i have winbluesoft on my pc.......

Hello.

• Download combofix from here
  Link 1
  Link 2
  
  1. If you are using Firefox, make sure that your download settings are as follows:
  
  * Tools->Options->Main tab
  * Set to "Always ask me where to Save the files".
  
  2. During the download, rename Combofix to Combo-Fix as follows:
  
  
  
  
  
  3. It is important you rename Combofix during the download, but not after.
  4. Please do not rename Combofix to other names, but only to the one indicated.
  5. Close any open browsers.
  6. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  
  
• We need to disable your local AV (Anti-virus) before running Combofix.
  
• See HERE for how to disable your AV. (Norton)
  
• Double click on ComboFix.exe.
  
• Follow the prompts. NOTE:
  
• ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
  ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***
  
  **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will automatically proceed with its scan.
  
  
  
• The Recovery Console provides a recovery/repair mode should a problem occur during a Combofix run.
  
  
  
  
• Allow ComboFix to download the Recovery Console.
  
• Accept the End-User License Agreement.
  
• The Recovery Console will be installed.
  
• You will then get this next prompt that asks if you want to continue the malware scan, select yes
  
  
  
  
• Allow combofix to run
  
• Post C:\combofix.txt back here.
  
  Note:
  Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
  

OK, I was able to load Combo and a bunch of files were deleted. I have the deletion log below. Does this mean that winblusoft is gone?

ComboFix 09-06-29.02 - Michael Francis 06/29/2009 17:02.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1015.695 [GMT -5:00]
Running from: c:\documents and settings\Michael Francis\Desktop\Combo-Fix.exe
FW: PC Tools Firewall Plus *enabled* {ABBD5028-5A95-4B6D-996E-98D64AE88D52}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\1013not-9-vzrus3de5.dll
c:\windows\1059tzreat23330.dll
c:\windows\1065vzr5s9ee.dll
c:\windows\10835hackto9z25b.bin
c:\windows\11085s5ambztd29.cpl
c:\windows\113z8n9t-a-virus455.bin
c:\windows\1140z5dware7479.bin
c:\windows\11509virusze1.cpl
c:\windows\1155t9oj4zc.ocx
c:\windows\11658hacktoz526b9.exe
c:\windows\116989z5j2f4.ocx
c:\windows\12010spa5bot911z.dll
c:\windows\1222th9eaz15549.dll
c:\windows\13060v9r5z11d.exe
c:\windows\133btz95f2882.ocx
c:\windows\1346zvirus55c9.cpl
c:\windows\13985tro5z7c.exe
c:\windows\13z93wo9m57e.dll
c:\windows\14567z5oj6219.cpl
c:\windows\149caddware1z56.bin
c:\windows\14cbadzwa5e439.bin
c:\windows\151659acztool66b.exe
c:\windows\15229spz4b5.cpl
c:\windows\154z2not-a9v5rus317.exe
c:\windows\15535s9zmbot33b.bin
c:\windows\1559azdware7979.cpl
c:\windows\15689pzrse516.ocx
c:\windows\15993not-a9zirus33a.bin
c:\windows\15z3spywar92838.exe
c:\windows\15z51sp5903.cpl
c:\windows\16486zpy596.bin
c:\windows\165859zcktool5ed.ocx
c:\windows\168955pz43e.ocx
c:\windows\16b7bzc9d5or1287.exe
c:\windows\16dzthief1549.ocx
c:\windows\17089oz-5-virus69b.ocx
c:\windows\17535s9yz5f.cpl
c:\windows\17889wzr97d5.ocx
c:\windows\17c5addwarez95.exe
c:\windows\1805z9py484.cpl
c:\windows\1807095cktozl1c8.ocx
c:\windows\1835zvirus792.bin
c:\windows\1878zparse21295.ocx
c:\windows\18z559py7ef.ocx
c:\windows\18z62hacktoo5995.bin
c:\windows\1908spzm5ot15.bin
c:\windows\19183vzr5s11b.dll
c:\windows\19387t9o56fz.dll
c:\windows\19469v5ruz656.bin
c:\windows\1949noz-5-virus495.cpl
c:\windows\19556vi5zs51b.dll
c:\windows\19565spam9oz4fe.dll
c:\windows\19566noz9a-virus7d9.cpl
c:\windows\195dzown9oa5er3183.dll
c:\windows\19629pyware7z05.exe
c:\windows\19695not-a-virus7ze.cpl
c:\windows\1973tzi9f1450.exe
c:\windows\19746ha5kzoo9486.ocx
c:\windows\19795pazse1021.ocx
c:\windows\19802spamboz315.bin
c:\windows\198z9ot-a-v5rus2e4.exe
c:\windows\19fz5ackdoor542.cpl
c:\windows\1ed6s5ywarez909.cpl
c:\windows\1f75ddw9rez896.ocx
c:\windows\1f7e95ckdoor1516z.dll
c:\windows\1z118wor5c9.exe
c:\windows\1z706wor94c95.cpl
c:\windows\1z87spyware9531.cpl
c:\windows\1z87t95eat10146.ocx
c:\windows\2003za5ktoo920b.dll
c:\windows\20919w59m3bz.dll
c:\windows\20c9thie52566z.dll
c:\windows\20z5th9ef1828.ocx
c:\windows\22105hackt9olz49.ocx
c:\windows\22256szy47a9.cpl
c:\windows\225aba5kdooz1492.dll
c:\windows\23229szambot5569.cpl
c:\windows\23545v5rus795z.bin
c:\windows\23573vir9551z.exe
c:\windows\23658not-9zvirusb5.dll
c:\windows\24571h9cz5ool610.bin
c:\windows\247av5r9z8.ocx
c:\windows\2483ste9l19z45.bin
c:\windows\2504spy5are265z9.ocx
c:\windows\252z9spyd55.ocx
c:\windows\25354w9rz5f0.exe
c:\windows\2544zt5ojc9.dll
c:\windows\25557zp91d5.exe
c:\windows\25566virus49z.cpl
c:\windows\25572t9oz5a9.cpl
c:\windows\255z6wo5970.dll
c:\windows\25692not-a-vzrus19e.bin
c:\windows\25787s9y52z.cpl
c:\windows\25fabac9dooz2827.cpl
c:\windows\25z13hackto9l581.cpl
c:\windows\260729orm52az.ocx
c:\windows\2669stez5873.dll
c:\windows\27139hackto9516z.ocx
c:\windows\2735z9ackt5ol182.cpl
c:\windows\27596vzr5s37.ocx
c:\windows\27729hackzool158.bin
c:\windows\27759zpy4db.ocx
c:\windows\277b5zr3599.ocx
c:\windows\27990s5a9bot7fz.cpl
c:\windows\27z295orm5a1.exe
c:\windows\28391vir5z31a.ocx
c:\windows\288zsteal9658.bin
c:\windows\29136zirus46e5.ocx
c:\windows\291525ormz2d.dll
c:\windows\29505zot-5-v9rus4bb.dll
c:\windows\29598not-azvirus732.dll
c:\windows\29779wzrm572.bin
c:\windows\297855ac9tzolb8.bin
c:\windows\29979zacktool7c59.exe
c:\windows\29995virzs4e6.dll
c:\windows\2cd9sz9rse5575.cpl
c:\windows\2ceeb9ckzoo51418.dll
c:\windows\2d655dzwa9e305.ocx
c:\windows\2dz6addwa5e9975.bin
c:\windows\2e1zspywa5e5849.bin
c:\windows\2ea9baczd5or879.exe
c:\windows\2z060troj935.dll
c:\windows\2z0fbackdo9r21075.bin
c:\windows\30343virusz965.exe
c:\windows\30441not-azv5rus209.bin
c:\windows\30597spambot1e4z.ocx
c:\windows\307ebz9kdoor1015.dll
c:\windows\3086tzie52793.bin
c:\windows\30985hac9to5l6cz.exe
c:\windows\31196n9tza-v5rus107.bin
c:\windows\319825rzj7a9.dll
c:\windows\31eedown5oader199z.dll
c:\windows\32175zp9mbot381.cpl
c:\windows\323325p943z.ocx
c:\windows\3251not-a-v9rus563z.cpl
c:\windows\3295th5ea99z35.ocx
c:\windows\32adspzwar52193.cpl
c:\windows\3385spz6e59.ocx
c:\windows\3390za9kdoor20875.bin
c:\windows\34759zckto5l176.ocx
c:\windows\34d1za5kdoo93092.bin
c:\windows\3529s5z9l1354.ocx
c:\windows\3539ste5z3109.bin
c:\windows\35c55ownlzader13709.bin
c:\windows\35e8downlo9der10z5.exe
c:\windows\35fzthief1892.ocx
c:\windows\35fzvir1199.cpl
c:\windows\3695spy2b9z.dll
c:\windows\375cdzwnlo5de92566.ocx
c:\windows\3763bzckdoo96705.exe
c:\windows\37a4szea53295.ocx
c:\windows\38acbackd5oz3973.bin
c:\windows\39170troz453.dll
c:\windows\391spzrse5865.ocx
c:\windows\3925tzoj605.cpl
c:\windows\392dzt9al3565.cpl
c:\windows\3954vi59z01.ocx
c:\windows\39705not-a-virus1z.cpl

c:\windows\39795spy35z5.bin
c:\windows\3cz9backd95r732.ocx
c:\windows\3d59backdoorz139.exe
c:\windows\3d7dstez525599.exe
c:\windows\3e5s5ar9z977.ocx
c:\windows\3f6zsp95se2273.cpl
c:\windows\3fd95zr16289.exe
c:\windows\3z059hief973.exe
c:\windows\40bdsp9wz5e437.bin
c:\windows\4210v9r5s4fz.exe
c:\windows\42zb95dware906.bin
c:\windows\435dvir2349z.dll
c:\windows\43z8vir2591.bin
c:\windows\4495spz9se123.exe
c:\windows\45a3szar9e1548.ocx
c:\windows\45zbspyw5r91408.ocx
c:\windows\471es95rse1z94.exe
c:\windows\4720zpa9b5t50.bin
c:\windows\47ez9teal2953.exe
c:\windows\485zth9eat15377.dll
c:\windows\499z9py450.dll
c:\windows\49a5v9r7z5.cpl
c:\windows\49bzv5r912.cpl
c:\windows\49ccthreat592z.dll
c:\windows\4a509zeal1495.cpl
c:\windows\4acdownloa5ez1096.ocx
c:\windows\4bc0downloz9e52223.dll
c:\windows\4d78spzrse94725.dll
c:\windows\4d98threat195z5.exe
c:\windows\4e5z5te9l564.cpl
c:\windows\4f60thrzat14935.exe
c:\windows\4z33th9ef579.bin
c:\windows\4z56v9r1510.bin
c:\windows\4z995teal433.cpl
c:\windows\5039downlozder545.bin
c:\windows\506829pamzot6f8.bin
c:\windows\50z9pambot6ea.bin
c:\windows\51256worz589.ocx
c:\windows\51295zrus49a.dll
c:\windows\516ebazkd9or291.cpl
c:\windows\51zbsteal1895.dll
c:\windows\522dste9lz091.exe
c:\windows\5233hack95olz9e.exe
c:\windows\5259zparse141.ocx
c:\windows\52z5thie518519.ocx
c:\windows\535789irzs315.cpl
c:\windows\5395sparse3z56.dll
c:\windows\541379izus26e.exe
c:\windows\5446st9al5z62.cpl
c:\windows\5475downloade91167z.bin
c:\windows\54985hac9tool5bez.ocx
c:\windows\5553downloadz9962.bin
c:\windows\5560threatz9838.ocx
c:\windows\556szarse1970.dll
c:\windows\5580sp9ware1899z.bin
c:\windows\5589szeal990.bin
c:\windows\55e3thz9at18785.exe
c:\windows\55f99irz050.bin
c:\windows\55z4backdo5r1019.bin
c:\windows\5619ste5l2983z.dll
c:\windows\569tr5jz169.ocx
c:\windows\56a3addw9re25z4.cpl
c:\windows\56c9zteal5285.cpl
c:\windows\5765nzt-a-9irus49f.dll
c:\windows\57e9sparse665z.bin
c:\windows\587859iez1562.ocx
c:\windows\591hazkt5ol72c.ocx
c:\windows\592zvir178.dll
c:\windows\5935spyzf9.bin
c:\windows\593dsteal2266z.ocx
c:\windows\5946zhi5f2206.bin
c:\windows\598fbackdoor402z.dll
c:\windows\599abackdooz275.cpl
c:\windows\59aebackdoor385z.bin
c:\windows\59c5zir1954.dll
c:\windows\59e1spyw5re264z.cpl
c:\windows\59f0a5dware195z.dll
c:\windows\59z6threat18534.dll
c:\windows\59z7v5r2587.exe
c:\windows\5a75addz9re2839.ocx
c:\windows\5b5czhreat1739.bin
c:\windows\5c079ir135z.cpl
c:\windows\5c96add5arz1393.ocx
c:\windows\5d37sparse9z5.dll
c:\windows\5d59sp5zse2308.dll
c:\windows\5d7zspywar520499.dll
c:\windows\5e5z5hief2489.exe
c:\windows\5eb2ste9z1533.ocx
c:\windows\5f2e59ywarz995.bin
c:\windows\5f5zi92850.cpl
c:\windows\5f6bdownlzad9r365.bin
c:\windows\5f70vi92356z.cpl
c:\windows\5f93th9eaz243945.ocx
c:\windows\5fd1sp9wzr5771.bin
c:\windows\5z49s5arse1201.bin
c:\windows\5z58t9ief5728.cpl
c:\windows\5z914troj79c.bin
c:\windows\5z96thief1159.ocx
c:\windows\5zf0t5re9t1379.exe
c:\windows\60b8v59265z.dll
c:\windows\614cspyw5z92931.cpl
c:\windows\615z9parse490.exe
c:\windows\6190v5rz007.dll
c:\windows\6297vir241z5.ocx
c:\windows\629zbackdoor5158.bin
c:\windows\62fcspz95e2197.dll
c:\windows\633zadd5are9500.cpl
c:\windows\6355zir2091.exe
c:\windows\6359zack5ool5299.dll
c:\windows\6366bzckd5or9671.exe
c:\windows\6395ste5lz88.dll
c:\windows\6589viru5698z.cpl
c:\windows\65efthreat9177z.bin
c:\windows\661ft9ief5z39.cpl
c:\windows\676bthreatz9595.exe
c:\windows\6862s5yz0a9.exe
c:\windows\687dsza5se14099.ocx
c:\windows\6950wzrm799.exe
c:\windows\6986sp9warz4505.cpl
c:\windows\69ffzpars5930.ocx
c:\windows\69z7threat15038.bin
c:\windows\6a44thief50z19.dll
c:\windows\6c89d5wnloader658z.dll
c:\windows\6c9fviz544.bin
c:\windows\6d69backdoor35z4.cpl
c:\windows\6z93sp9r5e878.exe
c:\windows\6zbc9ac5door2966.cpl
c:\windows\70z4v9rus675.bin
c:\windows\710bba5kzo9r198.dll
c:\windows\7166download95436z.cpl
c:\windows\72059zckdoor3230.ocx
c:\windows\7276th5efz099.cpl
c:\windows\7345spars9z9975.dll
c:\windows\73c7v9r3145z.exe
c:\windows\73f5thi9f2z50.cpl
c:\windows\754c9t5al207z.cpl
c:\windows\755a9ir4z.cpl
c:\windows\757asteal94z6.cpl
c:\windows\75bcsparse9569z.cpl
c:\windows\7695hackt95z39b.dll
c:\windows\77e2vi9257z.dll
c:\windows\78f0z5w9loader3016.exe
c:\windows\7913tzo529c.ocx
c:\windows\79ba9kdoorz511.cpl
c:\windows\79z3thr9at9452.cpl
c:\windows\7a765ownloazer9097.ocx
c:\windows\7abd5pyz9re1286.ocx
c:\windows\7b5fspyzare295.ocx
c:\windows\7dz2spars5933.ocx
c:\windows\7e2bdownload5rz199.ocx
c:\windows\7ecfth5ezt8294.bin
c:\windows\7ed5s9zal722.cpl
c:\windows\7ze79ownloader2599.bin
c:\windows\8857wzrm39a5.exe
c:\windows\911evi52z42.bin
c:\windows\912spamboz5ee9.exe
c:\windows\91675wor5z84.bin
c:\windows\924ztro5299.exe
c:\windows\935895cktzol52f.dll
c:\windows\94250sp5mbotz6a.bin
c:\windows\9535vizus5ea.cpl
c:\windows\956zi9us25a.bin
c:\windows\95726wzrm382.ocx
c:\windows\9594ste5z1462.cpl
c:\windows\965addwz5e2611.ocx
c:\windows\97205zpy311.bin
c:\windows\9751threat527z.dll
c:\windows\9811spa5se172z.dll
c:\windows\994thz5f319.cpl
c:\windows\9959not-z-virus4f5.exe
c:\windows\996zworm1c5.ocx
c:\windows\9990zvirus145.ocx
c:\windows\9a235pywaze1699.bin
c:\windows\9z4hackt5ol9ef.dll
c:\windows\9z9cthr5at5029.dll
c:\windows\aa35parsz198.dll
c:\windows\aa3bzck9o5r2586.exe
c:\windows\c99bac9do5z579.exe
c:\windows\d2c9a5kdozr2019.bin
c:\windows\e86spz9are6625.exe
c:\windows\f1zth9eat9594.bin
c:\windows\system32\1013595rz2ab.cpl
c:\windows\system32\10352hac9zool7e5.cpl
c:\windows\system32\1072sp9mbo56z4.exe
c:\windows\system32\109499pambz54eb.exe
c:\windows\system32\109985acktool4ze.exe
c:\windows\system32\109z55py769.dll
c:\windows\system32\10dcs5arse1980z.ocx
c:\windows\system32\10z57s9ambot55a.cpl
c:\windows\system32\115eb9ckdoorz24.dll
c:\windows\system32\115z2worm596.ocx
c:\windows\system32\115zspar9e178.dll
c:\windows\system32\11827t9oz4c5.ocx
c:\windows\system32\12209spy5d1z.exe
c:\windows\system32\1239ba5kdoo916z.cpl
c:\windows\system32\12569v9ruz492.bin
c:\windows\system32\12737spz9bot2ec5.dll
c:\windows\system32\12a9adzwa5e884.ocx
c:\windows\system32\12aaddwz5e28649.dll
c:\windows\system32\12cfaddwzre98845.cpl
c:\windows\system32\13597vzr5s64a.ocx
c:\windows\system32\13639s5amb9t3z9.dll
c:\windows\system32\13bzv9r5205.dll
c:\windows\system32\142595irus51z.ocx
c:\windows\system32\1449hackz9o5365.exe
c:\windows\system32\14640no9za-virus9a5.ocx
c:\windows\system32\14823h5cztool23a9.cpl
c:\windows\system32\149d5zief19079.ocx
c:\windows\system32\15029troj2z69.ocx
c:\windows\system32\15110noz-a-virus945.cpl
c:\windows\system32\1515vzr9343.bin
c:\windows\system32\151fd9wnloader322z.exe
c:\windows\system32\151fszars525019.exe
c:\windows\system32\153075ackt9ol732z.cpl
c:\windows\system32\15356notza-virus6a9.exe
c:\windows\system32\15659troj57dz.dll

c:\windows\system32\156999irus3cz.ocx
c:\windows\system32\1595addw9re523z.cpl
c:\windows\system32\15b7stea922z75.bin
c:\windows\system32\1694no5-a-v9rus6zd.cpl
c:\windows\system32\170925ack9ool6z8.dll
c:\windows\system32\17369hazk5ool4d99.dll
c:\windows\system32\175z3spambot9c5.dll
c:\windows\system32\17z01not9a-viru576a.bin
c:\windows\system32\18099tro925z.dll
c:\windows\system32\18430wor9z25.bin
c:\windows\system32\18596zackto5l303.ocx
c:\windows\system32\189655py707z.ocx
c:\windows\system32\18995spamboz55d.cpl
c:\windows\system32\19255worz2819.exe
c:\windows\system32\199z9spam5ot1e2.exe
c:\windows\system32\1abfad5w9rez96.ocx
c:\windows\system32\1c5eth9zat50192.dll
c:\windows\system32\1d96addwaz51782.bin
c:\windows\system32\1d9bthizf50859.cpl
c:\windows\system32\1e90szarse598.cpl
c:\windows\system32\1fb69zeal6835.dll
c:\windows\system32\1z13spam9ot5c5.ocx
c:\windows\system32\1z3849iru53e9.bin
c:\windows\system32\1z400hacktool1495.ocx
c:\windows\system32\1z533troj592.cpl
c:\windows\system32\2016zp9ware5032.exe
c:\windows\system32\20211h5zk9ool524.bin
c:\windows\system32\20395vi5us791z.bin
c:\windows\system32\204075ot-a-vzrus9ac.ocx
c:\windows\system32\2056hzcktool96.exe
c:\windows\system32\2078wo5mz469.exe
c:\windows\system32\20795vz5us129.exe
c:\windows\system32\217139zt-a-virus4465.cpl
c:\windows\system32\2171ztroj5d79.dll
c:\windows\system32\22548ha9ztool39e.exe
c:\windows\system32\225cthief266z9.exe
c:\windows\system32\22623spam59z553.dll
c:\windows\system32\22758spyz49.cpl
c:\windows\system32\2295zpy2965.bin
c:\windows\system32\22hacztoo5921.bin
c:\windows\system32\23098wozm4815.exe
c:\windows\system32\23310szy7895.ocx
c:\windows\system32\2374bazkd95r2774.ocx
c:\windows\system32\2377595rmzf6.bin
c:\windows\system32\237z9a5kdoor3231.ocx
c:\windows\system32\23cdbackd95rz925.bin
c:\windows\system32\23z5addwa9e2961.bin
c:\windows\system32\24393not-5-viru94eez.exe
c:\windows\system32\2455spyware1z59.ocx
c:\windows\system32\24597hacktooz175.cpl
c:\windows\system32\24751spamzot6a9.cpl
c:\windows\system32\24zdthief12579.cpl
c:\windows\system32\25105woz95a.dll
c:\windows\system32\25601not-a-vir5sz969.dll
c:\windows\system32\257zsparse2679.cpl
c:\windows\system32\259zspar5e970.dll
c:\windows\system32\2634vz51899.exe
c:\windows\system32\27026h5ckto9l3zd.ocx
c:\windows\system32\271579p5683z.cpl
c:\windows\system32\271965p96e5z.bin
c:\windows\system32\2773hack9zol547.dll
c:\windows\system32\27900spz5bo9120.exe
c:\windows\system32\2795zvirus5995.exe
c:\windows\system32\2855zddware2892.cpl
c:\windows\system32\28580vzru5392.ocx
c:\windows\system32\28z52tro9649.cpl
c:\windows\system32\2907sp5warez500.ocx
c:\windows\system32\29085t5oj7baz.ocx
c:\windows\system32\29449rojz85.dll
c:\windows\system32\29510v5zus2719.ocx
c:\windows\system32\29553spyz4c5.dll
c:\windows\system32\29554szy7c9.exe
c:\windows\system32\29569pyz5.exe
c:\windows\system32\29589not-azvir5s6b4.ocx
c:\windows\system32\29656trojz3c.dll
c:\windows\system32\2975dow9loadez5998.cpl
c:\windows\system32\2976w9r55z9.cpl
c:\windows\system32\297z1virus95.dll
c:\windows\system32\29b8addwar9z555.cpl
c:\windows\system32\29z51wo9m75c.cpl
c:\windows\system32\29z72n9t-a-virus1e75.dll
c:\windows\system32\29z80sp5759.exe
c:\windows\system32\2a51zir4149.ocx
c:\windows\system32\2a5dst9alz24.ocx
c:\windows\system32\2azth9eat8519.dll
c:\windows\system32\2bc595eal168z.ocx
c:\windows\system32\2e5cthzef1195.cpl
c:\windows\system32\2ee9sparsz27995.cpl
c:\windows\system32\2f85t9iz51873.dll
c:\windows\system32\2f995pzware1736.ocx
c:\windows\system32\2z3905roj36f.bin
c:\windows\system32\2z59sparse564.bin
c:\windows\system32\2z8a9hre5t21157.dll
c:\windows\system32\2zc9sparse21155.dll
c:\windows\system32\301f9pa5sz2885.cpl
c:\windows\system32\30553spz697.cpl
c:\windows\system32\3057szar9e1565.cpl
c:\windows\system32\3099zs5y1c59.cpl
c:\windows\system32\30bdad5waze2908.exe
c:\windows\system32\31354viruz65f9.cpl
c:\windows\system32\31586zp9551.ocx
c:\windows\system32\3158d5znloa9er2199.dll
c:\windows\system32\315zhacktool69d.bin
c:\windows\system32\31844vi5zs5979.ocx
c:\windows\system32\31939zirus565.dll
c:\windows\system32\31z97n5t-a-virus509.ocx
c:\windows\system32\31z9ba5kdoor9067.exe
c:\windows\system32\337dzownloader9538.cpl
c:\windows\system32\33c0spyw5r9138z.bin
c:\windows\system32\34a8spywar59z.cpl
c:\windows\system32\3518spaz9e216.exe
c:\windows\system32\3559downloadez1779.bin
c:\windows\system32\3635sparse94z.dll
c:\windows\system32\36z05ir2794.ocx
c:\windows\system32\372z5ow9loader2983.ocx
c:\windows\system32\37395ot-a-virusz24.cpl
c:\windows\system32\3750spy59cz.cpl
c:\windows\system32\3954steal2598z.ocx
c:\windows\system32\39z5t9oj1c85.ocx
c:\windows\system32\3d2ezh5eat29203.ocx
c:\windows\system32\3d50v5r9032z.ocx
c:\windows\system32\3dd1ba9k5oorz548.cpl
c:\windows\system32\3edz9d5ware94.bin
c:\windows\system32\3f94a5dwzre1001.dll
c:\windows\system32\3zd0d95nloader156.ocx
c:\windows\system32\414tzreat239975.bin
c:\windows\system32\431bbz9kd5or1000.dll
c:\windows\system32\43avz51993.cpl
c:\windows\system32\447dbackdoorz5529.dll
c:\windows\system32\4552szambo9541.dll
c:\windows\system32\4556backdzor1996.exe
c:\windows\system32\45795ownlzader3199.exe
c:\windows\system32\45b6vir319z.bin
c:\windows\system32\45z89roj6db.ocx
c:\windows\system32\46d0s5yza9e133.cpl
c:\windows\system32\4856zpa9bot250.dll
c:\windows\system32\49b5add5arz907.dll
c:\windows\system32\4b55d9wnload5r2z59.cpl
c:\windows\system32\4b75bac5dooz24279.exe
c:\windows\system32\4b95s5azse1196.bin
c:\windows\system32\4baz9dd5are2593.dll
c:\windows\system32\4e6a9dd5are26z2.dll
c:\windows\system32\4e98a5dware2z92.cpl
c:\windows\system32\4f01downloade931z05.exe
c:\windows\system32\4fzcvi91456.exe
c:\windows\system32\4z09downloader5837.bin
c:\windows\system32\4z2dt5r9at22801.ocx
c:\windows\system32\4z81thre5t9939.exe
c:\windows\system32\4z89backdoor5903.bin
c:\windows\system32\504csteal9z83.ocx
c:\windows\system32\5050thzea92312.bin
c:\windows\system32\505fvir27z29.bin
c:\windows\system32\50cd5hreat9z997.cpl
c:\windows\system32\50z32vir9s59a.exe
c:\windows\system32\51768zirus490.exe
c:\windows\system32\51abthizf5094.ocx
c:\windows\system32\51z09d5ware1223.exe
c:\windows\system32\5205stea9725z.dll
c:\windows\system32\5284spamboz925.dll
c:\windows\system32\52dbaddware59z2.bin
c:\windows\system32\53129ro560z.dll
c:\windows\system32\53f5zownl9ader1971.exe
c:\windows\system32\53za9teal1783.exe
c:\windows\system32\54138sp9mzot307.dll
c:\windows\system32\5422sp9wa5z1753.ocx
c:\windows\system32\54996zacktool49a.exe
c:\windows\system32\5529thiefz925.dll
c:\windows\system32\55435zcktool3809.exe
c:\windows\system32\555bsparsz9691.dll
c:\windows\system32\55b9szeal2560.ocx
c:\windows\system32\55bazackdoor2977.exe
c:\windows\system32\5665vir9175z.cpl
c:\windows\system32\569159reat13z50.dll
c:\windows\system32\56995acktool63z.dll
c:\windows\system32\57785z9rse157.exe
c:\windows\system32\578backd9or1z11.dll
c:\windows\system32\582znot-a-virus297.dll
c:\windows\system32\5843spywaze2895.cpl
c:\windows\system32\58511ha9ktool2z7.exe
c:\windows\system32\5891spz359.cpl
c:\windows\system32\5937t59jz09.bin
c:\windows\system32\59645zy206.exe
c:\windows\system32\59734virus16z.ocx
c:\windows\system32\59bbbackdoor253z.dll
c:\windows\system32\59f7addwar93076z.cpl
c:\windows\system32\5a7cs5yza9e1194.ocx
c:\windows\system32\5a85zp9ware1537.cpl
c:\windows\system32\5ac5t9izf2489.dll
c:\windows\system32\5ac9spazs9359.bin
c:\windows\system32\5c3a5i923z2.cpl
c:\windows\system32\5c62bz5kd9or2140.bin
c:\windows\system32\5c69thief155z.ocx
c:\windows\system32\5d6sparze2929.ocx
c:\windows\system32\5dbestez92755.exe
c:\windows\system32\5f149parze1909.dll
c:\windows\system32\5f58spar9z1094.ocx
c:\windows\system32\5f69sparse61z.cpl
c:\windows\system32\5f95tzief1530.exe
c:\windows\system32\5z2fste5l2998.cpl
c:\windows\system32\5z85steal2099.exe
c:\windows\system32\5zbfdownloade93197.dll
c:\windows\system32\6109backdoo562z.dll
c:\windows\system32\6195vir1995z.dll
c:\windows\system32\6252spambo91z7.bin
c:\windows\system32\6279st5az1395.bin
c:\windows\system32\62b2tzre9t29546.bin
c:\windows\system32\62z9no9-a-virus4875.exe
c:\windows\system32\63z8spyware915.cpl
c:\windows\system32\6558zddware1689.dll
c:\windows\system32\659worm409z.exe
c:\windows\system32\6697baczdoor8665.dll
c:\windows\system32\66aesz5a915.dll
c:\windows\system32\66f2zddwa5e2579.exe
c:\windows\system32\67azthrea53819.bin
c:\windows\system32\6817v5z14069.ocx
c:\windows\system32\695bdownlzader93.dll
c:\windows\system32\6azaa5dwar9147.bin
c:\windows\system32\6bd9z5ckdo9r2252.bin
c:\windows\system32\6c9fbackdzo5829.cpl
c:\windows\system32\6ca09p5rse1011z.exe
c:\windows\system32\6d419tealz55.dll
c:\windows\system32\6destea9z65.dll
c:\windows\system32\6fa6spa5sz1409.exe
c:\windows\system32\6z09sparse1695.bin
c:\windows\system32\6zf6downlo5der1490.bin
c:\windows\system32\7035not-azvi59s6e0.dll
c:\windows\system32\7092th5zat19825.bin
c:\windows\system32\72dazownl9ader1853.dll
c:\windows\system32\7368not-a-virzs7995.bin
c:\windows\system32\7437nzt-a9vi5us7cd.ocx
c:\windows\system32\74d1vir5589z.dll
c:\windows\system32\752spy9zre2575.exe
c:\windows\system32\7556vzr509.ocx
c:\windows\system32\7580backdo9z2157.bin
c:\windows\system32\759aspyware49z.bin
c:\windows\system32\759zs5y9f7.cpl
c:\windows\system32\7647s5ywa9z584.cpl
c:\windows\system32\773zs9ar5e17.cpl
c:\windows\system32\78dcdow9loadez2045.bin
c:\windows\system32\7953szy7f9.exe
c:\windows\system32\7956sp54z9.exe
c:\windows\system32\798z9py2525.exe
c:\windows\system32\7a9bdownl5ad9rz995.exe
c:\windows\system32\7ab3addzar59146.bin
c:\windows\system32\7bf6spzware53979.ocx
c:\windows\system32\7e885hief144z9.bin
c:\windows\system32\7f48vz51939.dll
c:\windows\system32\7f5c5hiz92472.dll
c:\windows\system32\7fz8thie52966.exe
c:\windows\system32\7z94d5wnloader16499.bin
c:\windows\system32\7z99vir5404.cpl
c:\windows\system32\7za5a59ware2174.ocx
c:\windows\system32\819zwo9m485.bin
c:\windows\system32\8363worz695.exe
c:\windows\system32\83z15iru91b2.bin
c:\windows\system32\87f5pywarz9670.dll
c:\windows\system32\8892hacktozl51d.dll
c:\windows\system32\9055viruz99a.dll
c:\windows\system32\9055zspambot7be.cpl
c:\windows\system32\90951worm5zd.dll
c:\windows\system32\915ds5yzare1079.dll
c:\windows\system32\91dcdownlo5der189z.cpl
c:\windows\system32\92773wormz65.cpl
c:\windows\system32\93751sp564z.bin
c:\windows\system32\94349zoj2d5.bin
c:\windows\system32\9445spybz.ocx
c:\windows\system32\9551steal2887z.exe
c:\windows\system32\955615orm75z.dll
c:\windows\system32\9597v5rz404.cpl
c:\windows\system32\9625tz5j1f9.cpl
c:\windows\system32\9683zs5y47.exe
c:\windows\system32\96z49s5y559.exe
c:\windows\system32\97556wzr54cc.dll
c:\windows\system32\9772nzt-a-virus7d5.cpl
c:\windows\system32\98cadzware554.dll
c:\windows\system32\9909sparsz2059.dll
c:\windows\system32\9919v5rz9354.dll
c:\windows\system32\99fdowzl5ader2812.cpl
c:\windows\system32\99z7thief195.exe
c:\windows\system32\9ababack5oor2566z.cpl
c:\windows\system32\9bf8tzi5f3082.ocx
c:\windows\system32\9d45zparse555.bin
c:\windows\system32\9e0v5rz161.dll
c:\windows\system32\9e15downloader145z.ocx

c:\windows\system32\9e37t5reaz27235.exe
c:\windows\system32\9e4esparse591z.exe
c:\windows\system32\9z050s5y62.dll
c:\windows\system32\9z130w5rmac.exe
c:\windows\system32\9z47thief1251.exe
c:\windows\system32\9z510spy5be.exe
c:\windows\system32\aa695rezt6961.dll
c:\windows\system32\ae2threat580z39.bin
c:\windows\system32\az9thief875.dll
c:\windows\system32\b425hzeat94507.cpl
c:\windows\system32\c72zhr95t24803.exe
c:\windows\system32\c92bac5dooz2673.bin
c:\windows\system32\dfzdownlo95er2040.ocx
c:\windows\system32\drivers\MSIVXxbrotowkrvituirqtlobouwjvwwuhhbg.sys
c:\windows\system32\drivers\pctmp.sys
c:\windows\system32\f59thief11z45.exe
c:\windows\system32\MSIVXcount
c:\windows\system32\MSIVXoewwqbymxowwanrsnidjkypyngpvdlen.dll
c:\windows\system32\MSIVXtlpkmkoeqsllljblngyewascxipblrmp.dll
c:\windows\system32\setup2.exe
c:\windows\system32\z0267s5y429.exe
c:\windows\system32\z065spyware9626.dll
c:\windows\system32\z079395oj36f.exe
c:\windows\system32\z0976v5rus9c7.cpl
c:\windows\system32\z0f5i91570.bin
c:\windows\system32\z1200spambo9105.bin
c:\windows\system32\z17845py19e.exe
c:\windows\system32\z1acaddware25949.exe
c:\windows\system32\z259ad5w9re326.cpl
c:\windows\system32\z29fthreat15618.dll
c:\windows\system32\z47dvir959.exe
c:\windows\system32\z4a59ackdoor1133.dll
c:\windows\system32\z5127not9a-virus275.cpl
c:\windows\system32\z52f5hreat30909.ocx
c:\windows\system32\z565addware972.dll
c:\windows\system32\z5daspars92998.cpl
c:\windows\system32\z6143hacktool915.bin
c:\windows\system32\z6330s5am9ot373.dll
c:\windows\system32\z6507worm593.cpl
c:\windows\system32\z654sp9r5e1138.exe
c:\windows\system32\z656s5ea9876.dll
c:\windows\system32\z6625hief1294.ocx
c:\windows\system32\z682threat59449.cpl
c:\windows\system32\z8599worm1c2.dll
c:\windows\system32\z90vir2175.dll
c:\windows\system32\z940s5a9se289.dll
c:\windows\system32\z944thief31815.bin
c:\windows\system32\z96169ir5s418.cpl
c:\windows\system32\z978vi513559.exe
c:\windows\system32\ze55threat17899.bin
c:\windows\system32\ze999teal1516.bin
c:\windows\Tasks\{5B57CF47-0BFA-43c6-ACF9-3B3653DCADBA}.job
c:\windows\z038sp5rs91458.exe
c:\windows\z0591worm3d3.ocx
c:\windows\z075spy629.bin
c:\windows\z10esteal2559.cpl
c:\windows\z159download9r2220.dll
c:\windows\z175not-9-virus2a5.exe
c:\windows\z1855s9am5ot653.cpl
c:\windows\z2598w5rm1a4.cpl
c:\windows\z3169tr9j2705.dll
c:\windows\z3507hack9oo5545.exe
c:\windows\z42519pam5ot20c.ocx
c:\windows\z4f55par9e1527.ocx
c:\windows\z558addware1829.bin
c:\windows\z5705s9y331.bin
c:\windows\z5b4sp9rse613.exe
c:\windows\z5bdownload9r228.ocx
c:\windows\z696worm325.dll
c:\windows\z699spy515.dll
c:\windows\z7804v5r9s5eb.exe
c:\windows\z922vir915.ocx
c:\windows\z96339ot-a-virus561.dll
c:\windows\z9d9spy5are2590.bin
c:\windows\za9stea5691.exe
c:\windows\zbe1backd9or195.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_MSIVXserv.sys
-------\Legacy_pctmp
-------\Service_pctmp


((((((((((((((((((((((((( Files Created from 2009-05-28 to 2009-06-29 )))))))))))))))))))))))))))))))
.

2009-08-26 03:01 . 2009-08-26 03:01 16607 ----a-w- c:\windows\2933259ambzt.exe
2009-06-23 04:57 . 2009-06-23 04:57 -------- d-----w- c:\program files\Trend Micro
2009-06-23 04:23 . 2009-06-23 04:23 -------- d-----w- c:\documents and settings\Michael Francis\Application Data\PCToolsFirewallPlus
2009-06-23 04:20 . 2008-03-12 14:30 159896 ----a-w- c:\windows\system32\drivers\pctfw2.sys
2009-06-23 04:19 . 2008-02-25 21:38 93440 ----a-w- c:\windows\system32\drivers\pctfw.sys
2009-06-23 04:19 . 2009-06-23 04:19 -------- d-----w- c:\program files\Common Files\PC Tools
2009-06-23 04:19 . 2008-02-21 13:56 18328 ----a-w- c:\windows\system32\drivers\pctssipc.sys
2009-06-23 04:19 . 2009-06-23 04:23 -------- d-----w- c:\program files\PC Tools Firewall Plus
2009-06-23 04:19 . 2009-06-19 19:37 46864 ----a-w- c:\windows\system32\drivers\TfSysMon.sys
2009-06-23 04:19 . 2009-06-19 19:37 33552 ----a-w- c:\windows\system32\drivers\TfNetMon.sys
2009-06-23 04:19 . 2009-06-19 19:37 51984 ----a-w- c:\windows\system32\drivers\TfFsMon.sys
2009-06-23 04:19 . 2009-06-23 04:19 -------- d-----w- c:\program files\ThreatFire
2009-06-23 04:19 . 2009-06-23 04:19 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Tools
2009-06-23 04:10 . 2009-06-23 04:18 -------- d-----w- c:\documents and settings\Michael Francis\Application Data\IObit
2009-06-23 04:10 . 2009-06-23 04:13 -------- d-----w- c:\program files\IObit
2009-06-23 04:09 . 2009-06-23 04:09 -------- d-----w- c:\program files\Lavasoft
2009-06-23 00:52 . 2009-06-23 00:52 -------- d-sh--w- c:\documents and settings\Administrator\PrivacIE
2009-06-23 00:45 . 2009-06-23 00:45 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
2009-06-22 23:34 . 2009-06-22 23:34 -------- d-----w- C:\!KillBox
2009-06-18 23:27 . 2009-06-29 22:26 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-06-18 23:19 . 2009-06-18 23:48 -------- d-----w- c:\program files\Microsoft AntiSpyware
2009-06-18 23:19 . 2009-06-23 04:05 -------- d-----w- c:\program files\SpywareBlaster
2009-06-18 23:17 . 2009-06-23 04:02 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-06-18 23:17 . 2009-06-24 00:06 -------- d-----w- c:\program files\SpywareGuard
2009-06-18 03:26 . 2009-06-18 03:26 -------- d-----w- c:\documents and settings\Michael Francis\Application Data\Winamp
2009-06-18 03:09 . 2009-06-18 03:09 -------- d-sh--w- c:\documents and settings\Michael Francis\IECompatCache
2009-06-18 03:08 . 2009-06-18 03:08 -------- d-sh--w- c:\documents and settings\Michael Francis\PrivacIE
2009-06-17 03:41 . 2009-06-17 03:41 -------- d-sh--w- c:\documents

and settings\NetworkService\IETldCache
2009-06-17 03:41 . 2009-06-17 03:41 -------- d-sh--w- c:\documents and settings\Michael Francis\IETldCache
2009-06-17 03:39 . 2009-04-30 21:22 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2009-06-17 03:39 . 2009-04-30 21:22 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2009-06-17 03:39 . 2009-06-17 03:39 -------- d-----w- c:\windows\ie8updates
2009-06-17 03:38 . 2009-05-12 05:11 102912 -c----w- c:\windows\system32\dllcache\iecompat.dll
2009-06-17 03:36 . 2009-06-17 03:37 -------- dc-h--w- c:\windows\ie8
2009-06-09 22:17 . 2009-06-09 22:17 152576 ----a-w- c:\documents and settings\Michael Francis\Application Data\Sun\Java\jre1.6.0_14\lzma.dll
2009-06-08 04:58 . 2009-06-19 00:26 -------- d-----w- c:\program files\Alarm

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-23 04:49 . 2008-04-11 20:28 -------- d-----w- c:\documents and settings\Michael Francis\Application Data\GlarySoft
2009-06-23 04:11 . 2008-04-11 20:25 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
2009-06-18 03:26 . 2008-04-11 20:18 -------- d-----w- c:\program files\Winamp
2009-06-18 03:20 . 2008-04-11 20:18 -------- d-----w- c:\program files\Mjuice Media Player
2009-06-18 03:15 . 2008-12-01 09:52 -------- d-----w- c:\documents and settings\All Users\Application Data\Soulseek
2009-06-08 00:29 . 2009-01-08 23:11 -------- d-----w- c:\program files\Common Files\Apple
2009-05-24 23:40 . 2008-04-12 21:37 -------- d-----w- c:\program files\Soulseek
2009-05-21 16:33 . 2009-02-28 22:03 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-05-13 05:15 . 2004-08-04 06:56 915456 ----a-w- c:\windows\system32\wininet.dll
2009-05-11 23:02 . 2009-05-11 23:02 -------- d-----w- c:\documents and settings\Michael Francis\Application Data\FileMaker
2009-05-07 15:32 . 2004-08-04 06:56 345600 ----a-w- c:\windows\system32\localspl.dll
2009-04-25 19:59 . 2009-04-25 19:59 57344 ----a-r- c:\documents and settings\Michael Francis\Application Data\Microsoft\Installer\{66381CF5-ECBB-4CB7-A7AF-C9767E4FDF24}\NewShortcut7_7771B2A712EF4ED6B9E64A04820E098E.exe
2009-04-25 19:59 . 2009-04-25 19:59 57344 ----a-r- c:\documents and settings\Michael Francis\Application Data\Microsoft\Installer\{66381CF5-ECBB-4CB7-A7AF-C9767E4FDF24}\NewShortcut1_7771B2A712EF4ED6B9E64A04820E098E.exe
2009-04-17 12:26 . 2004-08-04 05:17 1847168 ----a-w- c:\windows\system32\win32k.sys
2009-04-15 14:51 . 2004-08-04 06:56 585216 ----a-w- c:\windows\system32\rpcrt4.dll
2009-04-01 03:08 . 2009-04-01 03:08 152576 ----a-w- c:\documents and settings\Michael Francis\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
.

------- Sigcheck -------

[7] 2004-08-04 06:56 14336 8F078AE4ED187AAABC0A305146DE6716 c:\windows\$NtServicePackUninstall$\svchost.exe
[7] 2008-04-14 00:12 14336 27C6D03BCDB8CFEB96B716F3D8BE3E18 c:\windows\ServicePackFiles\i386\svchost.exe
[7] 2008-04-14 00:12 14336 27C6D03BCDB8CFEB96B716F3D8BE3E18 c:\windows\system32\svchost.exe

[-] 2005-03-02 18:19 577024 1800F293BCCC8EDE8A70E12B88D80036 c:\windows\$hf_mig$\KB890859\SP2QFE\user32.dll
[-] 2007-03-08 15:48 578048 7AA4F6C00405DFC4B70ED4214E7D687B c:\windows\$hf_mig$\KB925902\SP2QFE\user32.dll
[-] 2007-03-08 15:36 577536 B409909F6E2E8A7067076ED748ABF1E7 c:\windows\$NtServicePackUninstall$\user32.dll
[7] 2004-08-04 06:56 577024 C72661F8552ACE7C5C85E16A3CF505C4 c:\windows\$NtUninstallKB890859$\user32.dll
[-] 2005-03-02 18:09 577024 DE2DB164BBB35DB061AF0997E4499054 c:\windows\$NtUninstallKB925902$\user32.dll
[7] 2008-04-14 00:12 578560 B26B135FF1B9F60C9388B4A7D16F600B c:\windows\ServicePackFiles\i386\user32.dll
[7] 2008-04-14 00:12 578560 B26B135FF1B9F60C9388B4A7D16F600B c:\windows\system32\user32.dll

[7] 2004-08-04 06:56 82944 2ED0B7F12A60F90092081C50FA0EC2B2 c:\windows\$NtServicePackUninstall$\ws2_32.dll
[7] 2008-04-14 00:12 82432 2CCC474EB85CEAA3E1FA1726580A3E5A c:\windows\ServicePackFiles\i386\ws2_32.dll
[7] 2008-04-14 00:12 82432 2CCC474EB85CEAA3E1FA1726580A3E5A c:\windows\system32\ws2_32.dll
[7] 2008-04-14 00:12 82432 2CCC474EB85CEAA3E1FA1726580A3E5A c:\windows\system32\dllcache\ws2_32.dll

[7] 2007-10-10 23:47 825344 0E5D918F87EFA7D2424D66B499C7EB04 c:\windows\$hf_mig$\KB942615-IE7\SP2QFE\wininet.dll
[7] 2007-12-07 02:01 825344 B5B411BB229AE6EAD7652A32ED47BFB9 c:\windows\$hf_mig$\KB944533-IE7\SP2QFE\wininet.dll
[-] 2008-02-16 09:32 666112 BB1EACD6AB47E78EBCA02EB781550D55 c:\windows\$hf_mig$\KB947864\SP2QFE\wininet.dll
[7] 2008-03-01 13:03 827392 6316C2F0C61271C8ABDFF7429174879E c:\windows\$hf_mig$\KB947864-IE7\SP2QFE\wininet.dll
[7] 2008-04-23 03:35 827392 41546B396A526918DA7995A02EA04E51 c:\windows\$hf_mig$\KB950759-IE7\SP2QFE\wininet.dll
[7] 2008-06-23 16:01 827904 C66402A06B83B036C195242C0C8CF83C c:\windows\$hf_mig$\KB953838-IE7\SP2QFE\wininet.dll
[7] 2008-08-26 09:08 827904 77C192FE56A70D7FA0247BA0A6201C32 c:\windows\$hf_mig$\KB956390-IE7\SP2QFE\wininet.dll
[7] 2008-10-16 20:24 827904 0D5B75171FF51775B630A431B6C667E8 c:\windows\$hf_mig$\KB958215-IE7\SP2QFE\wininet.dll
[7] 2008-12-20 23:56 827904 044E0A4E9FE97C0FB9AFE9C89E2A82E6 c:\windows\$hf_mig$\KB961260-IE7\SP2QFE\wininet.dll
[7] 2009-03-03 00:17 828416 C8667854873938CA13C986F16B0CD183 c:\windows\$hf_mig$\KB963027-IE7\SP3QFE\wininet.dll
[7] 2009-04-29 04:49 828928 62CCA075F44015147B8971DAFFBCFF76 c:\windows\$hf_mig$\KB969897-IE7\SP3QFE\wininet.dll
[7] 2009-05-13 05:10 915456 C0EB6850C8A02A154281749DC61FAF22 c:\windows\$hf_mig$\KB969897-IE8\SP3QFE\wininet.dll
[7] 2004-08-04 06:56 656384 C0823FC5469663BA63E7DB88F9919D70 c:\windows\$NtUninstallKB947864$\wininet.dll
[-] 2008-02-16 08:59 659456 0C690E77C0E924C45B4D7045B182FFF1 c:\windows\ie7\wininet.dll
[7] 2007-08-13 23:54 818688 A4A0FC92358F39538A6494C42EF99FE9 c:\windows\ie7updates\KB942615-IE7\wininet.dll
[7] 2007-10-10 23:56 824832 30C1E0F34AD2972C72A01DB5C74AB065 c:\windows\ie7updates\KB944533-IE7\wininet.dll
[7] 2007-12-07 02:21 824832 806D274C9A6C3AAEA5EAE8E4AF841E04 c:\windows\ie7updates\KB947864-IE7\wininet.dll
[7] 2008-03-01 13:06 826368 AD21461AEF8244EDEC2EF18E55E1DCF3 c:\windows\ie7updates\KB950759-IE7\wininet.dll
[7] 2008-04-23 04:16 826368 F6589BE784647CFDBC22EA51CCB1A57A c:\windows\ie7updates\KB953838-IE7\wininet.dll
[7] 2008-06-23 16:57 826368 8C13D4A7479FA0A026EDA8ABCE82C0ED c:\windows\ie7updates\KB956390-IE7\wininet.dll
[7] 2008-08-26 07:24 826368 EF8EBA98145BFA44E80D17A3B3453300 c:\windows\ie7updates\KB958215-IE7\wininet.dll
[7] 2008-10-16 20:38 826368 6741EAF7B7F110E803A6E38F6E5FA6B0 c:\windows\ie7updates\KB961260-IE7\wininet.dll
[7] 2008-12-20 23:15 826368 A82935D32D0672E8FF4E91AE398E901C c:\windows\ie7updates\KB963027-IE7\wininet.dll
[7] 2009-03-03 00:18 826368 28775945CCD53DEE280EF58DEA1A94C4 c:\windows\ie7updates\KB969897-IE7\wininet.dll
[7] 2009-04-29 04:56 827392 8E2D471157B0DF329D8D0EA5D83B0DDB c:\windows\ie8\wininet.dll
[7] 2009-03-08 09:34 914944 6CE32F7778061CCC5814D5E0F282D369 c:\windows\ie8updates\KB969897-IE8\wininet.dll
[7] 2008-04-14 00:12 666112 7A4F775ABB2F1C97DEF3E73AFA2FAEDD c:\windows\ServicePackFiles\i386\wininet.dll
[7] 2008-03-01 13:06 826368 AD21461AEF8244EDEC2EF18E55E1DCF3 c:\windows\SoftwareDistribution\Download\4dcb1f965c037cafb3a5ed4c71a998b8\SP2GDR\wininet.dll
[7] 2008-03-01 13:03 827392 6316C2F0C61271C8ABDFF7429174879E c:\windows\SoftwareDistribution\Download\4dcb1f965c037cafb3a5ed4c71a998b8\SP2QFE\wininet.dll
[7] 2009-05-13 05:15 915456 366C72AF6970DB7BB39AB0142BF09DB5 c:\windows\SoftwareDistribution\Download\97fe76a20161cb86e78057600e7c82a0\SP3GDR\wininet.dll
[7] 2009-05-13 05:10 915456 C0EB6850C8A02A154281749DC61FAF22 c:\windows\SoftwareDistribution\Download\97fe76a20161cb86e78057600e7c82a0\SP3QFE\wininet.dll
[7] 2007-10-10 23:56 824832 30C1E0F34AD2972C72A01DB5C74AB065 c:\windows\SoftwareDistribution\Download\e3709fbfd9557a7d083f543d51d38612\SP2GDR\wininet.dll
[7] 2007-10-10 23:47 825344 0E5D918F87EFA7D2424D66B499C7EB04 c:\windows\SoftwareDistribution\Download\e3709fbfd9557a7d083f543d51d38612\SP2QFE\wininet.dll
[7] 2007-12-07 02:21 824832 806D274C9A6C3AAEA5EAE8E4AF841E04 c:\windows\SoftwareDistribution\Download\e5a204b08ee9dd0f7a20547e61486b27\SP2GDR\wininet.dll
[7] 2007-12-07 02:01 825344 B5B411BB229AE6EAD7652A32ED47BFB9 c:\windows\SoftwareDistribution\Download\e5a204b08ee9dd0f7a20547e61486b27\SP2QFE\wininet.dll
[7] 2009-05-13 05:15 915456 366C72AF6970DB7BB39AB0142BF09DB5 c:\windows\system32\wininet.dll
[7] 2009-05-13 05:15 915456 366C72AF6970DB7BB39AB0142BF09DB5 c:\windows\system32\dllcache\wininet.dll

[-] 2007-10-30 16:53 360832 64798ECFA43D78C7178375FCDD16D8C8 c:\windows\$hf_mig$\KB941644\SP2QFE\tcpip.sys
[7] 2008-06-20 10:44 360960 744E57C99232201AE98C49168B918F48 c:\windows\$hf_mig$\KB951748\SP2QFE\tcpip.sys
[7] 2008-06-20 11:51 361600 9AEFA14BD6B182D61E3119FA5F436D3D c:\windows\$hf_mig$\KB951748\SP3GDR\tcpip.sys
[7] 2008-06-20 11:59 361600 AD978A1B783B5719720CFF204B666C8E c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
[7] 2008-06-20 10:45 360320 2A5554FC5B1E04E131230E3CE035C3F9 c:\windows\$NtServicePackUninstall$\tcpip.sys
[7] 2004-08-04 05:14 359040 9F4B36614A0FC234525BA224957DE55C c:\windows\$NtUninstallKB941644$\tcpip.sys
[7] 2008-04-13 19:20 361344 93EA8D04EC73A85DB02EB8805988F733 c:\windows\$NtUninstallKB951748$\tcpip.sys
[-] 2007-10-30 17:20 360064 90CAFF4B094573449A0872A0F919B178 c:\windows\$NtUninstallKB951748_0$\tcpip.sys
[7] 2008-04-13 19:20 361344 93EA8D04EC73A85DB02EB8805988F733 c:\windows\ServicePackFiles\i386\tcpip.sys
[7] 2008-06-20 11:51 361600 9AEFA14BD6B182D61E3119FA5F436D3D c:\windows\system32\dllcache\tcpip.sys
[7] 2008-06-20 11:51 361600 9AEFA14BD6B182D61E3119FA5F436D3D c:\windows\system32\drivers\tcpip.sys

[7] 2004-08-04 06:56 502272 01C3346C241652F43AED8E2149881BFE c:\windows\$NtServicePackUninstall$\winlogon.exe
[7] 2008-04-14 00:12 507904 ED0EF0A136DEC83DF69F04118870003E c:\windows\ServicePackFiles\i386\winlogon.exe
[7] 2008-04-14 00:12 507904 ED0EF0A136DEC83DF69F04118870003E c:\windows\system32\winlogon.exe
[7] 2008-04-14 00:12 507904 ED0EF0A136DEC83DF69F04118870003E c:\windows\system32\dllcache\winlogon.exe

[7] 2004-08-04 05:14 182912 558635D3AF1C7546D26067D5D9B6959E c:\windows\$NtServicePackUninstall$\ndis.sys
[7] 2008-04-13 19:20 182656 1DF7F42665C94B825322FAE71721130D c:\windows\ServicePackFiles\i386\ndis.sys
[7] 2008-04-13 19:20 182656 1DF7F42665C94B825322FAE71721130D c:\windows\system32\drivers\ndis.sys

[7] 2004-08-04 05:00 29056 4448006B6BC60E6C027932CFC38D6855 c:\windows\$NtServicePackUninstall$\ip6fw.sys
[7] 2008-04-13 18:53 36608 3BB22519A194418D5FEC05D800A19AD0 c:\windows\ServicePackFiles\i386\ip6fw.sys
[7] 2008-04-13 18:53 36608 3BB22519A194418D5FEC05D800A19AD0 c:\windows\system32\drivers\ip6fw.sys

[-] 2005-03-02 00:36 2056832 D8ABA3EAB509627E707A3B14F00FBB6B c:\windows\$hf_mig$\KB890859\SP2QFE\ntkrnlpa.exe
[-] 2007-02-28 09:15 2059392 4D3DBDCCBF97F5BA1E74F322B155C3BA c:\windows\$hf_mig$\KB931784\SP2QFE\ntkrnlpa.exe
[7] 2009-02-06 10:30 2066176 607352B9CB3D708C67F6039097801B5A c:\windows\$hf_mig$\KB956572\SP3QFE\ntkrnlpa.exe
[7] 2008-08-14 20:39 2066048 A25E9B86EFFB2AF33BF51E676B68BFB0 c:\windows\$hf_mig$\KB956841\SP3QFE\ntkrnlpa.exe
[-] 2007-02-28 08:38 2057600 515D30E2C90A3665A2739309334C9283 c:\windows\$NtServicePackUninstall$\ntkrnlpa.exe
[7] 2004-08-04 07:05 2056832 947FB1D86D14AFCFFDB54BF837EC25D0 c:\windows\$NtUninstallKB890859$\ntkrnlpa.exe
[-] 2005-03-02 00:34 2056832 81013F36B21C7F72CF784CC6731E0002 c:\windows\$NtUninstallKB931784$\ntkrnlpa.exe
[7] 2008-08-14 09:33 2066048 4AC58F03EB94A72809949D757FC39D80 c:\windows\$NtUninstallKB956572$\ntkrnlpa.exe
[7] 2008-04-13 18:31 2065792 109F8E3E3C82E337BB71B6BC9B895D61 c:\windows\$NtUninstallKB956841$\ntkrnlpa.exe
[7] 2009-02-08 00:02 2066048 5BA7F2141BC6DB06100D0E5A732C617A c:\windows\Driver Cache\i386\ntkrnlpa.exe
[7] 2008-04-13 18:31 2065792 109F8E3E3C82E337BB71B6BC9B895D61 c:\windows\ServicePackFiles\i386\ntkrnlpa.exe
[7] 2009-02-08 00:02 2066048 5BA7F2141BC6DB06100D0E5A732C617A c:\windows\system32\ntkrnlpa.exe
[7] 2009-02-08 00:02 2066048 5BA7F2141BC6DB06100D0E5A732C617A c:\windows\system32\dllcache\ntkrnlpa.exe

[-] 2005-03-02 01:04 2179456 28187802B7C368C0D3AEF7D4C382AABB c:\windows\$hf_mig$\KB890859\SP2QFE\ntoskrnl.exe
[-] 2007-02-28 09:55 2182144 5A5C8DB4AA962C714C8371FBDF189FC9 c:\windows\$hf_mig$\KB931784\SP2QFE\ntoskrnl.exe
[7] 2009-02-08 00:35 2189184 EFE8EACE83EAAD5849A7A548FB75B584 c:\windows\$hf_mig$\KB956572\SP3QFE\ntoskrnl.exe
[7] 2008-08-14 21:11 2189184 31914172342BFF330063F343AC6958FE c:\windows\$hf_mig$\KB956841\SP3QFE\ntoskrnl.exe
[-] 2007-02-28 09:10 2180352 582A8DBAA58C3B1F176EB2817DAEE77C c:\windows\$NtServicePackUninstall$\ntoskrnl.exe
[7] 2004-08-04 05:20 2180992 CE218BC7088681FAA06633E218596CA7 c:\windows\$NtUninstallKB890859$\ntoskrnl.exe
[-] 2005-03-02 00:59 2179328 4D4CF2C14550A4B7718E94A6E581856E c:\windows\$NtUninstallKB931784$\ntoskrnl.exe
[7] 2008-08-14 10:11 2189184 EEAF32F8E15A24F62BECB1BD403BB5C5 c:\windows\$NtUninstallKB956572$\ntoskrnl.exe
[7] 2008-04-13 19:27 2188928 0C89243C7C3EE199B96FCC16990E0679 c:\windows\$NtUninstallKB956841$\ntoskrnl.exe
[7] 2009-02-06 11:08 2189056 7A95B10A73737EBF24139AAA63F5212B c:\windows\Driver Cache\i386\ntoskrnl.exe
[7] 2008-04-13 19:27 2188928 0C89243C7C3EE199B96FCC16990E0679 c:\windows\ServicePackFiles\i386\ntoskrnl.exe
[7] 2009-02-06 11:08 2189056 7A95B10A73737EBF24139AAA63F5212B c:\windows\system32\ntoskrnl.exe
[7] 2009-02-06 11:08 2189056 7A95B10A73737EBF24139AAA63F5212B c:\windows\system32\dllcache\ntoskrnl.exe

[7] 2008-04-14 00:12 1033728 12896823FB95BFB3DC9B46BCAEDC9923 c:\windows\explorer.exe
[-] 2007-06-13 11:26 1033216 7712DF0CDDE3A5AC89843E61CD5B3658 c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
[-] 2007-06-13 10:23 1033216 97BD6515465659FF8F3B7BE375B2EA87 c:\windows\$NtServicePackUninstall$\explorer.exe
[7] 2004-08-04 06:56 1032192 A0732187050030AE399B241436565E64 c:\windows\$NtUninstallKB938828$\explorer.exe
[7] 2008-04-14 00:12 1033728 12896823FB95BFB3DC9B46BCAEDC9923 c:\windows\ServicePackFiles\i386\explorer.exe

[7] 2009-02-06 11:06 110592 020CEAAEDC8EB655B6506B8C70D53BB6 c:\windows\$hf_mig$\KB956572\SP3QFE\services.exe
[7] 2004-08-04 06:56 108032 C6CE6EEC82F187615D1002BB3BB50ED4 c:\windows\$NtServicePackUninstall$\services.exe
[7] 2008-04-14 00:12 108544 0E776ED5F7CC9F94299E70461B7B8185 c:\windows\$NtUninstallKB956572$\services.exe
[7] 2008-04-14 00:12 108544 0E776ED5F7CC9F94299E70461B7B8185 c:\windows\ServicePackFiles\i386\services.exe
[7] 2009-02-06 11:11 110592 65DF52F5B8B6E9BBD183505225C37315 c:\windows\system32\services.exe
[7] 2009-02-06 11:11 110592 65DF52F5B8B6E9BBD183505225C37315 c:\windows\system32\dllcache\services.exe

[7] 2004-08-04 06:56 13312 84885F9B82F4D55C6146EBF6065D75D2 c:\windows\$NtServicePackUninstall$\lsass.exe
[7] 2008-04-14 00:12 13312 BF2466B3E18E970D8A976FB95FC1CA85 c:\windows\ServicePackFiles\i386\lsass.exe

[7] 2008-04-14 00:12 13312 BF2466B3E18E970D8A976FB95FC1CA85 c:\windows\system32\lsass.exe

[7] 2004-08-04 06:56 15360 24232996A38C0B0CF151C2140AE29FC8 c:\windows\$NtServicePackUninstall$\ctfmon.exe
[7] 2008-04-14 00:12 15360 5F1D5F88303D4A4DBC8E5F97BA967CC3 c:\windows\ServicePackFiles\i386\ctfmon.exe
[7] 2008-04-14 00:12 15360 5F1D5F88303D4A4DBC8E5F97BA967CC3 c:\windows\system32\ctfmon.exe

[-] 2005-06-11 00:17 57856 AD3D9D191AEA7B5445FE1D82FFBB4788 c:\windows\$hf_mig$\KB896423\SP2QFE\spoolsv.exe
[-] 2005-06-10 23:53 57856 DA81EC57ACD4CDC3D4C51CF3D409AF9F c:\windows\$NtServicePackUninstall$\spoolsv.exe
[7] 2004-08-04 06:56 57856 7435B108B935E42EA92CA94F59C8E717 c:\windows\$NtUninstallKB896423$\spoolsv.exe
[7] 2008-04-14 00:12 57856 D8E14A61ACC1D4A6CD0D38AEBAC7FA3B c:\windows\ServicePackFiles\i386\spoolsv.exe
[7] 2008-04-14 00:12 57856 D8E14A61ACC1D4A6CD0D38AEBAC7FA3B c:\windows\system32\spoolsv.exe

[7] 2008-04-14 00:12 111104 ED7262E52C31CF1625B65039102BC16C c:\windows\ServicePackFiles\i386\wuauclt.exe
[7] 2008-10-16 20:09 51224 E654B78D2F1D791B30D0ED9A8195EC22 c:\windows\system32\wuauclt.exe
[7] 2008-10-16 20:09 51224 E654B78D2F1D791B30D0ED9A8195EC22 c:\windows\system32\dllcache\wuauclt.exe

[7] 2004-08-04 06:56 24576 39B1FFB03C2296323832ACBAE50D2AFF c:\windows\$NtServicePackUninstall$\userinit.exe
[7] 2008-04-14 00:12 26112 A93AEE1928A9D7CE3E16D24EC7380F89 c:\windows\ServicePackFiles\i386\userinit.exe
[7] 2008-04-14 00:12 26112 A93AEE1928A9D7CE3E16D24EC7380F89 c:\windows\system32\userinit.exe

[7] 2004-08-04 06:56 295424 B60C877D16D9C880B952FDA04ADF16E6 c:\windows\$NtServicePackUninstall$\termsrv.dll
[7] 2008-04-14 00:12 295424 FF3477C03BE7201C294C35F684B3479F c:\windows\ServicePackFiles\i386\termsrv.dll
[7] 2008-04-14 00:12 295424 FF3477C03BE7201C294C35F684B3479F c:\windows\system32\termsrv.dll

[-] 2007-04-16 16:07 986112 09F7CB3687F86EDAA4CA081F7AB66C03 c:\windows\$hf_mig$\KB935839\SP2QFE\kernel32.dll
[7] 2009-03-21 13:59 991744 DA11D9D6ECBDF0F93436A4B7C13F7BEC c:\windows\$hf_mig$\KB959426\SP3QFE\kernel32.dll
[-] 2007-04-16 15:52 984576 A01F9CA902A88F7CED06884174D6419D c:\windows\$NtServicePackUninstall$\kernel32.dll
[7] 2004-08-04 06:56 983552 888190E31455FAD793312F8D087146EB c:\windows\$NtUninstallKB935839$\kernel32.dll
[7] 2008-04-14 00:11 989696 C24B983D211C34DA8FCC1AC38477971D c:\windows\$NtUninstallKB959426$\kernel32.dll
[7] 2008-04-14 00:11 989696 C24B983D211C34DA8FCC1AC38477971D c:\windows\ServicePackFiles\i386\kernel32.dll
[7] 2009-03-21 14:06 989696 B921FB870C9AC0D509B2CCABBBBE95F3 c:\windows\system32\kernel32.dll
[7] 2009-03-21 14:06 989696 B921FB870C9AC0D509B2CCABBBBE95F3 c:\windows\system32\dllcache\kernel32.dll

[7] 2004-08-04 06:56 17408 1B5F6923ABB450692E9FE0672C897AED c:\windows\$NtServicePackUninstall$\powrprof.dll
[7] 2008-04-14 00:12 17408 50A166237A0FA771261275A405646CC0 c:\windows\ServicePackFiles\i386\powrprof.dll
[7] 2008-04-14 00:12 17408 50A166237A0FA771261275A405646CC0 c:\windows\system32\powrprof.dll

[7] 2004-08-04 06:56 110080 87CA7CE6469577F059297B9D6556D66D c:\windows\$NtServicePackUninstall$\imm32.dll
[7] 2008-04-14 00:11 110080 0DA85218E92526972A821587E6A8BF8F c:\windows\ServicePackFiles\i386\imm32.dll
[7] 2008-04-14 00:11 110080 0DA85218E92526972A821587E6A8BF8F c:\windows\system32\imm32.dll
[7] 2008-04-14 00:11 110080 0DA85218E92526972A821587E6A8BF8F c:\windows\system32\dllcache\imm32.dll

[7] 2004-08-04 06:56 1580544 30A609E00BD1D4FFC49D6B5A432BE7F2 c:\windows\$NtServicePackUninstall$\sfcfiles.dll
[7] 2008-04-14 00:12 1614848 9DD07AF82244867CA36681EA2D29CE79 c:\windows\ServicePackFiles\i386\sfcfiles.dll
[7] 2008-04-14 00:12 1614848 9DD07AF82244867CA36681EA2D29CE79 c:\windows\system32\sfcfiles.dll

[7] 2004-08-04 06:56 167936 9C3C12975C97119412802B181FBEEFFE c:\windows\$NtServicePackUninstall$\appmgmts.dll
[7] 2008-04-14 00:11 167936 D8849F77C0B66226335A59D26CB4EDC6 c:\windows\ServicePackFiles\i386\appmgmts.dll
[7] 2008-04-14 00:11 167936 D8849F77C0B66226335A59D26CB4EDC6 c:\windows\system32\appmgmts.dll

[7] 2004-08-04 04:58 24576 EBDEE8A2EE5393890A1ACEE971C4C246 c:\windows\$NtServicePackUninstall$\kbdclass.sys
[7] 2008-04-13 18:39 24576 463C1EC80CD17420A542B7F36A36F128 c:\windows\ServicePackFiles\i386\kbdclass.sys
[7] 2008-04-13 18:39 24576 463C1EC80CD17420A542B7F36A36F128 c:\windows\system32\drivers\kbdclass.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"Advanced SystemCare 3"="c:\program files\IObit\Advanced SystemCare 3\AWC.exe" [2009-06-17 2328712]
"SmartRAM"="c:\program files\IObit\Advanced SystemCare 3\Sup_SmartRAM.exe" [2009-02-19 202064]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"CoolSwitch"="c:\windows\system32\taskswitch.exe" [2001-10-08 45632]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-12-19 135168]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-12-19 159744]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-12-19 131072]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"ThreatFire"="c:\program files\ThreatFire\TFTray.exe" [2009-06-19 259344]
"00PCTFW"="c:\program files\PC Tools Firewall Plus\FirewallGUI.exe" [2008-03-28 2598808]

c:\documents and settings\Michael Francis\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
SpywareGuard.lnk - c:\program files\SpywareGuard\sgmain.exe [2003-8-29 360448]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoSMMyPictures"= 0 (0x0)
"NoStartMenuMyMusic"= 0 (0x0)
"NoRecentDocsNetHood"= 0 (0x0)
"NoSimpleStartMenu"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMMyPictures"= 0 (0x0)
"NoStartMenuMyMusic"= 0 (0x0)
"NoRecentDocsNetHood"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
"FastUser"=c:\windows\system32\fast.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Soulseek\\slsk.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\SoulseekNS\\slsk.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=

R0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys [6/22/2009 11:19 PM 51984]
R0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys [6/22/2009 11:19 PM 46864]
R1 pctfw2;pctfw2;c:\windows\system32\drivers\pctfw2.sys [6/22/2009 11:20 PM 159896]
R1 pctssipc;PC Tools Security Suite IPC Driver;c:\windows\system32\drivers\pctssipc.sys [6/22/2009 11:19 PM 18328]
R2 ThreatFire;ThreatFire;c:\program files\ThreatFire\TFService.exe service --> c:\program files\ThreatFire\TFService.exe service [?]
R3 TfNetMon;TfNetMon;c:\windows\system32\drivers\TfNetMon.sys [6/22/2009 11:19 PM 33552]
S3 ADM8511;ADMtek ADM8511/AN986 USB To Fast Ethernet Converter;c:\windows\system32\drivers\ADM8511.SYS [4/12/2008 2:16 PM 20160]
S3 SeratoUsb;SeratoUsb driver;c:\windows\system32\drivers\SeratoUsb.sys [3/16/2006 4:24 PM 35712]

--- Other Services/Drivers In Memory ---

*Deregistered* - mchInjDrv

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-05-07 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 18:34]

2009-06-29 c:\windows\Tasks\GlaryInitialize.job
- c:\program files\Glary Utilities\initialize.exe [2008-04-11 02:44]
.

- - - - ORPHANS REMOVED - - - -

Notify-WgaLogon - (no file)


.
------- Supplementary Scan -------
.
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Michael Francis\Application Data\Mozilla\Firefox\Profiles\ejisdlzw.default\
FF - component: c:\documents and settings\Michael Francis\Application Data\Mozilla\Firefox\Profiles\ejisdlzw.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}\components\WinampTBPlayer.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true
FF - user.js: browser.sessionstore.resume_from_crash - false
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-29 17:26
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1400)
c:\windows\system32\NavLogon.dll
c:\program files\ThreatFire\TFWAH.dll
c:\program files\ThreatFire\TFNI.dll
c:\program files\ThreatFire\TFMon.dll
c:\program files\ThreatFire\TFRK.dll

- - - - - - - > 'lsass.exe'(1480)
c:\program files\ThreatFire\TFWAH.dll

- - - - - - - > 'explorer.exe'(2732)
c:\windows\system32\WININET.dll
c:\program files\ThreatFire\TFWAH.dll
c:\windows\system32\ieframe.dll
c:\program files\ThreatFire\TFNI.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\MSVCR80.dll
c:\program files\ThreatFire\TFMon.dll
c:\program files\ThreatFire\TFRK.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\PC Tools Firewall Plus\FWService.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\NavNT\defwatch.exe
c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\program files\SpywareGuard\sgbhp.exe
c:\program files\ThreatFire\TFService.exe
.
**************************************************************************
.
Completion time: 2009-06-29 17:51 - machine was rebooted
ComboFix-quarantined-files.txt 2009-06-29 22:51

Pre-Run: 66,609,156,096 bytes free
Post-Run: 66,606,346,240 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

1094 --- E O F --- 2009-06-17 03:39

Now open a new notepad file.
Input this into the notepad file:

File::
c:\windows\2933259ambzt.exe

Folder::
C:\!KillBox
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=-

Save this as CFScript.txt, save it to your desktop also.
Then drag and drop CFScript.txt into combofix as seen below:


This will open combofix again, agree to it's terms and allow it to run.
It may want to reboot after it's done. (It will warn you if it wants to)
Post the resulting log back here.