[milleniumchief]

Hello All. I have an internet cafe down here in Costa Rica.

I'm having a problem with Kavo.exe and it's several variants.

I used to have McAfee but it didn't do anything about Kavo.
I switched to Avast and it detects it and deletes it but it keeps popping up randomly.

I've tried doing safe mode, avast scan before windows xp boots up
Also I've tried going into registry and doing a find and deleting all the kavo registry entries.

here is the log report from HijackThis ! Thanks to anyone who can help.

if you are bored(which i'm sure ur not, this site is very bz), can you also recommend what other entries I eliminate from below ?

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:23:17 PM, on 6/29/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\system32\00THotkey.exe
C:\WINDOWS\PixArt\PAC207\Monitor.exe
C:\WINDOWS\system32\TPSMain.exe
C:\Program Files\QuickTime\QTTask.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\CleanMyPC\Registry Cleaner\RCHelper.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\system32\RAMASST.exe
C:\WINDOWS\system32\TPSBattM.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\Documents and Settings\All Users.WINDOWS\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\imapi.exe
C:\WINDOWS\System32\snmp.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Webroot\Washer\WasherSvc.exe
C:\WINDOWS\system32\mqsvc.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Microsoft Office\Office12\EXCEL.EXE
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\MSN Messenger\livecall.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.cr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R3 - URLSearchHook: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O1 - Hosts: 66.98.148.65 auto.search.msn.com
O1 - Hosts: 66.98.148.65 auto.search.msn.es
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [00THotkey] C:\WINDOWS\system32\00THotkey.exe
O4 - HKLM\..\Run: [000StTHK] 000StTHK.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Monitor] C:\WINDOWS\PixArt\PAC207\Monitor.exe
O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] "C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe"
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [EPSON Stylus CX7300 Series] "C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICDL.EXE" /FU "C:\WINDOWS\TEMP\E_SB3.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Registry Cleaner Scheduler] "C:\Program Files\CleanMyPC\Registry Cleaner\RCHelper.exe" /startup
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - Startup: BJ Status Monitor Canon PIXMA iP1000.lnk = C:\Documents and Settings\KashiF\cnmss Canon PIXMA iP1000 (Local).exe
O4 - Startup: Mozilla Firefox.lnk = C:\Program Files\Mozilla Firefox\firefox.exe
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Referencia - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail....es/MSNPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.mi...b?1210105480218
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.mi...b?1210105961625
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game03.zylom....gamesplayer.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zon...nt.cab56907.cab
O16 - DPF: {EA6246B4-F380-443F-8727-9AEA3371146C} (CPlayFirstWeddingDashControl Object) - http://www.shockwave...sh.1.0.0.47.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zon...er.cab56986.cab
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: EPSON V3 Service4(01) (EPSON_PM_RPCV4_01) - SEIKO EPSON CORPORATION - C:\Documents and Settings\All Users.WINDOWS\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
O23 - Service: Window Washer Engine (wwEngineSvc) - Webroot Software, Inc. - C:\Program Files\Webroot\Washer\WasherSvc.exe

--
End of file - 9869 bytes

[Advertisements]

Welcome to GTG.

1. Download combofix at http://download.blee...Bs/ComboFix.exe Save it to your Desktop before you run it.
2. Double-click combofix.exe & follow the prompts.
3. When finished, it will produce a log for you. Post that log in your next reply.

Note:
Do not click on combofix's window while it's running. That may cause it to stall.

[greyknight17]

Welcome to GTG.

1. Download combofix at http://download.blee...Bs/ComboFix.exe Save it to your Desktop before you run it.
2. Double-click combofix.exe & follow the prompts.
3. When finished, it will produce a log for you. Post that log in your next reply.

Note:
Do not click on combofix's window while it's running. That may cause it to stall.

[milleniumchief]

Welcome to GTG.

1. Download combofix at http://download.blee...Bs/ComboFix.exe Save it to your Desktop before you run it.
2. Double-click combofix.exe & follow the prompts.
3. When finished, it will produce a log for you. Post that log in your next reply.

Note:
Do not click on combofix's window while it's running. That may cause it to stall.

thanks

ComboFix 08-06-20.4 - KashiF 2008-06-30 21:10:56.1 - NTFSx86
Running from: C:\Documents and Settings\KashiF\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\KashiF\Application Data\.#
C:\WINDOWS\system32\Cache

.
((((((((((((((((((((((((( Files Created from 2008-06-01 to 2008-07-01 )))))))))))))))))))))))))))))))
.

2008-06-30 17:22 . 2008-06-30 17:24 <DIR> d-------- C:\caRPETA
2008-06-29 16:19 . 2008-06-29 16:19 <DIR> d-------- C:\Documents and Settings\NetworkService.NT AUTHORITY\Application Data\Webroot
2008-06-29 16:08 . 2008-06-29 16:08 <DIR> d-------- C:\Documents and Settings\LocalService.NT AUTHORITY\Application Data\Webroot
2008-06-29 16:08 . 2007-10-01 16:40 1,526,072 --a------ C:\WINDOWS\WRSetup.dll
2008-06-29 16:08 . 2007-10-01 16:24 163,640 --a------ C:\WINDOWS\system32\drivers\ssidrv.sys
2008-06-29 16:08 . 2007-10-01 16:24 23,864 --a------ C:\WINDOWS\system32\drivers\sskbfd.sys
2008-06-29 16:08 . 2007-10-01 16:24 21,816 --a------ C:\WINDOWS\system32\drivers\sshrmd.sys
2008-06-29 16:08 . 2007-10-01 16:24 20,280 --a------ C:\WINDOWS\system32\drivers\SSFS0BB9.sys
2008-06-28 13:25 . 2008-06-28 13:25 <DIR> d-------- C:\Documents and Settings\KashiF\Application Data\Apple Computer
2008-06-28 13:20 . 2008-06-28 13:20 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Apple Computer
2008-06-28 13:19 . 2008-06-28 13:19 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Apple
2008-06-28 13:06 . 2008-06-28 13:06 <DIR> d-------- C:\Program Files\Common Files\xing shared
2008-06-26 11:47 . 2008-06-26 11:47 124,300 -r-hs---- C:\1aq1obb.bat
2008-06-25 19:32 . 2008-06-25 21:36 68,096 --a------ C:\Presentación1.ppt
2008-06-25 17:37 . 2008-06-27 19:12 39,936 --a------ C:\FACTURA CATERING 26 DE MARZO.doc
2008-06-24 13:18 . 2008-06-24 13:18 <DIR> d-------- C:\Program Files\Microsoft.NET
2008-06-24 13:07 . 2008-06-24 13:07 <DIR> dr-h----- C:\MSOCache
2008-06-21 16:22 . 2008-06-21 15:44 812,344 --a------ C:\HJTInstall.exe
2008-06-21 15:44 . 2008-06-21 15:44 <DIR> d-------- C:\Program Files\Trend Micro
2008-06-20 17:36 . 2008-06-20 17:36 <DIR> d-------- C:\Program Files\Alwil Software
2008-06-20 15:22 . 2008-06-20 15:21 123,773 -r-hs---- C:\o6opnro.bat
2008-06-19 17:23 . 2008-06-19 15:12 24,234,968 --a------ C:\avast.exe
2008-06-19 15:02 . 2008-06-19 15:02 <DIR> d-------- C:\Program Files\MetaStream
2008-06-16 00:50 . 2008-06-16 01:08 28,672 --a------ C:\Email Translation.doc
2008-06-15 20:03 . 2006-11-30 15:11 90,800 -ra------ C:\WINDOWS\system32\drivers\se46unic.sys
2008-06-15 20:03 . 2006-11-30 15:11 18,704 -ra------ C:\WINDOWS\system32\drivers\se46nd5.sys
2008-06-15 20:03 . 2006-11-30 15:11 4,128 -ra------ C:\WINDOWS\system32\drivers\se46cr.sys
2008-06-15 20:02 . 2006-11-30 15:11 97,088 -ra------ C:\WINDOWS\system32\drivers\se46mdm.sys
2008-06-15 20:02 . 2006-11-30 15:11 88,624 -ra------ C:\WINDOWS\system32\drivers\se46mgmt.sys
2008-06-15 20:02 . 2006-11-30 15:11 86,432 -ra------ C:\WINDOWS\system32\drivers\se46obex.sys
2008-06-15 20:02 . 2006-11-30 15:11 61,536 -ra------ C:\WINDOWS\system32\drivers\se46bus.sys
2008-06-15 20:02 . 2006-11-30 15:11 9,360 -ra------ C:\WINDOWS\system32\drivers\se46mdfl.sys
2008-06-15 20:02 . 2006-11-30 15:11 6,240 -ra------ C:\WINDOWS\system32\drivers\se46cmnt.sys
2008-06-15 20:02 . 2006-11-30 15:11 6,240 -ra------ C:\WINDOWS\system32\drivers\se46cm.sys
2008-06-15 20:02 . 2006-11-30 15:11 5,872 -ra------ C:\WINDOWS\system32\drivers\se46whnt.sys
2008-06-15 20:02 . 2006-11-30 15:11 5,872 -ra------ C:\WINDOWS\system32\drivers\se46wh.sys
2008-06-15 20:01 . 2008-06-15 20:01 <DIR> d-------- C:\Documents and Settings\KashiF\Application Data\Teleca
2008-06-15 20:00 . 2008-06-15 20:00 <DIR> d-------- C:\Documents and Settings\KashiF\Application Data\Sony Ericsson
2008-06-15 19:50 . 2008-06-15 19:50 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Sony Ericsson
2008-06-15 19:49 . 2008-06-15 19:50 <DIR> d-------- C:\Program Files\Common Files\Teleca Shared
2008-06-15 19:49 . 2008-06-15 19:50 <DIR> d-------- C:\Program Files\Common Files\Sony Ericsson Shared
2008-06-15 19:48 . 2008-06-15 19:48 <DIR> d-------- C:\Program Files\Sony Ericsson
2008-06-15 19:48 . 2008-06-15 19:50 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Teleca
2008-06-15 19:43 . 2008-06-15 19:43 <DIR> d-------- C:\Program Files\Disc2Phone
2008-06-15 18:22 . 2008-06-15 18:22 <DIR> d-------- C:\Program Files\XviD
2008-06-15 18:15 . 2008-06-28 14:41 <DIR> d-------- C:\Program Files\3GP Player
2008-06-15 18:08 . 2008-06-18 21:21 1,465 --a------ C:\WINDOWS\cdplayer.ini
2008-06-15 18:04 . 2008-06-15 18:04 <DIR> d-------- C:\Program Files\Real
2008-06-14 18:15 . 2008-06-14 18:15 <DIR> d-------- C:\Documents and Settings\KashiF\Application Data\Nero
2008-06-14 18:07 . 2008-06-14 18:07 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Nero
2008-06-13 18:29 . 2008-06-13 18:29 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Yahoo! Companion
2008-06-13 14:05 . 2008-02-28 13:26 1,414,440 --a------ C:\WINDOWS\system32\ShellManager310E2D762.dll
2008-06-13 14:05 . 2008-02-28 13:01 774,144 --a------ C:\WINDOWS\system32\NEROINSTAEC43759.DB
2008-06-12 21:20 . 2008-06-12 21:20 <DIR> d-------- C:\Program Files\NeroInstall.bak
2008-06-12 21:12 . 2008-06-27 10:46 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-06-12 21:12 . 2008-06-20 17:36 1,409 --a------ C:\WINDOWS\QTFont.for
2008-06-11 19:46 . 2008-06-30 10:50 <DIR> d-a------ C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP
2008-06-11 19:45 . 2008-06-11 19:45 <DIR> d-------- C:\Program Files\CleanMyPC
2008-06-10 20:33 . 2008-06-10 20:34 <DIR> d-------- C:\Program Files\Advanced Batch Converter
2008-06-10 13:09 . 2008-06-05 07:23 47,787,248 --a------ C:\avg_free_stf_en_8_100a1295.exe
2008-06-07 19:24 . 2008-06-07 19:24 <DIR> d-------- C:\pc.tools.registry.mechanic.7.0.0.1010.+keygen-reseed
2008-06-07 19:24 . 2008-06-07 19:24 <DIR> d-------- C:\Clean My PC REGISTRY CLEANER 4.01(NEW-with serial key)
2008-06-05 18:05 . 2008-06-05 18:05 <DIR> d-------- C:\WINDOWS\Internet Logs
2008-06-05 18:05 . 2008-06-05 18:05 <DIR> d-------- C:\Program Files\Zone Labs
2008-06-04 18:24 . 2008-06-23 16:53 <DIR> d-------- C:\Program Files\Motorola Phone Tools
2008-06-04 18:07 . 2006-11-13 14:45 1,419,232 --a------ C:\WINDOWS\system32\wdfcoinstaller01005.dll
2008-06-04 18:07 . 2007-06-18 14:18 23,680 --a------ C:\WINDOWS\system32\drivers\motmodem.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-30 01:13 --------- d-----w C:\Documents and Settings\KashiF\Application Data\uTorrent
2008-06-29 22:08 --------- d-----w C:\Program Files\Webroot
2008-06-29 22:08 --------- d-----w C:\Documents and Settings\KashiF\Application Data\Webroot
2008-06-29 22:08 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Webroot
2008-06-28 20:51 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-28 20:51 --------- d-----w C:\Documents and Settings\KashiF\Application Data\ArcSoft
2008-06-28 19:22 --------- d-----w C:\Program Files\QuickTime
2008-06-28 19:19 --------- d-----w C:\Program Files\Apple Software Update
2008-06-28 19:06 --------- d-----w C:\Program Files\Common Files\Real
2008-06-26 18:05 --------- d-----w C:\Program Files\IrfanView
2008-06-24 19:39 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft Help
2008-06-23 22:49 --------- d-----w C:\Program Files\Avanquest update
2008-06-23 19:36 --------- d-----w C:\Program Files\DivX
2008-06-20 23:35 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\McAfee
2008-06-17 02:49 --------- d-----w C:\Documents and Settings\KashiF\Application Data\LimeWire
2008-06-16 01:42 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-06-16 00:04 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll
2008-06-15 00:09 --------- d-----w C:\Program Files\Common Files\Nero
2008-06-14 00:29 --------- d-----w C:\Documents and Settings\KashiF\Application Data\Yahoo!
2008-06-13 22:03 --------- d-----w C:\Program Files\Nero
2008-06-13 21:18 --------- d-----w C:\Program Files\Yahoo!
2008-06-13 21:18 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Yahoo!
2008-06-13 20:48 --------- d-----w C:\Program Files\uTorrent
2008-06-05 22:39 --------- d-----w C:\Program Files\Mozilla Firefox 3 Beta 5
2008-06-05 00:45 92,064 ----a-w C:\Documents and Settings\KashiF\mqdmmdm.sys
2008-06-05 00:45 9,232 ----a-w C:\Documents and Settings\KashiF\mqdmmdfl.sys
2008-06-05 00:45 79,328 ----a-w C:\Documents and Settings\KashiF\mqdmserd.sys
2008-06-05 00:45 66,656 ----a-w C:\Documents and Settings\KashiF\mqdmbus.sys
2008-06-05 00:45 6,208 ----a-w C:\Documents and Settings\KashiF\mqdmcmnt.sys
2008-06-05 00:45 5,936 ----a-w C:\Documents and Settings\KashiF\mqdmwhnt.sys
2008-06-05 00:45 4,048 ----a-w C:\Documents and Settings\KashiF\mqdmcr.sys
2008-06-05 00:45 25,600 ----a-w C:\Documents and Settings\KashiF\usbsermptxp.sys
2008-06-05 00:45 22,768 ----a-w C:\Documents and Settings\KashiF\usbsermpt.sys
2008-06-05 00:36 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\BVRP Software
2008-06-05 00:24 22,768 ----a-w C:\WINDOWS\system32\drivers\usbsermpt.sys
2008-05-30 23:22 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2008-05-30 23:22 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2008-05-30 23:22 815,104 ----a-w C:\WINDOWS\system32\divx_xx0a.dll
2008-05-30 23:22 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2008-05-30 23:22 683,520 ----a-w C:\WINDOWS\system32\DivX.dll
2008-05-30 23:22 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
2008-05-30 23:22 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
2008-05-30 23:22 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
2008-05-30 23:22 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
2008-05-30 23:22 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
2008-05-30 23:22 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
2008-05-29 23:46 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\SiteAdvisor
2008-05-22 22:22 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2008-05-22 22:22 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2008-05-22 22:20 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2008-05-22 22:20 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2008-05-22 22:19 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2008-05-22 22:19 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
2008-05-22 22:19 161,096 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-05-22 22:18 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2008-05-20 22:25 --------- d-----w C:\Documents and Settings\KashiF\Application Data\AVSMedia
2008-05-20 22:24 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\AVS4YOU
2008-05-20 22:17 --------- d-----w C:\Program Files\Common Files\AVSMedia
2008-05-20 22:16 --------- d-----w C:\Program Files\AVSMedia
2008-05-17 23:42 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\QuickTime
2008-05-17 23:38 --------- d-----w C:\Program Files\The Rosetta Stone
2008-05-17 18:38 --------- d-----w C:\Program Files\OJOsoft
2008-05-15 20:29 --------- d-----w C:\Program Files\Flickr Uploadr
2008-05-09 23:48 --------- d-----w C:\Documents and Settings\KashiF\Application Data\Skype
2008-05-06 22:41 --------- d-----w C:\Program Files\Links2Tray
2008-05-06 22:39 --------- d-----w C:\Program Files\CCP Server 5
2008-05-06 00:36 --------- d-----w C:\Program Files\SopCast
2008-05-05 19:51 --------- d-----w C:\Documents and Settings\KashiF\Application Data\U3
2008-05-04 23:32 --------- d-----w C:\Program Files\Pure Networks
2008-05-03 22:46 --------- d-----w C:\Program Files\FLV Player
2008-05-03 01:34 --------- d-----w C:\Program Files\YouTube Downloader
2008-05-03 01:29 --------- d-----w C:\Documents and Settings\KashiF\Application Data\CDBurnerXP_Soft
2008-05-03 01:26 --------- d-----w C:\Program Files\MSBuild
2008-05-03 01:25 --------- d-----w C:\Program Files\Reference Assemblies
2008-05-03 01:19 --------- d-----w C:\Program Files\MSXML 6.0
2008-03-06 22:23 92,064 ----a-w C:\Documents and Settings\TSHABA\mqdmmdm.sys
2008-03-06 22:23 9,232 ----a-w C:\Documents and Settings\TSHABA\mqdmmdfl.sys
2008-03-06 22:23 79,328 ----a-w C:\Documents and Settings\TSHABA\mqdmserd.sys
2008-03-06 22:23 66,656 ----a-w C:\Documents and Settings\TSHABA\mqdmbus.sys
2008-03-06 22:23 6,208 ----a-w C:\Documents and Settings\TSHABA\mqdmcmnt.sys
2008-03-06 22:23 5,936 ----a-w C:\Documents and Settings\TSHABA\mqdmwhnt.sys
2008-03-06 22:23 4,048 ----a-w C:\Documents and Settings\TSHABA\mqdmcr.sys
2008-03-06 22:23 25,600 ----a-w C:\Documents and Settings\TSHABA\usbsermptxp.sys
2008-03-06 22:23 22,768 ----a-w C:\Documents and Settings\TSHABA\usbsermpt.sys
2004-04-23 14:00 13,824 ----a-w C:\Documents and Settings\KashiF\cnmss Canon PIXMA iP1000 (Local).exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 13:54 5674352]
"Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" [2007-08-30 17:43 4670704]
"EPSON Stylus CX7300 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICDL.EXE" [2007-02-15 00:00 179200]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-03-09 07:09 15360]
"Registry Cleaner Scheduler"="C:\Program Files\CleanMyPC\Registry Cleaner\RCHelper.exe" [2008-06-11 19:55 913664]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-02-28 18:07 1828136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsmqIntCert"="regsvr32" []
"AGRSMMSG"="AGRSMMSG.exe" [2003-04-18 11:20 88363 C:\WINDOWS\agrsmmsg.exe]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2003-04-07 00:19 155648]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2003-04-07 00:07 114688]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"00THotkey"="C:\WINDOWS\system32\00THotkey.exe" [2003-11-21 14:49 258048]
"000StTHK"="000StTHK.exe" [2001-06-23 20:28 24576 C:\WINDOWS\system32\000StTHK.exe]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 11:16 39792]
"Monitor"="C:\WINDOWS\PixArt\PAC207\Monitor.exe" [2006-11-03 11:01 319488]
"TPSMain"="TPSMain.exe" [2003-11-19 21:15 278528 C:\WINDOWS\system32\TPSMain.exe]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-05-27 10:50 413696]
"NeroFilterCheck"="C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe" [2008-04-28 17:14 570664]
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2006-11-24 01:06 487424]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-05-15 17:19 79224]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-06-28 13:05 185896]

C:\Documents and Settings\KashiF\Start Menu\Programs\Startup\
BJ Status Monitor Canon PIXMA iP1000.lnk - C:\Documents and Settings\KashiF\cnmss Canon PIXMA iP1000 (Local).exe [2008-04-15 16:03:04 13824]
Mozilla Firefox.lnk - C:\Program Files\Mozilla Firefox\firefox.exe [2007-10-16 18:38:23 307712]

C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\
RAMASST.lnk - C:\WINDOWS\system32\RAMASST.exe [2008-04-28 21:11:54 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.xvid"= xvid.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\WINDOWS\\system32\\mqsvc.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\Ares\\Ares.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5900:TCP"= 5900:TCP:TCafeVNC
"21:TCP"= 21:TCP:TCafeFTP

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-15 17:20]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-15 17:16]
R2 wwEngineSvc;Window Washer Engine;C:\Program Files\Webroot\Washer\WasherSvc.exe [2007-11-26 14:47]
S3 PAC207;Look 110;C:\WINDOWS\system32\DRIVERS\PFC027.SYS [2007-03-01 09:23]
S3 se46bus;Sony Ericsson Device 070 driver (WDM);C:\WINDOWS\system32\DRIVERS\se46bus.sys [2006-11-30 15:11]
S3 se46mdfl;Sony Ericsson Device 070 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\se46mdfl.sys [2006-11-30 15:11]
S3 se46mdm;Sony Ericsson Device 070 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\se46mdm.sys [2006-11-30 15:11]
S3 se46mgmt;Sony Ericsson Device 070 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\se46mgmt.sys [2006-11-30 15:11]
S3 se46nd5;Sony Ericsson Device 070 USB Ethernet Emulation SEMC46 (NDIS);C:\WINDOWS\system32\DRIVERS\se46nd5.sys [2006-11-30 15:11]
S3 se46obex;Sony Ericsson Device 070 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\se46obex.sys [2006-11-30 15:11]
S3 se46unic;Sony Ericsson Device 070 USB Ethernet Emulation SEMC46 (WDM);C:\WINDOWS\system32\DRIVERS\se46unic.sys [2006-11-30 15:11]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1865b236-31c1-11dd-9d9e-00080df6f1cf}]
\Shell\AutoRun\command - F:\90imhpnc.exe
\Shell\explore\Command - F:\90imhpnc.exe
\Shell\open\Command - F:\90imhpnc.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{24220133-1c63-11dd-9d7c-00080df6f1cf}]
\Shell\AutoRun\command - pa39xth.cmd
\Shell\explore\Command - pa39xth.cmd
\Shell\open\Command - pa39xth.cmd

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{24963818-003d-11dd-9d39-00080df6f1cf}]
\Shell\AutoRun\command - 8ng8w.com
\Shell\explore\Command - 8ng8w.com
\Shell\open\Command - 8ng8w.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2822d2b0-3b37-11dd-9097-00080df6f1cf}]
\Shell\AutoRun\command - F:\pkxfkrki.bat
\Shell\explore\Command - F:\pkxfkrki.bat
\Shell\open\Command - F:\pkxfkrki.bat

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2822d2b1-3b37-11dd-9097-00080df6f1cf}]
\Shell\AutoRun\command - G:\pkxfkrki.bat
\Shell\explore\Command - G:\pkxfkrki.bat
\Shell\open\Command - G:\pkxfkrki.bat

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2822d2b4-3b37-11dd-9097-00080df6f1cf}]
\Shell\AutoRun\command - F:\pkxfkrki.bat
\Shell\explore\Command - F:\pkxfkrki.bat
\Shell\open\Command - F:\pkxfkrki.bat

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2e92f358-364b-11dd-9da6-00080df6f1cf}]
\Shell\AutoRun\command - F:\n.com
\Shell\explore\Command - F:\n.com
\Shell\open\Command - F:\n.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{37028004-4627-11dd-90ae-00080df6f1cf}]
\Shell\AutoRun\command - ntdelect.com
\Shell\explore\Command - G:\utdetect.com
\Shell\open\Command - G:\utdetect.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{37228a17-0a4f-11dd-9d58-00080df6f1cf}]
\Shell\Auto\command - MSOCache\doWTP_RESTORE_0.exe -autorun
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL MSOCache\doWTP_RESTORE_0.exe -autorun

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{37228a18-0a4f-11dd-9d58-00080df6f1cf}]
\Shell\AutoRun\command - F:\n.com
\Shell\explore\Command - F:\n.com
\Shell\open\Command - F:\n.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{37228a1a-0a4f-11dd-9d58-00080df6f1cf}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL protector.exe
\Shell\infected\command - F:\protector.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{377bd1ca-f480-11dc-9d0d-00080df6f1cf}]
\Shell\AutoRun\command - G:\xpbkh.com
\Shell\explore\Command - G:\xpbkh.com
\Shell\open\Command - G:\xpbkh.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4298a687-46dd-11dd-90b0-00080df6f1cf}]
\Shell\Auto\command - H:\Cn911.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Cn911.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5969e77e-4631-11dd-90af-00080df6f1cf}]
\Shell\Auto\command - G:\fun.xls.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL fun.xls.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{59901b6b-2aaa-11dd-9d91-00080df6f1cf}]
\Shell\AutoRun\command - F:\pa39xth.cmd
\Shell\explore\Command - F:\pa39xth.cmd
\Shell\open\Command - F:\pa39xth.cmd

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6a1cd398-fdd6-11dc-9d31-00080df6f1cf}]
\Shell\AutoRun\command - F:\aub0wb8.cmd
\Shell\explore\Command - F:\aub0wb8.cmd
\Shell\open\Command - F:\aub0wb8.cmd

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{94ea64a0-2112-11dd-9d82-00080df6f1cf}]
\Shell\AutoRun\command - F:\g2p3s.exe
\Shell\explore\Command - F:\g2p3s.exe
\Shell\open\Command - F:\g2p3s.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bdbfdda4-3401-11dd-9da3-00080df6f1cf}]
\Shell\AutoRun\command - F:\lgrncie.bat
\Shell\explore\Command - F:\lgrncie.bat
\Shell\open\Command - F:\lgrncie.bat

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bdbfdda5-3401-11dd-9da3-00080df6f1cf}]
\Shell\AutoRun\command - G:\lgrncie.bat
\Shell\explore\Command - G:\lgrncie.bat
\Shell\open\Command - G:\lgrncie.bat

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c5ea3d48-3290-11dd-9da0-00080df6f1cf}]
\Shell\AutoRun\command - F:\lgrncie.bat
\Shell\explore\Command - F:\lgrncie.bat
\Shell\open\Command - F:\lgrncie.bat

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cce8b780-372c-11dd-9da7-00080df6f1cf}]
\Shell\AutoRun\command - F:\lgrncie.bat
\Shell\explore\Command - F:\lgrncie.bat
\Shell\open\Command - F:\lgrncie.bat

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d0cf3fd9-00dc-11dd-9d3b-00080df6f1cf}]
\Shell\AutoRun\command - xp19.com
\Shell\explore\Command - xp19.com
\Shell\open\Command - xp19.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d14d6976-43a7-11dd-90a9-00080df6f1cf}]
\Shell\AutoRun\command - F:\1aq1obb.bat
\Shell\explore\Command - F:\1aq1obb.bat
\Shell\open\Command - F:\1aq1obb.bat

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d6684349-3bd1-11dd-9098-00080df6f1cf}]
\Shell\AutoRun\command - F:\n.com
\Shell\explore\Command - F:\n.com
\Shell\open\Command - F:\n.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e204ad16-1f93-11dd-9d80-00080df6f1cf}]
\Shell\AutoRun\command - F:\tgtighg.cmd
\Shell\explore\Command - F:\tgtighg.cmd
\Shell\open\Command - F:\tgtighg.cmd

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e204ad17-1f93-11dd-9d80-00080df6f1cf}]
\Shell\AutoRun\command - F:\n.com
\Shell\explore\Command - F:\n.com
\Shell\open\Command - F:\n.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e7e0fcb3-0035-11dd-9d38-00080df6f1cf}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ea0a3da4-3d84-11dd-909a-00080df6f1cf}]
\Shell\AutoRun\command - G:\n.com
\Shell\explore\Command - G:\n.com
\Shell\open\Command - G:\n.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f6d079cb-2b50-11dd-9d92-00080df6f1cf}]
\Shell\AutoRun\command - H:\n.com
\Shell\explore\Command - H:\n.com
\Shell\open\Command - H:\n.com

*Newly Created Service* - CATCHME
.
Contents of the 'Scheduled Tasks' folder
"2008-06-28 19:19:30 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-30 21:18:36
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-06-30 21:23:10
ComboFix-quarantined-files.txt 2008-07-01 03:22:56

Pre-Run: 5,782,876,160 bytes free
Post-Run: 7,466,606,592 bytes free

362

[greyknight17]

I see that you are using file sharing programs and cracked copies of paid programs. I don't recommend using these programs since they may contribute to malware infections.

Any idea what these files are for?
C:\caRPETA
C:\1aq1obb.bat - do NOT double click on this file unless you know what it's for. Right click on it and choose Edit instead to view the contents.
C:\o6opnro.bat - do NOT double click on this file unless you know what it's for. Right click on it and choose Edit instead to view the contents.
C:\Presentación1.ppt
C:\FACTURA CATERING 26 DE MARZO.doc
C:\Email Translation.doc

Is that Kavo file still detected now? If it is, run the following:

Download and install SUPERAntiSpyware at http://www.superanti...ANTISPYWAREFREE

- Run SUPERAntiSpyware and click the Check for Updates button.
- Once the update has finished, click the Scan your Computer button.
- Click on Perform Complete Scan and then click Next.
- SUPERAntiSpyware will now scan your computer and when it’s finished it will list all the infections it has found.
- Make sure that they all have a check next to them, and then click Next.
- Click Finish and you will be taken back to the main interface.
- It could be possible that it will ask you to reboot your computer in order to delete some files.
- I'll need a log afterwards of what has been found.
- To get the log, click Preferences and then click the Statistics/Logs tab. Click the dated log and press View Log and a text file will appear.
- Please post the results of the SUPERAntiSpyware log file in your next reply.

[greyknight17]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.