Thanks gerbil Here is the new Hijack This log
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:34:27 AM, on 8/29/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\brss01a.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\Brmfrmps.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\WZCBDL Service\WZCBDLS.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Brother\ControlCenter2\brctrcen.exe
C:\Program Files\D-Link\Air USB Utility\AirCFG.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Creative\VoiceCenter\AndreaVC.exe
C:\Program Files\Sonic\Product\Media Experience\DMXLauncher.exe
C:\Program Files\eFax Messenger 4.3\J2GDllCmd.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE
C:\Program Files\eFax Messenger 4.3\J2GTray.exe
C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
C:\Program Files\Brother\Brmfcmon\BrMfcmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro\HijackThis\imabunny.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://go.microsoft.com/fwlink/?Link...ge=about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL =
http://www.google.com/ig/dell?hl=en&...suk&channel=us
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl04b\BrStDvPt.exe
O4 - HKLM\..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [D-Link Air USB Utility] C:\Program Files\D-Link\Air USB Utility\AirCFG.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [VoiceCenter] "C:\Program Files\Creative\VoiceCenter\AndreaVC.exe" /tray
O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe
O4 - HKLM\..\Run: [DMXLauncher] "C:\Program Files\Sonic\Product\Media Experience\DMXLauncher.exe"
O4 - HKLM\..\Run: [eFax 4.3] "C:\Program Files\eFax Messenger 4.3\J2GDllCmd.exe" /R
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - Global Startup: eFax 4.3.lnk = C:\Program Files\eFax Messenger 4.3\J2GTray.exe
O4 - Global Startup: Status Monitor.lnk = C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) -
http://dl.tvunetworks.com/TVUAx.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
http://update.microsoft.com/windowsu...?1183943294843
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Brother Popup Suspend service for Resource manager (brmfrmps) - Brother Industries, Ltd. - C:\WINDOWS\system32\Brmfrmps.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Common Files\Sonic Shared\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Common Files\Sonic Shared\RoxioUpnpService9.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: WZCBDL Service (WZCBDLService) - D-Link - C:\Program Files\WZCBDL Service\WZCBDLS.exe
--
End of file - 7523 bytes
The VundoFix log fiel
VundoFix V6.5.4
Checking Java version...
Java version is 1.4.2.3
Old versions of java are exploitable and should be removed.
Scan started at 9:40:17 PM 7/7/2007
Listing files found while scanning....
C:\windows\system32\hqrhhljn.ini
C:\windows\system32\njlhhrqh.dll
C:\windows\system32\tuvsspo.dll
C:\windows\system32\xxywwvv.dll
Beginning removal...
Attempting to delete C:\windows\system32\hqrhhljn.ini
C:\windows\system32\hqrhhljn.ini Has been deleted!
Attempting to delete C:\windows\system32\njlhhrqh.dll
C:\windows\system32\njlhhrqh.dll Has been deleted!
Attempting to delete C:\windows\system32\tuvsspo.dll
C:\windows\system32\tuvsspo.dll Has been deleted!
Attempting to delete C:\windows\system32\xxywwvv.dll
C:\windows\system32\xxywwvv.dll Has been deleted!
Performing Repairs to the registry.
Done!
VundoFix V6.5.4
Checking Java version...
Java version is 1.4.2.3
Old versions of java are exploitable and should be removed.
Scan started at 9:43:37 PM 7/7/2007
Listing files found while scanning....
No infected files were found.
VundoFix V6.5.4
Checking Java version...
Java version is 1.4.2.3
Old versions of java are exploitable and should be removed.
Scan started at 11:15:11 PM 7/7/2007
Listing files found while scanning....
No infected files were found.
VundoFix V6.5.4
Checking Java version...
Java version is 1.4.2.3
Old versions of java are exploitable and should be removed.
Scan started at 12:06:08 AM 7/11/2007
Listing files found while scanning....
No infected files were found.
VundoFix V6.5.4
Checking Java version...
Java version is 1.4.2.3
Old versions of java are exploitable and should be removed.
Scan started at 8:59:26 PM 8/7/2007
Listing files found while scanning....
C:\WINDOWS\system32\bcbeg.bak1
C:\WINDOWS\system32\bcbeg.bak2
C:\WINDOWS\system32\bcbeg.ini
C:\WINDOWS\system32\gebcb.dll
Beginning removal...
Attempting to delete C:\WINDOWS\system32\bcbeg.bak1
C:\WINDOWS\system32\bcbeg.bak1 Has been deleted!
Attempting to delete C:\WINDOWS\system32\bcbeg.bak2
C:\WINDOWS\system32\bcbeg.bak2 Has been deleted!
Attempting to delete C:\WINDOWS\system32\bcbeg.ini
C:\WINDOWS\system32\bcbeg.ini Has been deleted!
Attempting to delete C:\WINDOWS\system32\gebcb.dll
C:\WINDOWS\system32\gebcb.dll Has been deleted!
Performing Repairs to the registry.
Done!
VundoFix V6.5.4
Checking Java version...
Java version is 1.4.2.3
Old versions of java are exploitable and should be removed.
Scan started at 10:50:53 PM 8/7/2007
Listing files found while scanning....
No infected files were found.
VundoFix V6.5.4
Checking Java version...
Java version is 1.4.2.3
Old versions of java are exploitable and should be removed.
Scan started at 5:29:54 PM 8/11/2007
Listing files found while scanning....
No infected files were found.
VundoFix V6.5.4
Checking Java version...
Java version is 1.4.2.3
Old versions of java are exploitable and should be removed.
Scan started at 12:15:13 AM 8/29/2007
Listing files found while scanning....
C:\WINDOWS\system32\geebx.dll
C:\WINDOWS\system32\xbeeg.bak1
C:\WINDOWS\system32\xbeeg.bak2
C:\WINDOWS\system32\xbeeg.ini
Beginning removal...
Attempting to delete C:\WINDOWS\system32\geebx.dll
C:\WINDOWS\system32\geebx.dll Could not be deleted.
Attempting to delete C:\WINDOWS\system32\xbeeg.bak1
C:\WINDOWS\system32\xbeeg.bak1 Has been deleted!
Attempting to delete C:\WINDOWS\system32\xbeeg.bak2
C:\WINDOWS\system32\xbeeg.bak2 Has been deleted!
Attempting to delete C:\WINDOWS\system32\xbeeg.ini
C:\WINDOWS\system32\xbeeg.ini Has been deleted!
Performing Repairs to the registry.
Done!
Beginning removal...
Attempting to delete C:\WINDOWS\system32\geebx.dll
C:\WINDOWS\system32\geebx.dll Could not be deleted.
Attempting to delete C:\WINDOWS\system32\xbeeg.ini
C:\WINDOWS\system32\xbeeg.ini Has been deleted!
Performing Repairs to the registry.
Done!
VundoFix V6.5.4
Checking Java version...
Java version is 1.4.2.3
Old versions of java are exploitable and should be removed.
Scan started at 12:25:38 AM 8/29/2007
Listing files found while scanning....
C:\WINDOWS\system32\geebx.dll
C:\WINDOWS\system32\xbeeg.ini
Beginning removal...
Attempting to delete C:\WINDOWS\system32\geebx.dll
C:\WINDOWS\system32\geebx.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\xbeeg.ini
C:\WINDOWS\system32\xbeeg.ini Has been deleted!
Performing Repairs to the registry.
Done!
VundoFix V6.5.4
Checking Java version...
Java version is 1.4.2.3
Old versions of java are exploitable and should be removed.
Scan started at 12:32:28 AM 8/29/2007
Listing files found while scanning....
No infected files were found.
and the combofix log file
ComboFix 07-08-29.2 - "ABHILASH" 2007-08-29 1:14:37.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1516 [GMT -7:00]
* Created a new restore point
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
C:\DOCUME~1\ABHILASH\MYDOCU~1\fnts~1
C:\DOCUME~1\ABHILASH\STARTM~1\Programs\Outerinfo
C:\Program Files\ipwindows
C:\Program Files\Online Services\merozegeq4444.dll
C:\Program Files\pppatc~1
C:\Program Files\Trend Micro\HijackThis\backups\backup-20070826-105958-627.dll
C:\Program Files\Windows Plus\qudas.dll
C:\Program Files\Windows Plus\qudas428.dll
C:\Program Files\wnsxs~1
C:\Program Files\ymante~1
C:\Temp\1cb
C:\Temp\1cb\syscheck.log
C:\Temp\fse
C:\Temp\fse\tmpZTF.log
C:\WINDOWS\cookies.ini
C:\WINDOWS\curity~1
C:\WINDOWS\icroso~1
C:\WINDOWS\racle~1
C:\WINDOWS\racle~1\?racle\
C:\WINDOWS\system32\awvvt.dll
C:\WINDOWS\system32\configs
C:\WINDOWS\system32\driver
C:\WINDOWS\system32\driver\w717.exe
C:\WINDOWS\system32\f02WtR
C:\WINDOWS\system32\F2
C:\WINDOWS\system32\F3
C:\WINDOWS\system32\flayqwwd.dll
C:\WINDOWS\system32\ggjlm.bak1
C:\WINDOWS\system32\ggjlm.bak2
C:\WINDOWS\system32\ggjlm.ini
C:\WINDOWS\system32\ggjlm.ini2
C:\WINDOWS\system32\ggjlm.tmp
C:\WINDOWS\system32\hjkmp.bak1
C:\WINDOWS\system32\hjkmp.ini
C:\WINDOWS\system32\mednolby.ini
C:\WINDOWS\system32\msnav32.ax
C:\WINDOWS\system32\opnllml.dll
C:\WINDOWS\system32\pmnkhfe.dll
C:\WINDOWS\system32\smpi1
C:\WINDOWS\system32\srutv.bak1
C:\WINDOWS\system32\srutv.bak2
C:\WINDOWS\system32\srutv.ini
C:\WINDOWS\system32\T3
C:\WINDOWS\system32\T4
C:\WINDOWS\system32\T6
C:\WINDOWS\system32\tvvwa.bak1
C:\WINDOWS\system32\tvvwa.ini
C:\WINDOWS\system32\utstv.bak1
C:\WINDOWS\system32\utstv.bak2
C:\WINDOWS\system32\utstv.ini
C:\WINDOWS\system32\vvhrhkru.exe
C:\WINDOWS\system32\wapisvtr32.exe
C:\WINDOWS\system32\yblondem.dll
C:\WINDOWS\tk58.exe
C:\WINDOWS\wr.txt
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
-------\LEGACY_CORE
-------\LEGACY_DOMAINSERVICE
-------\DomainService
((((((((((((((((((((((((( Files Created from 2007-07-28 to 2007-08-29 )))))))))))))))))))))))))))))))
2007-08-29 01:09 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-08-27 21:58 <DIR> d-------- C:\Program Files\Alcohol Soft
2007-08-27 21:49 <DIR> d-------- C:\WINDOWS\Easy DVD Copy
2007-08-27 21:49 <DIR> d-------- C:\Program Files\Easy DVD Copy
2007-08-26 00:35 94,263 --a------ C:\WINDOWS\DLA.EXE
2007-08-26 00:35 89,456 --a------ C:\WINDOWS\system32\drivers\DRVMCDB.SYS
2007-08-26 00:35 61,500 --a------ C:\WINDOWS\system32\DLAAPI_W.DLL
2007-08-26 00:35 5,660 --a------ C:\WINDOWS\system32\drivers\DLACDBHM.SYS
2007-08-26 00:35 40,544 --a------ C:\WINDOWS\system32\drivers\DRVNDDM.SYS
2007-08-26 00:35 22,684 --a------ C:\WINDOWS\system32\drivers\DLARTL_N.SYS
2007-08-25 14:00 5,600 --a------ C:\WINDOWS\system\winaspi.dll
2007-08-25 14:00 45,056 --a------ C:\WINDOWS\system32\wnaspi32.dll
2007-08-25 14:00 4,672 --a------ C:\WINDOWS\system\wowpost.exe
2007-08-25 14:00 25,244 --a------ C:\WINDOWS\system32\drivers\aspi32.sys
2007-08-25 13:26 <DIR> d-------- C:\Program Files\DAEMON Tools
2007-08-25 08:51 1,628,497 --ahs---- C:\WINDOWS\system32\abadd.bak2
2007-08-25 08:48 685,816 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2007-08-24 08:07 <DIR> d-------- C:\Program Files\Common Files\NSV
2007-08-23 21:47 6,473 --ahs---- C:\WINDOWS\system32\abadd.bak1
2007-08-23 20:28 6,855 --ahs---- C:\WINDOWS\system32\wycdd.bak2
2007-08-23 20:28 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\eFax Messenger 4.3 Output
2007-08-23 20:28 <DIR> d-------- C:\DOCUME~1\ABHILASH\APPLIC~1\eFax Messenger
2007-08-23 20:27 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\eFax Messenger 4.3 Setup
2007-08-23 20:26 <DIR> d-------- C:\Program Files\eFax Messenger 4.3
2007-08-23 03:11 6,473 --ahs---- C:\WINDOWS\system32\aybeg.bak1
2007-08-22 23:48 6,473 --ahs---- C:\WINDOWS\system32\kjjlm.bak1
2007-08-22 22:19 6,513 --ahs---- C:\WINDOWS\system32\xbadd.bak1
2007-08-22 20:33 6,513 --ahs---- C:\WINDOWS\system32\cbeeg.bak1
2007-08-22 19:20 6,473 --ahs---- C:\WINDOWS\system32\efhkj.bak1
2007-08-22 07:27 6,473 --ahs---- C:\WINDOWS\system32\rtstv.bak1
2007-08-22 01:04 6,473 --ahs---- C:\WINDOWS\system32\cdeeg.bak2
2007-08-21 23:14 6,513 --ahs---- C:\WINDOWS\system32\jmllm.bak1
2007-08-21 22:02 6,513 --ahs---- C:\WINDOWS\system32\bccdd.bak1
2007-08-21 20:08 6,473 --ahs---- C:\WINDOWS\system32\abeeg.bak1
2007-08-21 08:56 6,473 --ahs---- C:\WINDOWS\system32\cdeeg.bak1
2007-08-18 08:13 <DIR> d-------- C:\Program Files\Winamp
2007-08-18 04:19 6,473 --a------ C:\WINDOWS\system32\wycdd.bak1.ren
2007-08-18 04:19 298,080 --a------ C:\WINDOWS\system32\ddcyw.dll.ren
2007-08-18 04:19 29,683 --a------ C:\WINDOWS\system32\wycdd.ini.ren
2007-08-17 20:35 6,473 --ahs---- C:\WINDOWS\system32\ttstv.bak1
2007-08-17 20:30 31,254 --a------ C:\WINDOWS\system32\iifcbyw.dll.ren
2007-08-17 20:30 <DIR> d-------- C:\WINDOWS\system32\ICM3
2007-08-17 20:30 <DIR> d-------- C:\WINDOWS\system32\CC1
2007-08-17 20:30 <DIR> d-------- C:\WINDOWS\system32\bgfig5
2007-08-15 03:04 <DIR> d-------- C:\Program Files\MSXML 6.0
2007-08-11 23:01 <DIR> d-a------ C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
2007-08-11 23:00 77,312 --a------ C:\WINDOWS\system32\ztvunace26.dll
2007-08-11 23:00 75,264 --a------ C:\WINDOWS\system32\unacev2.dll
2007-08-11 23:00 69,632 --a------ C:\WINDOWS\system32\ztvcabinet.dll
2007-08-11 23:00 162,304 --a------ C:\WINDOWS\system32\ztvunrar36.dll
2007-08-11 23:00 153,088 --a------ C:\WINDOWS\system32\UNRAR3.dll
2007-08-11 23:00 <DIR> d-------- C:\Program Files\Trojan Remover
2007-08-11 23:00 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Simply Super Software
2007-08-11 23:00 <DIR> d-------- C:\DOCUME~1\ABHILASH\APPLIC~1\Simply Super Software
2007-08-11 22:52 9,593 --a------ C:\WINDOWS\system32\gfhkj.ini.ren
2007-08-11 22:52 6,421 --a------ C:\WINDOWS\system32\gfhkj.bak1.ren
2007-08-11 22:52 231,520 --a------ C:\WINDOWS\system32\jkhfg.dll.ren
2007-08-11 17:33 7,120 --a------ C:\WINDOWS\system32\mmllm.ini.ren
2007-08-11 17:33 6,421 --a------ C:\WINDOWS\system32\mmllm.bak1.ren
2007-08-11 16:49 69,184 --a------ C:\WINDOWS\system32\fdnqxkev.dll.ren
2007-08-11 03:30 6,461 --ahs---- C:\WINDOWS\system32\vyadd.bak1
2007-08-11 01:44 6,421 --ahs---- C:\WINDOWS\system32\jlnmp.bak1
2007-08-11 00:10 6,461 --ahs---- C:\WINDOWS\system32\fhkmp.bak1
2007-08-09 08:42 6,531 --a------ C:\WINDOWS\system32\jmllm.ini.ren
2007-08-09 08:42 6,461 --a------ C:\WINDOWS\system32\jmllm.bak1.ren
2007-08-09 07:18 6,421 --ahs---- C:\WINDOWS\system32\orqss.bak1
2007-08-08 22:39 6,461 --ahs---- C:\WINDOWS\system32\prqss.bak1
2007-08-08 21:01 6,513 --ahs---- C:\WINDOWS\system32\tttss.bak1
2007-08-08 19:41 6,421 --ahs---- C:\WINDOWS\system32\rstwa.bak1
2007-08-07 23:35 6,461 --ahs---- C:\WINDOWS\system32\yybeg.bak1
2007-08-07 22:07 6,421 --ahs---- C:\WINDOWS\system32\ghhkj.bak1
2007-08-07 20:13 6,421 --ahs---- C:\WINDOWS\system32\ttvwa.bak1
2007-08-04 21:55 69,184 --a------ C:\WINDOWS\system32\akkjvdfq.dll.ren
2007-08-04 07:37 31,254 --a------ C:\WINDOWS\system32\tuvtrpn.dll.ren
2007-08-02 07:35 <DIR> d-------- C:\WinZix
2007-08-02 07:35 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\LICENSE FORD HOPE DRAW
2007-08-02 07:35 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Face error funk license
2007-07-31 22:49 <DIR> d-------- C:\Program Files\Netflix
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
2007-08-29 01:20 --------- d-------- C:\Program Files\Windows Plus
2007-08-29 00:53 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-08-27 22:05 --------- d-------- C:\Program Files\dvdSanta
2007-08-26 00:35 --------- d-------- C:\Program Files\Roxio
2007-08-23 20:36 --------- d-------- C:\DOCUME~1\ABHILASH\APPLIC~1\OpenOffice.org2
2007-08-23 20:32 56 -r-hs---- C:\WINDOWS\system32\9E04DCDE50.sys
2007-08-23 20:32 4288 --ahs---- C:\WINDOWS\system32\KGyGaAvL.sys
2007-08-16 20:55 --------- d-------- C:\Program Files\DivX
2007-08-12 01:42 --------- d-------- C:\Program Files\Common Files\Sonic Shared
2007-08-12 01:42 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sonic
2007-08-12 01:41 --------- d-------- C:\Program Files\Sonic
2007-08-12 01:40 --------- d-------- C:\Program Files\Dell
2007-08-11 22:50 --------- d-------- C:\DOCUME~1\ABHILASH\APPLIC~1\Corel
2007-07-30 19:19 92504 --a------ C:\WINDOWS\system32\dllcache\cdm.dll
2007-07-30 19:19 92504 --a------ C:\WINDOWS\system32\cdm.dll
2007-07-30 19:19 549720 --a------ C:\WINDOWS\system32\wuapi.dll
2007-07-30 19:19 549720 --a------ C:\WINDOWS\system32\dllcache\wuapi.dll
2007-07-30 19:19 53080 --a------ C:\WINDOWS\system32\wuauclt.exe
2007-07-30 19:19 53080 --a------ C:\WINDOWS\system32\dllcache\wuauclt.exe
2007-07-30 19:19 43352 --a------ C:\WINDOWS\system32\wups2.dll
2007-07-30 19:19 325976 --a------ C:\WINDOWS\system32\wucltui.dll
2007-07-30 19:19 325976 --a------ C:\WINDOWS\system32\dllcache\wucltui.dll
2007-07-30 19:19 271224 --a------ C:\WINDOWS\system32\mucltui.dll
2007-07-30 19:19 207736 --a------ C:\WINDOWS\system32\muweb.dll
2007-07-30 19:19 203096 --a------ C:\WINDOWS\system32\wuweb.dll
2007-07-30 19:19 203096 --a------ C:\WINDOWS\system32\dllcache\wuweb.dll
2007-07-30 19:19 1712984 --a------ C:\WINDOWS\system32\wuaueng.dll
2007-07-30 19:19 1712984 --a------ C:\WINDOWS\system32\dllcache\wuaueng.dll
2007-07-30 19:18 33624 --a------ C:\WINDOWS\system32\wups.dll
2007-07-30 19:18 33624 --a------ C:\WINDOWS\system32\dllcache\wups.dll
2007-07-26 16:06 524288 --a------ C:\WINDOWS\system32\DivXsm.exe
2007-07-26 16:06 3596288 --a------ C:\WINDOWS\system32\qt-dx331.dll
2007-07-26 16:06 200704 --a------ C:\WINDOWS\system32\ssldivx.dll
2007-07-26 16:06 144704 --a------ C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2007-07-26 16:06 129784 --a------ C:\WINDOWS\system32\pxafs.dll
2007-07-26 16:06 118520 --a------ C:\WINDOWS\system32\pxinsi64.exe
2007-07-26 16:06 1044480 --a------ C:\WINDOWS\system32\libdivx.dll
2007-07-26 16:03 823296 --a------ C:\WINDOWS\system32\divx_xx0c.dll
2007-07-26 16:03 823296 --a------ C:\WINDOWS\system32\divx_xx07.dll
2007-07-26 16:03 81920 --a------ C:\WINDOWS\system32\dpl100.dll
2007-07-26 16:03 802816 --a------ C:\WINDOWS\system32\divx_xx11.dll
2007-07-26 16:03 740442 --a------ C:\WINDOWS\system32\DivX.dll
2007-07-26 16:03 593920 --a------ C:\WINDOWS\system32\dpuGUI11.dll
2007-07-26 16:03 57344 --a------ C:\WINDOWS\system32\dpv11.dll
2007-07-26 16:03 53248 --a------ C:\WINDOWS\system32\dpuGUI10.dll
2007-07-26 16:03 344064 --a------ C:\WINDOWS\system32\dpus11.dll
2007-07-26 16:03 294912 --a------ C:\WINDOWS\system32\dpu11.dll
2007-07-26 16:03 294912 --a------ C:\WINDOWS\system32\dpu10.dll
2007-07-26 16:03 196608 --a------ C:\WINDOWS\system32\dtu100.dll
2007-07-26 16:03 12288 --a------ C:\WINDOWS\system32\DivXWMPExtType.dll
2007-07-18 23:59 3583488 --a------ C:\WINDOWS\system32\dllcache\mshtml.dll
2007-07-12 16:31 765952 --a------ C:\WINDOWS\system32\dllcache\vgx.dll
2007-07-08 18:17 --------- d-------- C:\Program Files\Common Files\Autodesk Shared
2007-07-08 18:17 --------- d-------- C:\Program Files\AutoCAD 2005
2007-07-08 18:04 --------- d--h----- C:\Program Files\InstallShield Installation Information
2007-07-08 17:55 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Autodesk
2007-07-08 11:41 --------- d-------- C:\Program Files\Windows Defender
2007-07-08 10:43 --------- d-------- C:\Program Files\Lavasoft
2007-07-08 10:43 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-07-08 10:42 --------- d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-07-08 10:33 --------- d-------- C:\Program Files\CCleaner
2007-07-07 21:16 --------- d-------- C:\Program Files\Trend Micro
2007-07-07 21:03 --------- d-------- C:\Program Files\Microsoft Windows OneCare Live
2007-07-07 20:29 --------- d-------- C:\Program Files\Reference Assemblies
2007-06-27 07:34 823808 --a------ C:\WINDOWS\system32\dllcache\wininet.dll
2007-06-27 07:34 671232 --a------ C:\WINDOWS\system32\dllcache\mstime.dll
2007-06-27 07:34 6058496 --------- C:\WINDOWS\system32\dllcache\ieframe.dll
2007-06-27 07:34 52224 --------- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2007-06-27 07:34 477696 --a------ C:\WINDOWS\system32\dllcache\mshtmled.dll
2007-06-27 07:34 459264 --------- C:\WINDOWS\system32\dllcache\msfeeds.dll
2007-06-27 07:34 44544 --------- C:\WINDOWS\system32\dllcache\iernonce.dll
2007-06-27 07:34 384512 --------- C:\WINDOWS\system32\dllcache\iedkcs32.dll
2007-06-27 07:34 383488 --------- C:\WINDOWS\system32\dllcache\ieapfltr.dll
2007-06-27 07:34 27648 --a------ C:\WINDOWS\system32\dllcache\jsproxy.dll
2007-06-27 07:34 267776 --------- C:\WINDOWS\system32\dllcache\iertutil.dll
2007-06-27 07:34 232960 --------- C:\WINDOWS\system32\dllcache\webcheck.dll
2007-06-27 07:34 230400 --------- C:\WINDOWS\system32\dllcache\ieaksie.dll
2007-06-27 07:34 193024 --a------ C:\WINDOWS\system32\dllcache\msrating.dll
2007-06-27 07:34 153088 --------- C:\WINDOWS\system32\dllcache\ieakeng.dll
2007-06-27 07:34 132608 --a------ C:\WINDOWS\system32\dllcache\extmgr.dll
2007-06-27 07:34 124928 --------- C:\WINDOWS\system32\dllcache\advpack.dll
2007-06-27 07:34 1152000 --a------ C:\WINDOWS\system32\dllcache\urlmon.dll
2007-06-27 07:34 105984 --------- C:\WINDOWS\system32\dllcache\url.dll
2007-06-27 07:34 102400 --------- C:\WINDOWS\system32\dllcache\occache.dll
2007-06-27 01:27 63488 --------- C:\WINDOWS\system32\dllcache\ie4uinit.exe
2007-06-27 01:27 625152 --------- C:\WINDOWS\system32\dllcache\iexplore.exe
2007-06-27 01:27 13824 --------- C:\WINDOWS\system32\dllcache\ieudinit.exe
2007-06-27 00:00 161792 --------- C:\WINDOWS\system32\dllcache\ieakui.dll
2007-06-25 23:08 1104896 --a------ C:\WINDOWS\system32\msxml3.dll
2007-06-25 23:08 1104896 --------- C:\WINDOWS\system32\dllcache\msxml3.dll
2007-06-19 06:31 282112 --a------ C:\WINDOWS\system32\gdi32.dll
2007-06-19 06:31 282112 --------- C:\WINDOWS\system32\dllcache\gdi32.dll
2007-06-13 03:23 1033216 --a------ C:\WINDOWS\explorer.exe
2007-06-13 03:23 1033216 --------- C:\WINDOWS\system32\dllcache\explorer.exe
2007-03-22 12:57:59 88 --sh--r C:\WINDOWS\system32\50DEDC049E.sys
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SetDefPrt"="C:\Program Files\Brother\Brmfl04b\BrStDvPt.exe" [2004-05-25 07:16]
"ControlCenter2.0"="C:\Program Files\Brother\ControlCenter2\brctrcen.exe" [2004-07-20 07:34]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-07-23 08:54]
"D-Link Air USB Utility"="C:\Program Files\D-Link\Air USB Utility\AirCFG.exe" [2003-05-26 15:44]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-07-26 16:41]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 02:25]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20]
"ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 07:44]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 07:44]
"VoiceCenter"="C:\Program Files\Creative\VoiceCenter\AndreaVC.exe" [2005-09-19 04:42]
"TrojanScanner"="C:\Program Files\Trojan Remover\Trjscan.exe" [2007-08-11 20:11]
"DMXLauncher"="C:\Program Files\Sonic\Product\Media Experience\DMXLauncher.exe" [2007-04-02 05:24]
"eFax 4.3"="C:\Program Files\eFax Messenger 4.3\J2GDllCmd.exe" [2007-03-06 10:21]
"DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2006-09-21 05:20]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 02:00]
"Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [2007-06-11 18:16]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-08-22 05:06]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"=C:\WINDOWS\Resources\Themes\Royale.theme
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^ABHILASH^Start Menu^Programs^Startup^OpenOffice.org 2.1.lnk]
path=C:\Documents and Settings\ABHILASH\Start Menu\Programs\Startup\OpenOffice.org 2.1.lnk
backup=C:\WINDOWS\pss\OpenOffice.org 2.1.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^AutoCAD Startup Accelerator.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\AutoCAD Startup Accelerator.lnk
backup=C:\WINDOWS\pss\AutoCAD Startup Accelerator.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
backup=C:\WINDOWS\pss\Digital Line Detect.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
"C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Creative Detector]
"C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTSysVol]
C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]
"C:\Program Files\Dell Support\DSAgnt.exe" /startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DLA]
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DMXLauncher]
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EasyStudio_L]
"C:\Program Files\Samsung\Samsung PC Studio 3\Launcher.exe" -tray
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
C:\WINDOWS\ehome\ehtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
"C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]
C:\WINDOWS\system32\hkcmd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers]
C:\WINDOWS\system32\igfxpers.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray]
C:\WINDOWS\system32\igfxtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndexSearch]
C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
"C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
"C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MBMon]
Rundll32 CTMBHA.DLL,MBMon
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCAgentExe]
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCUpdateExe]
C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MimBoot]
C:\PROGRA~1\MUSICM~1\MUSICM~3\mimboot.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray]
"C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MPFExe]
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSKAGENTEXE]
C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSKDetectorExe]
C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Norton Ghost 10.0]
"C:\Program Files\Norton Ghost\Agent\GhostTray.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OASClnt]
C:\Program Files\McAfee.com\VSO\oasclnt.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PaperPort PTD]
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SetDefaultMIDI]
MIDIDef.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate]
"C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
C:\WINDOWS\UpdReg.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirusScan Online]
C:\Program Files\McAfee.com\VSO\mcvsshld.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VoiceCenter]
"C:\Program Files\Creative\VoiceCenter\AndreaVC.exe" /tray
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VSOCheckTask]
"C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
"C:\Program Files\Windows Defender\MSASCui.exe" -hide
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WindowsUpdate]
rundll32.exe "C:\WINDOWS\system32\wtelgjli.dll",realset
R2 NIOC;NIOC Service;\??\C:\WINDOWS\system32\NIOC.SYS
R2 WZCBDLService;WZCBDL Service;"C:\Program Files\WZCBDL Service\WZCBDLS.exe"
R2 XilinxPC4Driver;XilinxPC4Driver;C:\WINDOWS\system32\drivers\XPC4DRVR.SYS
R3 BrScnUsb;Brother USB Still Image driver;C:\WINDOWS\system32\Drivers\BrScnUsb.sys
R3 BrSerIf;Brother MFC Serial Port Interface WDM Driver;C:\WINDOWS\system32\Drivers\BrSerIf.sys
R3 BrUsbSer;Brother MFC USB Serial WDM Driver;C:\WINDOWS\system32\Drivers\BrUsbSer.sys
R3 PRISM_USB;D-Link Air DWL-122 Wireless USB Adapter Driver;C:\WINDOWS\system32\DRIVERS\PRISMUSB.sys
R3 sigfilt;sigfilt;C:\WINDOWS\system32\drivers\sigfilt.sys
R3 WinDriver6;WinDriver6;C:\WINDOWS\system32\drivers\windrvr6.sys
S3 ss_bus;Samsung Mobile USB Device 1.0 driver (WDM);C:\WINDOWS\system32\DRIVERS\ss_bus.sys
S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;C:\WINDOWS\system32\DRIVERS\ss_mdfl.sys
S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;C:\WINDOWS\system32\DRIVERS\ss_mdm.sys
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}]
AutoRun\command- E:\setup.exe
Contents of the 'Scheduled Tasks' folder
2007-06-14 14:20:46 C:\WINDOWS\Tasks\MP Scheduled Quick Scan.job - C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MpCmdRun.exe
2007-08-29 07:32:18 C:\WINDOWS\Tasks\MP Scheduled Scan.job - C:\Program Files\Windows Defender\MpCmdRun.exe
**************************************************************************
catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2007-08-29 01:27:14
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
C:\WINDOWS\WinSxS
C:\WINDOWS\WindowsShell.Manifest
C:\WINDOWS\WindowsUpdate.log
C:\WINDOWS\winhelp.exe
C:\WINDOWS\winhlp32.exe
C:\WINDOWS\wininit.ini
C:\WINDOWS\winnt.bmp
C:\WINDOWS\winnt256.bmp
C:\WINDOWS\WMSysPr9.prx
C:\WINDOWS\WORDPAD.INI
C:\WINDOWS\Zapotec.bmp
C:\WINDOWS\_default.pif
scan completed successfully
hidden files: 12
**************************************************************************
Completion time: 2007-08-29 1:29:11 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-08-29 01:29
--- E O F ---
Thanks again for the help
Unsolved 
pyware/Virtumonde Not disinfected C:\WINDOWS\system32\txvhogjc.dll 
Offline 
