i have winbluesoft on my pc.......

I have hijack this install and my PC ingores it.
I'm running Windows XP with Service Pack 3
I was able to temporarly disable setup2.exe, I would like assistance with fixing my machine. Please help!!!!!!
I looked for the Blocker.dll and it's not present on my machine
I have malware ready to go when I fix the problem.

I was able to DL Silent Runners and i have the report:
"Silent Runners.vbs", revision 59, http://www.silentrunners.org/
Operating System: Windows XP
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
---------------------------------

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"ctfmon.exe" = "C:\WINDOWS\system32\ctfmon.exe" [MS]
"MSMSGS" = ""C:\Program Files\Messenger\msmsgs.exe" /background" [MS]
"setup2.exe" = "C:\WINDOWS\system32\setup2.exe" [null data]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"]
"CoolSwitch" = "C:\WINDOWS\system32\taskswitch.exe" [null data]
"FastUser" = "C:\WINDOWS\system32\fast.exe" [MS]
"vptray" = "C:\Program Files\NavNT\vptray.exe" ["Symantec Corporation"]
"IgfxTray" = "C:\WINDOWS\system32\igfxtray.exe" ["Intel Corporation"]
"HotKeysCmds" = "C:\WINDOWS\system32\hkcmd.exe" ["Intel Corporation"]
"Persistence" = "C:\WINDOWS\system32\igfxpers.exe" ["Intel Corporation"]
"Adobe Reader Speed Launcher" = ""C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"" ["Adobe Systems Incorporated"]
"QuickTime Task" = ""C:\Program Files\QuickTime\QTTask.exe" -atboottime" ["Apple Inc."]
"SunJavaUpdateSched" = ""C:\Program Files\Java\jre6\bin\jusched.exe"" ["Sun Microsystems, Inc."]
"WinBlueSoft" = "C:\Program Files\WinBlueSoft Software\WinBlueSoft\WinBlueSoft.exe -min" [file not found]
"Ad-Watch" = "C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe" ["Lavasoft"]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ {++}
"Malwarebytes' Anti-Malware" = "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent" ["Malwarebytes Corporation"]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Adobe PDF Reader Link Helper"
\InProcServer32\(Default) = "C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]
{DBC80044-A445-435b-BC74-9C25C1C588A9}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Java(tm) Plug-In 2 SSV Helper"
\InProcServer32\(Default) = "C:\Program Files\Java\jre6\bin\jp2ssv.dll" ["Sun Microsystems, Inc."]
{E7E6F031-17CE-4C07-BC86-EABFE594F69C}\(Default) = "JQSIEStartDetectorImpl"
-> {HKLM...CLSID} = "JQSIEStartDetectorImpl Class"
\InProcServer32\(Default) = "C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll" ["Sun Microsystems, Inc."]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Display Panning CPL Extension"
-> {HKLM...CLSID} = "Display Panning CPL Extension"
\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "HyperTerminal Icon Ext"
-> {HKLM...CLSID} = "HyperTerminal Icon Ext"
\InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler"
-> {HKLM...CLSID} = "Outlook File Icon Extension"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office\OLKFSTUB.DLL" [MS]
"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office10\msohev.dll" [MS]
"{709C6E11-538F-4759-86AC-6ACB302AA0DE}" = "Desktop Manager"
-> {HKLM...CLSID} = "Desktop Manager"
\InProcServer32\(Default) = "C:\WINDOWS\system32\msvdm.dll" [null data]
"{1530F7EE-5128-43BD-9977-84A4B0FAD7DF}" = "PhotoToys"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\phototoys.dll" [MS]
"{efb97cb8-a4a4-4357-a261-002ffaed0267}" = "CD Slideshow Powertoy"
-> {HKLM...CLSID} = "CD Burn Slideshow Hook"
\InProcServer32\(Default) = "C:\WINDOWS\system32\slideshow.dll" [MS]
"{72923739-5A47-40A3-9895-25AF0DFBB9E4}" = "Glary Utilities Context Menu Shell Extension"
-> {HKLM...CLSID} = "Glary Utilities Context Menu Shell Extension"
\InProcServer32\(Default) = "C:\PROGRA~1\GLARYU~1\CONTEX~1.DLL" ["GlarySoft.com"]
"{BDA77241-42F6-11d0-85E2-00AA001FE28C}" = "LDVP Shell Extensions"
-> {HKLM...CLSID} = "VpshellEx Class"
\InProcServer32\(Default) = "C:\Program Files\Common Files\Symantec Shared\SSC\vpshell2.dll" ["Symantec Corporation"]
"{e57ce731-33e8-4c51-8354-bb4de9d215d1}" = "Universal Plug and Play Devices"
-> {HKLM...CLSID} = "Universal Plug and Play Devices"
\InProcServer32\(Default) = "C:\WINDOWS\system32\upnpui.dll" [MS]
"{11016101-E366-4D22-BC06-4ADA335C892B}" = "IE History and Feeds Shell Data Source for Windows Search"
-> {HKLM...CLSID} = "IE History and Feeds Shell Data Source for Windows Search"
\InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\
"WPDShServiceObj" = "{AAA288BA-9A4C-45B0-95D7-94D524869DB5}"
-> {HKLM...CLSID} = "WPDShServiceObj Class"
\InProcServer32\(Default) = "C:\WINDOWS\system32\WPDShServiceObj.dll" [MS]

HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\
<> ("digeste.dll" [file not found]) "SecurityProviders" = "msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, digeste.dll"

HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\
<> "BootExecute" = "autocheck autochk *"|"lsdelete" [null data]

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
<> igfxcui\DLLName = "igfxdev.dll" ["Intel Corporation"]
<> NavLogon\DLLName = "C:\WINDOWS\system32\NavLogon.dll" [null data]

HKLM\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\
{F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info"
-> {HKLM...CLSID} = "PDF Shell Extension"
\InProcServer32\(Default) = "C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."]

HKLM\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\
Glary Utilities\(Default) = "{72923739-5A47-40A3-9895-25AF0DFBB9E4}"
-> {HKLM...CLSID} = "Glary Utilities Context Menu Shell Extension"
\InProcServer32\(Default) = "C:\PROGRA~1\GLARYU~1\CONTEX~1.DLL" ["GlarySoft.com"]
LavasoftShellExt\(Default) = "{DCE027F7-16A4-4BEE-9BE7-74F80EE3738F}"
-> {HKLM...CLSID} = "Lavasoft Shell Extension"
\InProcServer32\(Default) = "C:\Program Files\Lavasoft\Ad-Aware\ShellExt.dll" [null data]
LDVPMenu\(Default) = "{BDA77241-42F6-11d0-85E2-00AA001FE28C}"
-> {HKLM...CLSID} = "VpshellEx Class"
\InProcServer32\(Default) = "C:\Program Files\Common Files\Symantec Shared\SSC\vpshell2.dll" ["Symantec Corporation"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\
Glary Utilities\(Default) = "{72923739-5A47-40A3-9895-25AF0DFBB9E4}"
-> {HKLM...CLSID} = "Glary Utilities Context Menu Shell Extension"
\InProcServer32\(Default) = "C:\PROGRA~1\GLARYU~1\CONTEX~1.DLL" ["GlarySoft.com"]
LavasoftShellExt\(Default) = "{DCE027F7-16A4-4BEE-9BE7-74F80EE3738F}"
-> {HKLM...CLSID} = "Lavasoft Shell Extension"
\InProcServer32\(Default) = "C:\Program Files\Lavasoft\Ad-Aware\ShellExt.dll" [null data]
LDVPMenu\(Default) = "{BDA77241-42F6-11d0-85E2-00AA001FE28C}"
-> {HKLM...CLSID} = "VpshellEx Class"
\InProcServer32\(Default) = "C:\Program Files\Common Files\Symantec Shared\SSC\vpshell2.dll" ["Symantec Corporation"]
MBAMShlExt\(Default) = "{57CE581A-0CB6-4266-9CA0-19364C90A0B3}"
-> {HKLM...CLSID} = "MBAMShlExt Class"
\InProcServer32\(Default) = "C:\Program Files\Malwarebytes' Anti-Malware\mbamext.dll" ["Malwarebytes Corporation"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\
MBAMShlExt\(Default) = "{57CE581A-0CB6-4266-9CA0-19364C90A0B3}"
-> {HKLM...CLSID} = "MBAMShlExt Class"
\InProcServer32\(Default) = "C:\Program Files\Malwarebytes' Anti-Malware\mbamext.dll" ["Malwarebytes Corporation"]


Group Policies {GPedit.msc branch and setting}:
-----------------------------------------------

Note: detected settings may not have any effect.

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\

"NoWindowsUpdate" = (REG_DWORD) dword:0x00000000
{User Configuration|Administrative Templates|Start Menu and Taskbar|
Remove links and access to Windows Update}

"NoInstrumentation" = (REG_DWORD) dword:0x00000001
{unrecognized setting}

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\

"NoInstrumentation" = (REG_DWORD) dword:0x00000001
{unrecognized setting}

"HonorAutoRunSetting" = (REG_DWORD) dword:0x00000001
{unrecognized setting}

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\WindowsUpdate\

"DisableWindowsUpdateAccess" = (REG_DWORD) dword:0x00000000
{User Configuration|Administrative Templates|Windows Components|Windows Update|
Remove access to use all Windows Update features}

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\

"shutdownwithoutlogon" = (REG_DWORD) dword:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Shutdown: Allow system to be shut down without having to log on}

"undockwithoutlogon" = (REG_DWORD) dword:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Devices: Allow undock without having to log on}


Active Desktop and Wallpaper:
-----------------------------

Active Desktop may be disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

Displayed if Active Desktop enabled and wallpaper not set by Group Policy:
HKCU\Software\Microsoft\Internet Explorer\Desktop\General\
"Wallpaper" = "C:\DOCUME~1\MICHAE~1\LOCALS~1\Temp\MSVDM-Desktop0.bmp"

Displayed if Active Desktop disabled and wallpaper not set by Group Policy:
HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\Documents and Settings\Michael Francis\Application Data\Mozilla\Firefox\Desktop Background.bmp"


Enabled Screen Saver:
---------------------

HKCU\Control Panel\Desktop\
"SCRNSAVE.EXE" = "C:\WINDOWS\system32\ssstars.scr" [MS]


Windows Portable Device AutoPlay Handlers
-----------------------------------------

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\

MSWPDShellNamespaceHandler\
"Provider" = "@%SystemRoot%\System32\WPDShextRes.dll,-501"
"CLSID" = "{A55803CC-4D53-404c-8557-FD63DBA95D24}"
"InitCmdLine" = " "
-> {HKLM...CLSID} = "WPDShextAutoplay"
\LocalServer32\(Default) = "C:\WINDOWS\system32\WPDShextAutoplay.exe" [MS]

NeroAutoPlay2AudioToNeroDigital\
"Provider" = "Nero Burning ROM"
"InvokeProgID" = "Nero.AutoPlay2"
"InvokeVerb" = "PlayCDAudioOnArrival_AudioToNeroDigital"
HKLM\SOFTWARE\Classes\Nero.AutoPlay2\shell\PlayCDAudioOnArrival_AudioToNeroDigital\command\(Default) = "C:\Program Files\Ahead\nero\nero.exe /Dialog:SaveTracks /Drive:%L" ["Ahead Software AG"]

NeroAutoPlay2CDAudio\
"Provider" = "Nero Express"
"InvokeProgID" = "Nero.AutoPlay2"
"InvokeVerb" = "HandleCDBurningOnArrival_CDAudio"
HKLM\SOFTWARE\Classes\Nero.AutoPlay2\shell\HandleCDBurningOnArrival_CDAudio\command\(Default) = "C:\Program Files\Ahead\nero\nero.exe /w /New:AudioCD /Drive:%L" ["Ahead Software AG"]

NeroAutoPlay2CopyCD\
"Provider" = "Nero Express"
"InvokeProgID" = "Nero.AutoPlay2"
"InvokeVerb" = "PlayCDAudioOnArrival_CopyCD"
HKLM\SOFTWARE\Classes\Nero.AutoPlay2\shell\PlayCDAudioOnArrival_CopyCD\command\(Default) = "C:\Program Files\Ahead\nero\nero.exe /w /Dialog:DiscCopy /Drive:%L" ["Ahead Software AG"]

NeroAutoPlay2DataDisc\
"Provider" = "Nero Express"
"InvokeProgID" = "Nero.AutoPlay2"
"InvokeVerb" = "HandleCDBurningOnArrival_DataDisc"
HKLM\SOFTWARE\Classes\Nero.AutoPlay2\shell\HandleCDBurningOnArrival_DataDisc\command\(Default) = "C:\Program Files\Ahead\nero\nero.exe /w /New:ISODisc /Drive:%L" ["Ahead Software AG"]

NeroAutoPlay2LaunchNeroStartSmart\
"Provider" = "Nero StartSmart"
"InvokeProgID" = "Nero.AutoPlay2"
"InvokeVerb" = "HandleCDBurningOnArrival_LaunchNeroStartSmart"
HKLM\SOFTWARE\Classes\Nero.AutoPlay2\shell\HandleCDBurningOnArrival_LaunchNeroStartSmart\command\(Default) = "C:\Program Files\Ahead\Nero StartSmart\NeroStartSmart.exe /AutoPlay /Drive:%L" ["Ahead Software AG"]

NeroAutoPlay2RipCD\
"Provider" = "Nero Burning ROM"
"InvokeProgID" = "Nero.AutoPlay2"
"InvokeVerb" = "PlayCDAudioOnArrival_RipCD"
HKLM\SOFTWARE\Classes\Nero.AutoPlay2\shell\PlayCDAudioOnArrival_RipCD\command\(Default) = "C:\Program Files\Ahead\nero\nero.exe /Dialog:SaveTracks /Drive:%L" ["Ahead Software AG"]

WinampMTPHandler\
"Provider" = "Winamp"
"ProgID" = "Shell.HWEventHandlerShellExecute"
"InitCmdLine" = "C:\Program Files\Winamp\winamp.exe"
HKLM\SOFTWARE\Classes\Shell.HWEventHandlerShellExecute\CLSID\(Default) = "{FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}"
-> {HKLM...CLSID} = "ShellExecute HW Event Handler"
\LocalServer32\(Default) = "rundll32.exe shell32.dll,SHCreateLocalServerRunDll {FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}" [MS]

WinampPlayMediaOnArrival\
"Provider" = "Winamp"
"InvokeProgID" = "Winamp.File"
"InvokeVerb" = "Play"
HKLM\SOFTWARE\Classes\Winamp.File\shell\Play\command\(Default) = ""C:\Program Files\Winamp\winamp.exe" "%1"" ["Nullsoft"]
HKLM\SOFTWARE\Classes\Winamp.File\shell\Play\DropTarget\CLSID = "{46986115-84D6-459c-8F95-52DD653E532E}"
-> {HKLM...CLSID} = (no title provided)
\LocalServer32\(Default) = ""C:\Program Files\Winamp\winamp.exe"" ["Nullsoft"]


Startup items in "Michael Francis" & "All Users" startup folders:
-----------------------------------------------------------------

C:\Documents and Settings\Michael Francis\Start Menu\Programs\Startup
"Adobe Gamma" -> shortcut to: "C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe" ["Adobe Systems, Inc."]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
"Microsoft Office" -> shortcut to: "C:\Program Files\Microsoft Office\Office\OSA9.EXE -b -l" [MS]


Enabled Scheduled Tasks:
------------------------

"Ad-Aware Update (Weekly)" -> launches: "C:\Program Files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe update all silent" ["Lavasoft"]
"AppleSoftwareUpdate" -> launches: "C:\Program Files\Apple Software Update\SoftwareUpdate.exe -task" ["Apple Inc."]
"GlaryInitialize" -> launches: "C:\Program Files\Glary Utilities\initialize.exe" ["GlarySoft.com"]
"{5B57CF47-0BFA-43c6-ACF9-3B3653DCADBA}" -> launches: "C:\WINDOWS\TEMP\tempo-21391109.tmp" [null data]


Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 15
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05


Toolbars, Explorer Bars, Extensions:
------------------------------------

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\
{E2E2DD38-D088-4134-82B7-F2BA38496583}\
"MenuText" = "@xpsp3res.dll,-20001"
"Exec" = "%windir%\Network Diagnostic\xpnetdiag.exe" [MS]

{FB5F1910-F110-11D2-BB9E-00C04F795683}\
"ButtonText" = "Messenger"
"MenuText" = "Windows Messenger"
"Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS]


Miscellaneous IE Hijack Points
------------------------------

C:\WINDOWS\INF\IERESET.INF (used to "Reset Web Settings")

Added lines (compared with English-language version):
[Strings]: START_PAGE_URL="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
[Strings]: MS_START_PAGE_URL="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"

Missing lines (compared with English-language version):
[Strings]: 2 lines

HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs\
<> "InPrivate" = "res://ieframe.dll/inprivate.htm" [MS]


Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

Apple Mobile Device, Apple Mobile Device, ""C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe"" ["Apple Inc."]
DefWatch, DefWatch, ""C:\Program Files\NavNT\defwatch.exe"" ["Symantec Corporation"]
InteractiveLogon, InteractiveLogon, "C:\WINDOWS\system32\Fast.exe -service" [MS]
Java Quick Starter, JavaQuickStarterService, ""C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf"" ["Sun Microsystems, Inc."]
Lavasoft Ad-Aware Service, Lavasoft Ad-Aware Service, ""C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe"" ["Lavasoft"]
Machine Debug Manager, MDM, ""C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe"" [MS]
Norton AntiVirus Client, Norton AntiVirus Server, ""C:\Program Files\NavNT\rtvscan.exe"" ["Symantec Corporation"]


---------- (launch time: 2009-06-22 18:30:47)
<>: Suspicious data at a malware launch point.
<>: Suspicious data at a browser hijack point.

+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ The search for DESKTOP.INI DLL launch points on all local fixed drives
took 39 seconds.
---------- (total run time: 113 seconds)

I'm unsure how to create a fix registry File.

PLEASE HELP!!!!!

Please navigate to this file and delete it: C:\windows\system32\blocker.dll

See if you can run HijackThis now.

i don't have the blocker.dll on my pc. for some reason I'm not able to run Hijack this. Would you suggest any other options?

See if you can run this.

• Please download DDS by sUBs to your Desktop (Important!!) from one of these locations:
  Link 1
  Link 2
  
• Double click DDS.scr to run.
  
• When complete, two logs will open. Save both of the report to your Desktop.
  
• Copy and paste DDS.txt back here, I don't need to see attach.txt.
  

DDS (Ver_09-05-14.01) - NTFSx86
Run by Michael Francis at 18:52:07.37 on Tue 06/23/2009
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1015.524 [GMT -5:00]

FW: PC Tools Firewall Plus *enabled* {ABBD5028-5A95-4B6D-996E-98D64AE88D52}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
C:\Program Files\PC Tools Firewall Plus\FWService.exe
C:\WINDOWS\system32\svchost -k rpcss
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\NavNT\defwatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\ThreatFire\TFService.exe
C:\WINDOWS\system32\Fast.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\WINDOWS\system32\taskswitch.exe
C:\Program Files\NavNT\vptray.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\ThreatFire\TFTray.exe
C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\setup2.exe
C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe
C:\Program Files\IObit\Advanced SystemCare 3\Sup_SmartRAM.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\WINDOWS\system32\MsgSys.EXE
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Michael Francis\My Documents\My Pictures\dds.scr
C:\WINDOWS\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: SpywareGuardDLBLOCK.CBrowserHelper: {4a368e80-174f-4872-96b5-0b27ddd11db2} - c:\program files\spywareguard\dlprotect.dll
BHO: {DBC80044-A445-435b-BC74-9C25C1C588A9} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRun: [setup2.exe] c:\windows\system32\setup2.exe
uRun: [Advanced SystemCare 3] "c:\program files\iobit\advanced systemcare 3\AWC.exe" /startup
uRun: [SmartRAM] "c:\program files\iobit\advanced systemcare 3\Sup_SmartRAM.exe" /m
mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe
mRun: [CoolSwitch] c:\windows\system32\taskswitch.exe
mRun: [vptray] c:\program files\navnt\vptray.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [ThreatFire] c:\program files\threatfire\TFTray.exe
mRun: [00PCTFW] "c:\program files\pc tools firewall plus\FirewallGUI.exe" -s
StartupFolder: c:\docume~1\michae~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
StartupFolder: c:\docume~1\michae~1\startm~1\programs\startup\spywar~1.lnk - c:\program files\spywareguard\sgmain.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office\OSA9.EXE
uPolicies-explorer: NoWindowsUpdate = 0 (0x0)
uPolicies-explorer: NoSMMyPictures = 0 (0x0)
uPolicies-explorer: NoStartMenuMyMusic = 0 (0x0)
uPolicies-explorer: NoRecentDocsNetHood = 0 (0x0)
uPolicies-explorer: NoInstrumentation = 0 (0x0)
mPolicies-explorer: NoSMMyPictures = 0 (0x0)
mPolicies-explorer: NoStartMenuMyMusic = 0 (0x0)
mPolicies-explorer: NoRecentDocsNetHood = 0 (0x0)
mPolicies-explorer: NoInstrumentation = 0 (0x0)
mPolicies-explorer: NoSimpleStartMenu = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
TCP: NameServer = 85.255.112.194,85.255.112.125
TCP: {30135F0A-AB3F-4664-8C6D-9A53D0282FCF} = 85.255.112.194,85.255.112.125
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL
Notify: igfxcui - igfxdev.dll
Notify: NavLogon - c:\windows\system32\NavLogon.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: SpywareGuard.Handler: {81559c35-8464-49f7-bb0e-07a383bef910} - c:\program files\spywareguard\spywareguard.dll
SecurityProviders: msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, digeste.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\michae~1\applic~1\mozilla\firefox\profiles\ejisdlzw.default\
FF - component: c:\documents and settings\michael francis\application data\mozilla\firefox\profiles\ejisdlzw.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}\components\WinampTBPlayer.dll

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true
FF - user.js: browser.sessionstore.resume_from_crash - false

============= SERVICES / DRIVERS ===============

R0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys [2009-6-22 51984]
R0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys [2009-6-22 46864]
R1 pctfw2;pctfw2;c:\windows\system32\drivers\pctfw2.sys [2009-6-22 159896]
R1 pctmp;PC Tools Firewall Memory Protection Driver;c:\windows\system32\drivers\pctmp.sys [2009-6-22 40856]
R1 pctssipc;PC Tools Security Suite IPC Driver;c:\windows\system32\drivers\pctssipc.sys [2009-6-22 18328]
R2 NAVAPEL;NAVAPEL;c:\program files\navnt\Navapel.sys [2002-3-28 18000]
R2 Norton AntiVirus Server;Norton AntiVirus Client;c:\program files\navnt\rtvscan.exe [2002-3-29 471040]
R2 PCToolsFirewallPlus;PC Tools Firewall Plus;c:\program files\pc tools firewall plus\FWService.exe [2009-6-22 92056]
R2 ThreatFire;ThreatFire;c:\program files\threatfire\tfservice.exe service --> c:\program files\threatfire\TFService.exe service [?]
R3 NAVAP;NAVAP;c:\program files\navnt\navap.sys [2002-3-28 185984]
R3 NAVENG;NAVENG;c:\progra~1\common~1\symant~1\virusd~1\20090610.002\NAVENG.sys [2009-6-12 89104]
R3 NAVEX15;NAVEX15;c:\progra~1\common~1\symant~1\virusd~1\20090610.002\NAVEX15.sys [2009-6-12 876144]
R3 TfNetMon;TfNetMon;c:\windows\system32\drivers\TfNetMon.sys [2009-6-22 33552]
S3 ADM8511;ADMtek ADM8511/AN986 USB To Fast Ethernet Converter;c:\windows\system32\drivers\ADM8511.SYS [2008-4-12 20160]
S3 SeratoUsb;SeratoUsb driver;c:\windows\system32\drivers\SeratoUsb.sys [2006-3-16 35712]

============== File Associations ===============

regfile="regedit.exe" "%1"

=============== Created Last 30 ================

2009-06-23 13:39 3,295 a------- c:\windows\system32\9z050s5y62.dll
2009-06-22 23:57 --d----- c:\program files\Trend Micro
2009-06-22 23:23 --d----- c:\docume~1\michae~1\applic~1\PCToolsFirewallPlus
2009-06-22 23:20 159,896 a------- c:\windows\system32\drivers\pctfw2.sys
2009-06-22 23:19 93,440 a------- c:\windows\system32\drivers\pctfw.sys
2009-06-22 23:19 40,856 a------- c:\windows\system32\drivers\pctmp.sys
2009-06-22 23:19 18,328 a------- c:\windows\system32\drivers\pctssipc.sys
2009-06-22 23:19 --d----- c:\program files\common files\PC Tools
2009-06-22 23:19 --d----- c:\program files\PC Tools Firewall Plus
2009-06-22 23:19 51,984 a------- c:\windows\system32\drivers\TfFsMon.sys
2009-06-22 23:19 46,864 a------- c:\windows\system32\drivers\TfSysMon.sys
2009-06-22 23:19 33,552 a------- c:\windows\system32\drivers\TfNetMon.sys
2009-06-22 23:19 --d----- c:\program files\ThreatFire
2009-06-22 23:19 --d----- c:\docume~1\alluse~1\applic~1\PC Tools
2009-06-22 23:10 --d----- c:\docume~1\michae~1\applic~1\IObit
2009-06-22 23:10 --d----- c:\program files\IObit
2009-06-22 23:09 --d----- c:\program files\Lavasoft
2009-06-22 19:10 5,868 a------- c:\windows\5553downloadz9962.bin
2009-06-22 18:43 17,106 a------- c:\windows\5z49s5arse1201.bin
2009-06-22 18:34 --d----- C:\!KillBox
2009-06-22 18:24 15,504 a------- c:\windows\system32\drivers\mbam.sys
2009-06-22 18:24 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-22 18:24 --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-06-22 18:24 --d----- c:\program files\Malwarebytes' Anti-Malware
2009-06-22 16:49 3,663 a------- c:\windows\43z8vir2591.bin
2009-06-22 10:05 12,694 a------- c:\windows\d2c9a5kdozr2019.bin
2009-06-21 15:43 15,684 a------- c:\windows\255z6wo5970.dll
2009-06-21 04:04 10,663 a------- c:\windows\system32\2e5cthzef1195.cpl
2009-06-20 00:36 9,987 a------- c:\windows\system32\20395vi5us791z.bin
2009-06-19 05:38 16,566 a------- c:\windows\z7804v5r9s5eb.exe
2009-06-18 23:02 16,875 a------- c:\windows\17535s9yz5f.cpl
2009-06-18 18:19 --d----- c:\program files\Microsoft AntiSpyware
2009-06-18 18:19 --d----- c:\program files\SpywareBlaster
2009-06-18 18:17 --d----- c:\program files\Spybot - Search & Destroy
2009-06-18 18:17 --d----- c:\program files\SpywareGuard
2009-06-17 22:09 --dsh--- c:\documents and settings\michael francis\IECompatCache
2009-06-17 22:08 --dsh--- c:\documents and settings\michael francis\PrivacIE
2009-06-17 22:06 44,944 -------- c:\windows\system32\drivers\PxHelp20.sys
2009-06-17 22:06 9,200 -------- c:\windows\system32\drivers\cdralw2k.sys
2009-06-17 22:06 9,072 -------- c:\windows\system32\drivers\cdr4_xp.sys
2009-06-17 22:06 129,520 -------- c:\windows\system32\pxafs.dll
2009-06-17 16:37 12,280 a------- c:\windows\system32\7fz8thie52966.exe
2009-06-16 22:41 --dsh--- c:\documents and settings\michael francis\IETldCache
2009-06-16 22:39 246,272 -c------ c:\windows\system32\dllcache\ieproxy.dll
2009-06-16 22:39 12,800 -c------ c:\windows\system32\dllcache\xpshims.dll
2009-06-16 22:39 --d----- c:\windows\ie8updates
2009-06-16 22:38 102,912 -c------ c:\windows\system32\dllcache\iecompat.dll
2009-06-16 22:36 -cd-h--- c:\windows\ie8
2009-06-16 18:50 13,755 a------- c:\windows\19629pyware7z05.exe
2009-06-16 09:35 14,288 a------- c:\windows\6zbc9ac5door2966.cpl
2009-06-14 09:15 7,309 a------- c:\windows\z699spy515.dll
2009-06-09 23:24 8,540 a------- c:\windows\system32\2975dow9loadez5998.cpl
2009-06-09 01:30 4,474 a------- c:\windows\system32\504csteal9z83.ocx
2009-06-07 23:58 647,872 a------- c:\windows\system32\mscomct2.ocx
2009-06-07 23:58 140,488 a------- c:\windows\system32\comdlg32.ocx
2009-06-07 23:58 61,440 a------- c:\windows\system32\digitbox.ocx
2009-06-07 23:58 --d----- c:\program files\Alarm
2009-06-07 19:29 --d----- c:\windows\system32\appmgmt
2009-06-07 16:17 4,946 a------- c:\windows\591hazkt5ol72c.ocx
2009-06-06 19:09 3,580 a------- c:\windows\198z9ot-a-v5rus2e4.exe
2009-06-06 17:34 10,316 a------- c:\windows\system32\773zs9ar5e17.cpl
2009-06-06 03:41 6,152 a------- c:\windows\c99bac9do5z579.exe
2009-06-05 19:59 7,589 a------- c:\windows\996zworm1c5.ocx
2009-06-05 17:04 9,273 a------- c:\windows\system32\5ac9spazs9359.bin
2009-06-05 08:13 17,288 a------- c:\windows\system32\25105woz95a.dll
2009-06-03 07:11 7,232 a------- c:\windows\435dvir2349z.dll
2009-06-01 16:53 4,705 a------- c:\windows\5a75addz9re2839.ocx
2009-06-01 11:35 18,173 a------- c:\windows\52z5thie518519.ocx
2009-05-31 22:02 8,935 a------- c:\windows\30597spambot1e4z.ocx

==================== Find3M ====================

2009-06-18 19:12 170,894 a------- c:\windows\pchealth\helpctr\config\cache\Professional_32_1033.dat
2009-05-24 13:27 15,823 a------- c:\windows\4210v9r5s4fz.exe
2009-05-22 16:26 12,037 a------- c:\windows\15993not-a9zirus33a.bin
2009-05-21 11:33 410,984 a------- c:\windows\system32\deploytk.dll
2009-05-21 02:13 15,652 a------- c:\windows\system32\582znot-a-virus297.dll
2009-05-19 11:03 18,033 a------- c:\windows\system32\4z89backdoor5903.bin
2009-05-18 21:58 14,289 a------- c:\windows\59c5zir1954.dll
2009-05-18 03:24 6,386 a------- c:\windows\62fcspz95e2197.dll
2009-05-16 17:50 16,361 a------- c:\windows\50z9pambot6ea.bin
2009-05-16 02:56 13,874 a------- c:\windows\65efthreat9177z.bin
2009-05-15 23:22 7,999 a------- c:\windows\system32\569159reat13z50.dll
2009-05-14 07:39 13,677 a------- c:\windows\system32\3518spaz9e216.exe
2009-05-13 00:15 915,456 a------- c:\windows\system32\wininet.dll
2009-05-12 19:30 8,238 a------- c:\windows\system32\9z130w5rmac.exe
2009-05-12 13:08 3,378 a------- c:\windows\system32\9551steal2887z.exe
2009-05-12 11:42 6,120 a------- c:\windows\60b8v59265z.dll
2009-05-07 10:32 345,600 a------- c:\windows\system32\localspl.dll
2009-05-05 22:49 6,041 a------- c:\windows\z3507hack9oo5545.exe
2009-05-05 00:43 3,243 a------- c:\windows\system32\115eb9ckdoorz24.dll
2009-05-04 01:18 10,846 a------- c:\windows\system32\18099tro925z.dll
2009-05-02 10:16 3,184 a------- c:\windows\47ez9teal2953.exe
2009-05-02 00:26 11,497 a------- c:\windows\16486zpy596.bin
2009-04-28 07:00 2,963 a------- c:\windows\system32\5zbfdownloade93197.dll
2009-04-25 18:59 16,203 a------- c:\windows\system32\9z510spy5be.exe
2009-04-24 17:23 5,310 a------- c:\windows\system32\1449hackz9o5365.exe
2009-04-24 04:25 15,482 a------- c:\windows\z159download9r2220.dll
2009-04-24 01:36 3,762 a------- c:\windows\7ecfth5ezt8294.bin
2009-04-20 06:29 14,064 a------- c:\windows\system32\752spy9zre2575.exe
2009-04-20 04:04 15,716 a------- c:\windows\system32\9d45zparse555.bin
2009-04-18 02:40 13,174 a------- c:\windows\system32\51768zirus490.exe
2009-04-17 07:26 1,847,168 a------- c:\windows\system32\win32k.sys
2009-04-17 03:34 18,375 a------- c:\windows\system32\62b2tzre9t29546.bin
2009-04-16 21:09 2,668 a------- c:\windows\2003za5ktoo920b.dll
2009-04-15 15:25 2,925 a------- c:\windows\710bba5kzo9r198.dll
2009-04-15 12:45 8,903 a------- c:\windows\42zb95dware906.bin
2009-04-15 09:51 585,216 a------- c:\windows\system32\rpcrt4.dll
2009-04-15 02:10 7,793 a------- c:\windows\20c9thie52566z.dll
2009-04-14 15:48 5,865 a------- c:\windows\system32\97556wzr54cc.dll
2009-04-01 10:02 6,306 a------- c:\windows\system32\8363worz695.exe
2009-03-28 05:09 7,186 a------- c:\windows\924ztro5299.exe
2008-08-20 06:45 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008082020080821\index.dat

============= FINISH: 18:52:31.50 ===============

ok here what i have

See if MBAM will run please.

Please download and run this tool.

Download Malwarebytes' Anti-Malware from Here

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
  
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  

Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.

Post the contents of the MBAM Log.

my pc will not let me dl malware anti spyware. I did happen to get a copy from a friend but after i go through the install process I will not load. any ideas?

Hello.

• Download combofix from here
  Link 1
  Link 2
  
  1. If you are using Firefox, make sure that your download settings are as follows:
  
  * Tools->Options->Main tab
  * Set to "Always ask me where to Save the files".
  
  2. During the download, rename Combofix to Combo-Fix as follows:
  
  
  
  
  
  3. It is important you rename Combofix during the download, but not after.
  4. Please do not rename Combofix to other names, but only to the one indicated.
  5. Close any open browsers.
  6. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  
  
• We need to disable your local AV (Anti-virus) before running Combofix.
  
• See HERE for how to disable your AV. (Norton)
  
• Double click on ComboFix.exe.
  
• Follow the prompts. NOTE:
  
• ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
  ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***
  
  **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will automatically proceed with its scan.
  
  
  
• The Recovery Console provides a recovery/repair mode should a problem occur during a Combofix run.
  
  
  
  
• Allow ComboFix to download the Recovery Console.
  
• Accept the End-User License Agreement.
  
• The Recovery Console will be installed.
  
• You will then get this next prompt that asks if you want to continue the malware scan, select yes
  
  
  
  
• Allow combofix to run
  
• Post C:\combofix.txt back here.
  
  Note:
  Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
  

OK, I was able to load Combo and a bunch of files were deleted. I have the deletion log below. Does this mean that winblusoft is gone?

ComboFix 09-06-29.02 - Michael Francis 06/29/2009 17:02.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1015.695 [GMT -5:00]
Running from: c:\documents and settings\Michael Francis\Desktop\Combo-Fix.exe
FW: PC Tools Firewall Plus *enabled* {ABBD5028-5A95-4B6D-996E-98D64AE88D52}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\1013not-9-vzrus3de5.dll
c:\windows\1059tzreat23330.dll
c:\windows\1065vzr5s9ee.dll
c:\windows\10835hackto9z25b.bin
c:\windows\11085s5ambztd29.cpl
c:\windows\113z8n9t-a-virus455.bin
c:\windows\1140z5dware7479.bin
c:\windows\11509virusze1.cpl
c:\windows\1155t9oj4zc.ocx
c:\windows\11658hacktoz526b9.exe
c:\windows\116989z5j2f4.ocx
c:\windows\12010spa5bot911z.dll
c:\windows\1222th9eaz15549.dll
c:\windows\13060v9r5z11d.exe
c:\windows\133btz95f2882.ocx
c:\windows\1346zvirus55c9.cpl
c:\windows\13985tro5z7c.exe
c:\windows\13z93wo9m57e.dll
c:\windows\14567z5oj6219.cpl
c:\windows\149caddware1z56.bin
c:\windows\14cbadzwa5e439.bin
c:\windows\151659acztool66b.exe
c:\windows\15229spz4b5.cpl
c:\windows\154z2not-a9v5rus317.exe
c:\windows\15535s9zmbot33b.bin
c:\windows\1559azdware7979.cpl
c:\windows\15689pzrse516.ocx
c:\windows\15993not-a9zirus33a.bin
c:\windows\15z3spywar92838.exe
c:\windows\15z51sp5903.cpl
c:\windows\16486zpy596.bin
c:\windows\165859zcktool5ed.ocx
c:\windows\168955pz43e.ocx
c:\windows\16b7bzc9d5or1287.exe
c:\windows\16dzthief1549.ocx
c:\windows\17089oz-5-virus69b.ocx
c:\windows\17535s9yz5f.cpl
c:\windows\17889wzr97d5.ocx
c:\windows\17c5addwarez95.exe
c:\windows\1805z9py484.cpl
c:\windows\1807095cktozl1c8.ocx
c:\windows\1835zvirus792.bin
c:\windows\1878zparse21295.ocx
c:\windows\18z559py7ef.ocx
c:\windows\18z62hacktoo5995.bin
c:\windows\1908spzm5ot15.bin
c:\windows\19183vzr5s11b.dll
c:\windows\19387t9o56fz.dll
c:\windows\19469v5ruz656.bin
c:\windows\1949noz-5-virus495.cpl
c:\windows\19556vi5zs51b.dll
c:\windows\19565spam9oz4fe.dll
c:\windows\19566noz9a-virus7d9.cpl
c:\windows\195dzown9oa5er3183.dll
c:\windows\19629pyware7z05.exe
c:\windows\19695not-a-virus7ze.cpl
c:\windows\1973tzi9f1450.exe
c:\windows\19746ha5kzoo9486.ocx
c:\windows\19795pazse1021.ocx
c:\windows\19802spamboz315.bin
c:\windows\198z9ot-a-v5rus2e4.exe
c:\windows\19fz5ackdoor542.cpl
c:\windows\1ed6s5ywarez909.cpl
c:\windows\1f75ddw9rez896.ocx
c:\windows\1f7e95ckdoor1516z.dll
c:\windows\1z118wor5c9.exe
c:\windows\1z706wor94c95.cpl
c:\windows\1z87spyware9531.cpl
c:\windows\1z87t95eat10146.ocx
c:\windows\2003za5ktoo920b.dll
c:\windows\20919w59m3bz.dll
c:\windows\20c9thie52566z.dll
c:\windows\20z5th9ef1828.ocx
c:\windows\22105hackt9olz49.ocx
c:\windows\22256szy47a9.cpl
c:\windows\225aba5kdooz1492.dll
c:\windows\23229szambot5569.cpl
c:\windows\23545v5rus795z.bin
c:\windows\23573vir9551z.exe
c:\windows\23658not-9zvirusb5.dll
c:\windows\24571h9cz5ool610.bin
c:\windows\247av5r9z8.ocx
c:\windows\2483ste9l19z45.bin
c:\windows\2504spy5are265z9.ocx
c:\windows\252z9spyd55.ocx
c:\windows\25354w9rz5f0.exe
c:\windows\2544zt5ojc9.dll
c:\windows\25557zp91d5.exe
c:\windows\25566virus49z.cpl
c:\windows\25572t9oz5a9.cpl
c:\windows\255z6wo5970.dll
c:\windows\25692not-a-vzrus19e.bin
c:\windows\25787s9y52z.cpl
c:\windows\25fabac9dooz2827.cpl
c:\windows\25z13hackto9l581.cpl
c:\windows\260729orm52az.ocx
c:\windows\2669stez5873.dll
c:\windows\27139hackto9516z.ocx
c:\windows\2735z9ackt5ol182.cpl
c:\windows\27596vzr5s37.ocx
c:\windows\27729hackzool158.bin
c:\windows\27759zpy4db.ocx
c:\windows\277b5zr3599.ocx
c:\windows\27990s5a9bot7fz.cpl
c:\windows\27z295orm5a1.exe
c:\windows\28391vir5z31a.ocx
c:\windows\288zsteal9658.bin
c:\windows\29136zirus46e5.ocx
c:\windows\291525ormz2d.dll
c:\windows\29505zot-5-v9rus4bb.dll
c:\windows\29598not-azvirus732.dll
c:\windows\29779wzrm572.bin
c:\windows\297855ac9tzolb8.bin
c:\windows\29979zacktool7c59.exe
c:\windows\29995virzs4e6.dll
c:\windows\2cd9sz9rse5575.cpl
c:\windows\2ceeb9ckzoo51418.dll
c:\windows\2d655dzwa9e305.ocx
c:\windows\2dz6addwa5e9975.bin
c:\windows\2e1zspywa5e5849.bin
c:\windows\2ea9baczd5or879.exe
c:\windows\2z060troj935.dll
c:\windows\2z0fbackdo9r21075.bin
c:\windows\30343virusz965.exe
c:\windows\30441not-azv5rus209.bin
c:\windows\30597spambot1e4z.ocx
c:\windows\307ebz9kdoor1015.dll
c:\windows\3086tzie52793.bin
c:\windows\30985hac9to5l6cz.exe
c:\windows\31196n9tza-v5rus107.bin
c:\windows\319825rzj7a9.dll
c:\windows\31eedown5oader199z.dll
c:\windows\32175zp9mbot381.cpl
c:\windows\323325p943z.ocx
c:\windows\3251not-a-v9rus563z.cpl
c:\windows\3295th5ea99z35.ocx
c:\windows\32adspzwar52193.cpl
c:\windows\3385spz6e59.ocx
c:\windows\3390za9kdoor20875.bin
c:\windows\34759zckto5l176.ocx
c:\windows\34d1za5kdoo93092.bin
c:\windows\3529s5z9l1354.ocx
c:\windows\3539ste5z3109.bin
c:\windows\35c55ownlzader13709.bin
c:\windows\35e8downlo9der10z5.exe
c:\windows\35fzthief1892.ocx
c:\windows\35fzvir1199.cpl
c:\windows\3695spy2b9z.dll
c:\windows\375cdzwnlo5de92566.ocx
c:\windows\3763bzckdoo96705.exe
c:\windows\37a4szea53295.ocx
c:\windows\38acbackd5oz3973.bin
c:\windows\39170troz453.dll
c:\windows\391spzrse5865.ocx
c:\windows\3925tzoj605.cpl
c:\windows\392dzt9al3565.cpl
c:\windows\3954vi59z01.ocx
c:\windows\39705not-a-virus1z.cpl

c:\windows\39795spy35z5.bin
c:\windows\3cz9backd95r732.ocx
c:\windows\3d59backdoorz139.exe
c:\windows\3d7dstez525599.exe
c:\windows\3e5s5ar9z977.ocx
c:\windows\3f6zsp95se2273.cpl
c:\windows\3fd95zr16289.exe
c:\windows\3z059hief973.exe
c:\windows\40bdsp9wz5e437.bin
c:\windows\4210v9r5s4fz.exe
c:\windows\42zb95dware906.bin
c:\windows\435dvir2349z.dll
c:\windows\43z8vir2591.bin
c:\windows\4495spz9se123.exe
c:\windows\45a3szar9e1548.ocx
c:\windows\45zbspyw5r91408.ocx
c:\windows\471es95rse1z94.exe
c:\windows\4720zpa9b5t50.bin
c:\windows\47ez9teal2953.exe
c:\windows\485zth9eat15377.dll
c:\windows\499z9py450.dll
c:\windows\49a5v9r7z5.cpl
c:\windows\49bzv5r912.cpl
c:\windows\49ccthreat592z.dll
c:\windows\4a509zeal1495.cpl
c:\windows\4acdownloa5ez1096.ocx
c:\windows\4bc0downloz9e52223.dll
c:\windows\4d78spzrse94725.dll
c:\windows\4d98threat195z5.exe
c:\windows\4e5z5te9l564.cpl
c:\windows\4f60thrzat14935.exe
c:\windows\4z33th9ef579.bin
c:\windows\4z56v9r1510.bin
c:\windows\4z995teal433.cpl
c:\windows\5039downlozder545.bin
c:\windows\506829pamzot6f8.bin
c:\windows\50z9pambot6ea.bin
c:\windows\51256worz589.ocx
c:\windows\51295zrus49a.dll
c:\windows\516ebazkd9or291.cpl
c:\windows\51zbsteal1895.dll
c:\windows\522dste9lz091.exe
c:\windows\5233hack95olz9e.exe
c:\windows\5259zparse141.ocx
c:\windows\52z5thie518519.ocx
c:\windows\535789irzs315.cpl
c:\windows\5395sparse3z56.dll
c:\windows\541379izus26e.exe
c:\windows\5446st9al5z62.cpl
c:\windows\5475downloade91167z.bin
c:\windows\54985hac9tool5bez.ocx
c:\windows\5553downloadz9962.bin
c:\windows\5560threatz9838.ocx
c:\windows\556szarse1970.dll
c:\windows\5580sp9ware1899z.bin
c:\windows\5589szeal990.bin
c:\windows\55e3thz9at18785.exe
c:\windows\55f99irz050.bin
c:\windows\55z4backdo5r1019.bin
c:\windows\5619ste5l2983z.dll
c:\windows\569tr5jz169.ocx
c:\windows\56a3addw9re25z4.cpl
c:\windows\56c9zteal5285.cpl
c:\windows\5765nzt-a-9irus49f.dll
c:\windows\57e9sparse665z.bin
c:\windows\587859iez1562.ocx
c:\windows\591hazkt5ol72c.ocx
c:\windows\592zvir178.dll
c:\windows\5935spyzf9.bin
c:\windows\593dsteal2266z.ocx
c:\windows\5946zhi5f2206.bin
c:\windows\598fbackdoor402z.dll
c:\windows\599abackdooz275.cpl
c:\windows\59aebackdoor385z.bin
c:\windows\59c5zir1954.dll
c:\windows\59e1spyw5re264z.cpl
c:\windows\59f0a5dware195z.dll
c:\windows\59z6threat18534.dll
c:\windows\59z7v5r2587.exe
c:\windows\5a75addz9re2839.ocx
c:\windows\5b5czhreat1739.bin
c:\windows\5c079ir135z.cpl
c:\windows\5c96add5arz1393.ocx
c:\windows\5d37sparse9z5.dll
c:\windows\5d59sp5zse2308.dll
c:\windows\5d7zspywar520499.dll
c:\windows\5e5z5hief2489.exe
c:\windows\5eb2ste9z1533.ocx
c:\windows\5f2e59ywarz995.bin
c:\windows\5f5zi92850.cpl
c:\windows\5f6bdownlzad9r365.bin
c:\windows\5f70vi92356z.cpl
c:\windows\5f93th9eaz243945.ocx
c:\windows\5fd1sp9wzr5771.bin
c:\windows\5z49s5arse1201.bin
c:\windows\5z58t9ief5728.cpl
c:\windows\5z914troj79c.bin
c:\windows\5z96thief1159.ocx
c:\windows\5zf0t5re9t1379.exe
c:\windows\60b8v59265z.dll
c:\windows\614cspyw5z92931.cpl
c:\windows\615z9parse490.exe
c:\windows\6190v5rz007.dll
c:\windows\6297vir241z5.ocx
c:\windows\629zbackdoor5158.bin
c:\windows\62fcspz95e2197.dll
c:\windows\633zadd5are9500.cpl
c:\windows\6355zir2091.exe
c:\windows\6359zack5ool5299.dll
c:\windows\6366bzckd5or9671.exe
c:\windows\6395ste5lz88.dll
c:\windows\6589viru5698z.cpl
c:\windows\65efthreat9177z.bin
c:\windows\661ft9ief5z39.cpl
c:\windows\676bthreatz9595.exe
c:\windows\6862s5yz0a9.exe
c:\windows\687dsza5se14099.ocx
c:\windows\6950wzrm799.exe
c:\windows\6986sp9warz4505.cpl
c:\windows\69ffzpars5930.ocx
c:\windows\69z7threat15038.bin
c:\windows\6a44thief50z19.dll
c:\windows\6c89d5wnloader658z.dll
c:\windows\6c9fviz544.bin
c:\windows\6d69backdoor35z4.cpl
c:\windows\6z93sp9r5e878.exe
c:\windows\6zbc9ac5door2966.cpl
c:\windows\70z4v9rus675.bin
c:\windows\710bba5kzo9r198.dll
c:\windows\7166download95436z.cpl
c:\windows\72059zckdoor3230.ocx
c:\windows\7276th5efz099.cpl
c:\windows\7345spars9z9975.dll
c:\windows\73c7v9r3145z.exe
c:\windows\73f5thi9f2z50.cpl
c:\windows\754c9t5al207z.cpl
c:\windows\755a9ir4z.cpl
c:\windows\757asteal94z6.cpl
c:\windows\75bcsparse9569z.cpl
c:\windows\7695hackt95z39b.dll
c:\windows\77e2vi9257z.dll
c:\windows\78f0z5w9loader3016.exe
c:\windows\7913tzo529c.ocx
c:\windows\79ba9kdoorz511.cpl
c:\windows\79z3thr9at9452.cpl
c:\windows\7a765ownloazer9097.ocx
c:\windows\7abd5pyz9re1286.ocx
c:\windows\7b5fspyzare295.ocx
c:\windows\7dz2spars5933.ocx
c:\windows\7e2bdownload5rz199.ocx
c:\windows\7ecfth5ezt8294.bin
c:\windows\7ed5s9zal722.cpl
c:\windows\7ze79ownloader2599.bin
c:\windows\8857wzrm39a5.exe
c:\windows\911evi52z42.bin
c:\windows\912spamboz5ee9.exe
c:\windows\91675wor5z84.bin
c:\windows\924ztro5299.exe
c:\windows\935895cktzol52f.dll
c:\windows\94250sp5mbotz6a.bin
c:\windows\9535vizus5ea.cpl
c:\windows\956zi9us25a.bin
c:\windows\95726wzrm382.ocx
c:\windows\9594ste5z1462.cpl
c:\windows\965addwz5e2611.ocx
c:\windows\97205zpy311.bin
c:\windows\9751threat527z.dll
c:\windows\9811spa5se172z.dll
c:\windows\994thz5f319.cpl
c:\windows\9959not-z-virus4f5.exe
c:\windows\996zworm1c5.ocx
c:\windows\9990zvirus145.ocx
c:\windows\9a235pywaze1699.bin
c:\windows\9z4hackt5ol9ef.dll
c:\windows\9z9cthr5at5029.dll
c:\windows\aa35parsz198.dll
c:\windows\aa3bzck9o5r2586.exe
c:\windows\c99bac9do5z579.exe
c:\windows\d2c9a5kdozr2019.bin
c:\windows\e86spz9are6625.exe
c:\windows\f1zth9eat9594.bin
c:\windows\system32\1013595rz2ab.cpl
c:\windows\system32\10352hac9zool7e5.cpl
c:\windows\system32\1072sp9mbo56z4.exe
c:\windows\system32\109499pambz54eb.exe
c:\windows\system32\109985acktool4ze.exe
c:\windows\system32\109z55py769.dll
c:\windows\system32\10dcs5arse1980z.ocx
c:\windows\system32\10z57s9ambot55a.cpl
c:\windows\system32\115eb9ckdoorz24.dll
c:\windows\system32\115z2worm596.ocx
c:\windows\system32\115zspar9e178.dll
c:\windows\system32\11827t9oz4c5.ocx
c:\windows\system32\12209spy5d1z.exe
c:\windows\system32\1239ba5kdoo916z.cpl
c:\windows\system32\12569v9ruz492.bin
c:\windows\system32\12737spz9bot2ec5.dll
c:\windows\system32\12a9adzwa5e884.ocx
c:\windows\system32\12aaddwz5e28649.dll
c:\windows\system32\12cfaddwzre98845.cpl
c:\windows\system32\13597vzr5s64a.ocx
c:\windows\system32\13639s5amb9t3z9.dll
c:\windows\system32\13bzv9r5205.dll
c:\windows\system32\142595irus51z.ocx
c:\windows\system32\1449hackz9o5365.exe
c:\windows\system32\14640no9za-virus9a5.ocx
c:\windows\system32\14823h5cztool23a9.cpl
c:\windows\system32\149d5zief19079.ocx
c:\windows\system32\15029troj2z69.ocx
c:\windows\system32\15110noz-a-virus945.cpl
c:\windows\system32\1515vzr9343.bin
c:\windows\system32\151fd9wnloader322z.exe
c:\windows\system32\151fszars525019.exe
c:\windows\system32\153075ackt9ol732z.cpl
c:\windows\system32\15356notza-virus6a9.exe
c:\windows\system32\15659troj57dz.dll

c:\windows\system32\156999irus3cz.ocx
c:\windows\system32\1595addw9re523z.cpl
c:\windows\system32\15b7stea922z75.bin
c:\windows\system32\1694no5-a-v9rus6zd.cpl
c:\windows\system32\170925ack9ool6z8.dll
c:\windows\system32\17369hazk5ool4d99.dll
c:\windows\system32\175z3spambot9c5.dll
c:\windows\system32\17z01not9a-viru576a.bin
c:\windows\system32\18099tro925z.dll
c:\windows\system32\18430wor9z25.bin
c:\windows\system32\18596zackto5l303.ocx
c:\windows\system32\189655py707z.ocx
c:\windows\system32\18995spamboz55d.cpl
c:\windows\system32\19255worz2819.exe
c:\windows\system32\199z9spam5ot1e2.exe
c:\windows\system32\1abfad5w9rez96.ocx
c:\windows\system32\1c5eth9zat50192.dll
c:\windows\system32\1d96addwaz51782.bin
c:\windows\system32\1d9bthizf50859.cpl
c:\windows\system32\1e90szarse598.cpl
c:\windows\system32\1fb69zeal6835.dll
c:\windows\system32\1z13spam9ot5c5.ocx
c:\windows\system32\1z3849iru53e9.bin
c:\windows\system32\1z400hacktool1495.ocx
c:\windows\system32\1z533troj592.cpl
c:\windows\system32\2016zp9ware5032.exe
c:\windows\system32\20211h5zk9ool524.bin
c:\windows\system32\20395vi5us791z.bin
c:\windows\system32\204075ot-a-vzrus9ac.ocx
c:\windows\system32\2056hzcktool96.exe
c:\windows\system32\2078wo5mz469.exe
c:\windows\system32\20795vz5us129.exe
c:\windows\system32\217139zt-a-virus4465.cpl
c:\windows\system32\2171ztroj5d79.dll
c:\windows\system32\22548ha9ztool39e.exe
c:\windows\system32\225cthief266z9.exe
c:\windows\system32\22623spam59z553.dll
c:\windows\system32\22758spyz49.cpl
c:\windows\system32\2295zpy2965.bin
c:\windows\system32\22hacztoo5921.bin
c:\windows\system32\23098wozm4815.exe
c:\windows\system32\23310szy7895.ocx
c:\windows\system32\2374bazkd95r2774.ocx
c:\windows\system32\2377595rmzf6.bin
c:\windows\system32\237z9a5kdoor3231.ocx
c:\windows\system32\23cdbackd95rz925.bin
c:\windows\system32\23z5addwa9e2961.bin
c:\windows\system32\24393not-5-viru94eez.exe
c:\windows\system32\2455spyware1z59.ocx
c:\windows\system32\24597hacktooz175.cpl
c:\windows\system32\24751spamzot6a9.cpl
c:\windows\system32\24zdthief12579.cpl
c:\windows\system32\25105woz95a.dll
c:\windows\system32\25601not-a-vir5sz969.dll
c:\windows\system32\257zsparse2679.cpl
c:\windows\system32\259zspar5e970.dll
c:\windows\system32\2634vz51899.exe
c:\windows\system32\27026h5ckto9l3zd.ocx
c:\windows\system32\271579p5683z.cpl
c:\windows\system32\271965p96e5z.bin
c:\windows\system32\2773hack9zol547.dll
c:\windows\system32\27900spz5bo9120.exe
c:\windows\system32\2795zvirus5995.exe
c:\windows\system32\2855zddware2892.cpl
c:\windows\system32\28580vzru5392.ocx
c:\windows\system32\28z52tro9649.cpl
c:\windows\system32\2907sp5warez500.ocx
c:\windows\system32\29085t5oj7baz.ocx
c:\windows\system32\29449rojz85.dll
c:\windows\system32\29510v5zus2719.ocx
c:\windows\system32\29553spyz4c5.dll
c:\windows\system32\29554szy7c9.exe
c:\windows\system32\29569pyz5.exe
c:\windows\system32\29589not-azvir5s6b4.ocx
c:\windows\system32\29656trojz3c.dll
c:\windows\system32\2975dow9loadez5998.cpl
c:\windows\system32\2976w9r55z9.cpl
c:\windows\system32\297z1virus95.dll
c:\windows\system32\29b8addwar9z555.cpl
c:\windows\system32\29z51wo9m75c.cpl
c:\windows\system32\29z72n9t-a-virus1e75.dll
c:\windows\system32\29z80sp5759.exe
c:\windows\system32\2a51zir4149.ocx
c:\windows\system32\2a5dst9alz24.ocx
c:\windows\system32\2azth9eat8519.dll
c:\windows\system32\2bc595eal168z.ocx
c:\windows\system32\2e5cthzef1195.cpl
c:\windows\system32\2ee9sparsz27995.cpl
c:\windows\system32\2f85t9iz51873.dll
c:\windows\system32\2f995pzware1736.ocx
c:\windows\system32\2z3905roj36f.bin
c:\windows\system32\2z59sparse564.bin
c:\windows\system32\2z8a9hre5t21157.dll
c:\windows\system32\2zc9sparse21155.dll
c:\windows\system32\301f9pa5sz2885.cpl
c:\windows\system32\30553spz697.cpl
c:\windows\system32\3057szar9e1565.cpl
c:\windows\system32\3099zs5y1c59.cpl
c:\windows\system32\30bdad5waze2908.exe
c:\windows\system32\31354viruz65f9.cpl
c:\windows\system32\31586zp9551.ocx
c:\windows\system32\3158d5znloa9er2199.dll
c:\windows\system32\315zhacktool69d.bin
c:\windows\system32\31844vi5zs5979.ocx
c:\windows\system32\31939zirus565.dll
c:\windows\system32\31z97n5t-a-virus509.ocx
c:\windows\system32\31z9ba5kdoor9067.exe
c:\windows\system32\337dzownloader9538.cpl
c:\windows\system32\33c0spyw5r9138z.bin
c:\windows\system32\34a8spywar59z.cpl
c:\windows\system32\3518spaz9e216.exe
c:\windows\system32\3559downloadez1779.bin
c:\windows\system32\3635sparse94z.dll
c:\windows\system32\36z05ir2794.ocx
c:\windows\system32\372z5ow9loader2983.ocx
c:\windows\system32\37395ot-a-virusz24.cpl
c:\windows\system32\3750spy59cz.cpl
c:\windows\system32\3954steal2598z.ocx
c:\windows\system32\39z5t9oj1c85.ocx
c:\windows\system32\3d2ezh5eat29203.ocx
c:\windows\system32\3d50v5r9032z.ocx
c:\windows\system32\3dd1ba9k5oorz548.cpl
c:\windows\system32\3edz9d5ware94.bin
c:\windows\system32\3f94a5dwzre1001.dll
c:\windows\system32\3zd0d95nloader156.ocx
c:\windows\system32\414tzreat239975.bin
c:\windows\system32\431bbz9kd5or1000.dll
c:\windows\system32\43avz51993.cpl
c:\windows\system32\447dbackdoorz5529.dll
c:\windows\system32\4552szambo9541.dll
c:\windows\system32\4556backdzor1996.exe
c:\windows\system32\45795ownlzader3199.exe
c:\windows\system32\45b6vir319z.bin
c:\windows\system32\45z89roj6db.ocx
c:\windows\system32\46d0s5yza9e133.cpl
c:\windows\system32\4856zpa9bot250.dll
c:\windows\system32\49b5add5arz907.dll
c:\windows\system32\4b55d9wnload5r2z59.cpl
c:\windows\system32\4b75bac5dooz24279.exe
c:\windows\system32\4b95s5azse1196.bin
c:\windows\system32\4baz9dd5are2593.dll
c:\windows\system32\4e6a9dd5are26z2.dll
c:\windows\system32\4e98a5dware2z92.cpl
c:\windows\system32\4f01downloade931z05.exe
c:\windows\system32\4fzcvi91456.exe
c:\windows\system32\4z09downloader5837.bin
c:\windows\system32\4z2dt5r9at22801.ocx
c:\windows\system32\4z81thre5t9939.exe
c:\windows\system32\4z89backdoor5903.bin
c:\windows\system32\504csteal9z83.ocx
c:\windows\system32\5050thzea92312.bin
c:\windows\system32\505fvir27z29.bin
c:\windows\system32\50cd5hreat9z997.cpl
c:\windows\system32\50z32vir9s59a.exe
c:\windows\system32\51768zirus490.exe
c:\windows\system32\51abthizf5094.ocx
c:\windows\system32\51z09d5ware1223.exe
c:\windows\system32\5205stea9725z.dll
c:\windows\system32\5284spamboz925.dll
c:\windows\system32\52dbaddware59z2.bin
c:\windows\system32\53129ro560z.dll
c:\windows\system32\53f5zownl9ader1971.exe
c:\windows\system32\53za9teal1783.exe
c:\windows\system32\54138sp9mzot307.dll
c:\windows\system32\5422sp9wa5z1753.ocx
c:\windows\system32\54996zacktool49a.exe
c:\windows\system32\5529thiefz925.dll
c:\windows\system32\55435zcktool3809.exe
c:\windows\system32\555bsparsz9691.dll
c:\windows\system32\55b9szeal2560.ocx
c:\windows\system32\55bazackdoor2977.exe
c:\windows\system32\5665vir9175z.cpl
c:\windows\system32\569159reat13z50.dll
c:\windows\system32\56995acktool63z.dll
c:\windows\system32\57785z9rse157.exe
c:\windows\system32\578backd9or1z11.dll
c:\windows\system32\582znot-a-virus297.dll
c:\windows\system32\5843spywaze2895.cpl
c:\windows\system32\58511ha9ktool2z7.exe
c:\windows\system32\5891spz359.cpl
c:\windows\system32\5937t59jz09.bin
c:\windows\system32\59645zy206.exe
c:\windows\system32\59734virus16z.ocx
c:\windows\system32\59bbbackdoor253z.dll
c:\windows\system32\59f7addwar93076z.cpl
c:\windows\system32\5a7cs5yza9e1194.ocx
c:\windows\system32\5a85zp9ware1537.cpl
c:\windows\system32\5ac5t9izf2489.dll
c:\windows\system32\5ac9spazs9359.bin
c:\windows\system32\5c3a5i923z2.cpl
c:\windows\system32\5c62bz5kd9or2140.bin
c:\windows\system32\5c69thief155z.ocx
c:\windows\system32\5d6sparze2929.ocx
c:\windows\system32\5dbestez92755.exe
c:\windows\system32\5f149parze1909.dll
c:\windows\system32\5f58spar9z1094.ocx
c:\windows\system32\5f69sparse61z.cpl
c:\windows\system32\5f95tzief1530.exe
c:\windows\system32\5z2fste5l2998.cpl
c:\windows\system32\5z85steal2099.exe
c:\windows\system32\5zbfdownloade93197.dll
c:\windows\system32\6109backdoo562z.dll
c:\windows\system32\6195vir1995z.dll
c:\windows\system32\6252spambo91z7.bin
c:\windows\system32\6279st5az1395.bin
c:\windows\system32\62b2tzre9t29546.bin
c:\windows\system32\62z9no9-a-virus4875.exe
c:\windows\system32\63z8spyware915.cpl
c:\windows\system32\6558zddware1689.dll
c:\windows\system32\659worm409z.exe
c:\windows\system32\6697baczdoor8665.dll
c:\windows\system32\66aesz5a915.dll
c:\windows\system32\66f2zddwa5e2579.exe
c:\windows\system32\67azthrea53819.bin
c:\windows\system32\6817v5z14069.ocx
c:\windows\system32\695bdownlzader93.dll
c:\windows\system32\6azaa5dwar9147.bin
c:\windows\system32\6bd9z5ckdo9r2252.bin
c:\windows\system32\6c9fbackdzo5829.cpl
c:\windows\system32\6ca09p5rse1011z.exe
c:\windows\system32\6d419tealz55.dll
c:\windows\system32\6destea9z65.dll
c:\windows\system32\6fa6spa5sz1409.exe
c:\windows\system32\6z09sparse1695.bin
c:\windows\system32\6zf6downlo5der1490.bin
c:\windows\system32\7035not-azvi59s6e0.dll
c:\windows\system32\7092th5zat19825.bin
c:\windows\system32\72dazownl9ader1853.dll
c:\windows\system32\7368not-a-virzs7995.bin
c:\windows\system32\7437nzt-a9vi5us7cd.ocx
c:\windows\system32\74d1vir5589z.dll
c:\windows\system32\752spy9zre2575.exe
c:\windows\system32\7556vzr509.ocx
c:\windows\system32\7580backdo9z2157.bin
c:\windows\system32\759aspyware49z.bin
c:\windows\system32\759zs5y9f7.cpl
c:\windows\system32\7647s5ywa9z584.cpl
c:\windows\system32\773zs9ar5e17.cpl
c:\windows\system32\78dcdow9loadez2045.bin
c:\windows\system32\7953szy7f9.exe
c:\windows\system32\7956sp54z9.exe
c:\windows\system32\798z9py2525.exe
c:\windows\system32\7a9bdownl5ad9rz995.exe
c:\windows\system32\7ab3addzar59146.bin
c:\windows\system32\7bf6spzware53979.ocx
c:\windows\system32\7e885hief144z9.bin
c:\windows\system32\7f48vz51939.dll
c:\windows\system32\7f5c5hiz92472.dll
c:\windows\system32\7fz8thie52966.exe
c:\windows\system32\7z94d5wnloader16499.bin
c:\windows\system32\7z99vir5404.cpl
c:\windows\system32\7za5a59ware2174.ocx
c:\windows\system32\819zwo9m485.bin
c:\windows\system32\8363worz695.exe
c:\windows\system32\83z15iru91b2.bin
c:\windows\system32\87f5pywarz9670.dll
c:\windows\system32\8892hacktozl51d.dll
c:\windows\system32\9055viruz99a.dll
c:\windows\system32\9055zspambot7be.cpl
c:\windows\system32\90951worm5zd.dll
c:\windows\system32\915ds5yzare1079.dll
c:\windows\system32\91dcdownlo5der189z.cpl
c:\windows\system32\92773wormz65.cpl
c:\windows\system32\93751sp564z.bin
c:\windows\system32\94349zoj2d5.bin
c:\windows\system32\9445spybz.ocx
c:\windows\system32\9551steal2887z.exe
c:\windows\system32\955615orm75z.dll
c:\windows\system32\9597v5rz404.cpl
c:\windows\system32\9625tz5j1f9.cpl
c:\windows\system32\9683zs5y47.exe
c:\windows\system32\96z49s5y559.exe
c:\windows\system32\97556wzr54cc.dll
c:\windows\system32\9772nzt-a-virus7d5.cpl
c:\windows\system32\98cadzware554.dll
c:\windows\system32\9909sparsz2059.dll
c:\windows\system32\9919v5rz9354.dll
c:\windows\system32\99fdowzl5ader2812.cpl
c:\windows\system32\99z7thief195.exe
c:\windows\system32\9ababack5oor2566z.cpl
c:\windows\system32\9bf8tzi5f3082.ocx
c:\windows\system32\9d45zparse555.bin
c:\windows\system32\9e0v5rz161.dll
c:\windows\system32\9e15downloader145z.ocx

c:\windows\system32\9e37t5reaz27235.exe
c:\windows\system32\9e4esparse591z.exe
c:\windows\system32\9z050s5y62.dll
c:\windows\system32\9z130w5rmac.exe
c:\windows\system32\9z47thief1251.exe
c:\windows\system32\9z510spy5be.exe
c:\windows\system32\aa695rezt6961.dll
c:\windows\system32\ae2threat580z39.bin
c:\windows\system32\az9thief875.dll
c:\windows\system32\b425hzeat94507.cpl
c:\windows\system32\c72zhr95t24803.exe
c:\windows\system32\c92bac5dooz2673.bin
c:\windows\system32\dfzdownlo95er2040.ocx
c:\windows\system32\drivers\MSIVXxbrotowkrvituirqtlobouwjvwwuhhbg.sys
c:\windows\system32\drivers\pctmp.sys
c:\windows\system32\f59thief11z45.exe
c:\windows\system32\MSIVXcount
c:\windows\system32\MSIVXoewwqbymxowwanrsnidjkypyngpvdlen.dll
c:\windows\system32\MSIVXtlpkmkoeqsllljblngyewascxipblrmp.dll
c:\windows\system32\setup2.exe
c:\windows\system32\z0267s5y429.exe
c:\windows\system32\z065spyware9626.dll
c:\windows\system32\z079395oj36f.exe
c:\windows\system32\z0976v5rus9c7.cpl
c:\windows\system32\z0f5i91570.bin
c:\windows\system32\z1200spambo9105.bin
c:\windows\system32\z17845py19e.exe
c:\windows\system32\z1acaddware25949.exe
c:\windows\system32\z259ad5w9re326.cpl
c:\windows\system32\z29fthreat15618.dll
c:\windows\system32\z47dvir959.exe
c:\windows\system32\z4a59ackdoor1133.dll
c:\windows\system32\z5127not9a-virus275.cpl
c:\windows\system32\z52f5hreat30909.ocx
c:\windows\system32\z565addware972.dll
c:\windows\system32\z5daspars92998.cpl
c:\windows\system32\z6143hacktool915.bin
c:\windows\system32\z6330s5am9ot373.dll
c:\windows\system32\z6507worm593.cpl
c:\windows\system32\z654sp9r5e1138.exe
c:\windows\system32\z656s5ea9876.dll
c:\windows\system32\z6625hief1294.ocx
c:\windows\system32\z682threat59449.cpl
c:\windows\system32\z8599worm1c2.dll
c:\windows\system32\z90vir2175.dll
c:\windows\system32\z940s5a9se289.dll
c:\windows\system32\z944thief31815.bin
c:\windows\system32\z96169ir5s418.cpl
c:\windows\system32\z978vi513559.exe
c:\windows\system32\ze55threat17899.bin
c:\windows\system32\ze999teal1516.bin
c:\windows\Tasks\{5B57CF47-0BFA-43c6-ACF9-3B3653DCADBA}.job
c:\windows\z038sp5rs91458.exe
c:\windows\z0591worm3d3.ocx
c:\windows\z075spy629.bin
c:\windows\z10esteal2559.cpl
c:\windows\z159download9r2220.dll
c:\windows\z175not-9-virus2a5.exe
c:\windows\z1855s9am5ot653.cpl
c:\windows\z2598w5rm1a4.cpl
c:\windows\z3169tr9j2705.dll
c:\windows\z3507hack9oo5545.exe
c:\windows\z42519pam5ot20c.ocx
c:\windows\z4f55par9e1527.ocx
c:\windows\z558addware1829.bin
c:\windows\z5705s9y331.bin
c:\windows\z5b4sp9rse613.exe
c:\windows\z5bdownload9r228.ocx
c:\windows\z696worm325.dll
c:\windows\z699spy515.dll
c:\windows\z7804v5r9s5eb.exe
c:\windows\z922vir915.ocx
c:\windows\z96339ot-a-virus561.dll
c:\windows\z9d9spy5are2590.bin
c:\windows\za9stea5691.exe
c:\windows\zbe1backd9or195.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_MSIVXserv.sys
-------\Legacy_pctmp
-------\Service_pctmp


((((((((((((((((((((((((( Files Created from 2009-05-28 to 2009-06-29 )))))))))))))))))))))))))))))))
.

2009-08-26 03:01 . 2009-08-26 03:01 16607 ----a-w- c:\windows\2933259ambzt.exe
2009-06-23 04:57 . 2009-06-23 04:57 -------- d-----w- c:\program files\Trend Micro
2009-06-23 04:23 . 2009-06-23 04:23 -------- d-----w- c:\documents and settings\Michael Francis\Application Data\PCToolsFirewallPlus
2009-06-23 04:20 . 2008-03-12 14:30 159896 ----a-w- c:\windows\system32\drivers\pctfw2.sys
2009-06-23 04:19 . 2008-02-25 21:38 93440 ----a-w- c:\windows\system32\drivers\pctfw.sys
2009-06-23 04:19 . 2009-06-23 04:19 -------- d-----w- c:\program files\Common Files\PC Tools
2009-06-23 04:19 . 2008-02-21 13:56 18328 ----a-w- c:\windows\system32\drivers\pctssipc.sys
2009-06-23 04:19 . 2009-06-23 04:23 -------- d-----w- c:\program files\PC Tools Firewall Plus
2009-06-23 04:19 . 2009-06-19 19:37 46864 ----a-w- c:\windows\system32\drivers\TfSysMon.sys
2009-06-23 04:19 . 2009-06-19 19:37 33552 ----a-w- c:\windows\system32\drivers\TfNetMon.sys
2009-06-23 04:19 . 2009-06-19 19:37 51984 ----a-w- c:\windows\system32\drivers\TfFsMon.sys
2009-06-23 04:19 . 2009-06-23 04:19 -------- d-----w- c:\program files\ThreatFire
2009-06-23 04:19 . 2009-06-23 04:19 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Tools
2009-06-23 04:10 . 2009-06-23 04:18 -------- d-----w- c:\documents and settings\Michael Francis\Application Data\IObit
2009-06-23 04:10 . 2009-06-23 04:13 -------- d-----w- c:\program files\IObit
2009-06-23 04:09 . 2009-06-23 04:09 -------- d-----w- c:\program files\Lavasoft
2009-06-23 00:52 . 2009-06-23 00:52 -------- d-sh--w- c:\documents and settings\Administrator\PrivacIE
2009-06-23 00:45 . 2009-06-23 00:45 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
2009-06-22 23:34 . 2009-06-22 23:34 -------- d-----w- C:\!KillBox
2009-06-18 23:27 . 2009-06-29 22:26 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-06-18 23:19 . 2009-06-18 23:48 -------- d-----w- c:\program files\Microsoft AntiSpyware
2009-06-18 23:19 . 2009-06-23 04:05 -------- d-----w- c:\program files\SpywareBlaster
2009-06-18 23:17 . 2009-06-23 04:02 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-06-18 23:17 . 2009-06-24 00:06 -------- d-----w- c:\program files\SpywareGuard
2009-06-18 03:26 . 2009-06-18 03:26 -------- d-----w- c:\documents and settings\Michael Francis\Application Data\Winamp
2009-06-18 03:09 . 2009-06-18 03:09 -------- d-sh--w- c:\documents and settings\Michael Francis\IECompatCache
2009-06-18 03:08 . 2009-06-18 03:08 -------- d-sh--w- c:\documents and settings\Michael Francis\PrivacIE
2009-06-17 03:41 . 2009-06-17 03:41 -------- d-sh--w- c:\documents

and settings\NetworkService\IETldCache
2009-06-17 03:41 . 2009-06-17 03:41 -------- d-sh--w- c:\documents and settings\Michael Francis\IETldCache
2009-06-17 03:39 . 2009-04-30 21:22 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2009-06-17 03:39 . 2009-04-30 21:22 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2009-06-17 03:39 . 2009-06-17 03:39 -------- d-----w- c:\windows\ie8updates
2009-06-17 03:38 . 2009-05-12 05:11 102912 -c----w- c:\windows\system32\dllcache\iecompat.dll
2009-06-17 03:36 . 2009-06-17 03:37 -------- dc-h--w- c:\windows\ie8
2009-06-09 22:17 . 2009-06-09 22:17 152576 ----a-w- c:\documents and settings\Michael Francis\Application Data\Sun\Java\jre1.6.0_14\lzma.dll
2009-06-08 04:58 . 2009-06-19 00:26 -------- d-----w- c:\program files\Alarm

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-23 04:49 . 2008-04-11 20:28 -------- d-----w- c:\documents and settings\Michael Francis\Application Data\GlarySoft
2009-06-23 04:11 . 2008-04-11 20:25 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
2009-06-18 03:26 . 2008-04-11 20:18 -------- d-----w- c:\program files\Winamp
2009-06-18 03:20 . 2008-04-11 20:18 -------- d-----w- c:\program files\Mjuice Media Player
2009-06-18 03:15 . 2008-12-01 09:52 -------- d-----w- c:\documents and settings\All Users\Application Data\Soulseek
2009-06-08 00:29 . 2009-01-08 23:11 -------- d-----w- c:\program files\Common Files\Apple
2009-05-24 23:40 . 2008-04-12 21:37 -------- d-----w- c:\program files\Soulseek
2009-05-21 16:33 . 2009-02-28 22:03 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-05-13 05:15 . 2004-08-04 06:56 915456 ----a-w- c:\windows\system32\wininet.dll
2009-05-11 23:02 . 2009-05-11 23:02 -------- d-----w- c:\documents and settings\Michael Francis\Application Data\FileMaker
2009-05-07 15:32 . 2004-08-04 06:56 345600 ----a-w- c:\windows\system32\localspl.dll
2009-04-25 19:59 . 2009-04-25 19:59 57344 ----a-r- c:\documents and settings\Michael Francis\Application Data\Microsoft\Installer\{66381CF5-ECBB-4CB7-A7AF-C9767E4FDF24}\NewShortcut7_7771B2A712EF4ED6B9E64A04820E098E.exe
2009-04-25 19:59 . 2009-04-25 19:59 57344 ----a-r- c:\documents and settings\Michael Francis\Application Data\Microsoft\Installer\{66381CF5-ECBB-4CB7-A7AF-C9767E4FDF24}\NewShortcut1_7771B2A712EF4ED6B9E64A04820E098E.exe
2009-04-17 12:26 . 2004-08-04 05:17 1847168 ----a-w- c:\windows\system32\win32k.sys
2009-04-15 14:51 . 2004-08-04 06:56 585216 ----a-w- c:\windows\system32\rpcrt4.dll
2009-04-01 03:08 . 2009-04-01 03:08 152576 ----a-w- c:\documents and settings\Michael Francis\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
.

------- Sigcheck -------

[7] 2004-08-04 06:56 14336 8F078AE4ED187AAABC0A305146DE6716 c:\windows\$NtServicePackUninstall$\svchost.exe
[7] 2008-04-14 00:12 14336 27C6D03BCDB8CFEB96B716F3D8BE3E18 c:\windows\ServicePackFiles\i386\svchost.exe
[7] 2008-04-14 00:12 14336 27C6D03BCDB8CFEB96B716F3D8BE3E18 c:\windows\system32\svchost.exe

[-] 2005-03-02 18:19 577024 1800F293BCCC8EDE8A70E12B88D80036 c:\windows\$hf_mig$\KB890859\SP2QFE\user32.dll
[-] 2007-03-08 15:48 578048 7AA4F6C00405DFC4B70ED4214E7D687B c:\windows\$hf_mig$\KB925902\SP2QFE\user32.dll
[-] 2007-03-08 15:36 577536 B409909F6E2E8A7067076ED748ABF1E7 c:\windows\$NtServicePackUninstall$\user32.dll
[7] 2004-08-04 06:56 577024 C72661F8552ACE7C5C85E16A3CF505C4 c:\windows\$NtUninstallKB890859$\user32.dll
[-] 2005-03-02 18:09 577024 DE2DB164BBB35DB061AF0997E4499054 c:\windows\$NtUninstallKB925902$\user32.dll
[7] 2008-04-14 00:12 578560 B26B135FF1B9F60C9388B4A7D16F600B c:\windows\ServicePackFiles\i386\user32.dll
[7] 2008-04-14 00:12 578560 B26B135FF1B9F60C9388B4A7D16F600B c:\windows\system32\user32.dll

[7] 2004-08-04 06:56 82944 2ED0B7F12A60F90092081C50FA0EC2B2 c:\windows\$NtServicePackUninstall$\ws2_32.dll
[7] 2008-04-14 00:12 82432 2CCC474EB85CEAA3E1FA1726580A3E5A c:\windows\ServicePackFiles\i386\ws2_32.dll
[7] 2008-04-14 00:12 82432 2CCC474EB85CEAA3E1FA1726580A3E5A c:\windows\system32\ws2_32.dll
[7] 2008-04-14 00:12 82432 2CCC474EB85CEAA3E1FA1726580A3E5A c:\windows\system32\dllcache\ws2_32.dll

[7] 2007-10-10 23:47 825344 0E5D918F87EFA7D2424D66B499C7EB04 c:\windows\$hf_mig$\KB942615-IE7\SP2QFE\wininet.dll
[7] 2007-12-07 02:01 825344 B5B411BB229AE6EAD7652A32ED47BFB9 c:\windows\$hf_mig$\KB944533-IE7\SP2QFE\wininet.dll
[-] 2008-02-16 09:32 666112 BB1EACD6AB47E78EBCA02EB781550D55 c:\windows\$hf_mig$\KB947864\SP2QFE\wininet.dll
[7] 2008-03-01 13:03 827392 6316C2F0C61271C8ABDFF7429174879E c:\windows\$hf_mig$\KB947864-IE7\SP2QFE\wininet.dll
[7] 2008-04-23 03:35 827392 41546B396A526918DA7995A02EA04E51 c:\windows\$hf_mig$\KB950759-IE7\SP2QFE\wininet.dll
[7] 2008-06-23 16:01 827904 C66402A06B83B036C195242C0C8CF83C c:\windows\$hf_mig$\KB953838-IE7\SP2QFE\wininet.dll
[7] 2008-08-26 09:08 827904 77C192FE56A70D7FA0247BA0A6201C32 c:\windows\$hf_mig$\KB956390-IE7\SP2QFE\wininet.dll
[7] 2008-10-16 20:24 827904 0D5B75171FF51775B630A431B6C667E8 c:\windows\$hf_mig$\KB958215-IE7\SP2QFE\wininet.dll
[7] 2008-12-20 23:56 827904 044E0A4E9FE97C0FB9AFE9C89E2A82E6 c:\windows\$hf_mig$\KB961260-IE7\SP2QFE\wininet.dll
[7] 2009-03-03 00:17 828416 C8667854873938CA13C986F16B0CD183 c:\windows\$hf_mig$\KB963027-IE7\SP3QFE\wininet.dll
[7] 2009-04-29 04:49 828928 62CCA075F44015147B8971DAFFBCFF76 c:\windows\$hf_mig$\KB969897-IE7\SP3QFE\wininet.dll
[7] 2009-05-13 05:10 915456 C0EB6850C8A02A154281749DC61FAF22 c:\windows\$hf_mig$\KB969897-IE8\SP3QFE\wininet.dll
[7] 2004-08-04 06:56 656384 C0823FC5469663BA63E7DB88F9919D70 c:\windows\$NtUninstallKB947864$\wininet.dll
[-] 2008-02-16 08:59 659456 0C690E77C0E924C45B4D7045B182FFF1 c:\windows\ie7\wininet.dll
[7] 2007-08-13 23:54 818688 A4A0FC92358F39538A6494C42EF99FE9 c:\windows\ie7updates\KB942615-IE7\wininet.dll
[7] 2007-10-10 23:56 824832 30C1E0F34AD2972C72A01DB5C74AB065 c:\windows\ie7updates\KB944533-IE7\wininet.dll
[7] 2007-12-07 02:21 824832 806D274C9A6C3AAEA5EAE8E4AF841E04 c:\windows\ie7updates\KB947864-IE7\wininet.dll
[7] 2008-03-01 13:06 826368 AD21461AEF8244EDEC2EF18E55E1DCF3 c:\windows\ie7updates\KB950759-IE7\wininet.dll
[7] 2008-04-23 04:16 826368 F6589BE784647CFDBC22EA51CCB1A57A c:\windows\ie7updates\KB953838-IE7\wininet.dll
[7] 2008-06-23 16:57 826368 8C13D4A7479FA0A026EDA8ABCE82C0ED c:\windows\ie7updates\KB956390-IE7\wininet.dll
[7] 2008-08-26 07:24 826368 EF8EBA98145BFA44E80D17A3B3453300 c:\windows\ie7updates\KB958215-IE7\wininet.dll
[7] 2008-10-16 20:38 826368 6741EAF7B7F110E803A6E38F6E5FA6B0 c:\windows\ie7updates\KB961260-IE7\wininet.dll
[7] 2008-12-20 23:15 826368 A82935D32D0672E8FF4E91AE398E901C c:\windows\ie7updates\KB963027-IE7\wininet.dll
[7] 2009-03-03 00:18 826368 28775945CCD53DEE280EF58DEA1A94C4 c:\windows\ie7updates\KB969897-IE7\wininet.dll
[7] 2009-04-29 04:56 827392 8E2D471157B0DF329D8D0EA5D83B0DDB c:\windows\ie8\wininet.dll
[7] 2009-03-08 09:34 914944 6CE32F7778061CCC5814D5E0F282D369 c:\windows\ie8updates\KB969897-IE8\wininet.dll
[7] 2008-04-14 00:12 666112 7A4F775ABB2F1C97DEF3E73AFA2FAEDD c:\windows\ServicePackFiles\i386\wininet.dll
[7] 2008-03-01 13:06 826368 AD21461AEF8244EDEC2EF18E55E1DCF3 c:\windows\SoftwareDistribution\Download\4dcb1f965c037cafb3a5ed4c71a998b8\SP2GDR\wininet.dll
[7] 2008-03-01 13:03 827392 6316C2F0C61271C8ABDFF7429174879E c:\windows\SoftwareDistribution\Download\4dcb1f965c037cafb3a5ed4c71a998b8\SP2QFE\wininet.dll
[7] 2009-05-13 05:15 915456 366C72AF6970DB7BB39AB0142BF09DB5 c:\windows\SoftwareDistribution\Download\97fe76a20161cb86e78057600e7c82a0\SP3GDR\wininet.dll
[7] 2009-05-13 05:10 915456 C0EB6850C8A02A154281749DC61FAF22 c:\windows\SoftwareDistribution\Download\97fe76a20161cb86e78057600e7c82a0\SP3QFE\wininet.dll
[7] 2007-10-10 23:56 824832 30C1E0F34AD2972C72A01DB5C74AB065 c:\windows\SoftwareDistribution\Download\e3709fbfd9557a7d083f543d51d38612\SP2GDR\wininet.dll
[7] 2007-10-10 23:47 825344 0E5D918F87EFA7D2424D66B499C7EB04 c:\windows\SoftwareDistribution\Download\e3709fbfd9557a7d083f543d51d38612\SP2QFE\wininet.dll
[7] 2007-12-07 02:21 824832 806D274C9A6C3AAEA5EAE8E4AF841E04 c:\windows\SoftwareDistribution\Download\e5a204b08ee9dd0f7a20547e61486b27\SP2GDR\wininet.dll
[7] 2007-12-07 02:01 825344 B5B411BB229AE6EAD7652A32ED47BFB9 c:\windows\SoftwareDistribution\Download\e5a204b08ee9dd0f7a20547e61486b27\SP2QFE\wininet.dll
[7] 2009-05-13 05:15 915456 366C72AF6970DB7BB39AB0142BF09DB5 c:\windows\system32\wininet.dll
[7] 2009-05-13 05:15 915456 366C72AF6970DB7BB39AB0142BF09DB5 c:\windows\system32\dllcache\wininet.dll

[-] 2007-10-30 16:53 360832 64798ECFA43D78C7178375FCDD16D8C8 c:\windows\$hf_mig$\KB941644\SP2QFE\tcpip.sys
[7] 2008-06-20 10:44 360960 744E57C99232201AE98C49168B918F48 c:\windows\$hf_mig$\KB951748\SP2QFE\tcpip.sys
[7] 2008-06-20 11:51 361600 9AEFA14BD6B182D61E3119FA5F436D3D c:\windows\$hf_mig$\KB951748\SP3GDR\tcpip.sys
[7] 2008-06-20 11:59 361600 AD978A1B783B5719720CFF204B666C8E c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
[7] 2008-06-20 10:45 360320 2A5554FC5B1E04E131230E3CE035C3F9 c:\windows\$NtServicePackUninstall$\tcpip.sys
[7] 2004-08-04 05:14 359040 9F4B36614A0FC234525BA224957DE55C c:\windows\$NtUninstallKB941644$\tcpip.sys
[7] 2008-04-13 19:20 361344 93EA8D04EC73A85DB02EB8805988F733 c:\windows\$NtUninstallKB951748$\tcpip.sys
[-] 2007-10-30 17:20 360064 90CAFF4B094573449A0872A0F919B178 c:\windows\$NtUninstallKB951748_0$\tcpip.sys
[7] 2008-04-13 19:20 361344 93EA8D04EC73A85DB02EB8805988F733 c:\windows\ServicePackFiles\i386\tcpip.sys
[7] 2008-06-20 11:51 361600 9AEFA14BD6B182D61E3119FA5F436D3D c:\windows\system32\dllcache\tcpip.sys
[7] 2008-06-20 11:51 361600 9AEFA14BD6B182D61E3119FA5F436D3D c:\windows\system32\drivers\tcpip.sys

[7] 2004-08-04 06:56 502272 01C3346C241652F43AED8E2149881BFE c:\windows\$NtServicePackUninstall$\winlogon.exe
[7] 2008-04-14 00:12 507904 ED0EF0A136DEC83DF69F04118870003E c:\windows\ServicePackFiles\i386\winlogon.exe
[7] 2008-04-14 00:12 507904 ED0EF0A136DEC83DF69F04118870003E c:\windows\system32\winlogon.exe
[7] 2008-04-14 00:12 507904 ED0EF0A136DEC83DF69F04118870003E c:\windows\system32\dllcache\winlogon.exe

[7] 2004-08-04 05:14 182912 558635D3AF1C7546D26067D5D9B6959E c:\windows\$NtServicePackUninstall$\ndis.sys
[7] 2008-04-13 19:20 182656 1DF7F42665C94B825322FAE71721130D c:\windows\ServicePackFiles\i386\ndis.sys
[7] 2008-04-13 19:20 182656 1DF7F42665C94B825322FAE71721130D c:\windows\system32\drivers\ndis.sys

[7] 2004-08-04 05:00 29056 4448006B6BC60E6C027932CFC38D6855 c:\windows\$NtServicePackUninstall$\ip6fw.sys
[7] 2008-04-13 18:53 36608 3BB22519A194418D5FEC05D800A19AD0 c:\windows\ServicePackFiles\i386\ip6fw.sys
[7] 2008-04-13 18:53 36608 3BB22519A194418D5FEC05D800A19AD0 c:\windows\system32\drivers\ip6fw.sys

[-] 2005-03-02 00:36 2056832 D8ABA3EAB509627E707A3B14F00FBB6B c:\windows\$hf_mig$\KB890859\SP2QFE\ntkrnlpa.exe
[-] 2007-02-28 09:15 2059392 4D3DBDCCBF97F5BA1E74F322B155C3BA c:\windows\$hf_mig$\KB931784\SP2QFE\ntkrnlpa.exe
[7] 2009-02-06 10:30 2066176 607352B9CB3D708C67F6039097801B5A c:\windows\$hf_mig$\KB956572\SP3QFE\ntkrnlpa.exe
[7] 2008-08-14 20:39 2066048 A25E9B86EFFB2AF33BF51E676B68BFB0 c:\windows\$hf_mig$\KB956841\SP3QFE\ntkrnlpa.exe
[-] 2007-02-28 08:38 2057600 515D30E2C90A3665A2739309334C9283 c:\windows\$NtServicePackUninstall$\ntkrnlpa.exe
[7] 2004-08-04 07:05 2056832 947FB1D86D14AFCFFDB54BF837EC25D0 c:\windows\$NtUninstallKB890859$\ntkrnlpa.exe
[-] 2005-03-02 00:34 2056832 81013F36B21C7F72CF784CC6731E0002 c:\windows\$NtUninstallKB931784$\ntkrnlpa.exe
[7] 2008-08-14 09:33 2066048 4AC58F03EB94A72809949D757FC39D80 c:\windows\$NtUninstallKB956572$\ntkrnlpa.exe
[7] 2008-04-13 18:31 2065792 109F8E3E3C82E337BB71B6BC9B895D61 c:\windows\$NtUninstallKB956841$\ntkrnlpa.exe
[7] 2009-02-08 00:02 2066048 5BA7F2141BC6DB06100D0E5A732C617A c:\windows\Driver Cache\i386\ntkrnlpa.exe
[7] 2008-04-13 18:31 2065792 109F8E3E3C82E337BB71B6BC9B895D61 c:\windows\ServicePackFiles\i386\ntkrnlpa.exe
[7] 2009-02-08 00:02 2066048 5BA7F2141BC6DB06100D0E5A732C617A c:\windows\system32\ntkrnlpa.exe
[7] 2009-02-08 00:02 2066048 5BA7F2141BC6DB06100D0E5A732C617A c:\windows\system32\dllcache\ntkrnlpa.exe

[-] 2005-03-02 01:04 2179456 28187802B7C368C0D3AEF7D4C382AABB c:\windows\$hf_mig$\KB890859\SP2QFE\ntoskrnl.exe
[-] 2007-02-28 09:55 2182144 5A5C8DB4AA962C714C8371FBDF189FC9 c:\windows\$hf_mig$\KB931784\SP2QFE\ntoskrnl.exe
[7] 2009-02-08 00:35 2189184 EFE8EACE83EAAD5849A7A548FB75B584 c:\windows\$hf_mig$\KB956572\SP3QFE\ntoskrnl.exe
[7] 2008-08-14 21:11 2189184 31914172342BFF330063F343AC6958FE c:\windows\$hf_mig$\KB956841\SP3QFE\ntoskrnl.exe
[-] 2007-02-28 09:10 2180352 582A8DBAA58C3B1F176EB2817DAEE77C c:\windows\$NtServicePackUninstall$\ntoskrnl.exe
[7] 2004-08-04 05:20 2180992 CE218BC7088681FAA06633E218596CA7 c:\windows\$NtUninstallKB890859$\ntoskrnl.exe
[-] 2005-03-02 00:59 2179328 4D4CF2C14550A4B7718E94A6E581856E c:\windows\$NtUninstallKB931784$\ntoskrnl.exe
[7] 2008-08-14 10:11 2189184 EEAF32F8E15A24F62BECB1BD403BB5C5 c:\windows\$NtUninstallKB956572$\ntoskrnl.exe
[7] 2008-04-13 19:27 2188928 0C89243C7C3EE199B96FCC16990E0679 c:\windows\$NtUninstallKB956841$\ntoskrnl.exe
[7] 2009-02-06 11:08 2189056 7A95B10A73737EBF24139AAA63F5212B c:\windows\Driver Cache\i386\ntoskrnl.exe
[7] 2008-04-13 19:27 2188928 0C89243C7C3EE199B96FCC16990E0679 c:\windows\ServicePackFiles\i386\ntoskrnl.exe
[7] 2009-02-06 11:08 2189056 7A95B10A73737EBF24139AAA63F5212B c:\windows\system32\ntoskrnl.exe
[7] 2009-02-06 11:08 2189056 7A95B10A73737EBF24139AAA63F5212B c:\windows\system32\dllcache\ntoskrnl.exe

[7] 2008-04-14 00:12 1033728 12896823FB95BFB3DC9B46BCAEDC9923 c:\windows\explorer.exe
[-] 2007-06-13 11:26 1033216 7712DF0CDDE3A5AC89843E61CD5B3658 c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
[-] 2007-06-13 10:23 1033216 97BD6515465659FF8F3B7BE375B2EA87 c:\windows\$NtServicePackUninstall$\explorer.exe
[7] 2004-08-04 06:56 1032192 A0732187050030AE399B241436565E64 c:\windows\$NtUninstallKB938828$\explorer.exe
[7] 2008-04-14 00:12 1033728 12896823FB95BFB3DC9B46BCAEDC9923 c:\windows\ServicePackFiles\i386\explorer.exe

[7] 2009-02-06 11:06 110592 020CEAAEDC8EB655B6506B8C70D53BB6 c:\windows\$hf_mig$\KB956572\SP3QFE\services.exe
[7] 2004-08-04 06:56 108032 C6CE6EEC82F187615D1002BB3BB50ED4 c:\windows\$NtServicePackUninstall$\services.exe
[7] 2008-04-14 00:12 108544 0E776ED5F7CC9F94299E70461B7B8185 c:\windows\$NtUninstallKB956572$\services.exe
[7] 2008-04-14 00:12 108544 0E776ED5F7CC9F94299E70461B7B8185 c:\windows\ServicePackFiles\i386\services.exe
[7] 2009-02-06 11:11 110592 65DF52F5B8B6E9BBD183505225C37315 c:\windows\system32\services.exe
[7] 2009-02-06 11:11 110592 65DF52F5B8B6E9BBD183505225C37315 c:\windows\system32\dllcache\services.exe

[7] 2004-08-04 06:56 13312 84885F9B82F4D55C6146EBF6065D75D2 c:\windows\$NtServicePackUninstall$\lsass.exe
[7] 2008-04-14 00:12 13312 BF2466B3E18E970D8A976FB95FC1CA85 c:\windows\ServicePackFiles\i386\lsass.exe

[7] 2008-04-14 00:12 13312 BF2466B3E18E970D8A976FB95FC1CA85 c:\windows\system32\lsass.exe

[7] 2004-08-04 06:56 15360 24232996A38C0B0CF151C2140AE29FC8 c:\windows\$NtServicePackUninstall$\ctfmon.exe
[7] 2008-04-14 00:12 15360 5F1D5F88303D4A4DBC8E5F97BA967CC3 c:\windows\ServicePackFiles\i386\ctfmon.exe
[7] 2008-04-14 00:12 15360 5F1D5F88303D4A4DBC8E5F97BA967CC3 c:\windows\system32\ctfmon.exe

[-] 2005-06-11 00:17 57856 AD3D9D191AEA7B5445FE1D82FFBB4788 c:\windows\$hf_mig$\KB896423\SP2QFE\spoolsv.exe
[-] 2005-06-10 23:53 57856 DA81EC57ACD4CDC3D4C51CF3D409AF9F c:\windows\$NtServicePackUninstall$\spoolsv.exe
[7] 2004-08-04 06:56 57856 7435B108B935E42EA92CA94F59C8E717 c:\windows\$NtUninstallKB896423$\spoolsv.exe
[7] 2008-04-14 00:12 57856 D8E14A61ACC1D4A6CD0D38AEBAC7FA3B c:\windows\ServicePackFiles\i386\spoolsv.exe
[7] 2008-04-14 00:12 57856 D8E14A61ACC1D4A6CD0D38AEBAC7FA3B c:\windows\system32\spoolsv.exe

[7] 2008-04-14 00:12 111104 ED7262E52C31CF1625B65039102BC16C c:\windows\ServicePackFiles\i386\wuauclt.exe
[7] 2008-10-16 20:09 51224 E654B78D2F1D791B30D0ED9A8195EC22 c:\windows\system32\wuauclt.exe
[7] 2008-10-16 20:09 51224 E654B78D2F1D791B30D0ED9A8195EC22 c:\windows\system32\dllcache\wuauclt.exe

[7] 2004-08-04 06:56 24576 39B1FFB03C2296323832ACBAE50D2AFF c:\windows\$NtServicePackUninstall$\userinit.exe
[7] 2008-04-14 00:12 26112 A93AEE1928A9D7CE3E16D24EC7380F89 c:\windows\ServicePackFiles\i386\userinit.exe
[7] 2008-04-14 00:12 26112 A93AEE1928A9D7CE3E16D24EC7380F89 c:\windows\system32\userinit.exe

[7] 2004-08-04 06:56 295424 B60C877D16D9C880B952FDA04ADF16E6 c:\windows\$NtServicePackUninstall$\termsrv.dll
[7] 2008-04-14 00:12 295424 FF3477C03BE7201C294C35F684B3479F c:\windows\ServicePackFiles\i386\termsrv.dll
[7] 2008-04-14 00:12 295424 FF3477C03BE7201C294C35F684B3479F c:\windows\system32\termsrv.dll

[-] 2007-04-16 16:07 986112 09F7CB3687F86EDAA4CA081F7AB66C03 c:\windows\$hf_mig$\KB935839\SP2QFE\kernel32.dll
[7] 2009-03-21 13:59 991744 DA11D9D6ECBDF0F93436A4B7C13F7BEC c:\windows\$hf_mig$\KB959426\SP3QFE\kernel32.dll
[-] 2007-04-16 15:52 984576 A01F9CA902A88F7CED06884174D6419D c:\windows\$NtServicePackUninstall$\kernel32.dll
[7] 2004-08-04 06:56 983552 888190E31455FAD793312F8D087146EB c:\windows\$NtUninstallKB935839$\kernel32.dll
[7] 2008-04-14 00:11 989696 C24B983D211C34DA8FCC1AC38477971D c:\windows\$NtUninstallKB959426$\kernel32.dll
[7] 2008-04-14 00:11 989696 C24B983D211C34DA8FCC1AC38477971D c:\windows\ServicePackFiles\i386\kernel32.dll
[7] 2009-03-21 14:06 989696 B921FB870C9AC0D509B2CCABBBBE95F3 c:\windows\system32\kernel32.dll
[7] 2009-03-21 14:06 989696 B921FB870C9AC0D509B2CCABBBBE95F3 c:\windows\system32\dllcache\kernel32.dll

[7] 2004-08-04 06:56 17408 1B5F6923ABB450692E9FE0672C897AED c:\windows\$NtServicePackUninstall$\powrprof.dll
[7] 2008-04-14 00:12 17408 50A166237A0FA771261275A405646CC0 c:\windows\ServicePackFiles\i386\powrprof.dll
[7] 2008-04-14 00:12 17408 50A166237A0FA771261275A405646CC0 c:\windows\system32\powrprof.dll

[7] 2004-08-04 06:56 110080 87CA7CE6469577F059297B9D6556D66D c:\windows\$NtServicePackUninstall$\imm32.dll
[7] 2008-04-14 00:11 110080 0DA85218E92526972A821587E6A8BF8F c:\windows\ServicePackFiles\i386\imm32.dll
[7] 2008-04-14 00:11 110080 0DA85218E92526972A821587E6A8BF8F c:\windows\system32\imm32.dll
[7] 2008-04-14 00:11 110080 0DA85218E92526972A821587E6A8BF8F c:\windows\system32\dllcache\imm32.dll

[7] 2004-08-04 06:56 1580544 30A609E00BD1D4FFC49D6B5A432BE7F2 c:\windows\$NtServicePackUninstall$\sfcfiles.dll
[7] 2008-04-14 00:12 1614848 9DD07AF82244867CA36681EA2D29CE79 c:\windows\ServicePackFiles\i386\sfcfiles.dll
[7] 2008-04-14 00:12 1614848 9DD07AF82244867CA36681EA2D29CE79 c:\windows\system32\sfcfiles.dll

[7] 2004-08-04 06:56 167936 9C3C12975C97119412802B181FBEEFFE c:\windows\$NtServicePackUninstall$\appmgmts.dll
[7] 2008-04-14 00:11 167936 D8849F77C0B66226335A59D26CB4EDC6 c:\windows\ServicePackFiles\i386\appmgmts.dll
[7] 2008-04-14 00:11 167936 D8849F77C0B66226335A59D26CB4EDC6 c:\windows\system32\appmgmts.dll

[7] 2004-08-04 04:58 24576 EBDEE8A2EE5393890A1ACEE971C4C246 c:\windows\$NtServicePackUninstall$\kbdclass.sys
[7] 2008-04-13 18:39 24576 463C1EC80CD17420A542B7F36A36F128 c:\windows\ServicePackFiles\i386\kbdclass.sys
[7] 2008-04-13 18:39 24576 463C1EC80CD17420A542B7F36A36F128 c:\windows\system32\drivers\kbdclass.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"Advanced SystemCare 3"="c:\program files\IObit\Advanced SystemCare 3\AWC.exe" [2009-06-17 2328712]
"SmartRAM"="c:\program files\IObit\Advanced SystemCare 3\Sup_SmartRAM.exe" [2009-02-19 202064]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"CoolSwitch"="c:\windows\system32\taskswitch.exe" [2001-10-08 45632]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-12-19 135168]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-12-19 159744]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-12-19 131072]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"ThreatFire"="c:\program files\ThreatFire\TFTray.exe" [2009-06-19 259344]
"00PCTFW"="c:\program files\PC Tools Firewall Plus\FirewallGUI.exe" [2008-03-28 2598808]

c:\documents and settings\Michael Francis\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
SpywareGuard.lnk - c:\program files\SpywareGuard\sgmain.exe [2003-8-29 360448]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoSMMyPictures"= 0 (0x0)
"NoStartMenuMyMusic"= 0 (0x0)
"NoRecentDocsNetHood"= 0 (0x0)
"NoSimpleStartMenu"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMMyPictures"= 0 (0x0)
"NoStartMenuMyMusic"= 0 (0x0)
"NoRecentDocsNetHood"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
"FastUser"=c:\windows\system32\fast.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Soulseek\\slsk.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\SoulseekNS\\slsk.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=

R0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys [6/22/2009 11:19 PM 51984]
R0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys [6/22/2009 11:19 PM 46864]
R1 pctfw2;pctfw2;c:\windows\system32\drivers\pctfw2.sys [6/22/2009 11:20 PM 159896]
R1 pctssipc;PC Tools Security Suite IPC Driver;c:\windows\system32\drivers\pctssipc.sys [6/22/2009 11:19 PM 18328]
R2 ThreatFire;ThreatFire;c:\program files\ThreatFire\TFService.exe service --> c:\program files\ThreatFire\TFService.exe service [?]
R3 TfNetMon;TfNetMon;c:\windows\system32\drivers\TfNetMon.sys [6/22/2009 11:19 PM 33552]
S3 ADM8511;ADMtek ADM8511/AN986 USB To Fast Ethernet Converter;c:\windows\system32\drivers\ADM8511.SYS [4/12/2008 2:16 PM 20160]
S3 SeratoUsb;SeratoUsb driver;c:\windows\system32\drivers\SeratoUsb.sys [3/16/2006 4:24 PM 35712]

--- Other Services/Drivers In Memory ---

*Deregistered* - mchInjDrv

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-05-07 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 18:34]

2009-06-29 c:\windows\Tasks\GlaryInitialize.job
- c:\program files\Glary Utilities\initialize.exe [2008-04-11 02:44]
.

- - - - ORPHANS REMOVED - - - -

Notify-WgaLogon - (no file)


.
------- Supplementary Scan -------
.
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Michael Francis\Application Data\Mozilla\Firefox\Profiles\ejisdlzw.default\
FF - component: c:\documents and settings\Michael Francis\Application Data\Mozilla\Firefox\Profiles\ejisdlzw.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}\components\WinampTBPlayer.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true
FF - user.js: browser.sessionstore.resume_from_crash - false
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-29 17:26
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1400)
c:\windows\system32\NavLogon.dll
c:\program files\ThreatFire\TFWAH.dll
c:\program files\ThreatFire\TFNI.dll
c:\program files\ThreatFire\TFMon.dll
c:\program files\ThreatFire\TFRK.dll

- - - - - - - > 'lsass.exe'(1480)
c:\program files\ThreatFire\TFWAH.dll

- - - - - - - > 'explorer.exe'(2732)
c:\windows\system32\WININET.dll
c:\program files\ThreatFire\TFWAH.dll
c:\windows\system32\ieframe.dll
c:\program files\ThreatFire\TFNI.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\MSVCR80.dll
c:\program files\ThreatFire\TFMon.dll
c:\program files\ThreatFire\TFRK.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\PC Tools Firewall Plus\FWService.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\NavNT\defwatch.exe
c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\program files\SpywareGuard\sgbhp.exe
c:\program files\ThreatFire\TFService.exe
.
**************************************************************************
.
Completion time: 2009-06-29 17:51 - machine was rebooted
ComboFix-quarantined-files.txt 2009-06-29 22:51

Pre-Run: 66,609,156,096 bytes free
Post-Run: 66,606,346,240 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

1094 --- E O F --- 2009-06-17 03:39

Now open a new notepad file.
Input this into the notepad file:

File::
c:\windows\2933259ambzt.exe

Folder::
C:\!KillBox
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=-

Save this as CFScript.txt, save it to your desktop also.
Then drag and drop CFScript.txt into combofix as seen below:


This will open combofix again, agree to it's terms and allow it to run.
It may want to reboot after it's done. (It will warn you if it wants to)
Post the resulting log back here.