help removing DLLs

[mmbc_voltron]

I was hit hard by winantivirus pro. I ran active scan and SmitfraudFix.exe and still can't get rid of the dlls. any ideas?

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 12:00:17 PM, on 7/6/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
Boot mode: Safe mode

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Owner\Desktop\Tools of the Trade\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_0.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {5ADF3862-9E2E-4ad3-86F7-4510E6550CD0} - C:\WINDOWS\System32\aoikrwmx.dll
O2 - BHO: (no name) - {7066E898-3923-40EC-8EAD-032B690D50CB} - (no file)
O2 - BHO: H - {70C872E5-69F5-456f-B809-484106881B7B} - q24m.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O2 - BHO: (no name) - {868865EC-0295-4C7D-B25D-9F65314145E9} - C:\WINDOWS\System32\iiffecd.dll
O2 - BHO: (no name) - {a0b40993-ef21-4de5-a8bb-594ec7fc8731} - C:\WINDOWS\system32\cewwav.dll (file missing)
O2 - BHO: (no name) - {CD5195F4-7CF0-4B81-A379-FAF892DC0A7F} - C:\WINDOWS\System32\awtst.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_0.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O4 - HKLM\..\Run: [LXCTCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCTtime.dll,[email protected]
O4 - HKLM\..\Run: [GPLv3] rundll32.exe "C:\WINDOWS\System32\dwcwtthc.dll",realset
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F94DAFEB-98BA-47BE-80B0-2176E49D4F47}: NameServer = 10.1.10.1
O20 - AppInit_DLLs:
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: awtst - C:\WINDOWS\System32\awtst.dll
O20 - Winlogon Notify: cewwav - cewwav.dll (file missing)
O20 - Winlogon Notify: iiffecd - C:\WINDOWS\SYSTEM32\iiffecd.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: DomainService - Unknown owner - C:\WINDOWS\System32\rubhhgmb.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: lxct_device - - C:\WINDOWS\System32\lxctcoms.exe

--
End of file - 4311 bytes





Incident Status Location

Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Owner\Cookies\[email protected][2].txt
Adware:Adware/IST Not disinfected C:\Documents and Settings\Owner\Desktop\spamblockerutility.exe[SBTVSetup.exe][SBTVHelper.dll]
Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Owner\Desktop\Tools of the Trade\SmitfraudFix\Process.exe
Virus:Trj/KillAV.FG Disinfected C:\Program Files\Alwil Software\Avast4\DATA\moved\[UPX].vir
Adware:Adware/WinAntivirus2006 Not disinfected C:\Program Files\Common Files\Companion Wizard\WapCHK.dll
Potentially unwanted tool:Application/DriveCleaner Not disinfected C:\Program Files\Common Files\WinAntiSpyware 2007\uwas7cw.exe
Virus:Generic Malware Disinfected C:\Program Files\poolsv\svhost.exe
Virus:W32/Tobecho.AB.worm Disinfected C:\Program Files\poolsv\wr-1-0000077.exe
Adware:Adware/IST Not disinfected C:\Program Files\SpamBlockerUtility\Bin\4.8.4.0\SBClientSinkPS.dll
Virus:Generic Malware Disinfected C:\Program Files\SpamBlockerUtility\Bin\4.8.4.0\SbCoreSrv.dll
Virus:Generic Malware Disinfected C:\Program Files\SpamBlockerUtility\Bin\4.8.4.0\SbHostOE.dll
Virus:Generic Malware Disinfected C:\Program Files\SpamBlockerUtility\Bin\4.8.4.0\SbHostOL.dll
Virus:Generic Malware Disinfected C:\Program Files\SpamBlockerUtility\Bin\4.8.4.0\SbInstIE.dll
Adware:Adware/IST Not disinfected C:\Program Files\SpamBlockerUtility\Bin\4.8.4.0\SBOLExp.dll
Adware:Adware/IST Not disinfected C:\Program Files\SpamBlockerUtility\Bin\4.8.4.0\SBOLExt.dll
Adware:Adware/IST Not disinfected C:\Program Files\SpamBlockerUtility\Bin\4.8.4.0\SBSrvPS.dll
Adware:Adware/IST Not disinfected C:\Program Files\SpamBlockerUtility\Bin\4.8.4.0\SbToolbar.dll
Adware:Adware/IST Not disinfected C:\Program Files\SpamBlockerUtility\Bin\4.8.4.0\SBTrayAppPS.dll
Adware:Adware/IST Not disinfected C:\Program Files\SpamBlockerUtility\Bin\4.8.4.0\SBUIRes.dll
Adware:Adware/IST Not disinfected C:\Program Files\SpamBlockerUtility\Bin\4.8.4.0\SBUISkin.dll
Virus:W32/Tobecho.AB.worm Disinfected C:\Program Files\svhost\wr-1-0000077.exe
Hacktool:Rootkit/Spyforms.H Not disinfected C:\WINDOWS\new_drv.sys
Adware:Adware/WinAntiSpyware Not disinfected C:\WINDOWS\poolsv.exe
Virus:Generic Malware Disinfected C:\WINDOWS\svhost.exe
Spyware:Spyware/Virtumonde Not disinfected C:\WINDOWS\system32\agugehbc.dll
Spyware:Spyware/Virtumonde Not disinfected C:\WINDOWS\system32\aoikrwmx.dll
Spyware:Spyware/Virtumonde Not disinfected C:\WINDOWS\system32\awtst.dll
Virus:Trj/Downloader.PCQ Disinfected C:\WINDOWS\system32\bhfpleif.exe
Spyware:Spyware/Virtumonde Not disinfected C:\WINDOWS\system32\bkyyomvu.dll
Adware:Adware/WinAntivirus2006 Not disinfected C:\WINDOWS\system32\cdxvdsts.dll
Spyware:Spyware/Virtumonde Not disinfected C:\WINDOWS\system32\dwcwtthc.dll
Virus:Trj/Downloader.OZB Disinfected C:\WINDOWS\system32\gmxcmppd.exe
Virus:Trj/Lowzones.TP Disinfected C:\WINDOWS\system32\igmgalho.exe
Spyware:Spyware/Virtumonde Not disinfected C:\WINDOWS\system32\ iiffecd.dll
Potentially unwanted tool:Application/Processor Not disinfected C:\WINDOWS\system32\Process.exe
Virus:Trj/Downloader.OZB Disinfected C:\WINDOWS\system32\rubhhgmb.exe
Spyware:Spyware/Virtumonde Not disinfected C:\WINDOWS\system32\sagxughx.dll
Virus:Trj/Downloader.OZB Disinfected C:\WINDOWS\system32\uhcmvfda.exe
Virus:Trj/Downloader.OZB Disinfected C:\WINDOWS\system32\vndtjooi.exe
Virus:Trj/Downloader.PCQ Disinfected C:\WINDOWS\system32\ydlbxufk.exe
Virus:Trj/Lowzones.TP Disinfected C:\WINDOWS\system32\yihvdvvw.exe
Virus:Trj/Lowzones.TP Disinfected C:\WINDOWS\system32\yvimepah.exe

 

[MFDnNC]

If you have vundofix, remove it and get the current version

Please download http://www.atribune.org/ccount/click.php?id=4 to C:\
Double-click VundoFix.exe to run it.
click the Scan for Vundo button.
Once it's done scanning, click the Remove Vundo button.
You will receive a prompt asking if you want to remove the files, click YES.
Once you click yes, your desktop will go blank as it starts removing Vundo.
When completed, it will prompt that it will shutdown your computer, click OK.
Turn your computer back on.
Please post the contents of C:\vundofix.txt
Note: It is possible that VundoFix encountered a file it could not remove. In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button" when VundoFix appears at reboot.

Please let Vundo finish its thing, sometimes it can take multiple passes
====================
Download Superantispyware (SAS)

http://www.superantispyware.com/superantispywarefreevspro.html

Install it and double-click the icon on your desktop to run it.
· It will ask if you want to update the program definitions, click Yes.
· Under Configuration and Preferences, click the Preferences button.
· Click the Scanning Control tab.
· Under Scanner Options make sure the following are checked:
o Close browsers before scanning
o Scan for tracking cookies
o Terminate memory threats before quarantining.
o Please leave the others unchecked.
o Click the Close button to leave the control center screen.
· On the main screen, under Scan for Harmful Software click Scan your computer.
· On the left check C:\Fixed Drive.
· On the right, under Complete Scan, choose Perform Complete Scan.
· Click Next to start the scan. Please be patient while it scans your computer.
· After the scan is complete a summary box will appear. Click OK.
· Make sure everything in the white box has a check next to it, then click Next.
· It will quarantine what it found and if it asks if you want to reboot, click Yes.
· To retrieve the removal information for me please do the following:
o After reboot, double-click the SUPERAntispyware icon on your desktop.
o Click Preferences. Click the Statistics/Logs tab.
o Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
o It will open in your default text editor (such as Notepad/Wordpad).
o Please highlight everything in the notepad, then right-click and choose copy.
· Click close and close again to exit the program.
· Please paste that information here for me with a new HijackThis log.

 

[mmbc_voltron]

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 07/06/2007 at 03:58 PM

Application Version : 3.9.1008

Core Rules Database Version : 3228
Trace Rules Database Version: 1239

Scan type : Complete Scan
Total Scan Time : 00:17:00

Memory items scanned : 285
Memory threats detected : 0
Registry items scanned : 4664
Registry threats detected : 134
File items scanned : 20338
File threats detected : 2162

Trojan.WinFixer
HKLM\Software\Classes\CLSID\{153E13B4-C939-4D7A-88E9-2EE1619B7829}
HKCR\CLSID\{153E13B4-C939-4D7A-88E9-2EE1619B7829}
HKCR\CLSID\{153E13B4-C939-4D7A-88E9-2EE1619B7829}\InprocServer32
HKCR\CLSID\{153E13B4-C939-4D7A-88E9-2EE1619B7829}\InprocServer32#ThreadingModel
C:\WINDOWS\SYSTEM32\AWTST.DLL
HKLM\Software\Classes\CLSID\{4EBD643D-C5C3-4F62-ABDE-39ADA5BE578C}
HKCR\CLSID\{4EBD643D-C5C3-4F62-ABDE-39ADA5BE578C}
HKCR\CLSID\{4EBD643D-C5C3-4F62-ABDE-39ADA5BE578C}\InprocServer32
HKCR\CLSID\{4EBD643D-C5C3-4F62-ABDE-39ADA5BE578C}\InprocServer32#ThreadingModel
C:\WINDOWS\SYSTEM32\VTSTT.DLL
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{153E13B4-C939-4D7A-88E9-2EE1619B7829}

Adware.HotBar/SpamBlockerUtility (Low Risk)
HKLM\Software\Classes\CLSID\{4B18DD50-C996-44fc-AC52-0FECFF82ED58}
HKCR\CLSID\{4B18DD50-C996-44FC-AC52-0FECFF82ED58}
HKCR\CLSID\{4B18DD50-C996-44FC-AC52-0FECFF82ED58}
HKCR\CLSID\{4B18DD50-C996-44FC-AC52-0FECFF82ED58}\Control
HKCR\CLSID\{4B18DD50-C996-44FC-AC52-0FECFF82ED58}\InprocServer32
HKCR\CLSID\{4B18DD50-C996-44FC-AC52-0FECFF82ED58}\InprocServer32#ThreadingModel
HKCR\CLSID\{4B18DD50-C996-44FC-AC52-0FECFF82ED58}\MiscStatus
HKCR\CLSID\{4B18DD50-C996-44FC-AC52-0FECFF82ED58}\MiscStatus\1
HKCR\CLSID\{4B18DD50-C996-44FC-AC52-0FECFF82ED58}\ProgID
HKCR\CLSID\{4B18DD50-C996-44FC-AC52-0FECFF82ED58}\Programmable
HKCR\CLSID\{4B18DD50-C996-44FC-AC52-0FECFF82ED58}\ToolboxBitmap32
HKCR\CLSID\{4B18DD50-C996-44FC-AC52-0FECFF82ED58}\Version
HKCR\CLSID\{4B18DD50-C996-44FC-AC52-0FECFF82ED58}\VersionIndependentProgID
C:\PROGRAM FILES\SPAMBLOCKERUTILITY\SBTV\SBTVHELPER.DLL
HKLM\Software\Classes\CLSID\{74CC49F7-EB32-4A08-B204-948962A6E3DB}
HKCR\CLSID\{74CC49F7-EB32-4A08-B204-948962A6E3DB}
HKCR\CLSID\{74CC49F7-EB32-4A08-B204-948962A6E3DB}
HKCR\CLSID\{74CC49F7-EB32-4A08-B204-948962A6E3DB}\InprocServer32
HKCR\CLSID\{74CC49F7-EB32-4A08-B204-948962A6E3DB}\InprocServer32#ThreadingModel
HKCR\CLSID\{74CC49F7-EB32-4A08-B204-948962A6E3DB}\ProgID
HKCR\CLSID\{74CC49F7-EB32-4A08-B204-948962A6E3DB}\Programmable
HKCR\CLSID\{74CC49F7-EB32-4A08-B204-948962A6E3DB}\TypeLib
HKCR\CLSID\{74CC49F7-EB32-4A08-B204-948962A6E3DB}\VersionIndependentProgID
C:\PROGRAM FILES\SPAMBLOCKERUTILITY\BIN\4.8.4.0\SBHOSTIE.DLL
HKLM\Software\Classes\CLSID\{7E66936C-FEA0-4984-AD26-7B6661AC5B2E}
HKCR\CLSID\{7E66936C-FEA0-4984-AD26-7B6661AC5B2E}
HKCR\CLSID\{7E66936C-FEA0-4984-AD26-7B6661AC5B2E}
HKCR\CLSID\{7E66936C-FEA0-4984-AD26-7B6661AC5B2E}\Control
HKCR\CLSID\{7E66936C-FEA0-4984-AD26-7B6661AC5B2E}\Implemented Categories
HKCR\CLSID\{7E66936C-FEA0-4984-AD26-7B6661AC5B2E}\Implemented Categories\{00021494-0000-0000-C000-000000000046}
HKCR\CLSID\{7E66936C-FEA0-4984-AD26-7B6661AC5B2E}\InprocServer32
HKCR\CLSID\{7E66936C-FEA0-4984-AD26-7B6661AC5B2E}\InprocServer32#ThreadingModel
HKCR\CLSID\{7E66936C-FEA0-4984-AD26-7B6661AC5B2E}\Instance
HKCR\CLSID\{7E66936C-FEA0-4984-AD26-7B6661AC5B2E}\Instance#CLSID
HKCR\CLSID\{7E66936C-FEA0-4984-AD26-7B6661AC5B2E}\Instance\InitPropertyBag
HKCR\CLSID\{7E66936C-FEA0-4984-AD26-7B6661AC5B2E}\Instance\InitPropertyBag#Url
HKCR\CLSID\{7E66936C-FEA0-4984-AD26-7B6661AC5B2E}\MiscStatus
HKCR\CLSID\{7E66936C-FEA0-4984-AD26-7B6661AC5B2E}\MiscStatus\1
HKCR\CLSID\{7E66936C-FEA0-4984-AD26-7B6661AC5B2E}\ProgID
HKCR\CLSID\{7E66936C-FEA0-4984-AD26-7B6661AC5B2E}\Programmable
HKCR\CLSID\{7E66936C-FEA0-4984-AD26-7B6661AC5B2E}\ToolboxBitmap32
HKCR\CLSID\{7E66936C-FEA0-4984-AD26-7B6661AC5B2E}\TypeLib
HKCR\CLSID\{7E66936C-FEA0-4984-AD26-7B6661AC5B2E}\Version
HKCR\CLSID\{7E66936C-FEA0-4984-AD26-7B6661AC5B2E}\VersionIndependentProgID
HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\{7E66936C-FEA0-4984-AD26-7B6661AC5B2E}
HKU\S-1-5-21-1547161642-842925246-839522115-1003\Software\Microsoft\Internet Explorer\Explorer Bars\{7E66936C-FEA0-4984-AD26-7B6661AC5B2E}
C:\Program Files\SpamBlockerUtility\Bin\4.8.4.0\3_Shot Gun.wav
C:\Program Files\SpamBlockerUtility\Bin\4.8.4.0\ASAPCom.dll
C:\Program Files\SpamBlockerUtility\Bin\4.8.4.0\Cml.exe
C:\Program Files\SpamBlockerUtility\Bin\4.8.4.0\dBenderC.dll
C:\Program Files\SpamBlockerUtility\Bin\4.8.4.0\Redemption.dll
C:\Program Files\SpamBlockerUtility\Bin\4.8.4.0\SBClientSinkPS.dll
C:\Program Files\SpamBlockerUtility\Bin\4.8.4.0\SbGuard.exe
C:\Program Files\SpamBlockerUtility\Bin\4.8.4.0\SbOEAddOn.exe
C:\Program Files\SpamBlockerUtility\Bin\4.8.4.0\SBOLExp.dll
C:\Program Files\SpamBlockerUtility\Bin\4.8.4.0\SBOLExt.dll
C:\Program Files\SpamBlockerUtility\Bin\4.8.4.0\SbSrv.exe
C:\Program Files\SpamBlockerUtility\Bin\4.8.4.0\SBSrvPS.dll
C:\Program Files\SpamBlockerUtility\Bin\4.8.4.0\SbToolbar.dll
C:\Program Files\SpamBlockerUtility\Bin\4.8.4.0\SBTrayAppPS.dll
C:\Program Files\SpamBlockerUtility\Bin\4.8.4.0\SBUIRes.dll
C:\Program Files\SpamBlockerUtility\Bin\4.8.4.0\SBUISkin.dll
C:\Program Files\SpamBlockerUtility\Bin\4.8.4.0\SbWallpaper.dll
C:\Program Files\SpamBlockerUtility\Bin\4.8.4.0\SbWeatherOnTray.exe
C:\Program Files\SpamBlockerUtility\Bin\4.8.4.0
C:\Program Files\SpamBlockerUtility\Bin\SbUninst.exe
C:\Program Files\SpamBlockerUtility\Bin
C:\Program Files\SpamBlockerUtility\SBTV\SBTV.exe
C:\Program Files\SpamBlockerUtility\SBTV\sbtvau.dat
C:\Program Files\SpamBlockerUtility\SBTV\sbtv_gdf.dat
C:\Program Files\SpamBlockerUtility\SBTV\sbtv_kyf.dat
C:\Program Files\SpamBlockerUtility\SBTV\uninstaller.exe
C:\Program Files\SpamBlockerUtility\SBTV
C:\Program Files\SpamBlockerUtility
C:\Documents and Settings\Owner\Application Data\SpamBlocker
C:\Documents and Settings\Owner\Application Data\SpamBlockerUtility\eskin\empty_bg_st.htm
C:\Documents and Settings\Owner\Application Data\SpamBlockerUtility\eskin\FileManager.txt
C:\Documents and Settings\Owner\Application Data\SpamBlockerUtility\eskin
C:\Documents and Settings\Owner\Application Data\SpamBlockerUtility\IESkins
C:\Documents and Settings\Owner\Application Data\SpamBlockerUtility\SpamBlockerUtility.log
C:\Documents and Settings\Owner\Application Data\SpamBlockerUtility\SpamBlockerUtility_1172962312.log
C:\Documents and Settings\Owner\Application Data\SpamBlockerUtility\SpamBlockerUtility_1174249477.log
C:\Documents and Settings\Owner\Application Data\SpamBlockerUtility\SpamBlockerUtility_1176267184.log
C:\Documents and Settings\Owner\Application Data\SpamBlockerUtility\v3.0\HostOI\dynamic
C:\Documents and Settings\Owner\Application Data\SpamBlockerUtility\v3.0\HostOI\static
C:\Documents and Settings\Owner\Application Data\SpamBlockerUtility\v3.0\HostOI
C:\Documents and Settings\Owner\Application Data\SpamBlockerUtility\v3.0\HostOL\dynamic
C:\Documents and Settings\Owner\Application Data\SpamBlockerUtility\v3.0\HostOL\static
C:\Documents and Settings\Owner\Application Data\SpamBlockerUtility\v3.0\HostOL
C:\Documents and Settings\Owner\Application Data\SpamBlockerUtility\v3.0\SpamBlockerUtility\dynamic\1.sdf
C:\Documents and Settings\Owner\Application Data\SpamBlockerUtility\v3.0\SpamBlockerUtility\dynamic\1006428.sdf
C:\Documents and Settings\Owner\Application Data\SpamBlockerUtility\v3.0\SpamBlockerUtility\dynamic\1007113.sdf
C:\Documents and Settings\Owner\Application Data\SpamBlockerUtility\v3.0\SpamBlockerUtility\dynamic\1009003.sdf
C:\Documents and Settings\Owner\Application Data\SpamBlockerUtility\v3.0\SpamBlockerUtility\dynamic\1012167.sdf
C:\Documents and Settings\Owner\Application Data\SpamBlockerUtility\v3.0\SpamBlockerUtility\dynamic\1012458.sdf
C:\Documents and Settings\Owner\Application Data\SpamBlockerUtility\v3.0\SpamBlockerUtility\dynamic\1016578.sdf
C:\Documents and Settings\Owner\Application Data\SpamBlockerUtility\v3.0\SpamBlockerUtility\dynamic\1019216.sdf
C:\Documents and Settings\Owner\Application Data\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad\top7.xip
C:\Documents and Settings\Owner\Application Data\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad\tsd_bg.xip
C:\Documents and Settings\Owner\Application Data\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad
C:\Documents and Settings\Owner\Application Data\SpamBlockerUtility\v3.0\SpamBlockerUtility\static
C:\Documents and Settings\Owner\Application Data\SpamBlockerUtility\v3.0\SpamBlockerUtility
C:\Documents and Settings\Owner\Application Data\SpamBlockerUtility\v3.0
C:\Documents and Settings\Owner\Application Data\SpamBlockerUtility
HKCR\SpamBlockerConfig.Application
HKCR\SpamBlockerConfig.Application\Clsid
HKCR\SpamBlockerConfig.Application.1
HKCR\SpamBlockerConfig.Application.1\Clsid
HKCR\SpamBlockerUtility.CommBand
HKCR\SpamBlockerUtility.CommBand\CLSID
HKCR\SpamBlockerUtility.CommBand\CurVer
HKCR\SpamBlockerUtility.CommBand.1
HKCR\SpamBlockerUtility.CommBand.1\CLSID
HKCR\SpamBlockerUtility.SbMain
HKCR\SpamBlockerUtility.SbMain\CLSID
HKCR\SpamBlockerUtility.SbMain\CurVer
HKCR\SpamBlockerUtility.SbMain.1
HKCR\SpamBlockerUtility.SbMain.1\CLSID
HKU\S-1-5-21-1547161642-842925246-839522115-1003\Software\SpamBlockerUtility
HKLM\Software\SpamBlockerUtility
HKLM\Software\SpamBlockerUtility\Install
HKLM\Software\SpamBlockerUtility\Install#IE
HKLM\Software\SpamBlockerUtility\Install#OL
HKLM\Software\SpamBlockerUtility\Install#WT
HKLM\Software\SpamBlockerUtility\Install#WP
HKLM\Software\SpamBlockerUtility\Install#Install_Dir
HKLM\Software\SpamBlockerUtility\Install#Installed_From
HKLM\Software\SpamBlockerUtility\Install\CmpMap
HKLM\Software\SpamBlockerUtility\Install\CmpMap#IE
HKLM\Software\SpamBlockerUtility\Install\CmpMap#OL
HKLM\Software\SpamBlockerUtility\Install\CmpMap#WT
HKLM\Software\SpamBlockerUtility\Install\CmpMap#WP
HKLM\Software\SpamBlockerUtility\SpamBlockerUtility
HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\Install
HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\Install#SearchAssistant
HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\Install#Use Custom Search URL
HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\Install#StartInstall
HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\Install#instcklm/instdata/affid
HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\Install#instcklm/instdata/bannerid
HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\Install#instcklm/instdata/directInstall
HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\Install#instcklm/instdata/iid
HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\Install#instcklm/instdata/instPartner
HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\Install#instcklm/instdata/requestor
HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\Install#instcklm/instdata/sp2user
HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\Install#IID
HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\Install#bannerid
HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\Install#reqid
HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\Install#affid
HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\Install#cookies_flag
HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\Install#IID_prv
HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\Install#HbHostOEPath
HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\Install#PrevVer
HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\Install#CurrentVer
HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\Install#FreeWeather
HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\Install#CreateDate
HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\Install#CreateDateDW
HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\MachineInfo
HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\MachineInfo#CID
HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\MachineInfo#CID_prv
HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\Mail
HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\Mail#business_card_promo
HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\Mail#promo_file
HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\PI
HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\PI\3.2
HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\PI\3.2#PID00
HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\Updates
HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\Updates#InstallDate
HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\Upgrade
HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\Upgrade#LastChecked
HKLM\Software\Spam Blocker
HKLM\Software\Spam Blocker#BuyNow
HKLM\Software\Spam Blocker#State
HKLM\Software\Spam Blocker#First start
HKLM\Software\Spam Blocker\ASAP
HKLM\Software\Spam Blocker\ASAP#ServerAddress
HKLM\Software\Spam Blocker\ASAP#Hash
HKLM\Software\Spam Blocker\ASAP#URI
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpamBlockerOutlookTools
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpamBlockerOutlookTools#DisplayName
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpamBlockerOutlookTools#DisplayIcon
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpamBlockerOutlookTools#UninstallString
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpamBlockerWebTools
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpamBlockerWebTools#DisplayName
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpamBlockerWebTools#DisplayIcon
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpamBlockerWebTools#UninstallString
C:\SYSTEM VOLUME INFORMATION\_RESTORE{40225FC9-18D9-42E5-B254-59F20619172C}\RP2\A0001307.DLL
C:\WINDOWS\Prefetch\SBTV.EXE-0F0EE786.pf

Adware.Tracking Cookie
C:\Documents and Settings\Owner\Cookies\[email protected][2].txt
C:\Documents and Settings\Owner\Cookies\[email protected][2].txt
C:\Documents and Settings\Owner\Cookies\[email protected][1].txt
C:\Documents and Settings\Owner\Cookies\[email protected][1].txt
C:\Documents and Settings\Owner\Cookies\[email protected][2].txt
C:\Documents and Settings\Owner\Cookies\[email protected][1].txt
C:\Documents and Settings\Owner\Cookies\[email protected][2].txt
C:\Documents and Settings\Owner\Cookies\[email protected][2].txt
C:\Documents and Settings\Administrator\Cookies\[email protected][1].txt

Trojan.WinAntiSpyware/WinAntiVirus 2006
C:\SYSTEM VOLUME INFORMATION\_RESTORE{40225FC9-18D9-42E5-B254-59F20619172C}\RP2\A0001132.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{40225FC9-18D9-42E5-B254-59F20619172C}\RP2\A0001142.EXE

Trojan.WinAntiSpyware/WinAntiVirus 2006/2007
C:\SYSTEM VOLUME INFORMATION\_RESTORE{40225FC9-18D9-42E5-B254-59F20619172C}\RP2\A0001141.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{40225FC9-18D9-42E5-B254-59F20619172C}\RP2\A0001151.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{40225FC9-18D9-42E5-B254-59F20619172C}\RP2\A0001180.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{40225FC9-18D9-42E5-B254-59F20619172C}\RP2\A0001181.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{40225FC9-18D9-42E5-B254-59F20619172C}\RP2\A0001189.EXE

Trojan.Downloader-DriverA
C:\SYSTEM VOLUME INFORMATION\_RESTORE{40225FC9-18D9-42E5-B254-59F20619172C}\RP2\A0001196.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{40225FC9-18D9-42E5-B254-59F20619172C}\RP2\A0001197.EXE

Trojan.Downloader-SpyTool
C:\SYSTEM VOLUME INFORMATION\_RESTORE{40225FC9-18D9-42E5-B254-59F20619172C}\RP2\A0001198.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{40225FC9-18D9-42E5-B254-59F20619172C}\RP2\A0001199.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{40225FC9-18D9-42E5-B254-59F20619172C}\RP2\A0001200.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{40225FC9-18D9-42E5-B254-59F20619172C}\RP3\A0001469.DLL
C:\VUNDOFIX BACKUPS\CDXVDSTS.DLL.BAD

Trace.Known Threat Sources
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\2DQHGTM9\styles[1].css
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\6BCVC5MF\WinAntiVirusPro2007FreeInstall[1].exe

 

[mmbc_voltron]

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 4:17:24 PM, on 7/6/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\lxctcoms.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Documents and Settings\Owner\Desktop\Tools of the Trade\HiJackThis_v2.exe

O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_0.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {7066E898-3923-40EC-8EAD-032B690D50CB} - (no file)
O2 - BHO: H - {70C872E5-69F5-456f-B809-484106881B7B} - q24m.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O2 - BHO: (no name) - {a0b40993-ef21-4de5-a8bb-594ec7fc8731} - C:\WINDOWS\system32\cewwav.dll (file missing)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_0.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O4 - HKLM\..\Run: [LXCTCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCTtime.dll,[email protected]
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F94DAFEB-98BA-47BE-80B0-2176E49D4F47}: NameServer = 10.1.10.1
O20 - AppInit_DLLs:
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: cewwav - cewwav.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: DomainService - Unknown owner - C:\WINDOWS\System32\rubhhgmb.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: lxct_device - - C:\WINDOWS\System32\lxctcoms.exe

--
End of file - 4420 bytes

 

[MFDnNC]

You may want to print this or save it to notepad as we will go to safe mode.

Fix these with HiJackThis – mark them, close IE, click fix checked

O2 - BHO: (no name) - {7066E898-3923-40EC-8EAD-032B690D50CB} - (no file)

O2 - BHO: H - {70C872E5-69F5-456f-B809-484106881B7B} - q24m.dll (file missing)

O2 - BHO: (no name) - {a0b40993-ef21-4de5-a8bb-594ec7fc8731} - C:\WINDOWS\system32\cewwav.dll (file missing)

O20 - AppInit_DLLs:

O20 - Winlogon Notify: cewwav - cewwav.dll (file missing)

O23 - Service: DomainService - Unknown owner - C:\WINDOWS\System32\rubhhgmb.exe (file missing)
==============
Click Start > Run > and type in:

services.msc

Click OK.

In the services window find this exact name

DomainService

Rightclick and choose "Properties". Beside "Startup Type" in the dropdown menu select "Disabled". On the "General" tab under "Service Status" click the "Stop" button to stop the service. Click Apply then OK. File-Exit the Services utility.

=========
DownLoad Killbox from one of these links

http://www.downloads.subratam.org/KillBox.zip or
http://www.thespykiller.co.uk/files/killbox.exe

Restart your computer into safe mode now. (Tapping F8 at the first black screen) Perform the following steps in safe mode:

Double-click on Killbox.exe to run it. Now put a tick by Standard File Kill. In the "Full Path of File to Delete" box, copy and paste each of the following lines one at a time then click on the button that has the red circle with the X in the middle after you enter each file. It will ask for confimation to delete the file. Click Yes. Continue with that same procedure until you have copied and pasted all of these in the "Paste Full Path of File to Delete" box.



Note: It is possible that Killbox will tell you that one or more files do not exist. If that happens, just continue on with all the files. Be sure you don't miss any.

START – RUN – type in %temp% - OK - Edit – Select all – File – Delete

Delete everything in the C:\Windows\Temp folder or C:\WINNT\temp

Not all temp files will delete and that is normal
Empty the recycle bin
Boot

Click on http://noahdfear.geekstogo.com/FindAWF.exe to download FindAWF.exe and save it to your desktop.
· Double-click on the FindAWF.exe file to run it.
· It will open a command prompt and ask you to "Press any key to continue".
· Press any key and the FindAWF tool will begin scanning your computer for the infected AWF files and the backups the trojan created.
· It may take a few minutes to complete so be patient.
· When it is complete, it will open a text file in notepad called AWF.txt which will automatically be saved to your desktop or whatever location you ran the file from.
· Come back here to this thread and copy and paste the contents of the AWF.txt file in your next reply.


Please give feedback on what worked/didn’t work and the current status of your system

 

[mmbc_voltron]

What file do I delete with Killbox?

 

[MFDnNC]

None, I meant to delete that portion

Click on http://noahdfear.geekstogo.com/FindAWF.exe to download FindAWF.exe and save it to your desktop.
· Double-click on the FindAWF.exe file to run it.
· It will open a command prompt and ask you to "Press any key to continue".
· Press any key and the FindAWF tool will begin scanning your computer for the infected AWF files and the backups the trojan created.
· It may take a few minutes to complete so be patient.
· When it is complete, it will open a text file in notepad called AWF.txt which will automatically be saved to your desktop or whatever location you ran the file from.
· Come back here to this thread and copy and paste the contents of the AWF.txt file in your next reply.

 

[mmbc_voltron]

This is option 1

Find AWF report by noahdfear ©2006


bak folders found
~~~~~~~~~~~


Directory of C:\PROGRA~1\ITUNES\BAK

02/23/2006 03:45 PM 278,528 iTunesHelper.exe
1 File(s) 278,528 bytes

Directory of C:\PROGRA~1\MESSEN~1\BAK

0 File(s) 0 bytes

Directory of C:\PROGRA~1\QUICKT~1\BAK

08/25/2006 08:58 PM 155,648 qttask.exe
1 File(s) 155,648 bytes

Directory of C:\WINDOWS\SYSTEM32\BAK

07/16/2003 01:26 PM 13,312 ctfmon.exe
04/07/2003 12:07 AM 114,688 hkcmd.exe
04/07/2003 12:19 AM 155,648 igfxtray.exe
07/09/2001 11:50 AM 155,648 NeroCheck.exe
4 File(s) 439,296 bytes

Directory of C:\PROGRA~1\ALWILS~1\AVAST4\BAK

05/31/2006 03:02 AM 108,160 ashDisp.exe
1 File(s) 108,160 bytes

Directory of C:\PROGRA~1\ANALOG~1\CORE\BAK

10/14/2004 02:42 PM 1,404,928 smax4pnp.exe
1 File(s) 1,404,928 bytes

Directory of C:\PROGRA~1\GRISOFT\AVGANT~1.5\BAK

10/07/2006 05:20 AM 6,266,880 avgas.exe
1 File(s) 6,266,880 bytes

Directory of C:\PROGRA~1\JAVA\JRE15~1.0_0\BIN\BAK

07/26/2006 04:03 AM 49,263 jusched.exe
1 File(s) 49,263 bytes


Duplicate files of bak directory contents
~~~~~~~~~~~~~~~~~~~~~~~

257088 Apr 27 2007 "C:\Program Files\iTunes\iTunesHelper.exe"
278528 Feb 23 2006 "C:\Program Files\iTunes\bak\iTunesHelper.exe"
102400 May 7 2007 "C:\WINDOWS\Installer\{3592F5CB-B524-43AA-92F2-2377268199CC}\iTunesIco.exe"
116288 Apr 27 2007 "C:\Documents and Settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 7.1.1.5\iTunesSetupAdmin.exe"
282624 Apr 27 2007 "C:\Program Files\QuickTime\qttask.exe"
155648 Aug 25 2006 "C:\Program Files\QuickTime\bak\qttask.exe"
13312 Jul 16 2003 "C:\WINDOWS\system32\ctfmon.exe"
13312 Jul 16 2003 "C:\WINDOWS\system32\bak\ctfmon.exe"
114688 Apr 7 2003 "C:\WINDOWS\system32\bak\hkcmd.exe"
114688 Apr 7 2003 "C:\DELL\drivers\video\Graphics\Win2000\hkcmd.exe"
114688 Apr 7 2003 "C:\WINDOWS\system32\ReinstallBackups\0000\DriverFiles\hkcmd.exe"
155648 Apr 7 2003 "C:\WINDOWS\system32\bak\igfxtray.exe"
155648 Apr 7 2003 "C:\DELL\drivers\video\Graphics\Win2000\igfxtray.exe"
155648 Apr 7 2003 "C:\WINDOWS\system32\ReinstallBackups\0000\DriverFiles\igfxtray.exe"
155648 Jul 9 2001 "C:\WINDOWS\system32\bak\NeroCheck.exe"
108160 Jan 15 2007 "C:\Program Files\Alwil Software\Avast4\ashDisp.exe"
108160 May 31 2006 "C:\Program Files\Alwil Software\Avast4\bak\ashDisp.exe"
1404928 Oct 14 2004 "C:\Program Files\Analog Devices\Core\bak\smax4pnp.exe"
1404928 Oct 14 2004 "C:\DELL\drivers\sound\SMAXWDM\W2K_XP\SMax4PNP.exe"
6266880 Oct 7 2006 "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe"
6266880 Oct 7 2006 "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\bak\avgas.exe"
49263 Jul 26 2006 "C:\Program Files\Java\jre1.5.0_08\bin\bak\jusched.exe"


end of report

 

[MFDnNC]

How are things now?

 

[mmbc_voltron]

they are much better.
I had to remove winantivirus from the add and remove programs

thanks for your help

 

[MFDnNC]

Clean

If you feel its is fixed mark it solved via Thread Tools above

Turn off restore points, boot, turn them back on – here’s how

http://service1.symantec.com/SUPPOR...2001111912274039?OpenDocument&src=sec_doc_nam

This clears infected restore points and sets a new, clean one.