The startup path for the C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBHP.EXE program causes the E_S88.tmp file to be created in the "C:\WINDOWS\TEMP" folder.. Verify those are the correct locations for the files. All links on the net point to it being an Epson file as well.
On the other hand, regarding the TIBS-PP Trojan, you might want to take a look at the link below which links the "kernels88.exe " file to the TIBS-PP Trojan.. I find it strange that Pacs Portal links the file to the TIBS-PP Trojan ONLY IF you use the "Search" tool at the site. I find no "Startup Item" listed as "E_S88".., and even then, if you check the link below, Sophos doesn't provide any data that connects the trojan to the E_S88 file.. If you don't use the "Search" tool at the Pacs Portal site, I don't find any reference to that file..
http://www.sophos.com/security/analyses/viruses-and-spyware/trojtibspp.html
Since, you've run scans with multiple tools and found nothing, it appears like it's part of the Epson program.
Hope this helps.
Grif
During my semi-annual check of noobie's computer I found E_S88 in the msconfig startup section of her computer.
SYSinfo.org shows possible TIBS-PP Trojan. First ran Malwarebytes and Super antispyware these programs were clean of this Trojan.
Ran HJT and found E_S88 listed along with E_FATBIA.Exe in the line extension.E_FATBIA.Exe in SYSinfo.org indicates this is a monitoring system for a Epson Stylus cx6000 printer. She has all of this equipment from Epson. She installed this printer using the software from Epson.
As she monitors her printer I did not remove E_S88 from startup at this time. I am still somewhat unsure about E_S88 and it's Trojan affiliate.
Although I found other problems with Trojan Agent and BHO's and tracking cookies etc this is the only one I did not fix.
Would someone please advise me further on this.
Ray
Chowhound
Comic Vine
GameFAQs
GameSpot
Giant Bomb
TechRepublic