoint, Viewpoint Manager, Viewpoint Media Player are Viewpoint components which are installed as a side effect of installing other software, most notably AOL and AOL Instant Messenger (AIM). Viewpoint Manager is responsible for managing and updating Viewpoint Media Player’s components. You can disable this using the Viewpoint Manager Control Panel found in the Windows Control Panel menu. By selecting Disable auto‑updating for the Viewpoint Manager ‑‑ the player will no longer attempt to check for updates. Anything that is installed without your consent is suspect. Read what Viewpoint says and make your own decision.

To provide a satisfying consumer experience and to operate effectively, the Viewpoint Media Player periodically sends information to servers at Viewpoint. Each installation of the Viewpoint Media Player is identifiable to Viewpoint via a Customer Unique Identifier (CUID), an alphanumeric identifier embedded in the Viewpoint Media Player. The Viewpoint Media Player randomly generates the CUID during installation and uses it to indicate a unique installation of the product. A CUID is never connected to a user's name, email address, or other personal contact information. CUIDs are used for the sole purpose of filtering redundant information. Each of these information exchanges occurs anonymously.

Viewpoint Manager is considered as foistware instead of malware since it is installed without user's approval but doesn't spy or do anything "bad". This may change, read Viewpoint to Plunge Into Adware.
I recommend that you remove the Viewpoint products; however, decide for yourself. To uninstall the the Viewpoint components (Viewpoint, Viewpoint Manager, Viewpoint Media Player):

• Click Start, point to Settings, and then click Control Panel.
• In Control Panel, double-click Add or Remove Programs.
• In Add or Remove Programs, highlight Viewpoint Manager , click Remove.
• Do the same for each Viewpoint component.

ComboFix 07-09-28.1 - Simon 2007-10-02 18:56:42.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.582 [GMT 1:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Simon\Desktop\CFScript
* Created a new restore point

FILE::
C:\DOCUME~1\Simon\LOCALS~1\Temp\efipsk.sys
C:\WINDOWS\system32\__c007606.dat
C:\WINDOWS\orun32.isu
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\Enigma Software Group
C:\Program Files\Enigma Software Group\SpyHunter\Backup\{05EF74A5-E109-11D2-A566-444553540000}.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\{0E7AE465-EE8D-11D2-A566-444553540000}.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\{1113C0B6-5300-4D5D-B2D7-35C14B28341B}.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\{111D8B01-96C5-46DD-94D1-C6E8B1F69F44}.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\{15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6}.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\{16410859-886F-4579-BC1F-330A139D0F0F}.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\{1C3C4699-B285-475F-BE47-0B26088CE876}.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\{1C3C4699-B285-475F-BE47-0B26088CE876}0.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\{35ED7DFB-A8ED-4216-A4BB-BC08C326EF08}.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\{399A8818-2000-436C-9A55-0016E5E3D227}.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\{52889E01-CB46-11D2-96BC-00104B242E64}.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\{5C49CBD2-8ED7-439B-8668-32149F84A235}.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\{6E6CF8E5-D795-11D2-A566-444553540000}.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\{79884200-3ADE-11D3-AC39-00105A2057FA}.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\{7F23E6E5-0E79-4aee-B723-B1463805D5A9}.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\{810E95C2-F908-4E02-9B28-B92C3A778D0D}.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\{8ECF83A0-1AC9-11D4-8501-00A0CC5D1F63}.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\{AA0C96F9-A994-42D7-9543-842CF85E1BA7}.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\{B57613B6-EF02-4D96-99C6-70C9A2014A14}.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\{B9BA256A-075B-49ea-B9E2-7DBC2EF021D5}.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\{BDB9B021-CAFF-11D2-9780-00104B242EA3}.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\{C1DA7AB8-54FC-4971-9AFB-1BCB9AFC3AA2}.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\{C3A156D4-503F-4779-A673-657308D94FAF}.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\{D72AC8E7-F41D-11D2-A566-444553540000}.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\{DE3E540A-F0F2-4761-99BE-AFC6DC427E30}.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\{EA6F254D-1A8C-4518-8FE0-E9B94FD134ED}.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\{EC914A5C-7C4B-4AC8-8C86-C10FF5C0D23D}.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\{ECFBE6E0-1AC8-11D4-8501-00A0CC5D1F63}.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\{F06E2ABE-3A50-4079-BE25-FC100D9EAA25}.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\{F10493C1-D0B6-11D2-A566-444553540000}.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\{FA13A9FA-CA9B-11D2-9780-00104B242EA3}.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\{FA13AA2E-CA9B-11D2-9780-00104B242EA3}.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\{FA13AA3A-CA9B-11D2-9780-00104B242EA3}.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\{FA13AA3E-CA9B-11D2-9780-00104B242EA3}.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\{FA13AA40-CA9B-11D2-9780-00104B242EA3}.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\{FA13AA44-CA9B-11D2-9780-00104B242EA3}.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\{FA13AA46-CA9B-11D2-9780-00104B242EA3}.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\{FA13AA50-CA9B-11D2-9780-00104B242EA3}.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\{FA13AAFA-CA9B-11D2-9780-00104B242EA3}.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\{FECA7CFA-1083-4073-A98A-CF3389FCAF6A}.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\4oD.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0097241.exe.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0098960.exe.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0098961.exe.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0098962.exe.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0098963.exe.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\iesmin.exe.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\imsmn.exe.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\imsunst.exe.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\jdrm0302.dll.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\Microsoft_Windows_CurrentVersion_App Management_ARPCache_Internet Optimizer.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\Microsoft_Windows_CurrentVersion_App Management_ARPCache_Windows Safety Alert.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\setup.exe.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\Setup_Player.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\[removed][2].txt.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\simon@adecn[1].txt.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\simon@adrevenue[1].txt.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\simon@adrevenue[2].txt.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\simon@advertising[1].txt.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\[removed][1].txt.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\simon@atdmt[2].txt.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\[removed]-sys[2].txt.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\simon@goldenpalace[2].txt.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\[removed][2].txt.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\simon@msnportal.112.2o7[1].txt.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\[removed][1].txt.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\simon@pcturbopro[1].txt.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\simon@questionmarket[2].txt.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\[removed][2].txt.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\simon@serving-sys[2].txt.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\simon@sexvat[2].txt.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\[removed][1].txt.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\simon@sexymalecelebs[2].txt.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\simon@tribalfusion[1].txt.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\simon@trustedprotection[1].txt.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\[removed][2].txt.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\[removed][1].txt.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\[removed][1].txt.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\[removed][1].txt.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\simon@virginmedia[1].txt.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\simon@winantispyware[1].txt.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\[removed]-media[2].txt.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\[removed][1].txt.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\[removed][1].txt.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\[removed][1].txt.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\[removed][2].txt.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\[removed][2].txt.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\[removed][2].txt.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\[removed][1].txt.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\[removed][2].txt.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\[removed][1].txt.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\simon@xiti[1].txt.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\SOFTWARE_Microsoft_Windows_CurrentVersion_policies_explorer_run_rare.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\SOFTWARE_Microsoft_Windows_CurrentVersion_policies_explorer_run_user32_dll.
at
C:\Program Files\Enigma Software Group\SpyHunter\Backup\WildTangent.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\WT3D_WT.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\WT3D_WT_1.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\wtdmmp.dll.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\wtdmmpv.dll.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\wtvh.dll.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\WTVis_WTVisReceiver.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\WTVis_WTVisReceiver_1.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\WTVis_WTVisSender.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\WTVis_WTVisSender_1.dat
C:\Program Files\Enigma Software Group\SpyHunter\backupLog.dat
C:\Program Files\Enigma Software Group\SpyHunter\def.dat
C:\Program Files\Enigma Software Group\SpyHunter\def.dat.bak
C:\Program Files\Enigma Software Group\SpyHunter\Download\spyhunter_update.exe
C:\Program Files\Enigma Software Group\SpyHunter\EnigmaUpdater.dll
C:\Program Files\Enigma Software Group\SpyHunter\esgi_md5h.dll
C:\Program Files\Enigma Software Group\SpyHunter\Esgiutl1.dll
C:\Program Files\Enigma Software Group\SpyHunter\exclusions.dat
C:\Program Files\Enigma Software Group\SpyHunter\ExtendedRemover.dll
C:\Program Files\Enigma Software Group\SpyHunter\ExtendedScript.dat
C:\Program Files\Enigma Software Group\SpyHunter\INSTALL.LOG
C:\Program Files\Enigma Software Group\SpyHunter\install.sss
C:\Program Files\Enigma Software Group\SpyHunter\LSPFix.dll
C:\Program Files\Enigma Software Group\SpyHunter\purl.dat
C:\Program Files\Enigma Software Group\SpyHunter\readme.txt
C:\Program Files\Enigma Software Group\SpyHunter\settings.ini
C:\Program Files\Enigma Software Group\SpyHunter\SHSched.dll
C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter.chm
C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter.exe
C:\Program Files\Enigma Software Group\SpyHunter\support.log
C:\Program Files\Enigma Software Group\SpyHunter\Uninstall.exe
C:\Program Files\Ogwycey
C:\WINDOWS\orun32.isu

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))


——-\LEGACY_EFIPSK
——-\efipsk


((((((((((((((((((((((((( Files Created from 2007-09-02 to 2007-10-02 )))))))))))))))))))))))))))))))
.

2007-09-27 19:45 51,200 –a—— C:\WINDOWS\NirCmd.exe
2007-09-16 13:04 d——– C:\Deckard
2007-09-10 20:08 10,872 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\AvgAsCln.sys
2007-09-08 13:32 4,762 –a—— C:\WINDOWS\SYSTEM32\tmp.reg
2007-09-07 21:02 d——– C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2007-09-06 13:59 d-a—— C:\Documents and Settings\All Users\Application Data\TEMP

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-02 19:03 ——— d——– C:\Documents and Settings\All Users\Application Data\Kontiki
2007-09-12 18:21 ——— d–h—– C:\Program Files\InstallShield Installation Information
2007-09-12 18:21 ——— d——– C:\Program Files\Sonic
2007-08-29 19:29 ——— d——– C:\Program Files\Creative
2007-08-19 04:28 ——— d——– C:\Program Files\Kontiki
2007-08-19 04:28 ——— d——– C:\Program Files\Channel4
2007-08-19 04:26 ——— d——– C:\Documents and Settings\All Users\Application Data\Channel4
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [2003-11-19 17:48]
"IntelMeM"="C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe" [2003-09-03 20:12]
"PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [2003-08-26 19:47]
"DVDSentry"="C:\WINDOWS\System32\DSentry.exe" [2003-08-13 10:27]
"VSOCheckTask"="c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" [2003-08-08 18:02]
"MCAgentExe"="c:\PROGRA~1\mcafee.com\agent\mcagent.exe" [2005-09-22 19:29]
"MCUpdateExe"="C:\PROGRA~1\mcafee.com\agent\mcupdate.exe" [2006-01-11 13:05]
"VirusScan"="c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe" [2003-08-17 21:50]
"VirusScan Online"="c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe" [2003-08-17 21:50]
"SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 11:38]
"LVCOMSX"="C:\WINDOWS\System32\LVCOMSX.EXE" [2004-05-21 19:11]
"LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2004-06-01 11:09]
"LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2004-06-01 11:03]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-08-25 12:52]
"UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 02:01]
"SsAAD.exe"="C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe" [2005-06-03 08:16]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" []
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-16 18:15]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2006-10-30 10:36]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-12-19 20:19]
"Sony Ericsson PC Suite"="F:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 17:17]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="" []
"LogitechSoftwareUpdate"="C:\Program Files\Logitech\Video\ManifestEngine.exe" [2004-06-01 10:46]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-28 17:17]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 08:56]
"kdx"="C:\Program Files\Kontiki\KHost.exe" [2007-04-23 11:23]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 21:05]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 23:05:26]
AOL 8.0 Tray Icon.lnk - C:\Program Files\AOL 8.0\aoltray.exe [2004-05-19 14:27:43]
DESKTOP.INI [2002-09-03 09:00:00]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 21:05:56]
ZDWLan Utility.lnk - F:\Program Files\WirelessWii\ZDWlan.exe [2007-01-13 19:23:29]

C:\Documents and Settings\Guest\Start Menu\Programs\Startup\
DESKTOP.INI [2002-09-03 09:00:00]

C:\Documents and Settings\Simon\Start Menu\Programs\Startup\
DESKTOP.INI [2002-09-03 09:00:00]
PowerReg Scheduler V3.exe [2005-03-14 17:12:23]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 23:05:26]
AOL 8.0 Tray Icon.lnk - C:\Program Files\AOL 8.0\aoltray.exe [2004-05-19 14:27:43]
DESKTOP.INI [2002-09-03 09:00:00]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 21:05:56]
ZDWLan Utility.lnk - F:\Program Files\WirelessWii\ZDWlan.exe [2007-01-13 19:23:29]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WildTangent CDA]
RUNDLL32.exe "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain

R2 STEC3;STEC3;\??\C:\WINDOWS\system32\STEC3.sys
R3 NaiFiltr;NaiFiltr;C:\WINDOWS\system32\DRIVERS\NaiFiltr.sys
S3 portio;portio;\??\C:\Program Files\Zinf\portio.sys
S3 SE27bus;Sony Ericsson Device 039 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\SE27bus.sys
S3 SE27mdfl;Sony Ericsson Device 039 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\SE27mdfl.sys
S3 SE27mdm;Sony Ericsson Device 039 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\SE27mdm.sys
S3 SE27mgmt;Sony Ericsson Device 039 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\SE27mgmt.sys
S3 se27nd5;Sony Ericsson Device 039 USB Ethernet Emulation SEMC39 (NDIS);C:\WINDOWS\system32\DRIVERS\se27nd5.sys
S3 SE27obex;Sony Ericsson Device 039 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\SE27obex.sys
S3 se27unic;Sony Ericsson Device 039 USB Ethernet Emulation SEMC39 (WDM);C:\WINDOWS\system32\DRIVERS\se27unic.sys
S3 ss_bus;Samsung Mobile USB Device 1.0 driver (WDM);C:\WINDOWS\system32\DRIVERS\ss_bus.sys
S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;C:\WINDOWS\system32\DRIVERS\ss_mdfl.sys
S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;C:\WINDOWS\system32\DRIVERS\ss_mdm.sys

.
Contents of the 'Scheduled Tasks' folder
"2006-12-10 20:01:40 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-02 19:03:22
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-10-02 19:05:59 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-10-02 19:05
C:\ComboFix2.txt … 2007-09-28 19:55
.
— E O F —

ComboFix 07-09-28.1 - Simon 2007-10-04 21:52:51.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.487 [GMT 1:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
.

((((((((((((((((((((((((( Files Created from 2007-09-04 to 2007-10-04 )))))))))))))))))))))))))))))))
.

2007-10-04 18:52 d——– C:\WINDOWS\SYSTEM32\Kaspersky Lab
2007-10-04 18:52 d——– C:\WINDOWS\LastGood
2007-10-04 18:52 d——– C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-09-27 19:45 51,200 –a—— C:\WINDOWS\NirCmd.exe
2007-09-16 13:04 d——– C:\Deckard
2007-09-10 20:08 10,872 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\AvgAsCln.sys
2007-09-08 13:32 4,762 –a—— C:\WINDOWS\SYSTEM32\tmp.reg
2007-09-07 21:02 d——– C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2007-09-06 13:59 d-a—— C:\Documents and Settings\All Users\Application Data\TEMP

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-04 21:56 ——— d——– C:\Documents and Settings\All Users\Application Data\Kontiki
2007-09-12 18:21 ——— d–h—– C:\Program Files\InstallShield Installation Information
2007-09-12 18:21 ——— d——– C:\Program Files\Sonic
2007-08-29 19:29 ——— d——– C:\Program Files\Creative
2007-08-19 04:28 ——— d——– C:\Program Files\Kontiki
2007-08-19 04:28 ——— d——– C:\Program Files\Channel4
2007-08-19 04:26 ——— d——– C:\Documents and Settings\All Users\Application Data\Channel4
2007-07-30 19:19 92504 –a—— C:\WINDOWS\SYSTEM32\DLLCACHE\cdm.dll
2007-07-30 19:19 92504 –a—— C:\WINDOWS\SYSTEM32\cdm.dll
2007-07-30 19:19 549720 –a—— C:\WINDOWS\SYSTEM32\wuapi.dll
2007-07-30 19:19 549720 –a—— C:\WINDOWS\SYSTEM32\DLLCACHE\wuapi.dll
2007-07-30 19:19 53080 –a—— C:\WINDOWS\SYSTEM32\wuauclt.exe
2007-07-30 19:19 53080 –a—— C:\WINDOWS\SYSTEM32\DLLCACHE\wuauclt.exe
2007-07-30 19:19 43352 –a—— C:\WINDOWS\SYSTEM32\wups2.dll
2007-07-30 19:19 325976 –a—— C:\WINDOWS\SYSTEM32\wucltui.dll
2007-07-30 19:19 325976 –a—— C:\WINDOWS\SYSTEM32\DLLCACHE\wucltui.dll
2007-07-30 19:19 271224 –a—— C:\WINDOWS\SYSTEM32\mucltui.dll
2007-07-30 19:19 207736 –a—— C:\WINDOWS\SYSTEM32\muweb.dll
2007-07-30 19:19 203096 –a—— C:\WINDOWS\SYSTEM32\wuweb.dll
2007-07-30 19:19 203096 –a—— C:\WINDOWS\SYSTEM32\DLLCACHE\wuweb.dll
2007-07-30 19:19 1712984 –a—— C:\WINDOWS\SYSTEM32\wuaueng.dll
2007-07-30 19:19 1712984 –a—— C:\WINDOWS\SYSTEM32\DLLCACHE\wuaueng.dll
2007-07-30 19:18 33624 –a—— C:\WINDOWS\SYSTEM32\wups.dll
2007-07-30 19:18 33624 –a—— C:\WINDOWS\SYSTEM32\DLLCACHE\wups.dll
2007-07-28 04:37 8237056 –a—— C:\WINDOWS\SYSTEM32\atioglx2.dll
2007-07-28 04:31 344064 –a—— C:\WINDOWS\SYSTEM32\ATIDEMGX.dll
2007-07-28 04:30 269312 –a—— C:\WINDOWS\SYSTEM32\ati2dvag.dll
2007-07-28 04:30 2371584 –a—— C:\WINDOWS\SYSTEM32\DLLCACHE\ati2mtag.sys
2007-07-28 04:24 307200 –a—— C:\WINDOWS\SYSTEM32\atiiiexx.dll
2007-07-28 04:23 143360 –a—— C:\WINDOWS\SYSTEM32\atipdlxx.dll
2007-07-28 04:23 122880 –a—— C:\WINDOWS\SYSTEM32\Oemdspif.dll
2007-07-28 04:22 43520 –a—— C:\WINDOWS\SYSTEM32\ati2edxx.dll
2007-07-28 04:22 26112 –a—— C:\WINDOWS\SYSTEM32\Ati2mdxx.exe
2007-07-28 04:22 118784 –a—— C:\WINDOWS\SYSTEM32\ati2evxx.dll
2007-07-28 04:21 483328 –a—— C:\WINDOWS\SYSTEM32\ati2evxx.exe
2007-07-28 04:20 53248 –a—— C:\WINDOWS\SYSTEM32\ATIDDC.DLL
2007-07-28 04:12 3067712 –a—— C:\WINDOWS\SYSTEM32\ati3duag.dll
2007-07-28 04:06 176128 –a—— C:\WINDOWS\SYSTEM32\atiok3x2.dll
2007-07-28 04:01 1550208 –a—— C:\WINDOWS\SYSTEM32\ativvaxx.dll
2007-07-28 03:50 5435392 –a—— C:\WINDOWS\SYSTEM32\atioglxx.dll
2007-07-28 03:47 266240 –a—— C:\WINDOWS\SYSTEM32\atikvmag.dll
2007-07-28 03:46 17408 –a—— C:\WINDOWS\SYSTEM32\atitvo32.dll
2007-07-28 03:40 450560 –a—— C:\WINDOWS\SYSTEM32\ati2cqag.dll
2007-07-27 21:05 593920 ——— C:\WINDOWS\SYSTEM32\ati2sgag.exe
.

((((((((((((((((((((((((((((( snapshot_2007-10-02_190531.70 )))))))))))))))))))))))))))))))))))))))))
.
—-a-w 213,048 2005-05-24 10:27:16 C:\WINDOWS\SYSTEM32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll
—-a-w 94,208 2007-09-07 10:29:00 C:\WINDOWS\SYSTEM32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe
—-a-w 946,176 2007-09-07 10:29:00 C:\WINDOWS\SYSTEM32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll
—-a-w 2,115,816 2007-06-11 20:34:34 C:\WINDOWS\SYSTEM32\Macromed\Flash\NPSWF32.dll
—-a-w 190,696 2007-06-11 20:34:40 C:\WINDOWS\SYSTEM32\Macromed\Flash\NPSWF32_FlashUtil.exe
—-a-w 45,218 2007-10-02 18:12:31 C:\WINDOWS\SYSTEM32\Macromed\Flash\uninstall_plugin.exe
—-atw 16,384 2007-10-04 17:25:14 C:\WINDOWS\Temp\Perflib_Perfdata_150.dat
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [2003-11-19 17:48]
"IntelMeM"="C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe" [2003-09-03 20:12]
"PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [2003-08-26 19:47]
"DVDSentry"="C:\WINDOWS\System32\DSentry.exe" [2003-08-13 10:27]
"VSOCheckTask"="c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" [2003-08-08 18:02]
"MCAgentExe"="c:\PROGRA~1\mcafee.com\agent\mcagent.exe" [2005-09-22 19:29]
"MCUpdateExe"="c:\PROGRA~1\mcafee.com\agent\mcupdate.exe" [2006-01-11 13:05]
"VirusScan"="c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe" [2003-08-17 21:50]
"VirusScan Online"="c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe" [2003-08-17 21:50]
"SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 11:38]
"LVCOMSX"="C:\WINDOWS\System32\LVCOMSX.EXE" [2004-05-21 19:11]
"LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2004-06-01 11:09]
"LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2004-06-01 11:03]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-08-25 12:52]
"UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 02:01]
"SsAAD.exe"="C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe" [2005-06-03 08:16]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" []
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-16 18:15]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2006-10-30 10:36]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-12-19 20:19]
"Sony Ericsson PC Suite"="F:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 17:17]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="" []
"LogitechSoftwareUpdate"="C:\Program Files\Logitech\Video\ManifestEngine.exe" [2004-06-01 10:46]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-28 17:17]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 08:56]
"kdx"="C:\Program Files\Kontiki\KHost.exe" [2007-04-23 11:23]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 21:05]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 23:05:26]
AOL 8.0 Tray Icon.lnk - C:\Program Files\AOL 8.0\aoltray.exe [2004-05-19 14:27:43]
DESKTOP.INI [2002-09-03 09:00:00]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 21:05:56]
ZDWLan Utility.lnk - F:\Program Files\WirelessWii\ZDWlan.exe [2007-01-13 19:23:29]

C:\Documents and Settings\Guest\Start Menu\Programs\Startup\
DESKTOP.INI [2002-09-03 09:00:00]

C:\Documents and Settings\Simon\Start Menu\Programs\Startup\
DESKTOP.INI [2002-09-03 09:00:00]
PowerReg Scheduler V3.exe [2005-03-14 17:12:23]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 23:05:26]
AOL 8.0 Tray Icon.lnk - C:\Program Files\AOL 8.0\aoltray.exe [2004-05-19 14:27:43]
DESKTOP.INI [2002-09-03 09:00:00]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 21:05:56]
ZDWLan Utility.lnk - F:\Program Files\WirelessWii\ZDWlan.exe [2007-01-13 19:23:29]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WildTangent CDA]
RUNDLL32.exe "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain

R2 STEC3;STEC3;\??\C:\WINDOWS\system32\STEC3.sys
R3 NaiFiltr;NaiFiltr;C:\WINDOWS\system32\DRIVERS\NaiFiltr.sys
S3 portio;portio;\??\C:\Program Files\Zinf\portio.sys
S3 SE27bus;Sony Ericsson Device 039 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\SE27bus.sys
S3 SE27mdfl;Sony Ericsson Device 039 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\SE27mdfl.sys
S3 SE27mdm;Sony Ericsson Device 039 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\SE27mdm.sys
S3 SE27mgmt;Sony Ericsson Device 039 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\SE27mgmt.sys
S3 se27nd5;Sony Ericsson Device 039 USB Ethernet Emulation SEMC39 (NDIS);C:\WINDOWS\system32\DRIVERS\se27nd5.sys
S3 SE27obex;Sony Ericsson Device 039 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\SE27obex.sys
S3 se27unic;Sony Ericsson Device 039 USB Ethernet Emulation SEMC39 (WDM);C:\WINDOWS\system32\DRIVERS\se27unic.sys
S3 ss_bus;Samsung Mobile USB Device 1.0 driver (WDM);C:\WINDOWS\system32\DRIVERS\ss_bus.sys
S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;C:\WINDOWS\system32\DRIVERS\ss_mdfl.sys
S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;C:\WINDOWS\system32\DRIVERS\ss_mdm.sys

.
Contents of the 'Scheduled Tasks' folder
"2006-12-10 20:01:40 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-04 21:57:14
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-10-04 21:58:29
C:\ComboFix-quarantined-files.txt … 2007-10-04 21:58
C:\ComboFix2.txt … 2007-10-02 19:05
C:\ComboFix3.txt … 2007-09-28 19:55
.
— E O F —






——————————————————————————-
KASPERSKY ONLINE SCANNER REPORT
Thursday, October 04, 2007 9:51:08 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.93.1
Kaspersky Anti-Virus database last update: 3/10/2007
Kaspersky Anti-Virus database records: 426853
——————————————————————————-

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\
E:\
F:\

Scan Statistics:
Total number of scanned objects: 139683
Number of viruses found: 8
Number of infected objects: 20
Number of suspicious objects: 0
Duration of the scan process: 01:51:06

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\Kontiki\error.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Logs\TaskScheduler\McTskshd000.log Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\INDEX.DAT Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\INDEX.DAT Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\INDEX.DAT Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Simon\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\archive.jar-13e1f81d-1f679512.zip/Gagaga.class Infected: Trojan-Dropper.Java.Beyond.g skipped
C:\Documents and Settings\Simon\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\archive.jar-13e1f81d-1f679512.zip/Vbagx.class Infected: Exploit.Java.ByteVerify skipped
C:\Documents and Settings\Simon\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\archive.jar-13e1f81d-1f679512.zip/Setupermf.class Infected: Trojan-Downloader.Java.OpenConnection.ac skipped
C:\Documents and Settings\Simon\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\archive.jar-13e1f81d-1f679512.zip ZIP: infected - 3 skipped
C:\Documents and Settings\Simon\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\ms0311.jar-202948a9-1f8cdcaf.zip/MagicApplet.class Infected: Trojan-Downloader.Java.OpenConnection.ao skipped
C:\Documents and Settings\Simon\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\ms0311.jar-202948a9-1f8cdcaf.zip/Installer.class Infected: Trojan-Downloader.Java.OpenConnection.ao skipped
C:\Documents and Settings\Simon\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\ms0311.jar-202948a9-1f8cdcaf.zip ZIP: infected - 2 skipped
C:\Documents and Settings\Simon\Application Data\Teleca\Telecalib\Logging\Application logs\SpecificUSB_log.txt Object is locked skipped
C:\Documents and Settings\Simon\Cookies\INDEX.DAT Object is locked skipped
C:\Documents and Settings\Simon\Desktop\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Documents and Settings\Simon\Desktop\SmitfraudFix\SmitfraudFix.zip/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Documents and Settings\Simon\Desktop\SmitfraudFix\SmitfraudFix.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Simon\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Simon\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Simon\Local Settings\History\History.IE5\INDEX.DAT Object is locked skipped
C:\Documents and Settings\Simon\Local Settings\History\History.IE5\MSHist012007100420071005\index.dat Object is locked skipped
C:\Documents and Settings\Simon\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Simon\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Simon\ntuser.dat.LOG Object is locked skipped
C:\qoobox\Quarantine\C\Program Files\Enigma Software Group\SpyHunter\Backup\imsunst.exe.dat.vir/Documents and Settings/Simon/Local Settings/Temp/temp.frC0EF/imsunst.exe Infected: Trojan-Downloader.Win32.Zlob.cmi skipped
C:\qoobox\Quarantine\C\Program Files\Enigma Software Group\SpyHunter\Backup\imsunst.exe.dat.vir ZIP: infected - 1 skipped
C:\qoobox\Quarantine\catchme2007-09-28_195242.53.zip/__c007606.dat Infected: Trojan.Win32.BHO.gz skipped
C:\qoobox\Quarantine\catchme2007-09-28_195242.53.zip ZIP: infected - 1 skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP657\A0098927.dll Infected: not-a-virus:AdWare.Win32.Agent.gz skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP657\A0098936.exe Infected: Trojan-Downloader.Win32.Zlob.cmi skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP670\A0099289.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP681\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{B4674607-4B13-4A13-B244-2CDF150EBB1E}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\SYSTEM32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\SYSTEM32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\ACEEvent.evt Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\AppEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\Internet.evt Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SAM Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SecEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SECURITY Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SysEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\H323LOG.TXT Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\Temp\Perflib_Perfdata_150.dat Object is locked skipped
C:\WINDOWS\WIADEBUG.LOG Object is locked skipped
C:\WINDOWS\WIASERVC.LOG Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
F:\Downloads\Apps\SmitfraudFix.exe/data.rar/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
F:\Downloads\Apps\SmitfraudFix.exe/data.rar Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
F:\Downloads\Apps\SmitfraudFix.exe RarSFX: infected - 2 skipped

Scan process completed.


Remove Wildtangent now, wasn't on add/remove programs, so ran the automatic removal.

Not getting any pop ups anymore f.y.i.

ComboFix 07-09-28.1 - Simon 2007-10-09 21:05:42.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.610 [GMT 1:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
.

((((((((((((((((((((((((( Files Created from 2007-09-09 to 2007-10-09 )))))))))))))))))))))))))))))))
.

2007-10-04 18:52 d——– C:\WINDOWS\SYSTEM32\Kaspersky Lab
2007-10-04 18:52 d——– C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-09-27 19:45 51,200 –a—— C:\WINDOWS\NirCmd.exe
2007-09-16 13:04 d——– C:\Deckard
2007-09-10 20:08 10,872 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\AvgAsCln.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-09 21:09 ——— d——– C:\Documents and Settings\All Users\Application Data\Kontiki
2007-09-12 18:21 ——— d–h—– C:\Program Files\InstallShield Installation Information
2007-09-12 18:21 ——— d——– C:\Program Files\Sonic
2007-09-11 19:39 4762 –a—— C:\WINDOWS\SYSTEM32\tmp.reg
2007-09-07 21:02 ——— d——– C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2007-09-06 18:58 ——— d-a—— C:\Documents and Settings\All Users\Application Data\TEMP
2007-08-29 19:29 ——— d——– C:\Program Files\Creative
2007-08-19 04:28 ——— d——– C:\Program Files\Kontiki
2007-08-19 04:28 ——— d——– C:\Program Files\Channel4
2007-08-19 04:26 ——— d——– C:\Documents and Settings\All Users\Application Data\Channel4
2007-07-30 19:19 92504 –a—— C:\WINDOWS\SYSTEM32\DLLCACHE\cdm.dll
2007-07-30 19:19 92504 –a—— C:\WINDOWS\SYSTEM32\cdm.dll
2007-07-30 19:19 549720 –a—— C:\WINDOWS\SYSTEM32\wuapi.dll
2007-07-30 19:19 549720 –a—— C:\WINDOWS\SYSTEM32\DLLCACHE\wuapi.dll
2007-07-30 19:19 53080 –a—— C:\WINDOWS\SYSTEM32\wuauclt.exe
2007-07-30 19:19 53080 –a—— C:\WINDOWS\SYSTEM32\DLLCACHE\wuauclt.exe
2007-07-30 19:19 43352 –a—— C:\WINDOWS\SYSTEM32\wups2.dll
2007-07-30 19:19 325976 –a—— C:\WINDOWS\SYSTEM32\wucltui.dll
2007-07-30 19:19 325976 –a—— C:\WINDOWS\SYSTEM32\DLLCACHE\wucltui.dll
2007-07-30 19:19 271224 –a—— C:\WINDOWS\SYSTEM32\mucltui.dll
2007-07-30 19:19 207736 –a—— C:\WINDOWS\SYSTEM32\muweb.dll
2007-07-30 19:19 203096 –a—— C:\WINDOWS\SYSTEM32\wuweb.dll
2007-07-30 19:19 203096 –a—— C:\WINDOWS\SYSTEM32\DLLCACHE\wuweb.dll
2007-07-30 19:19 1712984 –a—— C:\WINDOWS\SYSTEM32\wuaueng.dll
2007-07-30 19:19 1712984 –a—— C:\WINDOWS\SYSTEM32\DLLCACHE\wuaueng.dll
2007-07-30 19:18 33624 –a—— C:\WINDOWS\SYSTEM32\wups.dll
2007-07-30 19:18 33624 –a—— C:\WINDOWS\SYSTEM32\DLLCACHE\wups.dll
2007-07-28 04:37 8237056 –a—— C:\WINDOWS\SYSTEM32\atioglx2.dll
2007-07-28 04:31 344064 –a—— C:\WINDOWS\SYSTEM32\ATIDEMGX.dll
2007-07-28 04:30 269312 –a—— C:\WINDOWS\SYSTEM32\ati2dvag.dll
2007-07-28 04:30 2371584 –a—— C:\WINDOWS\SYSTEM32\DLLCACHE\ati2mtag.sys
2007-07-28 04:24 307200 –a—— C:\WINDOWS\SYSTEM32\atiiiexx.dll
2007-07-28 04:23 143360 –a—— C:\WINDOWS\SYSTEM32\atipdlxx.dll
2007-07-28 04:23 122880 –a—— C:\WINDOWS\SYSTEM32\Oemdspif.dll
2007-07-28 04:22 43520 –a—— C:\WINDOWS\SYSTEM32\ati2edxx.dll
2007-07-28 04:22 26112 –a—— C:\WINDOWS\SYSTEM32\Ati2mdxx.exe
2007-07-28 04:22 118784 –a—— C:\WINDOWS\SYSTEM32\ati2evxx.dll
2007-07-28 04:21 483328 –a—— C:\WINDOWS\SYSTEM32\ati2evxx.exe
2007-07-28 04:20 53248 –a—— C:\WINDOWS\SYSTEM32\ATIDDC.DLL
2007-07-28 04:12 3067712 –a—— C:\WINDOWS\SYSTEM32\ati3duag.dll
2007-07-28 04:06 176128 –a—— C:\WINDOWS\SYSTEM32\atiok3x2.dll
2007-07-28 04:01 1550208 –a—— C:\WINDOWS\SYSTEM32\ativvaxx.dll
2007-07-28 03:50 5435392 –a—— C:\WINDOWS\SYSTEM32\atioglxx.dll
2007-07-28 03:47 266240 –a—— C:\WINDOWS\SYSTEM32\atikvmag.dll
2007-07-28 03:46 17408 –a—— C:\WINDOWS\SYSTEM32\atitvo32.dll
2007-07-28 03:40 450560 –a—— C:\WINDOWS\SYSTEM32\ati2cqag.dll
2007-07-27 21:05 593920 ——— C:\WINDOWS\SYSTEM32\ati2sgag.exe
.

((((((((((((((((((((((((((((( snapshot_2007-10-02_190531.70 )))))))))))))))))))))))))))))))))))))))))
.
—-a-w 135,168 2007-09-24 21:30:28 C:\WINDOWS\SYSTEM32\java.exe
—-a-w 135,168 2007-09-24 21:30:30 C:\WINDOWS\SYSTEM32\javaw.exe
—-a-w 139,264 2007-09-24 22:31:42 C:\WINDOWS\SYSTEM32\javaws.exe
—-a-w 213,048 2005-05-24 10:27:16 C:\WINDOWS\SYSTEM32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll
—-a-w 94,208 2007-09-07 10:29:00 C:\WINDOWS\SYSTEM32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe
—-a-w 946,176 2007-09-07 10:29:00 C:\WINDOWS\SYSTEM32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll
—-a-w 2,115,816 2007-06-11 20:34:34 C:\WINDOWS\SYSTEM32\Macromed\Flash\NPSWF32.dll
—-a-w 190,696 2007-06-11 20:34:40 C:\WINDOWS\SYSTEM32\Macromed\Flash\NPSWF32_FlashUtil.exe
—-a-w 45,218 2007-10-02 18:12:31 C:\WINDOWS\SYSTEM32\Macromed\Flash\uninstall_plugin.exe
—-atw 16,384 2007-10-09 20:02:45 C:\WINDOWS\Temp\Perflib_Perfdata_50c.dat
.
—-a-w 24,681 2003-11-19 15:36:26 C:\WINDOWS\SYSTEM32\java.exe
—-a-w 28,779 2003-11-19 15:36:30 C:\WINDOWS\SYSTEM32\javaw.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelMeM"="C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe" [2003-09-03 20:12]
"PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [2003-08-26 19:47]
"DVDSentry"="C:\WINDOWS\System32\DSentry.exe" [2003-08-13 10:27]
"VSOCheckTask"="c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" [2003-08-08 18:02]
"MCAgentExe"="c:\PROGRA~1\mcafee.com\agent\mcagent.exe" [2005-09-22 19:29]
"MCUpdateExe"="C:\PROGRA~1\mcafee.com\agent\mcupdate.exe" [2006-01-11 13:05]
"VirusScan"="c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe" [2003-08-17 21:50]
"VirusScan Online"="c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe" [2003-08-17 21:50]
"SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 11:38]
"LVCOMSX"="C:\WINDOWS\System32\LVCOMSX.EXE" [2004-05-21 19:11]
"LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2004-06-01 11:09]
"LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2004-06-01 11:03]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-08-25 12:52]
"UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 02:01]
"SsAAD.exe"="C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe" [2005-06-03 08:16]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" []
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-16 18:15]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2006-10-30 10:36]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-12-19 20:19]
"Sony Ericsson PC Suite"="F:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 17:17]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="" []
"LogitechSoftwareUpdate"="C:\Program Files\Logitech\Video\ManifestEngine.exe" [2004-06-01 10:46]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-28 17:17]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 08:56]
"kdx"="C:\Program Files\Kontiki\KHost.exe" [2007-04-23 11:23]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 21:05]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 23:05:26]
AOL 8.0 Tray Icon.lnk - C:\Program Files\AOL 8.0\aoltray.exe [2004-05-19 14:27:43]
DESKTOP.INI [2002-09-03 09:00:00]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 21:05:56]
ZDWLan Utility.lnk - F:\Program Files\WirelessWii\ZDWlan.exe [2007-01-13 19:23:29]

C:\Documents and Settings\Guest\Start Menu\Programs\Startup\
DESKTOP.INI [2002-09-03 09:00:00]

C:\Documents and Settings\Simon\Start Menu\Programs\Startup\
DESKTOP.INI [2002-09-03 09:00:00]
PowerReg Scheduler V3.exe [2005-03-14 17:12:23]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 23:05:26]
AOL 8.0 Tray Icon.lnk - C:\Program Files\AOL 8.0\aoltray.exe [2004-05-19 14:27:43]
DESKTOP.INI [2002-09-03 09:00:00]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 21:05:56]
ZDWLan Utility.lnk - F:\Program Files\WirelessWii\ZDWlan.exe [2007-01-13 19:23:29]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WildTangent CDA]
RUNDLL32.exe "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain

R2 STEC3;STEC3;\??\C:\WINDOWS\system32\STEC3.sys
R3 NaiFiltr;NaiFiltr;C:\WINDOWS\system32\DRIVERS\NaiFiltr.sys
S3 portio;portio;\??\C:\Program Files\Zinf\portio.sys
S3 SE27bus;Sony Ericsson Device 039 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\SE27bus.sys
S3 SE27mdfl;Sony Ericsson Device 039 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\SE27mdfl.sys
S3 SE27mdm;Sony Ericsson Device 039 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\SE27mdm.sys
S3 SE27mgmt;Sony Ericsson Device 039 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\SE27mgmt.sys
S3 se27nd5;Sony Ericsson Device 039 USB Ethernet Emulation SEMC39 (NDIS);C:\WINDOWS\system32\DRIVERS\se27nd5.sys
S3 SE27obex;Sony Ericsson Device 039 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\SE27obex.sys
S3 se27unic;Sony Ericsson Device 039 USB Ethernet Emulation SEMC39 (WDM);C:\WINDOWS\system32\DRIVERS\se27unic.sys
S3 ss_bus;Samsung Mobile USB Device 1.0 driver (WDM);C:\WINDOWS\system32\DRIVERS\ss_bus.sys
S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;C:\WINDOWS\system32\DRIVERS\ss_mdfl.sys
S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;C:\WINDOWS\system32\DRIVERS\ss_mdm.sys

.
Contents of the 'Scheduled Tasks' folder
"2006-12-10 20:01:40 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-09 21:10:00
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-10-09 21:11:02
C:\ComboFix-quarantined-files.txt … 2007-10-09 21:11
C:\ComboFix2.txt … 2007-10-04 21:58
C:\ComboFix3.txt … 2007-10-02 19:05
.
— E O F —

ComboFix 07-10-11.8 - Simon 2007-10-12 18:49:17.6 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.595 [GMT 1:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Simon\Desktop\[removed]
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2007-09-12 to 2007-10-12 )))))))))))))))))))))))))))))))
.

2007-10-10 20:54 584,192 ——— C:\WINDOWS\SYSTEM32\DLLCACHE\rpcrt4.dll
2007-10-09 21:15 43,520 –a—— C:\WINDOWS\SYSTEM32\CmdLineExt03.dll
2007-10-09 20:42 d——– C:\Program Files\Common Files\Java
2007-10-04 18:52 d——– C:\WINDOWS\SYSTEM32\Kaspersky Lab
2007-10-04 18:52 d——– C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-09-27 19:45 51,200 –a—— C:\WINDOWS\NirCmd.exe
2007-09-16 13:04 d——– C:\Deckard

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-12 17:47 ——— d—–w C:\Documents and Settings\All Users\Application Data\Kontiki
2007-10-09 19:43 ——— d—–w C:\Program Files\Java
2007-09-12 17:21 ——— d–h–w C:\Program Files\InstallShield Installation Information
2007-09-12 17:21 ——— d—–w C:\Program Files\Sonic
2007-09-11 18:39 4,762 —-a-w C:\WINDOWS\SYSTEM32\tmp.reg
2007-09-10 19:08 ——— d—–w C:\Documents and Settings\Simon\Application Data\Grisoft
2007-09-10 19:08 ——— d—–w C:\Documents and Settings\All Users\Application Data\Grisoft
2007-09-07 20:02 ——— d—–w C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2007-09-06 17:58 ——— d—a-w C:\Documents and Settings\All Users\Application Data\TEMP
2007-08-29 18:29 ——— d—–w C:\Program Files\Creative
2007-08-22 12:55 96,256 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\inseng.dll
2007-08-22 12:55 665,600 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wininet.dll
2007-08-22 12:55 617,984 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\urlmon.dll
2007-08-22 12:55 55,808 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\extmgr.dll
2007-08-22 12:55 532,480 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\mstime.dll
2007-08-22 12:55 474,112 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\shlwapi.dll
2007-08-22 12:55 449,024 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\mshtmled.dll
2007-08-22 12:55 39,424 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\pngfilt.dll
2007-08-22 12:55 357,888 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\dxtmsft.dll
2007-08-22 12:55 3,064,832 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\mshtml.dll
2007-08-22 12:55 251,904 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\iepeers.dll
2007-08-22 12:55 205,824 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\dxtrans.dll
2007-08-22 12:55 16,384 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\jsproxy.dll
2007-08-22 12:55 151,040 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\cdfview.dll
2007-08-22 12:55 146,432 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\msrating.dll
2007-08-22 12:55 1,498,112 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\shdocvw.dll
2007-08-22 12:55 1,054,208 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\danim.dll
2007-08-22 12:55 1,022,976 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\browseui.dll
2007-08-21 10:19 18,432 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\iedw.exe
2007-08-21 06:15 683,520 —-a-w C:\WINDOWS\SYSTEM32\inetcomm.dll
2007-08-21 06:15 683,520 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\inetcomm.dll
2007-08-19 03:28 ——— d—–w C:\Program Files\Kontiki
2007-08-19 03:28 ——— d—–w C:\Program Files\Channel4
2007-08-19 03:26 ——— d—–w C:\Documents and Settings\All Users\Application Data\Channel4
2007-07-30 18:19 92,504 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\cdm.dll
2007-07-30 18:19 92,504 —-a-w C:\WINDOWS\SYSTEM32\cdm.dll
2007-07-30 18:19 549,720 —-a-w C:\WINDOWS\SYSTEM32\wuapi.dll
2007-07-30 18:19 549,720 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wuapi.dll
2007-07-30 18:19 53,080 —-a-w C:\WINDOWS\SYSTEM32\wuauclt.exe
2007-07-30 18:19 53,080 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wuauclt.exe
2007-07-30 18:19 43,352 —-a-w C:\WINDOWS\SYSTEM32\wups2.dll
2007-07-30 18:19 325,976 —-a-w C:\WINDOWS\SYSTEM32\wucltui.dll
2007-07-30 18:19 325,976 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wucltui.dll
2007-07-30 18:19 271,224 —-a-w C:\WINDOWS\SYSTEM32\mucltui.dll
2007-07-30 18:19 207,736 —-a-w C:\WINDOWS\SYSTEM32\muweb.dll
2007-07-30 18:19 203,096 —-a-w C:\WINDOWS\SYSTEM32\wuweb.dll
2007-07-30 18:19 203,096 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wuweb.dll
2007-07-30 18:19 1,712,984 —-a-w C:\WINDOWS\SYSTEM32\wuaueng.dll
2007-07-30 18:19 1,712,984 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wuaueng.dll
2007-07-30 18:18 33,624 —-a-w C:\WINDOWS\SYSTEM32\wups.dll
2007-07-30 18:18 33,624 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wups.dll
2007-07-28 03:37 8,237,056 —-a-w C:\WINDOWS\SYSTEM32\atioglx2.dll
2007-07-28 03:31 344,064 —-a-w C:\WINDOWS\SYSTEM32\ATIDEMGX.dll
2007-07-28 03:30 269,312 —-a-w C:\WINDOWS\SYSTEM32\ati2dvag.dll
2007-07-28 03:30 2,371,584 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\ati2mtag.sys
2007-07-28 03:24 307,200 —-a-w C:\WINDOWS\SYSTEM32\atiiiexx.dll
2007-07-28 03:23 143,360 —-a-w C:\WINDOWS\SYSTEM32\atipdlxx.dll
2007-07-28 03:23 122,880 —-a-w C:\WINDOWS\SYSTEM32\Oemdspif.dll
2007-07-28 03:22 43,520 —-a-w C:\WINDOWS\SYSTEM32\ati2edxx.dll
2007-07-28 03:22 26,112 —-a-w C:\WINDOWS\SYSTEM32\Ati2mdxx.exe
2007-07-28 03:22 118,784 —-a-w C:\WINDOWS\SYSTEM32\ati2evxx.dll
2007-07-28 03:21 483,328 —-a-w C:\WINDOWS\SYSTEM32\ati2evxx.exe
2007-07-28 03:20 53,248 —-a-w C:\WINDOWS\SYSTEM32\ATIDDC.DLL
2007-07-28 03:12 3,067,712 —-a-w C:\WINDOWS\SYSTEM32\ati3duag.dll
2007-07-28 03:06 176,128 —-a-w C:\WINDOWS\SYSTEM32\atiok3x2.dll
2007-07-28 03:01 1,550,208 —-a-w C:\WINDOWS\SYSTEM32\ativvaxx.dll
2007-07-28 02:50 5,435,392 —-a-w C:\WINDOWS\SYSTEM32\atioglxx.dll
2007-07-28 02:47 266,240 —-a-w C:\WINDOWS\SYSTEM32\atikvmag.dll
2007-07-28 02:46 17,408 —-a-w C:\WINDOWS\SYSTEM32\atitvo32.dll
2007-07-28 02:40 450,560 —-a-w C:\WINDOWS\SYSTEM32\ati2cqag.dll
2007-07-27 20:05 593,920 ——w C:\WINDOWS\SYSTEM32\ati2sgag.exe
.

((((((((((((((((((((((((((((( snapshot_2007-10-02_190531.70 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-07-09 13:16:16 582,656 —-a-w C:\WINDOWS\$hf_mig$\KB933729\SP2QFE\rpcrt4.dll
+ 2007-06-19 07:24:36 350,720 —-a-w C:\WINDOWS\$hf_mig$\KB933729\SP2QFE\xpsp3res.dll
+ 2005-10-12 23:12:25 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB933729\spmsg.dll
+ 2005-10-12 23:12:26 213,216 —-a-w C:\WINDOWS\$hf_mig$\KB933729\spuninst.exe
+ 2005-10-12 23:12:25 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB933729\update\spcustom.dll
+ 2005-10-12 23:12:28 716,000 —-a-w C:\WINDOWS\$hf_mig$\KB933729\update\update.exe
+ 2005-10-12 23:12:33 371,424 —-a-w C:\WINDOWS\$hf_mig$\KB933729\update\updspapi.dll
+ 2007-08-21 06:25:02 683,520 —-a-w C:\WINDOWS\$hf_mig$\KB941202\SP2QFE\inetcomm.dll
+ 2007-03-06 01:22:36 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB941202\spmsg.dll
+ 2007-03-06 01:22:41 213,216 —-a-w C:\WINDOWS\$hf_mig$\KB941202\spuninst.exe
+ 2007-03-06 01:22:34 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB941202\update\spcustom.dll
+ 2007-03-06 01:22:59 716,000 —-a-w C:\WINDOWS\$hf_mig$\KB941202\update\update.exe
+ 2007-03-06 01:23:51 371,424 —-a-w C:\WINDOWS\$hf_mig$\KB941202\update\updspapi.dll
+ 2004-08-04 07:56:44 581,120 -c—-w C:\WINDOWS\$NtUninstallKB933729$\rpcrt4.dll
+ 2005-10-12 23:12:26 213,216 -c—-w C:\WINDOWS\$NtUninstallKB933729$\spuninst\spuninst.exe
+ 2005-10-12 23:12:33 371,424 -c—-w C:\WINDOWS\$NtUninstallKB933729$\spuninst\updspapi.dll
+ 2007-06-15 08:12:28 1,022,976 -c—-w C:\WINDOWS\$NtUninstallKB939653$\browseui.dll
+ 2007-06-15 08:12:28 151,040 -c—-w C:\WINDOWS\$NtUninstallKB939653$\cdfview.dll
+ 2007-06-15 08:12:28 1,054,208 -c—-w C:\WINDOWS\$NtUninstallKB939653$\danim.dll
+ 2007-06-15 08:12:28 357,888 -c—-w C:\WINDOWS\$NtUninstallKB939653$\dxtmsft.dll
+ 2007-06-15 08:12:28 205,824 -c—-w C:\WINDOWS\$NtUninstallKB939653$\dxtrans.dll
+ 2007-06-15 08:12:28 55,808 -c—-w C:\WINDOWS\$NtUninstallKB939653$\extmgr.dll
+ 2007-06-14 10:32:36 18,432 -c—-w C:\WINDOWS\$NtUninstallKB939653$\iedw.exe
+ 2007-06-15 08:12:28 251,904 -c—-w C:\WINDOWS\$NtUninstallKB939653$\iepeers.dll
+ 2007-06-15 08:12:28 96,256 -c—-w C:\WINDOWS\$NtUninstallKB939653$\inseng.dll
+ 2007-06-15 08:12:28 16,384 -c—-w C:\WINDOWS\$NtUninstallKB939653$\jsproxy.dll
+ 2007-06-15 08:12:29 3,064,320 -c—-w C:\WINDOWS\$NtUninstallKB939653$\mshtml.dll
+ 2007-06-15 08:12:29 449,024 -c—-w C:\WINDOWS\$NtUninstallKB939653$\mshtmled.dll
+ 2007-06-15 08:12:29 146,432 -c—-w C:\WINDOWS\$NtUninstallKB939653$\msrating.dll
+ 2007-06-15 08:12:29 532,480 -c—-w C:\WINDOWS\$NtUninstallKB939653$\mstime.dll
+ 2007-06-15 08:12:29 39,424 -c—-w C:\WINDOWS\$NtUninstallKB939653$\pngfilt.dll
+ 2007-06-15 08:12:30 1,498,112 -c—-w C:\WINDOWS\$NtUninstallKB939653$\shdocvw.dll
+ 2007-06-15 08:12:30 474,112 -c—-w C:\WINDOWS\$NtUninstallKB939653$\shlwapi.dll
+ 2007-03-06 01:22:41 213,216 -c—-w C:\WINDOWS\$NtUninstallKB939653$\spuninst\spuninst.exe
+ 2007-03-06 01:23:51 371,424 -c—-w C:\WINDOWS\$NtUninstallKB939653$\spuninst\updspapi.dll
+ 2007-06-15 08:12:30 616,960 -c—-w C:\WINDOWS\$NtUninstallKB939653$\urlmon.dll
+ 2007-06-26 14:35:54 665,600 -c—-w C:\WINDOWS\$NtUninstallKB939653$\wininet.dll
+ 2007-06-14 10:08:46 350,720 -c—-w C:\WINDOWS\$NtUninstallKB939653$\xpsp3res.dll
+ 2007-05-16 15:12:02 683,520 -c—-w C:\WINDOWS\$NtUninstallKB941202$\inetcomm.dll
+ 2007-03-06 01:22:41 213,216 -c—-w C:\WINDOWS\$NtUninstallKB941202$\spuninst\spuninst.exe
+ 2007-03-06 01:23:51 371,424 -c—-w C:\WINDOWS\$NtUninstallKB941202$\spuninst\updspapi.dll
- 2007-07-19 23:47:22 109,056 —-a-w C:\WINDOWS\catchme.exe
+ 2007-09-28 08:06:08 135,168 —-a-w C:\WINDOWS\catchme.exe
+ 2007-08-22 12:55:28 1,022,976 —-a-w C:\WINDOWS\SoftwareDistribution\Download474e07262334919ca66aaa879430a63\sp2qfe\browseui.dll
+ 2007-08-22 12:55:29 151,040 —-a-w C:\WINDOWS\SoftwareDistribution\Download474e07262334919ca66aaa879430a63\sp2qfe\cdfview.dll
+ 2007-08-22 12:55:30 1,054,208 —-a-w C:\WINDOWS\SoftwareDistribution\Download474e07262334919ca66aaa879430a63\sp2qfe\danim.dll
+ 2007-08-22 12:55:30 357,888 —-a-w C:\WINDOWS\SoftwareDistribution\Download474e07262334919ca66aaa879430a63\sp2qfe\dxtmsft.dll
+ 2007-08-22 12:55:31 205,824 —-a-w C:\WINDOWS\SoftwareDistribution\Download474e07262334919ca66aaa879430a63\sp2qfe\dxtrans.dll
+ 2007-08-22 12:55:31 55,808 —-a-w C:\WINDOWS\SoftwareDistribution\Download474e07262334919ca66aaa879430a63\sp2qfe\extmgr.dll
+ 2007-08-21 10:19:39 18,432 —-a-w C:\WINDOWS\SoftwareDistribution\Download474e07262334919ca66aaa879430a63\sp2qfe\iedw.exe
+ 2007-08-22 12:55:32 251,904 —-a-w C:\WINDOWS\SoftwareDistribution\Download474e07262334919ca66aaa879430a63\sp2qfe\iepeers.dll
+ 2007-08-22 12:55:32 96,256 —-a-w C:\WINDOWS\SoftwareDistribution\Download474e07262334919ca66aaa879430a63\sp2qfe\inseng.dll
+ 2007-08-22 12:55:32 16,384 —-a-w C:\WINDOWS\SoftwareDistribution\Download474e07262334919ca66aaa879430a63\sp2qfe\jsproxy.dll
+ 2007-08-22 12:55:36 3,064,832 —-a-w C:\WINDOWS\SoftwareDistribution\Download474e07262334919ca66aaa879430a63\sp2qfe\mshtml.dll
+ 2007-08-22 12:55:37 449,024 —-a-w C:\WINDOWS\SoftwareDistribution\Download474e07262334919ca66aaa879430a63\sp2qfe\mshtmled.dll
+ 2007-08-22 12:55:37 146,432 —-a-w C:\WINDOWS\SoftwareDistribution\Download474e07262334919ca66aaa879430a63\sp2qfe\msrating.dll
+ 2007-08-22 12:55:38 532,480 —-a-w C:\WINDOWS\SoftwareDistribution\Download474e07262334919ca66aaa879430a63\sp2qfe\mstime.dll
+ 2007-08-22 12:55:38 39,424 —-a-w C:\WINDOWS\SoftwareDistribution\Download474e07262334919ca66aaa879430a63\sp2qfe\pngfilt.dll
+ 2007-08-22 12:55:40 1,498,112 —-a-w C:\WINDOWS\SoftwareDistribution\Download474e07262334919ca66aaa879430a63\sp2qfe\shdocvw.dll
+ 2007-08-22 12:55:41 474,112 —-a-w C:\WINDOWS\SoftwareDistribution\Download474e07262334919ca66aaa879430a63\sp2qfe\shlwapi.dll
+ 2007-08-22 12:55:43 617,984 —-a-w C:\WINDOWS\SoftwareDistribution\Download474e07262334919ca66aaa879430a63\sp2qfe\urlmon.dll
+ 2007-08-22 12:55:44 665,600 —-a-w C:\WINDOWS\SoftwareDistribution\Download474e07262334919ca66aaa879430a63\sp2qfe\wininet.dll
+ 2007-08-21 10:13:33 350,720 —-a-w C:\WINDOWS\SoftwareDistribution\Download474e07262334919ca66aaa879430a63\sp2qfe\xpsp3res.dll
+ 2007-03-06 01:22:36 14,048 —-a-w C:\WINDOWS\SoftwareDistribution\Download474e07262334919ca66aaa879430a63\spmsg.dll
+ 2007-03-06 01:22:41 213,216 —-a-w C:\WINDOWS\SoftwareDistribution\Download474e07262334919ca66aaa879430a63\spuninst.exe
+ 2007-03-06 01:22:34 22,752 —-a-w C:\WINDOWS\SoftwareDistribution\Download474e07262334919ca66aaa879430a63\update\spcustom.dll
+ 2007-03-06 01:22:59 716,000 —-a-w C:\WINDOWS\SoftwareDistribution\Download474e07262334919ca66aaa879430a63\update\update.exe
+ 2007-03-06 01:23:51 371,424 —-a-w C:\WINDOWS\SoftwareDistribution\Download474e07262334919ca66aaa879430a63\update\updspapi.dll
+ 2007-07-09 13:09:42 584,192 —-a-w C:\WINDOWS\SoftwareDistribution\Download\28d74bdac17e30d3a4336176766f2e4a\SP2GDR\rpcrt4.dll
+ 2007-06-13 06:53:14 115,712 —-a-w C:\WINDOWS\SoftwareDistribution\Download\28d74bdac17e30d3a4336176766f2e4a\SP2GDR\xpsp3res.dll
+ 2007-07-09 13:16:16 582,656 —-a-w C:\WINDOWS\SoftwareDistribution\Download\28d74bdac17e30d3a4336176766f2e4a\SP2QFE\rpcrt4.dll
+ 2007-06-19 07:24:36 350,720 —-a-w C:\WINDOWS\SoftwareDistribution\Download\28d74bdac17e30d3a4336176766f2e4a\SP2QFE\xpsp3res.dll
+ 2005-10-12 23:12:25 14,048 —-a-w C:\WINDOWS\SoftwareDistribution\Download\28d74bdac17e30d3a4336176766f2e4a\spmsg.dll
+ 2005-10-12 23:12:26 213,216 —-a-w C:\WINDOWS\SoftwareDistribution\Download\28d74bdac17e30d3a4336176766f2e4a\spuninst.exe
+ 2005-10-12 23:12:25 22,752 —-a-w C:\WINDOWS\SoftwareDistribution\Download\28d74bdac17e30d3a4336176766f2e4a\update\spcustom.dll
+ 2005-10-12 23:12:28 716,000 —-a-w C:\WINDOWS\SoftwareDistribution\Download\28d74bdac17e30d3a4336176766f2e4a\update\update.exe
+ 2005-10-12 23:12:33 371,424 —-a-w C:\WINDOWS\SoftwareDistribution\Download\28d74bdac17e30d3a4336176766f2e4a\update\updspapi.dll
+ 2007-08-21 06:15:44 683,520 —-a-w C:\WINDOWS\SoftwareDistribution\Download\8c426bb59cb8f380ba397304c1c563d0\sp2gdr\inetcomm.dll
+ 2007-08-21 06:25:02 683,520 —-a-w C:\WINDOWS\SoftwareDistribution\Download\8c426bb59cb8f380ba397304c1c563d0\sp2qfe\inetcomm.dll
+ 2007-03-06 01:22:36 14,048 —-a-w C:\WINDOWS\SoftwareDistribution\Download\8c426bb59cb8f380ba397304c1c563d0\spmsg.dll
+ 2007-03-06 01:22:41 213,216 —-a-w C:\WINDOWS\SoftwareDistribution\Download\8c426bb59cb8f380ba397304c1c563d0\spuninst.exe
+ 2007-03-06 01:22:34 22,752 —-a-w C:\WINDOWS\SoftwareDistribution\Download\8c426bb59cb8f380ba397304c1c563d0\update\spcustom.dll
+ 2007-03-06 01:22:59 716,000 —-a-w C:\WINDOWS\SoftwareDistribution\Download\8c426bb59cb8f380ba397304c1c563d0\update\update.exe
+ 2007-03-06 01:23:51 371,424 —-a-w C:\WINDOWS\SoftwareDistribution\Download\8c426bb59cb8f380ba397304c1c563d0\update\updspapi.dll
- 2007-06-15 08:12:28 1,022,976 —-a-w C:\WINDOWS\SYSTEM32\browseui.dll
+ 2007-08-22 12:55:28 1,022,976 —-a-w C:\WINDOWS\SYSTEM32\browseui.dll
- 2007-06-15 08:12:28 151,040 —-a-w C:\WINDOWS\SYSTEM32\cdfview.dll
+ 2007-08-22 12:55:29 151,040 —-a-w C:\WINDOWS\SYSTEM32\cdfview.dll
- 2007-06-15 08:12:28 1,054,208 —-a-w C:\WINDOWS\SYSTEM32\danim.dll
+ 2007-08-22 12:55:30 1,054,208 —-a-w C:\WINDOWS\SYSTEM32\danim.dll
- 2007-06-15 08:12:28 357,888 —-a-w C:\WINDOWS\SYSTEM32\dxtmsft.dll
+ 2007-08-22 12:55:30 357,888 —-a-w C:\WINDOWS\SYSTEM32\dxtmsft.dll
- 2007-06-15 08:12:28 205,824 —-a-w C:\WINDOWS\SYSTEM32\dxtrans.dll
+ 2007-08-22 12:55:31 205,824 —-a-w C:\WINDOWS\SYSTEM32\dxtrans.dll
- 2007-06-15 08:12:28 55,808 —-a-w C:\WINDOWS\SYSTEM32\extmgr.dll
+ 2007-08-22 12:55:31 55,808 —-a-w C:\WINDOWS\SYSTEM32\extmgr.dll
- 2007-06-15 08:12:28 251,904 —-a-w C:\WINDOWS\SYSTEM32\iepeers.dll
+ 2007-08-22 12:55:32 251,904 —-a-w C:\WINDOWS\SYSTEM32\iepeers.dll
- 2007-06-15 08:12:28 96,256 —-a-w C:\WINDOWS\SYSTEM32\inseng.dll
+ 2007-08-22 12:55:32 96,256 —-a-w C:\WINDOWS\SYSTEM32\inseng.dll
- 2003-11-19 15:36:26 24,681 —-a-w C:\WINDOWS\SYSTEM32\java.exe
+ 2007-09-24 21:30:28 135,168 —-a-w C:\WINDOWS\SYSTEM32\java.exe
- 2003-11-19 15:36:30 28,779 —-a-w C:\WINDOWS\SYSTEM32\javaw.exe
+ 2007-09-24 21:30:30 135,168 —-a-w C:\WINDOWS\SYSTEM32\javaw.exe
+ 2007-09-24 22:31:42 139,264 —-a-w C:\WINDOWS\SYSTEM32\javaws.exe
- 2007-06-15 08:12:28 16,384 —-a-w C:\WINDOWS\SYSTEM32\jsproxy.dll
+ 2007-08-22 12:55:32 16,384 —-a-w C:\WINDOWS\SYSTEM32\jsproxy.dll
+ 2005-05-24 10:27:16 213,048 —-a-w C:\WINDOWS\SYSTEM32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll
+ 2007-09-07 10:29:00 94,208 —-a-w C:\WINDOWS\SYSTEM32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe
+ 2007-09-07 10:29:00 946,176 —-a-w C:\WINDOWS\SYSTEM32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll
+ 2007-06-11 20:34:34 2,115,816 —-a-w C:\WINDOWS\SYSTEM32\Macromed\Flash\NPSWF32.dll
+ 2007-06-11 20:34:40 190,696 —-a-w C:\WINDOWS\SYSTEM32\Macromed\Flash\NPSWF32_FlashUtil.exe
+ 2007-10-02 18:12:31 45,218 —-a-w C:\WINDOWS\SYSTEM32\Macromed\Flash\uninstall_plugin.exe
- 2007-09-06 02:50:42 17,474,680 —-a-w C:\WINDOWS\SYSTEM32\MRT.exe
+ 2007-09-28 05:19:40 18,089,592 —-a-w C:\WINDOWS\SYSTEM32\MRT.exe
- 2007-06-15 08:12:29 3,064,320 —-a-w C:\WINDOWS\SYSTEM32\mshtml.dll
+ 2007-08-22 12:55:36 3,064,832 —-a-w C:\WINDOWS\SYSTEM32\mshtml.dll
- 2007-06-15 08:12:29 449,024 —-a-w C:\WINDOWS\SYSTEM32\mshtmled.dll
+ 2007-08-22 12:55:37 449,024 —-a-w C:\WINDOWS\SYSTEM32\mshtmled.dll
- 2007-06-15 08:12:29 146,432 —-a-w C:\WINDOWS\SYSTEM32\msrating.dll
+ 2007-08-22 12:55:37 146,432 —-a-w C:\WINDOWS\SYSTEM32\msrating.dll
- 2007-06-15 08:12:29 532,480 —-a-w C:\WINDOWS\SYSTEM32\mstime.dll
+ 2007-08-22 12:55:38 532,480 —-a-w C:\WINDOWS\SYSTEM32\mstime.dll
- 2007-06-15 08:12:29 39,424 —-a-w C:\WINDOWS\SYSTEM32\pngfilt.dll
+ 2007-08-22 12:55:38 39,424 —-a-w C:\WINDOWS\SYSTEM32\pngfilt.dll
- 2004-08-04 07:56:44 581,120 —-a-w C:\WINDOWS\SYSTEM32\rpcrt4.dll
+ 2007-07-09 13:09:42 584,192 —-a-w C:\WINDOWS\SYSTEM32\rpcrt4.dll
- 2007-06-15 08:12:30 1,498,112 —-a-w C:\WINDOWS\SYSTEM32\shdocvw.dll
+ 2007-08-22 12:55:40 1,498,112 —-a-w C:\WINDOWS\SYSTEM32\shdocvw.dll
- 2007-06-15 08:12:30 474,112 —-a-w C:\WINDOWS\SYSTEM32\shlwapi.dll
+ 2007-08-22 12:55:41 474,112 —-a-w C:\WINDOWS\SYSTEM32\shlwapi.dll
- 2007-07-22 17:39:27 844,800 —-a-w C:\WINDOWS\SYSTEM32\swreg.exe
+ 2007-10-05 09:07:31 279,552 —-a-w C:\WINDOWS\SYSTEM32\swreg.exe
- 2007-06-15 08:12:30 616,960 —-a-w C:\WINDOWS\SYSTEM32\urlmon.dll
+ 2007-08-22 12:55:43 617,984 —-a-w C:\WINDOWS\SYSTEM32\urlmon.dll
- 2007-06-26 14:35:54 665,600 —-a-w C:\WINDOWS\SYSTEM32\wininet.dll
+ 2007-08-22 12:55:44 665,600 —-a-w C:\WINDOWS\SYSTEM32\wininet.dll
- 2007-06-14 10:08:46 350,720 —-a-w C:\WINDOWS\SYSTEM32\xpsp3res.dll
+ 2007-08-21 10:13:33 350,720 —-a-w C:\WINDOWS\SYSTEM32\xpsp3res.dll
+ 2007-10-12 17:30:35 16,384 —-atw C:\WINDOWS\Temp\Perflib_Perfdata_790.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelMeM"="C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe" [2003-09-03 20:12]
"PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [2003-08-26 19:47]
"DVDSentry"="C:\WINDOWS\System32\DSentry.exe" [2003-08-13 10:27]
"VSOCheckTask"="c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" [2003-08-08 18:02]
"MCAgentExe"="c:\PROGRA~1\mcafee.com\agent\mcagent.exe" [2005-09-22 19:29]
"MCUpdateExe"="c:\PROGRA~1\mcafee.com\agent\mcupdate.exe" [2006-01-11 13:05]
"VirusScan"="c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe" [2003-08-17 21:50]
"VirusScan Online"="c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe" [2003-08-17 21:50]
"SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 11:38]
"LVCOMSX"="C:\WINDOWS\System32\LVCOMSX.EXE" [2004-05-21 19:11]
"LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2004-06-01 11:09]
"LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2004-06-01 11:03]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-08-25 12:52]
"UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 02:01]
"SsAAD.exe"="C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe" [2005-06-03 08:16]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" []
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-16 18:15]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2006-10-30 10:36]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-12-19 20:19]
"Sony Ericsson PC Suite"="F:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 17:17]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="" []
"LogitechSoftwareUpdate"="C:\Program Files\Logitech\Video\ManifestEngine.exe" [2004-06-01 10:46]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-28 17:17]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 08:56]
"kdx"="C:\Program Files\Kontiki\KHost.exe" [2007-04-23 11:23]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 21:05]

C:\Documents and Settings\Simon\Start Menu\Programs\Startup\
PowerReg Scheduler V3.exe [2005-03-14 17:12:23]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 23:05:26]
AOL 8.0 Tray Icon.lnk - C:\Program Files\AOL 8.0\aoltray.exe [2004-05-19 14:27:43]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 21:05:56]
ZDWLan Utility.lnk - F:\Program Files\WirelessWii\ZDWlan.exe [2007-01-13 19:23:29]

R3 NaiFiltr;NaiFiltr;C:\WINDOWS\system32\DRIVERS\NaiFiltr.sys
S3 portio;portio;\??\C:\Program Files\Zinf\portio.sys
S3 SE27bus;Sony Ericsson Device 039 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\SE27bus.sys
S3 SE27mdfl;Sony Ericsson Device 039 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\SE27mdfl.sys
S3 SE27mdm;Sony Ericsson Device 039 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\SE27mdm.sys
S3 SE27mgmt;Sony Ericsson Device 039 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\SE27mgmt.sys
S3 se27nd5;Sony Ericsson Device 039 USB Ethernet Emulation SEMC39 (NDIS);C:\WINDOWS\system32\DRIVERS\se27nd5.sys
S3 SE27obex;Sony Ericsson Device 039 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\SE27obex.sys
S3 se27unic;Sony Ericsson Device 039 USB Ethernet Emulation SEMC39 (WDM);C:\WINDOWS\system32\DRIVERS\se27unic.sys
S3 ss_bus;Samsung Mobile USB Device 1.0 driver (WDM);C:\WINDOWS\system32\DRIVERS\ss_bus.sys
S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;C:\WINDOWS\system32\DRIVERS\ss_mdfl.sys
S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;C:\WINDOWS\system32\DRIVERS\ss_mdm.sys

.
Contents of the 'Scheduled Tasks' folder
"2006-12-10 20:01:40 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-12 18:50:14
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-10-12 18:50:57
C:\ComboFix-quarantined-files.txt … 2007-10-09 21:11
C:\ComboFix2.txt … 2007-10-12 18:45
C:\ComboFix3.txt … 2007-10-09 21:11
.
— E O F —

Deckard's System Scanner v20070905.67
Run by [removed] on 2007-10-12 18:53:36
Computer is in Normal Mode.
——————————————————————————–



– HijackThis Clone ————————————————————

Emulating logfile of HijackThis v1.99.1
Scan saved at 2007-10-12 18:53:59
Platform: Windows XP Service Pack 2 (5.01.2600)
MSIE: Internet Explorer (6.00.2900.2180)

Running processes:
C:\WINDOWS\SYSTEM32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\SYSTEM32\services.exe
C:\WINDOWS\SYSTEM32\lsass.exe
C:\WINDOWS\SYSTEM32\ati2evxx.exe
C:\WINDOWS\SYSTEM32\svchost.exe
C:\WINDOWS\SYSTEM32\svchost.exe
C:\WINDOWS\SYSTEM32\ati2evxx.exe
C:\WINDOWS\SYSTEM32\spoolsv.exe
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\WINDOWS\SYSTEM32\DSentry.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\McAfee.com\VSO\mcvsshld.exe
C:\Program Files\Thomson\SpeedTouch USB\dragdiag.exe
C:\Program Files\McAfee.com\VSO\McVSEscn.exe
C:\WINDOWS\SYSTEM32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Sony\SonicStage\SSAAD.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
F:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\WINDOWS\SYSTEM32\ctfmon.exe
C:\Program Files\Kontiki\KHost.exe
C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
F:\Program Files\WirelessWii\ZDWlan.exe
C:\Program Files\Common Files\Teleca Shared\Generic.exe
F:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Kontiki\KService.exe
C:\Program Files\McAfee.com\Agent\Mcdetect.exe
C:\Program Files\McAfee.com\Agent\McTskshd.exe
C:\Program Files\McAfee.com\VSO\mcvsrte.exe
C:\WINDOWS\SYSTEM32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\SYSTEM32\svchost.exe
C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
C:\WINDOWS\SYSTEM32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\McAfee.com\VSO\McShield.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Simon\Desktop\dss.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://news.bbc.co.uk/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.com/search?q=%s
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=17
R1 - HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.freeserve.com/
R1 - HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
R1 - HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
R1 - HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
R0 - HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.euro.dell.com/countries/uk/enu/gen/default.htm
R1 - HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - C:\Program Files\McAfee.com\VSO\mcvsshl.dll
O4 - HKEY_LOCAL_MACHINE\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
O4 - HKEY_LOCAL_MACHINE\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKEY_LOCAL_MACHINE\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKEY_LOCAL_MACHINE\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKEY_LOCAL_MACHINE\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKEY_LOCAL_MACHINE\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKEY_LOCAL_MACHINE\..\Run: [VirusScan] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
O4 - HKEY_LOCAL_MACHINE\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKEY_LOCAL_MACHINE\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKEY_LOCAL_MACHINE\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKEY_LOCAL_MACHINE\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKEY_LOCAL_MACHINE\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKEY_LOCAL_MACHINE\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKEY_LOCAL_MACHINE\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKEY_LOCAL_MACHINE\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - HKEY_LOCAL_MACHINE\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKEY_LOCAL_MACHINE\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKEY_LOCAL_MACHINE\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKEY_LOCAL_MACHINE\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKEY_LOCAL_MACHINE\..\Run: [Sony Ericsson PC Suite] "F:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKEY_LOCAL_MACHINE\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKEY_LOCAL_MACHINE\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [kdx] C:\Program Files\Kontiki\KHost.exe -all
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: AOL 8.0 Tray Icon.lnk = C:\Program Files\AOL 8.0\aoltray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: ZDWLan Utility.lnk = F:\Program Files\WirelessWii\ZDWlan.exe
O8 - Extra context menu item: + &Download Express: download this file - f:\Program Files\Download Express\Add_Url.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (file missing)
O9 - Extra 'Tools' menuitem: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: Diagnose Connection Problems… - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} () - http://static.windupdates.com/cab/Download…/bridge-c11.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://fpdownload.macromedia.com/get/shock…director/sw.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/cha…v45/yacscom.cab
O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} () - http://download.microsoft.com/download/e/2…78f/wvc1dmo.cab
O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} (InstallShield Setup Player 2K2) - http://sib1.od2.com/common/Member/ClientIn…6/OCI/setup.exe
O16 - DPF: {4E62C4DE-627D-4604-B157-4B7D6B09F02E} (AccountTracking Profile Manager Class) - https://moneymanager.egg.com/Pinsafe/accounttracking.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by101fd.bay101.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} () - http://a1540.g.akamai.net/7/1540/52/200404…meInstaller.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1127126653289
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} (DmiReader Class) - http://support.euro.dell.com/global/apps/s…er/PROFILER.CAB
O16 - DPF: {B1E2B96C-12FE-45E2-BEF1-44A219113CDD} (SABScanProcesses Class) - http://www.superadblocker.com/activex/sabspx.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab Class) - http://www.systemrequirementslab.com/sysreqlab.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa…ash/swflash.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - "C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe"
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - C:\Program Files\McAfee.com\Agent\Mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - C:\Program Files\McAfee.com\VSO\McShield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - C:\Program Files\McAfee.com\Agent\McTskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\Program Files\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe /Embedding
O23 - Service: MSCSPTISRV - Sony Corporation - "C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe"
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: PACSPTISVR - Sony Corporation - "C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe"
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - "C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe"
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - "C:\WINDOWS\wanmpsvc.exe"


– Files created between 2007-09-12 and 2007-10-12 —————————–

2007-10-09 21:15:21 43520 –a—— C:\WINDOWS\system32\CmdLineExt03.dll
2007-10-09 20:42:56 0 d——– C:\Program Files\Common Files\Java
2007-10-04 18:52:05 0 d——– C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-10-04 18:52:04 0 d——– C:\WINDOWS\system32\Kaspersky Lab
2007-09-12 00:05:59 0 d——– C:\Documents and Settings\Simon\Application Data\Mozilla


– Find3M Report —————————————————————

2007-10-09 20:43:35 0 d——– C:\Program Files\Java
2007-10-09 20:42:56 0 d——– C:\Program Files\Common Files
2007-09-12 19:15:27 0 d——– C:\Program Files\Windows NT
2007-09-12 18:21:37 0 d——– C:\Program Files\Sonic
2007-09-12 18:21:05 0 d–h—– C:\Program Files\InstallShield Installation Information
2007-09-11 19:39:43 4762 –a—— C:\WINDOWS\system32\tmp.reg
2007-09-10 20:08:36 0 d——– C:\Documents and Settings\Simon\Application Data\Grisoft
2007-08-29 19:29:11 0 d——– C:\Program Files\Creative
2007-08-27 20:08:11 664 –a—— C:\WINDOWS\system32\d3d9caps.dat
2007-08-19 04:28:58 0 d——– C:\Program Files\Kontiki
2007-08-19 04:28:57 0 d——– C:\Program Files\Channel4
2007-07-27 21:05:00 593920 —–n— C:\WINDOWS\system32\ati2sgag.exe