1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Possible Virus

Discussion in 'Malware and Virus Removal Archive' started by backer, 2008/02/11.

  1. 2008/02/11
    backer

    backer Inactive Thread Starter

    Joined:
    2007/01/10
    Messages:
    83
    Likes Received:
    0
    Hey everyone. I just redid my computer got rid of everything on the harddrive and reinstalled windows two weeks ago. But recently i will get lots of messages from Panda saying it had to block ADSM.SYS. Looked around on the internet and places said its a virus. But all the sites i go to are very sketchy and looks like if i download the program to "remove" it im sure it will infect it more.

    Other problem i am receiving
    My Panda Antivirus will **** out. It will randomly get an error under protection status with internet protection level control. And i reinstalled panda many times and it keeps happening. So leads me to thing it might have something to do with the virus i might have?

    Final thing.
    When the internet level protection control goes. I will most often have the sound of clicking through my speakers. As if i just opened an application. And it will continue for a while and go on little runs on and off. Weirdest thing was i even had the sound of something i didn't have open on my computer. Like all i had open was Microsoft office working on something then i would hear something coming through my speakers like it sounded as if it was a commercial. And another time when i was watching a movie different sound this time. (and no it was not the movie because i paused the movie while it was happening and it was still going)

    Any help i could get would be greatly appreciated.
     
    backer,
    #1
  2. 2008/02/12
    backer

    backer Inactive Thread Starter

    Joined:
    2007/01/10
    Messages:
    83
    Likes Received:
    0
    Anything?
     
    backer,
    #2


  3. to hide this advert.

  4. 2008/02/12
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi backer

    Please download and install HijackThis and Run a scan then close HJT, then run Deckard's System Scanner and post the main.txt log here. Links and instructions here.

    Thanks
    Geri
     
    Geri,
    #3
  5. 2008/02/13
    backer

    backer Inactive Thread Starter

    Joined:
    2007/01/10
    Messages:
    83
    Likes Received:
    0
    Here is the Hijack log.

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 12:49:42 AM, on 2/14/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16608)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\SYSTEM32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\TPSrv.exe
    C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\pavsrv51.exe
    C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\AVENGINE.EXE
    C:\WINDOWS\System32\wltrysvc.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\System32\bcmwltry.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\PsCtrls.EXE
    C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\PavFnSvr.exe
    C:\WINDOWS\system32\perfs.exe
    c:\program files\panda software\panda antivirus + firewall 2007\firewall\PSHOST.EXE
    C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\psimsvc.exe
    C:\WINDOWS\system32\routing.exe
    C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\ApvxdWin.exe
    C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    c:\program files\panda software\panda antivirus + firewall 2007\WebProxy.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\system32\andt.sys
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\iTunes\iTunes.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Documents and Settings\Steve\Desktop\HiJackThis_v2.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\distnoted.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceHelper.exe
    C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\psimreal.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe "
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
    O4 - Global Startup: Adobe Acrobat Synchronizer.lnk = C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe
    O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
    O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1201404758515
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Panda Software Controller - Panda Software International - C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\PsCtrls.EXE
    O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software International - C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\PavFnSvr.exe
    O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\pavsrv51.exe
    O23 - Service: perfmons Service (perfmons) - Unknown owner - C:\WINDOWS\system32\perfs.exe
    O23 - Service: Panda Host Service (PSHost) - Panda Software International - c:\program files\panda software\panda antivirus + firewall 2007\firewall\PSHOST.EXE
    O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software International - C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\psimsvc.exe
    O23 - Service: Routing Service (Routing) - Unknown owner - C:\WINDOWS\system32\routing.exe
    O23 - Service: Panda TPSrv (TPSrv) - Panda Software International - C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\TPSrv.exe
    O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe

    --
    End of file - 9294 bytes



    when i try and run DSS. i keep getting a message.

    "dss.ece has encountered a problem and needs to close. We are sorry for the inconvenience "
     
    backer,
    #4
  6. 2008/02/14
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi backer
    Please do this to see if dss will run.

    Download ATF Cleaner by Atribune and save it to your Desktop.
    This is a good tool to get rid of the temporary garbage you pick up while surfing the net.
    Double click ATF-Cleaner.exe to run the program.
    Check the boxes to the left of:

    Windows Temp
    Current User Temp
    All Users Temp
    Temporary Internet Files
    Prefetch
    Java Cache
    Recycle bin

    The rest are optional - if you want it to remove everything check "Select All ".
    Finally, click Empty Selected. When you get the "Done Cleaning" message, click OK.

    Now try to run dss again.


    Download ComboFix from [color= "Red"]Here[/color] to your Desktop.
    It's best to disable realtime protection applications as they sometimes interfere with the tool. Check this link for any applicable programs you may have.
    • Close all open programs and windows
    • Double click combofix.exe and follow the prompts.
    • Vista users right click Combofix.exe and select Run As Administrator.
    • When finished, it shall produce a log for you. Post that log and a HiJackthis log in your next reply
    Note: Do not mouseclick combofix's window while its running. That may cause it to stall

    Please post the combofix log and the dss main txt log if it will run

    Thanks
    Geri
     
    Geri,
    #5
  7. 2008/02/15
    backer

    backer Inactive Thread Starter

    Joined:
    2007/01/10
    Messages:
    83
    Likes Received:
    0
    Deckard's System Scanner v20071014.68
    Run by Steve on 2008-02-16 00:56:16
    Computer is in Normal Mode.
    --------------------------------------------------------------------------------

    Total Physical Memory: 504 MiB (512 MiB recommended).


    -- HijackThis (run as Steve.exe) -----------------------------------------------

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 12:56:58 AM, on 2/16/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16608)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\SYSTEM32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\TPSrv.exe
    C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\pavsrv51.exe
    C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\AVENGINE.EXE
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\System32\wltrysvc.exe
    C:\WINDOWS\System32\bcmwltry.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\PsCtrls.EXE
    C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\PavFnSvr.exe
    C:\WINDOWS\system32\perfs.exe
    c:\program files\panda software\panda antivirus + firewall 2007\firewall\PSHOST.EXE
    C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\psimsvc.exe
    C:\WINDOWS\system32\routing.exe
    C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\system32\andt.sys
    C:\Documents and Settings\Steve\Desktop\dss.exe
    C:\PROGRA~1\TRENDM~1\HIJACK~1\Steve.exe
    C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\avciman.exe
    C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\psimreal.exe
    C:\WINDOWS\system32\wscntfy.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe "
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
    O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
    O4 - Global Startup: Adobe Acrobat Synchronizer.lnk = C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe
    O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
    O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1201404758515
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Panda Software Controller - Panda Software International - C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\PsCtrls.EXE
    O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software International - C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\PavFnSvr.exe
    O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\pavsrv51.exe
    O23 - Service: perfmons Service (perfmons) - Unknown owner - C:\WINDOWS\system32\perfs.exe
    O23 - Service: Panda Host Service (PSHost) - Panda Software International - c:\program files\panda software\panda antivirus + firewall 2007\firewall\PSHOST.EXE
    O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software International - C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\psimsvc.exe
    O23 - Service: Routing Service (Routing) - Unknown owner - C:\WINDOWS\system32\routing.exe
    O23 - Service: Panda TPSrv (TPSrv) - Panda Software International - C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\TPSrv.exe
    O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe

    --
    End of file - 8977 bytes

    -- Files created between 2008-01-16 and 2008-02-16 -----------------------------

    2008-02-14 15:28:12 0 d-------- C:\Documents and Settings\Steve\Application Data\DAEMON Tools
    2008-02-14 15:28:10 0 d-------- C:\Program Files\DAEMON Tools Lite
    2008-02-14 00:49:28 0 d-------- C:\Program Files\Trend Micro
    2008-02-11 21:48:01 716272 --a------ C:\WINDOWS\system32\drivers\sptd.sys
    2008-02-11 21:44:55 0 d-------- C:\Program Files\MagicISO
    2008-02-07 20:12:32 0 d-------- C:\Program Files\MagicDVDRipper
    2008-02-07 00:00:23 0 d-------- C:\Program Files\InterActual
    2008-02-06 23:47:24 0 d-------- C:\Program Files\PartyGaming
    2008-02-06 20:44:25 0 d-------- C:\Documents and Settings\All Users\Application Data\FLEXnet
    2008-02-06 00:22:18 0 d-------- C:\Documents an?
    2008-02-02 18:01:49 0 d-------- C:\Documents and Settings\Steve\Application Data\LimeWire
    2008-02-02 18:01:00 0 d-------- C:\Program Files\LimeWire
    2008-01-31 01:45:28 0 d-------- C:\Program Files\XP Codec Pack
    2008-01-31 01:34:11 0 d-------- C:\Documents and Settings\Steve\Application Data\WinRAR
    2008-01-31 00:43:44 1203 --a------ C:\WINDOWS\mozver.dat
    2008-01-31 00:12:11 0 d-------- C:\WINDOWS\pss
    2008-01-30 19:12:01 172868 --a------ C:\WINDOWS\system32\drivers\APPFCONT.DAT
    2008-01-30 19:11:50 0 d-------- C:\WINDOWS\system32\PAV
    2008-01-30 19:11:04 17792 --a------ C:\WINDOWS\system32\drivers\cpoint.sys <Not Verified; Panda Software; © Panda Software 2005>
    2008-01-29 23:11:47 0 d-------- C:\WINDOWS\system32\custom matrices
    2008-01-29 23:11:21 0 d-------- C:\WINDOWS\system32\QuickTime
    2008-01-29 22:57:39 0 d-------- C:\Documents and Settings\Steve\Application Data\DivX
    2008-01-29 22:24:56 0 d-------- C:\WINDOWS\Sun
    2008-01-29 22:24:55 0 d-------- C:\Documents and Settings\Steve\Application Data\Sun
    2008-01-29 20:34:30 0 d-------- C:\Documents and Settings\Steve\Application Data\Azureus
    2008-01-29 13:24:40 0 d-------- C:\Documents and Settings\LocalService\Application Data\Macromedia
    2008-01-29 13:23:00 0 d-------- C:\Documents and Settings\LocalService\Application Data\Adobe
    2008-01-28 15:24:46 0 d-------- C:\Program Files\Windows Media Connect 2
    2008-01-28 15:22:03 0 d-------- C:\WINDOWS\system32\LogFiles
    2008-01-28 15:22:03 0 d-------- C:\WINDOWS\system32\drivers\UMDF
    2008-01-28 14:34:59 0 d-------- C:\Program Files\Azureus
    2008-01-28 14:34:07 281 --a------ C:\WINDOWS\system32\PavCPL.dat
    2008-01-28 14:30:28 31744 --a------ C:\WINDOWS\system32\routing.exe
    2008-01-28 14:30:25 45056 --a------ C:\WINDOWS\system32\Indt2.sys <Not Verified; b; d_i1s_c_o_8f3xdsc0f20f22x32fs1av_ea_r>
    2008-01-28 14:30:23 250368 --a------ C:\WINDOWS\system32\andt.sys
    2008-01-28 14:28:00 0 d-------- C:\Program Files\PowerISO
    2008-01-28 14:27:12 0 d-------- C:\Program Files\Power ISO & serial
    2008-01-28 14:17:50 0 d-------- C:\Program Files\Java
    2008-01-28 14:16:48 0 d-------- C:\Program Files\Common Files\Java
    2008-01-28 14:13:17 0 d-------- C:\Program Files\DivX
    2008-01-28 14:04:33 0 d-------- C:\Program Files\mIRC
    2008-01-28 14:04:33 0 d-------- C:\Documents and Settings\Steve\Application Data\mIRC
    2008-01-28 13:33:20 0 d-------- C:\Program Files\Adobe Premiere Pro CS3
    2008-01-27 20:27:16 0 d-------- C:\Documents and Settings\All Users\Application Data\Adobe
    2008-01-27 20:12:59 0 d-------- C:\Program Files\Common Files\Macrovision Shared
    2008-01-27 20:05:37 0 d-------- C:\Program Files\Photoshop CS3
    2008-01-27 19:22:03 0 d-------- C:\Program Files\Common Files\Adobe
    2008-01-27 19:17:46 0 d-------- C:\Program Files\Microsoft Works
    2008-01-27 19:17:35 0 d-------- C:\Program Files\MSBuild
    2008-01-27 19:12:52 0 d-------- C:\WINDOWS\SHELLNEW
    2008-01-27 19:06:44 0 d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help
    2008-01-27 19:04:43 0 dr-h----- C:\MSOCache
    2008-01-27 18:56:28 0 d-------- C:\Documents and Settings\Steve\Contacts
    2008-01-27 18:55:37 0 d-------- C:\Program Files\Windows Live Toolbar
    2008-01-27 18:49:38 0 d--hs--c- C:\Program Files\Common Files\WindowsLiveInstaller
    2008-01-27 18:49:16 0 d-------- C:\Program Files\Windows Live
    2008-01-27 18:49:07 0 d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
    2008-01-27 18:45:51 0 d-------- C:\Documents and Settings\Steve\Application Data\Macromedia
    2008-01-27 18:45:51 0 d-------- C:\Documents and Settings\Steve\Application Data\Adobe
    2008-01-27 18:42:58 0 d-------- C:\Documents and Settings\Steve\Application Data\Apple Computer
    2008-01-27 18:42:26 0 d-------- C:\Program Files\iPod
    2008-01-27 18:42:11 0 d-------- C:\Program Files\iTunes
    2008-01-27 18:41:53 0 d-------- C:\Program Files\Bonjour
    2008-01-27 18:41:02 0 d-------- C:\Program Files\QuickTime
    2008-01-27 18:40:59 0 d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
    2008-01-27 18:40:35 0 d-------- C:\Program Files\Apple Software Update
    2008-01-27 18:40:26 0 d------c- C:\WINDOWS\system32\DRVSTORE
    2008-01-27 18:39:59 0 d-------- C:\Program Files\Common Files\Apple
    2008-01-27 18:39:58 0 d-------- C:\Documents and Settings\All Users\Application Data\Apple
    2008-01-27 16:38:19 0 --a------ C:\WINDOWS\nsreg.dat
    2008-01-27 16:38:15 0 d-------- C:\Documents and Settings\Steve\Application Data\Mozilla
    2008-01-27 16:35:32 48 --a------ C:\WINDOWS\system32\drivers\wnmsav.dat
    2008-01-27 16:18:39 37 --a------ C:\WINDOWS\r007
    2008-01-27 16:16:21 101888 --a------ C:\WINDOWS\system32\SYSTOOLS.DLL <Not Verified; Panda Software; SYSTOOLS>
    2008-01-27 16:15:37 0 d-------- C:\Program Files\Panda Software
    2008-01-27 16:14:54 26752 -ra------ C:\WINDOWS\system32\drivers\ShldDrv.sys <Not Verified; Panda Software; Panda®Shield>
    2008-01-27 16:14:54 165120 -ra------ C:\WINDOWS\system32\drivers\PavProc.sys <Not Verified; Panda Software; PandaShield>
    2008-01-27 16:14:54 0 d-------- C:\Program Files\Common Files\Panda Software
    2008-01-27 00:59:35 0 d-------- C:\WINDOWS\network diagnostic
    2008-01-26 22:47:05 0 d-------- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
    2008-01-26 22:39:47 0 d-------- C:\WINDOWS\system32\PreInstall
    2008-01-26 22:39:45 0 d--h----- C:\WINDOWS\$hf_mig$
    2008-01-26 22:33:05 0 d-------- C:\WINDOWS\system32\SoftwareDistribution
    2008-01-26 22:31:29 0 d--hs---- C:\Documents and Settings\Steve\UserData
    2008-01-26 22:07:37 65536 -----n--- C:\WINDOWS\system32\WLTRYSVC.EXE
    2008-01-26 22:07:37 17801 --a------ C:\WINDOWS\system32\drivers\AegisP.sys <Not Verified; Meetinghouse Data Communications; AEGIS Client 3.2.0.3>
    2008-01-26 22:07:37 192512 -----n--- C:\WINDOWS\system32\AegisI5.exe <Not Verified; ; AegisInstall Application>
    2008-01-26 22:07:36 696425 -----n--- C:\WINDOWS\system32\WLTRAY.EXE <Not Verified; Dell Inc; Dell Wireless WLAN Card Wireless Network Tray Applet>
    2008-01-26 22:07:36 872556 -----n--- C:\WINDOWS\system32\BCMWLTRY.EXE <Not Verified; Dell Inc; Dell Wireless WLAN Card Wireless Network Controller>
    2008-01-26 22:07:36 1396831 -----n--- C:\WINDOWS\system32\AegisE5.dll <Not Verified; Meetinghouse Data Communications; AEGIS Client API>
    2008-01-26 22:07:28 204800 -----n--- C:\WINDOWS\system32\BCMWLU00.EXE <Not Verified; Dell Inc; Dell Wireless WLAN Card Uninstaller>
    2008-01-26 22:07:28 69632 -----n--- C:\WINDOWS\system32\BCMWLD2K.EXE <Not Verified; Dell Inc; Dell Wireless WLAN Card Installation Manager>
    2008-01-26 22:05:52 0 d-------- C:\Program Files\Synaptics
    2008-01-26 22:05:01 0 d-------- C:\Program Files\CONEXANT
    2008-01-26 22:04:04 0 d-------- C:\Program Files\Intel
    2008-01-26 22:03:29 0 d-------- C:\WINDOWS\system32\ReinstallBackups
    2008-01-26 22:02:14 0 d-------- C:\Program Files\SigmaTel
    2008-01-26 21:57:26 176128 --a------ C:\WINDOWS\system32\RcdScan.dll <Not Verified; Dell Computer Corporation; RcdScan Module>
    2008-01-26 21:57:26 446464 -ra------ C:\WINDOWS\system32\hhactivex.dll <Not Verified; Blue Sky Software Corporation.; RoboHELP HTML 2000>
    2008-01-26 21:57:23 0 d--h----- C:\Program Files\InstallShield Installation Information
    2008-01-26 21:57:22 13632 -----n--- C:\WINDOWS\system32\drivers\omci.sys <Not Verified; Dell Computer Corporation; OMCI Driver>
    2008-01-26 21:57:15 0 d-------- C:\Program Files\Common Files\InstallShield
    2008-01-26 21:55:22 0 d-------- C:\Documents and Settings\Steve\Application Data\Identities
    2008-01-26 21:55:13 0 d--h----- C:\Documents and Settings\Steve\Templates
    2008-01-26 21:55:13 0 dr------- C:\Documents and Settings\Steve\Start Menu
    2008-01-26 21:55:13 0 dr-h----- C:\Documents and Settings\Steve\SendTo
    2008-01-26 21:55:13 0 dr-h----- C:\Documents and Settings\Steve\Recent
    2008-01-26 21:55:13 0 d--h----- C:\Documents and Settings\Steve\PrintHood
    2008-01-26 21:55:13 2359296 --ah----- C:\Documents and Settings\Steve\NTUSER.DAT
    2008-01-26 21:55:13 0 d--h----- C:\Documents and Settings\Steve\NetHood
    2008-01-26 21:55:13 0 dr------- C:\Documents and Settings\Steve\My Documents
    2008-01-26 21:55:13 0 d--h----- C:\Documents and Settings\Steve\Local Settings
    2008-01-26 21:55:13 0 dr------- C:\Documents and Settings\Steve\Favorites
    2008-01-26 21:55:13 0 d-------- C:\Documents and Settings\Steve\Desktop
    2008-01-26 21:55:13 0 d--hs---- C:\Documents and Settings\Steve\Cookies
    2008-01-26 21:55:13 0 d--h----- C:\Documents and Settings\Steve\Application Data
    2008-01-26 21:54:06 0 d-------- C:\WINDOWS\SoftwareDistribution
    2008-01-26 21:54:05 0 d-------- C:\WINDOWS\Prefetch
    2008-01-26 21:53:59 0 d---s---- C:\WINDOWS\system32\Microsoft
    2008-01-26 21:53:58 262144 --ah----- C:\Documents and Settings\LocalService\NTUSER.DAT
    2008-01-26 21:53:58 0 d--h----- C:\Documents and Settings\LocalService\Local Settings
    2008-01-26 21:53:58 0 d--hs---- C:\Documents and Settings\LocalService\Cookies
    2008-01-26 21:53:58 0 d-------- C:\Documents and Settings\LocalService\Application Data
    2008-01-26 21:53:58 0 d---s---- C:\Documents and Settings\LocalService\Application Data\Microsoft
    2008-01-26 21:53:05 225280 --ah----- C:\Documents and Settings\NetworkService\NTUSER.DAT
    2008-01-26 21:53:05 0 d--h----- C:\Documents and Settings\NetworkService\Local Settings
    2008-01-26 21:53:05 0 d--hs---- C:\Documents and Settings\NetworkService\Cookies
    2008-01-26 21:53:05 0 d-------- C:\Documents and Settings\NetworkService\Application Data
    2008-01-26 21:53:05 0 d---s---- C:\Documents and Settings\NetworkService\Application Data\Microsoft
    2008-01-26 21:49:59 0 d-------- C:\WINDOWS\system32\xircom
    2008-01-26 21:49:59 0 d-------- C:\Program Files\microsoft frontpage
    2008-01-26 21:49:56 225280 ---h----- C:\Documents and Settings\Default User\NTUSER.DAT
    2008-01-26 21:49:56 0 d-------- C:\DELL
    2008-01-26 21:49:41 0 -rahs---- C:\MSDOS.SYS
    2008-01-26 21:49:41 0 -rahs---- C:\IO.SYS
    2008-01-26 21:49:41 0 --a------ C:\CONFIG.SYS
    2008-01-26 21:49:41 0 --a------ C:\AUTOEXEC.BAT
    2008-01-26 21:48:32 0 d--hs---- C:\Documents and Settings\All Users\DRM
    2008-01-26 21:48:20 0 dr------- C:\WINDOWS\Offline Web Pages
    2008-01-26 21:48:20 0 d---s---- C:\WINDOWS\Downloaded Program Files
    2008-01-26 21:48:09 0 d--h----- C:\Program Files\WindowsUpdate
    2008-01-26 21:47:46 0 d-------- C:\WINDOWS\system32\DirectX
    2008-01-26 21:47:11 0 d---s---- C:\WINDOWS\Tasks
    2008-01-26 21:47:10 0 d-------- C:\Program Files\Common Files\MSSoap
    2008-01-26 21:47:06 0 d-------- C:\WINDOWS\srchasst
    2008-01-26 21:47:05 0 d-------- C:\WINDOWS\system32\Macromed
    2008-01-26 21:46:56 0 d-------- C:\Program Files\Movie Maker
    2008-01-26 21:46:47 0 d-------- C:\WINDOWS\system32\Restore
    2008-01-26 21:46:24 21640 --a------ C:\WINDOWS\system32\emptyregdb.dat
    2008-01-26 21:46:04 0 d-------- C:\WINDOWS\Registration
    2008-01-26 21:45:33 0 d-------- C:\Program Files\Online Services
    2008-01-26 21:45:27 0 d-------- C:\Program Files\Messenger
    2008-01-26 21:45:23 0 d-------- C:\Program Files\MSN Gaming Zone
    2008-01-26 21:44:41 0 d-------- C:\Program Files\Windows NT
    2008-01-26 21:44:38 0 d-------- C:\WINDOWS\system32\MsDtc
    2008-01-26 21:44:36 0 d-------- C:\WINDOWS\system32\Com
    2008-01-26 16:39:22 0 d--hs---- C:\WINDOWS\Installer
    2008-01-26 16:39:21 0 d-------- C:\Program Files\Common Files\ODBC
    2008-01-26 16:39:17 0 dr------- C:\Program Files
    2008-01-26 16:39:17 0 d-------- C:\Program Files\Common Files
    2008-01-26 16:39:17 0 d-------- C:\Program Files\Common Files\SpeechEngines
    2008-01-26 16:38:51 0 d--h----- C:\Documents and Settings\Default User\Templates
    2008-01-26 16:38:51 0 dr------- C:\Documents and Settings\Default User\Start Menu
    2008-01-26 16:38:51 0 dr-h----- C:\Documents and Settings\Default User\SendTo
    2008-01-26 16:38:51 0 d--h----- C:\Documents and Settings\Default User\Recent
    2008-01-26 16:38:51 0 d--h----- C:\Documents and Settings\Default User\PrintHood
    2008-01-26 16:38:51 0 d--h----- C:\Documents and Settings\Default User\NetHood
    2008-01-26 16:38:51 0 d-------- C:\Documents and Settings\Default User\My Documents
    2008-01-26 16:38:51 0 dr-h----- C:\Documents and Settings\Default User\Local Settings
    2008-01-26 16:38:51 0 d-------- C:\Documents and Settings\Default User\Favorites
    2008-01-26 16:38:51 0 d-------- C:\Documents and Settings\Default User\Desktop
    2008-01-26 16:38:51 0 d---s---- C:\Documents and Settings\Default User\Cookies
    2008-01-26 16:38:51 0 d--h----- C:\Documents and Settings\All Users\Templates
    2008-01-26 16:38:51 0 dr------- C:\Documents and Settings\All Users\Start Menu
    2008-01-26 16:38:51 0 d-------- C:\Documents and Settings\All Users\Favorites
    2008-01-26 16:38:51 0 dr------- C:\Documents and Settings\All Users\Documents
    2008-01-26 16:38:51 0 d-------- C:\Documents and Settings\All Users\Desktop
    2008-01-26 16:38:37 0 d-------- C:\WINDOWS\system32\CatRoot2
    2008-01-26 16:38:37 0 d-------- C:\WINDOWS\system32\CatRoot
    2008-01-26 16:38:32 0 dr-h----- C:\Documents and Settings\Default User\Application Data
    2008-01-26 16:38:32 0 d---s---- C:\Documents and Settings\Default User\Application Data\Microsoft
    2008-01-26 16:38:31 0 dr-h----- C:\Documents and Settings\All Users\Application Data
    2008-01-26 16:38:31 0 d---s---- C:\Documents and Settings\All Users\Application Data\Microsoft
    2008-01-26 16:38:06 0 d--hs---- C:\System Volume Information
    2008-01-26 16:38:06 0 d-------- C:\Documents and Settings
    2008-01-26 16:29:58 0 d-------- C:\WINDOWS
    2008-01-26 16:29:58 0 d-------- C:\WINDOWS\WinSxS
    2008-01-26 16:29:58 0 dr------- C:\WINDOWS\Web
    2008-01-26 16:29:58 0 d-------- C:\WINDOWS\twain_32
    2008-01-26 16:29:58 0 d-------- C:\WINDOWS\system32
    2008-01-26 16:29:58 0 d-------- C:\WINDOWS\system32\wins
    2008-01-26 16:29:58 0 d-------- C:\WINDOWS\system32\wbem
    2008-01-26 16:29:58 0 d-------- C:\WINDOWS\system32\usmt
    2008-01-26 16:29:58 0 d-------- C:\WINDOWS\system32\spool
    2008-01-26 16:29:58 0 d-------- C:\WINDOWS\system32\ShellExt
    2008-01-26 16:29:58 0 d-------- C:\WINDOWS\system32\Setup
    2008-01-26 16:29:58 0 d-------- C:\WINDOWS\system32\ras
    2008-01-26 16:29:58 0 d-------- C:\WINDOWS\system32\oobe
    2008-01-26 16:29:58 0 d-------- C:\WINDOWS\system32\npp
    2008-01-26 16:29:58 0 d-------- C:\WINDOWS\system32\mui
    2008-01-26 16:29:58 0 d-------- C:\WINDOWS\system32\inetsrv
    2008-01-26 16:29:58 0 d-------- C:\WINDOWS\system32\IME
    2008-01-26 16:29:58 0 d-------- C:\WINDOWS\system32\icsxml
    2008-01-26 16:29:58 0 d-------- C:\WINDOWS\system32\ias
    2008-01-26 16:29:58 0 d-------- C:\WINDOWS\system32\export
    2008-01-26 16:29:58 0 d-------- C:\WINDOWS\system32\drivers
    2008-01-26 16:29:58 0 d-------- C:\WINDOWS\system32\drivers\etc
    2008-01-26 16:29:58 0 d-------- C:\WINDOWS\system32\drivers\disdn
    2008-01-26 16:29:58 0 dr-hs--c- C:\WINDOWS\system32\dllcache
    2008-01-26 16:29:58 0 d-------- C:\WINDOWS\system32\dhcp
    2008-01-26 16:29:58 0 d-------- C:\WINDOWS\system32\config
    2008-01-26 16:29:58 0 d-------- C:\WINDOWS\system32\3com_dmi
    2008-01-26 16:29:58 0 d-------- C:\WINDOWS\system32\3076
    2008-01-26 16:29:58 0 d-------- C:\WINDOWS\system32\2052
    2008-01-26 16:29:58 0 d-------- C:\WINDOWS\system32\1054
    2008-01-26 16:29:58 0 d-------- C:\WINDOWS\system32\1042
    2008-01-26 16:29:58 0 d-------- C:\WINDOWS\system32\1041
    2008-01-26 16:29:58 0 d-------- C:\WINDOWS\system32\1037
    2008-01-26 16:29:58 0 d-------- C:\WINDOWS\system32\1033
    2008-01-26 16:29:58 0 d-------- C:\WINDOWS\system32\1031
    2008-01-26 16:29:58 0 d-------- C:\WINDOWS\system32\1028
    2008-01-26 16:29:58 0 d-------- C:\WINDOWS\system32\1025
    2008-01-26 16:29:58 0 d-------- C:\WINDOWS\system
    2008-01-26 16:29:58 0 d-------- C:\WINDOWS\security
    2008-01-26 16:29:58 0 d-------- C:\WINDOWS\Resources
    2008-01-26 16:29:58 0 d-------- C:\WINDOWS\repair
    2008-01-26 16:29:58 0 d-------- C:\WINDOWS\Provisioning
    2008-01-26 16:29:58 0 d-------- C:\WINDOWS\PeerNet
    2008-01-26 16:29:58 0 d-------- C:\WINDOWS\pchealth
    2008-01-26 16:29:58 0 d-------- C:\WINDOWS\mui
    2008-01-26 16:29:58 0 d-------- C:\WINDOWS\msapps
    2008-01-26 16:29:58 0 d-------- C:\WINDOWS\msagent
    2008-01-26 16:29:58 0 d-------- C:\WINDOWS\Media
    2008-01-26 16:29:58 0 d-------- C:\WINDOWS\java
    2008-01-26 16:29:58 0 d--h----- C:\WINDOWS\inf
    2008-01-26 16:29:58 0 d-------- C:\WINDOWS\ime
    2008-01-26 16:29:58 0 d-------- C:\WINDOWS\Help
    2008-01-26 16:29:58 0 dr--s---- C:\WINDOWS\Fonts
    2008-01-26 16:29:58 0 d-------- C:\WINDOWS\Driver Cache
    2008-01-26 16:29:58 0 d-------- C:\WINDOWS\dell
    2008-01-26 16:29:58 0 d-------- C:\WINDOWS\Debug
    2008-01-26 16:29:58 0 d-------- C:\WINDOWS\Cursors
    2008-01-26 16:29:58 0 d-------- C:\WINDOWS\Connection Wizard
    2008-01-26 16:29:58 0 d-------- C:\WINDOWS\Config
    2008-01-26 16:29:58 0 d-------- C:\WINDOWS\AppPatch
    2008-01-26 16:29:58 0 d-------- C:\WINDOWS\addins
    2008-01-20 16:26:46 204800 --a------ C:\WINDOWS\system32\TomsMoComp_ff.dll
    2008-01-20 16:26:46 204800 --a------ C:\WINDOWS\system32\ff_kernelDeint.dll
    2008-01-20 16:21:06 662016 --a------ C:\WINDOWS\system32\xvidcore.dll
    2008-01-20 16:21:04 114688 --a------ C:\WINDOWS\system32\libmpeg2_ff.dll
    2008-01-20 16:21:04 8192 --a------ C:\WINDOWS\system32\FLT_ffdshow.dll
    2008-01-20 16:21:04 38400 --a------ C:\WINDOWS\system32\ff_unrar.dll
    2008-01-20 16:21:04 81408 --a------ C:\WINDOWS\system32\ff_tremor.dll
    2008-01-20 16:21:04 122880 --a------ C:\WINDOWS\system32\ff_samplerate.dll
    2008-01-20 16:21:04 97280 --a------ C:\WINDOWS\system32\ff_realaac.dll
    2008-01-20 16:21:04 118784 --a------ C:\WINDOWS\system32\ff_libmad.dll
    2008-01-20 16:21:04 245760 --a------ C:\WINDOWS\system32\ff_libfaad2.dll
    2008-01-20 16:21:04 155648 --a------ C:\WINDOWS\system32\ff_libdts.dll
    2008-01-20 16:21:04 40960 --a------ C:\WINDOWS\system32\ff_liba52.dll
    2008-01-20 16:07:00 7680 --a------ C:\WINDOWS\system32\ff_vfw.dll


    -- Find3M Report ---------------------------------------------------------------

    2008-01-26 16:38:51 62 --ahs---- C:\Documents and Settings\Steve\Application Data\desktop.ini
    2008-01-04 16:58:50 3596288 --a------ C:\WINDOWS\system32\qt-dx331.dll
    2008-01-04 16:57:22 196608 --a------ C:\WINDOWS\system32\dtu100.dll <Not Verified; DivX, Inc.; DivX, Inc. dtu100>
    2008-01-04 16:57:22 81920 --a------ C:\WINDOWS\system32\dpl100.dll <Not Verified; DivX, Inc.; DivX, Inc. dpl100>
    2008-01-04 16:57:12 823296 --a------ C:\WINDOWS\system32\divx_xx07.dll <Not Verified; DivX, Inc.; DivX®>
    2008-01-04 16:57:10 802816 --a------ C:\WINDOWS\system32\divx_xx11.dll <Not Verified; DivX, Inc.; DivX?>
    2008-01-04 16:57:10 823296 --a------ C:\WINDOWS\system32\divx_xx0c.dll <Not Verified; DivX, Inc.; DivX®>
    2008-01-04 16:57:10 682496 --a------ C:\WINDOWS\system32\DivX.dll <Not Verified; DivX, Inc.; DivX®>
    2008-01-04 16:56:24 12288 --a------ C:\WINDOWS\system32\DivXWMPExtType.dll
    2007-12-31 19:00:00 741376 --a------ C:\WINDOWS\system32\audxlib.dll
    2007-12-28 19:04:02 159744 --a------ C:\WINDOWS\system32\mmfinfo.dll
    2007-12-28 19:04:00 245248 --a------ C:\WINDOWS\system32\dxr.dll
    2007-12-28 19:03:56 102400 --a------ C:\WINDOWS\system32\avss.dll
    2007-12-28 19:03:48 163840 --a------ C:\WINDOWS\system32\ts.dll
    2007-12-28 19:03:48 148480 --a------ C:\WINDOWS\system32\mkx.dll
    2007-12-28 19:03:48 335872 --a------ C:\WINDOWS\system32\gdsmux.exe
    2007-12-28 19:03:46 141312 --a------ C:\WINDOWS\system32\mp4.dll
    2007-12-28 19:03:46 108032 --a------ C:\WINDOWS\system32\avi.dll
    2007-12-28 19:03:40 120832 --a------ C:\WINDOWS\system32\ogm.dll
    2007-12-28 19:03:38 135168 --a------ C:\WINDOWS\system32\mkv2vfr.exe
    2007-12-28 19:03:38 103424 --a------ C:\WINDOWS\system32\dsmux.exe
    2007-12-28 19:03:38 97280 --a------ C:\WINDOWS\system32\avs.dll
    2007-12-28 19:03:34 79360 --a------ C:\WINDOWS\system32\mkzlib.dll
    2007-12-28 19:03:34 23552 --a------ C:\WINDOWS\system32\mkunicode.dll


    -- Registry Dump ---------------------------------------------------------------

    *Note* empty entries & legit default entries are not shown


    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "QuickTime Task "= "C:\Program Files\QuickTime\qttask.exe" [01/10/2008 03:27 PM]
    "Acrobat Assistant 8.0 "= "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [10/22/2006 11:24 PM]
    "@ "=" " []

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 07:00 AM]
    "msnmsgr "= "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [10/18/2007 11:34 AM]
    "DAEMON Tools Lite "= "C:\Program Files\DAEMON Tools Lite\daemon.exe" [01/17/2008 11:51 AM]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-F400-7760-000000000003}\_SC_Acrobat.exe [2/10/2008 7:21:14 PM]
    Adobe Acrobat Synchronizer.lnk - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe [10/23/2006 12:01:50 AM]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avldr]
    avldr.dll 09/21/2007 11:33 AM 50736 C:\WINDOWS\system32\avldr.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APVXDWIN]
    "C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\APVXDWIN.EXE" /s

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
    C:\WINDOWS\system32\ctfmon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell Wireless Manager UI]
    C:\WINDOWS\system32\WLTRAY

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
    "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe "

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
    C:\WINDOWS\system32\hkcmd.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
    C:\WINDOWS\system32\igfxtray.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
    "C:\Program Files\iTunes\iTunesHelper.exe "

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
    "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
    "C:\Program Files\QuickTime\qttask.exe" -atboottime

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
    "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe "

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPLpr]
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe




    -- End of Deckard's System Scanner: finished at 2008-02-16 00:57:47 ------------
     
    backer,
    #6
  8. 2008/02/16
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi

    The Combofix log?

    Having any p2p file sharing apps such as Limewire, BitTorrent uTorrent, Azureus etc.. is almost like inviting malware into your computer. There is absolutely no way for you to know which of the hundreds of thousands of users you are sharing files with are infected or not.
    I strongly recommend removing any P2P applications.

    Thanks
    Geri
     
    Geri,
    #7
  9. 2008/02/17
    backer

    backer Inactive Thread Starter

    Joined:
    2007/01/10
    Messages:
    83
    Likes Received:
    0
    combofix log

    ComboFix 08-02-17.2 - Steve 2008-02-17 12:22:40.2 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.168 [GMT -5:00]
    Running from: C:\Documents and Settings\Steve\Desktop\ComboFix.exe

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    ((((((((((((((((((((((((( Files Created from 2008-01-17 to 2008-02-17 )))))))))))))))))))))))))))))))
    .

    2008-02-14 15:28 . 2008-02-14 15:28 <DIR> d-------- C:\Program Files\DAEMON Tools Lite
    2008-02-14 15:28 . 2008-02-14 15:28 <DIR> d-------- C:\Documents and Settings\Steve\Application Data\DAEMON Tools
    2008-02-14 00:51 . 2008-02-14 00:51 <DIR> d-------- C:\Deckard
    2008-02-14 00:49 . 2008-02-14 00:49 <DIR> d-------- C:\Program Files\Trend Micro
    2008-02-11 21:48 . 2008-02-11 21:48 716,272 --a------ C:\WINDOWS\system32\drivers\sptd.sys
    2008-02-11 21:44 . 2008-02-11 21:45 <DIR> d-------- C:\Program Files\MagicISO
    2008-02-07 20:12 . 2008-02-07 20:12 <DIR> d-------- C:\Program Files\MagicDVDRipper
    2008-02-07 00:03 . 2008-02-07 00:03 0 --a------ C:\WINDOWS\iplayer.INI
    2008-02-07 00:00 . 2008-02-07 00:01 <DIR> d-------- C:\Program Files\InterActual
    2008-02-06 23:47 . 2008-02-06 23:49 <DIR> d-------- C:\Program Files\PartyGaming
    2008-02-06 20:44 . 2008-02-06 20:44 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\FLEXnet
    2008-02-06 00:22 . 2008-02-06 00:22 <DIR> d-------- C:\Documents an?
    2008-02-02 18:01 . 2008-02-11 13:15 <DIR> d-------- C:\Documents and Settings\Steve\Application Data\LimeWire
    2008-01-31 16:45 . 2008-02-17 12:19 1,184 --a------ C:\WINDOWS\system32\drivers\APPFLTR.CFG.bck
    2008-01-31 16:44 . 2008-02-17 12:19 172,868 --a------ C:\WINDOWS\system32\drivers\APPFCONT.DAT.bck
    2008-01-31 01:45 . 2008-01-31 01:45 <DIR> d-------- C:\Program Files\XP Codec Pack
    2008-01-31 00:43 . 2008-01-31 00:43 1,203 --a------ C:\WINDOWS\mozver.dat
    2008-01-30 19:24 . 2003-03-18 20:14 499,712 --a------ C:\WINDOWS\system32\MSVCP71.DLL
    2008-01-30 19:24 . 2003-02-21 04:42 348,160 --a------ C:\WINDOWS\system32\MSVCR71.DLL
    2008-01-30 19:16 . 2007-09-21 11:33 71,680 --a------ C:\WINDOWS\system32\drivers\PAVDRV51.SYS
    2008-01-30 19:12 . 2008-02-17 12:19 172,868 --a------ C:\WINDOWS\system32\drivers\APPFCONT.DAT
    2008-01-30 19:12 . 2008-02-17 12:19 1,184 --a------ C:\WINDOWS\system32\drivers\APPFLTR.CFG
    2008-01-30 19:11 . 2008-02-17 00:46 <DIR> d-------- C:\WINDOWS\system32\PAV
    2008-01-30 19:11 . 2007-09-21 11:33 190,640 --a------ C:\WINDOWS\system32\drivers\idsflt.sys
    2008-01-30 19:11 . 2007-09-21 11:33 121,392 --a------ C:\WINDOWS\system32\drivers\netfltdi.sys
    2008-01-30 19:11 . 2007-09-21 11:33 71,608 --a------ C:\WINDOWS\system32\drivers\APPFLT.SYS
    2008-01-30 19:11 . 2007-09-21 11:33 49,968 --a------ C:\WINDOWS\system32\drivers\dsaflt.sys
    2008-01-30 19:11 . 2007-09-21 11:33 36,016 --a------ C:\WINDOWS\system32\drivers\smsflt.sys
    2008-01-30 19:11 . 2007-09-21 11:33 29,360 --a------ C:\WINDOWS\system32\drivers\wnmflt.sys
    2008-01-30 19:11 . 2007-09-21 11:33 17,792 --a------ C:\WINDOWS\system32\drivers\cpoint.sys
    2008-01-30 19:11 . 2007-09-21 11:33 15,792 --a------ C:\WINDOWS\system32\drivers\fnetmon.sys
    2008-01-29 23:11 . 2008-01-29 23:11 <DIR> d-------- C:\WINDOWS\system32\QuickTime
    2008-01-29 23:11 . 2008-01-29 23:11 <DIR> d-------- C:\WINDOWS\system32\custom matrices
    2008-01-29 23:04 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
    2008-01-29 23:04 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll
    2008-01-29 23:04 . 2007-07-30 19:19 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
    2008-01-29 22:57 . 2008-01-29 22:59 <DIR> d-------- C:\Documents and Settings\Steve\Application Data\DivX
    2008-01-29 22:45 . 2004-08-03 23:08 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys
    2008-01-29 22:24 . 2008-01-29 22:24 <DIR> d-------- C:\WINDOWS\Sun
    2008-01-29 20:34 . 2008-02-16 00:56 <DIR> d-------- C:\Documents and Settings\Steve\Application Data\Azureus
    2008-01-28 15:24 . 2008-01-28 15:24 <DIR> d-------- C:\Program Files\Windows Media Connect 2
    2008-01-28 15:22 . 2008-01-28 15:22 <DIR> d-------- C:\WINDOWS\system32\LogFiles
    2008-01-28 15:22 . 2008-01-28 15:23 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF
    2008-01-28 15:21 . 2004-08-04 07:00 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
    2008-01-28 14:34 . 2008-02-02 14:46 <DIR> d-------- C:\Program Files\Azureus
    2008-01-28 14:34 . 2008-01-31 15:50 54,832 --a------ C:\WINDOWS\system32\pavcpl.cpl
    2008-01-28 14:34 . 2008-01-31 15:52 281 --a------ C:\WINDOWS\system32\PavCPL.dat
    2008-01-28 14:33 . 2008-01-28 14:33 0 --------- C:\WINDOWS\PAVSHRB.INI
    2008-01-28 14:32 . 2008-01-31 15:50 142,128 --a------ C:\WINDOWS\system32\drivers\netimflt.sys
    2008-01-28 14:32 . 2008-01-28 14:32 1,990 --a------ C:\WINDOWS\system32\drivers\net_m32.inf
    2008-01-28 14:30 . 2008-01-28 14:30 250,368 --a------ C:\WINDOWS\system32\andt.sys
    2008-01-28 14:30 . 2008-02-05 00:01 45,056 --a------ C:\WINDOWS\system32\Indt2.sys
    2008-01-28 14:30 . 2008-01-28 14:30 31,744 --a------ C:\WINDOWS\system32\routing.exe
    2008-01-28 14:28 . 2008-01-31 15:48 <DIR> d-------- C:\Program Files\PowerISO
    2008-01-28 14:27 . 2008-01-28 14:27 <DIR> d-------- C:\Program Files\Power ISO & serial
    2008-01-28 14:18 . 2007-09-24 23:31 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
    2008-01-28 14:17 . 2008-01-28 14:18 <DIR> d-------- C:\Program Files\Java
    2008-01-28 14:16 . 2008-01-28 14:16 <DIR> d-------- C:\Program Files\Common Files\Java
    2008-01-28 14:13 . 2008-02-14 16:26 <DIR> d-------- C:\Program Files\DivX
    2008-01-28 14:04 . 2008-02-05 19:42 <DIR> d-------- C:\Program Files\mIRC
    2008-01-28 14:04 . 2008-02-05 19:45 <DIR> d-------- C:\Documents and Settings\Steve\Application Data\mIRC
    2008-01-28 13:33 . 2008-02-06 19:59 <DIR> d-------- C:\Program Files\Adobe Premiere Pro CS3
    2008-01-27 20:12 . 2008-01-27 20:12 <DIR> d-------- C:\Program Files\Common Files\Macrovision Shared
    2008-01-27 20:05 . 2008-01-27 20:10 <DIR> d-------- C:\Program Files\Photoshop CS3
    2008-01-27 19:22 . 2008-02-10 19:16 <DIR> d-------- C:\Program Files\Common Files\Adobe
    2008-01-27 19:19 . 2006-10-26 19:56 32,592 --a------ C:\WINDOWS\system32\msonpmon.dll
    2008-01-27 19:17 . 2008-01-27 19:17 <DIR> d-------- C:\Program Files\MSBuild
    2008-01-27 19:17 . 2008-01-27 19:17 <DIR> d-------- C:\Program Files\Microsoft Works
    2008-01-27 19:12 . 2008-01-27 19:17 <DIR> d-------- C:\WINDOWS\SHELLNEW
    2008-01-27 19:06 . 2008-02-14 01:25 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help
    2008-01-27 19:04 . 2008-01-27 19:04 <DIR> dr-h----- C:\MSOCache
    2008-01-27 18:56 . 2008-01-28 12:28 <DIR> d-------- C:\Documents and Settings\Steve\Contacts
    2008-01-27 18:55 . 2008-01-28 14:47 <DIR> d-------- C:\Program Files\Windows Live Toolbar
    2008-01-27 18:49 . 2008-01-27 18:54 <DIR> d-------- C:\Program Files\Windows Live
    2008-01-27 18:49 . 2008-01-27 18:54 <DIR> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller
    2008-01-27 18:49 . 2008-01-27 18:49 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
    2008-01-27 18:42 . 2008-01-31 15:48 <DIR> d-------- C:\Program Files\iTunes
    2008-01-27 18:42 . 2008-01-27 18:42 <DIR> d-------- C:\Program Files\iPod
    2008-01-27 18:42 . 2008-01-27 18:42 <DIR> d-------- C:\Documents and Settings\Steve\Application Data\Apple Computer
    2008-01-27 18:41 . 2008-01-30 19:50 <DIR> d-------- C:\Program Files\QuickTime
    2008-01-27 18:41 . 2008-01-31 15:48 <DIR> d-------- C:\Program Files\Bonjour
    2008-01-27 18:40 . 2008-01-27 18:54 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
    2008-01-27 18:40 . 2008-01-27 18:40 <DIR> d-------- C:\Program Files\Apple Software Update
    2008-01-27 18:40 . 2008-01-27 18:42 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
    2008-01-27 18:39 . 2008-01-27 18:39 <DIR> d-------- C:\Program Files\Common Files\Apple
    2008-01-27 18:39 . 2008-01-27 18:39 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple
    2008-01-27 16:38 . 2008-01-27 16:38 0 --a------ C:\WINDOWS\nsreg.dat
    2008-01-27 16:35 . 2008-01-30 20:22 48 --a------ C:\WINDOWS\system32\drivers\wnmsav.dat
    2008-01-27 16:18 . 2008-01-30 19:30 37 --a------ C:\WINDOWS\r007
    2008-01-27 16:16 . 2008-01-31 15:50 292,400 --a------ C:\WINDOWS\system32\PavSHook.dll
    2008-01-27 16:16 . 2008-01-31 15:50 161,328 --a------ C:\WINDOWS\system32\TpUtil.dll
    2008-01-27 16:16 . 2006-06-27 19:36 101,888 --a------ C:\WINDOWS\system32\SYSTOOLS.DLL
    2008-01-27 16:16 . 2008-01-31 15:50 63,024 --a------ C:\WINDOWS\system32\pavipc.dll
    2008-01-27 16:16 . 2007-09-21 11:33 50,736 --a------ C:\WINDOWS\system32\avldr.dll
    2008-01-27 16:15 . 2008-01-27 16:15 <DIR> d-------- C:\Program Files\Panda Software
    2008-01-27 16:14 . 2008-01-27 16:14 <DIR> d-------- C:\Program Files\Common Files\Panda Software
    2008-01-27 16:14 . 2006-04-25 10:02 165,120 -ra------ C:\WINDOWS\system32\drivers\PavProc.sys
    2008-01-27 16:14 . 2005-08-29 07:23 26,752 -ra------ C:\WINDOWS\system32\drivers\ShldDrv.sys
    2008-01-26 22:39 . 2008-02-13 10:23 <DIR> d--h----- C:\WINDOWS\$hf_mig$
    2008-01-26 22:39 . 2006-09-25 17:58 23,856 --a------ C:\WINDOWS\system32\spupdsvc.exe

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-01-31 00:10 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-01-27 03:07 17,801 ----a-w C:\WINDOWS\system32\drivers\AegisP.sys
    2008-01-27 03:02 --------- d-----w C:\Program Files\Common Files\InstallShield
    2008-01-27 02:49 --------- d-----w C:\Program Files\microsoft frontpage
    2008-01-20 21:21 97,280 ----a-w C:\WINDOWS\system32\ff_realaac.dll
    2008-01-20 21:21 81,408 ----a-w C:\WINDOWS\system32\ff_tremor.dll
    2008-01-20 21:21 8,192 ----a-w C:\WINDOWS\system32\FLT_ffdshow.dll
    2008-01-20 21:21 662,016 ----a-w C:\WINDOWS\system32\xvidcore.dll
    2008-01-20 21:21 40,960 ----a-w C:\WINDOWS\system32\ff_liba52.dll
    2008-01-20 21:21 38,400 ----a-w C:\WINDOWS\system32\ff_unrar.dll
    2008-01-20 21:21 245,760 ----a-w C:\WINDOWS\system32\ff_libfaad2.dll
    2008-01-20 21:21 155,648 ----a-w C:\WINDOWS\system32\ff_libdts.dll
    2008-01-20 21:21 122,880 ----a-w C:\WINDOWS\system32\ff_samplerate.dll
    2008-01-20 21:21 118,784 ----a-w C:\WINDOWS\system32\ff_libmad.dll
    2008-01-20 21:21 114,688 ----a-w C:\WINDOWS\system32\libmpeg2_ff.dll
    2008-01-11 05:53 44,544 ----a-w C:\WINDOWS\system32\SET180.tmp
    2008-01-04 21:59 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
    2008-01-04 21:58 9,464 ------w C:\WINDOWS\system32\drivers\cdralw2k.sys
    2008-01-04 21:58 9,336 ------w C:\WINDOWS\system32\drivers\cdr4_xp.sys
    2008-01-04 21:58 43,528 ------w C:\WINDOWS\system32\drivers\PxHelp20.sys
    2008-01-04 21:58 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
    2008-01-04 21:58 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
    2008-01-04 21:58 129,784 ------w C:\WINDOWS\system32\pxafs.dll
    2008-01-04 21:58 120,056 ------w C:\WINDOWS\system32\pxcpyi64.exe
    2008-01-04 21:58 118,520 ------w C:\WINDOWS\system32\pxinsi64.exe
    2008-01-04 21:58 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
    2008-01-04 21:57 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
    2008-01-04 21:57 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
    2008-01-04 21:57 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
    2008-01-04 21:57 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
    2008-01-04 21:57 682,496 ----a-w C:\WINDOWS\system32\DivX.dll
    2008-01-04 21:57 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
    2008-01-04 21:57 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
    2008-01-04 21:57 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
    2008-01-04 21:57 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
    2008-01-04 21:57 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
    2008-01-04 21:57 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
    2008-01-04 21:57 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
    2008-01-04 21:56 156,992 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
    2008-01-04 21:56 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
    2008-01-01 00:00 741,376 ----a-w C:\WINDOWS\system32\audxlib.dll
    2007-12-29 00:04 245,248 ----a-w C:\WINDOWS\system32\dxr.dll
    2007-12-29 00:04 159,744 ----a-w C:\WINDOWS\system32\mmfinfo.dll
    2007-12-29 00:03 97,280 ----a-w C:\WINDOWS\system32\avs.dll
    2007-12-29 00:03 79,360 ----a-w C:\WINDOWS\system32\mkzlib.dll
    2007-12-29 00:03 335,872 ----a-w C:\WINDOWS\system32\gdsmux.exe
    2007-12-29 00:03 23,552 ----a-w C:\WINDOWS\system32\mkunicode.dll
    2007-12-29 00:03 163,840 ----a-w C:\WINDOWS\system32\ts.dll
    2007-12-29 00:03 148,480 ----a-w C:\WINDOWS\system32\mkx.dll
    2007-12-29 00:03 141,312 ----a-w C:\WINDOWS\system32\mp4.dll
    2007-12-29 00:03 135,168 ----a-w C:\WINDOWS\system32\mkv2vfr.exe
    2007-12-29 00:03 120,832 ----a-w C:\WINDOWS\system32\ogm.dll
    2007-12-29 00:03 108,032 ----a-w C:\WINDOWS\system32\avi.dll
    2007-12-29 00:03 103,424 ----a-w C:\WINDOWS\system32\dsmux.exe
    2007-12-29 00:03 102,400 ----a-w C:\WINDOWS\system32\avss.dll
    2007-12-18 09:51 179,584 ----a-w C:\WINDOWS\system32\drivers\mrxdav.sys
    2007-12-08 05:21 3,592,192 ----a-w C:\WINDOWS\system32\SET185.tmp
    2007-12-07 02:21 824,832 ----a-w C:\WINDOWS\system32\wininet.dll
    2007-12-07 02:21 824,832 ----a-w C:\WINDOWS\system32\SET17C.tmp
    2007-12-07 02:21 63,488 ----a-w C:\WINDOWS\system32\SET194.tmp
    2007-12-07 02:21 6,066,176 ----a-w C:\WINDOWS\system32\SET18D.tmp
    2007-12-07 02:21 52,224 ----a-w C:\WINDOWS\system32\SET186.tmp
    2007-12-07 02:21 478,208 ----a-w C:\WINDOWS\system32\SET184.tmp
    2007-12-07 02:21 459,264 ----a-w C:\WINDOWS\system32\SET187.tmp
    2007-12-07 02:21 383,488 ----a-w C:\WINDOWS\system32\SET18F.tmp
    2007-12-07 02:21 267,776 ----a-w C:\WINDOWS\system32\SET18B.tmp
    2007-12-07 02:21 124,928 ----a-w C:\WINDOWS\system32\SET197.tmp
    2007-12-07 02:21 105,984 ----a-w C:\WINDOWS\system32\SET17F.tmp
    2007-12-07 02:21 1,159,680 ----a-w C:\WINDOWS\system32\SET17E.tmp
    2007-12-04 18:38 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 07:00 15360]
    "msnmsgr "= "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184]
    "DAEMON Tools Lite "= "C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-01-17 11:51 486856]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "QuickTime Task "= "C:\Program Files\QuickTime\qttask.exe" [2008-01-10 15:27 385024]
    "Acrobat Assistant 8.0 "= "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2006-10-22 23:24 620152]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avldr]
    avldr.dll 2007-09-21 11:33 50736 C:\WINDOWS\system32\avldr.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APVXDWIN]
    --a------ 2007-09-21 11:33 329264 C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\APVXDWIN.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
    --a------ 2004-08-04 07:00 15360 C:\WINDOWS\system32\ctfmon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell Wireless Manager UI]
    C:\WINDOWS\system32\WLTRAY

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
    --a------ 2006-10-27 00:47 31016 C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
    --a------ 2004-11-02 16:59 126976 C:\WINDOWS\system32\hkcmd.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
    --a------ 2004-11-02 17:03 155648 C:\WINDOWS\system32\igfxtray.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
    --a------ 2008-01-15 03:22 267048 C:\Program Files\iTunes\iTunesHelper.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
    --a------ 2007-10-18 11:34 5724184 C:\Program Files\Windows Live\Messenger\MsnMsgr.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
    --a------ 2008-01-10 15:27 385024 C:\Program Files\QuickTime\qttask.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
    --a------ 2007-09-25 01:11 132496 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
    --a------ 2004-05-14 09:35 536576 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPLpr]
    --a------ 2004-05-13 19:23 98304 C:\Program Files\Synaptics\SynTP\SynTPLpr.exe

    R1 APPFLT;App Filter Plugin;C:\WINDOWS\system32\Drivers\APPFLT.SYS [2007-09-21 11:33]
    R1 DSAFLT;DSA Filter Plugin;C:\WINDOWS\system32\Drivers\DSAFLT.SYS [2007-09-21 11:33]
    R1 FNETMON;NetMon Filter Plugin;C:\WINDOWS\system32\Drivers\fnetmon.SYS [2007-09-21 11:33]
    R1 IDSFLT;Ids Filter Plugin;C:\WINDOWS\system32\Drivers\IDSFLT.SYS [2007-09-21 11:33]
    R1 NETFLTDI;Panda Net Driver [TDI Layer];C:\WINDOWS\system32\Drivers\NETFLTDI.SYS [2007-09-21 11:33]
    R1 SMSFLT;SMS Filter Plugin;C:\WINDOWS\system32\Drivers\SMSFLT.SYS [2007-09-21 11:33]
    R1 WNMFLT;Wifi Monitor Filter Plugin;C:\WINDOWS\system32\Drivers\WNMFLT.SYS [2007-09-21 11:33]
    R2 cpoint;cpoint;C:\WINDOWS\system32\drivers\cpoint.sys [2007-09-21 11:33]
    R2 perfmons;perfmons Service;C:\WINDOWS\system32\perfs.exe [2004-08-04 07:00]
    R2 Routing;Routing Service;C:\WINDOWS\system32\routing.exe [2008-01-28 14:30]
    R3 AvFlt;Antivirus Filter Driver;C:\WINDOWS\system32\drivers\av5flt.sys []
    R3 NETIMFLT;PANDA NDIS IM Filter Miniport;C:\WINDOWS\system32\DRIVERS\netimflt.sys [2008-01-31 15:50]
    R3 PavSRK.sys;PavSRK.sys;C:\WINDOWS\system32\PavSRK.sys []
    S3 PavTPK.sys;PavTPK.sys;C:\WINDOWS\system32\PavTPK.sys []

    .
    Contents of the 'Scheduled Tasks' folder
    "2008-02-15 03:09:28 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job "
    - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
    .
    **************************************************************************

    catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-02-17 12:25:55
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    PROCESS: C:\WINDOWS\explorer.exe [6.00.2900.3156]
    -> C:\WINDOWS\system32\mmfinfo.dll
    -> C:\WINDOWS\system32\mkunicode.dll
    .
    Completion time: 2008-02-17 12:26:47
    ComboFix2.txt 2008-02-17 17:14:06
    .
    2008-02-14 06:26:42 --- E O F ---
     
    backer,
    #8
  10. 2008/02/17
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi
    It looks like you run combofix 2 times, I need to see the first combofix log.

    It should be located in th C:\ QOOBox.


    Thanks
    Geri
     
    Geri,
    #9
  11. 2008/02/18
    backer

    backer Inactive Thread Starter

    Joined:
    2007/01/10
    Messages:
    83
    Likes Received:
    0
    i think this is the one.


    ComboFix 08-02-17.2 - Steve 2008-02-17 12:09:24.1 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.211 [GMT -5:00]
    Running from: C:\Documents and Settings\Steve\Desktop\ComboFix.exe
    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    ((((((((((((((((((((((((( Files Created from 2008-01-17 to 2008-02-17 )))))))))))))))))))))))))))))))
    .

    2008-02-14 15:28 . 2008-02-14 15:28 <DIR> d-------- C:\Program Files\DAEMON Tools Lite
    2008-02-14 15:28 . 2008-02-14 15:28 <DIR> d-------- C:\Documents and Settings\Steve\Application Data\DAEMON Tools
    2008-02-14 00:51 . 2008-02-14 00:51 <DIR> d-------- C:\Deckard
    2008-02-14 00:49 . 2008-02-14 00:49 <DIR> d-------- C:\Program Files\Trend Micro
    2008-02-11 21:48 . 2008-02-11 21:48 716,272 --a------ C:\WINDOWS\system32\drivers\sptd.sys
    2008-02-11 21:44 . 2008-02-11 21:45 <DIR> d-------- C:\Program Files\MagicISO
    2008-02-07 20:12 . 2008-02-07 20:12 <DIR> d-------- C:\Program Files\MagicDVDRipper
    2008-02-07 00:03 . 2008-02-07 00:03 0 --a------ C:\WINDOWS\iplayer.INI
    2008-02-07 00:00 . 2008-02-07 00:01 <DIR> d-------- C:\Program Files\InterActual
    2008-02-06 23:47 . 2008-02-06 23:49 <DIR> d-------- C:\Program Files\PartyGaming
    2008-02-06 20:44 . 2008-02-06 20:44 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\FLEXnet
    2008-02-06 00:22 . 2008-02-06 00:22 <DIR> d-------- C:\Documents an?
    2008-02-02 18:01 . 2008-02-11 13:15 <DIR> d-------- C:\Documents and Settings\Steve\Application Data\LimeWire
    2008-01-31 16:45 . 2008-02-16 10:40 1,184 --a------ C:\WINDOWS\system32\drivers\APPFLTR.CFG.bck
    2008-01-31 16:44 . 2008-02-16 10:40 172,868 --a------ C:\WINDOWS\system32\drivers\APPFCONT.DAT.bck
    2008-01-31 01:45 . 2008-01-31 01:45 <DIR> d-------- C:\Program Files\XP Codec Pack
    2008-01-31 00:43 . 2008-01-31 00:43 1,203 --a------ C:\WINDOWS\mozver.dat
    2008-01-30 19:24 . 2003-03-18 20:14 499,712 --a------ C:\WINDOWS\system32\MSVCP71.DLL
    2008-01-30 19:24 . 2003-02-21 04:42 348,160 --a------ C:\WINDOWS\system32\MSVCR71.DLL
    2008-01-30 19:16 . 2007-09-21 11:33 71,680 --a------ C:\WINDOWS\system32\drivers\PAVDRV51.SYS
    2008-01-30 19:12 . 2008-02-16 10:40 172,868 --a------ C:\WINDOWS\system32\drivers\APPFCONT.DAT
    2008-01-30 19:12 . 2008-02-16 10:40 1,184 --a------ C:\WINDOWS\system32\drivers\APPFLTR.CFG
    2008-01-30 19:11 . 2008-02-17 00:46 <DIR> d-------- C:\WINDOWS\system32\PAV
    2008-01-30 19:11 . 2007-09-21 11:33 190,640 --a------ C:\WINDOWS\system32\drivers\idsflt.sys
    2008-01-30 19:11 . 2007-09-21 11:33 121,392 --a------ C:\WINDOWS\system32\drivers\netfltdi.sys
    2008-01-30 19:11 . 2007-09-21 11:33 71,608 --a------ C:\WINDOWS\system32\drivers\APPFLT.SYS
    2008-01-30 19:11 . 2007-09-21 11:33 49,968 --a------ C:\WINDOWS\system32\drivers\dsaflt.sys
    2008-01-30 19:11 . 2007-09-21 11:33 36,016 --a------ C:\WINDOWS\system32\drivers\smsflt.sys
    2008-01-30 19:11 . 2007-09-21 11:33 29,360 --a------ C:\WINDOWS\system32\drivers\wnmflt.sys
    2008-01-30 19:11 . 2007-09-21 11:33 17,792 --a------ C:\WINDOWS\system32\drivers\cpoint.sys
    2008-01-30 19:11 . 2007-09-21 11:33 15,792 --a------ C:\WINDOWS\system32\drivers\fnetmon.sys
    2008-01-29 23:11 . 2008-01-29 23:11 <DIR> d-------- C:\WINDOWS\system32\QuickTime
    2008-01-29 23:11 . 2008-01-29 23:11 <DIR> d-------- C:\WINDOWS\system32\custom matrices
    2008-01-29 23:04 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
    2008-01-29 23:04 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll
    2008-01-29 23:04 . 2007-07-30 19:19 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
    2008-01-29 22:57 . 2008-01-29 22:59 <DIR> d-------- C:\Documents and Settings\Steve\Application Data\DivX
    2008-01-29 22:45 . 2004-08-03 23:08 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys
    2008-01-29 22:24 . 2008-01-29 22:24 <DIR> d-------- C:\WINDOWS\Sun
    2008-01-29 20:34 . 2008-02-16 00:56 <DIR> d-------- C:\Documents and Settings\Steve\Application Data\Azureus
    2008-01-28 15:24 . 2008-01-28 15:24 <DIR> d-------- C:\Program Files\Windows Media Connect 2
    2008-01-28 15:22 . 2008-01-28 15:22 <DIR> d-------- C:\WINDOWS\system32\LogFiles
    2008-01-28 15:22 . 2008-01-28 15:23 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF
    2008-01-28 15:21 . 2004-08-04 07:00 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
    2008-01-28 14:34 . 2008-02-02 14:46 <DIR> d-------- C:\Program Files\Azureus
    2008-01-28 14:34 . 2008-01-31 15:50 54,832 --a------ C:\WINDOWS\system32\pavcpl.cpl
    2008-01-28 14:34 . 2008-01-31 15:52 281 --a------ C:\WINDOWS\system32\PavCPL.dat
    2008-01-28 14:33 . 2008-01-28 14:33 0 --------- C:\WINDOWS\PAVSHRB.INI
    2008-01-28 14:32 . 2008-01-31 15:50 142,128 --a------ C:\WINDOWS\system32\drivers\netimflt.sys
    2008-01-28 14:32 . 2008-01-28 14:32 1,990 --a------ C:\WINDOWS\system32\drivers\net_m32.inf
    2008-01-28 14:30 . 2008-01-28 14:30 250,368 --a------ C:\WINDOWS\system32\andt.sys
    2008-01-28 14:30 . 2008-02-05 00:01 45,056 --a------ C:\WINDOWS\system32\Indt2.sys
    2008-01-28 14:30 . 2008-01-28 14:30 31,744 --a------ C:\WINDOWS\system32\routing.exe
    2008-01-28 14:28 . 2008-01-31 15:48 <DIR> d-------- C:\Program Files\PowerISO
    2008-01-28 14:27 . 2008-01-28 14:27 <DIR> d-------- C:\Program Files\Power ISO & serial
    2008-01-28 14:18 . 2007-09-24 23:31 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
    2008-01-28 14:17 . 2008-01-28 14:18 <DIR> d-------- C:\Program Files\Java
    2008-01-28 14:16 . 2008-01-28 14:16 <DIR> d-------- C:\Program Files\Common Files\Java
    2008-01-28 14:13 . 2008-02-14 16:26 <DIR> d-------- C:\Program Files\DivX
    2008-01-28 14:04 . 2008-02-05 19:42 <DIR> d-------- C:\Program Files\mIRC
    2008-01-28 14:04 . 2008-02-05 19:45 <DIR> d-------- C:\Documents and Settings\Steve\Application Data\mIRC
    2008-01-28 13:33 . 2008-02-06 19:59 <DIR> d-------- C:\Program Files\Adobe Premiere Pro CS3
    2008-01-27 20:12 . 2008-01-27 20:12 <DIR> d-------- C:\Program Files\Common Files\Macrovision Shared
    2008-01-27 20:05 . 2008-01-27 20:10 <DIR> d-------- C:\Program Files\Photoshop CS3
    2008-01-27 19:22 . 2008-02-10 19:16 <DIR> d-------- C:\Program Files\Common Files\Adobe
    2008-01-27 19:19 . 2006-10-26 19:56 32,592 --a------ C:\WINDOWS\system32\msonpmon.dll
    2008-01-27 19:17 . 2008-01-27 19:17 <DIR> d-------- C:\Program Files\MSBuild
    2008-01-27 19:17 . 2008-01-27 19:17 <DIR> d-------- C:\Program Files\Microsoft Works
    2008-01-27 19:12 . 2008-01-27 19:17 <DIR> d-------- C:\WINDOWS\SHELLNEW
    2008-01-27 19:06 . 2008-02-14 01:25 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help
    2008-01-27 19:04 . 2008-01-27 19:04 <DIR> dr-h----- C:\MSOCache
    2008-01-27 18:56 . 2008-01-28 12:28 <DIR> d-------- C:\Documents and Settings\Steve\Contacts
    2008-01-27 18:55 . 2008-01-28 14:47 <DIR> d-------- C:\Program Files\Windows Live Toolbar
    2008-01-27 18:49 . 2008-01-27 18:54 <DIR> d-------- C:\Program Files\Windows Live
    2008-01-27 18:49 . 2008-01-27 18:54 <DIR> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller
    2008-01-27 18:49 . 2008-01-27 18:49 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
    2008-01-27 18:42 . 2008-01-31 15:48 <DIR> d-------- C:\Program Files\iTunes
    2008-01-27 18:42 . 2008-01-27 18:42 <DIR> d-------- C:\Program Files\iPod
    2008-01-27 18:42 . 2008-01-27 18:42 <DIR> d-------- C:\Documents and Settings\Steve\Application Data\Apple Computer
    2008-01-27 18:41 . 2008-01-30 19:50 <DIR> d-------- C:\Program Files\QuickTime
    2008-01-27 18:41 . 2008-01-31 15:48 <DIR> d-------- C:\Program Files\Bonjour
    2008-01-27 18:40 . 2008-01-27 18:54 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
    2008-01-27 18:40 . 2008-01-27 18:40 <DIR> d-------- C:\Program Files\Apple Software Update
    2008-01-27 18:40 . 2008-01-27 18:42 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
    2008-01-27 18:39 . 2008-01-27 18:39 <DIR> d-------- C:\Program Files\Common Files\Apple
    2008-01-27 18:39 . 2008-01-27 18:39 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple
    2008-01-27 16:38 . 2008-01-27 16:38 0 --a------ C:\WINDOWS\nsreg.dat
    2008-01-27 16:35 . 2008-01-30 20:22 48 --a------ C:\WINDOWS\system32\drivers\wnmsav.dat
    2008-01-27 16:18 . 2008-01-30 19:30 37 --a------ C:\WINDOWS\r007
    2008-01-27 16:16 . 2008-01-31 15:50 292,400 --a------ C:\WINDOWS\system32\PavSHook.dll
    2008-01-27 16:16 . 2008-01-31 15:50 161,328 --a------ C:\WINDOWS\system32\TpUtil.dll
    2008-01-27 16:16 . 2006-06-27 19:36 101,888 --a------ C:\WINDOWS\system32\SYSTOOLS.DLL
    2008-01-27 16:16 . 2008-01-31 15:50 63,024 --a------ C:\WINDOWS\system32\pavipc.dll
    2008-01-27 16:16 . 2007-09-21 11:33 50,736 --a------ C:\WINDOWS\system32\avldr.dll
    2008-01-27 16:15 . 2008-01-27 16:15 <DIR> d-------- C:\Program Files\Panda Software
    2008-01-27 16:14 . 2008-01-27 16:14 <DIR> d-------- C:\Program Files\Common Files\Panda Software
    2008-01-27 16:14 . 2006-04-25 10:02 165,120 -ra------ C:\WINDOWS\system32\drivers\PavProc.sys
    2008-01-27 16:14 . 2005-08-29 07:23 26,752 -ra------ C:\WINDOWS\system32\drivers\ShldDrv.sys
    2008-01-26 22:39 . 2008-02-13 10:23 <DIR> d--h----- C:\WINDOWS\$hf_mig$
    2008-01-26 22:39 . 2006-09-25 17:58 23,856 --a------ C:\WINDOWS\system32\spupdsvc.exe

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-01-31 00:10 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-01-27 03:07 17,801 ----a-w C:\WINDOWS\system32\drivers\AegisP.sys
    2008-01-27 03:02 --------- d-----w C:\Program Files\Common Files\InstallShield
    2008-01-27 02:49 --------- d-----w C:\Program Files\microsoft frontpage
    2008-01-20 21:21 97,280 ----a-w C:\WINDOWS\system32\ff_realaac.dll
    2008-01-20 21:21 81,408 ----a-w C:\WINDOWS\system32\ff_tremor.dll
    2008-01-20 21:21 8,192 ----a-w C:\WINDOWS\system32\FLT_ffdshow.dll
    2008-01-20 21:21 662,016 ----a-w C:\WINDOWS\system32\xvidcore.dll
    2008-01-20 21:21 40,960 ----a-w C:\WINDOWS\system32\ff_liba52.dll
    2008-01-20 21:21 38,400 ----a-w C:\WINDOWS\system32\ff_unrar.dll
    2008-01-20 21:21 245,760 ----a-w C:\WINDOWS\system32\ff_libfaad2.dll
    2008-01-20 21:21 155,648 ----a-w C:\WINDOWS\system32\ff_libdts.dll
    2008-01-20 21:21 122,880 ----a-w C:\WINDOWS\system32\ff_samplerate.dll
    2008-01-20 21:21 118,784 ----a-w C:\WINDOWS\system32\ff_libmad.dll
    2008-01-20 21:21 114,688 ----a-w C:\WINDOWS\system32\libmpeg2_ff.dll
    2008-01-11 05:53 44,544 ----a-w C:\WINDOWS\system32\SET180.tmp
    2008-01-04 21:59 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
    2008-01-04 21:58 9,464 ------w C:\WINDOWS\system32\drivers\cdralw2k.sys
    2008-01-04 21:58 9,336 ------w C:\WINDOWS\system32\drivers\cdr4_xp.sys
    2008-01-04 21:58 43,528 ------w C:\WINDOWS\system32\drivers\PxHelp20.sys
    2008-01-04 21:58 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
    2008-01-04 21:58 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
    2008-01-04 21:58 129,784 ------w C:\WINDOWS\system32\pxafs.dll
    2008-01-04 21:58 120,056 ------w C:\WINDOWS\system32\pxcpyi64.exe
    2008-01-04 21:58 118,520 ------w C:\WINDOWS\system32\pxinsi64.exe
    2008-01-04 21:58 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
    2008-01-04 21:57 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
    2008-01-04 21:57 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
    2008-01-04 21:57 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
    2008-01-04 21:57 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
    2008-01-04 21:57 682,496 ----a-w C:\WINDOWS\system32\DivX.dll
    2008-01-04 21:57 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
    2008-01-04 21:57 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
    2008-01-04 21:57 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
    2008-01-04 21:57 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
    2008-01-04 21:57 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
    2008-01-04 21:57 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
    2008-01-04 21:57 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
    2008-01-04 21:56 156,992 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
    2008-01-04 21:56 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
    2008-01-01 00:00 741,376 ----a-w C:\WINDOWS\system32\audxlib.dll
    2007-12-29 00:04 245,248 ----a-w C:\WINDOWS\system32\dxr.dll
    2007-12-29 00:04 159,744 ----a-w C:\WINDOWS\system32\mmfinfo.dll
    2007-12-29 00:03 97,280 ----a-w C:\WINDOWS\system32\avs.dll
    2007-12-29 00:03 79,360 ----a-w C:\WINDOWS\system32\mkzlib.dll
    2007-12-29 00:03 335,872 ----a-w C:\WINDOWS\system32\gdsmux.exe
    2007-12-29 00:03 23,552 ----a-w C:\WINDOWS\system32\mkunicode.dll
    2007-12-29 00:03 163,840 ----a-w C:\WINDOWS\system32\ts.dll
    2007-12-29 00:03 148,480 ----a-w C:\WINDOWS\system32\mkx.dll
    2007-12-29 00:03 141,312 ----a-w C:\WINDOWS\system32\mp4.dll
    2007-12-29 00:03 135,168 ----a-w C:\WINDOWS\system32\mkv2vfr.exe
    2007-12-29 00:03 120,832 ----a-w C:\WINDOWS\system32\ogm.dll
    2007-12-29 00:03 108,032 ----a-w C:\WINDOWS\system32\avi.dll
    2007-12-29 00:03 103,424 ----a-w C:\WINDOWS\system32\dsmux.exe
    2007-12-29 00:03 102,400 ----a-w C:\WINDOWS\system32\avss.dll
    2007-12-18 09:51 179,584 ----a-w C:\WINDOWS\system32\drivers\mrxdav.sys
    2007-12-08 05:21 3,592,192 ----a-w C:\WINDOWS\system32\SET185.tmp
    2007-12-07 02:21 824,832 ----a-w C:\WINDOWS\system32\wininet.dll
    2007-12-07 02:21 824,832 ----a-w C:\WINDOWS\system32\SET17C.tmp
    2007-12-07 02:21 63,488 ----a-w C:\WINDOWS\system32\SET194.tmp
    2007-12-07 02:21 6,066,176 ----a-w C:\WINDOWS\system32\SET18D.tmp
    2007-12-07 02:21 52,224 ----a-w C:\WINDOWS\system32\SET186.tmp
    2007-12-07 02:21 478,208 ----a-w C:\WINDOWS\system32\SET184.tmp
    2007-12-07 02:21 459,264 ----a-w C:\WINDOWS\system32\SET187.tmp
    2007-12-07 02:21 383,488 ----a-w C:\WINDOWS\system32\SET18F.tmp
    2007-12-07 02:21 267,776 ----a-w C:\WINDOWS\system32\SET18B.tmp
    2007-12-07 02:21 124,928 ----a-w C:\WINDOWS\system32\SET197.tmp
    2007-12-07 02:21 105,984 ----a-w C:\WINDOWS\system32\SET17F.tmp
    2007-12-07 02:21 1,159,680 ----a-w C:\WINDOWS\system32\SET17E.tmp
    2007-12-04 18:38 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 07:00 15360]
    "msnmsgr "= "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184]
    "DAEMON Tools Lite "= "C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-01-17 11:51 486856]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "QuickTime Task "= "C:\Program Files\QuickTime\qttask.exe" [2008-01-10 15:27 385024]
    "Acrobat Assistant 8.0 "= "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2006-10-22 23:24 620152]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avldr]
    avldr.dll 2007-09-21 11:33 50736 C:\WINDOWS\system32\avldr.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APVXDWIN]
    --a------ 2007-09-21 11:33 329264 C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\APVXDWIN.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
    --a------ 2004-08-04 07:00 15360 C:\WINDOWS\system32\ctfmon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell Wireless Manager UI]
    C:\WINDOWS\system32\WLTRAY

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
    --a------ 2006-10-27 00:47 31016 C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
    --a------ 2004-11-02 16:59 126976 C:\WINDOWS\system32\hkcmd.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
    --a------ 2004-11-02 17:03 155648 C:\WINDOWS\system32\igfxtray.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
    --a------ 2008-01-15 03:22 267048 C:\Program Files\iTunes\iTunesHelper.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
    --a------ 2007-10-18 11:34 5724184 C:\Program Files\Windows Live\Messenger\MsnMsgr.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
    --a------ 2008-01-10 15:27 385024 C:\Program Files\QuickTime\qttask.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
    --a------ 2007-09-25 01:11 132496 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
    --a------ 2004-05-14 09:35 536576 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPLpr]
    --a------ 2004-05-13 19:23 98304 C:\Program Files\Synaptics\SynTP\SynTPLpr.exe

    R1 APPFLT;App Filter Plugin;C:\WINDOWS\system32\Drivers\APPFLT.SYS [2007-09-21 11:33]
    R1 DSAFLT;DSA Filter Plugin;C:\WINDOWS\system32\Drivers\DSAFLT.SYS [2007-09-21 11:33]
    R1 FNETMON;NetMon Filter Plugin;C:\WINDOWS\system32\Drivers\fnetmon.SYS [2007-09-21 11:33]
    R1 IDSFLT;Ids Filter Plugin;C:\WINDOWS\system32\Drivers\IDSFLT.SYS [2007-09-21 11:33]
    R1 NETFLTDI;Panda Net Driver [TDI Layer];C:\WINDOWS\system32\Drivers\NETFLTDI.SYS [2007-09-21 11:33]
    R1 SMSFLT;SMS Filter Plugin;C:\WINDOWS\system32\Drivers\SMSFLT.SYS [2007-09-21 11:33]
    R1 WNMFLT;Wifi Monitor Filter Plugin;C:\WINDOWS\system32\Drivers\WNMFLT.SYS [2007-09-21 11:33]
    R2 cpoint;cpoint;C:\WINDOWS\system32\drivers\cpoint.sys [2007-09-21 11:33]
    R2 perfmons;perfmons Service;C:\WINDOWS\system32\perfs.exe [2004-08-04 07:00]
    R2 Routing;Routing Service;C:\WINDOWS\system32\routing.exe [2008-01-28 14:30]
    R3 AvFlt;Antivirus Filter Driver;C:\WINDOWS\system32\drivers\av5flt.sys []
    R3 NETIMFLT;PANDA NDIS IM Filter Miniport;C:\WINDOWS\system32\DRIVERS\netimflt.sys [2008-01-31 15:50]
    R3 PavSRK.sys;PavSRK.sys;C:\WINDOWS\system32\PavSRK.sys []
    S3 PavTPK.sys;PavTPK.sys;C:\WINDOWS\system32\PavTPK.sys []

    *Newly Created Service* - COMFILTR
    .
    Contents of the 'Scheduled Tasks' folder
    "2008-02-15 03:09:28 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job "
    - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
    .
    **************************************************************************

    catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-02-17 12:13:17
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2008-02-17 12:14:05
    .
    2008-02-14 06:26:42 --- E O F ---
     
    backer,
    #10
  12. 2008/02/18
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi backer

    Highlight and copy the contents of the code box below and paste it into a blank notepad, then save it to your desktop as;

    Filename: CFScript.txt
    Save As Type: All Files (*.*)

    Close all other windows and programs. Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button.
    Click here to see how to use CFScript.txt
    Combofix should run and may reboot the computer when it's done. A log will open when it's complete. Post the contents of that log and another fresh HijackThis log.

    Please do not click on the ComboFix window while it is running a scan. This can cause it to stall.

    Code:
    File::
C:\WINDOWS\system32\andt.sys
C:\WINDOWS\system32\Indt2.sys
C:\WINDOWS\system32\routing.exe
C:\WINDOWS\system32\perfs.exe
    Please post the log it produces.

    Thanks
    Geri
     
    Geri,
    #11
  13. 2008/02/18
    backer

    backer Inactive Thread Starter

    Joined:
    2007/01/10
    Messages:
    83
    Likes Received:
    0
    Here is the new combofix log

    ComboFix 08-02-17.2 - Steve 2008-02-18 20:08:31.3 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.232 [GMT -5:00]
    Running from: C:\Documents and Settings\Steve\Desktop\ComboFix.exe
    Command switches used :: C:\Documents and Settings\Steve\Desktop\CFScript.txt
    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

    FILE ::
    C:\WINDOWS\system32\andt.sys
    C:\WINDOWS\system32\Indt2.sys
    C:\WINDOWS\system32\perfs.exe
    C:\WINDOWS\system32\routing.exe
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\WINDOWS\system32\andt.sys
    C:\WINDOWS\system32\Indt2.sys
    C:\WINDOWS\system32\perfs.exe
    C:\WINDOWS\system32\routing.exe

    .
    ((((((((((((((((((((((((( Files Created from 2008-01-19 to 2008-02-19 )))))))))))))))))))))))))))))))
    .

    2008-02-14 15:28 . 2008-02-14 15:28 <DIR> d-------- C:\Program Files\DAEMON Tools Lite
    2008-02-14 15:28 . 2008-02-14 15:28 <DIR> d-------- C:\Documents and Settings\Steve\Application Data\DAEMON Tools
    2008-02-14 00:51 . 2008-02-14 00:51 <DIR> d-------- C:\Deckard
    2008-02-14 00:49 . 2008-02-14 00:49 <DIR> d-------- C:\Program Files\Trend Micro
    2008-02-11 21:48 . 2008-02-11 21:48 716,272 --a------ C:\WINDOWS\system32\drivers\sptd.sys
    2008-02-11 21:44 . 2008-02-11 21:45 <DIR> d-------- C:\Program Files\MagicISO
    2008-02-07 20:12 . 2008-02-07 20:12 <DIR> d-------- C:\Program Files\MagicDVDRipper
    2008-02-07 00:03 . 2008-02-07 00:03 0 --a------ C:\WINDOWS\iplayer.INI
    2008-02-07 00:00 . 2008-02-07 00:01 <DIR> d-------- C:\Program Files\InterActual
    2008-02-06 23:47 . 2008-02-06 23:49 <DIR> d-------- C:\Program Files\PartyGaming
    2008-02-06 20:44 . 2008-02-06 20:44 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\FLEXnet
    2008-02-06 00:22 . 2008-02-06 00:22 <DIR> d-------- C:\Documents an?
    2008-02-02 18:01 . 2008-02-11 13:15 <DIR> d-------- C:\Documents and Settings\Steve\Application Data\LimeWire
    2008-01-31 16:45 . 2008-02-18 18:31 1,184 --a------ C:\WINDOWS\system32\drivers\APPFLTR.CFG.bck
    2008-01-31 16:44 . 2008-02-18 18:31 172,868 --a------ C:\WINDOWS\system32\drivers\APPFCONT.DAT.bck
    2008-01-31 01:45 . 2008-01-31 01:45 <DIR> d-------- C:\Program Files\XP Codec Pack
    2008-01-31 00:43 . 2008-01-31 00:43 1,203 --a------ C:\WINDOWS\mozver.dat
    2008-01-30 19:24 . 2003-03-18 20:14 499,712 --a------ C:\WINDOWS\system32\MSVCP71.DLL
    2008-01-30 19:24 . 2003-02-21 04:42 348,160 --a------ C:\WINDOWS\system32\MSVCR71.DLL
    2008-01-30 19:16 . 2007-09-21 11:33 71,680 --a------ C:\WINDOWS\system32\drivers\PAVDRV51.SYS
    2008-01-30 19:12 . 2008-02-18 18:31 172,868 --a------ C:\WINDOWS\system32\drivers\APPFCONT.DAT
    2008-01-30 19:12 . 2008-02-18 18:31 1,184 --a------ C:\WINDOWS\system32\drivers\APPFLTR.CFG
    2008-01-30 19:11 . 2008-02-18 20:00 <DIR> d-------- C:\WINDOWS\system32\PAV
    2008-01-30 19:11 . 2007-09-21 11:33 190,640 --a------ C:\WINDOWS\system32\drivers\idsflt.sys
    2008-01-30 19:11 . 2007-09-21 11:33 121,392 --a------ C:\WINDOWS\system32\drivers\netfltdi.sys
    2008-01-30 19:11 . 2007-09-21 11:33 71,608 --a------ C:\WINDOWS\system32\drivers\APPFLT.SYS
    2008-01-30 19:11 . 2007-09-21 11:33 49,968 --a------ C:\WINDOWS\system32\drivers\dsaflt.sys
    2008-01-30 19:11 . 2007-09-21 11:33 36,016 --a------ C:\WINDOWS\system32\drivers\smsflt.sys
    2008-01-30 19:11 . 2007-09-21 11:33 29,360 --a------ C:\WINDOWS\system32\drivers\wnmflt.sys
    2008-01-30 19:11 . 2007-09-21 11:33 17,792 --a------ C:\WINDOWS\system32\drivers\cpoint.sys
    2008-01-30 19:11 . 2007-09-21 11:33 15,792 --a------ C:\WINDOWS\system32\drivers\fnetmon.sys
    2008-01-29 23:11 . 2008-01-29 23:11 <DIR> d-------- C:\WINDOWS\system32\QuickTime
    2008-01-29 23:11 . 2008-01-29 23:11 <DIR> d-------- C:\WINDOWS\system32\custom matrices
    2008-01-29 23:04 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
    2008-01-29 23:04 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll
    2008-01-29 23:04 . 2007-07-30 19:19 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
    2008-01-29 22:57 . 2008-01-29 22:59 <DIR> d-------- C:\Documents and Settings\Steve\Application Data\DivX
    2008-01-29 22:45 . 2004-08-03 23:08 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys
    2008-01-29 22:24 . 2008-01-29 22:24 <DIR> d-------- C:\WINDOWS\Sun
    2008-01-29 20:34 . 2008-02-18 17:23 <DIR> d-------- C:\Documents and Settings\Steve\Application Data\Azureus
    2008-01-28 15:24 . 2008-01-28 15:24 <DIR> d-------- C:\Program Files\Windows Media Connect 2
    2008-01-28 15:22 . 2008-01-28 15:22 <DIR> d-------- C:\WINDOWS\system32\LogFiles
    2008-01-28 15:22 . 2008-01-28 15:23 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF
    2008-01-28 15:21 . 2004-08-04 07:00 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
    2008-01-28 14:34 . 2008-02-02 14:46 <DIR> d-------- C:\Program Files\Azureus
    2008-01-28 14:34 . 2008-01-31 15:50 54,832 --a------ C:\WINDOWS\system32\pavcpl.cpl
    2008-01-28 14:34 . 2008-01-31 15:52 281 --a------ C:\WINDOWS\system32\PavCPL.dat
    2008-01-28 14:33 . 2008-01-28 14:33 0 --------- C:\WINDOWS\PAVSHRB.INI
    2008-01-28 14:32 . 2008-01-31 15:50 142,128 --a------ C:\WINDOWS\system32\drivers\netimflt.sys
    2008-01-28 14:32 . 2008-01-28 14:32 1,990 --a------ C:\WINDOWS\system32\drivers\net_m32.inf
    2008-01-28 14:28 . 2008-01-31 15:48 <DIR> d-------- C:\Program Files\PowerISO
    2008-01-28 14:27 . 2008-01-28 14:27 <DIR> d-------- C:\Program Files\Power ISO & serial
    2008-01-28 14:18 . 2007-09-24 23:31 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
    2008-01-28 14:17 . 2008-01-28 14:18 <DIR> d-------- C:\Program Files\Java
    2008-01-28 14:16 . 2008-01-28 14:16 <DIR> d-------- C:\Program Files\Common Files\Java
    2008-01-28 14:13 . 2008-02-14 16:26 <DIR> d-------- C:\Program Files\DivX
    2008-01-28 14:04 . 2008-02-05 19:42 <DIR> d-------- C:\Program Files\mIRC
    2008-01-28 14:04 . 2008-02-05 19:45 <DIR> d-------- C:\Documents and Settings\Steve\Application Data\mIRC
    2008-01-28 13:33 . 2008-02-06 19:59 <DIR> d-------- C:\Program Files\Adobe Premiere Pro CS3
    2008-01-27 20:12 . 2008-01-27 20:12 <DIR> d-------- C:\Program Files\Common Files\Macrovision Shared
    2008-01-27 20:05 . 2008-01-27 20:10 <DIR> d-------- C:\Program Files\Photoshop CS3
    2008-01-27 19:22 . 2008-02-10 19:16 <DIR> d-------- C:\Program Files\Common Files\Adobe
    2008-01-27 19:19 . 2006-10-26 19:56 32,592 --a------ C:\WINDOWS\system32\msonpmon.dll
    2008-01-27 19:17 . 2008-01-27 19:17 <DIR> d-------- C:\Program Files\MSBuild
    2008-01-27 19:17 . 2008-01-27 19:17 <DIR> d-------- C:\Program Files\Microsoft Works
    2008-01-27 19:12 . 2008-01-27 19:17 <DIR> d-------- C:\WINDOWS\SHELLNEW
    2008-01-27 19:06 . 2008-02-14 01:25 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help
    2008-01-27 19:04 . 2008-01-27 19:04 <DIR> dr-h----- C:\MSOCache
    2008-01-27 18:56 . 2008-01-28 12:28 <DIR> d-------- C:\Documents and Settings\Steve\Contacts
    2008-01-27 18:55 . 2008-01-28 14:47 <DIR> d-------- C:\Program Files\Windows Live Toolbar
    2008-01-27 18:49 . 2008-01-27 18:54 <DIR> d-------- C:\Program Files\Windows Live
    2008-01-27 18:49 . 2008-01-27 18:54 <DIR> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller
    2008-01-27 18:49 . 2008-01-27 18:49 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
    2008-01-27 18:42 . 2008-01-31 15:48 <DIR> d-------- C:\Program Files\iTunes
    2008-01-27 18:42 . 2008-01-27 18:42 <DIR> d-------- C:\Program Files\iPod
    2008-01-27 18:42 . 2008-01-27 18:42 <DIR> d-------- C:\Documents and Settings\Steve\Application Data\Apple Computer
    2008-01-27 18:41 . 2008-01-30 19:50 <DIR> d-------- C:\Program Files\QuickTime
    2008-01-27 18:41 . 2008-01-31 15:48 <DIR> d-------- C:\Program Files\Bonjour
    2008-01-27 18:40 . 2008-01-27 18:54 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
    2008-01-27 18:40 . 2008-01-27 18:40 <DIR> d-------- C:\Program Files\Apple Software Update
    2008-01-27 18:40 . 2008-01-27 18:42 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
    2008-01-27 18:39 . 2008-01-27 18:39 <DIR> d-------- C:\Program Files\Common Files\Apple
    2008-01-27 18:39 . 2008-01-27 18:39 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple
    2008-01-27 16:38 . 2008-01-27 16:38 0 --a------ C:\WINDOWS\nsreg.dat
    2008-01-27 16:35 . 2008-01-30 20:22 48 --a------ C:\WINDOWS\system32\drivers\wnmsav.dat
    2008-01-27 16:18 . 2008-01-30 19:30 37 --a------ C:\WINDOWS\r007
    2008-01-27 16:16 . 2008-01-31 15:50 292,400 --a------ C:\WINDOWS\system32\PavSHook.dll
    2008-01-27 16:16 . 2008-01-31 15:50 161,328 --a------ C:\WINDOWS\system32\TpUtil.dll
    2008-01-27 16:16 . 2006-06-27 19:36 101,888 --a------ C:\WINDOWS\system32\SYSTOOLS.DLL
    2008-01-27 16:16 . 2008-01-31 15:50 63,024 --a------ C:\WINDOWS\system32\pavipc.dll
    2008-01-27 16:16 . 2007-09-21 11:33 50,736 --a------ C:\WINDOWS\system32\avldr.dll
    2008-01-27 16:15 . 2008-01-27 16:15 <DIR> d-------- C:\Program Files\Panda Software
    2008-01-27 16:14 . 2008-01-27 16:14 <DIR> d-------- C:\Program Files\Common Files\Panda Software
    2008-01-27 16:14 . 2006-04-25 10:02 165,120 -ra------ C:\WINDOWS\system32\drivers\PavProc.sys
    2008-01-27 16:14 . 2005-08-29 07:23 26,752 -ra------ C:\WINDOWS\system32\drivers\ShldDrv.sys
    2008-01-26 22:39 . 2008-02-13 10:23 <DIR> d--h----- C:\WINDOWS\$hf_mig$
    2008-01-26 22:39 . 2006-09-25 17:58 23,856 --a------ C:\WINDOWS\system32\spupdsvc.exe
    2008-01-26 22:33 . 2007-07-30 19:19 43,352 --a------ C:\WINDOWS\system32\wups2.dll
    2008-01-26 22:33 . 2007-07-30 19:18 34,136 --a------ C:\WINDOWS\system32\wucltui.dll.mui
    2008-01-26 22:33 . 2007-07-30 19:19 25,944 --a------ C:\WINDOWS\system32\wuaucpl.cpl.mui

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-01-31 00:10 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-01-27 03:07 17,801 ----a-w C:\WINDOWS\system32\drivers\AegisP.sys
    2008-01-27 03:02 --------- d-----w C:\Program Files\Common Files\InstallShield
    2008-01-27 02:49 --------- d-----w C:\Program Files\microsoft frontpage
    2008-01-20 21:21 97,280 ----a-w C:\WINDOWS\system32\ff_realaac.dll
    2008-01-20 21:21 81,408 ----a-w C:\WINDOWS\system32\ff_tremor.dll
    2008-01-20 21:21 8,192 ----a-w C:\WINDOWS\system32\FLT_ffdshow.dll
    2008-01-20 21:21 662,016 ----a-w C:\WINDOWS\system32\xvidcore.dll
    2008-01-20 21:21 40,960 ----a-w C:\WINDOWS\system32\ff_liba52.dll
    2008-01-20 21:21 38,400 ----a-w C:\WINDOWS\system32\ff_unrar.dll
    2008-01-20 21:21 245,760 ----a-w C:\WINDOWS\system32\ff_libfaad2.dll
    2008-01-20 21:21 155,648 ----a-w C:\WINDOWS\system32\ff_libdts.dll
    2008-01-20 21:21 122,880 ----a-w C:\WINDOWS\system32\ff_samplerate.dll
    2008-01-20 21:21 118,784 ----a-w C:\WINDOWS\system32\ff_libmad.dll
    2008-01-20 21:21 114,688 ----a-w C:\WINDOWS\system32\libmpeg2_ff.dll
    2008-01-11 05:53 44,544 ----a-w C:\WINDOWS\system32\SET180.tmp
    2008-01-04 21:59 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
    2008-01-04 21:58 9,464 ------w C:\WINDOWS\system32\drivers\cdralw2k.sys
    2008-01-04 21:58 9,336 ------w C:\WINDOWS\system32\drivers\cdr4_xp.sys
    2008-01-04 21:58 43,528 ------w C:\WINDOWS\system32\drivers\PxHelp20.sys
    2008-01-04 21:58 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
    2008-01-04 21:58 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
    2008-01-04 21:58 129,784 ------w C:\WINDOWS\system32\pxafs.dll
    2008-01-04 21:58 120,056 ------w C:\WINDOWS\system32\pxcpyi64.exe
    2008-01-04 21:58 118,520 ------w C:\WINDOWS\system32\pxinsi64.exe
    2008-01-04 21:58 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
    2008-01-04 21:57 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
    2008-01-04 21:57 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
    2008-01-04 21:57 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
    2008-01-04 21:57 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
    2008-01-04 21:57 682,496 ----a-w C:\WINDOWS\system32\DivX.dll
    2008-01-04 21:57 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
    2008-01-04 21:57 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
    2008-01-04 21:57 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
    2008-01-04 21:57 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
    2008-01-04 21:57 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
    2008-01-04 21:57 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
    2008-01-04 21:57 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
    2008-01-04 21:56 156,992 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
    2008-01-04 21:56 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
    2008-01-01 00:00 741,376 ----a-w C:\WINDOWS\system32\audxlib.dll
    2007-12-29 00:04 245,248 ----a-w C:\WINDOWS\system32\dxr.dll
    2007-12-29 00:04 159,744 ----a-w C:\WINDOWS\system32\mmfinfo.dll
    2007-12-29 00:03 97,280 ----a-w C:\WINDOWS\system32\avs.dll
    2007-12-29 00:03 79,360 ----a-w C:\WINDOWS\system32\mkzlib.dll
    2007-12-29 00:03 335,872 ----a-w C:\WINDOWS\system32\gdsmux.exe
    2007-12-29 00:03 23,552 ----a-w C:\WINDOWS\system32\mkunicode.dll
    2007-12-29 00:03 163,840 ----a-w C:\WINDOWS\system32\ts.dll
    2007-12-29 00:03 148,480 ----a-w C:\WINDOWS\system32\mkx.dll
    2007-12-29 00:03 141,312 ----a-w C:\WINDOWS\system32\mp4.dll
    2007-12-29 00:03 135,168 ----a-w C:\WINDOWS\system32\mkv2vfr.exe
    2007-12-29 00:03 120,832 ----a-w C:\WINDOWS\system32\ogm.dll
    2007-12-29 00:03 108,032 ----a-w C:\WINDOWS\system32\avi.dll
    2007-12-29 00:03 103,424 ----a-w C:\WINDOWS\system32\dsmux.exe
    2007-12-29 00:03 102,400 ----a-w C:\WINDOWS\system32\avss.dll
    2007-12-08 05:21 3,592,192 ----a-w C:\WINDOWS\system32\SET185.tmp
    2007-12-07 02:21 824,832 ----a-w C:\WINDOWS\system32\wininet.dll
    2007-12-07 02:21 824,832 ----a-w C:\WINDOWS\system32\SET17C.tmp
    2007-12-07 02:21 63,488 ----a-w C:\WINDOWS\system32\SET194.tmp
    2007-12-07 02:21 6,066,176 ----a-w C:\WINDOWS\system32\SET18D.tmp
    2007-12-07 02:21 52,224 ----a-w C:\WINDOWS\system32\SET186.tmp
    2007-12-07 02:21 478,208 ----a-w C:\WINDOWS\system32\SET184.tmp
    2007-12-07 02:21 459,264 ----a-w C:\WINDOWS\system32\SET187.tmp
    2007-12-07 02:21 383,488 ----a-w C:\WINDOWS\system32\SET18F.tmp
    2007-12-07 02:21 267,776 ----a-w C:\WINDOWS\system32\SET18B.tmp
    2007-12-07 02:21 124,928 ----a-w C:\WINDOWS\system32\SET197.tmp
    2007-12-07 02:21 105,984 ----a-w C:\WINDOWS\system32\SET17F.tmp
    2007-12-07 02:21 1,159,680 ----a-w C:\WINDOWS\system32\SET17E.tmp
    2007-12-04 18:38 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 07:00 15360]
    "msnmsgr "= "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184]
    "DAEMON Tools Lite "= "C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-01-17 11:51 486856]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "QuickTime Task "= "C:\Program Files\QuickTime\qttask.exe" [2008-01-10 15:27 385024]
    "Acrobat Assistant 8.0 "= "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2006-10-22 23:24 620152]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avldr]
    avldr.dll 2007-09-21 11:33 50736 C:\WINDOWS\system32\avldr.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APVXDWIN]
    --a------ 2007-09-21 11:33 329264 C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\APVXDWIN.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
    --a------ 2004-08-04 07:00 15360 C:\WINDOWS\system32\ctfmon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell Wireless Manager UI]
    C:\WINDOWS\system32\WLTRAY

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
    --a------ 2006-10-27 00:47 31016 C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
    --a------ 2004-11-02 16:59 126976 C:\WINDOWS\system32\hkcmd.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
    --a------ 2004-11-02 17:03 155648 C:\WINDOWS\system32\igfxtray.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
    --a------ 2008-01-15 03:22 267048 C:\Program Files\iTunes\iTunesHelper.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
    --a------ 2007-10-18 11:34 5724184 C:\Program Files\Windows Live\Messenger\MsnMsgr.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
    --a------ 2008-01-10 15:27 385024 C:\Program Files\QuickTime\qttask.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
    --a------ 2007-09-25 01:11 132496 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
    --a------ 2004-05-14 09:35 536576 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPLpr]
    --a------ 2004-05-13 19:23 98304 C:\Program Files\Synaptics\SynTP\SynTPLpr.exe

    R1 APPFLT;App Filter Plugin;C:\WINDOWS\system32\Drivers\APPFLT.SYS [2007-09-21 11:33]
    R1 DSAFLT;DSA Filter Plugin;C:\WINDOWS\system32\Drivers\DSAFLT.SYS [2007-09-21 11:33]
    R1 FNETMON;NetMon Filter Plugin;C:\WINDOWS\system32\Drivers\fnetmon.SYS [2007-09-21 11:33]
    R1 IDSFLT;Ids Filter Plugin;C:\WINDOWS\system32\Drivers\IDSFLT.SYS [2007-09-21 11:33]
    R1 NETFLTDI;Panda Net Driver [TDI Layer];C:\WINDOWS\system32\Drivers\NETFLTDI.SYS [2007-09-21 11:33]
    R1 SMSFLT;SMS Filter Plugin;C:\WINDOWS\system32\Drivers\SMSFLT.SYS [2007-09-21 11:33]
    R1 WNMFLT;Wifi Monitor Filter Plugin;C:\WINDOWS\system32\Drivers\WNMFLT.SYS [2007-09-21 11:33]
    R2 cpoint;cpoint;C:\WINDOWS\system32\drivers\cpoint.sys [2007-09-21 11:33]
    R3 AvFlt;Antivirus Filter Driver;C:\WINDOWS\system32\drivers\av5flt.sys []
    R3 NETIMFLT;PANDA NDIS IM Filter Miniport;C:\WINDOWS\system32\DRIVERS\netimflt.sys [2008-01-31 15:50]
    R3 PavSRK.sys;PavSRK.sys;C:\WINDOWS\system32\PavSRK.sys []
    S2 perfmons;perfmons Service;C:\WINDOWS\system32\perfs.exe []
    S2 Routing;Routing Service;C:\WINDOWS\system32\routing.exe []
    S3 PavTPK.sys;PavTPK.sys;C:\WINDOWS\system32\PavTPK.sys []

    .
    Contents of the 'Scheduled Tasks' folder
    "2008-02-15 03:09:28 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job "
    - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
    .
    **************************************************************************

    catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-02-18 20:12:05
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2008-02-18 20:12:39
    ComboFix-quarantined-files.txt 2008-02-19 01:12:24
    ComboFix2.txt 2008-02-17 17:26:48
    ComboFix3.txt 2008-02-17 17:14:06
    .
    2008-02-14 06:26:42 --- E O F ---











    And here is new hijack
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 8:14:35 PM, on 2/18/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16608)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\TPSrv.exe
    C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\pavsrv51.exe
    C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\AVENGINE.EXE
    C:\WINDOWS\System32\wltrysvc.exe
    C:\WINDOWS\System32\bcmwltry.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\PsCtrls.EXE
    C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\PavFnSvr.exe
    c:\program files\panda software\panda antivirus + firewall 2007\firewall\PSHOST.EXE
    C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\psimsvc.exe
    C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe "
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
    O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
    O4 - Global Startup: Adobe Acrobat Synchronizer.lnk = C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe
    O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
    O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1201404758515
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Panda Software Controller - Panda Software International - C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\PsCtrls.EXE
    O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software International - C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\PavFnSvr.exe
    O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\pavsrv51.exe
    O23 - Service: perfmons Service (perfmons) - Unknown owner - C:\WINDOWS\system32\perfs.exe (file missing)
    O23 - Service: Panda Host Service (PSHost) - Panda Software International - c:\program files\panda software\panda antivirus + firewall 2007\firewall\PSHOST.EXE
    O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software International - C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\psimsvc.exe
    O23 - Service: Routing Service (Routing) - Unknown owner - C:\WINDOWS\system32\routing.exe (file missing)
    O23 - Service: Panda TPSrv (TPSrv) - Panda Software International - C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\TPSrv.exe
    O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe

    --
    End of file - 8769 bytes
     
    backer,
    #12
  14. 2008/02/18
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi backer

    Download ATF Cleaner by Atribune and save it to your Desktop.
    This is a good tool to get rid of the temporary garbage you pick up while surfing the net.
    Double click ATF-Cleaner.exe to run the program.
    Check the boxes to the left of:

    Windows Temp
    Current User Temp
    All Users Temp
    Temporary Internet Files
    Prefetch
    Java Cache
    Recycle bin

    The rest are optional - if you want it to remove everything check "Select All ".
    Finally, click Empty Selected. When you get the "Done Cleaning" message, click OK.


    OK now lets get a on-line scan.

    Please do an online scan with Kaspersky WebScanner

    Click on "Accept" If your pop "“up blocker blocks the ActiveX download, allow it, click on "Accept" again

    You will be promted to install an ActiveX component from Kaspersky, Click Yes or Install.
    • The program will launch and then begin downloading the latest definition files:
    • Once the files have been downloaded click on NEXT
    • Now click on Scan Settings
    • In the scan settings make that the following are selected:
      • Scan using the following Anti-Virus database:
      • Extended (if available otherwise Standard)
      • Scan Options:
      • Scan Archives
        Scan Mail Bases
    • Click OK
    • Now under select a target to scan:
      • Select My Computer
    • This will start the program and scan your system.
    • The scan will take a while so be patient and let it run.
    • Once the scan is complete it will display if your system has been infected.
      • Now click on the Save as Text button:
    • Save the file to your desktop.
    • Copy and paste that information in your next post.

    Please post the Kaspersky results.

    Thanks
    Geri
     
    Geri,
    #13
  15. 2008/02/20
    backer

    backer Inactive Thread Starter

    Joined:
    2007/01/10
    Messages:
    83
    Likes Received:
    0
    KASPERSKY ONLINE SCANNER REPORT
    Wednesday, February 20, 2008 5:21:52 PM
    Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
    Kaspersky Online Scanner version: 5.0.98.0
    Kaspersky Anti-Virus database last update: 20/02/2008
    Kaspersky Anti-Virus database records: 573884
    Scan Settings
    Scan using the following antivirus database extended
    Scan Archives true
    Scan Mail Bases true
    Scan Target My Computer
    C:\
    D:\
    E:\
    Scan Statistics
    Total number of scanned objects 90129
    Number of viruses found 6
    Number of infected objects 17
    Number of suspicious objects 0
    Duration of the scan process 01:46:08

    Infected Object Name Virus Name Last Action
    C:\Deckard\System Scanner\20080214163049\backup\DOCUME~1\Steve\LOCALS~1\Temp\mirc631.exe/stream/data0014 Infected: not-a-virus:Client-IRC.Win32.mIRC.631 skipped
    C:\Deckard\System Scanner\20080214163049\backup\DOCUME~1\Steve\LOCALS~1\Temp\mirc631.exe/stream Infected: not-a-virus:Client-IRC.Win32.mIRC.631 skipped
    C:\Deckard\System Scanner\20080214163049\backup\DOCUME~1\Steve\LOCALS~1\Temp\mirc631.exe NSIS: infected - 2 skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
    C:\Documents and Settings\Steve\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\Steve\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped
    C:\Documents and Settings\Steve\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\Steve\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\Steve\Local Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\Steve\Local Settings\History\History.IE5\MSHist012008022020080221\index.dat Object is locked skipped
    C:\Documents and Settings\Steve\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
    C:\Documents and Settings\Steve\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\Steve\My Documents\mirc631.exe/stream/data0001/stream/data0014 Infected: not-a-virus:Client-IRC.Win32.mIRC.631 skipped
    C:\Documents and Settings\Steve\My Documents\mirc631.exe/stream/data0001/stream Infected: not-a-virus:Client-IRC.Win32.mIRC.631 skipped
    C:\Documents and Settings\Steve\My Documents\mirc631.exe/stream/data0001 Infected: not-a-virus:Client-IRC.Win32.mIRC.631 skipped
    C:\Documents and Settings\Steve\My Documents\mirc631.exe/stream Infected: not-a-virus:Client-IRC.Win32.mIRC.631 skipped
    C:\Documents and Settings\Steve\My Documents\mirc631.exe NSIS: infected - 4 skipped
    C:\Documents and Settings\Steve\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\Steve\ntuser.dat.LOG Object is locked skipped
    C:\Program Files\mIRC\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.631 skipped
    C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\cace2423dfb97c58fe7dd9f120557063PSK_NAMES Object is locked skipped
    C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\cace2423dfb97c58fe7dd9f120557063PSK_NAMES2 Object is locked skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\andt.sys.vir Infected: Trojan-Downloader.Win32.Delf.ehi skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\Indt2.sys.vir Infected: Trojan-Clicker.Win32.VB.aby skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\routing.exe.vir Infected: Trojan-Downloader.Win32.Delf.epz skipped
    C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
    C:\System Volume Information\_restore{3444982C-0F90-48F1-A92B-61E9137737D8}\RP24\A0004330.exe Infected: Trojan-Downloader.Win32.Delf.eqa skipped
    C:\System Volume Information\_restore{3444982C-0F90-48F1-A92B-61E9137737D8}\RP27\A0004447.sys Infected: Trojan-Clicker.Win32.VB.aai skipped
    C:\System Volume Information\_restore{3444982C-0F90-48F1-A92B-61E9137737D8}\RP44\A0008443.sys Infected: Trojan-Downloader.Win32.Delf.ehi skipped
    C:\System Volume Information\_restore{3444982C-0F90-48F1-A92B-61E9137737D8}\RP44\A0008444.sys Infected: Trojan-Clicker.Win32.VB.aby skipped
    C:\System Volume Information\_restore{3444982C-0F90-48F1-A92B-61E9137737D8}\RP44\A0008446.exe Infected: Trojan-Downloader.Win32.Delf.epz skipped
    C:\System Volume Information\_restore{3444982C-0F90-48F1-A92B-61E9137737D8}\RP45\change.log Object is locked skipped
    C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
    C:\WINDOWS\SchedLgU.Txt Object is locked skipped
    C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
    C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
    C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
    C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\default Object is locked skipped
    C:\WINDOWS\system32\config\default.LOG Object is locked skipped
    C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
    C:\WINDOWS\system32\config\ODiag.evt Object is locked skipped
    C:\WINDOWS\system32\config\OSession.evt Object is locked skipped
    C:\WINDOWS\system32\config\SAM Object is locked skipped
    C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\SECURITY Object is locked skipped
    C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
    C:\WINDOWS\system32\config\software Object is locked skipped
    C:\WINDOWS\system32\config\software.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\system Object is locked skipped
    C:\WINDOWS\system32\config\system.LOG Object is locked skipped
    C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped
    C:\WINDOWS\system32\h323log.txt Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
    C:\WINDOWS\WindowsUpdate.log Object is locked skipped
    Scan process completed.
     
    backer,
    #14
  16. 2008/02/20
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi backer
    OK that looks good.

    Do you use mIRC?
    If you don't use it I would delete it from add/remove.

    Please re-open HiJackThis and scan only. Check the boxes next to all the entries listed below.

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage << If you don't use this as your start page fix it.
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O23 - Service: Routing Service (Routing) - Unknown owner - C:\WINDOWS\system32\routing.exe (file missing)

    Now close all windows other than HiJackThis, then click Fix Checked.

    Close HJT.


    Click Start>Run in the run box copy and paste or type ComboFix /u then hit Enter to uninstall ComboFix and remove the files/folders it created.

    Run one more Kaspersky scan and post the log.

    Thanks
    Geri
     
    Geri,
    #15

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...