multiple popups and slow running system please help

Question

Here is my hijack log. I have virtumonde on my system and probably others. Any help would be great...

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:19:12 PM, on 11/8/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exe
C:\Program Files\Microsoft Windows OneCare Live\winss.exe
C:\WINDOWS\surfmonkey\SMProxy.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe
C:\WINDOWS\vVX3000.exe
C:\WINDOWS\system32\ctfmon.exe
C:\DOCUME~1\DAVID\APPLIC~1\YSTEM3~1\tracert.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - URLSearchHook: SrchHook Class - {44F9B173-041C-4825-A9B9-D914BD9DCBB3} - C:\Program Files\EarthLink TotalAccess\ElnIE.dll
R3 - URLSearchHook: (no name) - ~CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: (no name) - {2E6C3FA6-80EA-499C-ACE7-3F378FDEC22B} - C:\WINDOWS\system32\pmnnm.dll
O2 - BHO: {51909cee-a3e3-5169-6214-7b19285e81f5} - {5f18e582-91b7-4126-9615-3e3aeec90915} - C:\WINDOWS\system32\sdllkadw.dll
O2 - BHO: (no name) - {820A2C8D-DFC0-4A9F-B3CA-4410CA4F7C04} - C:\WINDOWS\system32\tuvwwuu.dll (file missing)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [VX3000] C:\WINDOWS\vVX3000.exe
O4 - HKLM\..\Run: [88708fc2] rundll32.exe "C:\WINDOWS\system32\jmgqlsdm.dll",b
O4 - HKLM\..\Run: [OneCareUI] "C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingA3347] command /c del "C:\WINDOWS\SYSTEM32\drivers\core.cache.dsk"
O4 - HKLM\..\RunOnce: [SpybotDeletingC6741] cmd /c del "C:\WINDOWS\SYSTEM32\drivers\core.cache.dsk"
O4 - HKLM\..\RunOnce: [SpybotDeletingA755] command /c del "C:\WINDOWS\SYSTEM32\drivers\core.sys"
O4 - HKLM\..\RunOnce: [SpybotDeletingC2273] cmd /c del "C:\WINDOWS\SYSTEM32\drivers\core.sys"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Aida] "C:\DOCUME~1\DAVID\APPLIC~1\YSTEM3~1\tracert.exe" -vt yazb
O4 - HKCU\..\Run: [SfKg6w] C:\Documents and Settings\DAVID\Application Data\Microsoft\Windows\rayiou.exe
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - (no file)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: *.amaena.com
O15 - Trusted Zone: *.avsystemcare.com
O15 - Trusted Zone: *.gomyhit.com
O15 - Trusted Zone: *.imageservr.com
O15 - Trusted Zone: *.imagesrvr.com
O15 - Trusted Zone: *.onerateld.com
O15 - Trusted Zone: *.trustedantivirus.com
O15 - Trusted Zone: *.virusschlacht.com
O15 - Trusted Zone: *.amaena.com (HKLM)
O15 - Trusted Zone: *.avsystemcare.com (HKLM)
O15 - Trusted Zone: *.gomyhit.com (HKLM)
O15 - Trusted Zone: *.imageservr.com (HKLM)
O15 - Trusted Zone: *.imagesrvr.com (HKLM)
O15 - Trusted Zone: *.onerateld.com (HKLM)
O15 - Trusted Zone: *.trustedantivirus.com (HKLM)
O15 - Trusted Zone: *.virusschlacht.com (HKLM)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {31E68DE2-5548-4B23-88F0-C51E6A0F695E} (Microsoft PID Sniffer) - https://support.microsoft.com/OAS/ActiveX/odc.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1134018815343
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} - http://atv.disney.go.com/global/download/otoy/OTOYAX29b.cab
O16 - DPF: {95D88B35-A521-472B-A182-BB1A98356421} (Pearson Installation Assistant 2) - http://asp.mathxl.com/books/_Players/PearsonInstallAsst2.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O16 - DPF: {CC32D4D8-2A0B-4CEB-B105-C9B968379105} (CGameManagerCtrl Object) - https://disney.go.com/games/downloads/gamemanager/DIGGameManager.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} - http://a532.g.akamai.net/f/532/6712/5m/virtools.download.akamai.com/6712/player/install/installer.exe
O16 - DPF: {E6D23284-0E9B-417D-A782-03E4487FC947} (Pearson MathXL Player) - http://asp.mathxl.com/books/_Players/MathPlayer.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab
O20 - Winlogon Notify: jkkhfcb - jkkhfcb.dll (file missing)
O20 - Winlogon Notify: tuvwwuu - tuvwwuu.dll (file missing)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe

Bugbatter · Answer

Welcome. Thank you for using Dell Community Forums. :)

I am reviewing your log.
In the meantime, you can help me by doing the following:

* If you have posted this log on another forum, please provide a link to the topic.

* If you are using any cracked software, please remove it.
Definition of cracked software:
http://en.wikipedia.org/wiki/Software_cracking

* If you are using any P2P (file sharing) programs, please remove them before we clean your computer.
The nature of such software and the high incidence of malware in files downloaded with them are counter productive to restoring your PC to a healthy state.

* If this computer belongs to someone else, do you have authority to apply the fixes we will use?

* Have you already fixed entries using HijackThis? If so, please restore all the backups and then post another log. Please do not do anything else until you get further instructions.

* After we begin working, please print or copy all instructions to Notepad in order to assist you when carrying out procedures.
Please follow all instructions in sequence.

* If your replies do not fit in one post while we are handling your issue, please reply to yourself until all text is submitted. It may take several posts.

I look forward to your reply.

Baylorclay · Answer

I only belong to this forum.  Thank you for your help.  I have tried spy-bot, adware 2007 by lavasoft, and vundofix.  None of those have helped.  I also have windows live onecare that will not completely install due to an error(still working on that).   I keep getting popups related to whatever website I visit..i.e. going to my bank account produces popups related to banking.   The firewall from live onecare also keeps blocking tracert.exe   And for my Yahoo home page I get a security warning about my current web page trying to open another site.  current:  http://ad.doubleclick.net  internet site: http://m1.2mdn.net   Do I need to remove spy-bot and all the others I mentioned above?   Thanks again...

Bugbatter · Answer

No, you do not need to remove your security software. I ask that you do not do any troubleshooting on your own while we are working on this.
Look in your Control Panel's Add/Remove Programs for any of these and uninstall them:

Oin
Yazzle by Oin
Purityscan by Oin
Snowballwars by Oin
or anything similar with Oin or Outerinfo in it.
Zolero
Tizzletalk
MediaTickets

Reboot and download and run this uninstaller:
http://www.outerinfo.com/OiUninstaller.exe

Tutorial for the uninstaller if needed

Reboot after running that.

Please download WinHelp2002's DelDomains by right-clicking on the following link, and choosing "Save Target As":
http://www.mvps.org/winhelp2002/DelDomains.inf
Save the file to the desktop. Then go to the desktop, right click on DelDomains.inf, and choose Install. You may not see any noticeable changes or prompts; this is normal.

Once it is finished your Zones should be reset.
**Note: this will remove all entries in the Trusted Zone and Restricted Zone, and entries you had will need to be entered again. You will have to re-immunize with SpywareBlaster, and/or Spybot after doing this, and reinstall IESpyads (if you use any of these programs).

Please launch Hijackthis and place a checkmark next to the following:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - URLSearchHook: (no name) - ~CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: (no name) - {2E6C3FA6-80EA-499C-ACE7-3F378FDEC22B} - C:\WINDOWS\system32\pmnnm.dll
O2 - BHO: {51909cee-a3e3-5169-6214-7b19285e81f5} - {5f18e582-91b7-4126-9615-3e3aeec90915} - C:\WINDOWS\system32\sdllkadw.dll
O2 - BHO: (no name) - {820A2C8D-DFC0-4A9F-B3CA-4410CA4F7C04} - C:\WINDOWS\system32\tuvwwuu.dll (file missing)
O4 - HKLM\..\Run: [88708fc2] rundll32.exe "C:\WINDOWS\system32\jmgqlsdm.dll",b
O4 - HKCU\..\Run: [Aida] "C:\DOCUME~1\DAVID\APPLIC~1\YSTEM3~1\tracert.exe" -vt yazb O4 - HKCU\..\Run: [SfKg6w] C:\Documents and Settings\DAVID\Application Data\Microsoft\Windows\rayiou.exe
O9 - Extra button: (no name) - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - (no file)
O15 - Trusted Zone: *.amaena.com
O15 - Trusted Zone: *.avsystemcare.com
O15 - Trusted Zone: *.gomyhit.com
O15 - Trusted Zone: *.imageservr.com
O15 - Trusted Zone: *.imagesrvr.com
O15 - Trusted Zone: *.onerateld.com
O15 - Trusted Zone: *.trustedantivirus.com
O15 - Trusted Zone: *.virusschlacht.com
O15 - Trusted Zone: *.amaena.com (HKLM)
O15 - Trusted Zone: *.avsystemcare.com (HKLM)
O15 - Trusted Zone: *.gomyhit.com (HKLM)
O15 - Trusted Zone: *.imageservr.com (HKLM)
O15 - Trusted Zone: *.imagesrvr.com (HKLM)
O15 - Trusted Zone: *.onerateld.com (HKLM)
O15 - Trusted Zone: *.trustedantivirus.com (HKLM)
O15 - Trusted Zone: *.virusschlacht.com (HKLM)
O20 - Winlogon Notify: jkkhfcb - jkkhfcb.dll (file missing) G O20 - Winlogon Notify: tuvwwuu - tuvwwuu.dll (file missing)

Also fix this if you or Spybot did not set these restrictions:
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

Close all windows except HijackThis and click "Fix Checked".
Close Hijackthis and reboot.

Please download Combofix from here:
http://www.techsupportforum.com/sectools/sUBs/ComboFix.exe
** Take note that the link is case sensitive

Save ComboFix to the desktop.

1. Double click on combo.exe & follow the prompts.
2. When finished, it will produce a logfile located at C:\ComboFix.txt.
3. Post the contents of that log in your next reply with a new HijackThis log.

Note:
Do not mouseclick Combofix's window while it is running. That may cause your system to stall/hang.
Do not proceed with the rest of the fix if you fail to run ComboFix.

Note: The above instructions have been created specifically for this user. If you are not this user, do NOT follow these directions.

Message Edited by Bugbatter on 11-08-2007 11:10 AM

Baylorclay · Answer

I looked for those programs and did not find any. followed the other instructions and here are the logs

combofix:

ComboFix 07-11-08.1 - DAVID 2007-11-09 13:07:35.1 - NTFSx86
Running from: C:\Documents and Settings\DAVID\Desktop\ComboFix.exe
* Created a new restore point
.

Unable to gain System Privileges

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\DAVID\Application Data\macromedia\Flash Player\#SharedObjects\2JFWUPQ4\www.broadcaster.com
C:\Documents and Settings\DAVID\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com
C:\Documents and Settings\DAVID\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol
C:\Documents and Settings\DAVID\Application Data\YSTEM3~1
C:\Documents and Settings\DAVID\Application Data\YSTEM3~1\?ystem32\
C:\Documents and Settings\DAVID\Application Data\YSTEM3~1\tracert.exe
C:\Documents and Settings\DAVID\Start Menu\Programs\Outerinfo
C:\Documents and Settings\DAVID\Start Menu\Programs\Outerinfo\Terms.lnk
C:\Documents and Settings\DAVID\Start Menu\Programs\Outerinfo\Uninstall.lnk
C:\Program Files\ssembl~1
C:\temp\tn3
C:\WINDOWS\b122.exe
C:\WINDOWS\b147.exe
C:\WINDOWS\cookies.ini
C:\WINDOWS\fnts~1
C:\WINDOWS\system32\a13
C:\WINDOWS\system32\adeeg.bak1
C:\WINDOWS\system32\adeeg.ini
C:\WINDOWS\system32\awvtq.dll
C:\WINDOWS\system32\D2
C:\WINDOWS\system32\drivers\core.cache.dsk
C:\WINDOWS\system32\drivers\core.sys
C:\WINDOWS\system32\drivers\fad.sys
C:\WINDOWS\system32\e2
C:\WINDOWS\system32\e2\caws83122.exe
C:\WINDOWS\system32\f02WtR
C:\WINDOWS\system32\g1
C:\WINDOWS\system32\i8
C:\WINDOWS\system32\i8\taldrvr11.exe
C:\WINDOWS\SYSTEM32\kjkmp.bak1
C:\WINDOWS\SYSTEM32\kjkmp.bak2
C:\WINDOWS\SYSTEM32\kjkmp.ini
C:\WINDOWS\system32\lsp.dll
C:\WINDOWS\SYSTEM32\mnnmp.bak1
C:\WINDOWS\SYSTEM32\mnnmp.bak2
C:\WINDOWS\SYSTEM32\mnnmp.ini
C:\WINDOWS\SYSTEM32\mnnmp.ini2
C:\WINDOWS\SYSTEM32\mnnmp.tmp
C:\WINDOWS\system32\pac.txt
C:\WINDOWS\SYSTEM32\pstwa.bak1
C:\WINDOWS\SYSTEM32\pstwa.ini
C:\WINDOWS\SYSTEM32\qtvwa.bak1
C:\WINDOWS\SYSTEM32\qtvwa.ini
C:\WINDOWS\system32\x22

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_CORE
-------\LEGACY_DOMAINSERVICE
-------\core
-------\DomainService

((((((((((((((((((((((((( Files Created from 2007-10-09 to 2007-11-09 )))))))))))))))))))))))))))))))
.

2007-11-09 12:41 80,448 --a------ C:\WINDOWS\SYSTEM32\jvblgjst.dll
2007-11-09 12:38 86,080 --a------ C:\WINDOWS\SYSTEM32\plpdrkhb.dll
2007-11-09 12:38 71,232 --a------ C:\WINDOWS\SYSTEM32\lqkilskp.exe
2007-11-09 09:21 d-------- C:\Program Files\Dell AIO Printer A920
2007-11-09 08:53 80,448 --a------ C:\WINDOWS\SYSTEM32\iafdnpgs.dll
2007-11-09 08:51 71,232 --a------ C:\WINDOWS\SYSTEM32\lxxurohm.exe
2007-11-08 22:37 d-------- C:\VundoFix Backups
2007-11-08 22:30 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-11-08 22:18 d-------- C:\Program Files\Trend Micro
2007-11-08 09:25 d-------- C:\Program Files\Lavasoft
2007-11-08 09:25 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-11-07 19:50 88,008 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\msfwdrv.sys
2007-11-07 19:49 112,840 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\msfwhlpr.sys
2007-11-07 19:45 67,784 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\MpFilter.sys
2007-11-07 19:42 d-------- C:\Program Files\MSXML 4.0
2007-11-07 19:20 d-------- C:\Program Files\Microsoft Windows OneCare Live
2007-11-07 13:25 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2007-11-07 13:08 81,472 --a------ C:\WINDOWS\SYSTEM32\sdllkadw.dll
2007-11-07 13:06 71,232 --a------ C:\WINDOWS\SYSTEM32\yplcnfbd.exe
2007-11-07 10:48 81,472 --a------ C:\WINDOWS\SYSTEM32\alsbpmvy.dll
2007-11-07 10:45 87,104 --a------ C:\WINDOWS\SYSTEM32\mfonukaq.dll
2007-11-07 10:40 71,232 --a------ C:\WINDOWS\SYSTEM32\enrkocgs.exe
2007-11-06 07:39 83,008 --a------ C:\WINDOWS\SYSTEM32\ophnhxuj.dll
2007-11-04 19:32 87,616 --a------ C:\WINDOWS\SYSTEM32\jmnxbfjq.dll
2007-11-04 19:26 81,472 --a------ C:\WINDOWS\SYSTEM32\esivoxcb.dll
2007-11-03 18:41 82,496 --a------ C:\WINDOWS\SYSTEM32\wsrawrhb.dll
2007-11-03 18:38 86,080 --a------ C:\WINDOWS\SYSTEM32\rpeldjlh.dll
2007-11-01 22:36 d-------- C:\WINDOWS\SYSTEM32\Mz02r
2007-10-11 15:47 245,408 --a------ C:\WINDOWS\SYSTEM32\unicows.dll
2007-10-10 12:59 584,192 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\rpcrt4.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-08 15:23 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2007-11-07 18:09 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-10-01 04:12 --------- d-----w C:\Program Files\Google
2007-09-24 20:56 --------- d-----w C:\Program Files\MSECache
2007-09-23 00:11 1,980,621 --sha-w C:\WINDOWS\SYSTEM32\qstwa.ini2
2007-09-22 23:21 --------- d-----w C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2007-09-19 23:50 --------- d-----w C:\Program Files\Yahoo!
2007-09-19 23:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\YAHOO
2007-09-17 23:45 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-09-17 22:25 --------- d-----w C:\Documents and Settings\DAVID\Application Data\Lavasoft
2007-09-17 22:09 --------- d-----w C:\Documents and Settings\DAVID\Application Data\Uniblue
2007-09-16 00:34 --------- d-----w C:\Program Files\EarthLink TotalAccess
2007-09-16 00:34 --------- d-----w C:\Documents and Settings\DAVID\Application Data\Earthlink
2007-09-15 23:51 --------- d-----w C:\Documents and Settings\DAVID\Application Data\ScamBlocker
2007-09-15 23:43 --------- d-----w C:\Program Files\Common Files\EarthLink
2007-09-15 23:43 --------- d-----w C:\Documents and Settings\LocalService\Application Data\Earthlink
2007-09-10 05:39 --------- d-----w C:\Documents and Settings\All Users\Application Data\ParetoLogic Anti-Spyware
2007-09-10 00:37 --------- d-----w C:\Program Files\Iomega
2007-09-10 00:34 --------- d-----w C:\Program Files\Starcraft
2007-08-21 06:15 683,520 ----a-w C:\WINDOWS\SYSTEM32\inetcomm.dll
2006-05-03 04:01 91,496 -c--a-w C:\Documents and Settings\DAVID\Application Data\GDIPFONTCACHEV1.DAT
2000-12-12 16:17 100,432 -c----w C:\Program Files\Win2000PPAHotfix.exe
2006-06-30 12:26:08 773 --sha-w C:\WINDOWS\SYSTEM32\ccbeg.ini2
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5ac53855-cad7-49df-98fe-5333a19147c5}]
2007-11-09 12:41 80448 --a------ C:\WINDOWS\system32\jvblgjst.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OneCareUI"="C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe" [2007-10-01 09:53]
"Dell AIO Printer A920"="C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe" []

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:56]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"MySpaceIM"=C:\Program Files\MySpace\IM\MySpaceIM.exe

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\OneCareMP]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\99e99df8.exe]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
"C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dla]
C:\WINDOWS\system32\dla\tfswctrl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ELNKProxy]
C:\WINDOWS\surfmonkey\smproxy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hosyc]
C:\Program Files\MSN\hosyc22011.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
C:\WINDOWS\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InetCntrl]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelMeM]
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Iomega Active Disk]
C:\Program Files\Iomega\AutoDisk\AD2KClient.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Iomega Drive Icons]
C:\Program Files\Iomega\DriveIcons\ImgIcon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Iomega Startup Options]
C:\Program Files\Iomega\Common\ImgStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"C:\Program Files\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\jmarwqh.dll]
C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\jmarwqh.dll,vgaivme

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MySpaceIM]
C:\Program Files\MySpace\IM\MySpaceIM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpySweeper]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SsAAD.exe]
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Uniblue RegistryBooster 2]
C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateManager]
"C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\URLLSTCK.exe]
C:\Program Files\Norton Internet Security\UrlLstCk.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VX3000]
C:\WINDOWS\vVX3000.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
"C:\Program Files\Windows Defender\MSASCui.exe" -hide

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=3 (0x3)
"WinDefend"=2 (0x2)
"usnjsvc"=3 (0x3)
"SSScsiSV"=3 (0x3)
"PACSPTISVR"=3 (0x3)
"navapsvc"=2 (0x2)
"MSCSPTISRV"=3 (0x3)
"MSCamSvc"=2 (0x2)
"LexBceS"=2 (0x2)
"iPodService"=3 (0x3)
"IDriverT"=3 (0x3)
"gusvc"=3 (0x3)
"Fax"=2 (0x2)
"EarthLinkMonitor"=2 (0x2)
"DSBrokerService"=3 (0x3)
"SPTISRV"=3 (0x3)
"aawservice"=2 (0x2)

R1 MSFWHLPR;MSFWHLPR;C:\WINDOWS\system32\DRIVERS\msfwhlpr.sys
R2 MSFWDrv;MSFWDrv;C:\WINDOWS\system32\DRIVERS\msfwdrv.sys
R2 msfwsvc;OneCare Firewall;"C:\Program Files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exe"
R2 OneCareMP;OneCare AntiSpyware and AntiVirus;"C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MsMpEng.exe"
R3 MpFilter;Microsoft Malware Protection Driver;C:\WINDOWS\system32\DRIVERS\MpFilter.sys
S3 ADSFilter;ADSFilter - (Aluria Filter Driver);C:\WINDOWS\system32\DRIVERS\ADSFilter.sys
S3 BW2NDIS5;BW2NDIS5;C:\WINDOWS\system32\Drivers\BW2NDIS5.sys
S3 VX3000;VX-3000;C:\WINDOWS\system32\DRIVERS\VX3000.sys
S4 EarthLinkMonitor;EarthLink Monitor Service;"C:\Program Files\EarthLink TotalAccess\WENGINE\wmonitor.exe"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9570871a-76fc-11d9-95ce-00038a000015}]
\Shell\AutoRun\command - F:\JDSecure\Windows\JDSecure20.exe

.
Contents of the 'Scheduled Tasks' folder
"2007-11-08 09:00:00 C:\WINDOWS\Tasks\AdwareAlert Scheduled Scan.job"
- C:\Program Files\AdwareAlert\AdwareAlert.exe
"2007-11-09 07:39:06 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
"2007-09-25 23:00:01 C:\WINDOWS\Tasks\Pareto UNS.job"
- C:\Program Files\Common Files\ParetoLogic\UUS\UUS.dll\Pareto_Update.exe
.
**************************************************************************

catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-09 13:16:29
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-09 13:20:54 - machine was rebooted
.
--- E O F ---

Baylorclay · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:42:52 PM, on 11/9/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exe
C:\Program Files\Microsoft Windows OneCare Live\winss.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: SrchHook Class - {44F9B173-041C-4825-A9B9-D914BD9DCBB3} - C:\Program Files\EarthLink TotalAccess\ElnIE.dll
O2 - BHO: {5c74191a-3335-ef89-fd94-7dac55835ca5} - {5ac53855-cad7-49df-98fe-5333a19147c5} - C:\WINDOWS\system32\jvblgjst.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [OneCareUI] "C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe"
O4 - HKLM\..\Run: [Dell AIO Printer A920] "C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {31E68DE2-5548-4B23-88F0-C51E6A0F695E} (Microsoft PID Sniffer) - https://support.microsoft.com/OAS/ActiveX/odc.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1134018815343
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} - http://atv.disney.go.com/global/download/otoy/OTOYAX29b.cab
O16 - DPF: {95D88B35-A521-472B-A182-BB1A98356421} (Pearson Installation Assistant 2) - http://asp.mathxl.com/books/_Players/PearsonInstallAsst2.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O16 - DPF: {CC32D4D8-2A0B-4CEB-B105-C9B968379105} (CGameManagerCtrl Object) - https://disney.go.com/games/downloads/gamemanager/DIGGameManager.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} - http://a532.g.akamai.net/f/532/6712/5m/virtools.download.akamai.com/6712/player/install/installer.exe
O16 - DPF: {E6D23284-0E9B-417D-A782-03E4487FC947} (Pearson MathXL Player) - http://asp.mathxl.com/books/_Players/MathPlayer.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab

--
End of file - 5153 bytes

Bugbatter · Answer

Open Notepad and copy/paste the following text between the dotted lines into it. Do not copy the dotted lines. ** Make sure you copy/paste ALL the text at once. ----------------------------------------------------------------------------------------------- File::C:\WINDOWS\system32\jvblgjst.dllC:\WINDOWS\SYSTEM32\ccbeg.ini2C:\WINDOWS\SYSTEM32\lxxurohm.exeC:\WINDOWS\SYSTEM32\iafdnpgs.dllC:\WINDOWS\SYSTEM32\plpdrkhb.dllC:\WINDOWS\SYSTEM32\lqkilskp.exeC:\WINDOWS\SYSTEM32\sdllkadw.dllC:\WINDOWS\SYSTEM32\yplcnfbd.exeC:\WINDOWS\SYSTEM32\alsbpmvy.dllC:\WINDOWS\SYSTEM32\mfonukaq.dllC:\WINDOWS\SYSTEM32\enrkocgs.exeC:\WINDOWS\SYSTEM32\ophnhxuj.dllC:\WINDOWS\SYSTEM32\jmnxbfjq.dllC:\WINDOWS\SYSTEM32\esivoxcb.dllC:\WINDOWS\SYSTEM32\wsrawrhb.dllC:\WINDOWS\SYSTEM32\rpeldjlh.dllC:\WINDOWS\SYSTEM32\qstwa.ini2C:\WINDOWS\system32\jmarwqh.dllRegistry::[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5ac53855-cad7-49df-98fe-5333a19147c5}][-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\jmarwqh.dll] -------------------------------------------------------------------------------------------------------- Save this as CFScript.txt Referring to the picture above, drag CFScript into ComboFix.exe You will be prompted to run Combofix again. Follow the same instructions you did before for running ComboFix. CAUTION: Do not mouse-click ComboFix while it is running. It may cause it to stall. When finished, a log is produced here: C:\ComboFix.txt Please provide the contents of the new ComboFix log in your next reply along with a new HijackThis log, and let me know how things are running.

Baylorclay · Answer

Ok, so far everything seems to be running much better. Still getting popups everynow and then, but no where near as many as before. Here is the combofix log:

ComboFix 07-11-08.1 - DAVID 2007-11-09 18:59:58.2 - NTFSx86
Running from: C:\Documents and Settings\DAVID\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\DAVID\Desktop\CFScript.txt
* Created a new restore point

FILE
File::C:\WINDOWS\system32\jvblgjst.dllC:\WINDOWS\SYSTEM32\ccbeg.ini2C:\WINDOWS\SYSTEM32\lxxurohm.exeC:\WINDOWS\SYSTEM32\iafdnpgs.dllC:\WINDOWS\SYSTEM32\plpdrkhb.dllC:\WINDOWS\SYSTEM32\lqkilskp.exeC:\WINDOWS\SYSTEM32\sdllkadw.dllC:\WINDOWS\SYSTEM32\yplcnfbd.exeC:\WINDOWS\SYSTEM32\alsbpmvy.dllC:\WINDOWS\SYSTEM32\mfonukaq.dllC:\WINDOWS\SYSTEM32\enrkocgs.exeC:\WINDOWS\SYSTEM32\ophnhxuj.dllC:\WINDOWS\SYSTEM32\jmnxbfjq.dllC:\WINDOWS\SYSTEM32\esivoxcb.dllC:\WINDOWS\SYSTEM32\wsrawrhb.dllC:\WINDOWS\SYSTEM32\rpeldjlh.dllC:\WINDOWS\SYSTEM32\qstwa.ini2C:\WINDOWS\system32\jmarwqh.dllRegistry::[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5ac53855-cad7-49df-98fe-5333a19147c5}][-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\jmarwqh.dll]
.

((((((((((((((((((((((((( Files Created from 2007-10-10 to 2007-11-10 )))))))))))))))))))))))))))))))
.

2007-11-09 14:00 d-------- C:\WINDOWS\SYSTEM32\NtmsData
2007-11-09 12:41 80,448 --a------ C:\WINDOWS\SYSTEM32\jvblgjst.dll
2007-11-09 12:38 86,080 --a------ C:\WINDOWS\SYSTEM32\plpdrkhb.dll
2007-11-09 12:38 71,232 --a------ C:\WINDOWS\SYSTEM32\lqkilskp.exe
2007-11-09 09:21 d-------- C:\Program Files\Dell AIO Printer A920
2007-11-09 08:53 80,448 --a------ C:\WINDOWS\SYSTEM32\iafdnpgs.dll
2007-11-09 08:51 71,232 --a------ C:\WINDOWS\SYSTEM32\lxxurohm.exe
2007-11-08 22:30 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-11-08 22:18 d-------- C:\Program Files\Trend Micro
2007-11-08 09:25 d-------- C:\Program Files\Lavasoft
2007-11-08 09:25 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-11-07 19:50 88,008 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\msfwdrv.sys
2007-11-07 19:49 112,840 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\msfwhlpr.sys
2007-11-07 19:45 67,784 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\MpFilter.sys
2007-11-07 19:42 d-------- C:\Program Files\MSXML 4.0
2007-11-07 19:20 d-------- C:\Program Files\Microsoft Windows OneCare Live
2007-11-07 13:25 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2007-11-07 13:08 81,472 --a------ C:\WINDOWS\SYSTEM32\sdllkadw.dll
2007-11-07 13:06 71,232 --a------ C:\WINDOWS\SYSTEM32\yplcnfbd.exe
2007-11-07 10:48 81,472 --a------ C:\WINDOWS\SYSTEM32\alsbpmvy.dll
2007-11-07 10:45 87,104 --a------ C:\WINDOWS\SYSTEM32\mfonukaq.dll
2007-11-07 10:40 71,232 --a------ C:\WINDOWS\SYSTEM32\enrkocgs.exe
2007-11-06 07:39 83,008 --a------ C:\WINDOWS\SYSTEM32\ophnhxuj.dll
2007-11-04 19:32 87,616 --a------ C:\WINDOWS\SYSTEM32\jmnxbfjq.dll
2007-11-04 19:26 81,472 --a------ C:\WINDOWS\SYSTEM32\esivoxcb.dll
2007-11-03 18:41 82,496 --a------ C:\WINDOWS\SYSTEM32\wsrawrhb.dll
2007-11-03 18:38 86,080 --a------ C:\WINDOWS\SYSTEM32\rpeldjlh.dll
2007-11-01 22:36 d-------- C:\WINDOWS\SYSTEM32\Mz02r
2007-10-11 15:47 245,408 --a------ C:\WINDOWS\SYSTEM32\unicows.dll
2007-10-10 12:59 584,192 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\rpcrt4.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-08 15:23 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2007-11-07 18:09 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-10-01 04:12 --------- d-----w C:\Program Files\Google
2007-09-24 20:56 --------- d-----w C:\Program Files\MSECache
2007-09-23 00:11 1,980,621 --sha-w C:\WINDOWS\SYSTEM32\qstwa.ini2
2007-09-22 23:21 --------- d-----w C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2007-09-19 23:50 --------- d-----w C:\Program Files\Yahoo!
2007-09-19 23:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\YAHOO
2007-09-17 23:45 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-09-17 22:25 --------- d-----w C:\Documents and Settings\DAVID\Application Data\Lavasoft
2007-09-17 22:09 --------- d-----w C:\Documents and Settings\DAVID\Application Data\Uniblue
2007-09-16 00:34 --------- d-----w C:\Program Files\EarthLink TotalAccess
2007-09-16 00:34 --------- d-----w C:\Documents and Settings\DAVID\Application Data\Earthlink
2007-09-15 23:51 --------- d-----w C:\Documents and Settings\DAVID\Application Data\ScamBlocker
2007-09-15 23:43 --------- d-----w C:\Program Files\Common Files\EarthLink
2007-09-15 23:43 --------- d-----w C:\Documents and Settings\LocalService\Application Data\Earthlink
2007-09-10 05:39 --------- d-----w C:\Documents and Settings\All Users\Application Data\ParetoLogic Anti-Spyware
2007-09-10 00:37 --------- d-----w C:\Program Files\Iomega
2007-09-10 00:34 --------- d-----w C:\Program Files\Starcraft
2007-08-21 06:15 683,520 ----a-w C:\WINDOWS\SYSTEM32\inetcomm.dll
2007-08-21 06:15 683,520 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\inetcomm.dll
2007-08-20 10:04 824,832 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wininet.dll
2007-08-20 10:04 671,232 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\mstime.dll
2007-08-20 10:04 63,488 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\icardie.dll
2007-08-20 10:04 6,058,496 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\ieframe.dll
2007-08-20 10:04 52,224 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\msfeedsbs.dll
2007-08-20 10:04 477,696 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\mshtmled.dll
2007-08-20 10:04 459,264 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\msfeeds.dll
2007-08-20 10:04 44,544 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\iernonce.dll
2007-08-20 10:04 384,512 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\iedkcs32.dll
2007-08-20 10:04 383,488 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\ieapfltr.dll
2007-08-20 10:04 3,584,512 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\mshtml.dll
2007-08-20 10:04 27,648 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\jsproxy.dll
2007-08-20 10:04 267,776 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\iertutil.dll
2007-08-20 10:04 232,960 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\webcheck.dll
2007-08-20 10:04 230,400 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\ieaksie.dll
2007-08-20 10:04 214,528 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\dxtrans.dll
2007-08-20 10:04 193,024 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\msrating.dll
2007-08-20 10:04 153,088 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\ieakeng.dll
2007-08-20 10:04 132,608 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\extmgr.dll
2007-08-20 10:04 124,928 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\advpack.dll
2007-08-20 10:04 105,984 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\url.dll
2007-08-20 10:04 102,400 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\occache.dll
2007-08-20 10:04 1,152,000 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\urlmon.dll
2007-08-17 10:21 625,152 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\iexplore.exe
2007-08-17 10:20 63,488 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\ie4uinit.exe
2007-08-17 10:20 13,824 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\ieudinit.exe
2007-08-17 07:34 161,792 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\ieakui.dll
2006-05-03 04:01 91,496 -c--a-w C:\Documents and Settings\DAVID\Application Data\GDIPFONTCACHEV1.DAT
2000-12-12 16:17 100,432 -c----w C:\Program Files\Win2000PPAHotfix.exe
2006-06-30 12:26:08 773 --sha-w C:\WINDOWS\SYSTEM32\ccbeg.ini2
.