Another Winbluesoft victim

Hi - I too am a victim of this miserable Winbluesoft thing. Initially I had the same problems as others in that it did not allow me to run anything to eliminate the virus, but reading posts I was able to knock out the Blocker.DLL . I subsequently ran MAlwarebytes anti malware and superantispyware. My PC is now nearly normal. However, the stupid splash screen is still stuck on my desktop and I figure ther might be a few things the antispyware could noit fix. Here is my HJ log
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:52:08, on 6/3/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\Drivers\trcboot.exe
C:\Program Files\IBM\Personal Communications\PCS_AGNT.EXE
C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\IBM\tivoli\dcd\client\ISSI\cds\CDSWinSrv.exe
C:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Executive Software\DiskeeperWorkstation\DKService.exe
C:\Program Files\C4ebreg\c4ebreg.exe
c:\sdwork\issimsvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\notes\ntmulti.exe
C:\PROGRA~1\AT&TNE~1\NetCfgSv.EXE
C:\WINDOWS\system32\cmd.exe
c:\Program Files\Symantec Client Security\Symantec AntiVirus\SavRoam.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe
C:\WINDOWS\System32\TPHDEXLG.EXE
C:\WINDOWS\system32\TpKmpSVC.exe
C:\WINDOWS\system32\Drivers\ldlcserv.exe
C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
C:\Program Files\IBM\tivoli\dcd\client\ISSI\_jvm\jre\bin\java.exe
C:\WINDOWS\system32\acs.exe
C:\Program Files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\SYMANT~2\SYMANT~2\VPTray.exe
C:\WINDOWS\system32\TpShocks.exe
C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe
C:\Program Files\IBM\Personal Communications\tpam.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Lenovo\PkgMgr\HOTKEY\TPONSCR.exe
C:\Program Files\Lenovo\PkgMgr\HOTKEY_1\TpScrex.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\ThinkPad\UltraNav Wizard\UNavTray.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\IBM\My Help\plugins\com.ibm.myhelp.common_1.4.19\pmonmh.exe
C:\Program Files\Lexmark X6100 Series\lxbfbmgr.exe
C:\Program Files\Lexmark X6100 Series\lxbfbmon.exe
C:\Program Files\C4ebreg\isamtray.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe
C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe
C:\Program Files\IBM\Infoprint Select\ipnotify.exe
C:\PROGRA~1\ThinkPad\BLUETO~1\BTSTAC~1.EXE
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\IBM\My Help\MyHelp.exe
C:\Program Files\IBM\My Help\jre\bin\myhelpw.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://w3.ibm.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://w3.ibm.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://w3.ibm.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.att.com:8000
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *ibm.com;
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.1125.0\msneshellx.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.1125.0\msneshellx.dll
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~2\SYMANT~2\VPTray.exe
O4 - HKLM\..\Run: [TpShocks] TpShocks.exe
O4 - HKLM\..\Run: [TPKMAPHELPER] C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - HKLM\..\Run: [Tpam.exe] "C:\Program Files\IBM\Personal Communications\tpam.exe"
O4 - HKLM\..\Run: [TP4EX] tp4ex.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [stgclean] c:\sdwork\w32main2.exe /cleanup
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [PWRMGRTR] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL,PwrMgrBkGndMonitor
O4 - HKLM\..\Run: [PSQLLauncher] "C:\Program Files\Thinkvantage Fingerprint Software\launcher.exe" /startup
O4 - HKLM\..\Run: [pmonmh] C:\Program Files\IBM\My Help\plugins\\com.ibm.myhelp.common_1.4.19/pmonmh.exe
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [MyHelpService] C:\Program Files\IBM\My Help\workspace\service\delayStart.exe
O4 - HKLM\..\Run: [Microsoft Default Manager] "C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume
O4 - HKLM\..\Run: [Lexmark X6100 Series] "C:\Program Files\Lexmark X6100 Series\lxbfbmgr.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [ISSI Service] "c:\sdwork\issimsvc.exe"
O4 - HKLM\..\Run: [ISAMTray] "C:\Program Files\C4ebreg\isamtray.exe"
O4 - HKLM\..\Run: [ISAM SMT Service] "C:\Program Files\C4ebreg\isamsmt.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [C4EBReg] "C:\Program Files\C4ebreg\c4ebreg.exe" /q
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [BLOG] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL,StartBattLog
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ACWLIcon] C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe
O4 - HKLM\..\Run: [ACTray] C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: Infoprint Select Notification.lnk = C:\Program Files\IBM\Infoprint Select\ipnotify.exe
O4 - Global Startup: Lotus QuickStart.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm

PART 2
O11 - Options group: [JAVA_IBM] Java (IBM)
O14 - IERESET.INF: START_PAGE_URL=http://w3.ibm.com
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=58813
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1121293151687
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1165851830953
O16 - DPF: {74FFE28D-2378-11D5-990C-006094235084} (IBM Access Support) - http://www-307.ibm.com/pc/support/IbmEgath.cab
O16 - DPF: {76E5AF9D-2B3E-4FEB-A31F-A9E63A27FA29} (IASRunner Class) - https://www-307.ibm.com/pc/support/access/aslibmain/content/AcpIR.cab
O16 - DPF: {9519B2A2-6592-4E41-8290-D0298459270C} (LNWebAssist Class) - http://w3.ibm.com/bluepages/scripts/lnwebassist.cab
O16 - DPF: {A4B28810-11A2-4956-82D1-B2DCBA4B2AFD} (gpwsx.plugin) - http://w3.ibm.com/tools/print/plugin/gpwsx.cab
O16 - DPF: {CAD4ADEB-C52B-4E83-A7D1-9C75E022ECCC} (Unyte Conferencing Plugin) - https://ds.conferenceservers.com/components/WDPLUGIN.CAB
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = worchester.ibm.com
O17 - HKLM\Software\..\Telephony: DomainName = worchester.ibm.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = worchester.ibm.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = IBM.COM
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = IBM.COM
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: ACNotify - ACNotify.dll (file missing)
O23 - Service: Ac Profile Manager Service (AcPrfMgrSvc) - Unknown owner - C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
O23 - Service: ACU Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe
O23 - Service: Access Connections Main Service (AcSvc) - Lenovo - C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
O23 - Service: AppnNode - IBM Corporation - C:\WINDOWS\system32\Drivers\appnnode.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: IBM DCD Standard Client (DCDClient-ISSI) (DCDClient-ISSI) - Unknown owner - C:\Program Files\IBM\tivoli\dcd\client\ISSI\cds\CDSWinSrv.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\DiskeeperWorkstation\DKService.exe
O23 - Service: ThinkPad PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\system32\ibmpmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: ISAM SMT Service (ISAMsmt) - Unknown owner - C:\Program Files\C4ebreg\isamsmt.exe (file missing)
O23 - Service: IBM Standard Asset Manager Service (ISAMSvc) - IBM Corp. - C:\Program Files\C4ebreg\c4ebreg.exe
O23 - Service: ISSI (ISSIMon) - IBM Corp. - c:\sdwork\issimsvc.exe
O23 - Service: IS Service (ISSVC) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: IBM Enterprise Extender (ldlcserv) - IBM Corporation - C:\WINDOWS\system32\Drivers\ldlcserv.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Multi-user Cleanup Service - IBM Corp - C:\notes\ntmulti.exe
O23 - Service: Network Configuration Service (NetCfgSvr) - AT&T - C:\PROGRA~1\AT&TNE~1\NetCfgSv.EXE
O23 - Service: SAVRoam (SavRoam) - symantec - c:\Program Files\Symantec Client Security\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: SSDP Discovery Service SSDPSRVISSIMon (SSDPSRVISSIMon) - Unknown owner - C:\WINDOWS\system32\aaaamonc.exe (file missing)
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Symantec SecurePort (SymSecurePort) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe
O23 - Service: ThinkPad HDD APS Logging Service (TPHDEXLGSVC) - Lenovo. - C:\WINDOWS\System32\TPHDEXLG.EXE
O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe
O23 - Service: IBM Trace Facility (TrcBoot) - IBM Corporation - C:\WINDOWS\system32\Drivers\trcboot.exe[u]

ok here is the log for Combofix and things are looking quite normal!
ComboFix 09-06-03.01 - meckhard 06/03/2009 16:47.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2038.1444 [GMT -4:00]
Running from: c:\documents and settings\Administrator\Desktop\Combo-Fix.exe
AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}
FW: Symantec Client Firewall *disabled* {5CB76A43-5FAD-476B-B9FF-26FA61F13187}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Autorun.inf
c:\documents and settings\All Users\Start Menu\Internet Explorer.lnk
c:\windows\10409hackto5ze59.exe
c:\windows\1049thzef32555.dll
c:\windows\1057n5z-a-vir9s428.ocx
c:\windows\10604not-a-z9r5s78a.dll
c:\windows\107z1s953d0.exe
c:\windows\10845v9rus5aez.cpl
c:\windows\1090backdo5926z6.exe
c:\windows\10z10not-9-virus5275.dll
c:\windows\11345not-a9virus4z5.bin
c:\windows\11721notz5-vi9us594.bin
c:\windows\1190virusza05.dll
c:\windows\11958hazktool1ac.exe
c:\windows\12019zr9j795.exe
c:\windows\125569roj4z0.bin
c:\windows\12d7ad5warz1689.exe
c:\windows\134355ot-a-viz9s10c.ocx
c:\windows\13735wor9z6a.bin
c:\windows\13831vi9u51z0.exe
c:\windows\1397ste5l2785z.bin
c:\windows\1435zworm559.cpl
c:\windows\14395iz2993.ocx
c:\windows\1448thre5t12093z.cpl
c:\windows\14598sp9z9f.cpl
c:\windows\14759wzr91e5.cpl
c:\windows\14899not5a-vzrus678.exe
c:\windows\14e0addwarz569.dll
c:\windows\1519zp5238.cpl
c:\windows\15457spz9b0.dll
c:\windows\154z95irus93c.ocx
c:\windows\15534noz9a-v5rus91.dll
c:\windows\15595szy9c.ocx
c:\windows\15797h5cktozl990.exe
c:\windows\157zteal1937.exe
c:\windows\15932wzrm39c.exe
c:\windows\15984spambo93zd.cpl
c:\windows\15994spy56z.cpl
c:\windows\15e4spzrse22789.exe
c:\windows\160z9viru56829.ocx
c:\windows\1694z9or5403.exe
c:\windows\170955orm5ez.bin
c:\windows\1710ztro92355.ocx
c:\windows\1713z9pambot2d95.bin
c:\windows\17395spambo57z9.cpl
c:\windows\17709not-z5virus1cc.bin
c:\windows\17858vi9zs542.dll
c:\windows\18365sp9223z.cpl
c:\windows\18649s5yz6.exe
c:\windows\188615oz-a-vir9s2dc.exe
c:\windows\18960spamzot4355.exe
c:\windows\18f4a5dwar9z325.exe
c:\windows\19262hackto9510z.cpl
c:\windows\19300n9t-a-5irus208z.exe
c:\windows\1935zspy370.dll
c:\windows\1939zw5rm2dd.ocx
c:\windows\19459z59m524.exe
c:\windows\19585hzck5ool2a49.cpl
c:\windows\195es5arse1722z.bin
c:\windows\1961azdware5419.ocx
c:\windows\19654v5rus603z.dll
c:\windows\19655hz5ktool7f5.dll
c:\windows\197bd5wn9oadzr2015.exe
c:\windows\1985spyz30.bin
c:\windows\1990zha5ktool53b.ocx
c:\windows\19ze9pywa5e874.bin
c:\windows\1a21sp9rsz28905.cpl
c:\windows\1b36z59ware467.dll
c:\windows\1c86th5eatz8569.exe
c:\windows\1d89downzo5der10579.dll
c:\windows\1d9fdow5loade92658z.cpl
c:\windows\1df0addza591025.bin
c:\windows\1z169sp5mb9t323.ocx
c:\windows\1z476spy4915.dll
c:\windows\2016do9n5ozder515.ocx
c:\windows\20527spambo9z54.cpl
c:\windows\2064tro5zf39.dll
c:\windows\20681no9-a-viruz27a5.dll
c:\windows\206zste5l2319.exe
c:\windows\208fbac5door1397z.ocx
c:\windows\21179t5ojz4d.ocx
c:\windows\21258wo9m5zc.exe
c:\windows\21269zorm551.exe
c:\windows\21589h5cktool531z.bin
c:\windows\22529hack9ool5cz.bin
c:\windows\22eeba95door3z90.cpl
c:\windows\23562troj4z79.exe
c:\windows\2359nzt-a-9irus66e.bin
c:\windows\237zv591512.cpl
c:\windows\23918not5a-viruz437.ocx
c:\windows\24115not-z-viru5956.bin
c:\windows\242925ot-a9virus23z.dll
c:\windows\2433659tza-virus6ed.dll
c:\windows\2446addzare9540.cpl
c:\windows\246addwzr927125.dll
c:\windows\24720not-5-vizus9a6.bin
c:\windows\24z69wo9m365.dll
c:\windows\25185zroj759.cpl
c:\windows\2569s5yware122z.cpl
c:\windows\25783spyz279.ocx
c:\windows\25e1s9eaz3136.dll
c:\windows\25z85not-a-v5rus988.bin
c:\windows\26694not-59virzs4ce.dll
c:\windows\26859wozm457.exe
c:\windows\2685downloa9zr5800.exe
c:\windows\2686zv5rus965.ocx
c:\windows\26896z5y599.ocx
c:\windows\268down5oadez949.exe
c:\windows\26d09pyzare18505.cpl
c:\windows\26z85hackt9ol451.dll
c:\windows\27095vz5uscd.ocx
c:\windows\271559roj1bz.cpl
c:\windows\27425zorm9f8.ocx
c:\windows\2759spy5are14z.exe
c:\windows\275thiefz559.dll
c:\windows\282405ot-a-vir9sz80.ocx
c:\windows\28999tr5jzc3.bin
c:\windows\28z275py2cc9.bin
c:\windows\29023hackto9l45z.dll
c:\windows\29254zot-a-virus7169.bin
c:\windows\2937hack5oolz55.cpl
c:\windows\29507sz912d.ocx
c:\windows\29918vi5us95z.ocx
c:\windows\299959orz7ff.bin
c:\windows\29c1thr9at275z05.dll
c:\windows\2a15zddware99.exe
c:\windows\2a59vi91z98.dll
c:\windows\2cb9thze5439.cpl
c:\windows\2d55backdoorz95.bin
c:\windows\2e7dsp5z9e1981.bin
c:\windows\2z39hi5f372.exe
c:\windows\2z906w95m659.cpl
c:\windows\30258zroj59c.cpl
c:\windows\303z8sp5998.cpl
c:\windows\305baddwarez8995.exe
c:\windows\3095spywzre2790.dll
c:\windows\31285wormz9.exe
c:\windows\3131zot-9-5irus797.cpl
c:\windows\315985pyz19.exe
c:\windows\31747ha5ktool19z.dll
c:\windows\3195s9arse1420z.ocx
c:\windows\31965s5y69bz.ocx
c:\windows\31z5thief3092.cpl
c:\windows\32229woz5769.exe
c:\windows\322zd5wnloader2954.dll
c:\windows\32759virus54az.bin
c:\windows\3303b9ckd5or3z95.dll
c:\windows\33ebsparse9z5.dll
c:\windows\33z9worm185.cpl
c:\windows\3409oz5502.ocx
c:\windows\345zback9oor1928.exe
c:\windows\34f1b5ckdoor69z.exe
c:\windows\350zvirus693.cpl
c:\windows\3544tro97z75.cpl
c:\windows\3562d5wn9oadez992.bin
c:\windows\3593ste9lz834.cpl
c:\windows\35c0t9zeat13592.exe
c:\windows\3802sp9wzr53015.bin
c:\windows\3815za59door956.exe
c:\windows\38d9thzef29925.dll
c:\windows\39057spy4ze.exe
c:\windows\39554wormz59.ocx
c:\windows\398zspa5se873.ocx
c:\windows\39b4vi95816z.bin
c:\windows\39d7vi51z4.exe
c:\windows\39d8spz9se2795.cpl
c:\windows\3ac8vzr1995.exe
c:\windows\3af5ste9l314z.dll
c:\windows\3bef59r129z.exe
c:\windows\3c955tzal2679.ocx
c:\windows\3ca89a5kdoor2z44.ocx
c:\windows\3cz8ste9l395.ocx
c:\windows\3d0edow9loadez2975.ocx
c:\windows\3e915ddzare58.cpl
c:\windows\3fbcdo5nloaze9460.dll
c:\windows\3z0455pamb9t592.cpl
c:\windows\3z5d9teal571.bin
c:\windows\404zth5e9189.dll
c:\windows\40815pz38a9.exe
c:\windows\41795pywzre2296.cpl
c:\windows\43z6spyware1509.ocx
c:\windows\43z95orm6ab.exe
c:\windows\44a9vir205z.exe
c:\windows\456bstealz095.ocx
c:\windows\458bszar9e815.dll
c:\windows\4592stealz945.bin
c:\windows\45a25zeal15469.exe
c:\windows\467e9azkdoor5264.bin
c:\windows\4788do5nloa9erz633.cpl
c:\windows\484et9ief5348z.bin
c:\windows\48559hreat9129z.ocx
c:\windows\492zbac5door677.bin
c:\windows\49z3a5dware1331.bin
c:\windows\49z9addwar51820.cpl
c:\windows\4a79b9ckzoor1557.exe
c:\windows\4b5azpywa5e94.bin
c:\windows\4becbaczd5or9001.bin
c:\windows\4dz2d9wnloader517.bin
c:\windows\4e53spy9zre24.exe
c:\windows\4f3fbzck9oor945.bin
c:\windows\4fad5warez99.ocx
c:\windows\4zees9eal1745.bin
c:\windows\50790zp9368.ocx
c:\windows\509tzief3079.bin
c:\windows\50z40sp9316.dll
c:\windows\5109st5a9541z.bin
c:\windows\52024spy2z9.bin
c:\windows\5204z5y985.dll
c:\windows\5238do9nzoad5r1856.dll
c:\windows\5319steal3175z.exe
c:\windows\5368spz9are2979.cpl
c:\windows\5397zir641.exe
c:\windows\53dcspa9se200z.exe
c:\windows\53z0add9are2559.exe
c:\windows\5429tr9z37c.bin
c:\windows\542aspzrse9859.dll
c:\windows\546czackdoor24529.ocx
c:\windows\5520sparsz928.dll
c:\windows\5529thief5z5.exe
c:\windows\5598vir1949z.ocx
c:\windows\559bsparsz1261.ocx
c:\windows\55b8szeal9116.cpl
c:\windows\55z2s9eal578.cpl
c:\windows\56727zot-a-virus6e9.ocx
c:\windows\5793sp9rse305z.bin
c:\windows\5795h5cktozlf29.exe
c:\windows\57z5d9wnloader25845.exe
c:\windows\583downloa59r3052z.cpl
c:\windows\58934hzcktool98.dll
c:\windows\594z1troj69d.dll
c:\windows\5968s9zal1170.ocx
c:\windows\5999wormzc5.cpl
c:\windows\599addwaze548.ocx
c:\windows\59z3virus905.dll
c:\windows\59z5b9ckdoor2972.ocx
c:\windows\59z90spy7d5.cpl
c:\windows\5b65zhief359.dll
c:\windows\5c9zaddwa5e1355.exe
c:\windows\5d59acz5oor1769.ocx
c:\windows\5d87s9ez5511.ocx
c:\windows\5e0eba9kdoor12z1.ocx
c:\windows\5e53t9iefz57.bin
c:\windows\5e95st9al214z.cpl
c:\windows\5f85steaz959.exe
c:\windows\5f95thi5f638z.bin
c:\windows\5fd9vir1295z.ocx
c:\windows\5z0daddw5re20729.cpl
c:\windows\5z17wor5915.cpl
c:\windows\5z532virus679.ocx
c:\windows\5z6959reat12219.bin
c:\windows\5z85sp9mbot226.bin
c:\windows\617fvi5539z.exe
c:\windows\61fba59zare2396.ocx
c:\windows\61z5d9wnloa5er1015.bin
c:\windows\629wo593e6z.dll
c:\windows\62a3ad9wzre28285.ocx
c:\windows\6359z5r2491.ocx
c:\windows\6371t95j5ze.cpl
c:\windows\6453thrzat4895.bin
c:\windows\6463spzr5e3059.ocx
c:\windows\64a9thiz5710.bin
c:\windows\651aspywzre2916.dll
c:\windows\6533woz55c99.cpl
c:\windows\666et5rzat24379.bin
c:\windows\6871not-azv9rus454.bin
c:\windows\6909virusz85.bin
c:\windows\6931do5nloazer2619.dll
c:\windows\6959zot-a-vi5us51c.ocx
c:\windows\6989add9arz855.ocx
c:\windows\699zbackdoo5178.exe
c:\windows\69bzvir5785.cpl
c:\windows\6a19ba5kd9or1z32.bin
c:\windows\6a295hzeat17649.cpl
c:\windows\6a945ddware2049z.exe
c:\windows\6b5cdownload95z691.ocx
c:\windows\6bb1viz15449.exe
c:\windows\6d75doznloa5er1950.cpl
c:\windows\6e28a5dwaze9219.dll
c:\windows\6e5fspzrs92532.cpl
c:\windows\6edathz5f22089.cpl
c:\windows\6fz9vir595.bin
c:\windows\6z51tro95a.cpl
c:\windows\6z91v9r5935.ocx
c:\windows\6za2thi5f983.bin
c:\windows\6zccb9ckdoor13765.cpl
c:\windows\72249ddwaze29445.exe
c:\windows\7326not-az95rus6f4.exe
c:\windows\7368szambot2e59.cpl
c:\windows\7421th5eat25z9.exe
c:\windows\7519spywz5e2710.bin
c:\windows\754f9ddware2z83.cpl
c:\windows\7555hac9tool6zb.exe
c:\windows\7652n5t-a-viruz592.bin
c:\windows\7753addwzr9512.exe
c:\windows\7886s5e9l23z9.exe
c:\windows\78a9bazkdoo52203.dll
c:\windows\7952zr9j6c5.dll
c:\windows\79cd5ddware314z.dll
c:\windows\7bc2a5dzare1698.bin
c:\windows\7fz3a5dware9655.ocx
c:\windows\7z99vir23595.dll
c:\windows\82z5s9ambot199.ocx
c:\windows\8893woz5599.bin
c:\windows\8996spzm5ot4f9.bin
c:\windows\909thze5846.ocx
c:\windows\91259troj25az.cpl
c:\windows\9167t5reat84z0.exe
c:\windows\91zeth5ef67.bin
c:\windows\92590wozm2a3.bin
c:\windows\92fsze5l696.dll
c:\windows\9368s5arsez361.bin
c:\windows\9398zw5rm7a4.ocx
c:\windows\94001v5zus64c.dll
c:\windows\942edzwnloader1657.ocx
c:\windows\943515orm19z.exe
c:\windows\949worz546.exe
c:\windows\95070h5cktool5bz.exe
c:\windows\95355vzrus7a9.ocx
c:\windows\9556zirus6655.ocx
c:\windows\9558sparse1014z.ocx
c:\windows\95750troz578.exe
c:\windows\95853vizus550.ocx
c:\windows\95fzaddw5re2052.ocx
c:\windows\96075virzs6165.exe
c:\windows\96795zy39d.ocx
c:\windows\96a7t5ief5z8.exe
c:\windows\972815ot-z-virus33d.ocx
c:\windows\973z2w5rm50c.ocx
c:\windows\9748thrzat14805.cpl
c:\windows\9785dd9are3z66.dll
c:\windows\99258h5zktool2a2.dll
c:\windows\99363hacktoolzb5.ocx
c:\windows\9939steal2358z.cpl
c:\windows\9b55viz620.dll
c:\windows\9b5backd9orz68.ocx
c:\windows\9z45vir1725.dll
c:\windows\a12thie5z339.exe
c:\windows\a70addw9rz2052.bin
c:\windows\b3bthrez593932.cpl
c:\windows\bb5thr9az3175.cpl
c:\windows\cbezhre5914584.bin
c:\windows\d79thzef258.exe
c:\windows\dcds9zr5e3180.exe
c:\windows\e25downl9ader155z.bin
c:\windows\e6dbackdooz495.ocx
c:\windows\f665irz079.cpl
c:\windows\f95d5wnloader1z9.ocx

PART 2

c:\windows\system32\103z5sp5499.dll
c:\windows\system32\104dthief254z9.cpl
c:\windows\system32\10904spambz95a5.bin
c:\windows\system32\11006sp5mbotz5f9.cpl
c:\windows\system32\111459zrus2ca.dll
c:\windows\system32\11337virusz559.cpl
c:\windows\system32\11705tzo9558.exe
c:\windows\system32\11878hzc9tool651.cpl
c:\windows\system32\11bbdoznl9ader2951.bin
c:\windows\system32\11c3d95nloaderz27.dll
c:\windows\system32\11cdbazkdo5r3489.cpl
c:\windows\system32\12599h5ckto9lz1.ocx
c:\windows\system32\1279s5yware247z.bin
c:\windows\system32\1297vi5uz21a.cpl
c:\windows\system32\13034s597zf.cpl
c:\windows\system32\132z9ac5tool306.ocx
c:\windows\system32\13422spa9bzt5d2.cpl
c:\windows\system32\13539v9ru53cz.dll
c:\windows\system32\13713spambot95z.bin
c:\windows\system32\13787hacktzo9523.cpl
c:\windows\system32\13963vz5us2b2.exe
c:\windows\system32\1399spar9e5z70.exe
c:\windows\system32\139cdzw5loader967.cpl
c:\windows\system32\1454zhack5oo92f.ocx
c:\windows\system32\14715d9ware96z.bin
c:\windows\system32\151not-5-vi9us67z.bin
c:\windows\system32\1528ztr9j655.exe
c:\windows\system32\15550not-a-vzrus6b9.cpl
c:\windows\system32\1598zhacktoolb9.dll
c:\windows\system32\159cviz9556.cpl
c:\windows\system32\15a4spywarz14359.ocx
c:\windows\system32\16160z9oj551.dll
c:\windows\system32\162255zam9ot2d3.dll
c:\windows\system32\16439zp5926.dll
c:\windows\system32\165cspy9are1954z.ocx
c:\windows\system32\16cddo5nloaz9r3140.cpl
c:\windows\system32\16f89zreat24657.ocx
c:\windows\system32\17097tr5j3z5.dll
c:\windows\system32\17099trojb5z.exe
c:\windows\system32\17111zpambo941c5.exe
c:\windows\system32\173489pambot2za5.dll
c:\windows\system32\1747zs5y7de9.ocx
c:\windows\system32\1748steaz29015.exe
c:\windows\system32\174z1s9ambot355.exe
c:\windows\system32\1799a5z9are287.ocx
c:\windows\system32\18201hac95oolze9.exe
c:\windows\system32\1823895rmz6c.cpl
c:\windows\system32\18323t59j3z0.exe
c:\windows\system32\1858z9roj3fe.dll
c:\windows\system32\185z9teal1892.bin
c:\windows\system32\18610zirus5959.bin
c:\windows\system32\1905virz369.bin
c:\windows\system32\191859i5usz99.ocx
c:\windows\system32\19367hazktool5549.dll
c:\windows\system32\19417wzrm5c.cpl
c:\windows\system32\19469hazktool55d.bin
c:\windows\system32\19475ot-a-virus3dz.ocx
c:\windows\system32\19880not9a-vizus6f35.bin
c:\windows\system32\1990znot5a-virus26d.exe
c:\windows\system32\19982vi59s249z.bin
c:\windows\system32\199955orm2za.cpl
c:\windows\system32\19996not-azvirus735.dll
c:\windows\system32\19997vi5us2ze.exe
c:\windows\system32\199cszarse2353.cpl
c:\windows\system32\1a4edownloa9er13z5.bin
c:\windows\system32\1a69spyw5rez549.bin
c:\windows\system32\1a7dadd9ar52661z.ocx
c:\windows\system32\1ab79ackdoorz534.dll
c:\windows\system32\1abeba5kdoor3z49.dll
c:\windows\system32\1dzavir90755.bin
c:\windows\system32\1e15zhief3019.dll
c:\windows\system32\1e68spyw5ze2998.ocx
c:\windows\system32\1e68zddw5re9264.bin
c:\windows\system32\1f52thr9at1z79.exe
c:\windows\system32\1f85szyware9814.cpl
c:\windows\system32\1z465s9ambot759.dll
c:\windows\system32\1z476v5rus908.bin
c:\windows\system32\1z589troj662.dll
c:\windows\system32\1z9cadd5a9e142.bin
c:\windows\system32\2032tzo541f9.cpl
c:\windows\system32\20476woz9153.bin
c:\windows\system32\20531spam9zt2d1.dll
c:\windows\system32\2055v9rz907.ocx
c:\windows\system32\205zth9ef1819.dll
c:\windows\system32\206z75pambot496.cpl
c:\windows\system32\21362not-a-viru956z.exe
c:\windows\system32\2152vir9z599.ocx
c:\windows\system32\21587hac9t5zl309.bin
c:\windows\system32\21587tz5j9f2.dll
c:\windows\system32\2168s5amzot4e9.bin
c:\windows\system32\2173zspy5c9.exe
c:\windows\system32\21989wo5m50fz.exe
c:\windows\system32\21b1v593z90.exe
c:\windows\system32\22442zo952fd.ocx
c:\windows\system32\224bsp9wa5e74z.dll
c:\windows\system32\22565or937z.cpl
c:\windows\system32\2275z9wnloader1104.ocx
c:\windows\system32\23579viruzfb.cpl
c:\windows\system32\235z4viru959.ocx
c:\windows\system32\23645not-5-9irzs95.ocx
c:\windows\system32\23868not5a-viz9s1f1.dll
c:\windows\system32\2395hacktooz1b9.exe
c:\windows\system32\23990zpy759.ocx
c:\windows\system32\23z58vir9s51e.exe
c:\windows\system32\245z8wor55439.exe
c:\windows\system32\24653z9rm3e7.ocx
c:\windows\system32\249z795y605.cpl
c:\windows\system32\24zs95al592.ocx
c:\windows\system32\25195spy67z.dll
c:\windows\system32\254z4virus7d09.ocx
c:\windows\system32\25535wor9z99.exe
c:\windows\system32\257039or5zc4.dll
c:\windows\system32\2577spars91210z.bin
c:\windows\system32\25849worm4b0z.exe
c:\windows\system32\2585zh9ef615.dll
c:\windows\system32\25899wozm4a9.ocx
c:\windows\system32\2594z9roj2ab.dll
c:\windows\system32\263b59ief8z4.ocx
c:\windows\system32\26569hacztool32c9.bin
c:\windows\system32\265z395oj72d.dll
c:\windows\system32\26864v5ru95e6z.ocx
c:\windows\system32\26z9t5oj513.cpl
c:\windows\system32\27205viruz799.exe
c:\windows\system32\27257not-a-zirus39e.ocx
c:\windows\system32\272zs9ars52158.cpl
c:\windows\system32\27588w9z54a6.dll
c:\windows\system32\278509roj5z1.bin
c:\windows\system32\27916no9-a-viruz3525.bin
c:\windows\system32\2803zspa95ot51c.dll
c:\windows\system32\28070n5t-azvirus519.cpl
c:\windows\system32\28594vi5uz1e.exe
c:\windows\system32\285downloader519z9.dll
c:\windows\system32\28763w5r9zc6.cpl
c:\windows\system32\28769sp51z5.exe
c:\windows\system32\290429ot-azvirus6285.dll
c:\windows\system32\29095hac5toolz69.ocx
c:\windows\system32\29181not-a-vi5u95bfz.cpl
c:\windows\system32\291cthrezt22165.ocx
c:\windows\system32\292329py45z.dll
c:\windows\system32\29304worm40z5.bin
c:\windows\system32\29513viruz37.ocx
c:\windows\system32\29537zpy98.cpl
c:\windows\system32\29550troj699z.exe
c:\windows\system32\295619pamboz338.cpl
c:\windows\system32\295975iruz9f0.ocx
c:\windows\system32\29661sp5z12.dll
c:\windows\system32\29701s5y4dz.exe
c:\windows\system32\29763s5zmb9t66b.cpl
c:\windows\system32\29799no5-azv9rusf4.bin
c:\windows\system32\2994s9am5ot33ez.cpl
c:\windows\system32\299865zrm75a.bin
c:\windows\system32\29ba5ir387z.dll
c:\windows\system32\29z245i9us37f.ocx
c:\windows\system32\2eza9teal2586.ocx
c:\windows\system32\2f58sp5wa9e11z7.ocx
c:\windows\system32\2fz3sp9w5re281.cpl
c:\windows\system32\2z023sp955d5.cpl
c:\windows\system32\2z36vi59s170.exe
c:\windows\system32\2z5199py625.cpl
c:\windows\system32\2z5hackto9l513.exe
c:\windows\system32\2z6fth9eat8265.exe
c:\windows\system32\2z7c5hi9f921.exe
c:\windows\system32\2z86thi5f954.bin
c:\windows\system32\2z915tro9601.ocx
c:\windows\system32\2z98backdoo5996.bin
c:\windows\system32\305f9parse1851z.ocx
c:\windows\system32\305z5hreat6922.ocx
c:\windows\system32\30868tr5jz49.bin
c:\windows\system32\3091thi9f553z.dll
c:\windows\system32\3093doz5l9ader1874.exe
c:\windows\system32\30z96spy5d9.bin
c:\windows\system32\31194szy555.cpl
c:\windows\system32\31467sp9mzo5146.exe
c:\windows\system32\3147695ambotza6.ocx
c:\windows\system32\315db9ckdoorz93.dll
c:\windows\system32\31659trz593f.exe
c:\windows\system32\32559tealz39.bin
c:\windows\system32\32602not-5-virz926a.dll
c:\windows\system32\329v9r1z075.exe
c:\windows\system32\32b9downloadzr532.exe
c:\windows\system32\32z65vi9us5bd.bin
c:\windows\system32\333t59ezt24284.ocx
c:\windows\system32\3393ad5wa9e2809z.dll
c:\windows\system32\3455z9eal830.ocx
c:\windows\system32\35aa9ozn5oader1182.dll
c:\windows\system32\35z81wor97e0.cpl
c:\windows\system32\3779tro5zcb.exe
c:\windows\system32\37d35ackdoorz3599.ocx
c:\windows\system32\386e5ackdo9r1201z.dll
c:\windows\system32\387cz9arse2759.exe
c:\windows\system32\3957steal3206z.exe
c:\windows\system32\395avzr2575.bin
c:\windows\system32\3995sparse270z.dll
c:\windows\system32\3a4a5ownloadez1119.bin
c:\windows\system32\3c99spywa9e57z5.ocx
c:\windows\system32\3d9zvir1534.cpl
c:\windows\system32\3e13zpyware31985.exe
c:\windows\system32\3efa9hief598z.exe
c:\windows\system32\3zf5vir2279.cpl
c:\windows\system32\404Fix.exe
c:\windows\system32\4110s95az968.exe
c:\windows\system32\41885ownloa9er18z5.ocx
c:\windows\system32\4293spzr5e478.exe
c:\windows\system32\43945pyware3071z.ocx
c:\windows\system32\4445s9ambotd3z.cpl
c:\windows\system32\44bfsparse2z595.bin
c:\windows\system32\4565szeal915.exe
c:\windows\system32\46799ot-a-z5rus14b.dll
c:\windows\system32\467zdow9loader250.cpl
c:\windows\system32\46a9tzief5589.exe
c:\windows\system32\46b5viz1937.dll
c:\windows\system32\46zbthr9at55834.cpl
c:\windows\system32\473ead95arz1799.cpl
c:\windows\system32\488cbac95ooz2134.dll
c:\windows\system32\4909s9z5are705.ocx
c:\windows\system32\4929sparse5z78.cpl
c:\windows\system32\4991hacktoz549d.dll
c:\windows\system32\49eespywar52z95.cpl
c:\windows\system32\4a4sp9waze22975.dll
c:\windows\system32\4a79thre5z7709.dll
c:\windows\system32\4a9addwaz52199.dll
c:\windows\system32\4bf9py5aze644.dll
c:\windows\system32\4cdbthreat591z4.ocx
c:\windows\system32\4e59threzt5269.ocx
c:\windows\system32\4z6athie9536.exe
c:\windows\system32\501449orm2ez.exe
c:\windows\system32\50599not-a-virzs182.bin
c:\windows\system32\5063h9cktoolz165.ocx
c:\windows\system32\50721szambo9265.exe
c:\windows\system32\5097n5t-azvir9s63b.dll
c:\windows\system32\5099spywarz1705.exe
c:\windows\system32\519z4virus2db.cpl
c:\windows\system32\51z2t9oj4f1.cpl
c:\windows\system32\51z79acktool4e9.dll
c:\windows\system32\5238downloa9er2755z.dll
c:\windows\system32\5286s9ealz7205.ocx
c:\windows\system32\52a9dzwnloader5256.exe
c:\windows\system32\52e6sp9ware55z.cpl
c:\windows\system32\52z54troj695.bin
c:\windows\system32\539spa5sz2836.cpl
c:\windows\system32\54075t9zj677.dll
c:\windows\system32\544esp5rsz9946.ocx
c:\windows\system32\54935t9oj4z4.exe
c:\windows\system32\54acthreatz19885.exe
c:\windows\system32\5529d9wnloadez685.exe
c:\windows\system32\558w9rz2f3.exe
c:\windows\system32\559csteal136z.dll
c:\windows\system32\55aethief2975z.ocx
c:\windows\system32\56113wor9152z.dll
c:\windows\system32\5673a5zware3290.exe
c:\windows\system32\56815hreat396z6.ocx
c:\windows\system32\57899h9cktoolzbd.exe
c:\windows\system32\57d0vi9z855.cpl
c:\windows\system32\57fbtzreat29945.cpl
c:\windows\system32\57z9downloade522699.dll
c:\windows\system32\58055hreatz77349.exe
c:\windows\system32\58ae9pywaze2209.ocx
c:\windows\system32\594thi9f1536z.cpl
c:\windows\system32\5951hacktoo9bdz.exe
c:\windows\system32\5977downlo9der2z98.ocx
c:\windows\system32\599zv9r5226.dll
c:\windows\system32\5a99threat24z585.dll
c:\windows\system32\5a9zt5al1567.cpl
c:\windows\system32\5aa7st5al1098z.bin
c:\windows\system32\5b19downloade51z.exe
c:\windows\system32\5bbad9w5re1979z.bin
c:\windows\system32\5c39threat16974z.ocx
c:\windows\system32\5ccb9ackdozr2556.dll
c:\windows\system32\5e1dthief969z.cpl
c:\windows\system32\5e42addwz5e8189.bin
c:\windows\system32\5e6s5ea9z979.ocx
c:\windows\system32\5f7caddware3z92.cpl
c:\windows\system32\5fastea9274z.dll
c:\windows\system32\5fdazackdoor2949.dll
c:\windows\system32\5z95vir50.exe
c:\windows\system32\6063vzr25909.ocx
c:\windows\system32\619fzte5l1969.dll
c:\windows\system32\63d0stealz1795.ocx
c:\windows\system32\6573wozm397.cpl
c:\windows\system32\65a25tzal996.bin
c:\windows\system32\65edz9r3098.cpl
c:\windows\system32\6625s5y9are208z.dll
c:\windows\system32\6677zroj7955.exe
c:\windows\system32\66davz52549.ocx
c:\windows\system32\675adown9zader2577.dll
c:\windows\system32\6829addwaze1513.dll
c:\windows\system32\68519py5z.exe
c:\windows\system32\68f8vir19z35.cpl
c:\windows\system32\6998not-a-ziru51d9.dll
c:\windows\system32\6a5f9teal1779z.dll
c:\windows\system32\6aczspyw95e116.cpl
c:\windows\system32\6adddo5zlo9der2159.exe
c:\windows\system32\6b2zvir32599.bin
c:\windows\system32\6e85hreat849z.dll
c:\windows\system32\6z42threat35095.bin
c:\windows\system32\6z95spy558.exe
c:\windows\system32\70999i5us3za.exe
c:\windows\system32\70ac9owzl5ader2500.ocx
c:\windows\system32\7144ba9kdoo53038z.dll
c:\windows\system32\74355hrzat29381.ocx
c:\windows\system32\74bes9za5555.cpl
c:\windows\system32\7559rus156z.bin
c:\windows\system32\755cvir2z9.exe
c:\windows\system32\75955oznloader3189.cpl
c:\windows\system32\75z3t5ie9695.bin
c:\windows\system32\7647threat559z.exe
c:\windows\system32\78d8zackd9or1513.exe
c:\windows\system32\78z6v9rus5e.ocx
c:\windows\system32\79bdbzckd5or2566.bin
c:\windows\system32\7c0z95ware445.ocx
c:\windows\system32\7c20stea5z1549.bin
c:\windows\system32\7zd4downlo5der9207.dll
c:\windows\system32\80z2sp9151.bin
c:\windows\system32\85249p57z5.ocx
c:\windows\system32\8595spamb5t557z.cpl
c:\windows\system32\869wzrm7c15.cpl
c:\windows\system32\871zspam5ot59.cpl
c:\windows\system32\90395szambotab.cpl
c:\windows\system32\90447troj4z5.cpl
c:\windows\system32\90661zirus596.ocx
c:\windows\system32\9129th5eat43z3.exe
c:\windows\system32\917zthreat25545.exe
c:\windows\system32\923z9r5j5c8.cpl
c:\windows\system32\925z7spy715.exe
c:\windows\system32\92672sp57c8z.exe
c:\windows\system32\93f7spywzre2553.exe
c:\windows\system32\93fsze5l504.ocx
c:\windows\system32\93z8worm45d.cpl
c:\windows\system32\950backdoor15z9.bin
c:\windows\system32\951virz330.ocx
c:\windows\system32\95239spambot62z.cpl
c:\windows\system32\9540zworm31.exe
c:\windows\system32\9559vzrus49d.exe
c:\windows\system32\9565azdware1847.exe
c:\windows\system32\9566sparse304z.cpl
c:\windows\system32\9592viruz595.dll
c:\windows\system32\96005worm69z5.exe
c:\windows\system32\97threa52z919.cpl
c:\windows\system32\9859ha9ktzol361.dll
c:\windows\system32\98ebzir2945.dll
c:\windows\system32\99259tzoj7a4.exe
c:\windows\system32\99376viru5z96.cpl
c:\windows\system32\99509zirus55d.exe
c:\windows\system32\997spy35z.dll
c:\windows\system32\9994spy5z0.dll
c:\windows\system32\99aes5azse1542.bin
c:\windows\system32\9azavi5892.dll
c:\windows\system32\9b64szarse5108.bin
c:\windows\system32\9b6ethr5atz3947.ocx
c:\windows\system32\9e03zhief6695.bin
c:\windows\system32\9e8zth5ef2923.cpl
c:\windows\system32\9f8aspywaze335.ocx
c:\windows\system32\a4thrz954744.bin
c:\windows\system32\Agent.OMZ.Fix.exe
c:\windows\system32\c18down5zader759.cpl
c:\windows\system32\c47downl5azer695.exe
c:\windows\system32\ddaaddwaz59036.dll

Awaiting the rest of the log.

c:\windows\system32\drivers\IBM_1951_A31_TP.MRK
c:\windows\system32\dumphive.exe
c:\windows\system32\e99threatz0597.cpl
c:\windows\system32\e9fadd5arez094.bin
c:\windows\system32\f25spywaze3190.ocx
c:\windows\system32\IEDFix.C.exe
c:\windows\system32\IEDFix.exe
c:\windows\system32\NicEtCoE.dll
c:\windows\system32\o4Patch.exe
c:\windows\system32\Process.exe
c:\windows\system32\SrchSTS.exe
c:\windows\system32\tmp.reg
c:\windows\system32\VACFix.exe
c:\windows\system32\VCCLSID.exe
c:\windows\system32\WS2Fix.exe
c:\windows\system32\z194s5a9bot47e.cpl
c:\windows\system32\z3994vir5s9c.bin
c:\windows\system32\z529spy579.bin
c:\windows\system32\z5464spy592.exe
c:\windows\system32\z560vir3091.exe
c:\windows\system32\z5935ir672.dll
c:\windows\system32\z59565r9j79c.bin
c:\windows\system32\z665parse295.cpl
c:\windows\system32\z677v9r5177.ocx
c:\windows\system32\z695no5-a-vir9s2c.dll
c:\windows\system32\z6a9addwar51032.cpl
c:\windows\system32\z70bvi91595.ocx
c:\windows\system32\z7983spy3275.exe
c:\windows\system32\z8793wor519d.ocx
c:\windows\system32\z8fdthief35989.cpl
c:\windows\system32\z9318wor52c7.dll
c:\windows\system32\z9935sp5292.bin
c:\windows\system32\zbfs9eal2505.exe
c:\windows\system32\zf08back9oor2275.exe
c:\windows\z08335orm904.cpl
c:\windows\z0997h9c5tool7ed.cpl
c:\windows\z1446not-9-v5rus768.bin
c:\windows\z175stea9549.ocx
c:\windows\z1f5s9arse2694.exe
c:\windows\z239spyware1547.bin
c:\windows\z2559troj14b9.bin
c:\windows\z2996hac9tool3a15.ocx
c:\windows\z345thre9t15968.bin
c:\windows\z442not-a5virus479.cpl
c:\windows\z4901troj3b59.cpl
c:\windows\z5856h5cktoo93b1.ocx
c:\windows\z59735acktool3c5.dll
c:\windows\z5e8addware31509.exe
c:\windows\z65bthreat90753.cpl
c:\windows\z7317not-a-9i5us1cc.bin
c:\windows\z820add9ar52988.ocx
c:\windows\z95bste5l2043.ocx
c:\windows\za8e5ownloader9415.cpl
c:\windows\za99vir1595.dll
c:\windows\zc1th5eat250859.exe
c:\windows\zceas5eal1399.dll
c:\windows\zd81v9r554.ocx
c:\windows\zde0downloa5er2971.ocx
c:\windows\ze2thief9528.dll
c:\windows\zf6edownl9a5er2981.cpl
F:\Autorun.inf

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_SSDPSRVISSIMON
-------\Service_SSDPSRVISSIMon


((((((((((((((((((((((((( Files Created from 2009-05-03 to 2009-06-03 )))))))))))))))))))))))))))))))
.

2009-06-03 15:21 . 2009-06-03 20:59 117760 ----a-w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-06-03 15:20 . 2009-06-03 15:20 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-06-03 15:20 . 2009-06-03 15:20 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-06-03 15:20 . 2009-06-03 15:20 -------- d-----w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com
2009-06-03 14:24 . 2009-06-03 14:24 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2009-06-03 14:24 . 2009-05-26 17:20 40160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-03 14:24 . 2009-06-03 14:24 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-06-03 14:24 . 2009-05-26 17:19 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-06-03 14:13 . 2009-06-03 14:13 -------- d-----w- C:\Quarentine
2009-06-02 14:22 . 2009-06-02 14:22 -------- d-----w- c:\program files\Trend Micro
2009-06-02 10:26 . 2009-06-03 14:24 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-05-27 23:58 . 2009-05-27 23:58 32 --s-a-w- c:\windows\system32\146893506.dat
2009-05-22 19:18 . 2009-05-22 08:00 259368 ----a-w- c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2d6c02.vdb\ECMSVR32.DLL
2009-05-22 19:18 . 2009-02-12 23:04 876144 ----a-w- c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2d6c02.vdb\NAVEX15.SYS
2009-05-22 19:18 . 2009-02-12 23:04 89104 ----a-w- c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2d6c02.vdb\NAVENG.SYS
2009-05-22 19:18 . 2009-02-12 23:03 1181040 ----a-w- c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2d6c02.vdb\NAVEX32A.DLL
2009-05-22 19:18 . 2009-02-12 23:03 177520 ----a-w- c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2d6c02.vdb\NAVENG32.DLL
2009-05-22 19:18 . 2009-02-06 19:26 101936 ----a-w- c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2d6c02.vdb\ERASER.SYS
2009-05-22 19:18 . 2009-02-06 19:26 371248 ----a-w- c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2d6c02.vdb\EECTRL.SYS
2009-05-22 19:18 . 2009-02-18 19:41 2414128 ----a-w- c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2d6c02.vdb\CCERASER.DLL
2009-05-21 12:44 . 2009-05-21 12:44 -------- d-----w- c:\program files\Microsoft
2009-05-20 03:46 . 2009-05-20 03:46 -------- d-----w- c:\windows\Sun
2009-05-19 21:39 . 2009-05-19 21:39 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-05-19 21:38 . 2009-05-19 21:38 -------- d-----w- c:\program files\Java
2009-05-19 21:38 . 2009-05-19 21:38 152576 ----a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-05-18 22:45 . 2009-05-18 22:45 -------- d-----w- c:\documents and settings\All Users\Application Data\Kodak

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2020-02-17 19:53 . 1922-01-02 09:45 98304 ----a-w- c:\windows\system32\TPMDDL.dll
2020-02-17 19:53 . 1921-09-08 15:58 15872 ----a-w- c:\windows\system32\drivers\atmeltpm.sys
2015-04-12 04:06 . 1908-05-18 13:18 23552 ----a-w- c:\windows\system32\PostProc.dll
2009-06-03 20:59 . 2009-01-26 17:37 -------- d-----w- c:\documents and settings\Administrator\Application Data\Skype
2009-06-03 20:56 . 2005-04-05 17:21 -------- d-----w- c:\program files\C4ebreg
2009-06-03 20:54 . 2007-04-02 13:57 40 ----a-w- c:\windows\system32\profile.dat
2009-06-03 17:13 . 2006-03-27 21:50 -------- d-----w- c:\program files\WST
2009-06-03 16:07 . 2006-01-24 00:45 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-06-03 14:34 . 2009-01-26 17:41 -------- d-----w- c:\documents and settings\Administrator\Application Data\skypePM
2009-05-25 18:20 . 2007-09-20 13:04 -------- d-----w- c:\program files\Google
2009-05-17 15:45 . 2006-12-11 13:33 -------- d-----w- c:\program files\AT&T Network Client
2009-05-17 15:32 . 2009-04-08 12:49 0 ----a-w- c:\windows\Hsuruja.bin
2009-04-30 18:34 . 2009-04-14 18:08 112072 ----a-w- c:\documents and settings\Administrator\Application Data\WDPlugin\wd_hook81.dll
2009-04-30 18:34 . 2009-04-14 18:08 197992 ----a-w- c:\documents and settings\Administrator\Application Data\WDPlugin\wdappview82.dll
2009-04-17 12:07 . 2009-04-17 12:07 0 ----a-w- c:\windows\Hsuruja.binHsuruja.bin
2009-04-15 16:35 . 2009-04-08 12:49 408 ----a-w- c:\windows\Vxewulaqocuba.dat
2009-04-14 18:08 . 2009-04-14 18:08 -------- d-----w- c:\documents and settings\Administrator\Application Data\WDPlugin
2009-03-20 19:26 . 2005-07-29 18:05 64752 ----a-w- c:\windows\isamunin.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-11-18 21633320]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-05-26 1830128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TPKMAPHELPER"="c:\program files\ThinkPad\Utilities\TpKmapAp.exe" [2006-06-02 856064]
"TPHOTKEY"="c:\progra~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe" [2006-07-25 94208]
"Tpam.exe"="c:\program files\IBM\Personal Communications\tpam.exe" [2005-09-06 28672]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2006-02-14 110592]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-02-14 512000]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-19 148888]
"stgclean"="c:\sdwork\w32main2.exe" [2009-06-01 298496]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [1951-09-04 925696]
"PWRMGRTR"="c:\progra~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL" [2006-05-26 151552]
"pmonmh"="c:\program files\IBM\My Help\plugins\\com.ibm.myhelp.common_1.4.19/pmonmh.exe" [2009-03-13 184371]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"MyHelpService"="c:\program files\IBM\My Help\workspace\service\delayStart.exe" [2009-03-13 94208]
"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-02-03 233304]
"Lexmark X6100 Series"="c:\program files\Lexmark X6100 Series\lxbfbmgr.exe" [2003-09-23 57344]
"ISSI Service"="c:\sdwork\issimsvc.exe" [2009-06-01 242928]
"ISAMTray"="c:\program files\C4ebreg\isamtray.exe" [2009-03-20 265456]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2014-05-15 98304]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2014-05-15 118784]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2014-05-15 77824]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-11-16 127035]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2006-07-19 52896]
"C4EBReg"="c:\program files\C4ebreg\c4ebreg.exe" [2009-03-20 417008]
"BLOG"="c:\progra~1\ThinkPad\UTILIT~1\BatLogEx.DLL" [2006-05-26 208896]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]
"ACWLIcon"="c:\program files\ThinkPad\ConnectUtilities\ACWLIcon.exe" [2006-04-17 98304]
"ACTray"="c:\program files\ThinkPad\ConnectUtilities\ACTray.exe" [2006-04-17 409600]
"TpShocks"="TpShocks.exe" - c:\windows\system32\TpShocks.exe [2006-03-15 106496]
"TP4EX"="tp4ex.exe" - c:\windows\system32\TP4EX.exe [2005-10-17 65536]
"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2004-08-04 110592]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\ThinkPad\Bluetooth Software\BTTray.exe [2006-8-1 622653]
Infoprint Select Notification.lnk - c:\program files\IBM\Infoprint Select\ipnotify.exe [2005-4-5 143360]
Lotus QuickStart.lnk - c:\lotus\wordpro\ltsstart.exe [2003-4-7 32768]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"NoDispBackgroundPage"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDevMgrUpdate"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 16:05 356352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ACNotify]
2006-04-17 13:01 32768 ----a-w- c:\program files\ThinkPad\ConnectUtilities\ACNotify.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\atmgrtok]
2005-09-06 09:07 53248 ----a-w- c:\program files\IBM\Personal Communications\atmgrtok.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\pcsinst]
2005-09-06 18:43 49152 ----a-w- c:\windows\system32\pcsinst.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpfnf2]
2005-07-06 00:00 28672 ----a-w- c:\windows\system32\notifyf2.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey]
2005-12-01 00:00 24576 ----a-w- c:\windows\system32\tphklock.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"IBMconfig"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\IBM\\Infoprint Select\\ipnotify.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundTimestampRequest"= 1 (0x1)
"AllowInboundMaskRequest"= 1 (0x1)
"AllowInboundRouterRequest"= 1 (0x1)

R0 Shockprf;Shockprf;c:\windows\system32\drivers\shockprf.sys [12/11/2006 9:32 AM 88576]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [5/26/2009 10:05 AM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/26/2009 10:05 AM 72944]
R1 ShockMgr;ShockMgr;c:\windows\system32\drivers\ShockMgr.sys [12/11/2006 9:32 AM 4736]
R1 TPPWRIF;TPPWRIF;c:\windows\system32\drivers\TPPWRIF.SYS [12/11/2006 9:31 AM 4442]
R2 AppnApi;AppnApi;c:\windows\system32\drivers\appnapi.sys [9/6/2005 5:07 AM 120192]
R2 DCDClient-ISSI;IBM DCD Standard Client (DCDClient-ISSI);c:\program files\IBM\tivoli\dcd\client\ISSI\cds\CDSWinSrv.exe [8/6/2008 12:29 PM 53248]
R2 IBM_LLC2;IBM Personal Communications LLC2 Driver;c:\windows\system32\drivers\llc2.sys [9/6/2005 5:07 AM 101408]
R2 ISAMSvc;IBM Standard Asset Manager Service;c:\program files\C4ebreg\c4ebreg.exe [3/20/2009 3:25 PM 417008]
R2 NsTrcNT;NsTrcNT;c:\windows\system32\drivers\nstrcnt.sys [9/6/2005 5:07 AM 12028]
R2 pdlnctdl;Twinax CUT Adapter;c:\windows\system32\drivers\pdlnctdl.sys [9/6/2005 5:07 AM 12288]
R2 pdlndldl;IBM Enterprise Extender (HPR/IP);c:\windows\system32\drivers\pdlndldl.sys [9/6/2005 5:07 AM 59392]
R2 SavRoam;SAVRoam;c:\program files\Symantec Client Security\Symantec AntiVirus\SavRoam.exe [9/27/2006 8:33 PM 116464]
R3 ABVPN2K;Net Firewall Miniport Interface;c:\windows\system32\drivers\abvpn2k.sys [12/11/2006 9:34 AM 164224]
R3 Anydlc;Anydlc;c:\windows\system32\drivers\anydlc.sys [9/6/2005 5:07 AM 38236]
R3 Appn;Appn;c:\windows\system32\drivers\appn.sys [9/6/2005 5:07 AM 1286560]
R3 AppnBase;AppnBase;c:\windows\system32\drivers\appnbase.sys [9/6/2005 5:07 AM 195872]
R3 avpnnic;AGN Virtual Network Adapter;c:\windows\system32\drivers\avpnnic.sys [12/11/2006 9:33 AM 13952]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2/26/2009 6:50 PM 101936]
R3 KLOGNT;KLOGNT;c:\windows\system32\drivers\klognt.sys [9/6/2005 5:07 AM 24588]
R3 pdlnacom;PDLC Adapter -- COM;c:\windows\system32\drivers\pdlnacom.sys [9/6/2005 5:07 AM 75200]
R3 pdlnafac;PDLC Adapter Factory;c:\windows\system32\drivers\pdlnafac.sys [9/6/2005 5:07 AM 36048]
R3 pdlnatcm;Twinax Adapter Common;c:\windows\system32\drivers\pdlnatcm.sys [9/6/2005 5:07 AM 20480]
R3 pdlnatdl;Twinax Adapter;c:\windows\system32\drivers\pdlnatdl.sys [9/6/2005 5:07 AM 18432]
R3 pdlncbas;PDLC CxM Classes;c:\windows\system32\drivers\pdlncbas.sys [9/6/2005 5:07 AM 6784]
R3 pdlncfwk;PDLC Connection Manager;c:\windows\system32\drivers\pdlncfwk.sys [9/6/2005 5:07 AM 160288]
R3 pdlndint;PDLC DLC Classes;c:\windows\system32\drivers\pdlndint.sys [9/6/2005 5:07 AM 12800]
R3 pdlndlpb;PDLC LAPB;c:\windows\system32\drivers\pdlndlpb.sys [9/6/2005 5:07 AM 70144]
R3 pdlndoem;PDLC OEM Interface;c:\windows\system32\drivers\pdlndoem.sys [9/6/2005 5:07 AM 18944]
R3 pdlndqll;PDLC QLLC;c:\windows\system32\drivers\pdlndqll.sys [9/6/2005 5:07 AM 53248]
R3 pdlndsdl;PDLC SDLC;c:\windows\system32\drivers\pdlndsdl.sys [9/6/2005 5:07 AM 67072]
R3 pdlndtdl;Twinax DLC;c:\windows\system32\drivers\pdlndtdl.sys [9/6/2005 5:07 AM 51712]
R3 pdlnebas;PDLC Environment;c:\windows\system32\drivers\pdlnebas.sys [9/6/2005 5:07 AM 8608]
R3 pdlnecfg;PDLC Configuration;c:\windows\system32\drivers\pdlnecfg.sys [9/6/2005 5:07 AM 50336]
R3 pdlnemap;PDLC Mapper;c:\windows\system32\drivers\pdlnemap.sys [9/6/2005 5:07 AM 67184]
R3 pdlnemsg;PDLC Message Driver;c:\windows\system32\drivers\pdlnemsg.sys [9/6/2005 5:07 AM 12768]
R3 pdlnepkt;PDLC Buffer Manager;c:\windows\system32\drivers\pdlnepkt.sys [9/6/2005 5:07 AM 19984]
R3 pdlnshay;PDLC Hayes At signalling;c:\windows\system32\drivers\pdlnshay.sys [9/6/2005 5:07 AM 59504]
R3 pdlnslea;PDLC SDLC Leased;c:\windows\system32\drivers\pdlnslea.sys [9/6/2005 5:07 AM 22384]
R3 pdlnsv25;PDLC V25bis signalling;c:\windows\system32\drivers\pdlnsv25.sys [9/6/2005 5:07 AM 54416]
R3 pdlnsx25;PDLC X.25;c:\windows\system32\drivers\pdlnsx25.sys [9/6/2005 5:07 AM 58432]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [5/26/2009 10:05 AM 7408]
S2 gaovyosjray;gaovyosjray;c:\windows\System32\svchost.exe -k netsvcs [8/4/2004 1:00 AM 14336]
S3 el575nd5;FE575C-3Com 10/100 LAN CardBus PC Card Driver;c:\windows\system32\drivers\el575ND5.sys [6/2/1920 12:52 PM 61021]
S3 gwiopm;gwiopm;\??\c:\program files\wst\gwiopm.sys --> c:\program files\wst\gwiopm.sys [?]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
gaovyosjray
.
Contents of the 'Scheduled Tasks' folder

2009-06-03 c:\windows\Tasks\PMTask.job
- c:\progra~1\ThinkPad\UTILIT~1\PWMIDTSK.EXE [2006-12-11 00:00]
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-PSQLLauncher - c:\program files\Thinkvantage Fingerprint Software\launcher.exe
HKLM-Run-ISAM SMT Service - c:\program files\C4ebreg\isamsmt.exe
HKLM-Run-Google Desktop Search - c:\program files\Google\Google Desktop Search\GoogleDesktop.exe
SafeBoot-procexp90.Sys


.
------- Supplementary Scan -------
.
uStart Page = hxxp://w3.ibm.com/
uInternet Connection Wizard,ShellNext = hxxp://w3.ibm.com/
uInternet Settings,ProxyServer = proxy.att.com:8000
uInternet Settings,ProxyOverride = *ibm.com;
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {9519B2A2-6592-4E41-8290-D0298459270C} - hxxp://w3.ibm.com/bluepages/scripts/lnwebassist.cab
DPF: {A4B28810-11A2-4956-82D1-B2DCBA4B2AFD} - hxxp://w3.ibm.com/tools/print/plugin/gpwsx.cab
DPF: {CAD4ADEB-C52B-4E83-A7D1-9C75E022ECCC} - hxxps://ds.conferenceservers.com/components/WDPLUGIN.CAB
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4mhp4cbb.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://w3.ibm.com/
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-03 16:57
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4mhp4cbb.default\StumbleUpon\favicons\houwebpas02 : WEB-P-GPortal-E-HOUWEBPAS02-9075.ico 15166 bytes hidden from API

scan completed successfully
hidden files: 1

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(984)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\program files\ThinkPad\ConnectUtilities\ACNotify.dll
c:\program files\ThinkPad\ConnectUtilities\AcSvcStub.dll
c:\program files\ThinkPad\ConnectUtilities\AcLocSettings.dll
c:\program files\ThinkPad\ConnectUtilities\ACHelper.dll
c:\windows\system32\MPR.dll
c:\windows\system32\tphklock.dll
c:\program files\IBM\Personal Communications\atmgrtok.dll
c:\program files\IBM\Personal Communications\MILLUTIL.DLL
c:\windows\system32\pcsinst.dll

- - - - - - - > 'explorer.exe'(3236)
c:\windows\system32\msi.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\btncopy.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ibmpmsvc.exe
c:\program files\ThinkPad\Bluetooth Software\bin\btwdins.exe
c:\program files\Common Files\Symantec Shared\ccSetMgr.exe
c:\program files\Common Files\Symantec Shared\ccEvtMgr.exe
c:\program files\Common Files\Symantec Shared\ccProxy.exe
c:\program files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe
c:\program files\Common Files\Symantec Shared\SNDSrvc.exe
c:\program files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
c:\windows\system32\LEXBCES.EXE
c:\windows\system32\LEXPPS.EXE
c:\windows\system32\drivers\trcboot.exe
c:\program files\IBM\Personal Communications\PCS_AGNT.EXE
c:\program files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
c:\program files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe
c:\program files\Executive Software\DiskeeperWorkstation\DKService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\notes\ntmulti.exe
c:\progra~1\AT&TNE~1\NetCfgSv.EXE
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe
c:\windows\system32\TPHDEXLG.exe
c:\windows\system32\TpKmpSvc.exe
c:\windows\system32\drivers\ldlcserv.exe
c:\program files\ThinkPad\ConnectUtilities\AcSvc.exe
c:\program files\IBM\tivoli\dcd\client\ISSI\_jvm\jre\bin\java.exe
c:\windows\system32\acs.exe
c:\program files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe
c:\windows\system32\wscntfy.exe
c:\program files\Lenovo\PkgMgr\HOTKEY\TPONSCR.exe
c:\program files\Lenovo\PkgMgr\HOTKEY_1\TpScrex.exe
c:\windows\system32\rundll32.exe
c:\program files\IBM\My Help\plugins\com.ibm.myhelp.common_1.4.19\pmonmh.exe
c:\program files\Lexmark X6100 Series\lxbfbmon.exe
c:\windows\system32\rundll32.exe
c:\progra~1\ThinkPad\BLUETO~1\BTSTAC~1.EXE
c:\program files\Skype\Plugin Manager\skypePM.exe
.
**************************************************************************
.
Completion time: 2009-06-03 17:02 - machine was rebooted
ComboFix-quarantined-files.txt 2009-06-03 21:02

Pre-Run: 39,906,443,264 bytes free
Post-Run: 39,993,126,912 bytes free

1056

Now open a new notepad file.
Input this into the notepad file:

KILLALL::

Driver::
gaovyosjray
gwiopm

File::
c:\windows\system32\146893506.dat
c:\windows\Vxewulaqocuba.dat
c:\windows\Hsuruja.binHsuruja.bin
c:\windows\Hsuruja.bin

NetSvc::
gaovyosjray

Save this as CFScript.txt, save it to your desktop also.
Then drag and drop CFScript.txt into combofix as seen below:


This will open combofix again, agree to it's terms and allow it to run.
It may want to reboot after it's done. (It will warn you if it wants to)
Post the resulting log back here.

ComboFix 09-06-03.01 - meckhard 06/03/2009 17:42.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2038.1314 [GMT -4:00]
Running from: c:\documents and settings\Administrator\Desktop\Combo-Fix.exe
Command switches used :: c:\documents and settings\Administrator\Desktop\CFScript.txt
AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}
FW: Symantec Client Firewall *disabled* {5CB76A43-5FAD-476B-B9FF-26FA61F13187}

FILE ::
"c:\windows\Hsuruja.bin"
"c:\windows\Hsuruja.binHsuruja.bin"
"c:\windows\system32\146893506.dat"
"c:\windows\Vxewulaqocuba.dat"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\Hsuruja.bin
c:\windows\Hsuruja.binHsuruja.bin
c:\windows\system32\146893506.dat
c:\windows\Vxewulaqocuba.dat

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_GAOVYOSJRAY
-------\Legacy_GWIOPM
-------\Service_gaovyosjray
-------\Service_gwiopm


((((((((((((((((((((((((( Files Created from 2009-05-03 to 2009-06-03 )))))))))))))))))))))))))))))))
.

2009-06-03 15:21 . 2009-06-03 21:59 117760 ----a-w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-06-03 15:20 . 2009-06-03 15:20 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-06-03 15:20 . 2009-06-03 15:20 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-06-03 15:20 . 2009-06-03 15:20 -------- d-----w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com
2009-06-03 14:24 . 2009-06-03 14:24 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2009-06-03 14:24 . 2009-05-26 17:20 40160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-03 14:24 . 2009-06-03 14:24 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-06-03 14:24 . 2009-05-26 17:19 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-06-03 14:13 . 2009-06-03 14:13 -------- d-----w- C:\Quarentine
2009-06-02 14:22 . 2009-06-02 14:22 -------- d-----w- c:\program files\Trend Micro
2009-06-02 10:26 . 2009-06-03 14:24 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-05-22 19:18 . 2009-05-22 08:00 259368 ----a-w- c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2d6c02.vdb\ECMSVR32.DLL
2009-05-22 19:18 . 2009-02-12 23:04 876144 ----a-w- c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2d6c02.vdb\NAVEX15.SYS
2009-05-22 19:18 . 2009-02-12 23:04 89104 ----a-w- c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2d6c02.vdb\NAVENG.SYS
2009-05-22 19:18 . 2009-02-12 23:03 1181040 ----a-w- c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2d6c02.vdb\NAVEX32A.DLL
2009-05-22 19:18 . 2009-02-12 23:03 177520 ----a-w- c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2d6c02.vdb\NAVENG32.DLL
2009-05-22 19:18 . 2009-02-06 19:26 101936 ----a-w- c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2d6c02.vdb\ERASER.SYS
2009-05-22 19:18 . 2009-02-06 19:26 371248 ----a-w- c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2d6c02.vdb\EECTRL.SYS
2009-05-22 19:18 . 2009-02-18 19:41 2414128 ----a-w- c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2d6c02.vdb\CCERASER.DLL
2009-05-21 12:44 . 2009-05-21 12:44 -------- d-----w- c:\program files\Microsoft
2009-05-20 03:46 . 2009-05-20 03:46 -------- d-----w- c:\windows\Sun
2009-05-19 21:39 . 2009-05-19 21:39 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-05-19 21:38 . 2009-05-19 21:38 -------- d-----w- c:\program files\Java
2009-05-19 21:38 . 2009-05-19 21:38 152576 ----a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-05-18 22:45 . 2009-05-18 22:45 -------- d-----w- c:\documents and settings\All Users\Application Data\Kodak

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2020-02-17 19:53 . 1922-01-02 09:45 98304 ----a-w- c:\windows\system32\TPMDDL.dll
2020-02-17 19:53 . 1921-09-08 15:58 15872 ----a-w- c:\windows\system32\drivers\atmeltpm.sys
2015-04-12 04:06 . 1908-05-18 13:18 23552 ----a-w- c:\windows\system32\PostProc.dll
2009-06-03 21:48 . 2005-04-05 17:21 -------- d-----w- c:\program files\C4ebreg
2009-06-03 21:42 . 2007-04-02 13:57 40 ----a-w- c:\windows\system32\profile.dat
2009-06-03 21:23 . 2009-01-26 17:37 -------- d-----w- c:\documents and settings\Administrator\Application Data\Skype
2009-06-03 21:02 . 2006-01-24 00:45 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-06-03 17:13 . 2006-03-27 21:50 -------- d-----w- c:\program files\WST
2009-06-03 14:34 . 2009-01-26 17:41 -------- d-----w- c:\documents and settings\Administrator\Application Data\skypePM
2009-05-25 18:20 . 2007-09-20 13:04 -------- d-----w- c:\program files\Google
2009-05-17 15:45 . 2006-12-11 13:33 -------- d-----w- c:\program files\AT&T Network Client
2009-04-30 18:34 . 2009-04-14 18:08 112072 ----a-w- c:\documents and settings\Administrator\Application Data\WDPlugin\wd_hook81.dll
2009-04-30 18:34 . 2009-04-14 18:08 197992 ----a-w- c:\documents and settings\Administrator\Application Data\WDPlugin\wdappview82.dll
2009-04-14 18:08 . 2009-04-14 18:08 -------- d-----w- c:\documents and settings\Administrator\Application Data\WDPlugin
2009-03-20 19:26 . 2005-07-29 18:05 64752 ----a-w- c:\windows\isamunin.exe
.

((((((((((((((((((((((((((((( SnapShot@2009-06-03_20.58.01 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-06-03 21:49 . 2009-06-03 21:49 16384 c:\windows\temp\Perflib_Perfdata_580.dat
+ 2009-06-03 21:49 . 2009-06-03 21:49 16384 c:\windows\temp\Perflib_Perfdata_4dc.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-11-18 21633320]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-05-26 1830128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TPKMAPHELPER"="c:\program files\ThinkPad\Utilities\TpKmapAp.exe" [2006-06-02 856064]
"TPHOTKEY"="c:\progra~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe" [2006-07-25 94208]
"Tpam.exe"="c:\program files\IBM\Personal Communications\tpam.exe" [2005-09-06 28672]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2006-02-14 110592]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-02-14 512000]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-19 148888]
"stgclean"="c:\sdwork\w32main2.exe" [2009-06-01 298496]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [1951-09-04 925696]
"PWRMGRTR"="c:\progra~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL" [2006-05-26 151552]
"pmonmh"="c:\program files\IBM\My Help\plugins\\com.ibm.myhelp.common_1.4.19/pmonmh.exe" [2009-03-13 184371]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"MyHelpService"="c:\program files\IBM\My Help\workspace\service\delayStart.exe" [2009-03-13 94208]
"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-02-03 233304]
"Lexmark X6100 Series"="c:\program files\Lexmark X6100 Series\lxbfbmgr.exe" [2003-09-23 57344]
"ISSI Service"="c:\sdwork\issimsvc.exe" [2009-06-01 242928]
"ISAMTray"="c:\program files\C4ebreg\isamtray.exe" [2009-03-20 265456]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2014-05-15 98304]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2014-05-15 118784]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2014-05-15 77824]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-11-16 127035]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2006-07-19 52896]
"C4EBReg"="c:\program files\C4ebreg\c4ebreg.exe" [2009-03-20 417008]
"BLOG"="c:\progra~1\ThinkPad\UTILIT~1\BatLogEx.DLL" [2006-05-26 208896]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]
"ACWLIcon"="c:\program files\ThinkPad\ConnectUtilities\ACWLIcon.exe" [2006-04-17 98304]
"ACTray"="c:\program files\ThinkPad\ConnectUtilities\ACTray.exe" [2006-04-17 409600]
"TpShocks"="TpShocks.exe" - c:\windows\system32\TpShocks.exe [2006-03-15 106496]
"TP4EX"="tp4ex.exe" - c:\windows\system32\TP4EX.exe [2005-10-17 65536]
"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2004-08-04 110592]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\ThinkPad\Bluetooth Software\BTTray.exe [2006-8-1 622653]
Infoprint Select Notification.lnk - c:\program files\IBM\Infoprint Select\ipnotify.exe [2005-4-5 143360]
Lotus QuickStart.lnk - c:\lotus\wordpro\ltsstart.exe [2003-4-7 32768]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"NoDispBackgroundPage"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDevMgrUpdate"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 16:05 356352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ACNotify]
2006-04-17 13:01 32768 ----a-w- c:\program files\ThinkPad\ConnectUtilities\ACNotify.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\atmgrtok]
2005-09-06 09:07 53248 ----a-w- c:\program files\IBM\Personal Communications\atmgrtok.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\pcsinst]
2005-09-06 18:43 49152 ----a-w- c:\windows\system32\pcsinst.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpfnf2]
2005-07-06 00:00 28672 ----a-w- c:\windows\system32\notifyf2.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey]
2005-12-01 00:00 24576 ----a-w- c:\windows\system32\tphklock.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"IBMconfig"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\IBM\\Infoprint Select\\ipnotify.exe"=
"c:\\Program Files\\IBM\\My Help\\jre\\bin\\myhelpw.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundTimestampRequest"= 1 (0x1)
"AllowInboundMaskRequest"= 1 (0x1)
"AllowInboundRouterRequest"= 1 (0x1)

R0 Shockprf;Shockprf;c:\windows\system32\drivers\shockprf.sys [12/11/2006 9:32 AM 88576]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [5/26/2009 10:05 AM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/26/2009 10:05 AM 72944]
R1 ShockMgr;ShockMgr;c:\windows\system32\drivers\ShockMgr.sys [12/11/2006 9:32 AM 4736]
R1 TPPWRIF;TPPWRIF;c:\windows\system32\drivers\TPPWRIF.SYS [12/11/2006 9:31 AM 4442]
R2 AppnApi;AppnApi;c:\windows\system32\drivers\appnapi.sys [9/6/2005 5:07 AM 120192]
R2 DCDClient-ISSI;IBM DCD Standard Client (DCDClient-ISSI);c:\program files\IBM\tivoli\dcd\client\ISSI\cds\CDSWinSrv.exe [8/6/2008 12:29 PM 53248]
R2 IBM_LLC2;IBM Personal Communications LLC2 Driver;c:\windows\system32\drivers\llc2.sys [9/6/2005 5:07 AM 101408]
R2 ISAMSvc;IBM Standard Asset Manager Service;c:\program files\C4ebreg\c4ebreg.exe [3/20/2009 3:25 PM 417008]
R2 NsTrcNT;NsTrcNT;c:\windows\system32\drivers\nstrcnt.sys [9/6/2005 5:07 AM 12028]
R2 pdlnctdl;Twinax CUT Adapter;c:\windows\system32\drivers\pdlnctdl.sys [9/6/2005 5:07 AM 12288]
R2 pdlndldl;IBM Enterprise Extender (HPR/IP);c:\windows\system32\drivers\pdlndldl.sys [9/6/2005 5:07 AM 59392]
R2 SavRoam;SAVRoam;c:\program files\Symantec Client Security\Symantec AntiVirus\SavRoam.exe [9/27/2006 8:33 PM 116464]
R3 ABVPN2K;Net Firewall Miniport Interface;c:\windows\system32\drivers\abvpn2k.sys [12/11/2006 9:34 AM 164224]
R3 Anydlc;Anydlc;c:\windows\system32\drivers\anydlc.sys [9/6/2005 5:07 AM 38236]
R3 Appn;Appn;c:\windows\system32\drivers\appn.sys [9/6/2005 5:07 AM 1286560]
R3 AppnBase;AppnBase;c:\windows\system32\drivers\appnbase.sys [9/6/2005 5:07 AM 195872]
R3 avpnnic;AGN Virtual Network Adapter;c:\windows\system32\drivers\avpnnic.sys [12/11/2006 9:33 AM 13952]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2/26/2009 6:50 PM 101936]
R3 KLOGNT;KLOGNT;c:\windows\system32\drivers\klognt.sys [9/6/2005 5:07 AM 24588]
R3 pdlnacom;PDLC Adapter -- COM;c:\windows\system32\drivers\pdlnacom.sys [9/6/2005 5:07 AM 75200]
R3 pdlnafac;PDLC Adapter Factory;c:\windows\system32\drivers\pdlnafac.sys [9/6/2005 5:07 AM 36048]
R3 pdlnatcm;Twinax Adapter Common;c:\windows\system32\drivers\pdlnatcm.sys [9/6/2005 5:07 AM 20480]
R3 pdlnatdl;Twinax Adapter;c:\windows\system32\drivers\pdlnatdl.sys [9/6/2005 5:07 AM 18432]
R3 pdlncbas;PDLC CxM Classes;c:\windows\system32\drivers\pdlncbas.sys [9/6/2005 5:07 AM 6784]
R3 pdlncfwk;PDLC Connection Manager;c:\windows\system32\drivers\pdlncfwk.sys [9/6/2005 5:07 AM 160288]
R3 pdlndint;PDLC DLC Classes;c:\windows\system32\drivers\pdlndint.sys [9/6/2005 5:07 AM 12800]
R3 pdlndlpb;PDLC LAPB;c:\windows\system32\drivers\pdlndlpb.sys [9/6/2005 5:07 AM 70144]
R3 pdlndoem;PDLC OEM Interface;c:\windows\system32\drivers\pdlndoem.sys [9/6/2005 5:07 AM 18944]
R3 pdlndqll;PDLC QLLC;c:\windows\system32\drivers\pdlndqll.sys [9/6/2005 5:07 AM 53248]
R3 pdlndsdl;PDLC SDLC;c:\windows\system32\drivers\pdlndsdl.sys [9/6/2005 5:07 AM 67072]
R3 pdlndtdl;Twinax DLC;c:\windows\system32\drivers\pdlndtdl.sys [9/6/2005 5:07 AM 51712]
R3 pdlnebas;PDLC Environment;c:\windows\system32\drivers\pdlnebas.sys [9/6/2005 5:07 AM 8608]
R3 pdlnecfg;PDLC Configuration;c:\windows\system32\drivers\pdlnecfg.sys [9/6/2005 5:07 AM 50336]
R3 pdlnemap;PDLC Mapper;c:\windows\system32\drivers\pdlnemap.sys [9/6/2005 5:07 AM 67184]
R3 pdlnemsg;PDLC Message Driver;c:\windows\system32\drivers\pdlnemsg.sys [9/6/2005 5:07 AM 12768]
R3 pdlnepkt;PDLC Buffer Manager;c:\windows\system32\drivers\pdlnepkt.sys [9/6/2005 5:07 AM 19984]
R3 pdlnshay;PDLC Hayes At signalling;c:\windows\system32\drivers\pdlnshay.sys [9/6/2005 5:07 AM 59504]
R3 pdlnslea;PDLC SDLC Leased;c:\windows\system32\drivers\pdlnslea.sys [9/6/2005 5:07 AM 22384]
R3 pdlnsv25;PDLC V25bis signalling;c:\windows\system32\drivers\pdlnsv25.sys [9/6/2005 5:07 AM 54416]
R3 pdlnsx25;PDLC X.25;c:\windows\system32\drivers\pdlnsx25.sys [9/6/2005 5:07 AM 58432]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [5/26/2009 10:05 AM 7408]
S3 el575nd5;FE575C-3Com 10/100 LAN CardBus PC Card Driver;c:\windows\system32\drivers\el575ND5.sys [6/2/1920 12:52 PM 61021]
.
Contents of the 'Scheduled Tasks' folder

2009-06-03 c:\windows\Tasks\PMTask.job
- c:\progra~1\ThinkPad\UTILIT~1\PWMIDTSK.EXE [2006-12-11 00:00]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://w3.ibm.com/
uInternet Connection Wizard,ShellNext = hxxp://w3.ibm.com/
uInternet Settings,ProxyServer = proxy.att.com:8000
uInternet Settings,ProxyOverride = *ibm.com;
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {9519B2A2-6592-4E41-8290-D0298459270C} - hxxp://w3.ibm.com/bluepages/scripts/lnwebassist.cab
DPF: {A4B28810-11A2-4956-82D1-B2DCBA4B2AFD} - hxxp://w3.ibm.com/tools/print/plugin/gpwsx.cab
DPF: {CAD4ADEB-C52B-4E83-A7D1-9C75E022ECCC} - hxxps://ds.conferenceservers.com/components/WDPLUGIN.CAB
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4mhp4cbb.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://w3.ibm.com/
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-03 17:58
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4mhp4cbb.default\StumbleUpon\favicons\houwebpas02 : WEB-P-GPortal-E-HOUWEBPAS02-9075.ico 15166 bytes hidden from API

scan completed successfully
hidden files: 1

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(980)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\program files\ThinkPad\ConnectUtilities\ACNotify.dll
c:\program files\ThinkPad\ConnectUtilities\AcSvcStub.dll
c:\program files\ThinkPad\ConnectUtilities\AcLocSettings.dll
c:\program files\ThinkPad\ConnectUtilities\ACHelper.dll
c:\windows\system32\tphklock.dll
c:\program files\IBM\Personal Communications\atmgrtok.dll
c:\program files\IBM\Personal Communications\MILLUTIL.DLL
c:\windows\system32\pcsinst.dll

- - - - - - - > 'explorer.exe'(2060)
c:\windows\system32\msi.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\btncopy.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ibmpmsvc.exe
c:\program files\ThinkPad\Bluetooth Software\bin\btwdins.exe
c:\program files\Common Files\Symantec Shared\ccSetMgr.exe
c:\program files\Common Files\Symantec Shared\ccEvtMgr.exe
c:\program files\Common Files\Symantec Shared\ccProxy.exe
c:\program files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe
c:\program files\Common Files\Symantec Shared\SNDSrvc.exe
c:\program files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
c:\windows\system32\LEXBCES.EXE
c:\windows\system32\LEXPPS.EXE
c:\windows\system32\drivers\trcboot.exe
c:\program files\IBM\Personal Communications\PCS_AGNT.EXE
c:\program files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
c:\program files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe
c:\program files\Executive Software\DiskeeperWorkstation\DKService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\notes\ntmulti.exe
c:\progra~1\AT&TNE~1\NetCfgSv.EXE
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe
c:\windows\system32\TPHDEXLG.exe
c:\windows\system32\TpKmpSvc.exe
c:\windows\system32\drivers\ldlcserv.exe
c:\program files\ThinkPad\ConnectUtilities\AcSvc.exe
c:\program files\IBM\tivoli\dcd\client\ISSI\_jvm\jre\bin\java.exe
c:\windows\system32\acs.exe
c:\program files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe
c:\windows\system32\wscntfy.exe
c:\program files\Lenovo\PkgMgr\HOTKEY\TPONSCR.exe
c:\program files\Lenovo\PkgMgr\HOTKEY_1\TpScrex.exe
c:\windows\system32\rundll32.exe
c:\program files\IBM\My Help\plugins\com.ibm.myhelp.common_1.4.19\pmonmh.exe
c:\program files\Lexmark X6100 Series\lxbfbmon.exe
c:\windows\system32\rundll32.exe
c:\progra~1\ThinkPad\BLUETO~1\BTSTAC~1.EXE
c:\program files\Skype\Plugin Manager\skypePM.exe
.
**************************************************************************
.
Completion time: 2009-06-03 18:03 - machine was rebooted
ComboFix-quarantined-files.txt 2009-06-03 22:03
ComboFix2.txt 2009-06-03 21:02

Pre-Run: 39,876,091,904 bytes free
Post-Run: 40,015,491,072 bytes free

296

Looking much better now.

Click Start > Run and copy/paste the following bolded text into the Run box and click OK:

ComboFix /u



This will also reset your restore points.

How is the machine running now?

Running normal again THANKS!

Need you to fix a leftover.

• Now open a new notepad file.
  
• Input this into the notepad file:
  

  
  Windows Registry Editor Version 5.00
  
  [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
  "NoDispBackgroundPage"=-
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
  "NoDevMgrUpdate"=-
  
  

  
  
• Save this as fix.reg, save it to your desktop.
  
• Double click fix.reg to run it.
  
• Select yes to the registry merge prompt.
  

Done and Thanks!

Okay, this should be fine now.

Below I have included a number of recommendations for how to protect your computer in order to prevent future malware infections. Please take these recommendations seriously; these few simple steps can stave off the vast majority of spyware problems. As happy as we are to help you, for your sake we would rather not have repeat customers.

1) Please navigate to http://windowsupdate.microsoft.com and download all the "critical updates" for Windows. This can patch many of the security holes through which attackers can gain access to your computer.

Please either enable Automatic Updates under Start -> Control Panel -> Automatic Updates , or get into the habit of checking for Windows updates regularly. I cannot stress enough how important this is.

2) In order to protect yourself against spyware, you should consider installing and running the following free programs:

Ad-Aware SE
A tutorial on using Ad-Aware to remove spyware from your computer may be found here.

Spybot-Search & Destroy
A tutorial on using Spybot to remove spyware from your computer may be found here. Please also remember to enable Spybot's "Immunize" and "TeaTimer" features.

SpywareBlaster
A tutorial on using SpywareBlaster to prevent spyware from ever installing on your computer may be found here.

SpywareGuard
A tutorial on using SpywareGuard for realtime protection against spyware and hijackers may be found here.

Make sure to keep these programs up-to-date and to run them regularly, as this can prevent a great deal of spyware hassle.

3) Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in popup blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from here:
http://www.mozilla.org/products/firefox/
I also recommand the following add-ons for Firefox, they will help keep you safe from malicious scripts or activeX exploits.
https://addons.mozilla.org/en-US/firefox/addon/722
https://addons.mozilla.org/en-US/firefox/addon/1865
https://addons.mozilla.org/en-US/firefox/addon/433

4) Also make sure to run your antivirus software regularly, and to keep it up-to-date.

To help you keep your software updated, please considering using this free software program that will check for program updates.
Update Checker

5) Finally, consider maintaining a firewall. Some good free firewalls are Kerio, or
Outpost
A tutorial on understanding and using firewalls may be found here.

Please also read Tony Klein's excellent article: How I got Infected in the First Place

If you would take a moment to fill out our feedback form, we would appreciate it.
The link can be found here.

Hopefully this should take care of your problems! Good luck.