[Resolved] Please Help Browser Hijack / Pop Ups

Hi,

Having problems with many browser pop-ups to different sites each time.
I've tried reading many threads, scan with different tools and still getting no where.
Tools I've tried includes: Ad-Ware, Avast, Trend Micro, SpyBot, HijackThis, VundoFix, and MoveOnBoot.

Don't know if I have screw it up further trying different things, but a few items I've noticed which is quite different from popular forums are:
The mllmm.dll is not located in windows\system32\. Instead, it is located in Documents and Settings\User Name\Locat Settings\Temp.
Most forums mentioned associated file, mmllm.dll, is not found.

Running VundoFix found ymgrdouk.dll and removed.
Also, somehow I removed vtsqo.dll and associated registry keys.

Now, much less pop ups, but the mllmm.dll cannot be deleted. (or respawn after deleting with MoveOnBoot).
Tried removing / changing values in registry which has "mllmm" but it re-appears even before I close registry editor.

Tried uploading the mllmm.dll and ymgrdouk.dll to Anchiva checking page and comes back with the following name:
Virtumonde.4B3C and SuperJuan.73DC respectively.

Below is the HijackThis log on most recent scan, followed by the Look2Me Log:

Logfile of HijackThis v1.99.1
Scan saved at 23:53:42, on 07-12-18
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\systemhound\shservice.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\wuauclt.exe
C:\temp\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://honda.portal.honda.ca/portal/login.jsp
O1 - Hosts: 205.190.239.100 sda.ds.adp.com
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\j2re1.4.2_07\bin\jusched.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {123BBFF5-F9E4-4B0A-A75B-B545AC5AAB91} (DiagClientA Class) - https://honda.portal.honda.ca/portal/DiagClient.cab
O16 - DPF: {1663ed61-23eb-11d2-b92f-008048fdd814} (MeadCo ScriptX Basic) - https://honda.portal.honda.ca/portal/ScriptX.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {3C9ECC99-D050-4AA2-9D9A-C0EA26252005} (DealerIdentity Class) - https://honda.portal.honda.ca/portal/DealerIdentity.CAB
O16 - DPF: {4E8AEBE0-31A6-43B0-A429-748DB14A70A0} (SysEngW2k Control) - http://205.190.239.100/apps/common/include…ONFIG-CHECK.CAB
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: SupportSoft RemoteAssist - SupportSoft, Inc. - C:\Program Files\Common Files\supportsoft\bin\ssrc.exe
O23 - Service: systemhound scheduler - Software Innovations UK Limited - C:\Program Files\systemhound\shservice.exe


Look2Me Log

L2MFIX find log 032106
These are the registry keys present
********************************************************************************
**
Winlogon/notify:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AutorunsDisabled]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AutorunsDisabled\WB]
"Asynchronous"=dword:00000000
"DllName"="C:\\PROGRA~1\\Stardock\\OBJECT~1\\WINDOW~1\\fastload.dll"
"Startup"="StartSys"
"Logon"="StartWB"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

********************************************************************************
**
useragent:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"SV1"=""

********************************************************************************
**
Shell Extension key:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{00022613-0000-0000-C000-000000000046}"="Multimedia File Property Sheet"
"{176d6597-26d3-11d1-b350-080036a75b03}"="ICM Scanner Management"
"{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="NTFS Security Page"
"{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="OLE Docfile Property Page"
"{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Shell extensions for sharing"
"{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
"{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Display Adapter CPL Extension"
"{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Display Monitor CPL Extension"
"{4E40F770-369C-11d0-8922-00A024AB2DBB}"="DS Security Page"
"{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Compatibility Page"
"{56117100-C0CD-101B-81E2-00AA004AE837}"="Shell Scrap DataHandler"
"{59099400-57FF-11CE-BD94-0020AF85B590}"="Disk Copy Extension"
"{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Shell extensions for Microsoft Windows Network objects"
"{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ICM Monitor Management"
"{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ICM Printer Management"
"{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Shell extensions for file compression"
"{77597368-7b15-11d0-a0c2-080036af3f03}"="Web Printer Shell Extension"
"{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
"{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Encryption Context Menu"
"{85BBD920-42A0-1069-A2E4-08002B30309D}"="Briefcase"
"{88895560-9AA2-1069-930E-00AA0030EBC8}"="HyperTerminal Icon Ext"
"{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
"{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="ICC Profile"
"{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Printers Security Page"
"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Shell extensions for sharing"
"{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
"{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Crypto PKO Extension"
"{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Crypto Sign Extension"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Network Connections"
"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Network Connections"
"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="Scanners & Cameras"
"{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="Scanners & Cameras"
"{905667aa-acd6-11d2-8080-00805f6596d2}"="Scanners & Cameras"
"{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="Scanners & Cameras"
"{83bbcbf3-b28a-4919-a5aa-73027445d672}"="Scanners & Cameras"
"{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
"{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Shell extensions for Windows Script Host"
"{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft Data Link"
"{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
"{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Scheduled Tasks"
"{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}"="Set Program Access and Defaults"
"{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension"
"{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Taskbar and Start Menu"
"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Search"
"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
"{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Run…"
"{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet"
"{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="E-mail"
"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Fonts"
"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Administrative Tools"
"{596AB062-B4D2-4215-9F74-E9109B0A8153}"="Previous Versions Property Page"
"{9DB7A13C-F208-4981-8353-73CC61AE2783}"="Previous Versions"
"{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
"{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
"{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
"{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
"{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
"{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
"{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Microsoft Internet Toolbar"
"{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Download Status"
"{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Augmented Shell Folder"
"{6413BA2C-B461-11d1-A18A-080036B11A03}"="Augmented Shell Folder 2"
"{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
"{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Microsoft BrowserBand"
"{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Search Band"
"{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="In-pane search"
"{07798131-AF23-11d1-9111-00A0C98BA67D}"="Web Search"
"{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Registry Tree Options Utility"
"{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Address"
"{A08C11D2-A228-11d0-825B-00AA005B4383}"="Address EditBox"
"{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Microsoft AutoComplete"
"{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
"{6756A641-DE71-11d0-831B-00AA005B4383}"="MRU AutoComplete List"
"{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Custom MRU AutoCompleted List"
"{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
"{acf35015-526e-4230-9596-becbe19f0ac9}"="Track Popup Bar"
"{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Microsoft History AutoComplete List"
"{03C036F1-A186-11D0-824A-00AA005B4383}"="Microsoft Shell Folder AutoComplete List"
"{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Microsoft Multiple AutoComplete List Container"
"{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Shell Band Site Menu"
"{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
"{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar"
"{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
"{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="User Assist"
"{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Global Folder Settings"
"{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
"{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
"{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
"{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
"{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
"{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"
"{FF393560-C2A7-11CF-BFF4-444553540000}"="History"
"{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
"{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="IE4 Suite Splash Screen"
"{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
"{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
"{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
"{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="The Internet"
"{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
"{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"
"{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{88C6C381-2E85-11D0-94DE-444553540000}"="ActiveX Cache Folder"
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
"{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="Subscription Folder"
"{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
"{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
"{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
"{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
"{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
"{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
"{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
"{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Shell Application Manager"
"{0B124F8F-91F0-11D1-B8B5-006008059382}"="Installed Apps Enumerator"
"{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher"
"{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
"{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
"{00E7B358-F65B-4dcf-83DF-CD026B94BFD4}"="Autoplay for SlideShow"
"{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="GDI+ file thumbnail extractor"
"{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Summary Info Thumbnail handler (DOCFILES)"
"{EAB841A0-9550-11cf-8C16-00805F1408F3}"="HTML Thumbnail Extractor"
"{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
"{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Web Publishing Wizard"
"{add36aa8-751a-4579-a266-d66f5202ccbb}"="Print Ordering via the Web"
"{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Shell Publishing Wizard Object"
"{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Get a Passport Wizard"
"{7A9D77BD-5403-11d2-8785-2E0420524153}"="User Accounts"
"{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
"{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
"{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Channel File"
"{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Channel Shortcut"
"{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"
"{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
"{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
"{692F0339-CBAA-47e6-B5B5-3B84DB604E87}"="Extensions Manager Folder"
"{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
"{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
"{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
"{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
"{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
"{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
"{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
"{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
"{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
"{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
"{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
"{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
"{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
"{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
"{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
"{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
"{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
"{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
"{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Offline Files Folder"
"{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
"{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
"{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
"{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
"{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
"{32714800-2E5F-11d0-8B85-00AA0044F941}"="For &People…"
"{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
"{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
"{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
"{BDEADF00-C265-11D0-BCED-00A0C90AB50F}"="Web Folders"
"{00020D75-0000-0000-C000-000000000046}"="Microsoft Office Outlook Desktop Icon Handler"
"{0006F045-0000-0000-C000-000000000046}"="Microsoft Office Outlook Custom Icon Handler"
"{42042206-2D85-11D3-8CFF-005004838597}"="Microsoft Office HTML Icon Handler"
"{6C47FB97-4B7B-11D3-A9BA-00C04FA3624C}"="Reflection FTP Neighborhood"
"{BDA77241-42F6-11d0-85E2-00AA001FE28C}"="LDVP Shell Extensions"
"{1D2680C9-0E2A-469d-B787-065558BC7D43}"="Fusion Cache"
"{21569614-B795-46b1-85F4-E737A8DC09AD}"="Shell Search Band"
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}"="WinRAR shell extension"
"{472083B0-C522-11CF-8763-00608CC02F24}"="avast"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\AutorunsDisabled]
"{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Display Panning CPL Extension"
"{2F5AC606-70CF-461C-BFE1-734234536262}"="WindowBlinds CPL Extension"

********************************************************************************
**
HKEY ROOT CLASSIDS:
********************************************************************************
**
Files Found are not all bad files:

C:\WINDOWS\SYSTEM32\
browseui.dll Thu 2007-10-11 1:13:44 A…. 1 023 488 999,50 K
cdfview.dll Thu 2007-10-11 1:13:44 A…. 151 040 147,50 K
danim.dll Thu 2007-10-11 1:13:44 A…. 1 054 208 1,00 M
dxtmsft.dll Thu 2007-10-11 1:13:44 A…. 357 888 349,50 K
dxtrans.dll Thu 2007-10-11 1:13:44 A…. 205 312 200,50 K
extmgr.dll Thu 2007-10-11 1:13:44 A…. 55 808 54,50 K
iepeers.dll Thu 2007-10-11 1:13:44 A…. 251 392 245,50 K
inseng.dll Thu 2007-10-11 1:13:44 A…. 96 256 94,00 K
jscript.dll Wed 2007-11-14 2:26:56 A…. 450 560 440,00 K
jsproxy.dll Thu 2007-10-11 1:13:44 A…. 16 384 16,00 K
legitc~1.dll Thu 2007-10-11 14:12:48 A…. 1 468 968 1,40 M
mshtml.dll Tue 2007-10-30 5:16:34 A…. 3 058 688 2,91 M
mshtmled.dll Thu 2007-10-11 1:13:46 A…. 449 024 438,50 K
msrating.dll Thu 2007-10-11 1:13:46 A…. 146 432 143,00 K
mstime.dll Thu 2007-10-11 1:13:46 A…. 532 480 520,00 K
pngfilt.dll Thu 2007-10-11 1:13:46 A…. 39 424 38,50 K
quartz.dll Mon 2007-10-29 17:43:04 A…. 1 287 680 1,23 M
shdocvw.dll Thu 2007-10-11 1:13:46 A…. 1 494 528 1,42 M
shell32.dll Thu 2007-10-25 22:36:52 A…. 8 454 656 8,06 M
shlwapi.dll Thu 2007-10-11 1:13:46 A…. 474 112 463,00 K
urlmon.dll Thu 2007-10-11 1:13:46 A…. 615 424 601,00 K
wininet.dll Thu 2007-10-11 1:13:46 A…. 659 456 644,00 K
wmasf.dll Sat 2007-10-27 17:39:20 A…. 230 912 225,50 K
wmvcore.dll Sat 2007-10-27 17:37:38 A…. 2 109 440 2,01 M
xpsp3res.dll Mon 2007-10-29 5:26:54 A…. 115 712 113,00 K

25 items found: 25 files, 0 directories.
Total of file sizes: 24 799 272 bytes 23,65 M
Locate .tmp files:

No matches found.
********************************************************************************
**
Directory Listing of system files:
Volume in drive C has no label.
Volume Serial Number is E8E3-EB96

Directory of C:\WINDOWS\System32

07-12-11 16:08 dllcache
05-03-30 10:45 Microsoft
0 File(s) 0 bytes
2 Dir(s) 53,483,999,232 bytes free


Please let me know if need further info.
Many many thanks!!

Woh…..you're the best! Seems like system cleaned.
Here are the logs from ComboFix and HJT respectively.

ComboFix 07-12-21.4 - parts6758 2007-12-23 13:55:12.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.73 [GMT -5:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\DOCUME~1\PARTS6~1\LOCALS~1\Temp\mllmm.dll
C:\WINDOWS\cookies.ini
C:\WINDOWS\system32\bvhwvtvt.dll
C:\WINDOWS\system32\cjfdmtwn.ini
C:\WINDOWS\system32\ewcgolln.ini
C:\WINDOWS\system32\gfywjwyc.dll
C:\WINDOWS\system32\hxqvghbm.dll
C:\WINDOWS\system32\icowbuyi.ini
C:\WINDOWS\system32\iyubwoci.dll
C:\WINDOWS\system32\jdnevryl.ini
C:\WINDOWS\system32\luvltqkj.dll
C:\WINDOWS\system32\lyrvendj.dll
C:\WINDOWS\system32\nllogcwe.dll
C:\WINDOWS\system32\nwtmdfjc.dll
C:\WINDOWS\system32\pac.txt
C:\WINDOWS\system32\rgkbvyly.ini
C:\WINDOWS\system32\tcjjcpfo.dll
C:\WINDOWS\system32\ylyvbkgr.dll

.
((((((((((((((((((((((((( Files Created from 2007-11-23 to 2007-12-23 )))))))))))))))))))))))))))))))
.

2007-12-23 13:42 . 2007-12-23 13:46 d——– C:\temp\ATF Cleaner
2007-12-21 12:00 . 2007-12-21 12:00 d——– C:\temp\Process Explorer
2007-12-19 11:31 . 2007-12-19 11:31 d——– C:\Documents and Settings\parts6758\reflectionweb
2007-12-19 02:47 . 2007-12-19 02:47 d——– C:\Documents and Settings\RCHAN\reflectionweb
2007-12-19 00:33 . 2005-01-20 13:47 175,616 –a—— C:\WINDOWS\system32\strings.exe
2007-12-19 00:33 . 2005-01-13 21:41 126,976 –a—— C:\WINDOWS\system32\zip.exe
2007-12-19 00:33 . 2005-01-13 21:41 53,248 –a—— C:\WINDOWS\system32\Process.exe
2007-12-19 00:33 . 2005-01-13 21:41 39,184 –a—— C:\WINDOWS\system32\Ntrights.exe
2007-12-19 00:33 . 2005-10-19 18:50 16,384 –a—— C:\WINDOWS\system32\restart.exe
2007-12-19 00:33 . 2005-01-13 21:41 11,254 –a—— C:\WINDOWS\system32\locate.com
2007-12-19 00:24 . 2007-12-19 00:09 336,914 –a—— C:\temp\l2mfix.exe
2007-12-18 22:28 . 2005-01-15 12:24 61,555 –a—— C:\WINDOWS\system32\jpicpl32.cpl
2007-12-18 22:12 . 2007-12-18 22:12 d——– C:\WINDOWS\Sun
2007-12-18 22:12 . 2007-12-19 01:01 d——– C:\Documents and Settings\parts6758\.housecall6.6
2007-12-18 21:40 . 2007-12-18 22:28 d——– C:\Program Files\Java
2007-12-18 21:40 . 2007-12-18 21:40 d——– C:\Program Files\Common Files\Java
2007-12-18 21:39 . 2007-12-18 21:39 d——– C:\Documents and Settings\RCHAN\Application Data\ADP
2007-12-18 21:06 . 2007-12-18 21:06 d——– C:\Program Files\Lavasoft
2007-12-18 21:06 . 2007-12-18 21:06 d——– C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-12-18 21:05 . 2007-12-18 21:05 d——– C:\Program Files\Common Files\Wise Installation Wizard
2007-12-18 20:47 . 2007-12-18 21:00 d——– C:\Documents and Settings\RCHAN\Application Data\Lavasoft
2007-12-18 01:28 . 2007-12-18 01:28 497,497 –a—— C:\temp\File2.zip
2007-12-18 01:26 . 2007-12-18 01:26 65,190 –a—— C:\temp\File1.zip
2007-12-18 00:58 . 2007-12-18 01:37 d——– C:\VundoFix Backups
2007-12-18 00:38 . 2007-12-18 00:38 d——– C:\Program Files\GiPo@Utilities
2007-12-18 00:38 . 2007-12-18 00:38 d——– C:\Program Files\Common Files\Gibinsoft Shared
2007-12-18 00:36 . 2007-12-17 23:58 610,232 –a—— C:\temp\moveonb.exe
2007-12-18 00:36 . 2007-12-17 23:23 132,608 –a—— C:\temp\VundoFix.exe
2007-12-18 00:04 . 2003-03-18 16:20 1,060,864 –a—— C:\WINDOWS\system32\MFC71.dll
2007-12-18 00:04 . 2007-12-04 08:04 837,496 –a—— C:\WINDOWS\system32\aswBoot.exe
2007-12-18 00:04 . 2004-01-09 04:13 380,928 –a—— C:\WINDOWS\system32\actskin4.ocx
2007-12-18 00:04 . 2007-12-04 07:54 95,608 –a—— C:\WINDOWS\system32\AvastSS.scr
2007-12-18 00:04 . 2007-12-04 09:55 94,544 –a—— C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-18 00:04 . 2007-12-04 09:56 93,264 –a—— C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-18 00:04 . 2007-12-04 09:51 42,912 –a—— C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-18 00:04 . 2007-12-04 09:49 26,624 –a—— C:\WINDOWS\system32\drivers\aavmker4.sys
2007-12-18 00:04 . 2007-12-04 09:53 23,152 –a—— C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-18 00:03 . 2007-12-18 00:03 d——– C:\Program Files\Alwil Software
2007-12-18 00:03 . 2007-12-18 00:03 18,750,104 –a—— C:\temp\setupengpro.exe
2007-12-17 23:08 . 2007-12-17 23:08 d——– C:\Documents and Settings\All Users\Application Data\Grisoft
2007-12-17 22:33 . 2007-12-17 22:33 d——– C:\Documents and Settings\Administrator\Application Data\AdobeUM
2007-12-17 22:31 . 2007-12-18 01:50 d——– C:\temp\backups
2007-12-17 22:25 . 2007-12-17 22:25 2,560 –a—— C:\WINDOWS\_MSRSTRT.EXE
2007-12-17 21:40 . 2007-12-17 21:42 d——– C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-12-17 21:30 . 2007-12-17 21:30 d——– C:\temp\CheckAutoRun
2007-12-17 21:30 . 2007-12-18 21:04 d-a—— C:\temp\AdWare
2007-12-14 17:52 . 2007-12-14 17:54 d——– C:\WINDOWS\system32\ineWc01
2007-12-14 17:52 . 2007-12-14 17:54 374 –a—— C:\WINDOWS\17PHolmes572.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-22 22:12 ——— d—–w C:\Program Files\AutoEPC
2007-12-19 03:11 ——— d—–w C:\Documents and Settings\parts6758\Application Data\AdobeUM
2007-12-18 05:16 ——— d—–w C:\Program Files\Symantec
2007-12-18 03:24 ——— d—–w C:\Program Files\Microsoft AntiSpyware
2007-12-18 03:23 ——— d—–w C:\Program Files\Google
2007-11-13 10:25 20,480 —-a-w C:\WINDOWS\system32\drivers\secdrv.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 08:00]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 07:00]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\AutorunsDisabled]
C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\fastload.dll

R2 systemhound scheduler;systemhound scheduler;C:\Program Files\systemhound\shservice.exe [2005-08-29 14:29]
S3 SupportSoft RemoteAssist;SupportSoft RemoteAssist;C:\Program Files\Common Files\supportsoft\bin\ssrc.exe [2007-11-05 09:48]
S4 tgsrvc_sda;SupportSoft Repair Service (sda);C:\Program Files\sda\bin\tgsrvc.exe /p sda []

.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-23 14:02:51
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-23 14:04:06 - machine was rebooted
.
2007-12-21 23:07:31 — E O F —



**************************************************************************
**************************************************************************

Logfile of HijackThis v1.99.1
Scan saved at 14:10, on 2007-12-23
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\systemhound\shservice.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\HijackThis\scanner.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://honda.portal.honda.ca/portal/login.jsp
O2 - BHO: (no name) - AutorunsDisabled - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {123BBFF5-F9E4-4B0A-A75B-B545AC5AAB91} (DiagClientA Class) - https://honda.portal.honda.ca/portal/DiagClient.cab
O16 - DPF: {1663ed61-23eb-11d2-b92f-008048fdd814} (MeadCo ScriptX Basic) - https://honda.portal.honda.ca/portal/ScriptX.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecal…ivex/hcImpl.cab
O16 - DPF: {3C9ECC99-D050-4AA2-9D9A-C0EA26252005} (DealerIdentity Class) - https://honda.portal.honda.ca/portal/DealerIdentity.CAB
O16 - DPF: {4E8AEBE0-31A6-43B0-A429-748DB14A70A0} (SysEngW2k Control) - http://205.190.239.100/apps/common/include…ONFIG-CHECK.CAB
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O20 - Winlogon Notify: AutorunsDisabled - C:\WINDOWS\
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: SupportSoft RemoteAssist - SupportSoft, Inc. - C:\Program Files\Common Files\supportsoft\bin\ssrc.exe
O23 - Service: systemhound scheduler - Software Innovations UK Limited - C:\Program Files\systemhound\shservice.exe


Thanks!!
Holidayz

All Done! Looks fine to me….
Kaspersky reported infection in system restore, and now I have removed all restore points and created a new one.
Please let me know what to do with the quarantined items under C:\qoobox, which I believe was created by ComboFix.
Should I simply delete them?

Below are the log files:

HJT:

Logfile of HijackThis v1.99.1
Scan saved at 19:08, on 2007-12-23
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\systemhound\shservice.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\HijackThis\scanner.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://honda.portal.honda.ca/portal/login.jsp
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/u…can_unicode.cab
O16 - DPF: {123BBFF5-F9E4-4B0A-A75B-B545AC5AAB91} (DiagClientA Class) - https://honda.portal.honda.ca/portal/DiagClient.cab
O16 - DPF: {1663ed61-23eb-11d2-b92f-008048fdd814} (MeadCo ScriptX Basic) - https://honda.portal.honda.ca/portal/ScriptX.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecal…ivex/hcImpl.cab
O16 - DPF: {3C9ECC99-D050-4AA2-9D9A-C0EA26252005} (DealerIdentity Class) - https://honda.portal.honda.ca/portal/DealerIdentity.CAB
O16 - DPF: {4E8AEBE0-31A6-43B0-A429-748DB14A70A0} (SysEngW2k Control) - http://205.190.239.100/apps/common/include…ONFIG-CHECK.CAB
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O20 - Winlogon Notify: AutorunsDisabled - C:\WINDOWS\
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: SupportSoft RemoteAssist - SupportSoft, Inc. - C:\Program Files\Common Files\supportsoft\bin\ssrc.exe
O23 - Service: systemhound scheduler - Software Innovations UK Limited - C:\Program Files\systemhound\shservice.exe

********************************************************************************
**
ComboFix
********************************************************************************
***
ComboFix 07-12-21.4 - parts6758 2007-12-23 17:57:26.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.88 [GMT -5:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\parts6758\Desktop\CFScript.txt
* Created a new restore point

FILE
C:\WINDOWS\17PHolmes572.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\17PHolmes572.exe
C:\WINDOWS\system32\ineWc01

.
((((((((((((((((((((((((( Files Created from 2007-11-23 to 2007-12-23 )))))))))))))))))))))))))))))))
.

2007-12-23 14:27 . 2003-02-28 18:26 139,536 –a—— C:\WINDOWS\system32\javaee.dll
2007-12-19 11:31 . 2007-12-19 11:31 d——– C:\Documents and Settings\parts6758\reflectionweb
2007-12-19 02:47 . 2007-12-19 02:47 d——– C:\Documents and Settings\RCHAN\reflectionweb
2007-12-19 00:33 . 2005-01-20 13:47 175,616 –a—— C:\WINDOWS\system32\strings.exe
2007-12-19 00:33 . 2005-01-13 21:41 126,976 –a—— C:\WINDOWS\system32\zip.exe
2007-12-19 00:33 . 2005-01-13 21:41 53,248 –a—— C:\WINDOWS\system32\Process.exe
2007-12-19 00:33 . 2005-01-13 21:41 39,184 –a—— C:\WINDOWS\system32\Ntrights.exe
2007-12-19 00:33 . 2005-10-19 18:50 16,384 –a—— C:\WINDOWS\system32\restart.exe
2007-12-19 00:33 . 2005-01-13 21:41 11,254 –a—— C:\WINDOWS\system32\locate.com
2007-12-18 22:28 . 2005-01-15 12:24 61,555 –a—— C:\WINDOWS\system32\jpicpl32.cpl
2007-12-18 22:12 . 2007-12-18 22:12 d——– C:\WINDOWS\Sun
2007-12-18 22:12 . 2007-12-19 01:01 d——– C:\Documents and Settings\parts6758\.housecall6.6
2007-12-18 21:40 . 2007-12-18 22:28 d——– C:\Program Files\Java
2007-12-18 21:40 . 2007-12-18 21:40 d——– C:\Program Files\Common Files\Java
2007-12-18 21:39 . 2007-12-18 21:39 d——– C:\Documents and Settings\RCHAN\Application Data\ADP
2007-12-18 20:47 . 2007-12-18 21:00 d——– C:\Documents and Settings\RCHAN\Application Data\Lavasoft
2007-12-18 00:04 . 2003-03-18 16:20 1,060,864 –a—— C:\WINDOWS\system32\MFC71.dll
2007-12-18 00:04 . 2007-12-04 08:04 837,496 –a—— C:\WINDOWS\system32\aswBoot.exe
2007-12-18 00:04 . 2004-01-09 04:13 380,928 –a—— C:\WINDOWS\system32\actskin4.ocx
2007-12-18 00:04 . 2007-12-04 07:54 95,608 –a—— C:\WINDOWS\system32\AvastSS.scr
2007-12-18 00:04 . 2007-12-04 09:55 94,544 –a—— C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-18 00:04 . 2007-12-04 09:56 93,264 –a—— C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-18 00:04 . 2007-12-04 09:51 42,912 –a—— C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-18 00:04 . 2007-12-04 09:49 26,624 –a—— C:\WINDOWS\system32\drivers\aavmker4.sys
2007-12-18 00:04 . 2007-12-04 09:53 23,152 –a—— C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-18 00:03 . 2007-12-18 00:03 d——– C:\Program Files\Alwil Software
2007-12-17 23:08 . 2007-12-17 23:08 d——– C:\Documents and Settings\All Users\Application Data\Grisoft
2007-12-17 22:33 . 2007-12-17 22:33 d——– C:\Documents and Settings\Administrator\Application Data\AdobeUM
2007-12-17 22:25 . 2007-12-17 22:25 2,560 –a—— C:\WINDOWS\_MSRSTRT.EXE
2007-12-17 21:40 . 2007-12-23 14:21 d——– C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-23 19:23 ——— d—–w C:\Documents and Settings\All Users\Application Data\Viewpoint
2007-12-22 22:12 ——— d—–w C:\Program Files\AutoEPC
2007-12-19 03:11 ——— d—–w C:\Documents and Settings\parts6758\Application Data\AdobeUM
2007-12-18 05:16 ——— d—–w C:\Program Files\Symantec
2007-12-18 03:24 ——— d—–w C:\Program Files\Microsoft AntiSpyware
2007-12-18 03:23 ——— d—–w C:\Program Files\Google
2007-11-13 10:25 20,480 —-a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-10-29 22:43 1,287,680 —-a-w C:\WINDOWS\system32\quartz.dll
2007-10-27 22:39 230,912 —-a-w C:\WINDOWS\system32\wmasf.dll
.

((((((((((((((((((((((((((((( snapshot@2007-12-23_14.03.28.81 )))))))))))))))))))))))))))))))))))))))))
.
- 2002-02-18 11:35:32 6,550 —-a-w C:\WINDOWS\jautoexp.dat
+ 2003-02-28 21:35:26 6,550 —-a-w C:\WINDOWS\jautoexp.dat
- 2002-02-18 14:23:10 46,352 —-a-w C:\WINDOWS\setdebug.exe
+ 2003-02-28 23:26:30 46,352 —-a-w C:\WINDOWS\setdebug.exe
- 2002-02-18 14:23:06 49,424 —-a-w C:\WINDOWS\system32\clspack.exe
+ 2003-02-28 23:26:26 49,424 —-a-w C:\WINDOWS\system32\clspack.exe
+ 2007-04-10 19:00:46 236,928 -c—-w C:\WINDOWS\system32\dllcache\WgaLogon.dll
+ 2007-04-10 19:01:18 336,768 -c—-w C:\WINDOWS\system32\dllcache\WgaTray.exe
- 2002-02-18 11:34:48 313,856 —-a-w C:\WINDOWS\system32\dx3j.dll
+ 2003-02-28 21:34:42 313,856 —-a-w C:\WINDOWS\system32\dx3j.dll
- 2002-02-18 14:22:56 187,152 —-a-w C:\WINDOWS\system32\javacypt.dll
+ 2003-02-28 23:26:16 187,152 —-a-w C:\WINDOWS\system32\javacypt.dll
- 2002-02-18 14:22:56 63,248 —-a-w C:\WINDOWS\system32\javaprxy.dll
+ 2003-02-28 23:26:18 63,248 —-a-w C:\WINDOWS\system32\javaprxy.dll
- 2002-02-18 14:22:58 404,752 —-a-w C:\WINDOWS\system32\javart.dll
+ 2003-02-28 23:26:18 404,752 —-a-w C:\WINDOWS\system32\javart.dll
- 2002-02-18 14:23:08 15,120 —-a-w C:\WINDOWS\system32\jdbgmgr.exe
+ 2003-02-28 23:26:30 15,120 —-a-w C:\WINDOWS\system32\jdbgmgr.exe
- 2002-02-18 14:22:58 171,280 —-a-w C:\WINDOWS\system32\jit.dll
+ 2003-02-28 23:26:20 171,280 —-a-w C:\WINDOWS\system32\jit.dll
- 2002-02-18 14:23:08 172,304 —-a-w C:\WINDOWS\system32\jview.exe
+ 2003-02-28 23:26:30 172,304 —-a-w C:\WINDOWS\system32\jview.exe
- 2002-02-18 14:23:00 154,384 —-a-w C:\WINDOWS\system32\msawt.dll
+ 2003-02-28 23:26:20 154,384 —-a-w C:\WINDOWS\system32\msawt.dll
- 2002-02-18 14:23:04 945,936 —-a-w C:\WINDOWS\system32\msjava.dll
+ 2003-02-28 23:26:26 947,472 —-a-w C:\WINDOWS\system32\msjava.dll
- 2002-02-18 14:23:04 21,264 —-a-w C:\WINDOWS\system32\msjdbc10.dll
+ 2003-02-28 23:26:26 21,264 —-a-w C:\WINDOWS\system32\msjdbc10.dll
- 2007-03-06 01:22:33 14,048 ——w C:\WINDOWS\system32\spmsg.dll
+ 2006-12-10 19:10:02 14,640 ——w C:\WINDOWS\system32\spmsg.dll
- 2002-02-18 14:23:06 286,992 —-a-w C:\WINDOWS\system32\vmhelper.dll
+ 2003-02-28 23:26:26 286,992 —-a-w C:\WINDOWS\system32\vmhelper.dll
+ 2007-04-10 19:00:46 236,928 ——w C:\WINDOWS\system32\WgaLogon.dll
+ 2007-04-10 19:01:18 336,768 ——w C:\WINDOWS\system32\WgaTray.exe
- 2002-02-18 14:23:10 171,792 —-a-w C:\WINDOWS\system32\wjview.exe
+ 2003-02-28 23:26:32 171,792 —-a-w C:\WINDOWS\system32\wjview.exe
+ 2007-12-23 19:29:04 16,384 —-atw C:\WINDOWS\Temp\Perflib_Perfdata_564.dat
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 08:00]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 07:00]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\AutorunsDisabled]
C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\fastload.dll

R2 systemhound scheduler;systemhound scheduler;C:\Program Files\systemhound\shservice.exe [2005-08-29 14:29]
S3 SupportSoft RemoteAssist;SupportSoft RemoteAssist;C:\Program Files\Common Files\supportsoft\bin\ssrc.exe [2007-11-05 09:48]
S4 tgsrvc_sda;SupportSoft Repair Service (sda);C:\Program Files\sda\bin\tgsrvc.exe /p sda []

.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-23 17:59:32
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-23 18:00:36
C:\ComboFix2.txt … 2007-12-23 14:04
.
2007-12-23 19:27:38 — E O F —

*****************************************************************************
Kaspersky
*******************************************************************************
——————————————————————————-
KASPERSKY ONLINE SCANNER REPORT
Sunday, December 23, 2007 7:01:37 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 24/12/2007
Kaspersky Anti-Virus database records: 492659
——————————————————————————-

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\

Scan Statistics:
Total number of scanned objects: 45112
Number of viruses found: 4
Number of infected objects: 19
Number of suspicious objects: 0
Duration of the scan process: 00:43:15

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\parts6758\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\parts6758\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\parts6758\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\parts6758\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\parts6758\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\parts6758\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\parts6758\NTUSER.DAT.LOG Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\aswResp.dat Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\Avast4.db Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\log\nshield.log Object is locked skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\iyubwoci.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.bjc skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\lyrvendj.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.bjc skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\nllogcwe.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.bjc skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\nwtmdfjc.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.bjc skipped
C:\qoobox\Quarantine\catchme2007-12-23_140239.98.zip/mllmm.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.bxe skipped
C:\qoobox\Quarantine\catchme2007-12-23_140239.98.zip ZIP: infected - 1 skipped
C:\RECYCLER\S-1-5-21-1757981266-308236825-1801674531-500\Dc1050.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.byj skipped
C:\RECYCLER\S-1-5-21-1757981266-308236825-1801674531-500\Dc1150.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.byj skipped
C:\RECYCLER\S-1-5-21-1757981266-308236825-1801674531-500\Dc1321 Infected: not-a-virus:AdWare.Win32.Virtumonde.byj skipped
C:\RECYCLER\S-1-5-21-1757981266-308236825-1801674531-500\Dc1322 Infected: not-a-virus:AdWare.Win32.Virtumonde.byj skipped
C:\RECYCLER\S-1-5-21-1757981266-308236825-1801674531-500\Dc1323 Infected: not-a-virus:AdWare.Win32.Virtumonde.byj skipped
C:\RECYCLER\S-1-5-21-1757981266-308236825-1801674531-500\Dc1324 Infected: not-a-virus:AdWare.Win32.Virtumonde.byj skipped
C:\RECYCLER\S-1-5-21-1757981266-308236825-1801674531-500\Dc1334.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.byj skipped
C:\RECYCLER\S-1-5-21-1757981266-308236825-1801674531-500\Dc913.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.byj skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{380740EA-0569-4A35-9AFD-C7DEE2694640}\RP970\A0035822.dll Infected: not-a-virus:AdWare.Win32.SuperJuan.ao skipped
C:\System Volume Information\_restore{380740EA-0569-4A35-9AFD-C7DEE2694640}\RP983\A0039624.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.bjc skipped
C:\System Volume Information\_restore{380740EA-0569-4A35-9AFD-C7DEE2694640}\RP983\A0039626.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.bjc skipped
C:\System Volume Information\_restore{380740EA-0569-4A35-9AFD-C7DEE2694640}\RP983\A0039627.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.bjc skipped
C:\System Volume Information\_restore{380740EA-0569-4A35-9AFD-C7DEE2694640}\RP983\A0039628.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.bjc skipped
C:\System Volume Information\_restore{380740EA-0569-4A35-9AFD-C7DEE2694640}\RP987\change.log Object is locked skipped
C:\WINDOWS\CSC\00000001 Object is locked skipped
C:\WINDOWS\Debug\Netlogon.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{481269A2-18B8-4DB3-8891-B7E41D212A21}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\Antivirus.Evt Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\Temp\Perflib_Perfdata_564.dat Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.


Thanks a million!!
Holidayz