[Resolved] Bancos IPA alias Trojan-Spy.Win32.Banker.gka [Kaspersk

Only when I run CA on the Yahoo tollbar I see this trojan, Bancos IPA but, if I close and reopen IE, it is back. I've tryed AVG 8, AVAST, AVIRA PREMIUM, A-SQUARED, Spyware Terminator, Spybot Search & Destroy, Spyware Doctor, XoftSpySE, Pavark anti-root and SpywareTerminator, none of them solved the problem. I did a search on the NET, and all the sugested registry keys or system directory were not found, so, can any one give some light, please?
BTW, only AVG is the active anti-virus, the others are call to do a system check now and then.
Thanks
Ricardo

Alias
Win32/Bancos.IPA
Aliases:Generic.Banker.Delf.9BDBE047 SOFTWIN BitDefender BDSCAN 1.01 15-Feb-2008
PSW.Banker4.KQV GRISoft AVG 7.5.516/1280 15-Feb-2008
TR/Spy.Banker.gka.1 Avira AntiVir/Win32-Console Version 7.4.0.15 15-Feb-2008
Trojan-Spy.Win32.Banker.gka Kaspersky Lab KavCon 1.0.0.48 15-Feb-2008
Detected by: CA VET RESCUE 8.3.0.0 14-Feb-2008
=========================================


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:19:34 PM, on 7/22/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
D:\ProgramsNET\Ad-Aware\aawservice.exe
D:\Program Files\Avast4\aswUpdSv.exe
D:\Program Files\Avast4\ashServ.exe
C:\PROGRA~1\GbPlugin\GbpSv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
D:\Program Files\Comodo\Firewall\cmdagent.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\PSIService.exe
D:\Program Files\SpywareTerminator\sp_rsser.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sony\VAIO Media Music Server\SSSvr.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
D:\Program Files\Avast4\ashMaiSv.exe
D:\Program Files\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\atiptaxx.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Sony\10Key Utility\va10key.exe
C:\WINDOWS\system32\ICO.EXE
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Apoint\Apntex.exe
D:\Program Files\Comodo\Firewall\cfp.exe
C:\WINDOWS\system32\ezSP_Px.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe
C:\Program Files\Sony\Jog Dial Navigator\JogServ2.exe
D:\Program Files\ActiveSync\Wcescomm.exe
D:\PROGRA~1\Pop-Up Stopper\PSFree.exe
D:\PROGRA~1\ActiveSync\rapimgr.exe
D:\Program Files\SpeedFan\speedfan.exe
D:\Program Files\Webshots\webshots.scr
C:\WINDOWS\System32\wbem\wmiprvse.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\explorer.exe
D:\ProgramsNET\a-squared Anti-Malware\a2service.exe
D:\ProgramsNET\HijackThis\HijackThis.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=ZillaPopupKiller:8100
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local;*.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - D:\Program Files\SnagIt 8\SnagItBHO.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - D:\Program Files\rpbrowserrecordplugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\Spybot S & D\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\avgtoolbar.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - D:\ProgramsNET\Spyware Doctor\tools\iesdpb.dll
O2 - BHO: G-Buster Browser Defense Unibanco - {C41A1C0E-EA6C-11D4-B1B8-444553540008} - C:\PROGRA~1\GbPlugin\gbiehuni.dll
O2 - BHO: CutePDF Form Filler - {D41289F2-69C6-417B-897E-C653D677CBAF} - D:\ProgramsNET\CutePDF Pro\CPFillerCo.dll
O2 - BHO: PicLens plug-in for Internet Explorer - {EAEE5C74-6D0D-4aca-9232-0DA4A7B866BA} - C:\Program Files\PicLensIE\PicLens.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O3 - Toolbar: Webshots Toolbar - {C17590D2-ECB4-4b15-8820-F58798DCC118} - (no file)
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\avgtoolbar.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - D:\Program Files\SnagIt 8\SnagItIEAddin.dll
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [va10key] C:\Program Files\Sony\10Key Utility\va10key.exe
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [COMODO Firewall Pro] "D:\Program Files\Comodo\Firewall\cfp.exe" -h
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\system32\ezSP_Px.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win
O4 - HKCU\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKCU\..\Run: [JOGSERV2.EXE] C:\Program Files\Sony\Jog Dial Navigator\JogServ2.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "D:\Program Files\ActiveSync\Wcescomm.exe"
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "D:\PROGRA~1\Pop-Up Stopper\PSFree.exe"
O4 - HKUS\S-1-5-18\..\Run: [Spyware Doctor] (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Spyware Doctor] (User 'Default user')
O4 - Startup: SpeedFan.lnk = D:\Program Files\SpeedFan\speedfan.exe
O4 - Startup: Webshots.lnk = D:\Program Files\Webshots\Launcher.exe
O8 - Extra context menu item: &Clean Traces - D:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - D:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: &Webshots Photo Search - res://D:\Program Files\Webshots\WSToolbar4IE.dll/MENUSEARCH.HTM
O8 - Extra context menu item: Download &all with DAP - D:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\Microsoft Office\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - D:\ProgramsNET\Spyware Doctor\tools\iesdpb.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - D:\PROGRA~1\ActiveSync\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - D:\PROGRA~1\ActiveSync\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - D:\PROGRA~1\ActiveSync\INetRepl.dll
O9 - Extra button: Launch PicLens - {3437D640-C91A-458f-89F5-B9095EA4C28B} - C:\Program Files\PicLensIE\PicLens.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\Microsoft Office\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\Spybot S & D\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\Spybot S & D\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1209754449894
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1209763554307
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {E37CB5F0-51F5-4395-A808-5FA49E399008} (GbPluginObj Class) - https://clickbanking.unibanco.com.br/GbPlug…GbPluginUni.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\Skype4COM.dll
O20 - AppInit_DLLs: avgrsstx.dll C:\WINDOWS\system32\guard32.dll
O20 - Winlogon Notify: GbPluginUni - C:\PROGRA~1\GbPlugin\gbiehuni.dll
O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Emsi Software GmbH - D:\ProgramsNET\a-squared Anti-Malware\a2service.exe
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - D:\ProgramsNET\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Program Files\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - D:\Program Files\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - D:\Program Files\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - D:\Program Files\Avast4\ashWebSv.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - Unknown owner - D:\Program Files\Comodo\Firewall\cmdagent.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - D:\Program Files\SpywareTerminator\sp_rsser.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: VAIO Media Music Server (Application) (VAIOMediaPlatform-MusicServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Music Server\SSSvr.exe

–
End of file - 13351 bytes

Thanks for the reaply.
Like I said, the anti-spyware CA from Yahoo toolbar shows a trojan called Bancos IPA. I have tryed some programs (ComboFix, Malwarebytes) to clean my laptop, but no lucke so far. I notice one file that I did not installed, GbPlugin, you can see it on the HJT O2 - BHO: G-Buster Browser Defense Unibanco - {C41A1C0E-EA6C-11D4-B1B8-444553540008}, but I was not able to delete, it is locked, I've even try the unlocker1.8.7, but no deal. I dont know if they are conected, but they are here, no matter what I do.

Here is the new log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:56, on 30/Jul/08
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
D:\ProgramsNET\Ad-Aware\aawservice.exe
D:\Program Files\Avast4\aswUpdSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
D:\Program Files\Avast4\ashServ.exe
C:\WINDOWS\system32\atiptaxx.exe
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\system32\ICO.EXE
C:\Program Files\Sony\10Key Utility\va10key.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
D:\Program Files\Comodo\Firewall\cfp.exe
C:\WINDOWS\system32\ezSP_Px.exe
C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe
C:\Program Files\Sony\Jog Dial Navigator\JogServ2.exe
D:\Program Files\ActiveSync\Wcescomm.exe
D:\PROGRA~1\Pop-Up Stopper\PSFree.exe
C:\Program Files\Apoint\Apntex.exe
D:\Program Files\SpeedFan\speedfan.exe
D:\PROGRA~1\ActiveSync\rapimgr.exe
C:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Webshots\webshots.scr
D:\ProgramsNET\a-squared Anti-Malware\a2service.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
D:\Program Files\Comodo\Firewall\cmdagent.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\PSIService.exe
D:\Program Files\SpywareTerminator\sp_rsser.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sony\VAIO Media Music Server\SSSvr.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
D:\Program Files\Avast4\ashMaiSv.exe
D:\Program Files\Avast4\ashWebSv.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\explorer.exe
C:\PROGRA~1\GbPlugin\GbpSv.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
D:\ProgramsNET\HijackThis\HijackThis.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=ZillaPopupKiller:8100
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local;*.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - D:\Program Files\SnagIt 8\SnagItBHO.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - D:\Program Files\rpbrowserrecordplugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\Spybot S & D\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\avgtoolbar.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - D:\ProgramsNET\Spyware Doctor\tools\iesdpb.dll
O2 - BHO: G-Buster Browser Defense Unibanco - {C41A1C0E-EA6C-11D4-B1B8-444553540008} - C:\PROGRA~1\GbPlugin\gbiehuni.dll
O2 - BHO: CutePDF Form Filler - {D41289F2-69C6-417B-897E-C653D677CBAF} - D:\ProgramsNET\CutePDF Pro\CPFillerCo.dll
O2 - BHO: PicLens plug-in for Internet Explorer - {EAEE5C74-6D0D-4aca-9232-0DA4A7B866BA} - C:\Program Files\PicLensIE\PicLens.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O3 - Toolbar: Webshots Toolbar - {C17590D2-ECB4-4b15-8820-F58798DCC118} - (no file)
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\avgtoolbar.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - D:\Program Files\SnagIt 8\SnagItIEAddin.dll
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [va10key] C:\Program Files\Sony\10Key Utility\va10key.exe
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [COMODO Firewall Pro] "D:\Program Files\Comodo\Firewall\cfp.exe" -h
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\system32\ezSP_Px.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win
O4 - HKCU\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKCU\..\Run: [JOGSERV2.EXE] C:\Program Files\Sony\Jog Dial Navigator\JogServ2.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "D:\Program Files\ActiveSync\Wcescomm.exe"
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "D:\PROGRA~1\Pop-Up Stopper\PSFree.exe"
O4 - Startup: SpeedFan.lnk = D:\Program Files\SpeedFan\speedfan.exe
O4 - Startup: Webshots.lnk = D:\Program Files\Webshots\Launcher.exe
O8 - Extra context menu item: &Clean Traces - D:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - D:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: &Webshots Photo Search - res://D:\Program Files\Webshots\WSToolbar4IE.dll/MENUSEARCH.HTM
O8 - Extra context menu item: Download &all with DAP - D:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\Microsoft Office\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - D:\ProgramsNET\Spyware Doctor\tools\iesdpb.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - D:\PROGRA~1\ActiveSync\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - D:\PROGRA~1\ActiveSync\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - D:\PROGRA~1\ActiveSync\INetRepl.dll
O9 - Extra button: Launch PicLens - {3437D640-C91A-458f-89F5-B9095EA4C28B} - C:\Program Files\PicLensIE\PicLens.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\Microsoft Office\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\Spybot S & D\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\Spybot S & D\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1209754449894
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1209763554307
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\Skype4COM.dll
O20 - Winlogon Notify: GbPluginUni - C:\PROGRA~1\GbPlugin\gbiehuni.dll
O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Emsi Software GmbH - D:\ProgramsNET\a-squared Anti-Malware\a2service.exe
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - D:\ProgramsNET\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Program Files\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - D:\Program Files\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - D:\Program Files\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - D:\Program Files\Avast4\ashWebSv.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - Unknown owner - D:\Program Files\Comodo\Firewall\cmdagent.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - D:\Program Files\SpywareTerminator\sp_rsser.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: VAIO Media Music Server (Application) (VAIOMediaPlatform-MusicServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Music Server\SSSvr.exe

–
End of file - 12619 bytes

Done as instructed, but combofix only runs under windows safe mode.

ComboFix 08-07-30.02 - Administrator 2008-07-31 14:04:54.5 - NTFSx86 MINIMAL
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.355 [GMT -3:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-06-28 to 2008-07-31 )))))))))))))))))))))))))))))))
.

2008-07-27 13:23 . 2008-07-27 13:23 d——– C:\Documents and Settings\Ricardo\Application Data\Malwarebytes
2008-07-27 13:23 . 2008-07-23 20:09 38,472 –a—— C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-07-27 13:23 . 2008-07-23 20:09 17,144 –a—— C:\WINDOWS\system32\drivers\mbam.sys
2008-07-27 13:22 . 2008-07-27 13:22 d——– C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-07-25 21:02 . 2008-07-25 21:02 d——– C:\Documents and Settings\Ricardo\Application Data\gtk-2.0
2008-07-25 20:59 . 2008-07-25 21:03 d——– C:\Documents and Settings\Ricardo\.gconfd
2008-07-25 20:59 . 2008-07-25 21:01 d——– C:\Documents and Settings\Ricardo\.gconf
2008-07-25 20:58 . 2008-07-25 21:03 d——– C:\Documents and Settings\Ricardo\.gnucash
2008-07-25 20:58 . 2008-07-25 20:58 d——– C:\Documents and Settings\Ricardo\.gnome2_private
2008-07-25 20:58 . 2008-07-25 20:58 d——– C:\Documents and Settings\Ricardo\.gnome2
2008-07-25 20:43 . 1999-07-10 23:39 152,064 –a—— C:\WINDOWS\system32\temp.00E
2008-07-25 20:43 . 1999-07-10 23:39 152,064 –a—— C:\WINDOWS\system32\temp.00A
2008-07-25 20:43 . 1998-06-17 11:45 77,878 –a—— C:\WINDOWS\system32\temp.00F
2008-07-25 20:43 . 1998-06-17 11:45 77,878 –a—— C:\WINDOWS\system32\temp.00B
2008-07-25 20:43 . 1998-10-12 17:07 65,024 –a—— C:\WINDOWS\system32\temp.00D
2008-07-25 20:43 . 1998-10-12 17:07 65,024 –a—— C:\WINDOWS\system32\temp.009
2008-07-25 20:43 . 1999-03-28 23:00 30,992 –a—— C:\WINDOWS\system32\temp.010
2008-07-25 20:43 . 1999-03-28 23:00 30,992 –a—— C:\WINDOWS\system32\temp.00C
2008-07-25 20:20 . 2008-07-25 20:20 d——– C:\Program Files\Common Files\Opus Shared
2008-07-24 23:54 . 2008-07-24 23:54 d——– C:\Documents and Settings\Eu\LOCALS~1
2008-07-24 23:54 . 2008-07-24 23:54 d——– C:\Documents and Settings\Eu
2008-07-24 16:26 . 2008-07-25 17:34 d——– C:\Program Files\PicLensIE
2008-07-19 20:48 . 2008-07-19 22:08 d——– C:\Documents and Settings\Ricardo\Application Data\Apple Computer
2008-07-19 20:47 . 2008-07-19 20:47 d——– C:\Program Files\iPod
2008-07-19 20:44 . 2008-07-19 20:45 d——– C:\Program Files\QuickTime
2008-07-19 20:44 . 2008-07-19 20:47 d——– C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-07-19 20:43 . 2008-07-19 20:43 d——– C:\Program Files\Apple Software Update
2008-07-19 20:42 . 2008-07-19 20:42 d——– C:\Program Files\Common Files\Apple
2008-07-19 20:42 . 2008-07-19 20:42 d——– C:\Documents and Settings\All Users\Application Data\Apple
2008-07-19 11:45 . 2008-06-10 02:32 73,728 –a—— C:\WINDOWS\system32\javacpl.cpl
2008-07-18 23:46 . 2008-07-18 23:46 d——– C:\Documents and Settings\Ricardo\Application Data\PC Tools
2008-07-18 23:44 . 2008-07-18 23:44 d——– C:\WINDOWS\system32\embedded
2008-07-18 18:29 . 2008-07-18 21:12 d——– C:\Documents and Settings\Ricardo\.housecall6.6
2008-07-18 18:28 . 2008-07-18 18:28 d——– C:\WINDOWS\Sun
2008-07-18 18:19 . 2008-07-19 11:45 d——– C:\Program Files\Java
2008-07-18 18:18 . 2008-07-18 18:18 d——– C:\Program Files\Common Files\Java
2008-07-18 17:40 . 2002-09-04 15:17 d——– C:\Documents and Settings\Administrator.EU\WINDOWS
2008-07-18 17:40 . 2002-09-03 16:36 d——– C:\Documents and Settings\Administrator.EU\Application Data\Sony Corporation
2008-07-18 17:40 . 2002-09-04 14:50 d——– C:\Documents and Settings\Administrator.EU\Application Data\InterTrust
2008-07-18 17:40 . 2008-07-18 17:40 d——– C:\Documents and Settings\Administrator.EU
2008-07-17 12:27 . 2002-09-03 16:36 d——– C:\Documents and Settings\Administrator\Application Data\Sony Corporation
2008-07-17 12:27 . 2008-07-17 12:29 d—s—- C:\Documents and Settings\Administrator
2008-07-14 11:57 . 2008-07-17 12:33 d——– C:\Program Files\GbPlugin
2008-07-14 11:57 . 2008-07-19 11:31 d——– C:\Documents and Settings\All Users\Application Data\GbPlugin
2008-07-11 14:34 . 2008-07-11 14:34 d——– C:\Documents and Settings\Ricardo\Application Data\PCF-VLC
2008-07-07 20:15 . 2008-07-07 20:15 244 –ah—– C:\sqmnoopt02.sqm
2008-07-07 20:15 . 2008-07-07 20:15 232 –ah—– C:\sqmdata02.sqm
2008-07-07 12:56 . 2008-07-07 12:56 244 –ah—– C:\sqmnoopt01.sqm
2008-07-07 12:56 . 2008-07-07 12:56 232 –ah—– C:\sqmdata01.sqm
2008-07-05 11:53 . 2008-07-05 11:53 d——– C:\Documents and Settings\Ricardo\Application Data\Avira
2008-07-05 11:48 . 2008-07-05 11:49 d——– C:\Documents and Settings\All Users\Application Data\Avira
2008-06-27 23:32 . 2008-06-28 21:36 127 –a—— C:\WINDOWS\system32\test.aok
2008-06-27 23:25 . 2008-06-27 23:25 d——– C:\Documents and Settings\Ricardo\Application Data\vlc
2008-06-25 17:58 . 2008-06-25 17:58 d——– C:\Program Files\MSXML 4.0
2008-06-20 14:46 . 2008-06-20 14:46 245,248 —–c— C:\WINDOWS\system32\dllcache\mswsock.dll
2008-06-20 14:46 . 2008-06-20 14:46 147,968 —–c— C:\WINDOWS\system32\dllcache\dnsapi.dll
2008-06-20 11:37 . 2006-04-25 22:14 212,992 –a—— C:\WINDOWS\system32\MSM23w.dll
2008-06-20 11:37 . 2007-05-15 16:54 184,320 –a—— C:\WINDOWS\system32\MSM25w.dll
2008-06-20 11:37 . 2007-01-16 14:11 184,320 –a—— C:\WINDOWS\system32\MSM24w.dll
2008-06-20 11:37 . 2005-07-01 14:05 184,320 –a—— C:\WINDOWS\system32\MSM22w.dll
2008-06-20 11:36 . 2008-06-20 11:36 d——– C:\Kpcms
2008-06-20 11:36 . 1998-09-14 08:41 285,216 –a—— C:\WINDOWS\system32\drivers\Onsio.sys
2008-06-20 11:36 . 1998-08-01 12:00 60,928 –a—— C:\WINDOWS\system32\drivers\Smplscsi.sys
2008-06-20 11:36 . 2003-06-11 12:03 15,396 –a—— C:\WINDOWS\system32\Msmusd5.dll
2008-06-20 11:36 . 2001-06-20 15:44 13,962 –a—— C:\WINDOWS\system32\Msmusd6.dll
2008-06-20 11:36 . 2003-07-17 16:12 12,499 –a—— C:\WINDOWS\system32\Msmusd7.dll
2008-06-20 11:36 . 1997-02-14 13:10 7,680 –a—— C:\WINDOWS\system32\drivers\Onsreged.sys
2008-06-20 08:51 . 2008-06-20 08:51 361,600 —–c— C:\WINDOWS\system32\dllcache\tcpip.sys
2008-06-20 08:40 . 2008-06-20 08:40 138,496 —–c— C:\WINDOWS\system32\dllcache\afd.sys
2008-06-20 08:08 . 2008-06-20 08:08 225,856 —–c— C:\WINDOWS\system32\dllcache\tcpip6.sys
2008-06-16 12:18 . 2008-07-28 00:49 d——– C:\Documents and Settings\Ricardo\Pavark
2008-06-15 16:15 . 2008-06-21 12:32 d——– C:\Documents and Settings\Ricardo\Application Data\DivX
2008-06-15 16:14 . 2008-05-22 19:22 129,784 ——— C:\WINDOWS\system32\pxafs.dll
2008-06-15 16:14 . 2008-05-22 19:22 120,056 ——— C:\WINDOWS\system32\pxcpyi64.exe
2008-06-15 16:14 . 2008-05-22 19:22 118,520 ——— C:\WINDOWS\system32\pxinsi64.exe
2008-06-15 16:14 . 2008-05-22 19:22 9,464 ——— C:\WINDOWS\system32\drivers\cdralw2k.sys
2008-06-15 16:14 . 2008-05-22 19:22 9,336 ——— C:\WINDOWS\system32\drivers\cdr4_xp.sys
2008-06-15 00:24 . 2008-06-15 00:24 d——– C:\Documents and Settings\Ricardo\Application Data\Participatory Culture Foundation
2008-06-14 23:36 . 2007-04-12 14:19 129,024 –a—— C:\WINDOWS\system32\AVERM.dll
2008-06-14 23:36 . 2006-09-26 13:57 28,672 –a—— C:\WINDOWS\system32\AVEQT.dll
2008-06-13 00:54 . 2008-06-13 00:53 8,704 –a—— C:\WINDOWS\system32\drivers\lxrldsmxiypi.sys
2008-06-12 01:35 . 2008-06-13 08:05 272,128 —–c— C:\WINDOWS\system32\dllcache\bthport.sys
2008-06-12 01:33 . 2008-05-08 11:02 203,136 —–c— C:\WINDOWS\system32\dllcache\rmcast.sys
2008-06-05 00:45 . 2008-06-05 00:46 13 –a—— C:\WINDOWS\system32\WinSys32.crc
2008-06-05 00:44 . 2004-11-22 20:56 913,560 –a—— C:\WINDOWS\system32\wodFtpDLX.ocx
2008-06-05 00:41 . 1999-03-22 12:29 233,472 –a—— C:\WINDOWS\system32\Ilda32.dll
2008-06-05 00:41 . 1998-06-17 04:00 18,944 –a—— C:\WINDOWS\system32\BORLNDMM.DLL
2008-06-02 17:13 . 2008-06-02 17:55 d——– C:\Program Files\Digital Locker Assistant

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-31 01:36 ——— d—–w C:\Documents and Settings\Ricardo\Application Data\Skype
2008-07-30 20:30 ——— d—–w C:\Documents and Settings\Ricardo\Application Data\skypePM
2008-07-30 03:42 ——— d—–w C:\Documents and Settings\Ricardo\Application Data\Spyware Terminator
2008-07-29 17:50 ——— d—a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-07-29 17:49 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spyware Terminator
2008-07-25 20:25 ——— d—–w C:\Program Files\Microsoft Silverlight
2008-07-22 03:49 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-07-19 23:47 ——— d—–w C:\Program Files\Bonjour
2008-07-05 18:33 ——— d—–w C:\Program Files\Plaxo
2008-07-05 13:45 76,040 —-a-w C:\WINDOWS\system32\drivers\avgtdix.sys
2008-07-05 13:44 96,520 —-a-w C:\WINDOWS\system32\drivers\avgldx86.sys
2008-07-05 13:44 10,520 —-a-w C:\WINDOWS\system32\avgrsstx.dll
2008-06-20 17:46 245,248 —-a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 14:39 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-06-20 11:51 361,600 —-a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 11:40 138,496 —-a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 11:08 225,856 —-a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-19 14:07 2,516 –sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2008-06-13 11:05 272,128 ——w C:\WINDOWS\system32\drivers\bthport.sys
2008-06-04 18:20 ——— d—–w C:\Program Files\Microsoft.NET
2008-05-30 23:22 823,296 —-a-w C:\WINDOWS\system32\divx_xx0c.dll
2008-05-30 23:22 823,296 —-a-w C:\WINDOWS\system32\divx_xx07.dll
2008-05-30 23:22 815,104 —-a-w C:\WINDOWS\system32\divx_xx0a.dll
2008-05-30 23:22 802,816 —-a-w C:\WINDOWS\system32\divx_xx11.dll
2008-05-30 23:22 683,520 —-a-w C:\WINDOWS\system32\DivX.dll
2008-05-30 23:22 593,920 —-a-w C:\WINDOWS\system32\dpuGUI11.dll
2008-05-30 23:22 57,344 —-a-w C:\WINDOWS\system32\dpv11.dll
2008-05-30 23:22 53,248 —-a-w C:\WINDOWS\system32\dpuGUI10.dll
2008-05-30 23:22 344,064 —-a-w C:\WINDOWS\system32\dpus11.dll
2008-05-30 23:22 294,912 —-a-w C:\WINDOWS\system32\dpu11.dll
2008-05-30 23:22 294,912 —-a-w C:\WINDOWS\system32\dpu10.dll
2008-05-26 14:43 143,104 —-a-w C:\WINDOWS\system32\guard32.dll
2008-05-22 22:22 524,288 —-a-w C:\WINDOWS\system32\DivXsm.exe
2008-05-22 22:22 3,596,288 —-a-w C:\WINDOWS\system32\qt-dx331.dll
2008-05-22 22:20 200,704 —-a-w C:\WINDOWS\system32\ssldivx.dll
2008-05-22 22:20 1,044,480 —-a-w C:\WINDOWS\system32\libdivx.dll
2008-05-22 22:19 81,920 —-a-w C:\WINDOWS\system32\dpl100.dll
2008-05-22 22:19 196,608 —-a-w C:\WINDOWS\system32\dtu100.dll
2008-05-22 22:19 161,096 —-a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-05-22 22:18 12,288 —-a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2008-05-16 14:58 12,632 —-a-w C:\WINDOWS\system32\lsdelete.exe
2008-05-09 20:02 203,776 —-a-w C:\WINDOWS\system32\clrviddc.dll
2008-05-09 10:53 90,112 —-a-w C:\WINDOWS\system32\wshext.dll
2008-05-09 10:53 430,080 —-a-w C:\WINDOWS\system32\vbscript.dll
2008-05-09 10:53 180,224 —-a-w C:\WINDOWS\system32\scrobj.dll
2008-05-09 10:53 172,032 —-a-w C:\WINDOWS\system32\scrrun.dll
2008-05-08 11:24 155,648 —-a-w C:\WINDOWS\system32\wscript.exe
2008-05-07 09:07 135,168 —-a-w C:\WINDOWS\system32\cscript.exe
2008-05-07 05:12 1,288,192 —-a-w C:\WINDOWS\system32\quartz.dll
2008-05-03 21:49 50,688 —-a-w C:\WINDOWS\system32\wbhelp2.dll
2008-04-23 04:16 826,368 —-a-w C:\WINDOWS\system32\wininet.dll
2008-04-14 08:42 985,088 —-a-w C:\WINDOWS\system32\setupapi.dll
2008-04-14 08:42 11,264 ——w C:\WINDOWS\system32\spnpinst.exe
2008-04-14 08:41 423,936 —-a-w C:\WINDOWS\system32\licdll.dll
2008-04-14 00:25 1,804 —-a-w C:\WINDOWS\system32\dcache.bin
2008-04-14 00:16 329,728 —-a-w C:\WINDOWS\system32\netsetup.exe
2008-04-14 00:13 92,424 —-a-w C:\WINDOWS\system32\rdpdd.dll
2008-04-14 00:13 87,176 —-a-w C:\WINDOWS\system32\rdpwsx.dll
2008-04-14 00:13 299,520 —-a-w C:\WINDOWS\system32\drmclien.dll
2008-04-14 00:13 12,168 —-a-w C:\WINDOWS\system32\tsddd.dll
2008-04-14 00:11 997,376 —-a-w C:\WINDOWS\system32\msgina.dll
2008-04-14 00:10 53,279 —-a-w C:\WINDOWS\system32\odbcji32.dll
2008-04-14 00:10 4,126 —-a-w C:\WINDOWS\system32\msdxmlc.dll
2008-04-14 00:10 3,584 —-a-w C:\WINDOWS\system32\msafd.dll
2008-04-13 21:00 103,424 —-a-w C:\WINDOWS\system32\dpcdll.dll
2008-04-13 19:30 1,845,632 —-a-w C:\WINDOWS\system32\win32k.sys
2008-04-13 19:27 2,188,928 —-a-w C:\WINDOWS\system32\ntoskrnl.exe
2008-04-13 18:44 17,664 —-a-w C:\WINDOWS\system32\watchdog.sys
2008-04-13 18:35 24,064 —-a-w C:\WINDOWS\system32\pidgen.dll
2008-04-13 18:31 7,424 —-a-w C:\WINDOWS\system32\kd1394.dll
2008-04-13 18:31 2,065,792 —-a-w C:\WINDOWS\system32\ntkrnlpa.exe
2008-04-13 18:30 61,440 —-a-w C:\WINDOWS\system32\msvcrt40.dll
2008-04-13 18:14 76,800 ——w C:\WINDOWS\system32\msshavmsg.dll
2008-04-13 17:39 438,784 ——w C:\WINDOWS\system32\xpob2res.dll
2008-04-13 17:39 2,897,920 ——w C:\WINDOWS\system32\xpsp2res.dll
2008-04-13 17:39 187,392 ——w C:\WINDOWS\system32\xpsp1res.dll
2008-04-13 17:37 208,384 —-a-w C:\WINDOWS\system32\rsaenh.dll
2008-04-13 17:37 138,752 —-a-w C:\WINDOWS\system32\dssenh.dll
2008-04-13 17:27 79,872 —-a-w C:\WINDOWS\system32\msxml6r.dll
2008-04-13 17:26 94,208 —-a-w C:\WINDOWS\system32\odbcint.dll
2008-04-13 17:26 12,288 —-a-w C:\WINDOWS\system32\odbcp32r.dll
2008-04-13 17:26 12,288 —-a-w C:\WINDOWS\system32\mscpx32r.dll
2008-04-13 17:24 20,480 —-a-w C:\WINDOWS\system32\msorc32r.dll
2008-04-13 17:21 733,696 —-a-w C:\WINDOWS\system32\qedwipes.dll
2008-04-13 17:09 4,096 ——w C:\WINDOWS\system32\dsprpres.dll
2008-04-13 17:03 63,488 —-a-w C:\WINDOWS\system32\browselc.dll
2008-04-13 17:03 549,376 —-a-w C:\WINDOWS\system32\shdoclc.dll
2008-04-13 16:48 1,647,616 ——w C:\WINDOWS\system32\winbrand.dll
2008-04-13 16:45 216,064 —-a-w C:\WINDOWS\system32\moricons.dll
2008-04-13 16:23 48,128 —-a-w C:\WINDOWS\system32\msprivs.dll
2008-04-13 16:22 48,128 —-a-w C:\WINDOWS\system32\inetres.dll
2008-04-13 15:39 884,736 —-a-w C:\WINDOWS\system32\msimsg.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2008-04-13 21:12 1695232]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 21:12 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [2002-02-28 15:27 114688]
"va10key"="C:\Program Files\Sony\10Key Utility\va10key.exe" [2002-03-04 18:55 102400]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-07-05 10:45 1232152]
"COMODO Firewall Pro"="D:\Program Files\Comodo\Firewall\cfp.exe" [2008-05-31 11:39 1655552]
"ezShieldProtector for Px"="C:\WINDOWS\system32\ezSP_Px.exe" [2002-07-03 21:17 40960]
"AtiPTA"="atiptaxx.exe" [2002-07-25 18:04 290816 C:\WINDOWS\system32\atiptaxx.exe]
"Mouse Suite 98 Daemon"="ICO.EXE" [2001-08-23 15:23 45056 C:\WINDOWS\system32\ico.exe]

C:\Documents and Settings\Ricardo\Start Menu\Programs\Startup\
SpeedFan.lnk - D:\Program Files\SpeedFan\speedfan.exe [2008-04-22 04:59:28 3287552]
Webshots.lnk - D:\Program Files\Webshots\Launcher.exe [2008-05-03 01:25:06 157008]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveSearch"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{EDB0E980-90BD-11D4-8599-0008C7D3B6F8}"= "D:\Eudora\EuShlExt.dll" [2006-08-17 14:57 86016]
"{E37CB5F0-51F5-4395-A808-5FA49E399008}"= "C:\PROGRA~1\GbPlugin\gbiehuni.dll" [2008-05-19 15:10 368032]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ GbPluginUni]
2008-05-19 15:10 368032 C:\PROGRA~1\GbPlugin\gbiehuni.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.MJPG"= sonymjpg.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ezShieldProtector for Px]
–a—— 2002-07-03 21:17 40960 C:\WINDOWS\system32\ezSP_Px.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"VAIOMediaPlatform-PhotoServer-UPnP"=2 (0x2)
"VAIOMediaPlatform-PhotoServer-HTTP"=2 (0x2)
"VAIOMediaPlatform-PhotoServer-AppServer"=2 (0x2)
"VAIOMediaPlatform-MusicServer-UPnP"=2 (0x2)
"VAIOMediaPlatform-MusicServer-HTTP"=2 (0x2)
"gusvc"=3 (0x3)
"AVEService"=2 (0x2)
"antivirwebservice"=2 (0x2)
"AntiVirService"=2 (0x2)
"AntiVirScheduler"=2 (0x2)
"AntiVirMailService"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"D:\Program Files\ActiveSync\rapimgr.exe"= D:\Program Files\ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"D:\Program Files\ActiveSync\wcescomm.exe"= D:\Program Files\ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"D:\Program Files\ActiveSync\WCESMgr.exe"= D:\Program Files\ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"D:\\Program Files\\SmartFTP\\SmartFTP.exe"=
"D:\\Program Files\\DAP\\DAP.exe"=
"D:\\ProgramsNET\\Video\\Miro\\xulrunner\\python\\Miro_Downloader.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"D:\\ProgramsNET\\iTunes\\iTunes.exe"=
"D:\\ProgramsNET\\Finanças\\gnucash\\bin\\gnucash-bin.exe"=
"D:\\ProgramsNET\\Finanças\\gnucash\\bin\\gconfd-2.exe"=
"D:\\Program Files\\Firefox\\firefox.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R3 SPI;Sony Programmable I/O Control Device;C:\WINDOWS\system32\DRIVERS\SonyPI.sys [2001-08-17 09:51]
S1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 11:35]
S1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-07-05 10:44]
S1 cmdGuard;COMODO Firewall Pro Sandbox Driver;C:\WINDOWS\system32\DRIVERS\cmdguard.sys [2008-05-26 11:43]
S1 cmdHlp;COMODO Firewall Pro Helper Driver;C:\WINDOWS\system32\DRIVERS\cmdhlp.sys [2008-05-26 11:43]
S2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 11:37]
S2 avg8emc;AVG8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-07-05 10:44]
S2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-07-05 10:44]
S2 AvgTdiX;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-07-05 10:45]
S3 BioNT_BS;BioNT_BS;D:\Program Files\Paragon\Partition Manager 9\bluescrn\BioNT_bs.sys []
S3 LEX_NIC_SERVICE;IEEE 802.11 Wireless NIC Win2000 Driver;C:\WINDOWS\system32\DRIVERS\Express.sys [2002-12-27 11:00]
S3 PRISM;IEEE 802.11 Wireless NIC Driver;C:\WINDOWS\system32\DRIVERS\EXPRESS.sys [2002-12-27 11:00]
S3 va10key;Sony 10Key Filter Driver;C:\WINDOWS\system32\DRIVERS\va10key.sys [2002-03-04 19:01]
S4 AntiVirMailService;Avira AntiVir Premium MailGuard;D:\ProgramsNET\Avira\AntiVir PersonalEdition Premium\avmailc.exe [2008-07-05 11:58]
S4 antivirwebservice;Avira AntiVir Premium WebGuard;D:\ProgramsNET\Avira\AntiVir PersonalEdition Premium\AVWEBGRD.EXE [2008-04-09 15:57]
S4 AVEService;Avira AntiVir Premium MailGuard helper service;D:\ProgramsNET\Avira\AntiVir PersonalEdition Premium\avesvc.exe [2008-02-07 10:06]
.
Contents of the 'Scheduled Tasks' folder

2008-07-30 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-07-29 22:31]

2008-07-31 C:\WINDOWS\Tasks\XoftSpySE 2.job
- D:\ProgramsNET\XoftSpySE\XoftSpy.exe [2007-07-13 08:43]

2008-06-02 C:\WINDOWS\Tasks\XoftSpySE.job
- D:\ProgramsNET\XoftSpySE\XoftSpy.exe [2007-07-13 08:43]
.
.
——- Supplementary Scan ——-
.
R0 -: HKCU-Main,Start Page = hxxp://www.sony.com/vaiopeople

O16 -: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
C:\WINDOWS\Downloaded Program Files\Microsoft XML Parser for Java.osd


**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-31 14:07:35
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-07-31 14:08:32
ComboFix-quarantined-files.txt 2008-07-31 17:08:29

Pre-Run: 16,668,815,360 bytes free
Post-Run: 16,652,492,800 bytes free

303 — E O F — 2008-07-10 00:46:02
================================================================================
===

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:14, on 2008-07-31
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
D:\ProgramsNET\Ad-Aware\aawservice.exe
D:\Program Files\Avast4\aswUpdSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
D:\Program Files\Avast4\ashServ.exe
C:\WINDOWS\system32\atiptaxx.exe
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\system32\ICO.EXE
C:\Program Files\Sony\10Key Utility\va10key.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
D:\Program Files\Comodo\Firewall\cfp.exe
C:\WINDOWS\system32\ezSP_Px.exe
C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe
C:\Program Files\Sony\Jog Dial Navigator\JogServ2.exe
D:\Program Files\ActiveSync\Wcescomm.exe
D:\PROGRA~1\Pop-Up Stopper\PSFree.exe
C:\Program Files\Apoint\Apntex.exe
D:\Program Files\SpeedFan\speedfan.exe
C:\PROGRA~1\GbPlugin\GbpSv.exe
D:\PROGRA~1\ActiveSync\rapimgr.exe
D:\Program Files\Webshots\webshots.scr
C:\WINDOWS\system32\spoolsv.exe
D:\ProgramsNET\a-squared Anti-Malware\a2service.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
D:\Program Files\Comodo\Firewall\cmdagent.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\PSIService.exe
D:\Program Files\SpywareTerminator\sp_rsser.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sony\VAIO Media Music Server\SSSvr.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
D:\Program Files\Avast4\ashMaiSv.exe
D:\Program Files\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wuauclt.exe
D:\ProgramsNET\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=ZillaPopupKiller:8100
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local;*.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - D:\Program Files\SnagIt 8\SnagItBHO.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - D:\Program Files\rpbrowserrecordplugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\Spybot S & D\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\avgtoolbar.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - D:\ProgramsNET\Spyware Doctor\tools\iesdpb.dll
O2 - BHO: G-Buster Browser Defense Unibanco - {C41A1C0E-EA6C-11D4-B1B8-444553540008} - C:\PROGRA~1\GbPlugin\gbiehuni.dll
O2 - BHO: CutePDF Form Filler - {D41289F2-69C6-417B-897E-C653D677CBAF} - D:\ProgramsNET\CutePDF Pro\CPFillerCo.dll
O2 - BHO: PicLens plug-in for Internet Explorer - {EAEE5C74-6D0D-4aca-9232-0DA4A7B866BA} - C:\Program Files\PicLensIE\PicLens.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O3 - Toolbar: Webshots Toolbar - {C17590D2-ECB4-4b15-8820-F58798DCC118} - (no file)
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\avgtoolbar.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - D:\Program Files\SnagIt 8\SnagItIEAddin.dll
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [va10key] C:\Program Files\Sony\10Key Utility\va10key.exe
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [COMODO Firewall Pro] "D:\Program Files\Comodo\Firewall\cfp.exe" -h
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\system32\ezSP_Px.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win
O4 - HKCU\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKCU\..\Run: [JOGSERV2.EXE] C:\Program Files\Sony\Jog Dial Navigator\JogServ2.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "D:\Program Files\ActiveSync\Wcescomm.exe"
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "D:\PROGRA~1\Pop-Up Stopper\PSFree.exe"
O4 - Startup: SpeedFan.lnk = D:\Program Files\SpeedFan\speedfan.exe
O4 - Startup: Webshots.lnk = D:\Program Files\Webshots\Launcher.exe
O8 - Extra context menu item: &Clean Traces - D:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - D:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: &Webshots Photo Search - res://D:\Program Files\Webshots\WSToolbar4IE.dll/MENUSEARCH.HTM
O8 - Extra context menu item: Download &all with DAP - D:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\Microsoft Office\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - D:\ProgramsNET\Spyware Doctor\tools\iesdpb.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - D:\PROGRA~1\ActiveSync\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - D:\PROGRA~1\ActiveSync\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - D:\PROGRA~1\ActiveSync\INetRepl.dll
O9 - Extra button: Launch PicLens - {3437D640-C91A-458f-89F5-B9095EA4C28B} - C:\Program Files\PicLensIE\PicLens.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\Microsoft Office\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\Spybot S & D\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\Spybot S & D\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1209754449894
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1209763554307
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\Skype4COM.dll
O20 - Winlogon Notify: GbPluginUni - C:\PROGRA~1\GbPlugin\gbiehuni.dll
O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Emsi Software GmbH - D:\ProgramsNET\a-squared Anti-Malware\a2service.exe
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - D:\ProgramsNET\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Program Files\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - D:\Program Files\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - D:\Program Files\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - D:\Program Files\Avast4\ashWebSv.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - Unknown owner - D:\Program Files\Comodo\Firewall\cmdagent.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - D:\Program Files\SpywareTerminator\sp_rsser.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: VAIO Media Music Server (Application) (VAIOMediaPlatform-MusicServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Music Server\SSSvr.exe

–
End of file - 12376 bytes

After runing the script, the trojan bancos ipa has gone away
The only strange thing is, every time I run combofix, Kazaa and bifrost apears on the scan of CA yahoo toolbar, which is able to clean it. Anyway, you solved the problem, thank you very much for your help and patience.

The logs:

ComboFix 08-07-31.01 - Ricardo 2008-08-01 11:45:52.6 - NTFSx86 MINIMAL
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.345 [GMT -3:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Ricardo\Desktop\CFScript.txt

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\PROGRA~1\GbPlugin\gbiehuni.dll
C:\WINDOWS\system32\temp.009
C:\WINDOWS\system32\temp.00A
C:\WINDOWS\system32\temp.00B
C:\WINDOWS\system32\temp.00C
C:\WINDOWS\system32\temp.00D
C:\WINDOWS\system32\temp.00E
C:\WINDOWS\system32\temp.00F
C:\WINDOWS\system32\temp.010
C:\WINDOWS\system32\WinSys32.crc
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\PROGRA~1\GbPlugin
C:\PROGRA~1\GbPlugin\gbieh.gmd
C:\PROGRA~1\GbPlugin\gbiehuni.dll
C:\PROGRA~1\GbPlugin\GbpSv.exe
C:\PROGRA~1\GbPlugin\uni.gpc
C:\Program Files\Bonjour
C:\Program Files\Bonjour\About Bonjour.rtf
C:\Program Files\Bonjour\mdnsNSP.dll
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\temp.009
C:\WINDOWS\system32\temp.00A
C:\WINDOWS\system32\temp.00B
C:\WINDOWS\system32\temp.00C
C:\WINDOWS\system32\temp.00D
C:\WINDOWS\system32\temp.00E
C:\WINDOWS\system32\temp.00F
C:\WINDOWS\system32\temp.010
C:\WINDOWS\system32\WinSys32.crc

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_GbpSv
——-\Service_GbpSv


((((((((((((((((((((((((( Files Created from 2008-07-01 to 2008-08-01 )))))))))))))))))))))))))))))))
.

2008-08-01 11:51 . 535,871,488 C:\hiberfil.sys
2008-08-01 11:45 . 2008-08-01 11:46 d——– C:\QooBox
2008-08-01 11:45 . 2008-08-01 11:56 d——– C:\ComboFix
2008-07-31 14:20 . 2008-07-31 14:20 d–hs—- C:\RECYCLER
2008-07-27 13:23 . 2008-07-27 13:23 d——– C:\Documents and Settings\Ricardo\Application Data\Malwarebytes
2008-07-27 13:23 . 2008-07-23 20:09 38,472 –a—— C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-07-27 13:23 . 2008-07-23 20:09 17,144 –a—— C:\WINDOWS\system32\drivers\mbam.sys
2008-07-27 13:22 . 2008-07-27 13:22 d——– C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-07-25 21:02 . 2008-07-25 21:02 d——– C:\Documents and Settings\Ricardo\Application Data\gtk-2.0
2008-07-25 20:59 . 2008-07-25 21:03 d——– C:\Documents and Settings\Ricardo\.gconfd
2008-07-25 20:59 . 2008-07-25 21:01 d——– C:\Documents and Settings\Ricardo\.gconf
2008-07-25 20:58 . 2008-07-25 21:03 d——– C:\Documents and Settings\Ricardo\.gnucash
2008-07-25 20:58 . 2008-07-25 20:58 d——– C:\Documents and Settings\Ricardo\.gnome2_private
2008-07-25 20:58 . 2008-07-25 20:58 d——– C:\Documents and Settings\Ricardo\.gnome2
2008-07-25 20:20 . 2008-07-25 20:20 d——– C:\Program Files\Common Files\Opus Shared
2008-07-24 23:54 . 2008-07-24 23:54 d——– C:\Documents and Settings\Eu\LOCALS~1
2008-07-24 23:54 . 2008-07-24 23:54 d——– C:\Documents and Settings\Eu
2008-07-24 16:26 . 2008-07-25 17:34 d——– C:\Program Files\PicLensIE
2008-07-19 20:48 . 2008-07-19 22:08 d——– C:\Documents and Settings\Ricardo\Application Data\Apple Computer
2008-07-19 20:47 . 2008-07-19 20:47 d——– C:\Program Files\iPod
2008-07-19 20:44 . 2008-07-19 20:45 d——– C:\Program Files\QuickTime
2008-07-19 20:44 . 2008-07-19 20:47 d——– C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-07-19 20:43 . 2008-07-19 20:43 d——– C:\Program Files\Apple Software Update
2008-07-19 20:42 . 2008-07-19 20:42 d——– C:\Program Files\Common Files\Apple
2008-07-19 20:42 . 2008-07-19 20:42 d——– C:\Documents and Settings\All Users\Application Data\Apple
2008-07-19 11:45 . 2008-06-10 02:32 73,728 –a—— C:\WINDOWS\system32\javacpl.cpl
2008-07-18 23:46 . 2008-07-18 23:46 d——– C:\Documents and Settings\Ricardo\Application Data\PC Tools
2008-07-18 23:44 . 2008-07-18 23:44 d——– C:\WINDOWS\system32\embedded
2008-07-18 18:29 . 2008-07-18 21:12 d——– C:\Documents and Settings\Ricardo\.housecall6.6
2008-07-18 18:28 . 2008-07-18 18:28 d——– C:\WINDOWS\Sun
2008-07-18 18:19 . 2008-07-19 11:45 d——– C:\Program Files\Java
2008-07-18 18:18 . 2008-07-18 18:18 d——– C:\Program Files\Common Files\Java
2008-07-18 17:40 . 2002-09-04 15:17 d——– C:\Documents and Settings\Administrator.EU\WINDOWS
2008-07-18 17:40 . 2002-09-03 16:36 d——– C:\Documents and Settings\Administrator.EU\Application Data\Sony Corporation
2008-07-18 17:40 . 2002-09-04 14:50 d——– C:\Documents and Settings\Administrator.EU\Application Data\InterTrust
2008-07-18 17:40 . 2008-07-18 17:40 d——– C:\Documents and Settings\Administrator.EU
2008-07-17 12:27 . 2002-09-03 16:36 d——– C:\Documents and Settings\Administrator\Application Data\Sony Corporation
2008-07-17 12:27 . 2008-07-17 12:29 d—s—- C:\Documents and Settings\Administrator
2008-07-14 11:57 . 2008-07-19 11:31 d——– C:\Documents and Settings\All Users\Application Data\GbPlugin
2008-07-11 14:34 . 2008-07-11 14:34 d——– C:\Documents and Settings\Ricardo\Application Data\PCF-VLC
2008-07-07 20:15 . 2008-07-07 20:15 244 –ah—– C:\sqmnoopt02.sqm
2008-07-07 20:15 . 2008-07-07 20:15 232 –ah—– C:\sqmdata02.sqm
2008-07-07 12:56 . 2008-07-07 12:56 244 –ah—– C:\sqmnoopt01.sqm
2008-07-07 12:56 . 2008-07-07 12:56 232 –ah—– C:\sqmdata01.sqm
2008-07-05 16:40 . 2008-07-05 16:40 d——– C:\WINDOWS\system32\config\systemprofile\Application Data\Avira
2008-07-05 11:53 . 2008-07-05 11:53 d——– C:\Documents and Settings\Ricardo\Application Data\Avira
2008-07-05 11:48 . 2008-07-05 11:49 d——– C:\Documents and Settings\All Users\Application Data\Avira

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-31 01:36 ——— d—–w C:\Documents and Settings\Ricardo\Application Data\Skype
2008-07-30 20:30 ——— d—–w C:\Documents and Settings\Ricardo\Application Data\skypePM
2008-07-30 03:42 ——— d—–w C:\Documents and Settings\Ricardo\Application Data\Spyware Terminator
2008-07-29 17:50 ——— d—a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-07-29 17:49 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spyware Terminator
2008-07-25 20:25 ——— d—–w C:\Program Files\Microsoft Silverlight
2008-07-22 03:49 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-07-05 18:33 ——— d—–w C:\Program Files\Plaxo
2008-07-05 13:45 76,040 —-a-w C:\WINDOWS\system32\drivers\avgtdix.sys
2008-07-05 13:44 96,520 —-a-w C:\WINDOWS\system32\drivers\avgldx86.sys
2008-07-05 13:44 10,520 —-a-w C:\WINDOWS\system32\avgrsstx.dll
2008-06-28 02:25 ——— d—–w C:\Documents and Settings\Ricardo\Application Data\vlc
2008-06-25 20:58 ——— d—–w C:\Program Files\MSXML 4.0
2008-06-21 15:32 ——— d—–w C:\Documents and Settings\Ricardo\Application Data\DivX
2008-06-20 17:46 245,248 —-a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 14:39 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-06-20 11:51 361,600 —-a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 11:40 138,496 —-a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 11:08 225,856 —-a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-19 14:07 2,516 –sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2008-06-15 03:24 ——— d—–w C:\Documents and Settings\Ricardo\Application Data\Participatory Culture Foundation
2008-06-13 11:05 272,128 ——w C:\WINDOWS\system32\drivers\bthport.sys
2008-06-13 03:53 8,704 —-a-w C:\WINDOWS\system32\drivers\lxrldsmxiypi.sys
2008-06-04 18:20 ——— d—–w C:\Program Files\Microsoft.NET
2008-06-02 20:55 ——— d—–w C:\Program Files\Digital Locker Assistant
2008-05-30 23:22 823,296 —-a-w C:\WINDOWS\system32\divx_xx0c.dll
2008-05-30 23:22 823,296 —-a-w C:\WINDOWS\system32\divx_xx07.dll
2008-05-30 23:22 815,104 —-a-w C:\WINDOWS\system32\divx_xx0a.dll
2008-05-30 23:22 802,816 —-a-w C:\WINDOWS\system32\divx_xx11.dll
2008-05-30 23:22 683,520 —-a-w C:\WINDOWS\system32\DivX.dll
2008-05-30 23:22 593,920 —-a-w C:\WINDOWS\system32\dpuGUI11.dll
2008-05-30 23:22 57,344 —-a-w C:\WINDOWS\system32\dpv11.dll
2008-05-30 23:22 53,248 —-a-w C:\WINDOWS\system32\dpuGUI10.dll
2008-05-30 23:22 344,064 —-a-w C:\WINDOWS\system32\dpus11.dll
2008-05-30 23:22 294,912 —-a-w C:\WINDOWS\system32\dpu11.dll
2008-05-30 23:22 294,912 —-a-w C:\WINDOWS\system32\dpu10.dll
2008-05-26 14:43 143,104 —-a-w C:\WINDOWS\system32\guard32.dll
2008-05-22 22:22 524,288 —-a-w C:\WINDOWS\system32\DivXsm.exe
2008-05-22 22:22 3,596,288 —-a-w C:\WINDOWS\system32\qt-dx331.dll
2008-05-22 22:22 129,784 ——w C:\WINDOWS\system32\pxafs.dll
2008-05-22 22:22 120,056 ——w C:\WINDOWS\system32\pxcpyi64.exe
2008-05-22 22:22 118,520 ——w C:\WINDOWS\system32\pxinsi64.exe
2008-05-22 22:20 200,704 —-a-w C:\WINDOWS\system32\ssldivx.dll
2008-05-22 22:20 1,044,480 —-a-w C:\WINDOWS\system32\libdivx.dll
2008-05-22 22:19 81,920 —-a-w C:\WINDOWS\system32\dpl100.dll
2008-05-22 22:19 196,608 —-a-w C:\WINDOWS\system32\dtu100.dll
2008-05-22 22:19 161,096 —-a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-05-22 22:18 12,288 —-a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2008-05-16 14:58 12,632 —-a-w C:\WINDOWS\system32\lsdelete.exe
2008-05-09 20:02 203,776 —-a-w C:\WINDOWS\system32\clrviddc.dll
2008-05-09 10:53 90,112 —-a-w C:\WINDOWS\system32\wshext.dll
2008-05-09 10:53 430,080 —-a-w C:\WINDOWS\system32\vbscript.dll
2008-05-09 10:53 180,224 —-a-w C:\WINDOWS\system32\scrobj.dll
2008-05-09 10:53 172,032 —-a-w C:\WINDOWS\system32\scrrun.dll
2008-05-08 11:24 155,648 —-a-w C:\WINDOWS\system32\wscript.exe
2008-05-07 09:07 135,168 —-a-w C:\WINDOWS\system32\cscript.exe
2008-05-07 05:12 1,288,192 —-a-w C:\WINDOWS\system32\quartz.dll
2008-05-03 21:49 50,688 —-a-w C:\WINDOWS\system32\wbhelp2.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 21:12 15360]
"FreeRAM XP"="C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" [2006-03-23 00:13 1591808]
"JOGSERV2.EXE"="C:\Program Files\Sony\Jog Dial Navigator\JogServ2.exe" [2002-07-24 00:09 172032]
"H/PC Connection Agent"="D:\Program Files\ActiveSync\Wcescomm.exe" [2006-11-13 13:39 1289000]
"PopUpStopperFreeEdition"="D:\PROGRA~1\Pop-Up Stopper\PSFree.exe" [2005-03-17 11:10 536576]
"ATIModeChange"="Ati2mdxx.exe" [2002-07-25 16:02 28672 C:\WINDOWS\system32\Ati2mdxx.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [2002-02-28 15:27 114688]
"va10key"="C:\Program Files\Sony\10Key Utility\va10key.exe" [2002-03-04 18:55 102400]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-07-05 10:45 1232152]
"COMODO Firewall Pro"="D:\Program Files\Comodo\Firewall\cfp.exe" [2008-05-31 11:39 1655552]
"ezShieldProtector for Px"="C:\WINDOWS\system32\ezSP_Px.exe" [2002-07-03 21:17 40960]
"AtiPTA"="atiptaxx.exe" [2002-07-25 18:04 290816 C:\WINDOWS\system32\atiptaxx.exe]
"Mouse Suite 98 Daemon"="ICO.EXE" [2001-08-23 15:23 45056 C:\WINDOWS\system32\ico.exe]

C:\Documents and Settings\Ricardo\Start Menu\Programs\Startup\
SpeedFan.lnk - D:\Program Files\SpeedFan\speedfan.exe [2008-04-22 04:59:28 3287552]
Webshots.lnk - D:\Program Files\Webshots\Launcher.exe [2008-05-03 01:25:06 157008]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveSearch"= 1 (0x1)
========================================================================

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:10, on 2008-08-01
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
D:\ProgramsNET\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\ctfmon.exe
D:\Program Files\Avast4\aswUpdSv.exe
D:\Program Files\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
D:\ProgramsNET\a-squared Anti-Malware\a2service.exe
C:\WINDOWS\system32\atiptaxx.exe
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\system32\ICO.EXE
C:\Program Files\Sony\10Key Utility\va10key.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe
C:\Program Files\Sony\Jog Dial Navigator\JogServ2.exe
C:\WINDOWS\System32\Ati2evxx.exe
D:\Program Files\ActiveSync\Wcescomm.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
D:\PROGRA~1\Pop-Up Stopper\PSFree.exe
D:\Program Files\Comodo\Firewall\cmdagent.exe
D:\Program Files\SpeedFan\speedfan.exe
D:\PROGRA~1\ActiveSync\rapimgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Apoint\Apntex.exe
C:\WINDOWS\system32\PSIService.exe
D:\Program Files\Webshots\webshots.scr
D:\Program Files\SpywareTerminator\sp_rsser.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sony\VAIO Media Music Server\SSSvr.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
D:\Program Files\Avast4\ashMaiSv.exe
D:\Program Files\Avast4\ashWebSv.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\NOTEPAD.EXE
D:\Program Files\Comodo\Firewall\cfp.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Program Files\Internet Explorer\iexplore.exe
D:\Program Files\Avast4\setup\avast.setup
D:\ProgramsNET\HijackThis\HijackThis.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=ZillaPopupKiller:8100
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local;*.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - D:\Program Files\SnagIt 8\SnagItBHO.dll
O2 - BHO: &Yahoo;! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - D:\Program Files\rpbrowserrecordplugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D; IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\Spybot S & D\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\avgtoolbar.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - D:\ProgramsNET\Spyware Doctor\tools\iesdpb.dll
O2 - BHO: CutePDF Form Filler - {D41289F2-69C6-417B-897E-C653D677CBAF} - D:\ProgramsNET\CutePDF Pro\CPFillerCo.dll
O2 - BHO: PicLens plug-in for Internet Explorer - {EAEE5C74-6D0D-4aca-9232-0DA4A7B866BA} - C:\Program Files\PicLensIE\PicLens.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O3 - Toolbar: Webshots Toolbar - {C17590D2-ECB4-4b15-8820-F58798DCC118} - (no file)
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\avgtoolbar.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - D:\Program Files\SnagIt 8\SnagItIEAddin.dll
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [va10key] C:\Program Files\Sony\10Key Utility\va10key.exe
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [COMODO Firewall Pro] "D:\Program Files\Comodo\Firewall\cfp.exe" -h
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\system32\ezSP_Px.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win
O4 - HKCU\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKCU\..\Run: [JOGSERV2.EXE] C:\Program Files\Sony\Jog Dial Navigator\JogServ2.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "D:\Program Files\ActiveSync\Wcescomm.exe"
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "D:\PROGRA~1\Pop-Up Stopper\PSFree.exe"
O4 - Startup: SpeedFan.lnk = D:\Program Files\SpeedFan\speedfan.exe
O4 - Startup: Webshots.lnk = D:\Program Files\Webshots\Launcher.exe
O8 - Extra context menu item: &Clean; Traces - D:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download; with &DAP; - D:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: &Webshots; Photo Search - res://D:\Program Files\Webshots\WSToolbar4IE.dll/MENUSEARCH.HTM
O8 - Extra context menu item: Download &all; with DAP - D:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://D:\PROGRA~1\Microsoft Office\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - D:\ProgramsNET\Spyware Doctor\tools\iesdpb.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - D:\PROGRA~1\ActiveSync\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - D:\PROGRA~1\ActiveSync\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - D:\PROGRA~1\ActiveSync\INetRepl.dll
O9 - Extra button: Launch PicLens - {3437D640-C91A-458f-89F5-B9095EA4C28B} - C:\Program Files\PicLensIE\PicLens.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\Microsoft Office\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\Spybot S & D\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\Spybot S & D\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1209754449894
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1209763554307
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\Skype4COM.dll
O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Emsi Software GmbH - D:\ProgramsNET\a-squared Anti-Malware\a2service.exe
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - D:\ProgramsNET\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Program Files\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - D:\Program Files\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - D:\Program Files\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - D:\Program Files\Avast4\ashWebSv.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Unknown owner - C:\Program Files\Bonjour\mDNSResponder.exe (file missing)
O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - Unknown owner - D:\Program Files\Comodo\Firewall\cmdagent.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Gbp Service (GbpSv) - Unknown owner - C:\PROGRA~1\GbPlugin\GbpSv.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - D:\Program Files\SpywareTerminator\sp_rsser.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: VAIO Media Music Server (Application) (VAIOMediaPlatform-MusicServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Music Server\SSSvr.exe

–
End of file - 12390 bytes