[Resolved] infected machine, still after running fixes

You need to post the logs not attach them. We can't read them.
Here's why:

ComboFix 07-11-19.3 - Administrator 2007-11-24 16:18:11.14 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1677 [GMT 1:00] Running from: C:\Documents and Settings\[removed]\Desktop\combofix.exe * Created a new restore point . Unable to gain System Privileges ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\drivers\IVMS75.sys C:\WINDOWS\system32\drivers\symavc32.sys . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . ——-\LEGACY_IVMS75 ——-\LEGACY_PROTECT ——-\LEGACY_RUNTIME ——-\LEGACY_RUNTIME2 ——-\LEGACY_SYSLIBRARY ((((((((((((((((((((((((( Files Created from 2007-10-24 to 2007-11-24 ))))))))))))))))))))))))))))))) . 2007-11-24 15:58
d——– C:\WINDOWS\system32\xircom 2007-11-24 15:58
d——– C:\Program Files\microsoft frontpage 2007-11-24 15:50
d——– C:\WINDOWS\ERUNT 2007-11-24 15:39 512,096 –a—— C:\WINDOWS\system32\drivers\amon.sys 2007-11-24 15:39 15,424 –a—— C:\WINDOWS\system32\drivers\nod32drv.sys 2007-11-24 15:33 131,836 –a—— C:\WINDOWS\system32\_install.exe 2007-11-24 15:32 131,836 –a—— C:\WINDOWS\_install.exe 2007-11-24 15:24 29 –a—— C:\WINDOWS\system32\grtrtpgp.tmp 2007-11-24 12:23
d–h—– C:\Documents and Settings\All Users\Application Data\~1 2007-11-22 17:00
d–h—– C:\Documents and Settings\All Users\Application Data\~0 2007-11-22 08:34 230 –a—— C:\WINDOWS\system32\spupdsvc.inf 2007-11-18 15:50 68,608 –a—— C:\WINDOWS\system32\plugin.ocx . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-24 14:36 ——— d–h–w

Sorry, here is the NOD32 log, I guess we can start from here: Time Module Object Name Threat Action User Information 11/27/2007 10:25:25 AM AMON file D:\System Volume Information\_restore{4A46F404-0F17-40D1-AEB6-4BA6A9A9632C}\RP3\A0001356.exe probably unknown NewHeur_PE virus quarantined - deleted NT AUTHORITY\SYSTEM Event occurred on a file modified by the application: C:\WINDOWS\system32\svchost.exe. The file was moved to quarantine. You may close this window. 11/25/2007 21:34:45 PM AMON file C:\System Volume Information\_restore{4A46F404-0F17-40D1-AEB6-4BA6A9A9632C}\RP2\A0001040.exe probably unknown NewHeur_PE virus quarantined - deleted NT AUTHORITY\SYSTEM Event occurred on a file modified by the application: C:\WINDOWS\system32\svchost.exe. The file was moved to quarantine. You may close this window. 11/24/2007 16:28:09 PM AMON file C:\RECYCLER\S-1-5-21-1993962763-842925246-725345543-500\Dc5.tmp Win32/SpamTool.Agent.NAN trojan quarantined - deleted SKODA\Administrator Event occurred on a file modified by the application: C:\Program Files\internet explorer\iexplore.exe. The file was moved to quarantine. You may close this window. 11/24/2007 16:28:05 PM AMON file C:\77.tmp Win32/SpamTool.Agent.NAN trojan SKODA\Administrator Event occurred at an attempt to access the file by the application: C:\Program Files\internet explorer\iexplore.exe. 11/24/2007 16:28:02 PM AMON file C:\RECYCLER\S-1-5-21-1993962763-842925246-725345543-500\Dc3.tmp Win32/TrojanDownloader.Small.AVT trojan quarantined - deleted SKODA\Administrator Event occurred on a file modified by the application: C:\Program Files\internet explorer\iexplore.exe. The file was moved to quarantine. You may close this window. 11/24/2007 16:27:58 PM AMON file C:\7C.tmp Win32/TrojanDownloader.Small.AVT trojan SKODA\Administrator Event occurred at an attempt to access the file by the application: C:\Program Files\internet explorer\iexplore.exe. 11/24/2007 16:27:49 PM AMON file C:\7D.tmp Win32/Spy.Agent.NDM trojan deleted SKODA\Administrator Event occurred at an attempt to access the file by the application: C:\Program Files\internet explorer\iexplore.exe. 11/24/2007 16:03:01 PM AMON file C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys Win32/Rootkit.Agent.DP trojan deleted SKODA\Administrator Event occurred at an attempt to access the file by the application: C:\Documents and Settings\Administrator\Desktop\spyware\HiJackThis.exe. 11/24/2007 15:59:08 PM AMON file C:\SDFix\backups\ip6fw.sys Win32/Rootkit.Agent.DP trojan SKODA\Administrator Event occurred at an attempt to access the file by the application: C:\SDFix\apps\zip.exe. 11/24/2007 15:59:08 PM AMON file C:\SDFix\backups\actcontroller.exe Win32/SpamTool.Agent.NAJ trojan SKODA\Administrator Event occurred at an attempt to access the file by the application: C:\SDFix\apps\zip.exe. 11/24/2007 15:47:50 PM AMON file C:\WINDOWS\SYSTEM32\SVCHOST.EXE:EXT.EXE Win32/Obfuscated.NAJ trojan quarantined SKODA\Administrator Event occurred at an attempt to access the file by the application: C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe. 11/24/2007 15:47:33 PM Kernel file C:\WINDOWS\system32\actcontroller.exe Win32/SpamTool.Agent.NAJ trojan Alert was generated during the system startup file check. 11/24/2007 15:47:28 PM Kernel file C:\WINDOWS\system32\drivers\protect.sys Win32/SpamTool.Agent.NAJ trojan Alert was generated during the system startup file check. 11/24/2007 15:47:26 PM Kernel file C:\WINDOWS\system32\drivers\ip6fw.sys Win32/Rootkit.Agent.DP trojan Alert was generated during the system startup file check. 11/24/2007 15:47:24 PM Kernel file c:\windows\system32\actcontroller.exe Win32/SpamTool.Agent.NAJ trojan Alert was generated during the system startup file check. 11/24/2007 15:46:51 PM Kernel file C:\WINDOWS\noskrnl.exe probably unknown NewHeur_PE virus 11/24/2007 15:46:38 PM Kernel file c:\windows\noskrnl.exe probably unknown NewHeur_PE virus

The main one I need is the combofix.txt

Do you know what these folders are?
C:\Documents and Settings\All Users\Application Data\~1
C:\Documents and Settings\All Users\Application Data\~0


Please click HERE select Save. Save FindAWF to your desktop.

Double Click FindAWF.exe and let it run, it will create the file awf.txt on your desktop when finished.

Open awf.txt in notepad, select Edit> Select All> Edit> Copy> and Paste the contents.

I don't know what those directories are … at all. FindAWF seemed to find a million things, here is the log: Find AWF report by noahdfear ©2006 Version 1.40 The current date is: Sat 12/01/2007 The current time is: 10:40:41.65 bak folders found ~~~~~~~~~~~ Directory of C:\WINDOWS\PCHEALTH\HELPCTR\BINARIES\BAK 11/24/2007 03:23 PM 131,836 _install.exe 12/31/2002 01:00 PM 158,208 MSConfig.exe 2 File(s) 290,044 bytes Duplicate files of bak directory contents ~~~~~~~~~~~~~~~~~~~~~~~ 145408 Apr 15 2007 "C:\WINDOWS\pchealth\helpctr\binaries\MSConfig.exe" 158208 Dec 31 2002 "C:\WINDOWS\pchealth\helpctr\binaries\bak\MSConfig.exe" 131836 Nov 24 2007 "C:\WINDOWS\_install.exe" 131836 Nov 24 2007 "C:\Program Files\backburner 2\_install.exe" 131836 Nov 24 2007 "C:\Program Files\Easy Video Splitter\_install.exe" 131836 Nov 24 2007 "C:\Program Files\Internet Explorer\_install.exe" 131836 Nov 24 2007 "C:\Program Files\Movie Maker\_install.exe" 131836 Nov 24 2007 "C:\Program Files\Mozilla Firefox\_install.exe" 131836 Nov 24 2007 "C:\Program Files\MSN Messenger\_install.exe" 131836 Nov 24 2007 "C:\Program Files\NetMeeting\_install.exe" 131836 Nov 24 2007 "C:\Program Files\Outlook Express\_install.exe" 131836 Nov 24 2007 "C:\Program Files\PartyGaming\_install.exe" 131836 Nov 24 2007 "C:\Program Files\Windows Media Connect 2\_install.exe" 131836 Nov 24 2007 "C:\Program Files\Windows Media Player\_install.exe" 131836 Nov 24 2007 "C:\Program Files\XviD\_install.exe" 131836 Nov 24 2007 "C:\QuickTax 2005\QT2005\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\$NtUninstallKB896423$\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\$NtUninstallKB896344$\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\$NtUninstallwmp11$\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\$NtUninstallKB905915$\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\$NtUninstallKB896688$\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\$NtUninstallWMFDist11$\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\$NtUninstallKB896727$\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\Downloaded Program Files\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\inf\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\msagent\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\mui\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\system32\_install.exe" 131836 Nov 24 2007 "C:\ATI\SUPPORT\5-11_xp-2k_dd_27345\_install.exe" 131836 Nov 24 2007 "C:\ATI\SUPPORT\5-9_xp-2k_dd_cp_wdm_26409\_install.exe" 131836 Nov 24 2007 "C:\ATI\SUPPORT\wxp-w2k-catalyst-8-062-040929a-018115C\_install.exe" 131836 Nov 24 2007 "C:\Documents and Settings\Administrator\.housecall6.6\_install.exe" 131836 Nov 24 2007 "C:\Program Files\Adobe\Adobe Bridge\_install.exe" 131836 Nov 24 2007 "C:\Program Files\Adobe\Adobe Help Center\_install.exe" 131836 Nov 24 2007 "C:\Program Files\AMD\Athlon 64 Processor Driver\_install.exe" 131836 Nov 24 2007 "C:\Program Files\Autodesk\Autodesk DWF Viewer\_install.exe" 131836 Nov 24 2007 "C:\Program Files\Common Files\Autodesk Shared\_install.exe" 131836 Nov 24 2007 "C:\Program Files\Common Files\Raxco\_install.exe" 131836 Nov 24 2007 "C:\Program Files\InstallShield Installation Information\{43801800-CFEE-11D2-A41B-006097B55AD3}\_install.exe" 131836 Nov 24 2007 "C:\Program Files\InstallShield Installation Information\{5556E378-9A12-4236-9AD7-6F883389DE98}\_install.exe" 131836 Nov 24 2007 "C:\Program Files\InstallShield Installation Information\{98736A65-3C79-49EC-B7E9-A3C77774B0E6}\_install.exe" 131836 Nov 24 2007 "C:\Program Files\InstallShield Installation Information\{9B94BE6F-7CA3-4C40-A266-62667FF746CC}\_install.exe" 131836 Nov 24 2007 "C:\Program Files\InstallShield Installation Information\{B3D8B2F8-3C2C-45BC-933E-8B60E78F6684}\_install.exe" 131836 Nov 24 2007 "C:\Program Files\InstallShield Installation Information\{C151CE54-E7EA-4804-854B-F515368B0798}\_install.exe" 131836 Nov 24 2007 "C:\Program Files\InstallShield Installation Information\{FB08F381-6533-4108-B7DD-039E11FBC27E}\_install.exe" 131836 Nov 24 2007 "C:\Program Files\Internet Explorer\Connection Wizard\_install.exe" 131836 Nov 24 2007 "C:\Program Files\Mozilla Firefox\uninstall\_install.exe" 131836 Nov 24 2007 "C:\Program Files\MSN Messenger\Device Manager\_install.exe" 131836 Nov 24 2007 "C:\Program Files\PartyGaming\PartyPoker\_install.exe" 131836 Nov 24 2007 "C:\Program Files\Raxco\PerfectDisk\_install.exe" 131836 Nov 24 2007 "C:\Program Files\Windows NT\Accessories\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\$hf_mig$\KB893756\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\$hf_mig$\KB896423\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\$hf_mig$\KB898461\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\$hf_mig$\KB899588\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\$hf_mig$\KB899589\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\$hf_mig$\KB899591\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\$hf_mig$\KB901017\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\$hf_mig$\KB901214\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\$hf_mig$\KB905414\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\$hf_mig$\KB905749\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\$hf_mig$\KB910437\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\$hf_mig$\KB915865\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\$NtUninstallKB902400$\spuninst\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\$NtUninstallKB894391$\spuninst\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\$NtUninstallKB900930$\spuninst\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\$NtUninstallKB891122$\spuninst\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\$NtUninstallKB899591$\spuninst\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\$NtUninstallKB905414$\spuninst\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\$NtUninstallKB911565$\spuninst\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\$NtUninstallKB896423$\spuninst\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\$NtUninstallKB896424$\spuninst\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\$NtUninstallKB896344$\spuninst\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\$NtUninstallwmp11$\spuninst\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\$NtUninstallKB901017$\spuninst\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\$NtUninstallKB900725$\spuninst\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\$NtUninstallKB915865$\spuninst\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\$NtUninstallKB910437$\spuninst\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\$NtUninstallWdf01005$\spuninst\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\$NtUninstallKB905915$\spuninst\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\$NtUninstallKB904706$\spuninst\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\$NtUninstallKB926239$\spuninst\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\$NtUninstallKB885884$\spuninst\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\$NtUninstallKB905749$\spuninst\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\$NtUninstallKB893756$\spuninst\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\$NtUninstallKB899587$\spuninst\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\$NtUninstallKB896688$\spuninst\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\$NtUninstallKB912919$\spuninst\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\$NtUninstallKB899589$\spuninst\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\$NtUninstallWudf01000$\spuninst\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\$NtUninstallKB898461$\spuninst\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\$NtUninstallKB901214$\spuninst\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\$NtUninstallKB899588$\spuninst\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\$NtUninstallKB896727$\spuninst\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\Downloaded Installations\Macromedia Flash 8\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\Downloaded Installations\Macromedia Dreamweaver 8\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\Downloaded Installations\Macromedia Fireworks 8\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\Installer\{0837A661-FEC3-48B3-876C-91E7D32048A9}\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\Installer\{212F5777-1190-4DEF-8E4D-6B2F313B45E7}\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\Installer\{21DBBDD6-93A5-4326-9A04-C9A5C9148502}\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\Installer\{236BB7C4-4419-42FD-0409-1E257A25E34D}\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\Installer\{2BD5C305-1B27-4D41-B690-7A61172D2FEB}\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\Installer\{49FC50FC-F965-40D9-89B4-CBFF80941033}\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\Installer\{4C24A8C1-7CFA-4650-AF15-732F5BD7B46D}\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\Installer\{513AEC24-3465-8C4F-87BA-652D6F491033}\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\Installer\{5546CDB5-2CE2-498B-B059-5B3BF81FC41F}\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\Installer\{5783F2D7-4001-0409-0002-0060B0CE6BBA}\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\Installer\{7451C9B5-3E10-4E59-AD37-AB7438D84288}\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\Installer\{7CCEBC24-62DB-4280-A8EC-BFA49F167920}\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\Installer\{8BF2C401-02CE-424D-BC26-6C4F9FB446B6}\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\Installer\{90280409-6000-11D3-8CFE-0050048383C9}\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\Installer\{AC76BA86-0000-7EC8-7489-000000000702}\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\Installer\{AC76BA86-7AD7-1033-7B44-A80000000002}\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\Installer\{B2F5D08C-7E79-4FCD-AAF4-57AD35FF0601}\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\Installer\{B74D4E10-1033-0000-0000-000000000001}\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\Installer\{E9787678-1033-0000-8E67-000000000001}\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\Microsoft.NET\Framework\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\RegisteredPackages\{3FDF25EE-E592-4495-8391-6E9C504DAC2B}\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\RegisteredPackages\{60BFF50D-FB2C-4498-A577-C9548C390BB9}\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\RegisteredPackages\{981FB688-E76B-4246-987B-92083185B90A}\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\RegisteredPackages\{DD90D410-1823-43EB-9A16-A2331BF08799}\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\system32\Com\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\system32\npp\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\system32\oobe\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\system32\Restore\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\system32\URTTemp\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\system32\usmt\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\system32\wbem\_install.exe" 131836 Nov 24 2007 "C:\ATI\SUPPORT\5-9_xp-2k_dd_cp_wdm_26409\BIN\_install.exe" 131836 Nov 24 2007 "C:\ATI\SUPPORT\5-9_xp-2k_dd_cp_wdm_26409\CPanel\_install.exe" 131836 Nov 24 2007 "C:\ATI\SUPPORT\5-9_xp-2k_dd_cp_wdm_26409\Driver\_install.exe" 131836 Nov 24 2007 "C:\ATI\SUPPORT\5-9_xp-2k_dd_cp_wdm_26409\WDM_ALL\_install.exe" 131836 Nov 24 2007 "C:\ATI\SUPPORT\wxp-w2k-catalyst-8-062-040929a-018115C\BIN\_install.exe" 131836 Nov 24 2007 "C:\ATI\SUPPORT\wxp-w2k-catalyst-8-062-040929a-018115C\CPanel\_install.exe" 131836 Nov 24 2007 "C:\ATI\SUPPORT\wxp-w2k-catalyst-8-062-040929a-018115C\Driver\_install.exe" 131836 Nov 24 2007 "C:\ATI\SUPPORT\wxp-w2k-catalyst-8-062-040929a-018115C\WDM\_install.exe" 131836 Nov 24 2007 "C:\Documents and Settings\All Users\Application Data\~0\_install.exe" 131836 Nov 24 2007 "C:\Documents and Settings\All Users\Application Data\~1\_install.exe" 131836 Nov 24 2007 "C:\Program Files\Adobe\Adobe Help Viewer\1.0\_install.exe" 131836 Nov 24 2007 "C:\Program Files\Adobe\Adobe Utilities\ExtendScript Toolkit\_install.exe" 131836 Nov 24 2007 "C:\Program Files\Audio Ease\Altiverb 5\Uninstall\_install.exe" 131836 Nov 24 2007 "C:\Program Files\Common Files\Adobe\Calibration\_install.exe" 131836 Nov 24 2007 "C:\Program Files\Common Files\Adobe\Updater\_install.exe" 131836 Nov 24 2007 "C:\Program Files\Common Files\Adobe\Updater5\_install.exe" 131836 Nov 24 2007 "C:\Program Files\Common Files\Adobe Systems Shared\Service\_install.exe" 131836 Nov 24 2007 "C:\Program Files\Common Files\Ahead\Lib\_install.exe" 131836 Nov 24 2007 "C:\Program Files\Common Files\Ahead\Nero Web\_install.exe" 131836 Nov 24 2007 "C:\Program Files\Common Files\Ahead\RemoteControl\_install.exe" 131836 Nov 24 2007 "C:\Program Files\Common Files\Autodesk Shared\AcDwgFilter\_install.exe" 131836 Nov 24 2007 "C:\Program Files\Common Files\Autodesk Shared\dwf common\_install.exe" 131836 Nov 24 2007 "C:\Program Files\Common Files\Autodesk Shared\Service\_install.exe" 131836 Nov 24 2007 "C:\Program Files\Common Files\Intuit\Internet Client\_install.exe" 131836 Nov 24 2007 "C:\Program Files\Common Files\Microsoft Shared\MSInfo\_install.exe" 131836 Nov 24 2007 "C:\Program Files\Common Files\Microsoft Shared\Speech\_install.exe" 131836 Nov 24 2007 "C:\Program Files\DivX\Google\Firefox\_install.exe" 131836 Nov 24 2007 "C:\Program Files\Java\jre1.6.0_02\bin\_install.exe" 131836 Nov 24 2007 "C:\Program Files\PartyGaming\PartyPoker\tmpUpgrade\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\$hf_mig$\KB893756\update\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\$hf_mig$\KB896423\SP2QFE\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\$hf_mig$\KB896423\update\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\$hf_mig$\KB898461\update\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\$hf_mig$\KB899588\update\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\$hf_mig$\KB899589\update\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\$hf_mig$\KB899591\update\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\$hf_mig$\KB901017\update\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\$hf_mig$\KB901214\update\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\$hf_mig$\KB905414\update\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\$hf_mig$\KB905749\update\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\$hf_mig$\KB910437\update\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\$hf_mig$\KB915865\update\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\Help\Tours\mmTour\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\pchealth\helpctr\binaries\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\pchealth\UploadLB\Binaries\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\RegisteredPackages\{3FDF25EE-E592-4495-8391-6E9C504DAC2B}$BACKUP$\System\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\RegisteredPackages\{981FB688-E76B-4246-987B-92083185B90A}$BACKUP$\System\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}$BACKUP$\System\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\RegisteredPackages\{DD90D410-1823-43EB-9A16-A2331BF08799}$BACKUP$\System\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\system32\DRVSTORE\lfmouhid_FACDA2D2CAF5FF8A2DA6CD8B0212C3F89DFA31A2\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\system32\Macromed\Director\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\system32\Macromed\Flash\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\system32\Macromed\Shockwave 10\_install.exe" 131836 Nov 24 2007 "C:\Documents and Settings\Administrator\Application Data\Move Networks\ie_bin\_install.exe" 131836 Nov 24 2007 "C:\Documents and Settings\Administrator\Application Data\SopCast\adv\_install.exe" 131836 Nov 24 2007 "C:\Documents and Settings\Administrator\Local Settings\Application Data\ApplicationHistory\_install.exe" 131836 Nov 24 2007 "C:\Program Files\Common Files\Adobe\SVG Viewer 3.0\Uninstall\_install.exe" 131836 Nov 24 2007 "C:\Program Files\Common Files\Microsoft Shared\MSSearch\Bin\_install.exe" 131836 Nov 24 2007 "C:\Program Files\Common Files\Microsoft Shared\VBA\VBA6\_install.exe" 131836 Nov 24 2007 "C:\Program Files\Mozilla Firefox\extensions\[removed]\components\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\pchealth\helpctr\binaries\bak\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\system32\PreInstall\WinSE\wxp_x86_0409_v1\_install.exe" 131836 Nov 24 2007 "C:\WINDOWS\system32\ReinstallBackups\0000\DriverFiles\_install.exe" 131836 Nov 24 2007 "C:\Documents and Settings\Administrator\Application Data\Microsoft\Installer\{8CC990CD-87C8-475C-AC32-8A7984E2FCFA}\_install.exe" 131836 Nov 24 2007 "C:\Documents and Settings\Administrator\Application Data\Microsoft\Installer\{9FE51DFE-D80F-447E-9F99-85BB273213AD}\_install.exe" 131836 Nov 24 2007 "C:\Documents and Settings\Administrator\Application Data\Microsoft\Installer\{C89C8D86-4423-4A58-AA40-DD259ACE07C1}\_install.exe" 131836 Nov 24 2007 "C:\Documents and Settings\Administrator\Application Data\Microsoft\Installer\{EEB97B65-667A-4D76-ABD4-441FB30D5CE6}\_install.exe" 131836 Nov 24 2007 "C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 7.0.0.125\English\_install.exe" 131836 Nov 24 2007 "C:\Program Files\Common Files\InstallShield\Driver\10\Intel 32\_install.exe" 131836 Nov 24 2007 "C:\Program Files\Common Files\InstallShield\Driver\7\Intel 32\_install.exe" 131836 Nov 24 2007 "C:\Program Files\Common Files\InstallShield\Driver\9\Intel 32\_install.exe" 131836 Nov 24 2007 "C:\Program Files\Common Files\InstallShield\engine\6\Intel 32\_install.exe" 131836 Nov 24 2007 "C:\Documents and Settings\Administrator\Application Data\Adobe\Acrobat\7.0\Updater\_install.exe" 131836 Nov 24 2007 "C:\Documents and Settings\Administrator\Local Settings\Application Data\SRKX\ggpoClient.exe_Url_ogzo3ihle5bmw0bidhoc2savoftbqwdg\1.0.0.0\_install.exe" 131836 Nov 24 2007 "C:\Program Files\Common Files\Java\Update\Base Images\jre1.6.0.b105\patch-jre1.6.0_02.b06\_install.exe" 131836 Nov 24 2007 "C:\Documents and Settings\Administrator\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\_install.exe" 131836 Nov 24 2007 "C:\Program Files\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\_install.exe" 131836 Nov 24 2007 "C:\Program Files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\_install.exe" 131836 Nov 24 2007 "C:\Program Files\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\_install.exe" 131836 Nov 24 2007 "D:\Program Files\Adobe Type Manager\_install.exe" 131836 Nov 24 2007 "D:\Program Files\AutoCAD 2006\_install.exe" 131836 Nov 24 2007 "D:\Program Files\Azureus\_install.exe" 131836 Nov 24 2007 "D:\Program Files\Color Schemer Studio\_install.exe" 131836 Nov 24 2007 "D:\Program Files\DAEMON Tools\_install.exe" 131836 Nov 24 2007 "D:\Program Files\DirectX Happy Uninstall\_install.exe" 131836 Nov 24 2007 "D:\Program Files\DivX\_install.exe" 131836 Nov 24 2007 "D:\Program Files\Driver Cleaner PE\_install.exe" 131836 Nov 24 2007 "D:\Program Files\DVD Region+CSS Free\_install.exe" 131836 Nov 24 2007 "D:\Program Files\Ethereal\_install.exe" 131836 Nov 24 2007 "D:\Program Files\GSpot\_install.exe" 131836 Nov 24 2007 "D:\Program Files\Inkscape\_install.exe" 131836 Nov 24 2007 "D:\Program Files\K-Lite Codec Pack\_install.exe" 131836 Nov 24 2007 "D:\Program Files\Adobe\Adobe Photoshop CS2\_install.exe" 131836 Nov 24 2007 "D:\Program Files\Arturia\Moog Modular V 2\_install.exe" 131836 Nov 24 2007 "D:\Program Files\Autodesk\3dsMax8\_install.exe" 131836 Nov 24 2007 "D:\Program Files\ESET\Install\_install.exe" 131836 Nov 24 2007 "D:\Program Files\Extensis\Extensis Suitcase 11\_install.exe" 131836 Nov 24 2007 "D:\Program Files\Google\Google SketchUp 6\_install.exe" 131836 Nov 24 2007 "D:\Program Files\Inkscape\python\_install.exe" 131836 Nov 24 2007 "D:\Program Files\K-Lite Codec Pack\Media Player Classic\_install.exe" 131836 Nov 24 2007 "D:\Program Files\K-Lite Codec Pack\tools\_install.exe" 131836 Nov 24 2007 "D:\Program Files\Lavasoft\Ad-Aware SE Personal\_install.exe" 131836 Nov 24 2007 "D:\Program Files\Adobe\Adobe Illustrator CS2\Demonstrator\_install.exe" 131836 Nov 24 2007 "D:\Program Files\Adobe\Adobe Photoshop CS2\Required\_install.exe" 131836 Nov 24 2007 "D:\Program Files\Adobe\Reader 8.0\Reader\_install.exe" 131836 Nov 24 2007 "D:\Program Files\Autodesk\3dsMax8\JSR\_install.exe" 131836 Nov 24 2007 "D:\Program Files\Autodesk\3dsMax8\stdplugs\_install.exe" 131836 Nov 24 2007 "D:\Program Files\Extensis\Extensis Suitcase 11\Bonjour\_install.exe" 131836 Nov 24 2007 "D:\Program Files\K-Lite Codec Pack\tools\gspot\_install.exe" 131836 Nov 24 2007 "D:\Program Files\Adobe\Reader 8.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A80000000002}\_install.exe" 131836 Nov 24 2007 "D:\Program Files\Autodesk\3dsMax8\hair\bin\_install.exe" 131836 Nov 24 2007 "D:\Program Files\Autodesk\3dsMax8\mentalray\satellite\_install.exe" 131836 Nov 24 2007 "D:\Program Files\Autodesk\3dsMax8\stdplugs\ShineExp\_install.exe" 131836 Nov 24 2007 "D:\Program Files\Adobe\Adobe Illustrator CS2\Demonstrator\content\soundEffects\_install.exe" 131836 Nov 24 2007 "D:\Program Files\Adobe\Adobe Illustrator CS2\Support Files\Contents\Windows\_install.exe" 131836 Nov 24 2007 "D:\Program Files\Adobe\Adobe Photoshop CS2\Samples\Droplets\ImageReady Droplets\_install.exe" 131836 Nov 24 2007 "D:\Program Files\Adobe\Adobe Photoshop CS2\Samples\Droplets\Photoshop Droplets\_install.exe" 131836 Nov 24 2007 "D:\Program Files\Inkscape\python\Lib\distutils\command\_install.exe" 131836 Nov 24 2007 "D:\Program Files\Adobe\Adobe Illustrator CS2\Scripting\Sample Scripts\Visual Basic\Web Gallery\_install.exe" end of report

Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\WINDOWS\system32\_install.exe
C:\WINDOWS\_install.exe
C:\WINDOWS\system32\grtrtpgp.tmp
C:\WINDOWS\pchealth\UploadLB\Binaries\_install.exe
C:\WINDOWS\pchealth\helpctr\binaries\bak\_install.exe
C:\WINDOWS\pchealth\helpctr\binaries\_install.exe
C:\WINDOWS\inf\_install.exe
C:\WINDOWS\Help\Tours\mmTour\_install.exe

Save this as Save this as "CFScript"


[external image: Posted Image]

Refering to the picture above, drag CFScript.txt into ComboFix.exe

Then post the results log and a new HijackThis log.


Are there any folders / files in these:
C:\Documents and Settings\All Users\Application Data\~1
C:\Documents and Settings\All Users\Application Data\~0

Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winlogon.exe

Folder::
C:\Documents and Settings\All Users\Application Data\~1
C:\Documents and Settings\All Users\Application Data\~0

Save this as Save this as "CFScript"


[external image: Posted Image]

Refering to the picture above, drag CFScript.txt into ComboFix.exe

Then post the results log and a new HijackThis log.


Also please describe how your computer behaves at the moment.

Open notepad and copy/paste the text in the quotebox below into it:

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Firewall auto setup]

Save this as Save this as "CFScript"


[external image: Posted Image]

Refering to the picture above, drag CFScript.txt into ComboFix.exe

Then post the results log and a new HijackThis log.


Also please describe how your computer behaves at the moment.

Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winlogon.exe

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Firewall auto setup]

Save this as Save this as "CFScript"


[external image: Posted Image]

Refering to the picture above, drag CFScript.txt into ComboFix.exe

Then post the results log and a new HijackThis log.


Also please describe how your computer behaves at the moment.

You still needing help with this?