Slow computer! Please help.

My friends computer is running slow. Would you please check his HJT log to see if there is a problem?
Thanks for your help.
Ed
surname and email address removed


Logfile of HijackThis v1.99.1
Scan saved at 5:30:46 PM, on 11/27/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Sierra\Planner\Plnrnote.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
C:\WINDOWS\SYSTEM32\RUNDLL32.EXE
C:\WINDOWS\explorer.exe
C:\HiJackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
O1 - Hosts: 12.129.205.209 search.netscape.com12.129.205.209 sitefinder.verisign.com
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [RealTray] "C:\Program Files\Real\RealPlayer\RealPlay.exe" SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [mmtask] "c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe"
O4 - HKLM\..\Run: [77tbutap] C:\WINDOWS\System32\77tbutap.exe
O4 - HKLM\..\Run: [gcqwaip] C:\WINDOWS\System32\ihjnepm.exe r
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [34eb8a30] "rundll32.exe" "C:\WINDOWS\System32\miycujuu.dll",b
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Event Planner Reminders Tray Icon.lnk = ?
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: KODAK Software Updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

Thanks for your help. Here are the files you asked for.
Thanks again.


ComboFix 07-11-19.4C - Kelly Landram 2007-11-29 16:42:39.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.1.1252.1.1033.18.61 [GMT -5:00]
Running from: F:\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\cookies.ini
C:\WINDOWS\system32\cfg.dat
C:\WINDOWS\system32\drivers\fad.sys
C:\WINDOWS\SYSTEM32\ilkkj.ini
C:\WINDOWS\SYSTEM32\ilkkj.ini2
C:\WINDOWS\system32\jkkli.dll

.
((((((((((((((((((((((((( Files Created from 2007-10-28 to 2007-11-29 )))))))))))))))))))))))))))))))
.

2007-11-28 20:32 86,080 –a—— C:\WINDOWS\SYSTEM32\stqsllqx.dll
2007-11-27 17:29 d——– C:\HiJackThis
2007-11-27 16:35 784,957 –ahs—- C:\WINDOWS\SYSTEM32\bpwjwlnn.ini
2007-11-27 16:35 86,080 –a—— C:\WINDOWS\SYSTEM32\nnlwjwpb.dll
2007-11-25 20:12 776,072 –ahs—- C:\WINDOWS\SYSTEM32\gebxxmxa.ini
2007-11-25 15:33 d——– C:\QIMacros
2007-11-23 17:04 776,012 –ahs—- C:\WINDOWS\SYSTEM32\eoctnotd.ini
2007-11-21 22:07 20,280 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\SSFS0BB9.sys
2007-11-21 22:06 d——– C:\Program Files\AskSBar

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-22 03:06 164 —-a-w C:\install.dat
2007-10-05 00:24 28,256 —-a-w C:\WINDOWS\system32\drivers\MxlW2k.sys
2007-10-01 21:40 1,526,072 —-a-w C:\WINDOWS\WRSetup.dll
2007-10-01 21:24 23,864 —-a-w C:\WINDOWS\system32\drivers\sskbfd.sys
2007-10-01 21:24 21,816 —-a-w C:\WINDOWS\system32\drivers\sshrmd.sys
2007-10-01 21:24 163,640 —-a-w C:\WINDOWS\system32\drivers\ssidrv.sys
2007-09-26 23:02 121,048 —-a-w C:\Documents and Settings\Kelly Landram\Application Data\GDIPFONTCACHEV1.DAT
2006-01-02 19:00 120,664 —-a-w C:\Documents and Settings\Lauren Landram\Application Data\GDIPFONTCACHEV1.DAT
2005-09-05 16:55 120,664 —-a-w C:\Documents and Settings\kenny landram\Application Data\GDIPFONTCACHEV1.DAT
2005-04-21 23:17 120,664 —-a-w C:\Documents and Settings\Lindsey Landram\Application Data\GDIPFONTCACHEV1.DAT
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2}]
2007-11-21 22:07 66912 –a—— C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA}]
2007-11-21 22:06 267592 –a—— C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}"= C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL [2007-11-21 22:06 267592]

[HKEY_CLASSES_ROOT\clsid\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}"= C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL [2007-11-21 22:06 267592]

[HKEY_CLASSES_ROOT\clsid\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-11-15 16:18]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2003-04-07 01:19]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2003-04-07 01:07]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2003-08-06 02:04]
"StorageGuard"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-02-13 02:01]
"PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [2003-08-26 20:47]
"RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [2004-02-20 07:38]
"mmtask"="c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe" [2003-10-06 11:05]
"77tbutap"="C:\WINDOWS\System32\77tbutap.exe" []
"gcqwaip"="C:\WINDOWS\System32\ihjnepm.exe" []
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-12-02 09:28]
"34eb8a30"="C:\WINDOWS\System32\stqsllqx.dll" [2007-11-28 20:32]
"SpySweeper"="C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" [2007-10-01 16:40]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Event Planner Reminders Tray Icon.lnk - C:\Program Files\Sierra\Planner\Plnrnote.exe [2005-01-13 22:01:44]
Kodak EasyShare software.lnk - C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2006-06-02 04:29:26]
KODAK Software Updater.lnk - C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe [2004-02-13 14:12:08]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 00:01:04]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\gebyyvt]
gebyyvt.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\System32\jkkli.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk
backup=C:\WINDOWS\pss\America Online 9.0 Tray Icon.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
backup=C:\WINDOWS\pss\Digital Line Detect.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDSentry]
2003-08-13 11:27 28672 –a—— C:\WINDOWS\System32\DSentry.exe

R0 SSFS0BB9;Spy Sweeper File System Filer Driver: 0BB9;C:\WINDOWS\System32\Drivers\SSFS0BB9.SYS

*Newly Created Service* - ALG
*Newly Created Service* - IPNAT
*Newly Created Service* - SHAREDACCESS
.
Contents of the 'Scheduled Tasks' folder
"2007-11-16 12:21:36 C:\WINDOWS\Tasks\wrSpySweeper_L22B4012DDF324D2CA4E041AB3BBA034E.job"
- C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe>/ScheduleSweep=wrSpySweeper_L22B4012DDF324D2CA4E041AB3BBA034E
- C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.ex
- C:\
.
**************************************************************************

catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-29 16:59:00
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

**************************************************************************
.
Completion time: 2007-11-29 17:01:46 - machine was rebooted
.
— E O F —



Logfile of HijackThis v1.99.1
Scan saved at 17:06, on 2007-11-29
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Sierra\Planner\Plnrnote.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\wuauclt.exe
C:\HiJackThis\Scanner.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
O2 - BHO: Ask Search Assistant BHO - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [RealTray] "C:\Program Files\Real\RealPlayer\RealPlay.exe" SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [mmtask] "c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe"
O4 - HKLM\..\Run: [77tbutap] C:\WINDOWS\System32\77tbutap.exe
O4 - HKLM\..\Run: [gcqwaip] C:\WINDOWS\System32\ihjnepm.exe r
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [34eb8a30] "rundll32.exe" "C:\WINDOWS\System32\stqsllqx.dll",b
O4 - HKLM\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe /startintray
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Event Planner Reminders Tray Icon.lnk = ?
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: KODAK Software Updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O20 - Winlogon Notify: gebyyvt - gebyyvt.dll (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

Hrer are the files you requested.
Thanks.

ComboFix 07-12-12.3 - Kelly Landram 2007-12-13 16:48:14.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.1.1252.1.1033.18.64 [GMT -5:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Kelly Landram\Desktop\CFScript.txt
* Created a new restore point

FILE
C:\WINDOWS\System32\77tbutap.exe
C:\WINDOWS\SYSTEM32\bpwjwlnn.ini
C:\WINDOWS\SYSTEM32\eoctnotd.ini
C:\WINDOWS\SYSTEM32\gebxxmxa.ini
C:\WINDOWS\System32\ihjnepm.exe
C:\WINDOWS\SYSTEM32\nnlwjwpb.dll
C:\WINDOWS\System32\stqsllqx.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\_002683_.tmp.dll
C:\WINDOWS\system32\_002684_.tmp.dll
C:\WINDOWS\system32\_002685_.tmp.dll
C:\WINDOWS\system32\_002686_.tmp.dll
C:\WINDOWS\system32\_002693_.tmp.dll
C:\WINDOWS\system32\_002694_.tmp.dll
C:\WINDOWS\system32\_002695_.tmp.dll
C:\WINDOWS\system32\_002696_.tmp.dll
C:\WINDOWS\system32\_002698_.tmp.dll
C:\WINDOWS\system32\_002699_.tmp.dll
C:\WINDOWS\system32\_002702_.tmp.dll
C:\WINDOWS\system32\_002703_.tmp.dll
C:\WINDOWS\system32\_002705_.tmp.dll
C:\WINDOWS\system32\_002706_.tmp.dll
C:\WINDOWS\system32\_002707_.tmp.dll
C:\WINDOWS\system32\_002709_.tmp.dll
C:\WINDOWS\system32\_002710_.tmp.dll
C:\WINDOWS\system32\_002712_.tmp.dll
C:\WINDOWS\system32\_002716_.tmp.dll
C:\WINDOWS\system32\_002717_.tmp.dll
C:\WINDOWS\system32\_002719_.tmp.dll
C:\WINDOWS\system32\_002722_.tmp.dll
C:\WINDOWS\system32\_002724_.tmp.dll
C:\WINDOWS\system32\_002725_.tmp.dll
C:\WINDOWS\system32\_002726_.tmp.dll
C:\WINDOWS\system32\_002727_.tmp.dll
C:\WINDOWS\system32\_002728_.tmp.dll
C:\WINDOWS\system32\_002731_.tmp.dll
C:\WINDOWS\system32\_002733_.tmp.dll
C:\WINDOWS\system32\_002734_.tmp.dll
C:\WINDOWS\system32\_002735_.tmp.dll
C:\WINDOWS\system32\_002739_.tmp.dll
C:\WINDOWS\SYSTEM32\bpwjwlnn.ini
C:\WINDOWS\SYSTEM32\eoctnotd.ini
C:\WINDOWS\SYSTEM32\gebxxmxa.ini
C:\WINDOWS\SYSTEM32\nnlwjwpb.dll
C:\WINDOWS\System32\stqsllqx.dll
C:\WINDOWS\SYSTEM32\xqllsqts.ini

.
((((((((((((((((((((((((( Files Created from 2007-11-13 to 2007-12-13 )))))))))))))))))))))))))))))))
.

2007-12-04 08:35 . 2007-12-04 08:35 2 –a—— C:\WINDOWS\msoffice.ini
2007-12-03 08:23 . 2007-12-03 08:23 d——– C:\WINDOWS\provisioning
2007-12-03 08:23 . 2007-12-04 02:17 d——– C:\WINDOWS\peernet
2007-12-03 08:20 . 2007-12-03 08:20 d——– C:\WINDOWS\ServicePackFiles
2007-12-03 08:11 . 2005-09-09 21:04 2,025,984 –a—— C:\WINDOWS\SYSTEM32\cdosys.dll
2007-12-03 07:55 . 2007-12-03 07:55 d——– C:\WINDOWS\EHome
2007-12-01 21:49 . 2007-12-01 21:50 d——– C:\Program Files\Google
2007-11-29 17:34 . 2004-03-29 20:48 40,960 ——— C:\WINDOWS\SYSTEM32\DLLCACHE\evtgprov.dll
2007-11-29 09:03 . 2004-08-02 14:20 7,208 ——— C:\WINDOWS\SYSTEM32\secupd.sig
2007-11-29 09:03 . 2004-08-02 14:20 4,569 ——— C:\WINDOWS\SYSTEM32\secupd.dat
2007-11-27 17:29 . 2007-11-29 17:05 d——– C:\HiJackThis
2007-11-26 20:13 . 2007-11-27 16:35 784,897 –ahs—- C:\WINDOWS\SYSTEM32\uujucyim.ini
2007-11-25 17:38 . 2007-11-25 13:25 775,832 –ahs—- C:\WINDOWS\SYSTEM32\vgcauwyo.ini
2007-11-25 15:33 . 2007-11-25 15:33 d——– C:\QIMacros
2007-11-24 20:31 . 2007-11-24 21:45 776,117 –ahs—- C:\WINDOWS\SYSTEM32\vgcauwyo.tmp
2007-11-21 22:07 . 2007-10-01 16:24 20,280 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\SSFS0BB9.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-04 14:08 ——— d—–w C:\Program Files\Bonjour
2007-12-04 13:36 ——— d—–w C:\Documents and Settings\All Users\Application Data\AOL
2007-11-22 03:06 164 —-a-w C:\install.dat
2007-10-01 21:40 1,526,072 —-a-w C:\WINDOWS\WRSetup.dll
2007-09-26 23:02 121,048 —-a-w C:\Documents and Settings\Kelly Landram\Application Data\GDIPFONTCACHEV1.DAT
2005-04-21 23:17 120,664 —-a-w C:\Documents and Settings\Lindsey Landram\Application Data\GDIPFONTCACHEV1.DAT
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 02:56]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2007-12-01 21:50]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2003-04-07 01:19]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2003-04-07 01:07]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2003-08-06 02:04]
"StorageGuard"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-02-13 02:01]
"PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [2003-08-26 20:47]
"RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [2004-02-20 07:38]
"mmtask"="c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe" [2003-10-06 11:05]
"gcqwaip"="C:\WINDOWS\System32\ihjnepm.exe" []
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-12-02 09:28]
"SpySweeper"="C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" [2007-10-01 16:40]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Event Planner Reminders Tray Icon.lnk - C:\Program Files\Sierra\Planner\Plnrnote.exe [2005-01-13 22:01:44]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 00:01:04]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\gebyyvt]
gebyyvt.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk
backup=C:\WINDOWS\pss\America Online 9.0 Tray Icon.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
backup=C:\WINDOWS\pss\Digital Line Detect.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
backup=C:\WINDOWS\pss\Kodak EasyShare software.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDSentry]
2003-08-13 11:27 28672 –a—— C:\WINDOWS\System32\DSentry.exe

R0 SSFS0BB9;Spy Sweeper File System Filer Driver: 0BB9;C:\WINDOWS\System32\Drivers\SSFS0BB9.SYS

.
Contents of the 'Scheduled Tasks' folder
"2007-12-04 13:43:37 C:\WINDOWS\Tasks\wrSpySweeper_L22B4012DDF324D2CA4E041AB3BBA034E.job"
- C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe>/ScheduleSweep=wrSpySweeper_L22B4012DDF324D2CA4E041AB3BBA034E
- C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.ex
- C:\
.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-13 17:01:39
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

**************************************************************************
.
Completion time: 2007-12-13 17:03:34 - machine was rebooted
C:\ComboFix2.txt … 2007-11-29 17:01
.
2007-12-03 13:30:56 — E O F —




Logfile of HijackThis v1.99.1
Scan saved at 5:41:28 PM, on 12/13/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Sierra\Planner\Plnrnote.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
C:\WINDOWS\System32\wuauclt.exe
C:\HiJackThis\Scanner.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [RealTray] "C:\Program Files\Real\RealPlayer\RealPlay.exe" SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [mmtask] "c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe /startintray
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe"
O4 - Global Startup: Event Planner Reminders Tray Icon.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

Here are the HJT log and the combofix log. AVG would not generate a log.That option remained grayed out and would not let me choose it. AVG did find and fix 114 items. Most of them were tracking cookies but a few , about 5 or 6 ,were adware.
Thanks

ComboFix 07-12-21.4 - Kelly Landram 2007-12-26 16:37:09.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.1.1252.1.1033.18.62 [GMT -5:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Kelly Landram\Desktop\CFScript.txt
* Created a new restore point

FILE
C:\WINDOWS\SYSTEM32\uujucyim.ini
C:\WINDOWS\SYSTEM32\vgcauwyo.ini
C:\WINDOWS\SYSTEM32\vgcauwyo.tmp
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\SYSTEM32\uujucyim.ini
C:\WINDOWS\SYSTEM32\vgcauwyo.ini
C:\WINDOWS\SYSTEM32\vgcauwyo.tmp

.
((((((((((((((((((((((((( Files Created from 2007-11-26 to 2007-12-26 )))))))))))))))))))))))))))))))
.

2007-12-26 16:31 . 2007-12-26 16:31 d——– C:\Documents and Settings\Kelly Landram\Application Data\Grisoft
2007-12-26 16:30 . 2007-12-26 16:30 d——– C:\Documents and Settings\All Users\Application Data\Grisoft
2007-12-26 16:30 . 2007-05-30 07:10 10,872 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\AvgAsCln.sys
2007-12-21 21:41 . 2007-12-21 21:41 d——– C:\Documents and Settings\Kelly Landram\Application Data\CyberLink
2007-12-19 16:40 . 2007-12-19 16:40 451 –a—— C:\WINDOWS\cdPlayer.ini
2007-12-16 19:28 . 2007-12-23 18:07 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2007-12-16 19:28 . 2007-12-16 19:28 1,409 –a—— C:\WINDOWS\QTFont.for
2007-12-13 17:29 . 2004-04-10 23:04 593,408 –a—— C:\WINDOWS\SYSTEM32\DLLCACHE\xpsp2res.dll
2007-12-13 17:26 . 2004-08-04 02:56 221,184 –a—— C:\WINDOWS\SYSTEM32\wmpns.dll
2007-12-13 17:09 . 2007-12-13 17:09 d——– C:\Program Files\Common Files\Wise Installation Wizard
2007-12-05 17:46 . 2007-12-05 17:46 260,096 –a—— C:\WINDOWS\SYSTEM32\mstask.dll
2007-12-05 17:46 . 2007-12-05 17:46 172,544 –a—— C:\WINDOWS\SYSTEM32\schedsvc.dll
2007-12-05 17:46 . 2007-12-05 17:46 10,752 –a—— C:\WINDOWS\SYSTEM32\mstinit.exe
2007-12-04 08:35 . 2007-12-04 08:35 2 –a—— C:\WINDOWS\msoffice.ini
2007-12-03 08:23 . 2007-12-03 08:23 d——– C:\WINDOWS\provisioning
2007-12-03 08:23 . 2007-12-04 02:17 d——– C:\WINDOWS\peernet
2007-12-03 08:20 . 2007-12-03 08:20 d——– C:\WINDOWS\ServicePackFiles
2007-12-03 08:11 . 2005-09-09 21:04 2,025,984 –a—— C:\WINDOWS\SYSTEM32\cdosys.dll
2007-12-03 07:55 . 2007-12-03 07:55 d——– C:\WINDOWS\EHome
2007-12-01 21:49 . 2007-12-01 21:50 d——– C:\Program Files\Google
2007-11-29 17:34 . 2004-03-29 20:48 40,960 ——— C:\WINDOWS\SYSTEM32\DLLCACHE\evtgprov.dll
2007-11-29 09:03 . 2004-08-02 14:20 7,208 ——— C:\WINDOWS\SYSTEM32\secupd.sig
2007-11-29 09:03 . 2004-08-02 14:20 4,569 ——— C:\WINDOWS\SYSTEM32\secupd.dat
2007-11-27 17:29 . 2007-12-13 17:41 d——– C:\HiJackThis

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-19 22:43 28,256 —-a-w C:\WINDOWS\system32\drivers\MxlW2k.sys
2007-12-04 14:08 ——— d—–w C:\Program Files\Bonjour
2007-12-04 13:36 ——— d—–w C:\Documents and Settings\All Users\Application Data\AOL
2007-11-22 03:06 164 —-a-w C:\install.dat
2007-10-01 21:40 1,526,072 —-a-w C:\WINDOWS\WRSetup.dll
2007-09-26 23:02 121,048 —-a-w C:\Documents and Settings\Kelly Landram\Application Data\GDIPFONTCACHEV1.DAT
2005-04-21 23:17 120,664 —-a-w C:\Documents and Settings\Lindsey Landram\Application Data\GDIPFONTCACHEV1.DAT
.

((((((((((((((((((((((((((((( snapshot@2007-12-13_17.02.05.79 )))))))))))))))))))))))))))))))))))))))))
.
- 2004-03-30 01:34:15 741,376 —-a-w C:\WINDOWS\PCHealth\HelpCtr\Binaries\helpctr.exe
+ 2004-04-14 22:50:06 740,864 —-a-w C:\WINDOWS\PCHealth\HelpCtr\Binaries\helpctr.exe
- 2002-08-29 11:00:00 8,704 —-a-w C:\WINDOWS\PCHealth\HelpCtr\Binaries\hscupd.exe
+ 2004-04-11 00:53:14 16,384 —-a-w C:\WINDOWS\PCHealth\HelpCtr\Binaries\hscupd.exe
- 2002-08-29 11:00:00 97,792 —-a-w C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchshell.dll
+ 2002-11-27 16:50:20 94,208 —-a-w C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchshell.dll
- 2004-02-20 12:35:28 4,302 —-a-w C:\WINDOWS\PCHealth\HelpCtr\PackageStore\SkuStore.bin
+ 2007-12-13 22:31:49 17,472 —-a-w C:\WINDOWS\PCHealth\HelpCtr\PackageStore\SkuStore.bin
- 2002-08-29 11:00:00 179,200 —-a-w C:\WINDOWS\SYSTEM32\accwiz.exe
+ 2002-11-20 16:50:50 179,200 —-a-w C:\WINDOWS\SYSTEM32\accwiz.exe
- 2002-08-29 11:00:00 44,032 —-a-w C:\WINDOWS\SYSTEM32\basesrv.dll
+ 2004-06-17 17:58:35 47,616 —-a-w C:\WINDOWS\SYSTEM32\basesrv.dll
- 2007-12-03 12:46:26 32,768 —-a-w C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\INDEX.DAT
+ 2007-12-13 22:31:40 32,768 —-a-w C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\INDEX.DAT
- 2007-12-03 12:46:26 32,768 —-a-w C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\History\History.IE5\INDEX.DAT
+ 2007-12-13 22:31:40 32,768 —-a-w C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\History\History.IE5\INDEX.DAT
- 2007-12-03 12:46:26 65,536 —-a-w C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\INDEX.DAT
+ 2007-12-13 22:31:41 32,768 —-a-w C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2002-08-29 11:00:00 53,248 —-a-w C:\WINDOWS\SYSTEM32\cryptsvc.dll
+ 2003-03-25 21:40:14 53,760 —-a-w C:\WINDOWS\SYSTEM32\cryptsvc.dll
- 2002-08-29 11:00:00 471,040 —-a-w C:\WINDOWS\SYSTEM32\cryptui.dll
+ 2003-07-24 21:40:22 477,696 —-a-w C:\WINDOWS\SYSTEM32\cryptui.dll
- 2002-08-29 11:00:00 61,440 —-a-w C:\WINDOWS\SYSTEM32\dbnetlib.dll
+ 2003-10-28 01:12:42 61,440 —-a-w C:\WINDOWS\SYSTEM32\DBnetlib.dll
+ 2004-03-01 18:55:22 561,179 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\dao360.dll
+ 2003-10-28 01:12:42 61,440 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\DBnetlib.dll
+ 2004-01-10 11:37:02 380,957 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\expsrv.dll
+ 2003-10-28 01:09:50 126,976 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\msdart.dll
+ 2004-03-01 18:55:23 512,029 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\msexch40.dll
+ 2004-03-01 18:55:24 319,517 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\msexcl40.dll
+ 2004-03-16 18:44:10 1,507,356 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\msjet40.dll
+ 2004-03-01 18:52:15 358,976 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\msjetol1.dll
+ 2004-03-16 17:38:32 151,583 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\msjint40.dll
+ 2004-01-10 11:36:33 53,279 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\msjter40.dll
+ 2004-03-01 18:55:29 241,693 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\msjtes40.dll
+ 2004-01-10 11:36:38 213,023 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\msltus40.dll
+ 2004-03-01 18:55:31 348,189 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\mspbde40.dll
+ 2004-01-10 11:36:42 421,919 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\msrd2x40.dll
+ 2004-01-10 11:36:43 315,423 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\msrd3x40.dll
+ 2004-03-01 18:55:35 552,989 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\msrepl40.dll
+ 2004-03-01 18:55:35 258,077 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\mstext40.dll
+ 2004-01-10 11:36:50 831,519 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\mswdat10.dll
+ 2004-03-16 17:38:33 614,431 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\mswstr10.dll
+ 2004-03-01 18:55:39 348,189 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\msxbde40.dll
+ 2003-10-28 01:09:44 204,800 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\ODBC32.dll
+ 2003-10-28 01:13:06 98,304 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\ODBCCP32.dll
+ 2003-10-28 01:10:24 417,792 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\oledb32.dll
+ 2004-03-16 18:44:16 30,749 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\vbajet32.dll
- 2002-08-29 11:00:00 157,056 —-a-w C:\WINDOWS\SYSTEM32\DRIVERS\netbt.sys
+ 2003-07-08 21:48:54 149,248 —-a-w C:\WINDOWS\SYSTEM32\DRIVERS\netbt.sys
- 2002-08-29 11:00:00 46,336 —-a-w C:\WINDOWS\SYSTEM32\DRIVERS\raspptp.sys
+ 2002-10-01 22:52:30 46,208 —-a-w C:\WINDOWS\SYSTEM32\DRIVERS\raspptp.sys
- 2002-08-29 11:00:00 380,445 —-a-w C:\WINDOWS\SYSTEM32\expsrv.dll
+ 2004-01-10 11:37:02 380,957 —-a-w C:\WINDOWS\SYSTEM32\expsrv.dll
- 2002-08-29 11:00:00 37,888 —-a-w C:\WINDOWS\SYSTEM32\grpconv.exe
+ 2004-07-29 22:50:08 38,400 —-a-w C:\WINDOWS\SYSTEM32\grpconv.exe
- 2002-08-29 11:00:00 92,160 —-a-w C:\WINDOWS\SYSTEM32\krnl386.exe
+ 2004-05-17 22:48:03 92,224 —-a-w C:\WINDOWS\SYSTEM32\krnl386.exe
- 2002-08-29 11:00:00 68,096 —-a-w C:\WINDOWS\SYSTEM32\locator.exe
+ 2002-12-03 23:50:10 68,608 —-a-w C:\WINDOWS\SYSTEM32\locator.exe
- 2002-08-29 11:00:00 67,584 —-a-w C:\WINDOWS\SYSTEM32\magnify.exe
+ 2002-11-20 16:50:52 67,584 —-a-w C:\WINDOWS\SYSTEM32\magnify.exe
- 2007-11-02 05:12:58 18,238,072 —-a-w C:\WINDOWS\SYSTEM32\MRT.exe
+ 2007-12-02 23:00:05 18,684,536 —-a-w C:\WINDOWS\SYSTEM32\MRT.exe
- 2002-08-29 11:00:00 126,976 —-a-w C:\WINDOWS\SYSTEM32\msdart.dll
+ 2003-10-28 01:09:50 126,976 —-a-w C:\WINDOWS\SYSTEM32\msdart.dll
- 2002-08-29 11:00:00 512,031 —-a-w C:\WINDOWS\SYSTEM32\msexch40.dll
+ 2004-03-01 18:55:23 512,029 —-a-w C:\WINDOWS\SYSTEM32\msexch40.dll
- 2002-08-29 11:00:00 319,519 —-a-w C:\WINDOWS\SYSTEM32\msexcl40.dll
+ 2004-03-01 18:55:24 319,517 —-a-w C:\WINDOWS\SYSTEM32\msexcl40.dll
- 2002-08-29 11:00:00 1,503,262 —-a-w C:\WINDOWS\SYSTEM32\msjet40.dll
+ 2004-03-16 18:44:10 1,507,356 —-a-w C:\WINDOWS\SYSTEM32\msjet40.dll
- 2002-08-29 11:00:00 348,195 —-a-w C:\WINDOWS\SYSTEM32\msjetoledb40.dll
+ 2004-03-01 18:52:15 358,976 —-a-w C:\WINDOWS\SYSTEM32\msjetoledb40.dll
- 2002-08-29 11:00:00 151,626 —-a-w C:\WINDOWS\SYSTEM32\msjint40.dll
+ 2004-03-16 17:38:32 151,583 —-a-w C:\WINDOWS\SYSTEM32\msjint40.dll
- 2002-08-29 11:00:00 53,322 —-a-w C:\WINDOWS\SYSTEM32\msjter40.dll
+ 2004-01-10 11:36:33 53,279 —-a-w C:\WINDOWS\SYSTEM32\msjter40.dll
- 2002-08-29 11:00:00 241,695 —-a-w C:\WINDOWS\SYSTEM32\msjtes40.dll
+ 2004-03-01 18:55:29 241,693 —-a-w C:\WINDOWS\SYSTEM32\msjtes40.dll
- 2002-08-29 11:00:00 213,023 —-a-w C:\WINDOWS\SYSTEM32\msltus40.dll
+ 2004-01-10 11:36:38 213,023 —-a-w C:\WINDOWS\SYSTEM32\msltus40.dll
- 2002-08-29 11:00:00 348,191 —-a-w C:\WINDOWS\SYSTEM32\mspbde40.dll
+ 2004-03-01 18:55:31 348,189 —-a-w C:\WINDOWS\SYSTEM32\mspbde40.dll
- 2002-08-29 11:00:00 421,919 —-a-w C:\WINDOWS\SYSTEM32\msrd2x40.dll
+ 2004-01-10 11:36:42 421,919 —-a-w C:\WINDOWS\SYSTEM32\msrd2x40.dll
- 2002-08-29 11:00:00 315,466 —-a-w C:\WINDOWS\SYSTEM32\msrd3x40.dll
+ 2004-01-10 11:36:43 315,423 —-a-w C:\WINDOWS\SYSTEM32\msrd3x40.dll
- 2002-08-29 11:00:00 552,991 —-a-w C:\WINDOWS\SYSTEM32\msrepl40.dll
+ 2004-03-01 18:55:35 552,989 —-a-w C:\WINDOWS\SYSTEM32\msrepl40.dll
- 2002-08-29 11:00:00 253,983 —-a-w C:\WINDOWS\SYSTEM32\mstext40.dll
+ 2004-03-01 18:55:35 258,077 —-a-w C:\WINDOWS\SYSTEM32\mstext40.dll
- 2002-08-29 11:00:00 831,562 —-a-w C:\WINDOWS\SYSTEM32\mswdat10.dll
+ 2004-01-10 11:36:50 831,519 —-a-w C:\WINDOWS\SYSTEM32\mswdat10.dll
- 2002-08-29 11:00:00 614,474 —-a-w C:\WINDOWS\SYSTEM32\mswstr10.dll
+ 2004-03-16 17:38:33 614,431 —-a-w C:\WINDOWS\SYSTEM32\mswstr10.dll
- 2002-08-29 11:00:00 344,095 —-a-w C:\WINDOWS\SYSTEM32\msxbde40.dll
+ 2004-03-01 18:55:39 348,189 —-a-w C:\WINDOWS\SYSTEM32\msxbde40.dll
- 2002-08-29 11:00:00 51,200 —-a-w C:\WINDOWS\SYSTEM32\narrator.exe
+ 2002-11-20 16:50:52 51,200 —-a-w C:\WINDOWS\SYSTEM32\narrator.exe
- 2002-08-29 11:00:00 16,384 —-a-w C:\WINDOWS\SYSTEM32\nddenb32.dll
+ 2004-06-17 00:24:49 16,384 —-a-w C:\WINDOWS\SYSTEM32\nddenb32.dll
- 2002-08-29 11:00:00 105,984 —-a-w C:\WINDOWS\SYSTEM32\netdde.exe
+ 2004-06-16 18:32:52 107,008 —-a-w C:\WINDOWS\SYSTEM32\netdde.exe
- 2002-08-29 11:00:00 238,080 —-a-w C:\WINDOWS\SYSTEM32\newdev.dll
+ 2003-01-31 21:46:24 238,080 —-a-w C:\WINDOWS\SYSTEM32\newdev.dll
- 2002-08-29 11:00:00 668,672 —-a-w C:\WINDOWS\SYSTEM32\ntdll.dll
+ 2003-05-01 21:56:12 654,336 —-a-w C:\WINDOWS\SYSTEM32\ntdll.dll
- 2002-08-29 11:00:00 33,808 —-a-w C:\WINDOWS\SYSTEM32\ntio.sys
+ 2004-05-17 22:43:02 33,840 —-a-w C:\WINDOWS\SYSTEM32\ntio.sys
- 2002-08-29 11:00:00 34,528 —-a-w C:\WINDOWS\SYSTEM32\ntio404.sys
+ 2004-05-17 22:43:07 34,560 —-a-w C:\WINDOWS\SYSTEM32\ntio404.sys
- 2002-08-29 11:00:00 35,632 —-a-w C:\WINDOWS\SYSTEM32\ntio411.sys
+ 2004-05-17 22:43:04 35,648 —-a-w C:\WINDOWS\SYSTEM32\ntio411.sys
- 2002-08-29 11:00:00 35,392 —-a-w C:\WINDOWS\SYSTEM32\ntio412.sys
+ 2004-05-17 22:43:09 35,424 —-a-w C:\WINDOWS\SYSTEM32\ntio412.sys
- 2002-08-29 11:00:00 34,528 —-a-w C:\WINDOWS\SYSTEM32\ntio804.sys
+ 2004-05-17 22:43:06 34,560 —-a-w C:\WINDOWS\SYSTEM32\ntio804.sys
- 2002-08-29 11:00:00 395,776 —-a-w C:\WINDOWS\SYSTEM32\ntvdm.exe
+ 2004-06-12 01:14:34 396,288 —-a-w C:\WINDOWS\SYSTEM32\ntvdm.exe
- 2002-08-29 11:00:00 13,312 —-a-w C:\WINDOWS\SYSTEM32\NTVDMD.DLL
+ 2004-06-17 17:58:35 13,312 —-a-w C:\WINDOWS\SYSTEM32\ntvdmd.dll
- 2002-08-29 11:00:00 200,704 —-a-w C:\WINDOWS\SYSTEM32\odbc32.dll
+ 2003-10-28 01:09:44 204,800 —-a-w C:\WINDOWS\SYSTEM32\ODBC32.dll
- 2002-08-29 11:00:00 24,576 —-a-w C:\WINDOWS\SYSTEM32\odbcbcp.dll
+ 2003-10-28 01:13:16 24,576 —-a-w C:\WINDOWS\SYSTEM32\odbcbcp.dll
- 2002-08-29 11:00:00 94,208 —-a-w C:\WINDOWS\SYSTEM32\odbccp32.dll
+ 2003-10-28 01:13:06 98,304 —-a-w C:\WINDOWS\SYSTEM32\ODBCCP32.dll
- 2002-08-29 11:00:00 385,024 —-a-w C:\WINDOWS\SYSTEM32\sqlsrv32.dll
+ 2003-10-28 01:12:44 385,024 —-a-w C:\WINDOWS\SYSTEM32\SQLSRV32.dll
- 2007-07-22 23:39:27 279,552 —-a-w C:\WINDOWS\SYSTEM32\swreg.exe
+ 2007-12-14 02:26:50 156,160 —-a-w C:\WINDOWS\SYSTEM32\swreg.exe
- 2002-08-29 11:00:00 230,400 —-a-w C:\WINDOWS\SYSTEM32\USMT\migwiz.exe
+ 2002-11-20 17:22:36 230,400 —-a-w C:\WINDOWS\SYSTEM32\USMT\migwiz.exe
- 2002-08-29 11:00:00 30,992 —-a-w C:\WINDOWS\SYSTEM32\vbajet32.dll
+ 2004-03-16 18:44:16 30,749 —-a-w C:\WINDOWS\SYSTEM32\vbajet32.dll
- 2002-08-29 11:00:00 24,064 —-a-w C:\WINDOWS\SYSTEM32\vdmdbg.dll
+ 2004-06-17 17:58:35 23,040 —-a-w C:\WINDOWS\SYSTEM32\vdmdbg.dll
- 2002-08-29 11:00:00 516,608 —-a-w C:\WINDOWS\SYSTEM32\winlogon.exe
+ 2004-05-27 01:38:46 483,328 —-a-w C:\WINDOWS\SYSTEM32\winlogon.exe
- 2002-08-29 11:00:00 247,808 —-a-w C:\WINDOWS\SYSTEM32\wow32.dll
+ 2004-06-04 00:43:01 245,760 —-a-w C:\WINDOWS\SYSTEM32\wow32.dll
- 2003-10-14 06:50:15 26,112 —-a-w C:\WINDOWS\SYSTEM32\xpsp1hfm.exe
+ 2004-04-10 17:24:44 26,112 —-a-w C:\WINDOWS\SYSTEM32\xpsp1hfm.exe
- 2003-03-03 18:17:10 316,928 —-a-w C:\WINDOWS\SYSTEM32\zipfldr.dll
+ 2004-08-21 07:54:17 316,928 —-a-w C:\WINDOWS\SYSTEM32\zipfldr.dll
+ 2004-04-16 22:56:04 921,600 —-a-w C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.1515_x-ww_7bb98b8a\comctl32.dll
+ 2004-08-20 20:01:14 921,600 —-a-w C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.1579_x-ww_7bbf8d08\comctl32.dll
+ 2004-03-02 21:19:47 1,638,400 —-a-w C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.1360_x-ww_24a2ed47\GdiPlus.dll
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 02:56]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-12-23 17:28]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2003-04-07 01:19]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2003-04-07 01:07]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2003-08-06 02:04]
"StorageGuard"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-02-13 02:01]
"PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [2003-08-26 20:47]
"RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [2004-02-20 07:38]
"mmtask"="c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe" [2003-10-06 11:05]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-12-02 09:28]
"SpySweeper"="C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" [2007-10-01 16:40]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Event Planner Reminders Tray Icon.lnk - C:\Program Files\Sierra\Planner\Plnrnote.exe [2005-01-13 22:01:44]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 00:01:04]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk
backup=C:\WINDOWS\pss\America Online 9.0 Tray Icon.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
backup=C:\WINDOWS\pss\Digital Line Detect.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
backup=C:\WINDOWS\pss\Kodak EasyShare software.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDSentry]
2003-08-13 11:27 28672 –a—— C:\WINDOWS\System32\DSentry.exe

R0 SSFS0BB9;Spy Sweeper File System Filer Driver: 0BB9;C:\WINDOWS\System32\Drivers\SSFS0BB9.SYS [2007-10-01 16:24]

*Newly Created Service* - AVG_ANTI-SPYWARE_DRIVER
*Newly Created Service* - AVG_ANTI-SPYWARE_GUARD
.
Contents of the 'Scheduled Tasks' folder
"2007-12-24 20:00:10 C:\WINDOWS\Tasks\wrSpySweeper_L22B4012DDF324D2CA4E041AB3BBA034E.job"
- C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe>/ScheduleSweep=wrSpySweeper_L22B4012DDF324D2CA4E041AB3BBA034E
- C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.ex
- C:\
.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-26 16:41:27
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-26 16:42:16
C:\ComboFix2.txt … 2007-12-13 17:03
C:\ComboFix3.txt … 2007-11-29 17:01
.
2007-12-13 22:34:11 — E O F —



Logfile of HijackThis v1.99.1
Scan saved at 5:52:02 PM, on 12/26/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Sierra\Planner\Plnrnote.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\wuauclt.exe
C:\HiJackThis\Scanner.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.1121.2472\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [RealTray] "C:\Program Files\Real\RealPlayer\RealPlay.exe" SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [mmtask] "c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe /startintray
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Global Startup: Event Planner Reminders Tray Icon.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

Here are the log files.The computer seems to be running better.

Thanks

——————————————————————————-
KASPERSKY ONLINE SCANNER REPORT
2008-01-05 6:53:29 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 1 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 5/01/2008
Kaspersky Anti-Virus database records: 502954
——————————————————————————-

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\
E:\

Scan Statistics:
Total number of scanned objects: 71146
Number of viruses found: 5
Number of infected objects: 5
Number of suspicious objects: 0
Duration of the scan process: 00:56:16

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\338894d3fb9005e527aebdb17e99fec1_1dce0e75-1303-433a-bfc1-6b582bd25551 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\Kelly Landram\Application Data\Webroot\Spy Sweeper\Logs\080105173208.ses Object is locked skipped
C:\Documents and Settings\Kelly Landram\Cookies\INDEX.DAT Object is locked skipped
C:\Documents and Settings\Kelly Landram\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Kelly Landram\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Kelly Landram\Local Settings\History\History.IE5\INDEX.DAT Object is locked skipped
C:\Documents and Settings\Kelly Landram\Local Settings\History\History.IE5\MSHist012008010520080106\index.dat Object is locked skipped
C:\Documents and Settings\Kelly Landram\Local Settings\Temporary Internet Files\Content.IE5\INDEX.DAT Object is locked skipped
C:\Documents and Settings\Kelly Landram\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Kelly Landram\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Data\settings.dat Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS02F72AB1-0935-4C01-85E1-3CF189B0799D.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS03D181AD-848E-48FE-AA18-4C43B30C3C0D.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS045472E0-8C76-47A0-B6B6-A887E58F4C84.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS062DCB5F-D890-41AC-B8F2-017F21C0233A.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS0635EA55-1027-4E19-8DCC-ABE800A9AE8D.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS06E16CB7-0052-4388-8F8D-30BA0E7A360D.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS07D1649A-4A98-4EBD-93D6-90D88A024C96.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS1374AEC4-ACC6-438E-A976-2D6F7C66A714.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS190F5911-0031-4698-AD21-339E0FC4148D.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS1EA6D2A8-D1A6-461F-B85F-D061355EF327.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS235EF81F-A33B-4F88-B13C-CA5185A1B75C.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS240F4576-CBAF-4196-AEDC-2CDBBE0B60CD.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS247EA4EE-AF84-4DF3-8FD2-73A9F5477B29.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS27A9C094-5C62-4481-B09C-93F08DA2BB15.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS2A1A6D96-6034-4A1B-B1E7-8DAFE93E85BF.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS2F8376DC-9433-4717-BD9E-E27FB2CF5088.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS32B66AB3-01C7-40A5-AB13-C939556D41D1.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS364DE323-9F01-42F7-A900-AFDC180E9DCC.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS3662573F-E418-4C2A-A523-DEDD30FB7470.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS368A4F2F-D98F-4C82-AFA3-822401E8D971.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS37A3CC72-2082-42F9-86CE-A4B52E2D27B3.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS37C77DBA-9A0B-4452-BEE2-C3681F48AE6C.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS38E588F1-3CF2-4B88-BEC1-E15063720474.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS395743B6-8D19-4889-83CE-B6D40248E9D3.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS4089CE1C-7208-4BC7-BF9F-03E5B22E416D.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS42E4D4CF-18DD-4DDF-96AA-5C80041CD187.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS444E1511-449B-4868-8A53-563F3269B4D2.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS462BF2F9-11A1-4939-960D-60AE8D675639.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS54AB2A20-FEC4-4007-92F6-4C31C0C0866B.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS5617ED18-D04B-469C-BD67-131365CAC6BC.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS57AF616B-A09D-491B-A207-9615EF8DD012.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS581CEF5D-286F-49AB-A8B7-10D4518F26D7.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS5AC8C241-A9B9-4767-A42D-D3A486919F07.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS5C52A87E-3351-4DC1-87DD-0914BD14B10C.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS5F9BA6C7-AF70-4F74-A251-44B8CE0F7DD0.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS61392028-8471-4A9F-8D9A-7DF09926C840.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS61A763B9-7C14-4F25-BEB1-6D4AE0EFA367.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS690CD5B4-BC25-488A-B45C-AC42CFA156A3.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS6ED2AAC9-005E-4F6B-A252-C0FC00F2F764.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS6F29BE4B-D6A9-4299-89D9-2B588EB6E0C9.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS70B7AD36-C269-47EA-A49F-D7BC473F2FE5.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS7226AAC1-8FE0-477C-8973-ADE47B38F9BC.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS73F3AA9F-6CCF-4734-82F6-F243A24A6801.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS74AD8DF6-0BE2-4955-BC63-8EC1C79B2FC9.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS76DF42D4-1B6B-4919-9278-5943C58E91F1.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS7E04199E-882C-469B-8C39-CBB6C96A2DD0.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS811E5EF6-2EBF-4961-857E-C96E3A2C2813.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS81F150DC-E643-45D5-9B53-05B83F090134.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS8AEBD3C1-FDCE-45B0-A313-AC4C947FB8F2.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS8C26D091-3235-4D70-B9B1-5BDDAC5814E1.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS962B7F9A-6151-4D57-9632-6F24689FF689.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS97DC180A-093A-4A79-9C5D-F4885B741D50.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS99357BC5-CF18-4DA5-9501-CA62BC8AF9DA.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS99477BAF-596E-460A-9769-A37338DEC9CE.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMSA1C9A5B5-2854-4A1B-A635-A9991F12C9E0.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMSA2D91415-A419-4055-B6CF-EC22C6B311DF.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMSA337D090-B91F-4E55-BEE4-B14A12BB157A.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMSAC318EB8-FE21-4484-B027-28420FF31BC5.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMSB2DB772F-0E09-4AF3-B164-0379F0D12FD1.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMSB597581A-7339-4EDF-AA21-6E1F81C30B88.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMSB7130231-8BBE-4C70-9603-D2133FF1CBE2.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMSBA0AD0A4-1096-4DB5-84D8-984D75BE1D3D.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMSBD427882-67D7-49C7-9B28-52DAFC69E4E5.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMSC18684EE-23AD-452F-817C-DA9D21F7FC51.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMSC2E9DAEB-193B-4E0F-8601-270D80C593E6.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMSC6EEEFD1-659F-4EA4-B403-F38C44D37735.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMSC7F32B5D-060D-429E-A19D-E625FD7A63A2.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMSC82F47AC-F1A7-4870-B347-B9E47ECCBB6E.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMSCD03A6A9-B1FC-4269-B0CF-2CE014B567A8.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMSCE15C08E-1FC7-432F-AEE9-376CED09E91F.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMSD1083481-5714-4FA9-AB10-F47BF2B9F49C.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMSD145E220-FB0F-41E6-9160-9D822AB5659F.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMSD1A4F180-97D1-413B-87B1-F78547CE5CAF.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMSD2A4E038-2622-4640-B51C-51FB0D160BE9.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMSD49A9567-923B-476F-8C1B-98A3B425D78A.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMSD5F002D3-3E47-4DEF-B205-0DD1951D1AF9.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMSD73812BD-3FDB-443B-9633-409E7EBE2513.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMSD9322B8C-A7D6-4A8F-B02D-9E0A7110E13C.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMSDE7A7CBE-7687-4C53-9705-7B24C387F185.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMSE280EE57-9599-4CC8-B927-97A3E5125609.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMSE589B3CF-295E-4453-AC4A-70D837C69056.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMSEADF9F18-ADF9-4493-B406-1874621FD954.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMSEC3A8169-A94E-4E5A-AD92-DF0F00576086.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMSED74FEF5-3C46-45E4-8A01-D182DD4872E7.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMSEDF44D97-83D2-4417-B963-31C971E45315.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMSF216814A-2315-4B3B-B39D-81A1EF093751.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMSFBE5F039-5E22-48CD-937A-47588021E2F7.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMSFD03989C-C980-4B7A-9C0C-5C6B1A6506FD.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMSFD184E4D-0CF0-4E14-B38A-5F2ABBA5A42E.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\INDEX.DAT Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\INDEX.DAT Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\INDEX.DAT Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Program Files\Audible\Admin\atm.log Object is locked skipped
C:\Program Files\Audible\Bin\Debug.log Object is locked skipped
C:\Program Files\Audible\Bin\Details.html Object is locked skipped
C:\Program Files\Audible\Bin\Update.log Object is locked skipped
C:\Program Files\Audible\Programs\Downloads\aasubsschedule.log Object is locked skipped
C:\Program Files\Webroot\Spy Sweeper\Masters\masters.bak Object is locked skipped
C:\Program Files\Webroot\Spy Sweeper\Masters\Masters.const Object is locked skipped
C:\Program Files\Webroot\Spy Sweeper\Masters\masters.mst Object is locked skipped
C:\Program Files\Webroot\Spy Sweeper\Masters.base Object is locked skipped
C:\Program Files\Windows Media Player\wmplayer.exe.tmp Infected: Trojan-Downloader.Win32.Small.bem skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP575\A0101459.exe Infected: Trojan-Dropper.Win32.Agent.se skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP575\A0101461.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.ai skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP575\A0101462.exe Infected: not-a-virus:AdWare.Win32.Sahat.f skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP582\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{88D86832-73F3-4C68-AD87-52FAAEFF0B4E}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\SYSTEM32\bpbnulq1.ini Infected: not-a-virus:AdWare.Win32.Sahat.ao skipped
C:\WINDOWS\SYSTEM32\CONFIG\AppEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SAM Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SecEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SECURITY Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SysEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\H323LOG.TXT Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\WIADEBUG.LOG Object is locked skipped
C:\WINDOWS\WIASERVC.LOG Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.



Logfile of HijackThis v1.99.1
Scan saved at 4:14:47 PM, on 1/6/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Sierra\Planner\Plnrnote.exe
C:\HiJackThis\Scanner.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.1121.2472\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [RealTray] "C:\Program Files\Real\RealPlayer\RealPlay.exe" SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [mmtask] "c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - Global Startup: Event Planner Reminders Tray Icon.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

Here are the logs you requested.
Thanks


Logfile of HijackThis v1.99.1
Scan saved at 8:21:24 PM, on 1/23/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Sierra\Planner\Plnrnote.exe
C:\WINDOWS\System32\wuauclt.exe
C:\HiJackThis\Scanner.exe.exe
C:\WINDOWS\System32\wuauclt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.1121.2472\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [RealTray] "C:\Program Files\Real\RealPlayer\RealPlay.exe" SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [mmtask] "c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - Global Startup: Event Planner Reminders Tray Icon.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe




——————————————————————————-
KASPERSKY ONLINE SCANNER REPORT
2008-01-23 9:34:49 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 1 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 23/01/2008
Kaspersky Anti-Virus database records: 528852
——————————————————————————-

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\
E:\
F:\

Scan Statistics:
Total number of scanned objects: 70243
Number of viruses found: 2
Number of infected objects: 2
Number of suspicious objects: 0
Duration of the scan process: 00:57:07

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\338894d3fb9005e527aebdb17e99fec1_1dce0e75-1303-433a-bfc1-6b582bd25551 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\Kelly Landram\Application Data\Webroot\Spy Sweeper\Logs\080123201928.ses Object is locked skipped
C:\Documents and Settings\Kelly Landram\Cookies\INDEX.DAT Object is locked skipped
C:\Documents and Settings\Kelly Landram\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Kelly Landram\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Kelly Landram\Local Settings\History\History.IE5\INDEX.DAT Object is locked skipped
C:\Documents and Settings\Kelly Landram\Local Settings\Temporary Internet Files\Content.IE5\INDEX.DAT Object is locked skipped
C:\Documents and Settings\Kelly Landram\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Kelly Landram\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Data\settings.dat Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS016E171A-860E-47E1-97C8-C7970C622B0A.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS01D92A9B-A795-4029-B21D-940179E9DDC7.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS07A6505C-A34B-4BB2-BD6A-2F385A9CAAAF.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS09198BA2-8D2A-4EBA-8DF4-E0553EF77994.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS09EEA890-587A-4668-B03D-B39997B37719.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS107F9AE1-B806-4121-9493-04659041FA58.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS13714225-91C4-4235-830C-5A967CE1F915.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS155E78C4-8A19-42AE-A806-68E08E0B1F5F.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS17DE3A56-FE84-429B-9F46-91069635B618.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS1E1F6D26-3592-44E3-B9D7-66095558CCD3.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS2880075E-01E6-4101-AADC-4A1876AD1EC0.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS2CD275F3-60A2-4311-A623-7414DCA09A20.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS2FFA63E8-0B69-4870-BB8B-2BC0E4397517.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS335D957B-98C8-4D5B-A178-1C5847E5F4F3.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS33FDB24E-5591-4008-8495-8C0DEA3EF517.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS3789D4ED-5C53-4D4A-AA49-4C6961D61FED.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS394718E7-F3C0-42B4-A6DE-95D4CA8A19F5.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS3CEE7832-53F3-4DC1-B11A-701A237F46A9.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS4377DD9D-7C5A-49E9-B025-D7C396F7BC36.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS4CD9B673-FBB9-4917-821B-F008990AF3AA.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS4E66788F-5A61-4DE9-B89A-FC2F6D6A4CBC.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS57A2DC1C-1229-4EE6-9994-7ED509880018.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS57A7577C-01B4-4EFB-9656-372EEE0D5DE2.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS59B7FC42-9C81-45C3-A35A-B8B4ED37E292.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS5DCB5695-5CB5-423B-BD1C-8543583BDD15.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS5E75E053-C600-4736-89AF-73DDE513AE1B.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS5F7C27F4-AA60-4A52-8237-0739FC4C3164.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS600806BD-BB5B-4BEB-834A-7F921E174D84.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS60A8F4DA-9DBF-47A3-AD87-1D07CA6A74D0.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS61A81EFD-3893-4215-985F-891186622CA9.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS626DDC42-099E-4EC2-BE36-4D6F1BD86DB6.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS63CACAF0-420D-44B8-9CAC-BAD4D4BCFC24.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS651149FC-B04D-4261-88B4-752212A0B385.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS66731B6C-0C2E-4A85-9614-D2E005071B19.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS6B372FD6-CDC1-42A3-9050-6B3FDB5DA268.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS6BE9D26F-155E-492D-B11F-F2EA4A1BE204.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS705C42C7-C450-40C8-B0DD-7472BC3CDE86.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS738AB93F-1340-4CEF-BFD7-E231E73463CC.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS7746B822-D89A-4244-BCCE-72A45A418939.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS78DD2AD5-C6D7-4194-9430-0FB457D63F2A.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS790250E1-063A-47FD-BB77-DE7219D86CF4.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS7A0CE95C-E37F-469D-8DE1-14C87BFFB565.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS7BD9059B-75A9-45C8-9492-18AC1CE1D1A5.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS7C9CB91D-C548-4D2D-BC76-12608DA0C355.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS7E08DA90-0AF9-49BA-B2AE-5B52454C0731.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS7E56EC0B-C044-46E9-8C04-7F0DC5B1A1F8.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS80A31E37-9583-438A-ADCA-D67F09D8DBB3.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS80A6D341-997F-4452-B8AA-D436060E14F2.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS8181E027-DF02-4A80-BBE7-647C2217B353.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS8BC9DBB0-705C-49ED-9329-5EE9A4EAFAF3.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS8FA0AE8C-7D9F-4686-B56D-6EB7C88E8753.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS919774BB-D13F-4B65-B7ED-B8436471BC3A.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS93A3E325-D8FC-46BB-B599-EADC21960D0F.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS96CCD262-5160-470F-81CA-6F66B108869D.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS98C0F9AF-E794-4E20-BC12-C2485B716A26.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMS9C43675D-4903-45FA-AA7D-8CDFD03E9D6D.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMSA21B988A-23D9-4195-9C70-B13F9762720E.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMSA4E238CB-85C5-4C87-B6F4-1757F35B8563.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMSA61DCD02-DE89-497E-8878-06F9EC2E008C.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMSA8B32D23-FFEF-4B7D-BA88-63335A951CC5.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMSA917CB08-4170-4860-9A9B-A943F5C64770.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMSA9A6A6DD-4232-4CF8-96E3-464D649216C7.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMSA9FD3E49-2E0B-4077-8414-8E1AACAA6135.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMSAC8DBFD9-664C-45D8-9067-2E9505348AF9.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMSB09D08ED-7792-47B4-888B-B618FAB169DA.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMSB36AA4CC-4D04-4750-A0AE-2FFC2062B3C6.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMSB600DB4B-6F00-4ED8-9E0D-D9542FD881A8.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMSBFBB80CF-DF05-4136-8782-384D683F3D14.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMSC08D3461-A97E-4317-9E7E-DB1ECC9D3C35.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMSC10B37C2-E8F6-4437-AB4A-97AC95784EAA.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMSC4758BF7-A1A2-4718-9FB9-1734FFDC377C.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMSC60821C0-8F14-4266-A66A-33EF7C7D07D0.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMSC681A1B2-D63D-4FB5-B40B-A5FE89843A1B.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMSC9D7ED95-45CE-4243-BAA0-25401B824940.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMSD169A1B5-E77C-4E22-8350-3C681F02602C.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMSD9C2427F-5EE6-42AA-A142-E59595FA5F27.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMSDE262DD8-025B-46D5-A011-316BE2F32DE9.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMSDF49691C-AC6F-4FD7-96DE-2D878D279FEB.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMSE0C6F1EE-DFAD-4D96-9AD2-6D36EDD2ABDF.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMSE824F883-F759-4452-95CA-0E985D08AAB6.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMSE922BD88-5A57-40F6-8FDD-8CD28DEF9E38.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMSE983D0F7-B3A3-46C7-B124-9391CB658705.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMSECD00BC4-A6ED-400E-8C77-1B185C6098F6.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMSEF08EAC1-7395-45AA-A1D6-D0A9C9C30EB6.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMSF3E5C528-7D2F-46FD-92A1-61EA24ECA782.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMSF74F1C1D-009E-4A11-8119-17940B60884D.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMSF93ABA67-A0D8-4BE4-B0E4-574B698027D8.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMSF9EC8317-1C5D-457E-A764-F12F53C96BE7.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSMSFD73095B-4610-41E8-BFAF-0211AA597258.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\INDEX.DAT Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\INDEX.DAT Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\INDEX.DAT Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Program Files\Audible\Admin\atm.log Object is locked skipped
C:\Program Files\Audible\Bin\Debug.log Object is locked skipped
C:\Program Files\Audible\Bin\Details.html Object is locked skipped
C:\Program Files\Audible\Bin\Update.log Object is locked skipped
C:\Program Files\Audible\Programs\Downloads\aasubsschedule.log Object is locked skipped
C:\Program Files\Webroot\Spy Sweeper\Masters\masters.bak Object is locked skipped
C:\Program Files\Webroot\Spy Sweeper\Masters\Masters.const Object is locked skipped
C:\Program Files\Webroot\Spy Sweeper\Masters\masters.mst Object is locked skipped
C:\Program Files\Webroot\Spy Sweeper\Masters.base Object is locked skipped
C:\RECYCLER\S-1-5-21-3763064615-942797620-1659702975-1008\Dc220.tmp Infected: Trojan-Downloader.Win32.Small.bem skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{E3E097B8-B1C5-4666-BF8D-E45920A7C426}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\SYSTEM32\bpbnulq1.ini Infected: not-a-virus:AdWare.Win32.Sahat.ao skipped
C:\WINDOWS\SYSTEM32\CONFIG\AppEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SAM Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SecEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SECURITY Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SysEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\H323LOG.TXT Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\WIADEBUG.LOG Object is locked skipped
C:\WINDOWS\WIASERVC.LOG Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.