1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Lost admin rights

Discussion in 'Malware and Virus Removal Archive' started by covian, 2008/04/13.

Page 1 of 2
  1. 2008/04/13
    covian

    covian Inactive Thread Starter

    Joined:
    2008/03/30
    Messages:
    22
    Likes Received:
    0
    I have lost control of my computer. All my administrative rights are gone. I cant open task manager, control panel, and other things. It says something about the restrictions on my computer and I need to check with my administrator. I also get alot of pop ups and the computer is running very slow.


    I ran HijackThis and this is what it gave:


    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 7:20:28 PM, on 4/13/2008
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\eAcceleration\Firewall\FWService.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\WINDOWS\winself.exe
    C:\Program Files\Softex\OmniPass\Omniserv.exe
    C:\Program Files\Spyware Doctor\sdhelp.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\wdfmgr.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\wanmpsvc.exe
    C:\Program Files\Softex\OmniPass\OPXPApp.exe
    C:\WINDOWS\System32\ctfmon.exe
    C:\Documents and Settings\All Users\Application Data\dktofqxe\rqzmxsnc.exe
    C:\windows\system\hpsysdrv.exe
    C:\WINDOWS\System32\hkcmd.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
    C:\WINDOWS\System32\hphmon05.exe
    C:\HP\KBD\KBD.EXE
    C:\Program Files\Multimedia Card Reader\shwicon2k.exe
    C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
    C:\Program Files\eAcceleration\Station\station.exe
    C:\Program Files\Acceleration Software\Anti-Virus\stopsignav.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
    C:\WINDOWS\System32\hphmon06.exe
    C:\WINDOWS\ALCXMNTR.EXE
    C:\WINDOWS\System32\igfxtray.exe
    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
    C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\eAcceleration\OnAccess\onaccess.exe
    C:\WINDOWS\System32\regsvr32.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\AIM6\aim6.exe
    C:\WINDOWS\?icrosoft\?ttrib.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\WINDOWS\System32\regscan.exe
    C:\Program Files\AIM6\aolsoftware.exe
    C:\DOCUME~1\Owner\LOCALS~1\Temp\!update.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\PROGRA~1\CROSOF~1\dexplore.exe
    C:\DOCUME~1\Owner\LOCALS~1\Temp\ie.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\QdrModule\QdrModule15.exe
    C:\Program Files\QdrPack\QdrPack15.exe
    C:\WINDOWS\system32\ngtkvwxm.exe
    C:\Program Files\America Online 8.0\aoltray.exe
    C:\Program Files\AOL Companion\companion.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqgalry.exe
    C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe
    C:\WINDOWS\PCHealth\HelpCtr\Binaries\helpctr.exe
    C:\Program Files\Bat\X_Bat.exe
    C:\Program Files\Greetings Workshop\GWREMIND.EXE
    C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
    C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
    C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpSvc.exe
    C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpHost.exe
    C:\Program Files\Java\jre1.6.0_03\bin\jucheck.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    C:\WINDOWS\System32\wbem\wmiprvse.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us9.hpwis.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us9.hpwis.com/
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
    R3 - Default URLSearchHook is missing
    F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\Userinit.exe
    O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\HPDTLK02.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: Zango - {07AA283A-43D7-4CBE-A064-32A21112D94D} - C:\Program Files\Zango\bin\10.0.370.0\HostIE.dll (file missing)
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
    O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe
    O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
    O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
    O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
    O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [AutoTKit] C:\hp\bin\AUTOTKIT.EXE
    O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
    O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe
    O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe "
    O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
    O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
    O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\McAfee.com\Agent\McUpdate.exe
    O4 - HKLM\..\Run: [MCAgentExe] C:\PROGRA~1\McAfee.com\Agent\McAgent.exe
    O4 - HKLM\..\Run: [SoftwareStation] "C:\Program Files\eAcceleration\Station\station.exe" /b Startup
    O4 - HKLM\..\Run: [StopSignSsTsMon] Rundll32.exe "C:\Program Files\Acceleration Software\Anti-Virus\sstsmon.dll ",VerifyStatus
    O4 - HKLM\..\Run: [webscan] "C:\Program Files\Acceleration Software\Anti-Virus\stopsignav.exe" -k
    O4 - HKLM\..\Run: [StopSignSsFwMon] Rundll32.exe "C:\Program Files\eAcceleration\Firewall\ssfwmon.dll ",VerifyStatus
    O4 - HKLM\..\Run: [HPHUPD06] C:\Program Files\Hewlett-Packard\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
    O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe "
    O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe "
    O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\System32\hphmon06.exe
    O4 - HKLM\..\Run: [StopSignSsSsMon] Rundll32.exe "C:\Program Files\Acceleration Software\Anti-Virus\ssssmon.dll ",VerifyStatus
    O4 - HKLM\..\Run: [runner1] C:\WINDOWS\retadpu572.exe 61A847B5BBF728173599284503996897C881250221C8670836AC4FA7C8833201749139
    O4 - HKLM\..\Run: [avp] C:\WINDOWS\avp.exe
    O4 - HKLM\..\Run: [smgr] mgrs.exe
    O4 - HKLM\..\Run: [WinAVX] "c:\documents and settings\all users\_qbothome\_qbotinj.exe" "c:\documents and settings\all users\_qbothome\_qbot.dll" /c c:\windows\system32\winavxx.exe
    O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe "
    O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe "
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe "
    O4 - HKLM\..\Run: [ZangoOE] C:\Program Files\Zango\bin\10.0.370.0\OEAddOn.exe
    O4 - HKLM\..\Run: [ZangoSA] "C:\Program Files\Zango\bin\10.0.370.0\ZangoSA.exe "
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
    O4 - HKLM\..\Run: [XP Advanced Keylogger] C:\Program Files\XP Advanced Keylogger\ToolKeylogger.exe
    O4 - HKLM\..\Run: [OnAccess] "C:\Program Files\eAcceleration\OnAccess\onaccess.exe" -erk
    O4 - HKLM\..\Run: [ctfmon] "c:\documents and settings\all users\_qbothome\_qbotinj.exe" "c:\documents and settings\all users\_qbothome\_qbot.dll "
    O4 - HKLM\..\Run: [ahadypex] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\ahadypex.dll "
    O4 - HKLM\..\Run: [webHancer Agent] C:\Program Files\webHancer\Programs\whagent.exe
    O4 - HKLM\..\Run: [78d2b5e2] rundll32.exe "C:\WINDOWS\System32\mmaxsbuh.dll ",b
    O4 - HKLM\..\Run: [BM7be1867e] Rundll32.exe "C:\WINDOWS\System32\uslohbhj.dll ",s
    O4 - HKLM\..\RunOnce: [StopSignSsTsMon] Rundll32.exe "C:\Program Files\Acceleration Software\Anti-Virus\sstsmon.dll ",VerifyStatus /ro
    O4 - HKLM\..\RunOnce: [StopSignSsFwMon] Rundll32.exe "C:\Program Files\eAcceleration\Firewall\ssfwmon.dll ",VerifyStatus /ro
    O4 - HKLM\..\RunOnce: [StopSignSsSsMon] Rundll32.exe "C:\Program Files\Acceleration Software\Anti-Virus\ssssmon.dll ",VerifyStatus /ro
    O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\Hewlett-Packard\Digital Imaging\bin\backupnotify.exe
    O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
    O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
    O4 - HKCU\..\Run: [Jfw] C:\WINDOWS\?icrosoft\?ttrib.exe
    O4 - HKCU\..\Run: [autoload] C:\WINDOWS\System32\drivers\svchost.exe
    O4 - HKCU\..\Run: [autorun] C:\Documents and Settings\Owner\svchost.exe
    O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
    O4 - HKCU\..\Run: [ITCHCURB] C:\DOCUME~1\Owner\APPLIC~1\INSIDE~1\Bat okay.exe
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [WinAVX] C:\WINDOWS\System32\WinAvXX.exe
    O4 - HKCU\..\Run: [Regscan] C:\WINDOWS\System32\regscan.exe
    O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
    O4 - HKCU\..\Run: [Notn] "C:\PROGRA~1\CROSOF~1\dexplore.exe" -vt yazb
    O4 - HKCU\..\Run: [Microsoft Windows Installer] C:\DOCUME~1\Owner\LOCALS~1\Temp\ie.exe
    O4 - HKCU\..\Run: [QdrModule15] "C:\Program Files\QdrModule\QdrModule15.exe "
    O4 - HKCU\..\Run: [QdrPack15] "C:\Program Files\QdrPack\QdrPack15.exe "
    O4 - HKCU\..\Run: [herrxkta] C:\WINDOWS\system32\ngtkvwxm.exe
    O4 - HKLM\..\Policies\Explorer\Run: [oDimT1O74b] C:\Documents and Settings\All Users\Application Data\dktofqxe\rqzmxsnc.exe
    O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
    O4 - S-1-5-18 Startup: AutoTBar.exe (User 'SYSTEM')
    O4 - S-1-5-18 Startup: HP Organize.lnk = ? (User 'SYSTEM')
    O4 - S-1-5-18 Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'SYSTEM')
    O4 - S-1-5-18 Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE (User 'SYSTEM')
    O4 - S-1-5-18 Startup: spamsubtract.lnk = C:\Program Files\interMute\SpamSubtract\SpamSubtract.exe (User 'SYSTEM')
    O4 - .DEFAULT Startup: AutoTBar.exe (User 'Default user')
    O4 - .DEFAULT Startup: HP Organize.lnk = ? (User 'Default user')
    O4 - .DEFAULT Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'Default user')
    O4 - .DEFAULT Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE (User 'Default user')
    O4 - .DEFAULT Startup: spamsubtract.lnk = C:\Program Files\interMute\SpamSubtract\SpamSubtract.exe (User 'Default user')
    O4 - .DEFAULT User Startup: AutoTBar.exe (User 'Default user')
    O4 - .DEFAULT User Startup: HP Organize.lnk = ? (User 'Default user')
    O4 - .DEFAULT User Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'Default user')
    O4 - .DEFAULT User Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE (User 'Default user')
    O4 - .DEFAULT User Startup: spamsubtract.lnk = C:\Program Files\interMute\SpamSubtract\SpamSubtract.exe (User 'Default user')
    O4 - Startup: Bat - Auto Update.lnk = C:\Program Files\Bat\Bat.exe
    O4 - Startup: Greetings Workshop Reminders.lnk = C:\Program Files\Greetings Workshop\GWREMIND.EXE
    O4 - Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
    O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
    O4 - Startup: PowerReg Scheduler.exe
    O4 - Global Startup: America Online 8.0 Tray Icon.lnk = C:\Program Files\America Online 8.0\aoltray.exe
    O4 - Global Startup: AOL Companion.lnk = C:\Program Files\AOL Companion\companion.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
    O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqthb08.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
    O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
    O4 - Global Startup: Updates from HP.lnk = C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe
    O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O10 - Hijacked Internet access by WebHancer
    O10 - Hijacked Internet access by WebHancer
    O10 - Hijacked Internet access by WebHancer
    O16 - DPF: {15589FA1-C456-11CE-BF01-00AA0055595A} - http://w4s2.work4sure.com/c/ge/w4sgeen9.exe
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {DD8C9372-35FD-4F7D-8CE4-909ABCFAB2C5} - ms-its:mhtml:file://c:\\nores.mht!http://adxtnet.net/code/chm/xpre.chm::/xpreload.ocx
    O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/RACtrl.cab
    O23 - Service: FWService - eAcceleration Corp. - C:\Program Files\eAcceleration\Firewall\FWService.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: MSSysInterv (MSSysInterv1) - Unknown owner - C:\WINDOWS\winself.exe
    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: Softex OmniPass Service (omniserv) - Unknown owner - C:\Program Files\Softex\OmniPass\Omniserv.exe
    O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
    O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
    O24 - Desktop Component 0: (no name) - C:\Program Files\Windows Media Player\viko.html

    --
    End of file - 15828 bytes
     
    covian,
    #1
  2. 2008/04/13
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Welcome to WindowsBBS covian :)

    Wow! You've got quite a mess there. :eek:

    Download ComboFix by sUBs from here, saving the file to your desktop.


    Please disable realtime protection applications as they sometimes interfere with the tool. Check this link for your applicable programs.

    • Close all open programs and windows
    • Double click combofix.exe and follow the prompts.
    • It may reboot your computer and resume running when you logon. Wait for it to complete. When finished, it will open a log for you. Post that log and a new HijackThis log in your next reply.
    Note: Do not mouseclick combofix's window while its running. That may cause it to stall
     
    noahdfear,
    #2


  3. to hide this advert.

  4. 2008/04/13
    covian

    covian Inactive Thread Starter

    Joined:
    2008/03/30
    Messages:
    22
    Likes Received:
    0
    Alright below is the what you requested

    ComboFix 08-04-13.1 - Owner 2008-04-13 20:05:36.1 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.1.1252.1.1033.18.195 [GMT -4:00]
    Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe
    * Created a new restore point
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\Documents and Settings\All Users.\documents\settings
    C:\Documents and Settings\All Users.\documents\settings\desktop.ini
    C:\Documents and Settings\All Users\Application Data\2ACA5CC3-0F83-453D-A079-1076FE1A8B65
    C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
    C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
    C:\Documents and Settings\Owner\Application Data\FunWebProducts
    C:\Documents and Settings\Owner\Application Data\FunWebProducts\Data\Owner\avatar.dat
    C:\Documents and Settings\Owner\Start Menu\Programs\Internet Speed Monitor
    C:\Documents and Settings\Owner\Start Menu\Programs\Internet Speed Monitor\Check Now.lnk
    C:\Documents and Settings\Owner\Start Menu\Programs\Internet Speed Monitor\Uninstall.lnk
    C:\Documents and Settings\Owner\Start Menu\Programs\Outerinfo
    C:\Documents and Settings\Owner\Start Menu\Programs\Outerinfo\Terms.lnk
    C:\Documents and Settings\Owner\Start Menu\Programs\Outerinfo\Uninstall.lnk
    C:\Program Files\Common Files\sstem3~1
    C:\Program Files\crosof~1
    C:\Program Files\crosof~1\??crosoft\
    C:\Program Files\crosof~1\dexplore.exe
    C:\Program Files\FunWebProducts
    C:\Program Files\FunWebProducts\Shared\Cache\AvatarSmallBtn-new.html
    C:\Program Files\FunWebProducts\Shared\Cache\AvatarSmallBtn.html
    C:\Program Files\FunWebProducts\Shared\Cache\CheckersAIMBtn.html
    C:\Program Files\FunWebProducts\Shared\Cache\ChessAIMBtn-new.html
    C:\Program Files\FunWebProducts\Shared\Cache\ChessAIMBtn.html
    C:\Program Files\FunWebProducts\Shared\Cache\CursorManiaBtn.html
    C:\Program Files\FunWebProducts\Shared\Cache\EnableDisableAIMBtn.html
    C:\Program Files\FunWebProducts\Shared\Cache\FunBuddyIconBtn.html
    C:\Program Files\FunWebProducts\Shared\Cache\MailStampBtn.html
    C:\Program Files\FunWebProducts\Shared\Cache\MyFunCardsIMBtn-new.html
    C:\Program Files\FunWebProducts\Shared\Cache\MyFunCardsIMBtn.html
    C:\Program Files\FunWebProducts\Shared\Cache\MyStationeryBtn.html
    C:\Program Files\FunWebProducts\Shared\Cache\NoSettingAIMBtn-new.html
    C:\Program Files\FunWebProducts\Shared\Cache\NoSettingAIMBtn.html
    C:\Program Files\FunWebProducts\Shared\Cache\ReversiAIMBtn-new.html
    C:\Program Files\FunWebProducts\Shared\Cache\ReversiAIMBtn.html
    C:\Program Files\FunWebProducts\Shared\Cache\SmileyCentralBtn.html
    C:\Program Files\ISM
    C:\Program Files\ISM\ism.exe
    C:\Program Files\ISM\Uninstall.exe
    C:\Program Files\MyWebSearch
    C:\Program Files\MyWebSearch\bar\1.bin\MWSOESTB.DLL
    C:\Program Files\MyWebSearch\bar\2.bin\F3BKGERR.JPG
    C:\Program Files\MyWebSearch\bar\2.bin\F3BROVLY.DLL
    C:\Program Files\MyWebSearch\bar\2.bin\F3CJPEG.DLL
    C:\Program Files\MyWebSearch\bar\2.bin\F3DTACTL.DLL
    C:\Program Files\MyWebSearch\bar\2.bin\F3HISTSW.DLL
    C:\Program Files\MyWebSearch\bar\2.bin\F3HTMLMU.DLL
    C:\Program Files\MyWebSearch\bar\2.bin\F3HTTPCT.DLL
    C:\Program Files\MyWebSearch\bar\2.bin\F3IMSTUB.DLL
    C:\Program Files\MyWebSearch\bar\2.bin\F3POPSWT.DLL
    C:\Program Files\MyWebSearch\bar\2.bin\F3PSSAVR.SCR
    C:\Program Files\MyWebSearch\bar\2.bin\F3REPROX.DLL
    C:\Program Files\MyWebSearch\bar\2.bin\F3RESTUB.DLL
    C:\Program Files\MyWebSearch\bar\2.bin\F3SCHMON.EXE
    C:\Program Files\MyWebSearch\bar\2.bin\F3SCRCTR.DLL
    C:\Program Files\MyWebSearch\bar\2.bin\F3SHLLVW.DLL
    C:\Program Files\MyWebSearch\bar\2.bin\F3SPACER.WMV
    C:\Program Files\MyWebSearch\bar\2.bin\F3WALLPP.DAT
    C:\Program Files\MyWebSearch\bar\2.bin\F3WPHOOK.DLL
    C:\Program Files\MyWebSearch\bar\2.bin\M3FFXTBR.JAR
    C:\Program Files\MyWebSearch\bar\2.bin\M3FFXTBR.MANIFEST
    C:\Program Files\MyWebSearch\bar\2.bin\M3HTML.DLL
    C:\Program Files\MyWebSearch\bar\2.bin\M3IDLE.DLL
    C:\Program Files\MyWebSearch\bar\2.bin\M3IMPIPE.EXE
    C:\Program Files\MyWebSearch\bar\2.bin\M3MSG.DLL
    C:\Program Files\MyWebSearch\bar\2.bin\M3NTSTBR.JAR
    C:\Program Files\MyWebSearch\bar\2.bin\M3NTSTBR.MANIFEST
    C:\Program Files\MyWebSearch\bar\2.bin\M3OUTLCN.DLL
    C:\Program Files\MyWebSearch\bar\2.bin\M3PLUGIN.DLL
    C:\Program Files\MyWebSearch\bar\2.bin\M3SKIN.DLL
    C:\Program Files\MyWebSearch\bar\2.bin\M3SKPLAY.EXE
    C:\Program Files\MyWebSearch\bar\2.bin\MWSBAR.DLL
    C:\Program Files\MyWebSearch\bar\2.bin\MWSOEMON.EXE
    C:\Program Files\MyWebSearch\bar\2.bin\MWSOEPLG.DLL
    C:\Program Files\MyWebSearch\bar\2.bin\MWSOESTB.DLL
    C:\Program Files\MyWebSearch\bar\2.bin\NPMYWEBS.DLL
    C:\Program Files\MyWebSearch\bar\Avatar\COMMON.F3S
    C:\Program Files\MyWebSearch\bar\Avatar\COMMON\avatar.htm
    C:\Program Files\MyWebSearch\bar\Avatar\COMMON\bgfadel.gif
    C:\Program Files\MyWebSearch\bar\Avatar\COMMON\bgfader.gif
    C:\Program Files\MyWebSearch\bar\Avatar\COMMON\close.gif
    C:\Program Files\MyWebSearch\bar\Avatar\COMMON\common-x.css
    C:\Program Files\MyWebSearch\bar\Avatar\COMMON\common.css
    C:\Program Files\MyWebSearch\bar\Avatar\COMMON\cornerbl.gif
    C:\Program Files\MyWebSearch\bar\Avatar\COMMON\cornerbr.gif
    C:\Program Files\MyWebSearch\bar\Avatar\COMMON\htmlctrl.js
    C:\Program Files\MyWebSearch\bar\Avatar\COMMON\include.js
    C:\Program Files\MyWebSearch\bar\Avatar\COMMON\index.htm
    C:\Program Files\MyWebSearch\bar\Avatar\COMMON\loading.gif
    C:\Program Files\MyWebSearch\bar\Avatar\COMMON\login.htm
    C:\Program Files\MyWebSearch\bar\Avatar\COMMON\logo.gif
    C:\Program Files\MyWebSearch\bar\Avatar\COMMON\max.gif
    C:\Program Files\MyWebSearch\bar\Avatar\COMMON\min.gif
    C:\Program Files\MyWebSearch\bar\Avatar\COMMON\noflash.htm
    C:\Program Files\MyWebSearch\bar\Avatar\COMMON\spacer.gif
    C:\Program Files\MyWebSearch\bar\Avatar\COMMON\spacer.swf
    C:\Program Files\MyWebSearch\bar\Avatar\COMMON\unmax.gif
    C:\Program Files\MyWebSearch\bar\Avatar\COMMON\wardrobe.htm
    C:\Program Files\MyWebSearch\bar\Avatar\COMMON\window.ico
    C:\Program Files\MyWebSearch\bar\Cache\0005480D
    C:\Program Files\MyWebSearch\bar\Cache\0009F9C5
    C:\Program Files\MyWebSearch\bar\Cache\00226106
    C:\Program Files\MyWebSearch\bar\Cache\01E1820D
    C:\Program Files\MyWebSearch\bar\Cache\04F3435F.bin
    C:\Program Files\MyWebSearch\bar\Cache\04F34469.bin
    C:\Program Files\MyWebSearch\bar\Cache\04F344D6.bin
    C:\Program Files\MyWebSearch\bar\Cache\04F34534.bin
    C:\Program Files\MyWebSearch\bar\Cache\05308D9E.bin
    C:\Program Files\MyWebSearch\bar\Cache\0AFE3CC3.bin
    C:\Program Files\MyWebSearch\bar\Cache\0AFE3DBD.bin
    C:\Program Files\MyWebSearch\bar\Cache\0AFE3E88.bin
    C:\Program Files\MyWebSearch\bar\Cache\0AFE3F05.bin
    C:\Program Files\MyWebSearch\bar\Cache\0BE8DFD7
    C:\Program Files\MyWebSearch\bar\Cache\0E7AEAB4.CVOYw
    C:\Program Files\MyWebSearch\bar\Cache\0E7AEE4D.bin
    C:\Program Files\MyWebSearch\bar\Cache\0E7AEEEA.bin
    C:\Program Files\MyWebSearch\bar\Cache\0E7AEFB5.bin
    C:\Program Files\MyWebSearch\bar\Cache\0E7AF090.bin
    C:\Program Files\MyWebSearch\bar\Cache\0E7AF12C.bin
    C:\Program Files\MyWebSearch\bar\Cache\23BDD4B0.bin
    C:\Program Files\MyWebSearch\bar\Cache\23BDD5AA.bin
    C:\Program Files\MyWebSearch\bar\Cache\23BDD6B4.bin
    C:\Program Files\MyWebSearch\bar\Cache\23BDD8C7.bin
    C:\Program Files\MyWebSearch\bar\Cache\23BDE55A.bin
    C:\Program Files\MyWebSearch\bar\Cache\files.ini
    C:\Program Files\MyWebSearch\bar\Game\CHECKERS.F3S
    C:\Program Files\MyWebSearch\bar\Game\CHESS.F3S
    C:\Program Files\MyWebSearch\bar\Game\REVERSI.F3S
    C:\Program Files\MyWebSearch\bar\History\search2
    C:\Program Files\MyWebSearch\bar\Settings\prevcfg2.htm
    C:\Program Files\MyWebSearch\bar\Settings\s_pid.dat
    C:\Program Files\MyWebSearch\bar\Settings\setting2.htm
    C:\Program Files\MyWebSearch\bar\Settings\settings.dat
    C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
    C:\Program Files\outerinfo
    C:\Program Files\outerinfo\FF\chrome.manifest
    C:\Program Files\outerinfo\FF\components\FF.dll
    C:\Program Files\outerinfo\FF\components\OuterinfoAds.xpt
    C:\Program Files\outerinfo\FF\install.rdf
    C:\Program Files\outerinfo\Terms.rtf
    C:\Program Files\QdrDrive
    C:\Program Files\QdrDrive\QdrDrive15.dll
    C:\Program Files\QdrDrive\qdrloader.exe
    C:\Program Files\QdrModule
    C:\Program Files\QdrModule\dicy.gz
    C:\Program Files\QdrModule\kwdy.gz
    C:\Program Files\QdrModule\pckr.dat
    C:\Program Files\QdrModule\QdrModule15.exe
    C:\Program Files\QdrPack
    C:\Program Files\QdrPack\dicts.gz
    C:\Program Files\QdrPack\QdrPack15.exe
    C:\Program Files\QdrPack\trgts.gz
    C:\Program Files\Ultimate Cleaner
    C:\Program Files\webhancer
    C:\Program Files\webhancer\Programs\license.txt
    C:\Program Files\webhancer\Programs\readme.txt
    C:\Program Files\webhancer\Programs\sporder.dll
    C:\Program Files\webhancer\Programs\webhdll.dll
    C:\Program Files\webhancer\Programs\whagent.ini
    C:\Program Files\webhancer\Programs\whiehlpr.dll
    C:\Program Files\webhancer\Programs\whinstaller.exe
    C:\Program Files\Windows Media Player\viko.html
    C:\RECYCLER\desktopA.sys
    C:\temp\0c2
    C:\temp\0c2\tmpFF.log
    C:\temp\brr
    C:\temp\brr\tmpZTF.log
    C:\temp\tn3
    C:\WINDOWS\Casino.ico
    C:\WINDOWS\conf.inf
    C:\WINDOWS\Downloaded Program Files\xpreload.ocx
    C:\WINDOWS\Free Online Dating.ico
    C:\WINDOWS\icroso~1
    C:\WINDOWS\icroso~1\?ttrib.exe
    C:\WINDOWS\inet20004
    C:\WINDOWS\inet20004\1.txt
    C:\WINDOWS\inet20004\killer.exe.bak
    C:\WINDOWS\inet20004\tmp.req
    C:\WINDOWS\ky.sxc
    C:\WINDOWS\lfn.exe
    C:\WINDOWS\mscon.sio
    C:\WINDOWS\PerfInfo
    C:\WINDOWS\PerfInfo\oDimT1O74bwp.exe
    C:\WINDOWS\pskt.ini
    C:\WINDOWS\rau001978.exe
    C:\WINDOWS\Spyware Remover.ico
    C:\WINDOWS\svchost.exe
    C:\WINDOWS\system32\000080.exe
    C:\WINDOWS\system32\000090.exe
    C:\WINDOWS\system32\b02FdUe
    C:\WINDOWS\system32\B1
    C:\WINDOWS\system32\B1\mwspasrt83122.exe
    C:\WINDOWS\system32\B11
    C:\WINDOWS\system32\B3
    C:\WINDOWS\system32\B5
    C:\WINDOWS\system32\B7
    C:\WINDOWS\system32\B9
    C:\WINDOWS\system32\drivers\core.sys
    C:\WINDOWS\system32\hubsxamm.ini
    C:\WINDOWS\system32\MVCIknmp.ini
    C:\WINDOWS\system32\MVCIknmp.ini2
    C:\WINDOWS\system32\nfxxwwgu.dll
    C:\WINDOWS\system32\pmnkICVM.dll
    C:\WINDOWS\system32\regscan.exe
    C:\WINDOWS\system32\vot.dll
    C:\WINDOWS\system32\win
    C:\WINDOWS\system32\winfrun32.bin
    C:\WINDOWS\system32\wmsdkns.exe
    C:\WINDOWS\taskmgr.exe
    C:\WINDOWS\TISKY009.exe
    C:\WINDOWS\winself.exe
    D:\Autorun.inf

    ----- BITS: Possible infected sites -----

    hxxp://80.93.48.74
    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    -------\Legacy_CORE
    -------\Legacy_RUNTIME
    -------\Service_core
    -------\Legacy_MSSysInterv1
    -------\MSSysInterv1


    ((((((((((((((((((((((((( Files Created from 2008-03-14 to 2008-04-14 )))))))))))))))))))))))))))))))
    .

    2008-04-13 17:45 . 2008-04-13 17:45 85,568 --a------ C:\WINDOWS\system32\mmaxsbuh.dll._eac_qt_
    2008-04-13 17:40 . 2008-04-13 17:40 101,091 --a------ C:\WINDOWS\BM7be1867e.xml
    2008-04-13 17:40 . 2008-04-13 17:40 95,296 --a------ C:\WINDOWS\system32\uslohbhj.dll._eac_qt_
    2008-04-13 17:40 . 2008-04-13 17:40 3,648 --a------ C:\WINDOWS\system32\ghubmtqi.dll
    2008-04-13 17:35 . 2008-04-13 17:35 <DIR> d-------- C:\WINDOWS\cuawsppw
    2008-04-13 17:35 . 2008-04-13 17:35 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Rabio
    2008-04-13 17:35 . 2008-04-13 17:35 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\dktofqxe
    2008-04-13 17:35 . 2008-04-13 17:35 196,096 --a------ C:\WINDOWS\glypoxkj.dll
    2008-04-13 17:35 . 2008-04-13 17:35 110,592 --a------ C:\WINDOWS\system32\ngtkvwxm.exe
    2008-04-13 17:35 . 2008-04-13 17:35 70,144 --a------ C:\WINDOWS\bglgtuju.dll
    2008-04-13 17:35 . 2008-04-13 17:35 70,144 --a------ C:\Documents and Settings\All Users\Application Data\ahadypex.dll
    2008-04-13 17:34 . 2008-04-13 17:37 <DIR> d-------- C:\Program Files\Bat
    2008-04-13 17:34 . 2008-04-13 17:34 41,724 ---hs---- C:\Program Files\Common Files\Yazzle1552OinUninstaller.exe
    2008-04-13 17:34 . 2008-04-13 17:34 38,400 --a------ C:\WINDOWS\17PHolmes72.exe
    2008-04-13 17:34 . 2008-04-13 17:34 8,268 --a------ C:\WINDOWS\system32\L56B2.tmp
    2008-04-13 17:34 . 2008-04-13 17:34 397 --a------ C:\WINDOWS\system32\L71FB.tmp
    2008-04-13 17:34 . 2008-04-13 17:34 397 --a------ C:\WINDOWS\system32\L6345.tmp
    2008-04-13 17:34 . 2008-04-13 17:34 397 --a------ C:\WINDOWS\system32\L58A6.tmp
    2008-04-13 17:34 . 2008-04-13 17:34 397 --a------ C:\WINDOWS\system32\L576E.tmp
    2008-04-11 15:44 . 2008-04-11 15:44 187,904 ---hs---- C:\Program Files\Common Files\Yazzle1552OinAdmin.exe
    2008-03-30 12:50 . 2008-03-30 12:50 1,126 --a------ C:\WINDOWS\mozver.dat
    2008-03-30 10:48 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
    2008-03-30 10:48 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
    2008-03-30 10:48 . 2008-03-29 00:19 86,528 --a------ C:\WINDOWS\system32\VACFix.exe
    2008-03-30 10:48 . 2008-03-26 09:50 82,432 --a------ C:\WINDOWS\system32\IEDFix.exe
    2008-03-30 10:48 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
    2008-03-30 10:48 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
    2008-03-30 10:48 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
    2008-03-30 10:32 . 2008-03-30 10:32 812,344 --a------ C:\HJTInstall.exe
    2008-03-30 10:17 . 2003-11-13 20:49 <DIR> d-------- C:\Documents and Settings\Administrator.DESKTOP\.jpi_cache
    2008-03-30 10:17 . 2003-11-13 20:48 <DIR> d-------- C:\Documents and Settings\Administrator.DESKTOP\.java
    2008-03-30 10:16 . 2003-08-23 10:34 <DIR> d-------- C:\Documents and Settings\Administrator.DESKTOP\WINDOWS
    2008-03-30 10:16 . 2008-03-30 10:17 <DIR> d---s---- C:\Documents and Settings\Administrator.DESKTOP\UserData
    2008-03-30 10:16 . 2008-03-30 10:16 <DIR> d-------- C:\Documents and Settings\Administrator.DESKTOP
    2008-03-27 21:03 . 2008-03-27 21:03 <DIR> d-------- C:\Documents and Settings\Owner\My Doucments
    2008-03-27 18:52 . 2008-04-05 11:09 54,156 --ah----- C:\WINDOWS\QTFont.qfn
    2008-03-27 18:52 . 2008-03-27 18:52 1,409 --a------ C:\WINDOWS\QTFont.for

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-04-13 23:14 --------- d-----w C:\Documents and Settings\Owner\Application Data\OpenOffice.org2
    2008-04-13 23:12 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
    2008-04-13 22:32 3,836 ----a-w C:\WINDOWS\viassary-hp.reg
    2008-04-10 16:31 --------- d-----w C:\Program Files\Google
    2008-04-10 01:42 --------- d-----w C:\Program Files\Real
    2008-03-30 14:32 --------- d-----w C:\Program Files\Trend Micro
    2008-03-29 14:18 --------- d-----w C:\Program Files\America Online 8.0
    2008-03-08 15:55 --------- d-----w C:\Program Files\AIM
    2008-03-06 00:44 --------- d-----w C:\Program Files\AIM6
    2008-03-06 00:16 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL Downloads
    2008-02-28 21:00 --------- d-----w C:\Documents and Settings\Owner\Application Data\MySpace
    2008-02-28 20:59 --------- d-----w C:\Program Files\MySpace
    2008-01-06 20:04 70,712 ----a-w C:\Documents and Settings\Owner\Application Data\GDIPFONTCACHEV1.DAT
    2007-08-22 11:42 96,512 ----a-w C:\Program Files\ucleaner_setup.exe._eac_qt_
    2007-08-22 11:39 71,502 ----a-w C:\Program Files\setup.exe._eac_qt_
    2007-07-24 12:53 40,183 --sh--w C:\Program Files\Common Files\Yazzle1281OinUninstaller.exe
    2007-06-29 15:37 146,944 --sh--w C:\Program Files\Common Files\Yazzle1281OinAdmin.exe
    2007-03-24 12:49 1,190,258 ----a-w C:\Documents and Settings\Owner\Application Data\Install.dat
    2005-12-19 21:49 785,122 -c--a-w C:\Documents and Settings\Owner\ht.com
    2005-12-18 15:40 784,830 -c--a-w C:\Documents and Settings\Owner\sys0.com
    2005-04-16 17:44 91,392 -c--a-w C:\WINDOWS\system32\config\systemprofile\Application Data\GDIPFONTCACHEV1.DAT
    2005-04-16 17:44 91,392 -c--a-w C:\Documents and Settings\Default User\Application Data\GDIPFONTCACHEV1.DAT
    2003-08-23 14:30 1,687 ----a-w C:\Program Files\HP Organize.lnk
    2007-08-09 18:08 8,784 ----a-w C:\Program Files\mozilla firefox\plugins\ractrlkeyhook.dll
    2007-08-09 18:10 245,408 ----a-w C:\Program Files\mozilla firefox\plugins\unicows.dll
    2004-10-27 20:13 32 -csha-w C:\WINDOWS\{8A7CCB54-21B0-43E1-80FB-9A58C5524A5A}.dat
    2004-10-21 00:34 3,296,136 -csha-w C:\WINDOWS\Driver Cache\ksatsm.bak2
    2004-10-12 12:44 527,707 -csha-w C:\WINDOWS\Driver Cache\rcnib.bak2
    2004-11-06 00:59 604,794 -csha-w C:\WINDOWS\inf\bdnur.bak2
    2004-11-21 17:15 553,782 -csha-w C:\WINDOWS\inf\gminib.bak1
    2004-10-06 00:40 501,990 -csha-w C:\WINDOWS\system\rvsvrs.bak2
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{07AA283A-43D7-4CBE-A064-32A21112D94D}]

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{63F7460B-C831-4142-A4AA-5EC303EC4343}]
    2008-03-07 21:15 413696 --a------ C:\Program Files\Bat\Bat.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{db41de82-1dd1-11b2-b7fd-fbaf280c36b9}]
    2008-04-13 17:35 70144 --a------ C:\WINDOWS\bglgtuju.dll

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "BackupNotify "= "c:\Program Files\Hewlett-Packard\Digital Imaging\bin\backupnotify.exe" [2003-06-23 00:25 24576]
    "NVIEW "= "nview.dll" [2003-05-03 02:19 835654 C:\WINDOWS\system32\nview.dll]
    "MSMSGS "= "C:\Program Files\Messenger\msmsgs.exe" [2004-11-15 17:18 1670144]
    "ctfmon.exe "= "C:\WINDOWS\System32\ctfmon.exe" [2002-08-29 08:00 13312]
    "Aim6 "= "C:\Program Files\AIM6\aim6.exe" [2007-04-27 17:17 50736]
    "Jfw "= "C:\WINDOWS\?icrosoft\?ttrib.exe" [ ]
    "Spyware Doctor "= "C:\Program Files\Spyware Doctor\swdoctor.exe" [2007-08-20 08:47 2115728]
    "ITCHCURB "= "C:\DOCUME~1\Owner\APPLIC~1\INSIDE~1\Bat okay.exe" [ ]
    "swg "= "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-10-27 20:30 68856]
    "AdobeUpdater "= "C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-03-01 10:37 2321600]
    "Notn "= "C:\PROGRA~1\CROSOF~1\dexplore.exe" [ ]
    "QdrModule15 "= "C:\Program Files\QdrModule\QdrModule15.exe" [ ]
    "QdrPack15 "= "C:\Program Files\QdrPack\QdrPack15.exe" [ ]
    "herrxkta "= "C:\WINDOWS\system32\ngtkvwxm.exe" [2008-04-13 17:35 110592]
    "ieskegbk "= "C:\WINDOWS\system32\wzahobwh.exe" [2008-04-13 20:26 118784]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "hpsysdrv "= "c:\windows\system\hpsysdrv.exe" [1998-05-07 19:04 52736]
    "HotKeysCmds "= "C:\WINDOWS\System32\hkcmd.exe" [2004-08-20 15:51 118784]
    "CamMonitor "= "c:\Program Files\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe" [2002-10-07 10:23 90112]
    "HPHUPD05 "= "c:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" [2003-05-23 06:03 49152]
    "HPHmon05 "= "C:\WINDOWS\System32\hphmon05.exe" [2003-05-23 05:55 483328]
    "KBD "= "C:\HP\KBD\KBD.EXE" [2003-02-11 23:02 61440]
    "StorageGuard "= "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-02-13 11:01 155648]
    "TkBellExe "= "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2003-08-23 10:14 151597]
    "AutoTKit "= "C:\hp\bin\AUTOTKIT.EXE" [2003-06-18 22:19 53248]
    "Recguard "= "C:\WINDOWS\SMINST\RECGUARD.EXE" [2002-09-14 00:42 212992]
    "NvCplDaemon "= "C:\WINDOWS\System32\NvCpl.dll" [2003-05-03 02:19 4640768]
    "nwiz "= "nwiz.exe" [2003-05-03 02:19 323584 C:\WINDOWS\system32\nwiz.exe]
    "Sunkist2k "= "C:\Program Files\Multimedia Card Reader\shwicon2k.exe" [2003-08-09 12:27 139264]
    "Reminder "= "C:\Windows\Creator\Remind_XP.exe" [2003-06-17 21:13 118784]
    "PS2 "= "C:\WINDOWS\system32\ps2.exe" [2002-10-16 19:57 81920]
    "mmtask "= "C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe" [2003-02-24 21:51 53248]
    "MCUpdateExe "= "C:\PROGRA~1\McAfee.com\Agent\McUpdate.exe" [ ]
    "MCAgentExe "= "C:\PROGRA~1\McAfee.com\Agent\McAgent.exe" [ ]
    "SoftwareStation "= "C:\Program Files\eAcceleration\Station\station.exe" [2007-05-08 20:12 136904]
    "StopSignSsTsMon "= "C:\Program Files\Acceleration Software\Anti-Virus\sstsmon.dll" [2007-12-10 22:13 152976 C:\Program Files\Acceleration Software\Anti-Virus\sstsmon.dll]
    "webscan "= "C:\Program Files\Acceleration Software\Anti-Virus\stopsignav.exe" [2007-12-19 22:20 771504]
    "StopSignSsFwMon "= "C:\Program Files\eAcceleration\Firewall\ssfwmon.dll" [2006-08-09 14:56 136864]
    "HPHUPD06 "= "C:\Program Files\Hewlett-Packard\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe" [2004-06-07 00:53 49152]
    "HP Software Update "= "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2004-09-13 16:49 49152]
    "HP Component Manager "= "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 16:18 241664]
    "HPHmon06 "= "C:\WINDOWS\System32\hphmon06.exe" [2004-06-07 00:42 659456]
    "StopSignSsSsMon "= "C:\Program Files\Acceleration Software\Anti-Virus\ssssmon.dll" [2007-12-19 15:50 140696]
    "AlcxMonitor "= "ALCXMNTR.EXE" [2004-09-07 13:47 57344 C:\WINDOWS\ALCXMNTR.EXE]
    "IgfxTray "= "C:\WINDOWS\System32\igfxtray.exe" [2004-08-20 15:55 155648]
    "SunJavaUpdateSched "= "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 02:11 132496]
    "Adobe Photo Downloader "= "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 11:09 63712]
    "Adobe Reader Speed Launcher "= "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]
    "ZangoOE "= "C:\Program Files\Zango\bin\10.0.370.0\OEAddOn.exe" [ ]
    "ZangoSA "= "C:\Program Files\Zango\bin\10.0.370.0\ZangoSA.exe" [ ]
    "QuickTime Task "= "C:\Program Files\QuickTime\qttask.exe" [2007-10-19 21:16 286720]
    "iTunesHelper "= "C:\Program Files\iTunes\iTunesHelper.exe" [2007-11-02 19:36 267048]
    "XP Advanced Keylogger "= "C:\Program Files\XP Advanced Keylogger\ToolKeylogger.exe" [2005-10-09 00:53 372736]
    "OnAccess "= "C:\Program Files\eAcceleration\OnAccess\onaccess.exe" [2008-01-17 22:14 214352]
    "ctfmon "= "c:\documents and settings\all users\_qbothome\_qbotinj.exe" [ ]
    "78d2b5e2 "= "C:\WINDOWS\System32\mmaxsbuh.dll" [ ]
    "BM7be1867e "= "C:\WINDOWS\System32\uslohbhj.dll" [ ]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
    "StopSignSsFwMon "= "C:\Program Files\eAcceleration\Firewall\ssfwmon.dll" [2006-08-09 14:56 136864]
    "StopSignSsSsMon "= "C:\Program Files\Acceleration Software\Anti-Virus\ssssmon.dll" [2007-12-19 15:50 140696]
    "StopSignSsTsMon "= "C:\Program Files\Acceleration Software\Anti-Virus\sstsmon.dll" [2007-12-10 22:13 152976]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "MySpaceIM "= "C:\Program Files\MySpace\IM\MySpaceIM.exe" [2008-02-01 16:32 8699904]

    C:\WINDOWS\system32\config\systemprofile\Start Menu\Programs\Startup\
    AutoTBar.exe [2003-06-18 22:19:08 53248]
    HP Organize.lnk - C:\Program Files\Hewlett-Packard\HP Organize\bin\displayAgent.exe [2003-08-23 10:30:48 28672]
    mod_sm.lnk - C:\hp\bin\cloaker.exe [1999-11-07 10:11:14 27136]

    C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\
    AutoTBar.exe [2003-06-18 22:19:08 53248]
    mod_sm.lnk - C:\hp\bin\cloaker.exe [1999-11-07 10:11:14 27136]

    C:\Documents and Settings\Default User\Start Menu\Programs\Startup\
    AutoTBar.exe [2003-06-18 22:19:08 53248]
    HP Organize.lnk - C:\Program Files\Hewlett-Packard\HP Organize\bin\displayAgent.exe [2003-08-23 10:30:48 28672]
    mod_sm.lnk - C:\hp\bin\cloaker.exe [1999-11-07 10:11:14 27136]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    America Online 8.0 Tray Icon.lnk - C:\Program Files\America Online 8.0\aoltray.exe [2007-05-19 08:43:23 36940]
    AOL Companion.lnk - C:\Program Files\AOL Companion\companion.exe [2007-05-19 08:45:57 221258]
    HP Digital Imaging Monitor.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe [2004-05-28 22:31:38 241664]
    HP Image Zone Fast Start.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqthb08.exe [2004-05-28 23:06:36 53248]
    Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 02:01:04 83360]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]
    "oDimT1O74b "= C:\Documents and Settings\All Users\Application Data\dktofqxe\rqzmxsnc.exe

    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
    "{42DD0873-5FA9-465D-90DE-0826020416A5} "= C:\Program Files\eAcceleration\OnAccess\onaccess_hk32.dll [2008-01-17 22:14 161104]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OPXPGina]
    C:\Program Files\Softex\OmniPass\opxpgina.dll 2003-02-21 06:50 40960 C:\Program Files\Softex\OmniPass\OPXPGina.dll

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall "= 0 (0x0)

    R0 fwcore;Fwcore Filter;C:\WINDOWS\System32\drivers\fwcore.sys [2007-02-28 22:26]
    R2 FWService;FWService;C:\Program Files\eAcceleration\Firewall\FWService.exe [2007-02-28 22:26]

    .
    Contents of the 'Scheduled Tasks' folder
    "2008-04-14 00:00:00 C:\WINDOWS\Tasks\874237A78325AAB3.job "
    - c:\docume~1\owner\applic~1\inside~1\deafboldplus.exe
    "2008-04-07 11:30:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job "
    - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
    .
    **************************************************************************

    catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-04-13 20:26:05
    Windows 5.1.2600 Service Pack 1 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************

    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\mchInjDrv]
    "ImagePath "= "\??\C:\WINDOWS\TEMP\mc21.tmp "
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    PROCESS: C:\WINDOWS\system32\winlogon.exe
    -> C:\Program Files\Softex\OmniPass\opxpgina.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\Program Files\Softex\OmniPass\omniServ.exe
    C:\Program Files\Spyware Doctor\sdhelp.exe
    C:\Program Files\Softex\OmniPass\OPXPApp.exe
    C:\WINDOWS\system32\wdfmgr.exe
    C:\WINDOWS\wanmpsvc.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\HpqCmon.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
    C:\Program Files\Java\jre1.6.0_03\bin\jucheck.exe
    .
    **************************************************************************
    .
    Completion time: 2008-04-13 20:35:18 - machine was rebooted
    ComboFix-quarantined-files.txt 2008-04-14 00:35:11

    Pre-Run: 53,692,432,384 bytes free
    Post-Run: 54,796,079,104 bytes free
    .
    2008-04-09 07:01:45 --- E O F ---
     
    covian,
    #3
  5. 2008/04/13
    covian

    covian Inactive Thread Starter

    Joined:
    2008/03/30
    Messages:
    22
    Likes Received:
    0
    Below is the HijackThis


    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 10:06:24 PM, on 4/13/2008
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\alg.exe
    C:\Program Files\eAcceleration\Firewall\FWService.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\Program Files\Softex\OmniPass\Omniserv.exe
    C:\Program Files\Spyware Doctor\sdhelp.exe
    C:\Program Files\Softex\OmniPass\OPXPApp.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\wdfmgr.exe
    C:\WINDOWS\wanmpsvc.exe
    C:\WINDOWS\System32\ctfmon.exe
    C:\Documents and Settings\All Users\Application Data\dktofqxe\rqzmxsnc.exe
    C:\windows\system\hpsysdrv.exe
    C:\WINDOWS\System32\hkcmd.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
    C:\WINDOWS\System32\hphmon05.exe
    C:\HP\KBD\KBD.EXE
    C:\Program Files\Multimedia Card Reader\shwicon2k.exe
    C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
    C:\Program Files\eAcceleration\Station\station.exe
    C:\Program Files\Acceleration Software\Anti-Virus\stopsignav.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
    C:\WINDOWS\System32\hphmon06.exe
    C:\WINDOWS\ALCXMNTR.EXE
    C:\WINDOWS\System32\igfxtray.exe
    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
    C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\eAcceleration\OnAccess\onaccess.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\WINDOWS\system32\wzahobwh.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
    C:\WINDOWS\System32\wuauclt.exe
    C:\Program Files\Java\jre1.6.0_03\bin\jucheck.exe
    C:\WINDOWS\explorer.exe
    C:\WINDOWS\system32\notepad.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    C:\WINDOWS\System32\wbem\wmiprvse.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us9.hpwis.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: Zango /fleok=1D8A83A5C4EC167F9BAD6A2A1FBB39BFE4976E26CAEDA120180A196D6093 - {07AA283A-43D7-4CBE-A064-32A21112D94D} - (no file)
    O2 - BHO: BatBHO - {63F7460B-C831-4142-A4AA-5EC303EC4343} - C:\Program Files\Bat\Bat.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
    O2 - BHO: (no name) - {db41de82-1dd1-11b2-b7fd-fbaf280c36b9} - C:\WINDOWS\bglgtuju.dll
    O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\HPDTLK02.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: (no name) - {07AA283A-43D7-4CBE-A064-32A21112D94D} - (no file)
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
    O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe
    O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
    O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
    O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
    O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [AutoTKit] C:\hp\bin\AUTOTKIT.EXE
    O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
    O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe
    O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe "
    O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
    O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
    O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\McAfee.com\Agent\McUpdate.exe
    O4 - HKLM\..\Run: [MCAgentExe] C:\PROGRA~1\McAfee.com\Agent\McAgent.exe
    O4 - HKLM\..\Run: [SoftwareStation] "C:\Program Files\eAcceleration\Station\station.exe" /b Startup
    O4 - HKLM\..\Run: [StopSignSsTsMon] Rundll32.exe "C:\Program Files\Acceleration Software\Anti-Virus\sstsmon.dll ",VerifyStatus
    O4 - HKLM\..\Run: [webscan] "C:\Program Files\Acceleration Software\Anti-Virus\stopsignav.exe" -k
    O4 - HKLM\..\Run: [StopSignSsFwMon] Rundll32.exe "C:\Program Files\eAcceleration\Firewall\ssfwmon.dll ",VerifyStatus
    O4 - HKLM\..\Run: [HPHUPD06] C:\Program Files\Hewlett-Packard\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
    O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe "
    O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe "
    O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\System32\hphmon06.exe
    O4 - HKLM\..\Run: [StopSignSsSsMon] Rundll32.exe "C:\Program Files\Acceleration Software\Anti-Virus\ssssmon.dll ",VerifyStatus
    O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe "
    O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe "
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe "
    O4 - HKLM\..\Run: [ZangoOE] C:\Program Files\Zango\bin\10.0.370.0\OEAddOn.exe
    O4 - HKLM\..\Run: [ZangoSA] "C:\Program Files\Zango\bin\10.0.370.0\ZangoSA.exe "
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
    O4 - HKLM\..\Run: [XP Advanced Keylogger] C:\Program Files\XP Advanced Keylogger\ToolKeylogger.exe
    O4 - HKLM\..\Run: [OnAccess] "C:\Program Files\eAcceleration\OnAccess\onaccess.exe" -erk
    O4 - HKLM\..\Run: [ctfmon] "c:\documents and settings\all users\_qbothome\_qbotinj.exe" "c:\documents and settings\all users\_qbothome\_qbot.dll "
    O4 - HKLM\..\Run: [78d2b5e2] rundll32.exe "C:\WINDOWS\System32\mmaxsbuh.dll ",b
    O4 - HKLM\..\Run: [BM7be1867e] Rundll32.exe "C:\WINDOWS\System32\uslohbhj.dll ",s
    O4 - HKLM\..\RunOnce: [StopSignSsFwMon] Rundll32.exe "C:\Program Files\eAcceleration\Firewall\ssfwmon.dll ",VerifyStatus /ro
    O4 - HKLM\..\RunOnce: [StopSignSsSsMon] Rundll32.exe "C:\Program Files\Acceleration Software\Anti-Virus\ssssmon.dll ",VerifyStatus /ro
    O4 - HKLM\..\RunOnce: [StopSignSsTsMon] Rundll32.exe "C:\Program Files\Acceleration Software\Anti-Virus\sstsmon.dll ",VerifyStatus /ro
    O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\Hewlett-Packard\Digital Imaging\bin\backupnotify.exe
    O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
    O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
    O4 - HKCU\..\Run: [Jfw] C:\WINDOWS\?icrosoft\?ttrib.exe
    O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
    O4 - HKCU\..\Run: [ITCHCURB] C:\DOCUME~1\Owner\APPLIC~1\INSIDE~1\Bat okay.exe
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
    O4 - HKCU\..\Run: [Notn] "C:\PROGRA~1\CROSOF~1\dexplore.exe" -vt yazb
    O4 - HKCU\..\Run: [QdrModule15] "C:\Program Files\QdrModule\QdrModule15.exe "
    O4 - HKCU\..\Run: [QdrPack15] "C:\Program Files\QdrPack\QdrPack15.exe "
    O4 - HKCU\..\Run: [herrxkta] C:\WINDOWS\system32\ngtkvwxm.exe
    O4 - HKCU\..\Run: [ieskegbk] C:\WINDOWS\system32\wzahobwh.exe
    O4 - HKLM\..\Policies\Explorer\Run: [oDimT1O74b] C:\Documents and Settings\All Users\Application Data\dktofqxe\rqzmxsnc.exe
    O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
    O4 - S-1-5-18 Startup: AutoTBar.exe (User 'SYSTEM')
    O4 - S-1-5-18 Startup: HP Organize.lnk = ? (User 'SYSTEM')
    O4 - S-1-5-18 Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'SYSTEM')
    O4 - S-1-5-18 Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE (User 'SYSTEM')
    O4 - S-1-5-18 Startup: spamsubtract.lnk = C:\Program Files\interMute\SpamSubtract\SpamSubtract.exe (User 'SYSTEM')
    O4 - .DEFAULT Startup: AutoTBar.exe (User 'Default user')
    O4 - .DEFAULT Startup: HP Organize.lnk = ? (User 'Default user')
    O4 - .DEFAULT Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'Default user')
    O4 - .DEFAULT Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE (User 'Default user')
    O4 - .DEFAULT Startup: spamsubtract.lnk = C:\Program Files\interMute\SpamSubtract\SpamSubtract.exe (User 'Default user')
    O4 - .DEFAULT User Startup: AutoTBar.exe (User 'Default user')
    O4 - .DEFAULT User Startup: HP Organize.lnk = ? (User 'Default user')
    O4 - .DEFAULT User Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'Default user')
    O4 - .DEFAULT User Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE (User 'Default user')
    O4 - .DEFAULT User Startup: spamsubtract.lnk = C:\Program Files\interMute\SpamSubtract\SpamSubtract.exe (User 'Default user')
    O4 - Startup: AutoTBar.exe
    O4 - Startup: Bat - Auto Update.lnk = C:\Program Files\Bat\Bat.exe
    O4 - Startup: Greetings Workshop Reminders.lnk = C:\Program Files\Greetings Workshop\GWREMIND.EXE
    O4 - Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
    O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
    O4 - Startup: PowerReg Scheduler.exe
    O4 - Global Startup: America Online 8.0 Tray Icon.lnk = C:\Program Files\America Online 8.0\aoltray.exe
    O4 - Global Startup: AOL Companion.lnk = C:\Program Files\AOL Companion\companion.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
    O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqthb08.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
    O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
    O4 - Global Startup: Updates from HP.lnk = C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O16 - DPF: {15589FA1-C456-11CE-BF01-00AA0055595A} - http://w4s2.work4sure.com/c/ge/w4sgeen9.exe
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {DD8C9372-35FD-4F7D-8CE4-909ABCFAB2C5} - ms-its:mhtml:file://c:\\nores.mht!http://adxtnet.net/code/chm/xpre.chm::/xpreload.ocx
    O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/RACtrl.cab
    O23 - Service: FWService - eAcceleration Corp. - C:\Program Files\eAcceleration\Firewall\FWService.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: Softex OmniPass Service (omniserv) - Unknown owner - C:\Program Files\Softex\OmniPass\Omniserv.exe
    O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
    O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

    --
    End of file - 14544 bytes
     
    covian,
    #4
  6. 2008/04/13
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Open the StopSign antivirus and remove all quarantined items.
    Remove all quarantined items in Spyware Doctor.

    Next, download Malwarebytes' Anti-Malware (MBAM) from here or here and save the file to your desktop.

    Double click mbam-setup.exe to install the application.
    • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
    • If an update is found, it will download and install the latest version.
    • Once the program has loaded, select 'Perform Quick Scan', then click Scan.
    • The scan may take some time to finish,so please be patient.
    • When the scan is complete, click OK, then Show Results to view the results.
    • Make sure that everything is checked, and click Remove Selected.
    • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note below)
    • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
    • Post the entire report in your next reply along with a fresh HijackThis log.

    Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.
     
    noahdfear,
    #5
  7. 2008/04/14
    covian

    covian Inactive Thread Starter

    Joined:
    2008/03/30
    Messages:
    22
    Likes Received:
    0
    Malwarebytes' Anti-Malware 1.11
    Database version: 624

    Scan type: Quick Scan
    Objects scanned: 36470
    Time elapsed: 6 minute(s), 33 second(s)

    Memory Processes Infected: 3
    Memory Modules Infected: 0
    Registry Keys Infected: 89
    Registry Values Infected: 9
    Registry Data Items Infected: 0
    Folders Infected: 4
    Files Infected: 63

    Memory Processes Infected:
    c:\program files\Bat\X_Bat.exe (Adware.Batco) -> Unloaded process successfully.
    C:\WINDOWS\system32\ngtkvwxm.exe (Trojan.FakeAlert) -> Unloaded process successfully.
    C:\Documents and Settings\All Users\Application Data\dktofqxe\rqzmxsnc.exe (Trojan.FakeAlert) -> Unloaded process successfully.

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    HKEY_CLASSES_ROOT\AppID\{f663b917-591f-4172-8d87-3d7d729007ca} (Adware.Batco) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\bat.batbho (Adware.Batco) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\bat.batbho.1 (Adware.Batco) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{63f7460b-c831-4142-a4aa-5ec303ec4343} (Adware.Batco) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{63f7460b-c831-4142-a4aa-5ec303ec4343} (Adware.Batco) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{d279bc2b-a85b-4559-8fd9-ddc55f5d402d} (Adware.Batco) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Typelib\{b80a3586-caa5-41c8-89bf-e617f0b6cfbf} (Adware.Batco) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{00b77587-be1b-4201-b8e9-09fcf50ab771} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{067c6a37-72ea-4437-863a-5be20c246f3c} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{07aa283a-43d7-4cbe-a064-32a21112d94d} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{34e29700-0d13-46aa-b9a5-ace68e21a091} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{3661af2d-c27b-499c-9bcf-66c8502a3806} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{99123ac9-7dda-4c82-b252-44c2804bf392} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Typelib\{08755390-f46d-4d09-968c-3430166b3189} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{5a4737a8-b92a-4e54-970e-c2891d98ce3f} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{ace99e77-aa2a-43c2-8c9d-caf2020fdf2b} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{e0fb1610-b25b-49f6-be20-751b2f230e6f} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{3f0915b8-b238-4c2d-ad1e-60db1e14d27a} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{ea58c2ea-be26-49dd-9b9a-c8e4e5ca7791} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{fca28ac5-c1e1-4d67-a5ae-c44d6c374d9f} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Typelib\{0923208c-e259-4ed5-a778-cb607da350ad} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{1230cf51-6bc4-4a23-b3f1-c7cf0afed619} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{1985fce1-4043-4346-ae70-d0a0cd90bdd3} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{1a2af056-1fe1-47ca-993d-5d09d18e674e} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\zangoax.clientdetector (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\zangoax.clientdetector.1 (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{1e5b2693-d348-4ca7-8364-4f5e51bf9c6d} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{1e5b2693-d348-4ca7-8364-4f5e51bf9c6d} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{2e623b96-b166-4c70-8169-820761794299} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{4e8b851b-05b0-4baf-b24d-d0dfe88dded3} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{50c3e2b3-4fd7-4cb9-91f9-641a6e6b3689} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{62b0b239-f9ac-4a5b-bfae-62c7a23f7627} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{726f0ab9-b842-4ae4-90c7-230e233e6a99} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{b9cc2b92-5611-453f-8381-8b6f72d9c0b8} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{c4543e64-1498-410d-8e72-4744eea99ab9} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Typelib\{229d2451-a617-4b30-b5e8-8138694240cb} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{2b81f920-6660-4f76-93bf-b1c67bf5d1a0} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\zangoax.userprofiles (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\zangoax.userprofiles.1 (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{2e54ac53-efa4-4831-a3f6-b47b1a1937cf} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{2e54ac53-efa4-4831-a3f6-b47b1a1937cf} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{49155dae-c471-40fa-98ee-b2b3cad115ce} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{4d783385-0dda-4188-a529-c97dc3d67cbd} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{54a3f8b7-228e-4ed8-895b-de832b2c3959} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{54a3f8b7-228e-4ed8-895b-de832b2c3959} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{5b2e150d-4c8a-40e4-8c36-dd9c02771c67} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{627d894a-8a77-416e-b522-432eaf2c818e} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{6e10479b-31e8-4a3b-81b1-ddaf39097f19} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{7138f250-5b72-48dd-adfb-9a83b429dd9e} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{8971cb48-9fca-445a-be77-e8e8a4cc9df7} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{93b0fa7b-50f6-41b4-ac7e-612a72ce8c3c} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{93b0fa7b-50f6-41b4-ac7e-612a72ce8c3c} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{93b0fa7b-50f6-41b4-ac7e-612a72ce8c3c} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{e420a65f-9984-4b8c-9fa9-1ed69d3b0a13} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Typelib\{9720de03-5820-4059-b4a4-639d5e52bd09} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{b247f5bf-bd9d-4ecd-8fc1-365f36a1fda1} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{bbbfb891-98ae-4678-86f3-bd5a2eed86c9} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Typelib\{ad71e48f-6f47-4b63-9312-fae879541c4d} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{b88e4484-3ff6-4ea9-815b-a54fe20d4387} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\zango.desktopflash (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\zango.desktopflash.1 (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{bd937ffe-0352-4fde-88f2-c30d1a9b25cf} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{bd937ffe-0352-4fde-88f2-c30d1a9b25cf} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{bd937ffe-0352-4fde-88f2-c30d1a9b25cf} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{bf1bf02c-5a86-4ecf-adac-472c54c4d21e} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{bfc08cff-c737-4433-bd5a-0ee7efcfee54} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Typelib\{c23fa5a4-1fea-419f-8b14-f7465df062bc} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Typelib\{ccc6e232-aa4c-4813-a019-9c14b27776b6} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{d2221ccb-f2bb-4858-aad4-57c754153603} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\AppID\{dbf00e12-281c-4dc8-a7ec-1ff45182439b} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Typelib\{dd1cb2d7-161d-4b84-ae5c-08d3faed894f} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{ea0b6a1a-6a59-4a58-9c41-9966504898a5} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\Microsoft\Installer\Features\9ee2330ae5f4470cac801baac83818c9 (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\Microsoft\Installer\Products\568267acfc5644dab06f058006ddbae3 (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{dd8c9372-35fd-4f7d-8ce4-909abcfab2c5} (Trojan.Downloader) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\mwc (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\xpre (Trojan.Downloader) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\BATCO (Adware.Batco) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Batco (Adware.Batco) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\AppID\bat.DLL (Adware.Batco) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Bat (Adware.Batco) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Bat (Adware.Batco) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\xflock (Malware.Trace) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\WakeNet (Trojan.Adware) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\zangosa (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZangoSA (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\AppID\ZangoSA_df.exe (Adware.Zango) -> Quarantined and deleted successfully.

    Registry Values Infected:
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\herrxkta (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ieskegbk (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\twvyxxip (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\oDimT1O74b (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\Mozilla\Firefox\Extensions\{59a40ac9-e67d-4155-b31d-4b7330fcd2d6} (Adware.PurityScan) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{07aa283a-43d7-4cbe-a064-32a21112d94d} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BM7be1867e (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\Extensions\Zango@Zango.com (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform\Zango 10.0.370.0 (Adware.Zango) -> Quarantined and deleted successfully.

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    C:\Program Files\Bat (Adware.Batco) -> Quarantined and deleted successfully.
    C:\Documents and Settings\All Users\Application Data\ZangoSA (Adware.Zango) -> Quarantined and deleted successfully.
    C:\Documents and Settings\All Users\Application Data\Rabio\Search Enhancer (Adware.SearchEnhancer) -> Quarantined and deleted successfully.
    C:\Documents and Settings\All Users\Application Data\Rabio (Adware.Rabio) -> Quarantined and deleted successfully.

    Files Infected:
    c:\program files\Bat\X_Bat.exe (Adware.Batco) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\ngtkvwxm.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\wzahobwh.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\ohqdufeb.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\Documents and Settings\All Users\Application Data\dktofqxe\rqzmxsnc.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\Program Files\Windows Media Player\rybi.dll._eac_qt_ (Trojan.BHO) -> Quarantined and deleted successfully.
    C:\Program Files\ucleaner_setup.exe._eac_qt_ (Rogue.Installer) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\gopa.exe._eac_qt_ (Trojan.Downloader) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\hadjajr.ini._eac_qt_ (Trojan.Qhost) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\hlpsrv.exe._eac_qt_ (Trojan.Clicker) -> Quarantined and deleted successfully.
    C:\WINDOWS\Downloaded Program Files\UWA7P_0001_N91M0809NetInstaller.exe (Rogue.WinAntivirus) -> Quarantined and deleted successfully.
    C:\WINDOWS\pyjulph.exe._eac_qt_ (Dropper.Agent) -> Quarantined and deleted successfully.
    C:\WINDOWS\tk58.exe._eac_qt_ (Trojan.BHO) -> Quarantined and deleted successfully.
    C:\sysaqga.exe._eac_qt_ (Trojan.DownLoader) -> Quarantined and deleted successfully.
    C:\sysbwin.exe._eac_qt_ (Trojan.DownLoader) -> Quarantined and deleted successfully.
    C:\sysezmr.exe._eac_qt_ (Trojan.DownLoader) -> Quarantined and deleted successfully.
    C:\sysfcmz.exe._eac_qt_ (Trojan.DownLoader) -> Quarantined and deleted successfully.
    C:\sysfcnf.exe._eac_qt_ (Trojan.DownLoader) -> Quarantined and deleted successfully.
    C:\sysgwaf.exe._eac_qt_ (Trojan.DownLoader) -> Quarantined and deleted successfully.
    C:\sysothf.exe._eac_qt_ (Trojan.DownLoader) -> Quarantined and deleted successfully.
    C:\sysskqv.exe._eac_qt_ (Trojan.DownLoader) -> Quarantined and deleted successfully.
    C:\sysudfp.exe._eac_qt_ (Trojan.DownLoader) -> Quarantined and deleted successfully.
    C:\sysxscz.exe._eac_qt_ (Trojan.DownLoader) -> Quarantined and deleted successfully.
    C:\sysxxpd.exe._eac_qt_ (Trojan.DownLoader) -> Quarantined and deleted successfully.
    C:\sysyirw.exe._eac_qt_ (Trojan.DownLoader) -> Quarantined and deleted successfully.
    C:\syszqdg.exe._eac_qt_ (Trojan.DownLoader) -> Quarantined and deleted successfully.
    C:\Program Files\Bat\Bat.dll.intermediate.manifest (Adware.Batco) -> Quarantined and deleted successfully.
    C:\Program Files\Bat\Bat.exe (Adware.Batco) -> Quarantined and deleted successfully.
    C:\Program Files\Bat\Bat.info (Adware.Batco) -> Quarantined and deleted successfully.
    C:\Program Files\Bat\Bat.original (Adware.Batco) -> Quarantined and deleted successfully.
    C:\Program Files\Bat\Info.dll (Adware.Batco) -> Quarantined and deleted successfully.
    C:\Program Files\Bat\un_BatSetup_15041.exe (Adware.Batco) -> Quarantined and deleted successfully.
    C:\Program Files\Bat\un_BatSetup_15041.txt (Adware.Batco) -> Quarantined and deleted successfully.
    C:\Program Files\Bat\X_Bat.log (Adware.Batco) -> Quarantined and deleted successfully.
    C:\Documents and Settings\All Users\Application Data\ZangoSA\ZangoSA.dat (Adware.Zango) -> Quarantined and deleted successfully.
    C:\Documents and Settings\All Users\Application Data\ZangoSA\ZangoSAAbout.mht (Adware.Zango) -> Quarantined and deleted successfully.
    C:\Documents and Settings\All Users\Application Data\ZangoSA\ZangoSAau.dat (Adware.Zango) -> Quarantined and deleted successfully.
    C:\Documents and Settings\All Users\Application Data\ZangoSA\ZangoSAEULA.mht (Adware.Zango) -> Quarantined and deleted successfully.
    C:\Documents and Settings\All Users\Application Data\ZangoSA\ZangoSA_kyf.dat (Adware.Zango) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\~.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\WINDOWS\17PHolmes72.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\printer.exe._eac_qt_ (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\WINDOWS\b122.exe (Heuristics.Malware) -> Quarantined and deleted successfully.
    C:\WINDOWS\tcb.pmw (Malware.Trace) -> Quarantined and deleted successfully.
    C:\Program Files\Common Files\Yazzle1281OinAdmin.exe (Adware.PurityScan) -> Quarantined and deleted successfully.
    C:\Program Files\Common Files\Yazzle1281OinUninstaller.exe (Adware.PurityScan) -> Quarantined and deleted successfully.
    C:\Program Files\Common Files\Yazzle1552OinAdmin.exe (Adware.PurityScan) -> Quarantined and deleted successfully.
    C:\Program Files\Common Files\Yazzle1552OinUninstaller.exe (Adware.PurityScan) -> Quarantined and deleted successfully.
    C:\WINDOWS\retadpu572.exe.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\WINDOWS\avp.exe._eac_qt_ (Trojan.Downloader) -> Quarantined and deleted successfully.
    C:\WINDOWS\mgrs.exe._eac_qt_ (Trojan.Downloader) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\drivers\core.cache.dsk (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\retadpu.exe._eac_qt_ (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\WINDOWS\retadpu1000106.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Owner\Start Menu\Programs\Startup\Bat - Auto Update.lnk (Adware.Batco) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Owner\Application Data\Install.dat (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Owner\Favorites\Online Security Test.url (Rogue.Link) -> Quarantined and deleted successfully.
    C:\Documents and Settings\All Users\Desktop\Security Troubleshooting.url (Rogue.Link) -> Quarantined and deleted successfully.
    C:\Documents and Settings\All Users\Start Menu\Online Security Guide.url (Rogue.Link) -> Quarantined and deleted successfully.
    C:\Documents and Settings\All Users\Start Menu\Security Troubleshooting.url (Rogue.Link) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Owner\Desktop\Find Spyware Remover.lnk (Rogue.Link) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\drivers\svchost.exe._eac_qt_ (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Owner\svchost.exe._eac_qt_ (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.
     
    covian,
    #6
  8. 2008/04/14
    covian

    covian Inactive Thread Starter

    Joined:
    2008/03/30
    Messages:
    22
    Likes Received:
    0
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 12:09:08 PM, on 4/14/2008
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\alg.exe
    C:\Program Files\eAcceleration\Firewall\FWService.exe
    C:\Program Files\LogMeIn\x86\RaMaint.exe
    C:\Program Files\LogMeIn\x86\LogMeIn.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\Program Files\Softex\OmniPass\Omniserv.exe
    C:\Program Files\Spyware Doctor\sdhelp.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\wdfmgr.exe
    C:\WINDOWS\wanmpsvc.exe
    C:\Program Files\Softex\OmniPass\OPXPApp.exe
    C:\WINDOWS\Explorer.EXE
    C:\windows\system\hpsysdrv.exe
    C:\WINDOWS\System32\hkcmd.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
    C:\WINDOWS\System32\hphmon05.exe
    C:\HP\KBD\KBD.EXE
    C:\Program Files\Multimedia Card Reader\shwicon2k.exe
    C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
    C:\Program Files\eAcceleration\Station\station.exe
    C:\Program Files\Acceleration Software\Anti-Virus\stopsignav.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
    C:\WINDOWS\System32\hphmon06.exe
    C:\WINDOWS\ALCXMNTR.EXE
    C:\WINDOWS\System32\igfxtray.exe
    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
    C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\eAcceleration\OnAccess\onaccess.exe
    C:\Program Files\LogMeIn\x86\LogMeInSystray.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\WINDOWS\System32\ctfmon.exe
    C:\Program Files\AIM6\aim6.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\Program Files\AIM6\aolsoftware.exe
    C:\WINDOWS\System32\wuauclt.exe
    C:\Program Files\LogMeIn\x86\LogMeIn.exe
    C:\Program Files\America Online 8.0\aoltray.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqgalry.exe
    C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe
    C:\Program Files\Greetings Workshop\GWREMIND.EXE
    C:\Program Files\AOL Companion\companion.exe
    C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
    C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
    C:\Program Files\Java\jre1.6.0_03\bin\jucheck.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    C:\WINDOWS\System32\wbem\wmiprvse.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us9.hpwis.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
    F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\Userinit.exe
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
    O2 - BHO: (no name) - {db41de82-1dd1-11b2-b7fd-fbaf280c36b9} - C:\WINDOWS\bglgtuju.dll
    O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\HPDTLK02.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
    O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe
    O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
    O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
    O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
    O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [AutoTKit] C:\hp\bin\AUTOTKIT.EXE
    O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
    O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe
    O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe "
    O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
    O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
    O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\McAfee.com\Agent\McUpdate.exe
    O4 - HKLM\..\Run: [MCAgentExe] C:\PROGRA~1\McAfee.com\Agent\McAgent.exe
    O4 - HKLM\..\Run: [SoftwareStation] "C:\Program Files\eAcceleration\Station\station.exe" /b Startup
    O4 - HKLM\..\Run: [StopSignSsTsMon] Rundll32.exe "C:\Program Files\Acceleration Software\Anti-Virus\sstsmon.dll ",VerifyStatus
    O4 - HKLM\..\Run: [webscan] "C:\Program Files\Acceleration Software\Anti-Virus\stopsignav.exe" -k
    O4 - HKLM\..\Run: [StopSignSsFwMon] Rundll32.exe "C:\Program Files\eAcceleration\Firewall\ssfwmon.dll ",VerifyStatus
    O4 - HKLM\..\Run: [HPHUPD06] C:\Program Files\Hewlett-Packard\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
    O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe "
    O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe "
    O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\System32\hphmon06.exe
    O4 - HKLM\..\Run: [StopSignSsSsMon] Rundll32.exe "C:\Program Files\Acceleration Software\Anti-Virus\ssssmon.dll ",VerifyStatus
    O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe "
    O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe "
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe "
    O4 - HKLM\..\Run: [ZangoOE] C:\Program Files\Zango\bin\10.0.370.0\OEAddOn.exe
    O4 - HKLM\..\Run: [ZangoSA] "C:\Program Files\Zango\bin\10.0.370.0\ZangoSA.exe "
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
    O4 - HKLM\..\Run: [XP Advanced Keylogger] C:\Program Files\XP Advanced Keylogger\ToolKeylogger.exe
    O4 - HKLM\..\Run: [OnAccess] "C:\Program Files\eAcceleration\OnAccess\onaccess.exe" -erk
    O4 - HKLM\..\Run: [ctfmon] "c:\documents and settings\all users\_qbothome\_qbotinj.exe" "c:\documents and settings\all users\_qbothome\_qbot.dll "
    O4 - HKLM\..\Run: [78d2b5e2] rundll32.exe "C:\WINDOWS\System32\mmaxsbuh.dll ",b
    O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe "
    O4 - HKLM\..\RunOnce: [StopSignSsTsMon] Rundll32.exe "C:\Program Files\Acceleration Software\Anti-Virus\sstsmon.dll ",VerifyStatus /ro
    O4 - HKLM\..\RunOnce: [StopSignSsFwMon] Rundll32.exe "C:\Program Files\eAcceleration\Firewall\ssfwmon.dll ",VerifyStatus /ro
    O4 - HKLM\..\RunOnce: [StopSignSsSsMon] Rundll32.exe "C:\Program Files\Acceleration Software\Anti-Virus\ssssmon.dll ",VerifyStatus /ro
    O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\Hewlett-Packard\Digital Imaging\bin\backupnotify.exe
    O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
    O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
    O4 - HKCU\..\Run: [Jfw] C:\WINDOWS\?icrosoft\?ttrib.exe
    O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
    O4 - HKCU\..\Run: [ITCHCURB] C:\DOCUME~1\Owner\APPLIC~1\INSIDE~1\Bat okay.exe
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
    O4 - HKCU\..\Run: [Notn] "C:\PROGRA~1\CROSOF~1\dexplore.exe" -vt yazb
    O4 - HKCU\..\Run: [QdrModule15] "C:\Program Files\QdrModule\QdrModule15.exe "
    O4 - HKCU\..\Run: [QdrPack15] "C:\Program Files\QdrPack\QdrPack15.exe "
    O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
    O4 - S-1-5-21-4060356480-3532442688-3890861542-1008 Startup: AutoTBar.exe (User 'LogMeInRemoteUser')
    O4 - S-1-5-21-4060356480-3532442688-3890861542-1008 Startup: HP Organize.lnk = ? (User 'LogMeInRemoteUser')
    O4 - S-1-5-21-4060356480-3532442688-3890861542-1008 Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'LogMeInRemoteUser')
    O4 - S-1-5-21-4060356480-3532442688-3890861542-1008 Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE (User 'LogMeInRemoteUser')
    O4 - S-1-5-21-4060356480-3532442688-3890861542-1008 Startup: spamsubtract.lnk = C:\Program Files\interMute\SpamSubtract\SpamSubtract.exe (User 'LogMeInRemoteUser')
    O4 - S-1-5-21-4060356480-3532442688-3890861542-1008 User Startup: AutoTBar.exe (User 'LogMeInRemoteUser')
    O4 - S-1-5-21-4060356480-3532442688-3890861542-1008 User Startup: HP Organize.lnk = ? (User 'LogMeInRemoteUser')
    O4 - S-1-5-21-4060356480-3532442688-3890861542-1008 User Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'LogMeInRemoteUser')
    O4 - S-1-5-21-4060356480-3532442688-3890861542-1008 User Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE (User 'LogMeInRemoteUser')
    O4 - S-1-5-21-4060356480-3532442688-3890861542-1008 User Startup: spamsubtract.lnk = C:\Program Files\interMute\SpamSubtract\SpamSubtract.exe (User 'LogMeInRemoteUser')
    O4 - S-1-5-18 Startup: AutoTBar.exe (User 'SYSTEM')
    O4 - S-1-5-18 Startup: HP Organize.lnk = ? (User 'SYSTEM')
    O4 - S-1-5-18 Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'SYSTEM')
    O4 - S-1-5-18 Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE (User 'SYSTEM')
    O4 - S-1-5-18 Startup: spamsubtract.lnk = C:\Program Files\interMute\SpamSubtract\SpamSubtract.exe (User 'SYSTEM')
    O4 - .DEFAULT Startup: AutoTBar.exe (User 'Default user')
    O4 - .DEFAULT Startup: HP Organize.lnk = ? (User 'Default user')
    O4 - .DEFAULT Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'Default user')
    O4 - .DEFAULT Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE (User 'Default user')
    O4 - .DEFAULT Startup: spamsubtract.lnk = C:\Program Files\interMute\SpamSubtract\SpamSubtract.exe (User 'Default user')
    O4 - .DEFAULT User Startup: AutoTBar.exe (User 'Default user')
    O4 - .DEFAULT User Startup: HP Organize.lnk = ? (User 'Default user')
    O4 - .DEFAULT User Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'Default user')
    O4 - .DEFAULT User Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE (User 'Default user')
    O4 - .DEFAULT User Startup: spamsubtract.lnk = C:\Program Files\interMute\SpamSubtract\SpamSubtract.exe (User 'Default user')
    O4 - Startup: Greetings Workshop Reminders.lnk = C:\Program Files\Greetings Workshop\GWREMIND.EXE
    O4 - Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
    O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
    O4 - Startup: PowerReg Scheduler.exe
    O4 - Global Startup: America Online 8.0 Tray Icon.lnk = C:\Program Files\America Online 8.0\aoltray.exe
    O4 - Global Startup: AOL Companion.lnk = C:\Program Files\AOL Companion\companion.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
    O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqthb08.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
    O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
    O4 - Global Startup: Updates from HP.lnk = C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O16 - DPF: {15589FA1-C456-11CE-BF01-00AA0055595A} - http://w4s2.work4sure.com/c/ge/w4sgeen9.exe
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/RACtrl.cab
    O23 - Service: FWService - eAcceleration Corp. - C:\Program Files\eAcceleration\Firewall\FWService.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\RaMaint.exe
    O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\LogMeIn.exe
    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: Softex OmniPass Service (omniserv) - Unknown owner - C:\Program Files\Softex\OmniPass\Omniserv.exe
    O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
    O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

    --
    End of file - 15738 bytes
     
    covian,
    #7
  9. 2008/04/14
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Lots of progress! :)

    Did you install the program XP Advanced Keylogger?


    Scan again with HijackThis and place a check next to each of the following entries.

    O2 - BHO: (no name) - {db41de82-1dd1-11b2-b7fd-fbaf280c36b9} - C:\WINDOWS\bglgtuju.dll
    O4 - HKLM\..\Run: [ZangoOE] C:\Program Files\Zango\bin\10.0.370.0\OEAddOn.exe
    O4 - HKLM\..\Run: [ZangoSA] "C:\Program Files\Zango\bin\10.0.370.0\ZangoSA.exe "
    O4 - HKLM\..\Run: [ctfmon] "c:\documents and settings\all users\_qbothome\_qbotinj.exe" "c:\documents and settings\all users\_qbothome\_qbot.dll "
    O4 - HKLM\..\Run: [78d2b5e2] rundll32.exe "C:\WINDOWS\System32\mmaxsbuh.dll ",b
    O4 - HKCU\..\Run: [Jfw] C:\WINDOWS\?icrosoft\?ttrib.exe
    O4 - HKCU\..\Run: [ITCHCURB] C:\DOCUME~1\Owner\APPLIC~1\INSIDE~1\Bat okay.exe
    O4 - HKCU\..\Run: [Notn] "C:\PROGRA~1\CROSOF~1\dexplore.exe" -vt yazb
    O4 - HKCU\..\Run: [QdrModule15] "C:\Program Files\QdrModule\QdrModule15.exe "
    O4 - HKCU\..\Run: [QdrPack15] "C:\Program Files\QdrPack\QdrPack15.exe "
    O4 - S-1-5-21-4060356480-3532442688-3890861542-1008 Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE (User 'LogMeInRemoteUser')
    O4 - S-1-5-21-4060356480-3532442688-3890861542-1008 User Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE (User 'LogMeInRemoteUser')
    O4 - S-1-5-18 Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE (User 'SYSTEM')
    O4 - .DEFAULT Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE (User 'Default user')
    O4 - .DEFAULT User Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE (User 'Default user')
    O4 - Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
    O4 - Startup: PowerReg Scheduler.exe
    O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
    O16 - DPF: {15589FA1-C456-11CE-BF01-00AA0055595A} - http://w4s2.work4sure.com/c/ge/w4sgeen9.exe


    Now close all other windows then click Fix Checked. Close HijackThis.


    Download Deckard's System Scanner (dss.exe) and save it to your desktop.
    • Close all applications and windows.
    • Double click on dss.exe to run it and follow the prompts.
    • When the scan is complete, two text files will open; main.txt, which will be maximized and extra.txt, which will be minimized.
    Post the contents of logs. You will likely need to put them in separate posts due to character count limitations.
     
    noahdfear,
    #8
  10. 2008/04/16
    covian

    covian Inactive Thread Starter

    Joined:
    2008/03/30
    Messages:
    22
    Likes Received:
    0
    I put the keylogger there.




    Deckard's System Scanner v20071014.68
    Run by Owner on 2008-04-16 11:24:00
    Computer is in Normal Mode.
    --------------------------------------------------------------------------------

    -- System Restore --------------------------------------------------------------

    Successfully created a Deckard's System Scanner Restore Point.


    -- Last 5 Restore Point(s) --
    92: 2008-04-16 15:24:06 UTC - RP423 - Deckard's System Scanner Restore Point
    91: 2008-04-15 18:53:38 UTC - RP422 - System Checkpoint
    90: 2008-04-14 16:54:47 UTC - RP421 - Installed Windows XP Service Pack 2.
    89: 2008-04-14 16:31:21 UTC - RP420 - Software Distribution Service 3.0
    88: 2008-04-14 16:19:36 UTC - RP419 - Configured easy Internet sign-up


    -- First Restore Point --
    1: 2008-04-13 21:39:33 UTC - RP332 - System Checkpoint


    Backed up registry hives.
    Performed disk cleanup.

    Total Physical Memory: 504 MiB (512 MiB recommended).


    -- HijackThis (run as Owner.exe) -----------------------------------------------

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 11:25:28 AM, on 4/16/2008
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2800.1106)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\alg.exe
    C:\Program Files\eAcceleration\Firewall\FWService.exe
    C:\Program Files\LogMeIn\x86\RaMaint.exe
    C:\Program Files\LogMeIn\x86\LogMeIn.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\Program Files\Softex\OmniPass\Omniserv.exe
    C:\Program Files\Spyware Doctor\sdhelp.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\wdfmgr.exe
    C:\WINDOWS\wanmpsvc.exe
    C:\Program Files\Softex\OmniPass\OPXPApp.exe
    C:\WINDOWS\Explorer.EXE
    C:\windows\system\hpsysdrv.exe
    C:\WINDOWS\System32\hkcmd.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
    C:\WINDOWS\System32\hphmon05.exe
    C:\HP\KBD\KBD.EXE
    C:\Program Files\Multimedia Card Reader\shwicon2k.exe
    C:\Program Files\eAcceleration\Station\station.exe
    C:\Program Files\Acceleration Software\Anti-Virus\stopsignav.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
    C:\WINDOWS\System32\hphmon06.exe
    C:\WINDOWS\ALCXMNTR.EXE
    C:\WINDOWS\System32\igfxtray.exe
    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
    C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\eAcceleration\OnAccess\onaccess.exe
    C:\Program Files\LogMeIn\x86\LogMeInSystray.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\WINDOWS\System32\ctfmon.exe
    C:\Program Files\AIM6\aim6.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\Program Files\AIM6\aolsoftware.exe
    C:\WINDOWS\System32\wuauclt.exe
    C:\Program Files\Java\jre1.6.0_03\bin\jucheck.exe
    C:\Program Files\AOL Companion\companion.exe
    C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe
    C:\Program Files\Greetings Workshop\GWREMIND.EXE
    C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
    C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
    C:\Program Files\LogMeIn\x86\LogMeIn.exe
    C:\Documents and Settings\Owner\Desktop\dss.exe
    C:\WINDOWS\System32\wbem\wmiprvse.exe
    C:\PROGRA~1\TRENDM~1\HIJACK~1\Owner.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us9.hpwis.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
    F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\Userinit.exe
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
    O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\HPDTLK02.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
    O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe
    O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
    O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
    O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
    O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [AutoTKit] C:\hp\bin\AUTOTKIT.EXE
    O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
    O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe
    O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe "
    O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
    O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\McAfee.com\Agent\McUpdate.exe
    O4 - HKLM\..\Run: [MCAgentExe] C:\PROGRA~1\McAfee.com\Agent\McAgent.exe
    O4 - HKLM\..\Run: [SoftwareStation] "C:\Program Files\eAcceleration\Station\station.exe" /b Startup
    O4 - HKLM\..\Run: [StopSignSsTsMon] Rundll32.exe "C:\Program Files\Acceleration Software\Anti-Virus\sstsmon.dll ",VerifyStatus
    O4 - HKLM\..\Run: [webscan] "C:\Program Files\Acceleration Software\Anti-Virus\stopsignav.exe" -k
    O4 - HKLM\..\Run: [StopSignSsFwMon] Rundll32.exe "C:\Program Files\eAcceleration\Firewall\ssfwmon.dll ",VerifyStatus
    O4 - HKLM\..\Run: [HPHUPD06] C:\Program Files\Hewlett-Packard\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
    O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe "
     
    covian,
    #9
  11. 2008/04/16
    covian

    covian Inactive Thread Starter

    Joined:
    2008/03/30
    Messages:
    22
    Likes Received:
    0
    O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe "
    O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\System32\hphmon06.exe
    O4 - HKLM\..\Run: [StopSignSsSsMon] Rundll32.exe "C:\Program Files\Acceleration Software\Anti-Virus\ssssmon.dll ",VerifyStatus
    O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe "
    O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe "
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe "
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
    O4 - HKLM\..\Run: [OnAccess] "C:\Program Files\eAcceleration\OnAccess\onaccess.exe" -erk
    O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe "
    O4 - HKLM\..\RunOnce: [StopSignSsTsMon] Rundll32.exe "C:\Program Files\Acceleration Software\Anti-Virus\sstsmon.dll ",VerifyStatus /ro
    O4 - HKLM\..\RunOnce: [StopSignSsFwMon] Rundll32.exe "C:\Program Files\eAcceleration\Firewall\ssfwmon.dll ",VerifyStatus /ro
    O4 - HKLM\..\RunOnce: [StopSignSsSsMon] Rundll32.exe "C:\Program Files\Acceleration Software\Anti-Virus\ssssmon.dll ",VerifyStatus /ro
    O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\Hewlett-Packard\Digital Imaging\bin\backupnotify.exe
    O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
    O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
    O4 - HKCU\..\Run: [Jfw] C:\WINDOWS\?icrosoft\?ttrib.exe
    O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
    O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
    O4 - S-1-5-21-4060356480-3532442688-3890861542-1008 Startup: AutoTBar.exe (User 'LogMeInRemoteUser')
    O4 - S-1-5-21-4060356480-3532442688-3890861542-1008 Startup: HP Organize.lnk = ? (User 'LogMeInRemoteUser')
    O4 - S-1-5-21-4060356480-3532442688-3890861542-1008 Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'LogMeInRemoteUser')
    O4 - S-1-5-21-4060356480-3532442688-3890861542-1008 Startup: spamsubtract.lnk = C:\Program Files\interMute\SpamSubtract\SpamSubtract.exe (User 'LogMeInRemoteUser')
    O4 - S-1-5-21-4060356480-3532442688-3890861542-1008 User Startup: AutoTBar.exe (User 'LogMeInRemoteUser')
    O4 - S-1-5-21-4060356480-3532442688-3890861542-1008 User Startup: HP Organize.lnk = ? (User 'LogMeInRemoteUser')
    O4 - S-1-5-21-4060356480-3532442688-3890861542-1008 User Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'LogMeInRemoteUser')
    O4 - S-1-5-21-4060356480-3532442688-3890861542-1008 User Startup: spamsubtract.lnk = C:\Program Files\interMute\SpamSubtract\SpamSubtract.exe (User 'LogMeInRemoteUser')
    O4 - S-1-5-18 Startup: AutoTBar.exe (User 'SYSTEM')
    O4 - S-1-5-18 Startup: HP Organize.lnk = ? (User 'SYSTEM')
    O4 - S-1-5-18 Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'SYSTEM')
    O4 - S-1-5-18 Startup: spamsubtract.lnk = C:\Program Files\interMute\SpamSubtract\SpamSubtract.exe (User 'SYSTEM')
    O4 - .DEFAULT Startup: AutoTBar.exe (User 'Default user')
    O4 - .DEFAULT Startup: HP Organize.lnk = ? (User 'Default user')
    O4 - .DEFAULT Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'Default user')
    O4 - .DEFAULT Startup: spamsubtract.lnk = C:\Program Files\interMute\SpamSubtract\SpamSubtract.exe (User 'Default user')
    O4 - .DEFAULT User Startup: AutoTBar.exe (User 'Default user')
    O4 - .DEFAULT User Startup: HP Organize.lnk = ? (User 'Default user')
    O4 - .DEFAULT User Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'Default user')
    O4 - .DEFAULT User Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE (User 'Default user')
    O4 - .DEFAULT User Startup: spamsubtract.lnk = C:\Program Files\interMute\SpamSubtract\SpamSubtract.exe (User 'Default user')
    O4 - Startup: Greetings Workshop Reminders.lnk = C:\Program Files\Greetings Workshop\GWREMIND.EXE
    O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
    O4 - Global Startup: America Online 8.0 Tray Icon.lnk = C:\Program Files\America Online 8.0\aoltray.exe
    O4 - Global Startup: AOL Companion.lnk = C:\Program Files\AOL Companion\companion.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
    O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqthb08.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
    O4 - Global Startup: Updates from HP.lnk = C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/RACtrl.cab
    O23 - Service: FWService - eAcceleration Corp. - C:\Program Files\eAcceleration\Firewall\FWService.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\RaMaint.exe
    O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\LogMeIn.exe
    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: Softex OmniPass Service (omniserv) - Unknown owner - C:\Program Files\Softex\OmniPass\Omniserv.exe
    O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
    O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

    --
    End of file - 13392 bytes

    -- HijackThis Fixed Entries (C:\PROGRA~1\TRENDM~1\HIJACK~1\backups\) -----------

    backup-20080330-093705-292 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us9.hpwis.com/
    backup-20080416-112010-121 O4 - HKLM\..\Run: [78d2b5e2] rundll32.exe "C:\WINDOWS\System32\mmaxsbuh.dll ",b
    backup-20080416-112010-132 O4 - HKLM\..\Run: [ZangoOE] C:\Program Files\Zango\bin\10.0.370.0\OEAddOn.exe
    backup-20080416-112010-211 O4 - HKCU\..\Run: [QdrModule15] "C:\Program Files\QdrModule\QdrModule15.exe "
    backup-20080416-112010-217 O4 - Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
    backup-20080416-112010-277 O2 - BHO: (no name) - {db41de82-1dd1-11b2-b7fd-fbaf280c36b9} - C:\WINDOWS\bglgtuju.dll
    backup-20080416-112010-307 O4 - HKLM\..\Run: [ctfmon] "c:\documents and settings\all users\_qbothome\_qbotinj.exe" "c:\documents and settings\all users\_qbothome\_qbot.dll "
    backup-20080416-112010-409 O4 - HKCU\..\Run: [QdrPack15] "C:\Program Files\QdrPack\QdrPack15.exe "
    backup-20080416-112010-460 O4 - S-1-5-18 Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE (User 'SYSTEM')
    backup-20080416-112010-800 O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
    backup-20080416-112010-826 O4 - S-1-5-21-4060356480-3532442688-3890861542-1008 Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE (User 'LogMeInRemoteUser')
    backup-20080416-112010-828 O4 - .DEFAULT Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE (User 'Default user')
    backup-20080416-112010-861 O4 - Startup: PowerReg Scheduler.exe
    backup-20080416-112010-912 O4 - HKLM\..\Run: [ZangoSA] "C:\Program Files\Zango\bin\10.0.370.0\ZangoSA.exe "
    backup-20080416-112010-942 O4 - .DEFAULT User Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE (User 'Default user')
    backup-20080416-112010-944 O4 - HKCU\..\Run: [ITCHCURB] C:\DOCUME~1\Owner\APPLIC~1\INSIDE~1\Bat okay.exe
    backup-20080416-112010-999 O4 - S-1-5-21-4060356480-3532442688-3890861542-1008 User Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE (User 'LogMeInRemoteUser')
    backup-20080416-112115-148 O16 - DPF: {15589FA1-C456-11CE-BF01-00AA0055595A} - http://w4s2.work4sure.com/c/ge/w4sgeen9.exe

    -- File Associations -----------------------------------------------------------

    .cpl - cplfile - shell\cplopen\command - rundll32.exe shell32.dll,Control_RunDLL "%1 ",%*
    .cpl - cplfile - shell\runas\command - rundll32.exe shell32.dll,Control_RunDLLAsUser "%1 ",%*
    .reg - regfile - shell\open\command - regedit.exe "%1" %*
    .scr - scrfile - shell\open\command - "%1" %*


    -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

    R3 pfc (Padus ASPI Shell) - c:\windows\system32\drivers\pfc.sys <Not Verified; Padus, Inc.; Padus(R) ASPI Shell>
    R3 SunkFilt (Alcor Micro Corp - 9360) - c:\windows\system32\drivers\sunkfilt.sys <Not Verified; Alcor Micro Corp.; SunkFilt>

    S3 catchme - c:\docume~1\owner\locals~1\temp\catchme.sys (file missing)
    S3 Sunkfiltp (HP && Alcor Micro Corp for Phison) - c:\windows\system32\drivers\sunkfiltp.sys (file missing)


    -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

    All services whitelisted.


    -- Device Manager: Disabled ----------------------------------------------------

    No disabled devices found.


    -- Scheduled Tasks -------------------------------------------------------------

    2008-04-16 11:00:00 260 --ah----- C:\WINDOWS\Tasks\874237A78325AAB3.job
    2008-04-07 07:30:02 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job


    -- Files created between 2008-03-16 and 2008-04-16 -----------------------------

    2008-04-14 12:51:55 1689600 --a------ C:\WINDOWS\System32\d3d9.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
    2008-04-14 12:51:54 1769472 --a------ C:\WINDOWS\System32\dxdiagn.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
    2008-04-14 12:51:52 183808 --a------ C:\WINDOWS\System32\ir50_qcx.dll <Not Verified; Intel Corporation.; Intel Indeo® video 5.10 Quick Compressor>
    2008-04-14 12:51:52 200192 --a------ C:\WINDOWS\System32\ir50_qc.dll <Not Verified; Intel Corporation.; Intel Indeo® video 5.10 Quick Compressor>
    2008-04-14 12:51:52 755200 --a------ C:\WINDOWS\System32\ir50_32.dll <Not Verified; Intel Corporation; Intel Indeo® video 5.10>
    2008-04-14 12:51:52 338432 --a------ C:\WINDOWS\System32\ir41_qcx.dll <Not Verified; Intel Corporation.; Intel Indeo® Video Interactive Quick Compressor>
    2008-04-14 12:51:52 120320 --a------ C:\WINDOWS\System32\ir41_qc.dll <Not Verified; Intel Corporation.; Intel Indeo® Video Interactive Quick Compressor>
    2008-04-14 12:51:17 166912 --a------ C:\WINDOWS\System32\encdec.dll
    2008-04-14 12:51:15 219136 --a------ C:\WINDOWS\System32\sbe.dll
    2008-04-14 12:51:15 7680 --a------ C:\WINDOWS\System32\bitsprx2.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
    2008-04-14 12:51:14 361984 --a------ C:\WINDOWS\System32\qmgr.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
    2008-04-14 12:51:12 331776 --a------ C:\WINDOWS\System32\winhttp.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
    2008-04-14 12:51:12 7168 --a------ C:\WINDOWS\System32\bitsprx3.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
    2008-04-14 12:49:34 77824 --a------ C:\WINDOWS\System32\dpmodemx.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
    2008-04-14 12:49:33 381952 --a------ C:\WINDOWS\System32\dpvoice.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
    2008-04-14 12:49:33 723968 --a------ C:\WINDOWS\System32\dpnet.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
    2008-04-14 12:49:32 491520 --a------ C:\WINDOWS\System32\dsdmoprp.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
    2008-04-14 12:49:25 593408 --a------ C:\WINDOWS\System32\h323msp.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
    2008-04-14 12:49:21 596480 --a------ C:\WINDOWS\System32\inetcomm.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
    2008-04-14 12:49:20 47616 --a------ C:\WINDOWS\System32\inetres.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
    2008-04-14 12:49:17 439808 --a------ C:\WINDOWS\System32\ipnathlp.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
    2008-04-14 12:49:05 51712 --a------ C:\WINDOWS\System32\msasn1.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
    2008-04-14 12:49:02 971264 --a------ C:\WINDOWS\System32\msgina.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
    2008-04-14 12:49:00 230400 --a------ C:\WINDOWS\System32\msieftp.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
    2008-04-14 12:49:00 44032 --a------ C:\WINDOWS\System32\msident.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
    2008-04-14 12:48:59 91136 --a------ C:\WINDOWS\System32\msoert2.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
    2008-04-14 12:48:59 229376 --a------ C:\WINDOWS\System32\msoeacct.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
    2008-04-14 12:48:56 324096 --a------ C:\WINDOWS\System32\mswebdvd.dll <Not Verified; Microsoft Corporation; DirectShow>
    2008-04-14 12:48:47 1798144 --a------ C:\WINDOWS\System32\qedit.dll
    2008-04-14 12:48:47 257024 --a------ C:\WINDOWS\System32\qcap.dll
    2008-04-14 12:48:46 17408 --a------ C:\WINDOWS\System32\qmgrprxy.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
    2008-04-14 12:48:29 226816 --a------ C:\WINDOWS\System32\srrstr.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
    2008-04-14 12:48:00 136704 --a------ C:\WINDOWS\System32\schannel.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
    2008-04-14 12:47:56 50816 --a------ C:\WINDOWS\System32\drivers\1394bus.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
    2008-04-14 12:47:55 87040 --a------ C:\WINDOWS\System32\drivers\atapi.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
    2008-04-14 12:47:47 12400 --a------ C:\WINDOWS\System32\drivers\secdrv.sys <Not Verified; Macrovision Europe Ltd; Security Windows NT>
    2008-04-14 12:47:45 64000 --a------ C:\WINDOWS\System32\drivers\udfs.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
    2008-04-14 12:47:37 548352 --a------ C:\WINDOWS\System32\rtcdll.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
    2008-04-14 11:40:19 0 d-------- C:\Documents and Settings\Owner\Application Data\Malwarebytes
    2008-04-14 11:40:10 0 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-04-14 11:40:09 0 d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-04-14 11:21:27 91392 --a------ C:\Documents and Settings\LogMeInRemoteUser\Application Data\GDIPFONTCACHEV1.DAT
    2008-04-14 11:08:24 0 d-------- C:\Documents and Settings\LogMeInRemoteUser\Application Data\AdobeUM
    2008-04-14 11:08:24 0 d-------- C:\Documents and Settings\LogMeInRemoteUser\Application Data\Adobe
    2008-04-14 11:08:24 0 d-------- C:\Documents and Settings\LogMeInRemoteUser\.jpi_cache
    2008-04-14 11:08:24 0 d-------- C:\Documents and Settings\LogMeInRemoteUser\.java
    2008-04-14 11:08:23 0 d-------- C:\Documents and Settings\LogMeInRemoteUser\Application Data\Macromedia
    2008-04-14 11:08:23 0 d-------- C:\Documents and Settings\LogMeInRemoteUser\Application Data\Lycos
    2008-04-14 11:08:23 0 d-------- C:\Documents and Settings\LogMeInRemoteUser\Application Data\Kontiki
    2008-04-14 11:08:23 0 d-------- C:\Documents and Settings\LogMeInRemoteUser\Application Data\Intuit
    2008-04-14 11:08:23 0 d-------- C:\Documents and Settings\LogMeInRemoteUser\Application Data\InterVideo
    2008-04-14 11:08:23 0 d-------- C:\Documents and Settings\LogMeInRemoteUser\Application Data\interMute
    2008-04-14 11:08:23 0 d-------- C:\Documents and Settings\LogMeInRemoteUser\Application Data\Identities
    2008-04-14 11:08:23 0 d-------- C:\Documents and Settings\LogMeInRemoteUser\Application Data\HP
    2008-04-14 11:08:23 0 d-------- C:\Documents and Settings\LogMeInRemoteUser\Application Data\Help
    2008-04-14 11:08:23 0 d--h----- C:\Documents and Settings\LogMeInRemoteUser\Application Data\GTek
    2008-04-14 11:08:23 0 d-------- C:\Documents and Settings\LogMeInRemoteUser\Application Data\ArcSoft
    2008-04-14 11:08:23 0 d-------- C:\Documents and Settings\LogMeInRemoteUser\Application Data\AOL
    2008-04-14 11:08:23 0 d-------- C:\Documents and Settings\LogMeInRemoteUser\Application Data\Aim
    2008-04-14 11:08:22 0 d-------- C:\Documents and Settings\LogMeInRemoteUser\Favorites
    2008-04-14 11:08:22 0 d-------- C:\Documents and Settings\LogMeInRemoteUser\Desktop
    2008-04-14 11:08:22 0 d---s---- C:\Documents and Settings\LogMeInRemoteUser\Cookies
    2008-04-14 11:08:22 0 dr-h----- C:\Documents and Settings\LogMeInRemoteUser\Application Data
    2008-04-14 11:08:22 0 d-------- C:\Documents and Settings\LogMeInRemoteUser\Application Data\You've Got Pictures Screensaver
    2008-04-14 11:08:22 0 d-------- C:\Documents and Settings\LogMeInRemoteUser\Application Data\WeatherBug
    2008-04-14 11:08:22 0 d-------- C:\Documents and Settings\LogMeInRemoteUser\Application Data\Viewpoint
    2008-04-14 11:08:22 0 d-------- C:\Documents and Settings\LogMeInRemoteUser\Application Data\Template
    2008-04-14 11:08:22 0 d-------- C:\Documents and Settings\LogMeInRemoteUser\Application Data\Symantec
    2008-04-14 11:08:22 0 d-------- C:\Documents and Settings\LogMeInRemoteUser\Application Data\Sonic
    2008-04-14 11:08:22 0 d-------- C:\Documents and Settings\LogMeInRemoteUser\Application Data\SampleView
    2008-04-14 11:08:22 0 d-------- C:\Documents and Settings\LogMeInRemoteUser\Application Data\Real
    2008-04-14 11:08:22 0 d-------- C:\Documents and Settings\LogMeInRemoteUser\Application Data\Musicmatch
    2008-04-14 11:08:22 0 d-------- C:\Documents and Settings\LogMeInRemoteUser\Application Data\Motive
    2008-04-14 11:08:22 0 d---s---- C:\Documents and Settings\LogMeInRemoteUser\Application Data\Microsoft
    2008-04-14 11:08:21 0 d--h----- C:\Documents and Settings\LogMeInRemoteUser\Local Settings
    2008-04-14 11:08:18 0 d-------- C:\Documents and Settings\LogMeInRemoteUser\My Documents
    2008-04-14 11:08:17 0 d-------- C:\Documents and Settings\LogMeInRemoteUser\WINDOWS
    2008-04-14 11:08:17 0 d---s---- C:\Documents and Settings\LogMeInRemoteUser\UserData
    2008-04-14 11:08:17 0 d--h----- C:\Documents and Settings\LogMeInRemoteUser\Templates
    2008-04-14 11:08:17 0 dr------- C:\Documents and Settings\LogMeInRemoteUser\Start Menu
    2008-04-14 11:08:17 0 dr-h----- C:\Documents and Settings\LogMeInRemoteUser\SendTo
    2008-04-14 11:08:17 0 d--h----- C:\Documents and Settings\LogMeInRemoteUser\Recent
    2008-04-14 11:08:17 0 d--h----- C:\Documents and Settings\LogMeInRemoteUser\PrintHood
    2008-04-14 11:08:17 262144 --ah----- C:\Documents and Settings\LogMeInRemoteUser\NTUSER.DAT
    2008-04-14 11:08:17 0 d--h----- C:\Documents and Settings\LogMeInRemoteUser\NetHood
    2008-04-14 06:41:03 0 d--hs---- C:\found.000
    2008-04-13 22:12:36 0 d-------- C:\Program Files\LogMeIn
    2008-04-13 20:03:43 68096 --a------ C:\WINDOWS\zip.exe
    2008-04-13 20:03:43 49152 --a------ C:\WINDOWS\VFind.exe
    2008-04-13 20:03:43 212480 --a------ C:\WINDOWS\swxcacls.exe <Not Verified; SteelWerX; SteelWerX Extended Configurator ACLists>
    2008-04-13 20:03:43 136704 --a------ C:\WINDOWS\swsc.exe <Not Verified; SteelWerX; SteelWerX Service Controller>
    2008-04-13 20:03:43 161792 --a------ C:\WINDOWS\swreg.exe <Not Verified; SteelWerX; SteelWerX Registry Editor>
    2008-04-13 20:03:43 98816 --a------ C:\WINDOWS\sed.exe
    2008-04-13 20:03:43 80412 --a------ C:\WINDOWS\grep.exe
    2008-04-13 20:03:43 73728 --a------ C:\WINDOWS\fdsv.exe <Not Verified; Smallfrogs Studio; >
    2008-04-13 17:35:54 0 d-------- C:\Documents and Settings\LocalService\Application Data\Macromedia
    2008-04-13 17:35:53 0 d-------- C:\Documents and Settings\LocalService\Application Data\Adobe
    2008-04-13 17:35:47 0 d-------- C:\Documents and Settings\LocalService\Application Data\Google
    2008-04-13 17:35:42 0 d-------- C:\Documents and Settings\All Users\Application Data\dktofqxe
    2008-04-13 17:35:40 0 d-------- C:\WINDOWS\cuawsppw
    2008-04-13 17:35:39 196096 --a------ C:\WINDOWS\glypoxkj.dll
    2008-04-13 17:35:39 70144 --a------ C:\Documents and Settings\All Users\Application Data\ahadypex.dll
    2008-03-30 12:50:28 1126 --a------ C:\WINDOWS\mozver.dat
    2008-03-30 10:48:54 25600 --a------ C:\WINDOWS\System32\WS2Fix.exe
    2008-03-30 10:48:54 289144 --a------ C:\WINDOWS\System32\VCCLSID.exe <Not Verified; S!Ri; >
    2008-03-30 10:48:54 86528 --a------ C:\WINDOWS\System32\VACFix.exe <Not Verified; S!Ri.URZ; VACFix>
    2008-03-30 10:48:54 288417 --a------ C:\WINDOWS\System32\SrchSTS.exe <Not Verified; S!Ri; SrchSTS>
    2008-03-30 10:48:54 53248 --a------ C:\WINDOWS\System32\Process.exe <Not Verified; http://www.beyondlogic.org; Command Line Process Utility>
    2008-03-30 10:48:54 82432 --a------ C:\WINDOWS\System32\IEDFix.exe <Not Verified; S!Ri.URZ; IEDFix>
    2008-03-30 10:48:54 51200 --a------ C:\WINDOWS\System32\dumphive.exe
    2008-03-30 10:17:03 0 d-------- C:\Documents and Settings\Administrator.DESKTOP\Application Data\AdobeUM
    2008-03-30 10:17:03 0 d-------- C:\Documents and Settings\Administrator.DESKTOP\Application Data\Adobe
    2008-03-30 10:17:03 0 d-------- C:\Documents and Settings\Administrator.DESKTOP\.jpi_cache
    2008-03-30 10:17:03 0 d-------- C:\Documents and Settings\Administrator.DESKTOP\.java
    2008-03-30 10:17:02 0 d-------- C:\Documents and Settings\Administrator.DESKTOP\Application Data\Lycos
    2008-03-30 10:17:02 0 d-------- C:\Documents and Settings\Administrator.DESKTOP\Application Data\Kontiki
    2008-03-30 10:17:02 0 d-------- C:\Documents and Settings\Administrator.DESKTOP\Application Data\Intuit
    2008-03-30 10:17:02 0 d-------- C:\Documents and Settings\Administrator.DESKTOP\Application Data\InterVideo
    2008-03-30 10:17:02 0 d-------- C:\Documents and Settings\Administrator.DESKTOP\Application Data\interMute
    2008-03-30 10:17:02 0 d-------- C:\Documents and Settings\Administrator.DESKTOP\Application Data\Identities
    2008-03-30 10:17:02 0 d-------- C:\Documents and Settings\Administrator.DESKTOP\Application Data\HP
    2008-03-30 10:17:02 0 d-------- C:\Documents and Settings\Administrator.DESKTOP\Application Data\Help
    2008-03-30 10:17:02 0 d--h----- C:\Documents and Settings\Administrator.DESKTOP\Application Data\GTek
    2008-03-30 10:17:02 0 d-------- C:\Documents and Settings\Administrator.DESKTOP\Application Data\ArcSoft
    2008-03-30 10:17:02 0 d-------- C:\Documents and Settings\Administrator.DESKTOP\Application Data\AOL
    2008-03-30 10:17:02 0 d-------- C:\Documents and Settings\Administrator.DESKTOP\Application Data\Aim
    2008-03-30 10:17:01 0 d-------- C:\Documents and Settings\Administrator.DESKTOP\Application Data\Macromedia
    2008-03-30 10:17:00 0 d-------- C:\Documents and Settings\Administrator.DESKTOP\Favorites
    2008-03-30 10:17:00 0 d-------- C:\Documents and Settings\Administrator.DESKTOP\Desktop
    2008-03-30 10:17:00 0 d---s---- C:\Documents and Settings\Administrator.DESKTOP\Cookies
    2008-03-30 10:17:00 0 dr-h----- C:\Documents and Settings\Administrator.DESKTOP\Application Data
    2008-03-30 10:17:00 0 d-------- C:\Documents and Settings\Administrator.DESKTOP\Application Data\You've Got Pictures Screensaver
    2008-03-30 10:17:00 0 d-------- C:\Documents and Settings\Administrator.DESKTOP\Application Data\WeatherBug
    2008-03-30 10:17:00 0 d-------- C:\Documents and Settings\Administrator.DESKTOP\Application Data\Viewpoint
    2008-03-30 10:17:00 0 d-------- C:\Documents and Settings\Administrator.DESKTOP\Application Data\Template
    2008-03-30 10:17:00 0 d-------- C:\Documents and Settings\Administrator.DESKTOP\Application Data\Symantec
    2008-03-30 10:17:00 0 d-------- C:\Documents and Settings\Administrator.DESKTOP\Application Data\Sonic
    2008-03-30 10:17:00 0 d-------- C:\Documents and Settings\Administrator.DESKTOP\Application Data\SampleView
    2008-03-30 10:17:00 0 d-------- C:\Documents and Settings\Administrator.DESKTOP\Application Data\Real
    2008-03-30 10:17:00 0 d-------- C:\Documents and Settings\Administrator.DESKTOP\Application Data\Musicmatch
    2008-03-30 10:17:00 0 d-------- C:\Documents and Settings\Administrator.DESKTOP\Application Data\Motive
    2008-03-30 10:17:00 0 d---s---- C:\Documents and Settings\Administrator.DESKTOP\Application Data\Microsoft
    2008-03-30 10:16:57 0 dr-h----- C:\Documents and Settings\Administrator.DESKTOP\Local Settings
    2008-03-30 10:16:53 0 d--h----- C:\Documents and Settings\Administrator.DESKTOP\Templates
    2008-03-30 10:16:53 0 dr------- C:\Documents and Settings\Administrator.DESKTOP\Start Menu
    2008-03-30 10:16:53 0 dr-h----- C:\Documents and Settings\Administrator.DESKTOP\SendTo
    2008-03-30 10:16:53 0 d--h----- C:\Documents and Settings\Administrator.DESKTOP\Recent
    2008-03-30 10:16:53 0 d--h----- C:\Documents and Settings\Administrator.DESKTOP\PrintHood
    2008-03-30 10:16:53 0 d--h----- C:\Documents and Settings\Administrator.DESKTOP\NetHood
    2008-03-30 10:16:53 0 d-------- C:\Documents and Settings\Administrator.DESKTOP\My Documents
    2008-03-30 10:16:52 0 d-------- C:\Documents and Settings\Administrator.DESKTOP\WINDOWS
    2008-03-30 10:16:52 0 d---s---- C:\Documents and Settings\Administrator.DESKTOP\UserData
    2008-03-30 10:16:52 262144 --ah----- C:\Documents and Settings\Administrator.DESKTOP\NTUSER.DAT
    2008-03-27 21:03:19 0 d-------- C:\Documents and Settings\Owner\My Doucments


    -- Find3M Report ---------------------------------------------------------------

    2008-04-15 15:37:13 0 d-------- C:\Documents and Settings\Owner\Application Data\OpenOffice.org2
    2008-04-14 13:14:00 0 d-------- C:\Program Files\Messenger
    2008-04-14 13:10:12 0 d-------- C:\Program Files\Windows NT
    2008-04-14 13:10:09 0 d-------- C:\Program Files\Movie Maker
    2008-04-14 12:20:08 0 d-------- C:\Program Files\Easy Internet signup
    2008-04-14 12:15:15 0 d-------- C:\Program Files\MUSICMATCH
    2008-04-14 12:14:34 0 d--h----- C:\Program Files\InstallShield Installation Information
    2008-04-14 12:07:45 0 d-------- C:\Program Files\Common Files
    2008-04-13 18:32:52 3836 --a------ C:\WINDOWS\viassary-hp.reg
    2008-04-10 12:31:59 0 d-------- C:\Program Files\Google
    2008-04-09 21:42:27 0 d-------- C:\Program Files\Real
    2008-03-30 10:32:37 0 d-------- C:\Program Files\Trend Micro
    2008-03-29 10:18:55 0 d-------- C:\Program Files\America Online 8.0
    2008-03-08 11:55:40 0 d-------- C:\Program Files\AIM
    2008-03-05 20:44:27 0 d-------- C:\Program Files\AIM6
    2008-03-05 20:16:25 0 d-------- C:\Documents and Settings\Owner\Application Data\Mozilla
    2008-03-02 22:20:41 6596 --a------ C:\Documents and Settings\Owner\Application Data\update.log
    2008-02-28 17:00:17 0 d-------- C:\Documents and Settings\Owner\Application Data\MySpace
    2008-02-28 16:59:59 0 d-------- C:\Program Files\MySpace
     
    covian,
    #10
  12. 2008/04/16
    covian

    covian Inactive Thread Starter

    Joined:
    2008/03/30
    Messages:
    22
    Likes Received:
    0
    -- Registry Dump ---------------------------------------------------------------

    *Note* empty entries & legit default entries are not shown


    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "hpsysdrv "= "c:\windows\system\hpsysdrv.exe" [05/07/1998 07:04 PM]
    "HotKeysCmds "= "C:\WINDOWS\System32\hkcmd.exe" [08/20/2004 03:51 PM]
    "CamMonitor "= "c:\Program Files\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe" [10/07/2002 10:23 AM]
    "HPHUPD05 "= "c:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" [05/23/2003 06:03 AM]
    "HPHmon05 "= "C:\WINDOWS\System32\hphmon05.exe" [05/23/2003 05:55 AM]
    "KBD "= "C:\HP\KBD\KBD.EXE" [02/11/2003 11:02 PM]
    "StorageGuard "= "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [02/13/2003 11:01 AM]
    "TkBellExe "= "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [08/23/2003 10:14 AM]
    "AutoTKit "= "C:\hp\bin\AUTOTKIT.EXE" [06/18/2003 10:19 PM]
    "Recguard "= "C:\WINDOWS\SMINST\RECGUARD.EXE" [09/14/2002 12:42 AM]
    "NvCplDaemon "= "C:\WINDOWS\System32\NvCpl.dll" [05/03/2003 02:19 AM]
    "nwiz "= "nwiz.exe" [05/03/2003 02:19 AM C:\WINDOWS\system32\nwiz.exe]
    "Sunkist2k "= "C:\Program Files\Multimedia Card Reader\shwicon2k.exe" [08/09/2003 12:27 PM]
    "Reminder "= "C:\Windows\Creator\Remind_XP.exe" [06/17/2003 09:13 PM]
    "PS2 "= "C:\WINDOWS\system32\ps2.exe" [10/16/2002 07:57 PM]
    "MCUpdateExe "= "C:\PROGRA~1\McAfee.com\Agent\McUpdate.exe" []
    "MCAgentExe "= "C:\PROGRA~1\McAfee.com\Agent\McAgent.exe" []
    "SoftwareStation "= "C:\Program Files\eAcceleration\Station\station.exe" [05/08/2007 08:12 PM]
    "StopSignSsTsMon "= "C:\Program Files\Acceleration Software\Anti-Virus\sstsmon.dll" [12/10/2007 10:13 PM]
    "webscan "= "C:\Program Files\Acceleration Software\Anti-Virus\stopsignav.exe" [12/19/2007 10:20 PM]
    "StopSignSsFwMon "= "C:\Program Files\eAcceleration\Firewall\ssfwmon.dll" [08/09/2006 02:56 PM]
    "HPHUPD06 "= "C:\Program Files\Hewlett-Packard\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe" [06/07/2004 12:53 AM]
    "HP Software Update "= "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [09/13/2004 04:49 PM]
    "HP Component Manager "= "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [05/12/2004 04:18 PM]
    "HPHmon06 "= "C:\WINDOWS\System32\hphmon06.exe" [06/07/2004 12:42 AM]
    "StopSignSsSsMon "= "C:\Program Files\Acceleration Software\Anti-Virus\ssssmon.dll" [12/19/2007 03:50 PM]
    "AlcxMonitor "= "ALCXMNTR.EXE" [09/07/2004 01:47 PM C:\WINDOWS\ALCXMNTR.EXE]
    "IgfxTray "= "C:\WINDOWS\System32\igfxtray.exe" [08/20/2004 03:55 PM]
    "SunJavaUpdateSched "= "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [09/25/2007 02:11 AM]
    "Adobe Photo Downloader "= "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [03/09/2007 11:09 AM]
    "Adobe Reader Speed Launcher "= "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [10/10/2007 07:51 PM]
    "QuickTime Task "= "C:\Program Files\QuickTime\qttask.exe" [10/19/2007 09:16 PM]
    "iTunesHelper "= "C:\Program Files\iTunes\iTunesHelper.exe" [11/02/2007 07:36 PM]
    "OnAccess "= "C:\Program Files\eAcceleration\OnAccess\onaccess.exe" [01/17/2008 10:14 PM]
    "LogMeIn GUI "= "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe" [08/03/2007 03:09 PM]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "BackupNotify "= "c:\Program Files\Hewlett-Packard\Digital Imaging\bin\backupnotify.exe" [06/23/2003 12:25 AM]
    "NVIEW "= "nview.dll,nViewLoadHook" []
    "MSMSGS "= "C:\Program Files\Messenger\msmsgs.exe" [11/15/2004 05:18 PM]
    "ctfmon.exe "= "C:\WINDOWS\System32\ctfmon.exe" [08/29/2002 08:00 AM]
    "Aim6 "= "C:\Program Files\AIM6\aim6.exe" [04/27/2007 05:17 PM]
    "Jfw "= "C:\WINDOWS\?icrosoft\?ttrib.exe" []
    "Spyware Doctor "= "C:\Program Files\Spyware Doctor\swdoctor.exe" [08/20/2007 08:47 AM]
    "swg "= "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [10/27/2007 08:30 PM]
    "AdobeUpdater "= "C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [03/01/2007 10:37 AM]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce]
    "StopSignSsTsMon "=Rundll32.exe "C:\Program Files\Acceleration Software\Anti-Virus\sstsmon.dll ",VerifyStatus /ro
    "StopSignSsFwMon "=Rundll32.exe "C:\Program Files\eAcceleration\Firewall\ssfwmon.dll ",VerifyStatus /ro
    "StopSignSsSsMon "=Rundll32.exe "C:\Program Files\Acceleration Software\Anti-Virus\ssssmon.dll ",VerifyStatus /ro

    [HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
    "MySpaceIM "=C:\Program Files\MySpace\IM\MySpaceIM.exe

    C:\Documents and Settings\Owner\Start Menu\Programs\Startup\
    Greetings Workshop Reminders.lnk - C:\Program Files\Greetings Workshop\GWREMIND.EXE [9/4/1997]
    OpenOffice.org 2.3.lnk - C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe [8/17/2007 10:57:56 PM]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    America Online 8.0 Tray Icon.lnk - C:\Program Files\America Online 8.0\aoltray.exe [5/19/2007 8:43:23 AM]
    AOL Companion.lnk - C:\Program Files\AOL Companion\companion.exe [5/19/2007 8:45:57 AM]
    HP Digital Imaging Monitor.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe [5/28/2004 10:31:38 PM]
    HP Image Zone Fast Start.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqthb08.exe [5/28/2004 11:06:36 PM]
    Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2/13/2001 2:01:04 AM]
    Quicken Scheduled Updates.lnk - C:\Program Files\Quicken\bagent.exe [9/20/2002 10:20:02 PM]
    Updates from HP.lnk - C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe [8/23/2003 11:34:35 PM]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "DisableRegistryTools "=0 (0x0)
    "HideLegacyLogonScripts "=0 (0x0)
    "HideLogoffScripts "=0 (0x0)
    "RunLogonScriptSync "=1 (0x1)
    "RunStartupScriptSync "=1 (0x1)
    "HideStartupScripts "=0 (0x0)

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
    "HideLegacyLogonScripts "=0 (0x0)
    "HideLogoffScripts "=0 (0x0)
    "RunLogonScriptSync "=1 (0x1)
    "RunStartupScriptSync "=1 (0x1)
    "HideStartupScripts "=0 (0x0)

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
    "NoActiveDesktop "=1 (0x1)

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    "{42DD0873-5FA9-465D-90DE-0826020416A5} "= C:\Program Files\eAcceleration\OnAccess\onaccess_hk32.dll [01/17/2008 10:14 PM 161104]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
    LMIinit.dll 11/15/2007 06:46 PM 87352 C:\WINDOWS\system32\LMIinit.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OPXPGina]
    C:\Program Files\Softex\OmniPass\opxpgina.dll 02/21/2003 06:50 AM 40960 C:\Program Files\Softex\OmniPass\OPXPGina.dll




    -- End of Deckard's System Scanner: finished at 2008-04-16 11:28:03 ------------
     
    covian,
    #11
  13. 2008/04/16
    covian

    covian Inactive Thread Starter

    Joined:
    2008/03/30
    Messages:
    22
    Likes Received:
    0
    Deckard's System Scanner v20071014.68
    Extra logfile - please post this as an attachment with your post.
    --------------------------------------------------------------------------------

    -- System Information ----------------------------------------------------------

    Microsoft Windows XP Home Edition (build 2600) SP 1.0
    Architecture: X86; Language: English

    CPU 0: Intel(R) Pentium(R) 4 CPU 2.60GHz
    Percentage of Memory in Use: 67%
    Physical Memory (total/avail): 503.36 MiB / 165.77 MiB
    Pagefile Memory (total/avail): 1231.16 MiB / 807.61 MiB
    Virtual Memory (total/avail): 2047.88 MiB / 1914.4 MiB

    A: is Removable (No Media)
    C: is Fixed (NTFS) - 104.76 GiB total, 48.83 GiB free.
    D: is Fixed (FAT32) - 7.01 GiB total, 2.41 GiB free.
    E: is CDROM (CDFS)
    F: is CDROM (No Media)
    G: is Removable (No Media)
    H: is Removable (No Media)
    I: is Removable (FAT)
    K: is Removable (No Media)

    \\.\PHYSICALDRIVE0 - ST3120022A - 111.79 GiB - 2 partitions
    \PARTITION0 - Unknown - 7.02 GiB - D:
    \PARTITION1 (bootable) - Installable File System - 104.76 GiB - C:

    \\.\PHYSICALDRIVE1 - Generic USB CF Reader USB Device

    \\.\PHYSICALDRIVE3 - Generic USB MS Reader USB Device - 117.66 MiB - 1 partition
    \PARTITION0 (bootable) - MS-DOS V4 Huge - 123.73 MiB - I:

    \\.\PHYSICALDRIVE2 - Generic USB SM Reader USB Device

    \\.\PHYSICALDRIVE4 - HP Photosmart 370 s USB Device



    -- Security Center -------------------------------------------------------------

    AUOptions is scheduled to auto-install.


    -- Environment Variables -------------------------------------------------------

    ALLUSERSPROFILE=C:\Documents and Settings\All Users
    APPDATA=C:\Documents and Settings\Owner\Application Data
    CLASSPATH=.;C:\Program Files\Java\jre1.6.0_02\lib\ext\QTJava.zip
    CLIENTNAME=Console
    CommonProgramFiles=C:\Program Files\Common Files
    COMPUTERNAME=DESKTOP
    ComSpec=C:\WINDOWS\system32\cmd.exe
    HOMEDRIVE=C:
    HOMEPATH=\Documents and Settings\Owner
    LOGONSERVER=\\DESKTOP
    NUMBER_OF_PROCESSORS=1
    OS=Windows_NT
    Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\system32\wbem;c:\Python22;C:\Program Files\PC-Doctor for Windows\services;C:\Program Files\QuickTime\QTSystem
    PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
    PROCESSOR_ARCHITECTURE=x86
    PROCESSOR_IDENTIFIER=x86 Family 15 Model 2 Stepping 9, GenuineIntel
    PROCESSOR_LEVEL=15
    PROCESSOR_REVISION=0209
    ProgramFiles=C:\Program Files
    PROMPT=$P$G
    QTJAVA=C:\Program Files\Java\jre1.6.0_02\lib\ext\QTJava.zip
    SESSIONNAME=Console
    SystemDrive=C:
    SystemRoot=C:\WINDOWS
    TEMP=C:\DOCUME~1\Owner\LOCALS~1\Temp
    TMP=C:\DOCUME~1\Owner\LOCALS~1\Temp
    USERDOMAIN=DESKTOP
    USERNAME=Owner
    USERPROFILE=C:\Documents and Settings\Owner
    windir=C:\WINDOWS


    -- User Profiles ---------------------------------------------------------------

    Owner (admin)
    LogMeInRemoteUser (admin)


    -- Add/Remove Programs ---------------------------------------------------------

    --> "C:\Program Files\Acceleration Software\Anti-Virus\ws_uninst.exe" -s
    --> "C:\Program Files\Acceleration Software\Veloz\VelozSp\velozsp.exe" /Uninstall
    --> "C:\Program Files\eAcceleration\OnAccess\onaccess.exe" -u -s
    --> "C:\Program Files\eAcceleration\Station\station.exe" /UnRegister
    --> C:\PROGRA~1\ACCELE~1\ANTI-V~1\regsvr32.exe /u /s C:\PROGRA~1\ACCELE~1\ANTI-V~1\ssupload.dll
    --> C:\PROGRA~1\ACCELE~1\ANTI-V~1\regsvr32.exe /u /s C:\PROGRA~1\ACCELE~1\ANTI-V~1\vclnr.dll
    --> C:\PROGRA~1\COMMON~1\EACCEL~1\SysSnap\syssnap.exe -UnregServer
    --> C:\Program Files\Common Files\Real\Update_OB\rnuninst.exe RealNetworks|RealPlayer|6.0
    --> C:\WINDOWS\IsUninst.exe -fC:\WINDOWS\orun32.isu
    --> C:\WINDOWS\System32\\MSIEXEC.EXE /I {09DA4F91-2A09-4232-AB8C-6BC740096DE3} REMOVE=UpdateMgrFeature
    --> c:\WINDOWS\System32\\MSIEXEC.EXE /x {9541FED0-327F-4df0-8B96-EF57EF622F19}
    --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{39DA87A1-0B26-4562-A70C-2A6147366E47}\Setup.exe"
    --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9F765BD0-B900-4EDE-A90B-61C8A9E95C42}\Setup.exe"
    --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{BAD59025-5B73-4E12-B789-0028C5A573C2}\Setup.exe"
    --> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
    Adobe Flash Player 9 ActiveX --> C:\WINDOWS\System32\Macromed\Flash\FlashUtil9b.exe -uninstallDelete
    Adobe Flash Player ActiveX --> C:\WINDOWS\System32\Macromed\Flash\uninstall_activeX.exe
    Adobe Flash Player Plugin --> C:\WINDOWS\System32\Macromed\Flash\uninstall_plugin.exe
    Adobe Reader 8.1.1 --> MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81100000003}
    Adobe® Photoshop® Album Starter Edition 3.2 --> MsiExec.exe /I{A654A805-41D9-40C7-AA46-4AF04F044D61}
    AIM 6 --> C:\Program Files\AIM6\uninst.exe
    America Online (Choose which version to remove) --> C:\Program Files\Common Files\aolshare\Aolunins_us.exe
    AnswerWorks 4.0 Runtime - English --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{7DD9A065-2C86-4A9F-A5FF-796EC1B99DCA}\setup.exe" -l0x9 -removeonly
    AOL Coach Version 1.0(Build:20020929.1) --> C:\WINDOWS\AolCInUn.exe
    Apple Software Update --> MsiExec.exe /I{B74F042E-E1B9-4A5B-8D46-387BB172F0A4}
    ArcSoft ShowBiz 2 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{791B20D4-AE59-4DE9-B45F-BA01F3D0A493}\setup.exe" -l0x9
    Blackhawk Striker from Hewlett-Packard Desktops (remove only) --> "C:\Program Files\WildTangent\Apps\GameChannel\Games\5415BC25-6D6C-46C4-B34C-EA8470FE56D5\Uninstall.exe "
    Blasterball 2 from Hewlett-Packard Desktops (remove only) --> "C:\Program Files\WildTangent\Apps\GameChannel\Games\357ECB62-CD36-4B63-B57E-769D0CA174F4\Uninstall.exe "
    Bounce from Hewlett-Packard Desktops (remove only) --> "C:\Program Files\WildTangent\Apps\GameChannel\Games\D11F7128-8CBD-408B-8BF8-034604DEDD42\Uninstall.exe "
    Cannonballs from Hewlett-Packard Desktops (remove only) --> "C:\Program Files\WildTangent\Apps\GameChannel\Games\C99127BE-FDE5-49BD-9621-BFE5DF19AA34\Uninstall.exe "
    CiD Help --> C:\DOCUME~1\Owner\APPLIC~1\INSIDE~1\Bat okay.exe -uninstall
    Cucusoft DVD to iPod Converter 3.17 --> "C:\Program Files\Cucusoft\ipod-converter\unins000.exe "
    DVD Decrypter (Remove Only) --> "C:\Documents and Settings\Owner\My Documents\Drews games\DVD Decrypter\uninstall.exe "
    Excavation from Hewlett-Packard Desktops (remove only) --> "C:\Program Files\WildTangent\Apps\GameChannel\Games\DF479CEA-34C0-460F-9B56-93BCE4CD4086\Uninstall.exe "
    Five Card Frenzy from Hewlett-Packard Desktops (remove only) --> "C:\Program Files\WildTangent\Apps\GameChannel\Games\DA44615A-C243-46A4-8E47-184CFF33CD38\Uninstall.exe "
    GemMaster 3 from Hewlett-Packard Desktops (remove only) --> "C:\Program Files\WildTangent\Apps\GameChannel\Games\1ABC286C-DE10-4590-BEFF-4D0DFF5EA1EC\Uninstall.exe "
    Google Toolbar for Internet Explorer --> MsiExec.exe /I{DBEA1034-5882-4A88-8033-81C4EF0CFA29}
    Google Toolbar for Internet Explorer --> regsvr32 /u /s "c:\program files\google\googletoolbar2.dll "
    HijackThis 2.0.2 --> "C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
    Honeycombs from Hewlett-Packard Desktops (remove only) --> "C:\Program Files\WildTangent\Apps\GameChannel\Games\1FEF9671-50F6-4CB0-9E96-304EB14158E0\Uninstall.exe "
    Hotfix for MDAC 2.80 (KB911562) --> "C:\WINDOWS\$SQLUninstallMDAC28-KB911562-x86-ENU$\spuninst\spuninst.exe "
    HP Deskjet Preloaded Printer Drivers --> MsiExec.exe /X{F419D20A-7719-4639-8E30-C073A040D878}
    HP Image Zone 4.0 --> C:\Program Files\Hewlett-Packard\Digital Imaging\uninstall\hpzscr01.exe -datfile hpqscr01.dat
    HP Instant Support --> C:\PROGRA~1\HPINST~1\UNWISE.EXE C:\PROGRA~1\HPINST~1\INSTALL.LOG
    HP Organize --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D0122362-6333-4DE4-93F6-A5A2F3CC101A}\Setup.exe" UNINSTALL
    HP Photo and Imaging 2.0 - Photosmart Cameras --> MsiExec.exe /X{5D7F0A0E-369E-46C0-9F99-FAB21A064781}
    HP Software Update --> MsiExec.exe /X{457791C5-D702-4143-A7B2-2744BE9573F2}
    HPImageZone --> MsiExec.exe /X{11946FA8-329A-4DDF-B867-A32781FED8EE}
    Intel(R) Extreme Graphics 2 Driver --> RUNDLL32.EXE C:\WINDOWS\System32\ialmrem.dll,UninstallW2KIGfx PCI\VEN_8086&DEV_2572
    IntelliMover Data Transfer Demo --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{14589F05-C658-4594-9429-D437BA688686}\Setup.exe" -l0x9
    InterVideo WinDVD Player --> "C:\Program Files\InstallShield Installation Information\{98E8A2EF-4EAE-43B8-A172-74842B764777}\setup.exe" REMOVEALL
    iTunes --> MsiExec.exe /I{E3FEE4E7-4488-4A3F-A6BD-13745936EADB}
    Java 2 Runtime Environment, SE v1.4.1_02 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{EFCE5837-FC21-11D6-9D24-00010240CE95}\setup.exe" Anytext
    Java DB 10.2.2.0 --> MsiExec.exe /X{0ECB59D5-A3FC-4D61-AD3B-6CE679B3F852}
    Java Web Start --> "C:\Program Files\Java Web Start\uninst-javaws.exe "
    Java(TM) 6 Update 2 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160020}
    Java(TM) 6 Update 3 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160030}
    Java(TM) SE Development Kit 6 Update 2 --> MsiExec.exe /I{32A3A4F4-B792-11D6-A78A-00B0D0160020}
    JCreator LE 2.50 --> "C:\Program Files\Xinox Software\JCreator LE\unins000.exe "
    KBD --> C:\HP\KBD\KBD.EXE uninstalled
    LiveReg (Symantec Corporation) --> C:\Program Files\Common Files\Symantec Shared\LiveReg\VcSetup.exe /REMOVE
    LogMeIn --> MsiExec.exe /I{7E7658A2-CD3F-48A7-93EA-0882BCA4FD2A}
    Malwarebytes' Anti-Malware --> "C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe "
    Mars Rover from Hewlett-Packard Desktops (remove only) --> "C:\Program Files\WildTangent\Apps\GameChannel\Games\53EF27E9-150C-4063-8343-61C45FC6BB98\Uninstall.exe "
    Memories Disc Creator 2.0 --> MsiExec.exe /X{2E132061-C78A-48D4-A899-1D13B9D189FA}
    Microsoft Money 2003 --> MsiExec.exe /I{01F9D88C-3C86-4E82-840A-101A3221F67A}
    Microsoft Money 2003 System Pack --> MsiExec.exe /I{02B42D23-10F2-4862-ADA4-3DF1EA0021B2}
    Microsoft Office XP Media Content --> MsiExec.exe /I{90300409-6000-11D3-8CFE-0050048383C9}
    Microsoft Office XP Small Business --> MsiExec.exe /I{91130409-6000-11D3-8CFE-0050048383C9}
    Microsoft Plus! Digital Media Edition --> MsiExec.exe /I{C6A7AF96-4EB1-4AAE-8318-1AB393C64F88}
    Microsoft Visual J# .NET Redistributable Package 1.1 --> MsiExec.exe /X{1A655D51-1423-48A3-B748-8F5A0BE294C8}
    Microsoft Works 7.0 --> MsiExec.exe /I{764D06D8-D8DE-411E-A1C8-D9E9380F8A84}
    Mozilla Firefox (2.0.0.13) --> C:\PROGRA~1\Mozilla Firefox\uninstall\helper.exe
    Multimedia Card Reader --> C:\Program Files\Common Files\InstallShield\Driver\8\Intel 32\IDriver.exe /M{E05895C5-FE97-4334-8D73-B0089FD07CE3}
    MySpaceIM --> C:\Program Files\MySpace\IM\Uninstall.exe
    NVIDIA Gart Driver --> C:\WINDOWS\System32\nvugart.exe Uninstall C:\WINDOWS\System32\Nvgart.nvu,NVIDIA Gart Driver
    NVIDIA Windows 2000/XP Display Drivers --> rundll32.exe C:\WINDOWS\System32\nvinstnt.dll,NvUninstallNT4 nvhp.inf
    OmniPass --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F4E57F49-84B4-4CF2-B0A1-8CA1752BDF7E}\Setup.exe" -l0x9
    OpenOffice.org 2.3 --> MsiExec.exe /I{2F29D6D2-824E-4FEF-8AED-7013F39F642A}
    Orbital from Hewlett-Packard Desktops (remove only) --> "C:\Program Files\WildTangent\Apps\GameChannel\Games\62067F4C-84A9-45B9-8573-B90468B0A3EF\Uninstall.exe "
    Otto from Hewlett-Packard Desktops (remove only) --> "C:\Program Files\WildTangent\Apps\GameChannel\Games\BFBCBAE3-8293-4215-9C4F-C2402C118EDB\Uninstall.exe "
    PC-Doctor for Windows --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{1F7CCFA3-D926-4882-B2A5-A0217ED25597}\Setup.exe"
    Photosmart 140,240,7200,7600,7700,7900 Series --> C:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\setup\hpzscr01.exe -datfile hphscr01.dat
    Photosmart 320,370,7400,8100,8400 Series --> C:\Program Files\Hewlett-Packard\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\setup\hpzscr01.exe -datfile hphscr01.dat
    Polar Bowler from Hewlett-Packard Desktops (remove only) --> "C:\Program Files\WildTangent\Apps\GameChannel\Games\36317AE4-57EC-4F3E-B828-009A3DD96BE8\Uninstall.exe "
    PS2 --> C:\WINDOWS\system32\ps2.exe uninstall
    Python 2.2 combined Win32 extensions --> C:\Python22\Lib\SITE-P~1\UNWISE~1.EXE C:\Python22\Lib\SITE-P~1\w32inst.log
    Python 2.2.1 --> C:\Python22\UNWISE.EXE C:\Python22\INSTALL.LOG
    Quicken 2003 New User Edition --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{F61F2821-694C-475F-99AB-6AF2EFDF40FD} anything
    QuickTime --> MsiExec.exe /I{5B09BD67-4C99-46A1-8161-B7208CE18121}
    RealOne Player --> C:\Program Files\Common Files\Real\Update_OB\rnuninst.exe RealNetworks|RealPlayer|6.0
    RecordNow! --> MsiExec.exe /I{9541FED0-327F-4DF0-8B96-EF57EF622F19}
    Rhapsody Player Engine --> MsiExec.exe /I{84F1DE76-C48C-4281-87A0-CC9548D1E7F9}
    Roll --> C:\WINDOWS\UniFish3.exe C:\Program Files\Hasbro Interactive\RollerCoaster Tycoon\RollerCoaster Tycoon.log
    S3Display --> s3uninst.exe -reg 5 'HKLM\Software\S3\S3Uninst\S3Display'
    S3Gamma2 --> s3uninst.exe -reg 5 'HKLM\Software\S3\S3Uninst\S3Gamma2'
    S3Info2 --> s3uninst.exe -reg 5 'HKLM\Software\S3\S3Uninst\S3Info2'
    S3Overlay --> s3uninst.exe -reg 5 'HKLM\Software\S3\S3Uninst\S3Overlay'
    Security Update for Step By Step Interactive Training (KB898458) --> "C:\WINDOWS\$NtUninstallKB898458$\spuninst\spuninst.exe "
    Slyder from Hewlett-Packard Desktops (remove only) --> "C:\Program Files\WildTangent\Apps\GameChannel\Games\5F804D2B-A66D-4F0A-B64E-FBDA3F52E3F8\Uninstall.exe "
    Sonic Update Manager --> MsiExec.exe /I{09DA4F91-2A09-4232-AB8C-6BC740096DE3}
    StopSign by eAcceleration --> C:\PROGRA~1\COMMON~1\EACCEL~1\INSTAL~1\eaccelsetup.exe -AddRemove
    STX from Hewlett-Packard Desktops (remove only) --> "C:\Program Files\WildTangent\Apps\GameChannel\Games\342970EF-F8DF-4E9B-8477-A1A03E3E15E1\Uninstall.exe "
    The Sims Superstar --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{1A7F8DF6-5A3E-4CDF-BC82-BE26B407E21B}\setup.exe" -l0009
    toolkit --> c:\Windows\HPTK\unhptkit.exe
    TurboTax ItsDeductible 2006 --> MsiExec.exe /X{AFF1EA96-9C23-4249-B7D4-CD4B54D4582F}
    TurboTax Premier 2007 --> C:\Program Files\TurboTax\Premier 2007\TaxUnst.EXE "C:\Program Files\TurboTax\Premier 2007\Uninstall.log" -NoGui
    TurboTax Premier Investments 2006 --> C:\Program Files\TurboTax\Premier 2006\TaxUnst.EXE "C:\Program Files\TurboTax\Premier 2006\Uninstall.log" -NoGui
    Updates from HP --> C:\WINDOWS\BWUnin-6.2.3.66.exe -AppId 137903
    Viewpoint Media Player --> C:\Program Files\Viewpoint\Viewpoint Experience Technology\mtsAxInstaller.exe /u
    Virtual Warfare from Hewlett-Packard Desktops (remove only) --> "C:\Program Files\WildTangent\Apps\GameChannel\Games\4F0AE1FB-4082-4A27-8363-05D292D92FB0\Uninstall.exe "
    Weblink --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{4FCC384C-18EA-4E25-9281-A06AE006D219}\setup.exe" -l0x9
    WexTech AnswerWorks --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{EA2BEBD6-87B9-41E5-95AC-7E4C165A9475}\SETUP.EXE" -l0x9 -eliminate


    -- Application Event Log -------------------------------------------------------

    Event Record #/Type1732 / Error
    Event Submitted/Written: 04/15/2008 03:37:17 PM
    Event ID/Source: 1002 / Application Hang
    Event Description:
    Hanging application hpqgalry.exe, version 43.1.5.0, hang module mscorwks.dll, version 1.1.4322.573, hang address 0x0002e29f.

    Event Record #/Type1558 / Warning
    Event Submitted/Written: 04/14/2008 03:27:19 PM
    Event ID/Source: 1015 / MsiInstaller
    Event Description:
    Failed to connect to server. Error: 0x80080005

    Event Record #/Type1546 / Error
    Event Submitted/Written: 04/14/2008 11:39:23 AM
    Event ID/Source: 1002 / Application Hang
    Event Description:
    Hanging application stopsignav.exe, version 0.0.1.4274, hang module vclnr.dll, version 2.0.0.98, hang address 0x00074f2c.

    Event Record #/Type1545 / Error
    Event Submitted/Written: 04/14/2008 11:33:54 AM
    Event ID/Source: 1002 / Application Hang
    Event Description:
    Hanging application hpqgalry.exe, version 43.1.5.0, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

    Event Record #/Type1460 / Warning
    Event Submitted/Written: 04/13/2008 08:23:58 PM
    Event ID/Source: 1524 / Userenv
    Event Description:
    Windows cannot unload your classes registry file - it is still in use by other applications or services. The file will be unloaded when it is no longer in use.



    -- Security Event Log ----------------------------------------------------------

    No Errors/Warnings found.


    -- System Event Log ------------------------------------------------------------

    Event Record #/Type8396 / Warning
    Event Submitted/Written: 04/16/2008 04:05:47 AM
    Event ID/Source: 36 / W32Time
    Event Description:
    The time service has not been able to synchronize the system time
    for 49152 seconds because none of the time providers has been able to
    provide a usable time stamp. The system clock is unsynchronized.

    Event Record #/Type8381 / Error
    Event Submitted/Written: 04/15/2008 02:27:50 PM
    Event ID/Source: 7000 / Service Control Manager
    Event Description:
    The mrtRate service failed to start due to the following error:
    %%2

    Event Record #/Type8375 / Error
    Event Submitted/Written: 04/15/2008 02:25:15 PM
    Event ID/Source: 7000 / Service Control Manager
    Event Description:
    The mrtRate service failed to start due to the following error:
    %%2

    Event Record #/Type8369 / Error
    Event Submitted/Written: 04/15/2008 02:22:30 PM
    Event ID/Source: 7000 / Service Control Manager
    Event Description:
    The mrtRate service failed to start due to the following error:
    %%2

    Event Record #/Type8363 / Error
    Event Submitted/Written: 04/15/2008 02:19:44 PM
    Event ID/Source: 7000 / Service Control Manager
    Event Description:
    The mrtRate service failed to start due to the following error:
    %%2



    -- End of Deckard's System Scanner: finished at 2008-04-16 11:28:03 ------------
     
    covian,
    #12
  14. 2008/04/16
    covian

    covian Inactive Thread Starter

    Joined:
    2008/03/30
    Messages:
    22
    Likes Received:
    0
    Thanks alot for all your help.I put the first half of main text again because im not sure if the post went through.. I did install key logger but i think i removed it.

    Deckard's System Scanner v20071014.68
    Extra logfile - please post this as an attachment with your post.
    --------------------------------------------------------------------------------

    -- System Information ----------------------------------------------------------

    Microsoft Windows XP Home Edition (build 2600) SP 1.0
    Architecture: X86; Language: English

    CPU 0: Intel(R) Pentium(R) 4 CPU 2.60GHz
    Percentage of Memory in Use: 67%
    Physical Memory (total/avail): 503.36 MiB / 165.77 MiB
    Pagefile Memory (total/avail): 1231.16 MiB / 807.61 MiB
    Virtual Memory (total/avail): 2047.88 MiB / 1914.4 MiB

    A: is Removable (No Media)
    C: is Fixed (NTFS) - 104.76 GiB total, 48.83 GiB free.
    D: is Fixed (FAT32) - 7.01 GiB total, 2.41 GiB free.
    E: is CDROM (CDFS)
    F: is CDROM (No Media)
    G: is Removable (No Media)
    H: is Removable (No Media)
    I: is Removable (FAT)
    K: is Removable (No Media)

    \\.\PHYSICALDRIVE0 - ST3120022A - 111.79 GiB - 2 partitions
    \PARTITION0 - Unknown - 7.02 GiB - D:
    \PARTITION1 (bootable) - Installable File System - 104.76 GiB - C:

    \\.\PHYSICALDRIVE1 - Generic USB CF Reader USB Device

    \\.\PHYSICALDRIVE3 - Generic USB MS Reader USB Device - 117.66 MiB - 1 partition
    \PARTITION0 (bootable) - MS-DOS V4 Huge - 123.73 MiB - I:

    \\.\PHYSICALDRIVE2 - Generic USB SM Reader USB Device

    \\.\PHYSICALDRIVE4 - HP Photosmart 370 s USB Device



    -- Security Center -------------------------------------------------------------

    AUOptions is scheduled to auto-install.


    -- Environment Variables -------------------------------------------------------

    ALLUSERSPROFILE=C:\Documents and Settings\All Users
    APPDATA=C:\Documents and Settings\Owner\Application Data
    CLASSPATH=.;C:\Program Files\Java\jre1.6.0_02\lib\ext\QTJava.zip
    CLIENTNAME=Console
    CommonProgramFiles=C:\Program Files\Common Files
    COMPUTERNAME=DESKTOP
    ComSpec=C:\WINDOWS\system32\cmd.exe
    HOMEDRIVE=C:
    HOMEPATH=\Documents and Settings\Owner
    LOGONSERVER=\\DESKTOP
    NUMBER_OF_PROCESSORS=1
    OS=Windows_NT
    Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\system32\wbem;c:\Python22;C:\Program Files\PC-Doctor for Windows\services;C:\Program Files\QuickTime\QTSystem
    PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
    PROCESSOR_ARCHITECTURE=x86
    PROCESSOR_IDENTIFIER=x86 Family 15 Model 2 Stepping 9, GenuineIntel
    PROCESSOR_LEVEL=15
    PROCESSOR_REVISION=0209
    ProgramFiles=C:\Program Files
    PROMPT=$P$G
    QTJAVA=C:\Program Files\Java\jre1.6.0_02\lib\ext\QTJava.zip
    SESSIONNAME=Console
    SystemDrive=C:
    SystemRoot=C:\WINDOWS
    TEMP=C:\DOCUME~1\Owner\LOCALS~1\Temp
    TMP=C:\DOCUME~1\Owner\LOCALS~1\Temp
    USERDOMAIN=DESKTOP
    USERNAME=Owner
    USERPROFILE=C:\Documents and Settings\Owner
    windir=C:\WINDOWS


    -- User Profiles ---------------------------------------------------------------

    Owner (admin)
    LogMeInRemoteUser (admin)


    -- Add/Remove Programs ---------------------------------------------------------

    --> "C:\Program Files\Acceleration Software\Anti-Virus\ws_uninst.exe" -s
    --> "C:\Program Files\Acceleration Software\Veloz\VelozSp\velozsp.exe" /Uninstall
    --> "C:\Program Files\eAcceleration\OnAccess\onaccess.exe" -u -s
    --> "C:\Program Files\eAcceleration\Station\station.exe" /UnRegister
    --> C:\PROGRA~1\ACCELE~1\ANTI-V~1\regsvr32.exe /u /s C:\PROGRA~1\ACCELE~1\ANTI-V~1\ssupload.dll
    --> C:\PROGRA~1\ACCELE~1\ANTI-V~1\regsvr32.exe /u /s C:\PROGRA~1\ACCELE~1\ANTI-V~1\vclnr.dll
    --> C:\PROGRA~1\COMMON~1\EACCEL~1\SysSnap\syssnap.exe -UnregServer
    --> C:\Program Files\Common Files\Real\Update_OB\rnuninst.exe RealNetworks|RealPlayer|6.0
    --> C:\WINDOWS\IsUninst.exe -fC:\WINDOWS\orun32.isu
    --> C:\WINDOWS\System32\\MSIEXEC.EXE /I {09DA4F91-2A09-4232-AB8C-6BC740096DE3} REMOVE=UpdateMgrFeature
    --> c:\WINDOWS\System32\\MSIEXEC.EXE /x {9541FED0-327F-4df0-8B96-EF57EF622F19}
    --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{39DA87A1-0B26-4562-A70C-2A6147366E47}\Setup.exe"
    --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9F765BD0-B900-4EDE-A90B-61C8A9E95C42}\Setup.exe"
    --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{BAD59025-5B73-4E12-B789-0028C5A573C2}\Setup.exe"
    --> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
    Adobe Flash Player 9 ActiveX --> C:\WINDOWS\System32\Macromed\Flash\FlashUtil9b.exe -uninstallDelete
    Adobe Flash Player ActiveX --> C:\WINDOWS\System32\Macromed\Flash\uninstall_activeX.exe
    Adobe Flash Player Plugin --> C:\WINDOWS\System32\Macromed\Flash\uninstall_plugin.exe
    Adobe Reader 8.1.1 --> MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81100000003}
    Adobe® Photoshop® Album Starter Edition 3.2 --> MsiExec.exe /I{A654A805-41D9-40C7-AA46-4AF04F044D61}
    AIM 6 --> C:\Program Files\AIM6\uninst.exe
    America Online (Choose which version to remove) --> C:\Program Files\Common Files\aolshare\Aolunins_us.exe
    AnswerWorks 4.0 Runtime - English --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{7DD9A065-2C86-4A9F-A5FF-796EC1B99DCA}\setup.exe" -l0x9 -removeonly
    AOL Coach Version 1.0(Build:20020929.1) --> C:\WINDOWS\AolCInUn.exe
    Apple Software Update --> MsiExec.exe /I{B74F042E-E1B9-4A5B-8D46-387BB172F0A4}
    ArcSoft ShowBiz 2 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{791B20D4-AE59-4DE9-B45F-BA01F3D0A493}\setup.exe" -l0x9
    Blackhawk Striker from Hewlett-Packard Desktops (remove only) --> "C:\Program Files\WildTangent\Apps\GameChannel\Games\5415BC25-6D6C-46C4-B34C-EA8470FE56D5\Uninstall.exe "
    Blasterball 2 from Hewlett-Packard Desktops (remove only) --> "C:\Program Files\WildTangent\Apps\GameChannel\Games\357ECB62-CD36-4B63-B57E-769D0CA174F4\Uninstall.exe "
    Bounce from Hewlett-Packard Desktops (remove only) --> "C:\Program Files\WildTangent\Apps\GameChannel\Games\D11F7128-8CBD-408B-8BF8-034604DEDD42\Uninstall.exe "
    Cannonballs from Hewlett-Packard Desktops (remove only) --> "C:\Program Files\WildTangent\Apps\GameChannel\Games\C99127BE-FDE5-49BD-9621-BFE5DF19AA34\Uninstall.exe "
    CiD Help --> C:\DOCUME~1\Owner\APPLIC~1\INSIDE~1\Bat okay.exe -uninstall
    Cucusoft DVD to iPod Converter 3.17 --> "C:\Program Files\Cucusoft\ipod-converter\unins000.exe "
    DVD Decrypter (Remove Only) --> "C:\Documents and Settings\Owner\My Documents\Drews games\DVD Decrypter\uninstall.exe "
    Excavation from Hewlett-Packard Desktops (remove only) --> "C:\Program Files\WildTangent\Apps\GameChannel\Games\DF479CEA-34C0-460F-9B56-93BCE4CD4086\Uninstall.exe "
    Five Card Frenzy from Hewlett-Packard Desktops (remove only) --> "C:\Program Files\WildTangent\Apps\GameChannel\Games\DA44615A-C243-46A4-8E47-184CFF33CD38\Uninstall.exe "
    GemMaster 3 from Hewlett-Packard Desktops (remove only) --> "C:\Program Files\WildTangent\Apps\GameChannel\Games\1ABC286C-DE10-4590-BEFF-4D0DFF5EA1EC\Uninstall.exe "
    Google Toolbar for Internet Explorer --> MsiExec.exe /I{DBEA1034-5882-4A88-8033-81C4EF0CFA29}
    Google Toolbar for Internet Explorer --> regsvr32 /u /s "c:\program files\google\googletoolbar2.dll "
    HijackThis 2.0.2 --> "C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
    Honeycombs from Hewlett-Packard Desktops (remove only) --> "C:\Program Files\WildTangent\Apps\GameChannel\Games\1FEF9671-50F6-4CB0-9E96-304EB14158E0\Uninstall.exe "
    Hotfix for MDAC 2.80 (KB911562) --> "C:\WINDOWS\$SQLUninstallMDAC28-KB911562-x86-ENU$\spuninst\spuninst.exe "
    HP Deskjet Preloaded Printer Drivers --> MsiExec.exe /X{F419D20A-7719-4639-8E30-C073A040D878}
    HP Image Zone 4.0 --> C:\Program Files\Hewlett-Packard\Digital Imaging\uninstall\hpzscr01.exe -datfile hpqscr01.dat
    HP Instant Support --> C:\PROGRA~1\HPINST~1\UNWISE.EXE C:\PROGRA~1\HPINST~1\INSTALL.LOG
    HP Organize --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D0122362-6333-4DE4-93F6-A5A2F3CC101A}\Setup.exe" UNINSTALL
    HP Photo and Imaging 2.0 - Photosmart Cameras --> MsiExec.exe /X{5D7F0A0E-369E-46C0-9F99-FAB21A064781}
    HP Software Update --> MsiExec.exe /X{457791C5-D702-4143-A7B2-2744BE9573F2}
    HPImageZone --> MsiExec.exe /X{11946FA8-329A-4DDF-B867-A32781FED8EE}
    Intel(R) Extreme Graphics 2 Driver --> RUNDLL32.EXE C:\WINDOWS\System32\ialmrem.dll,UninstallW2KIGfx PCI\VEN_8086&DEV_2572
    IntelliMover Data Transfer Demo --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{14589F05-C658-4594-9429-D437BA688686}\Setup.exe" -l0x9
    InterVideo WinDVD Player --> "C:\Program Files\InstallShield Installation Information\{98E8A2EF-4EAE-43B8-A172-74842B764777}\setup.exe" REMOVEALL
    iTunes --> MsiExec.exe /I{E3FEE4E7-4488-4A3F-A6BD-13745936EADB}
    Java 2 Runtime Environment, SE v1.4.1_02 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{EFCE5837-FC21-11D6-9D24-00010240CE95}\setup.exe" Anytext
    Java DB 10.2.2.0 --> MsiExec.exe /X{0ECB59D5-A3FC-4D61-AD3B-6CE679B3F852}
    Java Web Start --> "C:\Program Files\Java Web Start\uninst-javaws.exe "
    Java(TM) 6 Update 2 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160020}
    Java(TM) 6 Update 3 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160030}
    Java(TM) SE Development Kit 6 Update 2 --> MsiExec.exe /I{32A3A4F4-B792-11D6-A78A-00B0D0160020}
    JCreator LE 2.50 --> "C:\Program Files\Xinox Software\JCreator LE\unins000.exe "
    KBD --> C:\HP\KBD\KBD.EXE uninstalled
    LiveReg (Symantec Corporation) --> C:\Program Files\Common Files\Symantec Shared\LiveReg\VcSetup.exe /REMOVE
    LogMeIn --> MsiExec.exe /I{7E7658A2-CD3F-48A7-93EA-0882BCA4FD2A}
    Malwarebytes' Anti-Malware --> "C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe "
    Mars Rover from Hewlett-Packard Desktops (remove only) --> "C:\Program Files\WildTangent\Apps\GameChannel\Games\53EF27E9-150C-4063-8343-61C45FC6BB98\Uninstall.exe "
    Memories Disc Creator 2.0 --> MsiExec.exe /X{2E132061-C78A-48D4-A899-1D13B9D189FA}
    Microsoft Money 2003 --> MsiExec.exe /I{01F9D88C-3C86-4E82-840A-101A3221F67A}
    Microsoft Money 2003 System Pack --> MsiExec.exe /I{02B42D23-10F2-4862-ADA4-3DF1EA0021B2}
    Microsoft Office XP Media Content --> MsiExec.exe /I{90300409-6000-11D3-8CFE-0050048383C9}
    Microsoft Office XP Small Business --> MsiExec.exe /I{91130409-6000-11D3-8CFE-0050048383C9}
    Microsoft Plus! Digital Media Edition --> MsiExec.exe /I{C6A7AF96-4EB1-4AAE-8318-1AB393C64F88}
    Microsoft Visual J# .NET Redistributable Package 1.1 --> MsiExec.exe /X{1A655D51-1423-48A3-B748-8F5A0BE294C8}
    Microsoft Works 7.0 --> MsiExec.exe /I{764D06D8-D8DE-411E-A1C8-D9E9380F8A84}
    Mozilla Firefox (2.0.0.13) --> C:\PROGRA~1\Mozilla Firefox\uninstall\helper.exe
    Multimedia Card Reader --> C:\Program Files\Common Files\InstallShield\Driver\8\Intel 32\IDriver.exe /M{E05895C5-FE97-4334-8D73-B0089FD07CE3}
    MySpaceIM --> C:\Program Files\MySpace\IM\Uninstall.exe
    NVIDIA Gart Driver --> C:\WINDOWS\System32\nvugart.exe Uninstall C:\WINDOWS\System32\Nvgart.nvu,NVIDIA Gart Driver
    NVIDIA Windows 2000/XP Display Drivers --> rundll32.exe C:\WINDOWS\System32\nvinstnt.dll,NvUninstallNT4 nvhp.inf
    OmniPass --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F4E57F49-84B4-4CF2-B0A1-8CA1752BDF7E}\Setup.exe" -l0x9
    OpenOffice.org 2.3 --> MsiExec.exe /I{2F29D6D2-824E-4FEF-8AED-7013F39F642A}
    Orbital from Hewlett-Packard Desktops (remove only) --> "C:\Program Files\WildTangent\Apps\GameChannel\Games\62067F4C-84A9-45B9-8573-B90468B0A3EF\Uninstall.exe "
    Otto from Hewlett-Packard Desktops (remove only) --> "C:\Program Files\WildTangent\Apps\GameChannel\Games\BFBCBAE3-8293-4215-9C4F-C2402C118EDB\Uninstall.exe "
    PC-Doctor for Windows --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{1F7CCFA3-D926-4882-B2A5-A0217ED25597}\Setup.exe"
    Photosmart 140,240,7200,7600,7700,7900 Series --> C:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\setup\hpzscr01.exe -datfile hphscr01.dat
    Photosmart 320,370,7400,8100,8400 Series --> C:\Program Files\Hewlett-Packard\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\setup\hpzscr01.exe -datfile hphscr01.dat
    Polar Bowler from Hewlett-Packard Desktops (remove only) --> "C:\Program Files\WildTangent\Apps\GameChannel\Games\36317AE4-57EC-4F3E-B828-009A3DD96BE8\Uninstall.exe "
    PS2 --> C:\WINDOWS\system32\ps2.exe uninstall
    Python 2.2 combined Win32 extensions --> C:\Python22\Lib\SITE-P~1\UNWISE~1.EXE C:\Python22\Lib\SITE-P~1\w32inst.log
    Python 2.2.1 --> C:\Python22\UNWISE.EXE C:\Python22\INSTALL.LOG
    Quicken 2003 New User Edition --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{F61F2821-694C-475F-99AB-6AF2EFDF40FD} anything
    QuickTime --> MsiExec.exe /I{5B09BD67-4C99-46A1-8161-B7208CE18121}
    RealOne Player --> C:\Program Files\Common Files\Real\Update_OB\rnuninst.exe RealNetworks|RealPlayer|6.0
    RecordNow! --> MsiExec.exe /I{9541FED0-327F-4DF0-8B96-EF57EF622F19}
    Rhapsody Player Engine --> MsiExec.exe /I{84F1DE76-C48C-4281-87A0-CC9548D1E7F9}
    Roll --> C:\WINDOWS\UniFish3.exe C:\Program Files\Hasbro Interactive\RollerCoaster Tycoon\RollerCoaster Tycoon.log
    S3Display --> s3uninst.exe -reg 5 'HKLM\Software\S3\S3Uninst\S3Display'
    S3Gamma2 --> s3uninst.exe -reg 5 'HKLM\Software\S3\S3Uninst\S3Gamma2'
    S3Info2 --> s3uninst.exe -reg 5 'HKLM\Software\S3\S3Uninst\S3Info2'
    S3Overlay --> s3uninst.exe -reg 5 'HKLM\Software\S3\S3Uninst\S3Overlay'
    Security Update for Step By Step Interactive Training (KB898458) --> "C:\WINDOWS\$NtUninstallKB898458$\spuninst\spuninst.exe "
    Slyder from Hewlett-Packard Desktops (remove only) --> "C:\Program Files\WildTangent\Apps\GameChannel\Games\5F804D2B-A66D-4F0A-B64E-FBDA3F52E3F8\Uninstall.exe "
    Sonic Update Manager --> MsiExec.exe /I{09DA4F91-2A09-4232-AB8C-6BC740096DE3}
    StopSign by eAcceleration --> C:\PROGRA~1\COMMON~1\EACCEL~1\INSTAL~1\eaccelsetup.exe -AddRemove
    STX from Hewlett-Packard Desktops (remove only) --> "C:\Program Files\WildTangent\Apps\GameChannel\Games\342970EF-F8DF-4E9B-8477-A1A03E3E15E1\Uninstall.exe "
    The Sims Superstar --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{1A7F8DF6-5A3E-4CDF-BC82-BE26B407E21B}\setup.exe" -l0009
    toolkit --> c:\Windows\HPTK\unhptkit.exe
    TurboTax ItsDeductible 2006 --> MsiExec.exe /X{AFF1EA96-9C23-4249-B7D4-CD4B54D4582F}
    TurboTax Premier 2007 --> C:\Program Files\TurboTax\Premier 2007\TaxUnst.EXE "C:\Program Files\TurboTax\Premier 2007\Uninstall.log" -NoGui
    TurboTax Premier Investments 2006 --> C:\Program Files\TurboTax\Premier 2006\TaxUnst.EXE "C:\Program Files\TurboTax\Premier 2006\Uninstall.log" -NoGui
    Updates from HP --> C:\WINDOWS\BWUnin-6.2.3.66.exe -AppId 137903
    Viewpoint Media Player --> C:\Program Files\Viewpoint\Viewpoint Experience Technology\mtsAxInstaller.exe /u
    Virtual Warfare from Hewlett-Packard Desktops (remove only) --> "C:\Program Files\WildTangent\Apps\GameChannel\Games\4F0AE1FB-4082-4A27-8363-05D292D92FB0\Uninstall.exe "
    Weblink --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{4FCC384C-18EA-4E25-9281-A06AE006D219}\setup.exe" -l0x9
    WexTech AnswerWorks --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{EA2BEBD6-87B9-41E5-95AC-7E4C165A9475}\SETUP.EXE" -l0x9 -eliminate


    -- Application Event Log -------------------------------------------------------

    Event Record #/Type1732 / Error
    Event Submitted/Written: 04/15/2008 03:37:17 PM
    Event ID/Source: 1002 / Application Hang
    Event Description:
    Hanging application hpqgalry.exe, version 43.1.5.0, hang module mscorwks.dll, version 1.1.4322.573, hang address 0x0002e29f.

    Event Record #/Type1558 / Warning
    Event Submitted/Written: 04/14/2008 03:27:19 PM
    Event ID/Source: 1015 / MsiInstaller
    Event Description:
    Failed to connect to server. Error: 0x80080005

    Event Record #/Type1546 / Error
    Event Submitted/Written: 04/14/2008 11:39:23 AM
    Event ID/Source: 1002 / Application Hang
    Event Description:
    Hanging application stopsignav.exe, version 0.0.1.4274, hang module vclnr.dll, version 2.0.0.98, hang address 0x00074f2c.

    Event Record #/Type1545 / Error
    Event Submitted/Written: 04/14/2008 11:33:54 AM
    Event ID/Source: 1002 / Application Hang
    Event Description:
    Hanging application hpqgalry.exe, version 43.1.5.0, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

    Event Record #/Type1460 / Warning
    Event Submitted/Written: 04/13/2008 08:23:58 PM
    Event ID/Source: 1524 / Userenv
    Event Description:
    Windows cannot unload your classes registry file - it is still in use by other applications or services. The file will be unloaded when it is no longer in use.



    -- Security Event Log ----------------------------------------------------------

    No Errors/Warnings found.


    -- System Event Log ------------------------------------------------------------

    Event Record #/Type8396 / Warning
    Event Submitted/Written: 04/16/2008 04:05:47 AM
    Event ID/Source: 36 / W32Time
    Event Description:
    The time service has not been able to synchronize the system time
    for 49152 seconds because none of the time providers has been able to
    provide a usable time stamp. The system clock is unsynchronized.

    Event Record #/Type8381 / Error
    Event Submitted/Written: 04/15/2008 02:27:50 PM
    Event ID/Source: 7000 / Service Control Manager
    Event Description:
    The mrtRate service failed to start due to the following error:
    %%2

    Event Record #/Type8375 / Error
    Event Submitted/Written: 04/15/2008 02:25:15 PM
    Event ID/Source: 7000 / Service Control Manager
    Event Description:
    The mrtRate service failed to start due to the following error:
    %%2

    Event Record #/Type8369 / Error
    Event Submitted/Written: 04/15/2008 02:22:30 PM
    Event ID/Source: 7000 / Service Control Manager
    Event Description:
    The mrtRate service failed to start due to the following error:
    %%2

    Event Record #/Type8363 / Error
    Event Submitted/Written: 04/15/2008 02:19:44 PM
    Event ID/Source: 7000 / Service Control Manager
    Event Description:
    The mrtRate service failed to start due to the following error:
    %%2



    -- End of Deckard's System Scanner: finished at 2008-04-16 11:28:03 ------------
     
    covian,
    #13
  15. 2008/04/16
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Highlight and copy the bolded command below.

    "%userprofile%\desktop\dss.exe" /daft
    • Click Start>Run and paste the command in, then hit enter.
    • An interface of Deckards file association fix will open.
    • Click Scan.
    • You should the following come up in the list.
      • .cpl - cplfile - shell\cplopen\command - rundll32.exe shell32.dll,Control_RunDLL "%1 ",%*
      • .cpl - cplfile - shell\runas\command - rundll32.exe shell32.dll,Control_RunDLLAsUser "%1 ",%*
      • .reg - regfile - shell\open\command - regedit.exe "%1" %*
      • .scr - scrfile - shell\open\command - "%1" %*
    • Check the box next to then, then click Fix.
    • Exit when complete.



    Please delete the ComboFix.exe file you currently have and download a fresh copy from here, saving it to your desktop.

    Once again, please disable any realtime protection applications. Highlight and copy the contents of the code box below and paste it into a blank notepad, then save it to your desktop as;

    Filename: CFScript.txt
    Save As Type: All Files (*.*)

    Code:
    File::
C:\WINDOWS\Tasks\874237A78325AAB3.job
C:\WINDOWS\glypoxkj.dll
C:\Documents and Settings\All Users\Application Data\ahadypex.dll
Folder::
C:\Documents and Settings\All Users\Application Data\dktofqxe
C:\WINDOWS\cuawsppw
Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
 "Jfw "=-
    Close all other windows and programs. Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button. Combofix should run and may reboot the computer when it's done. A log will open when it's complete. Post the contents of that log and another fresh HijackThis log.

    Please do not click on the ComboFix window while it is running a scan. This can cause it to stall.
     
    noahdfear,
    #14
  16. 2008/04/18
    covian

    covian Inactive Thread Starter

    Joined:
    2008/03/30
    Messages:
    22
    Likes Received:
    0
    When I pasted the stuff in the run box it gave me an error. Also I cant seem to find ComboFix so I can do the second part of your instructions.
     
    covian,
    #15
  17. 2008/04/18
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    ComboFix.exe was on the desktop. Is it no longer there?
    dss.exe was too. Is it gone as well?
     
    noahdfear,
    #16
  18. 2008/04/19
    covian

    covian Inactive Thread Starter

    Joined:
    2008/03/30
    Messages:
    22
    Likes Received:
    0
    I figure the pasting the stuff into run box out. I ran the scan and fixed what you said. Now I still cant find ComboFix I ran a search and nothing. Is SmitfraudFix the same thing??
     
    covian,
    #17
  19. 2008/04/19
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    OK, just download ComboFix from the link I provided and save it to your desktop, then follow the instructions to create the CFScript.txt and use it to run ComboFix.
     
    noahdfear,
    #18
  20. 2008/04/24
    covian

    covian Inactive Thread Starter

    Joined:
    2008/03/30
    Messages:
    22
    Likes Received:
    0
    ComboFix 08-04-22.5 - Owner 2008-04-24 11:29:31.2 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.1.1252.1.1033.18.158 [GMT -4:00]
    Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe
    Command switches used :: C:\Documents and Settings\Owner\Desktop\CFScript.txt
    * Created a new restore point

    FILE ::
    C:\Documents and Settings\All Users\Application Data\ahadypex.dll
    C:\WINDOWS\glypoxkj.dll
    C:\WINDOWS\Tasks\874237A78325AAB3.job
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\Documents and Settings\All Users\Application Data\ahadypex.dll
    C:\Documents and Settings\All Users\Application Data\dktofqxe
    C:\WINDOWS\cuawsppw
    C:\WINDOWS\cuawsppw\1.png
    C:\WINDOWS\cuawsppw\2.png
    C:\WINDOWS\cuawsppw\3.png
    C:\WINDOWS\cuawsppw\4.png
    C:\WINDOWS\cuawsppw\5.png
    C:\WINDOWS\cuawsppw\6.png
    C:\WINDOWS\cuawsppw\7.png
    C:\WINDOWS\cuawsppw\8.png
    C:\WINDOWS\cuawsppw\9.png
    C:\WINDOWS\cuawsppw\bottom-rc.gif
    C:\WINDOWS\cuawsppw\config.png
    C:\WINDOWS\cuawsppw\content.png
    C:\WINDOWS\cuawsppw\download.gif
    C:\WINDOWS\cuawsppw\frame-bg.gif
    C:\WINDOWS\cuawsppw\frame-bottom-left.gif
    C:\WINDOWS\cuawsppw\frame-h1bg.gif
    C:\WINDOWS\cuawsppw\head.png
    C:\WINDOWS\cuawsppw\icon.png
    C:\WINDOWS\cuawsppw\indexwp.html
    C:\WINDOWS\cuawsppw\main.css
    C:\WINDOWS\cuawsppw\memory-prots.png
    C:\WINDOWS\cuawsppw\net.png
    C:\WINDOWS\cuawsppw\pc-mag.gif
    C:\WINDOWS\cuawsppw\pc.gif
    C:\WINDOWS\cuawsppw\poloska1.png
    C:\WINDOWS\cuawsppw\poloska2.png
    C:\WINDOWS\cuawsppw\poloska3.png
    C:\WINDOWS\cuawsppw\promowp1.html
    C:\WINDOWS\cuawsppw\promowp2.html
    C:\WINDOWS\cuawsppw\promowp3.html
    C:\WINDOWS\cuawsppw\promowp4.html
    C:\WINDOWS\cuawsppw\promowp5.html
    C:\WINDOWS\cuawsppw\reg.png
    C:\WINDOWS\cuawsppw\repair.png
    C:\WINDOWS\cuawsppw\scr-1.png
    C:\WINDOWS\cuawsppw\scr-2.png
    C:\WINDOWS\cuawsppw\start.png
    C:\WINDOWS\cuawsppw\styles.css
    C:\WINDOWS\cuawsppw\Thumbs.db
    C:\WINDOWS\cuawsppw\top-rc.gif
    C:\WINDOWS\cuawsppw\vline.gif
    C:\WINDOWS\cuawsppw\wp.png
    C:\WINDOWS\glypoxkj.dll
    C:\WINDOWS\Tasks\874237A78325AAB3.job

    .
    ((((((((((((((((((((((((( Files Created from 2008-03-24 to 2008-04-24 )))))))))))))))))))))))))))))))
    .

    2008-04-22 11:33 . 2008-04-22 11:36 <DIR> d-------- C:\WINDOWS\SxsCaPendDel
    2008-04-22 11:30 . 2008-04-22 11:30 <DIR> d-------- C:\Program Files\Common Files\Adobe AIR
    2008-04-22 11:30 . 2008-04-22 11:30 <DIR> d-------- C:\Program Files\Adobe Media Player
    2008-04-21 11:24 . 2008-04-21 11:24 <DIR> d-------- C:\Program Files\Belkin
    2008-04-21 11:08 . 2008-04-21 11:08 <DIR> d-------- C:\Program Files\RegCure
    2008-04-21 10:53 . 2008-04-21 10:53 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
    2008-04-16 12:38 . 2008-04-16 12:38 9,216 --ahs---- C:\WINDOWS\Thumbs.db
    2008-04-16 11:23 . 2008-04-16 11:23 <DIR> d-------- C:\Deckard
    2008-04-14 12:58 . 2004-08-03 22:42 20,480 --a------ C:\WINDOWS\system32\sprecovr.exe
    2008-04-14 12:50 . 2002-08-29 08:00 4,186,256 --a------ C:\WINDOWS\system32\dllcache\luna.mst
    2008-04-14 12:47 . 2002-08-29 08:00 2,049,999 --a------ C:\WINDOWS\system32\dllcache\nt5.cat
    2008-04-14 11:40 . 2008-04-14 11:40 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-04-14 11:40 . 2008-04-14 11:40 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Malwarebytes
    2008-04-14 11:40 . 2008-04-14 11:40 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-04-14 11:21 . 2005-04-16 13:44 91,392 --a------ C:\Documents and Settings\LogMeInRemoteUser\Application Data\GDIPFONTCACHEV1.DAT
    2008-04-14 11:08 . 2003-08-23 10:34 <DIR> d-------- C:\Documents and Settings\LogMeInRemoteUser\WINDOWS
    2008-04-14 11:08 . 2003-11-15 19:54 <DIR> d---s---- C:\Documents and Settings\LogMeInRemoteUser\UserData
    2008-04-14 11:08 . 2004-10-16 22:40 <DIR> d-------- C:\Documents and Settings\LogMeInRemoteUser\Application Data\You've Got Pictures Screensaver
    2008-04-14 11:08 . 2004-10-03 15:27 <DIR> d-------- C:\Documents and Settings\LogMeInRemoteUser\Application Data\WeatherBug
    2008-04-14 11:08 . 2004-08-17 18:11 <DIR> d-------- C:\Documents and Settings\LogMeInRemoteUser\Application Data\Viewpoint
    2008-04-14 11:08 . 2004-01-14 19:06 <DIR> d-------- C:\Documents and Settings\LogMeInRemoteUser\Application Data\Template
    2008-04-14 11:08 . 2003-08-28 23:16 <DIR> d-------- C:\Documents and Settings\LogMeInRemoteUser\Application Data\Symantec
    2008-04-14 11:08 . 2003-08-23 10:12 <DIR> d-------- C:\Documents and Settings\LogMeInRemoteUser\Application Data\Sonic
    2008-04-14 11:08 . 2003-08-23 23:26 <DIR> d-------- C:\Documents and Settings\LogMeInRemoteUser\Application Data\SampleView
    2008-04-14 11:08 . 2005-03-30 12:30 <DIR> d-------- C:\Documents and Settings\LogMeInRemoteUser\Application Data\Musicmatch
    2008-04-14 11:08 . 2003-11-13 21:13 <DIR> d-------- C:\Documents and Settings\LogMeInRemoteUser\Application Data\Motive
    2008-04-14 11:08 . 2004-06-13 07:40 <DIR> d-------- C:\Documents and Settings\LogMeInRemoteUser\Application Data\Lycos
    2008-04-14 11:08 . 2003-11-19 21:25 <DIR> d-------- C:\Documents and Settings\LogMeInRemoteUser\Application Data\Kontiki
    2008-04-14 11:08 . 2005-01-06 20:35 <DIR> d-------- C:\Documents and Settings\LogMeInRemoteUser\Application Data\Intuit
    2008-04-14 11:08 . 2004-04-12 22:38 <DIR> d-------- C:\Documents and Settings\LogMeInRemoteUser\Application Data\InterVideo
    2008-04-14 11:08 . 2003-08-28 23:19 <DIR> d-------- C:\Documents and Settings\LogMeInRemoteUser\Application Data\interMute
    2008-04-14 11:08 . 2004-08-23 19:52 <DIR> d-------- C:\Documents and Settings\LogMeInRemoteUser\Application Data\HP
    2008-04-14 11:08 . 2004-10-16 22:40 <DIR> d--h----- C:\Documents and Settings\LogMeInRemoteUser\Application Data\GTek
    2008-04-14 11:08 . 2003-11-14 08:04 <DIR> d-------- C:\Documents and Settings\LogMeInRemoteUser\Application Data\ArcSoft
    2008-04-14 11:08 . 2006-08-19 09:48 <DIR> d-------- C:\Documents and Settings\LogMeInRemoteUser\Application Data\AOL
    2008-04-14 11:08 . 2005-08-04 19:38 <DIR> d-------- C:\Documents and Settings\LogMeInRemoteUser\Application Data\Aim
    2008-04-14 11:08 . 2005-02-20 10:58 <DIR> d-------- C:\Documents and Settings\LogMeInRemoteUser\Application Data\AdobeUM
    2008-04-14 11:08 . 2003-11-13 20:49 <DIR> d-------- C:\Documents and Settings\LogMeInRemoteUser\.jpi_cache
    2008-04-14 11:08 . 2003-11-13 20:48 <DIR> d-------- C:\Documents and Settings\LogMeInRemoteUser\.java
    2008-04-14 11:08 . 2008-04-24 10:22 <DIR> d-------- C:\Documents and Settings\LogMeInRemoteUser
    2008-04-14 11:08 . 2008-04-24 11:13 1,024 --ah----- C:\Documents and Settings\LogMeInRemoteUser\ntuser.dat.LOG
    2008-04-14 06:41 . 2008-04-14 06:41 <DIR> d--hs---- C:\found.000
    2008-04-13 22:13 . 2007-11-15 18:46 83,288 --a------ C:\WINDOWS\system32\LMIRfsClientNP.dll
    2008-04-13 22:13 . 2007-08-03 15:09 46,112 --a------ C:\WINDOWS\system32\drivers\LMIRfsDriver.sys
    2008-04-13 22:13 . 2007-11-15 18:46 21,496 --a------ C:\WINDOWS\system32\LMIport.dll
    2008-04-13 22:12 . 2008-04-24 10:18 <DIR> d-------- C:\Program Files\LogMeIn
    2008-04-13 22:12 . 2007-11-15 18:46 87,352 --a------ C:\WINDOWS\system32\LMIinit.dll
    2008-04-13 22:12 . 2008-04-13 22:12 1,024 --a------ C:\.rnd
    2008-04-13 17:45 . 2008-04-13 17:45 85,568 --a------ C:\WINDOWS\system32\mmaxsbuh.dll._eac_qt_
    2008-04-13 17:40 . 2008-04-13 17:40 101,091 --a------ C:\WINDOWS\BM7be1867e.xml
    2008-04-13 17:40 . 2008-04-13 17:40 95,296 --a------ C:\WINDOWS\system32\uslohbhj.dll._eac_qt_
    2008-04-13 17:40 . 2008-04-13 17:40 3,648 --a------ C:\WINDOWS\system32\ghubmtqi.dll._eac_qt_
    2008-04-13 17:34 . 2008-04-13 17:34 8,268 --a------ C:\WINDOWS\system32\L56B2.tmp
    2008-04-13 17:34 . 2008-04-13 17:34 397 --a------ C:\WINDOWS\system32\L71FB.tmp
    2008-04-13 17:34 . 2008-04-13 17:34 397 --a------ C:\WINDOWS\system32\L6345.tmp
    2008-04-13 17:34 . 2008-04-13 17:34 397 --a------ C:\WINDOWS\system32\L58A6.tmp
    2008-04-13 17:34 . 2008-04-13 17:34 397 --a------ C:\WINDOWS\system32\L576E.tmp
    2008-03-30 12:50 . 2008-03-30 12:50 1,126 --a------ C:\WINDOWS\mozver.dat
    2008-03-30 10:48 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
    2008-03-30 10:48 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
    2008-03-30 10:48 . 2008-03-29 00:19 86,528 --a------ C:\WINDOWS\system32\VACFix.exe
    2008-03-30 10:48 . 2008-03-26 09:50 82,432 --a------ C:\WINDOWS\system32\IEDFix.exe
    2008-03-30 10:48 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
    2008-03-30 10:48 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
    2008-03-30 10:48 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
    2008-03-30 10:32 . 2008-03-30 10:32 812,344 --a------ C:\HJTInstall.exe
    2008-03-30 10:17 . 2003-11-13 20:49 <DIR> d-------- C:\Documents and Settings\Administrator.DESKTOP\.jpi_cache
    2008-03-30 10:17 . 2003-11-13 20:48 <DIR> d-------- C:\Documents and Settings\Administrator.DESKTOP\.java
    2008-03-30 10:16 . 2003-08-23 10:34 <DIR> d-------- C:\Documents and Settings\Administrator.DESKTOP\WINDOWS
    2008-03-30 10:16 . 2008-03-30 10:17 <DIR> d---s---- C:\Documents and Settings\Administrator.DESKTOP\UserData
    2008-03-30 10:16 . 2008-03-30 10:16 <DIR> d-------- C:\Documents and Settings\Administrator.DESKTOP
    2008-03-30 10:16 . 2008-04-24 11:29 1,024 --ah----- C:\Documents and Settings\Administrator.DESKTOP\ntuser.dat.LOG
    2008-03-27 21:03 . 2008-03-27 21:03 <DIR> d-------- C:\Documents and Settings\Owner\My Doucments

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-04-24 10:19 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
    2008-04-24 00:29 --------- d-----w C:\Documents and Settings\Owner\Application Data\OpenOffice.org2
    2008-04-23 10:34 --------- d-----w C:\Program Files\America Online 8.0
    2008-04-23 06:22 --------- d-----w C:\Documents and Settings\All Users\Application Data\eAcceleration
    2008-04-22 19:21 65,536 ----a-w C:\WINDOWS\DUMP7b0c.tmp
    2008-04-21 14:29 --------- d-----w C:\Documents and Settings\Owner\Application Data\MSN6
    2008-04-16 16:19 --------- d-----w C:\Program Files\Common Files\Adobe
    2008-04-14 16:20 --------- d-----w C:\Program Files\Easy Internet signup
    2008-04-14 16:15 --------- d-----w C:\Program Files\MUSICMATCH
    2008-04-14 16:14 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-04-13 22:32 3,836 ----a-w C:\WINDOWS\viassary-hp.reg
    2008-04-10 16:31 --------- d-----w C:\Program Files\Google
    2008-04-10 01:42 --------- d-----w C:\Program Files\Real
    2008-03-30 14:32 --------- d-----w C:\Program Files\Trend Micro
    2008-03-08 15:55 --------- d-----w C:\Program Files\AIM
    2008-03-06 00:44 --------- d-----w C:\Program Files\AIM6
    2008-03-06 00:16 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL Downloads
    2008-02-28 21:00 --------- d-----w C:\Documents and Settings\Owner\Application Data\MySpace
    2008-02-28 20:59 --------- d-----w C:\Program Files\MySpace
    2008-01-06 20:04 70,712 ----a-w C:\Documents and Settings\Owner\Application Data\GDIPFONTCACHEV1.DAT
    2007-08-22 11:39 71,502 ----a-w C:\Program Files\setup.exe._eac_qt_
    2005-12-19 21:49 785,122 -c--a-w C:\Documents and Settings\Owner\ht.com
    2005-12-18 15:40 784,830 -c--a-w C:\Documents and Settings\Owner\sys0.com
    2005-04-16 17:44 91,392 -c--a-w C:\WINDOWS\system32\config\systemprofile\Application Data\GDIPFONTCACHEV1.DAT
    2005-04-16 17:44 91,392 -c--a-w C:\Documents and Settings\Default User\Application Data\GDIPFONTCACHEV1.DAT
    2004-11-21 17:15 553,782 -csha-w C:\WINDOWS\inf\gminib.bak1
    2004-11-06 00:59 604,794 -csha-w C:\WINDOWS\inf\bdnur.bak2
    2003-08-23 14:30 1,687 ----a-w C:\Program Files\HP Organize.lnk
    2007-08-09 18:08 8,784 ----a-w C:\Program Files\mozilla firefox\plugins\ractrlkeyhook.dll
    2007-08-09 18:10 245,408 ----a-w C:\Program Files\mozilla firefox\plugins\unicows.dll
    2004-10-27 20:13 32 -csha-w C:\WINDOWS\{8A7CCB54-21B0-43E1-80FB-9A58C5524A5A}.dat
    2004-10-21 00:34 3,296,136 -csha-w C:\WINDOWS\Driver Cache\ksatsm.bak2
    2004-10-12 12:44 527,707 -csha-w C:\WINDOWS\Driver Cache\rcnib.bak2
    2004-11-06 00:59 604,794 -csha-w C:\WINDOWS\inf\bdnur.bak2
    2004-11-21 17:15 553,782 -csha-w C:\WINDOWS\inf\gminib.bak1
    2004-10-06 00:40 501,990 -csha-w C:\WINDOWS\system\rvsvrs.bak2
    .

    ------- Sigcheck -------

    2004-09-29 14:27 656896 2c07195588d69a067c2afdaa31759295 C:\WINDOWS\$hf_mig$\KB834707\SP2QFE\wininet.dll
    2005-01-27 13:08 657920 a8eac5330876548e9966a7d13025d196 C:\WINDOWS\$hf_mig$\KB867282\SP2QFE\wininet.dll
    2005-05-02 16:57 658944 e1e18136f9dd3df1ad9c82193a5898a6 C:\WINDOWS\$hf_mig$\KB883939\SP2QFE\wininet.dll
    2005-03-10 03:43 657920 c8663b488996e89a84c3d17c1d12b79e C:\WINDOWS\$hf_mig$\KB890923\SP2QFE\wininet.dll
    2006-06-23 11:33 575488 7e7760c7f263ec7a740ee265b263f770 C:\WINDOWS\$NtServicePackUninstall$\wininet.dll
    2004-08-04 03:56 656384 c0823fc5469663ba63e7db88f9919d70 C:\WINDOWS\$NtUninstallKB834707$\wininet.dll
    2004-09-29 14:47 656896 cba65b573c66fe23f647ff96e3a10994 C:\WINDOWS\$NtUninstallKB867282$\wininet.dll
    2005-03-10 04:02 656896 6f018d6319be4f96426ea829b79e05d5 C:\WINDOWS\$NtUninstallKB883939$\wininet.dll
    2005-01-27 13:13 656896 b5e043e440b210014e021b24cf0a72e3 C:\WINDOWS\$NtUninstallKB890923$\wininet.dll
    2002-08-29 08:00 599040 f3587750a7481dccbea13d473a0700be C:\WINDOWS\$NtUninstallKB918899-IE6SP1-20060725.123917$\wininet.dll
    2004-08-04 03:56 656384 c0823fc5469663ba63e7db88f9919d70 C:\WINDOWS\ServicePackFiles\i386\wininet.dll
    2004-08-04 03:56 656384 c0823fc5469663ba63e7db88f9919d70 C:\WINDOWS\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\wininet.dll
    2006-06-23 11:33 575488 7e7760c7f263ec7a740ee265b263f770 C:\WINDOWS\system32\wininet.dll
    2006-06-23 11:33 575488 7e7760c7f263ec7a740ee265b263f770 C:\WINDOWS\system32\dllcache\wininet.dll
    .
    ((((((((((((((((((((((((((((( snapshot@2008-04-13_20.34.42.90 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2003-01-13 20:53:24 50,816 -c----w C:\WINDOWS\$NtServicePackUninstall$\1394bus.sys
    + 2007-12-19 23:09:17 2,678 -c----w C:\WINDOWS\$NtServicePackUninstall$\4ozftff9.dat
    + 2006-08-16 12:14:23 95,232 -c----w C:\WINDOWS\$NtServicePackUninstall$\6to4svc.dll
    + 2002-08-29 12:00:00 179,200 -c----w C:\WINDOWS\$NtServicePackUninstall$\accwiz.exe
    + 2002-08-29 12:00:00 1,818,624 -c----w C:\WINDOWS\$NtServicePackUninstall$\acgenral.dll
    + 2002-08-29 12:00:00 406,528 -c----w C:\WINDOWS\$NtServicePackUninstall$\aclayers.dll
    + 2002-08-29 12:00:00 125,440 -c----w C:\WINDOWS\$NtServicePackUninstall$\aclua.dll
    + 2002-08-29 12:00:00 107,008 -c----w C:\WINDOWS\$NtServicePackUninstall$\aclui.dll
    + 2002-08-29 12:00:00 179,328 -c----w C:\WINDOWS\$NtServicePackUninstall$\acpi.sys
    + 2002-08-29 12:00:00 219,136 -c----w C:\WINDOWS\$NtServicePackUninstall$\acspecfc.dll
    + 2002-08-29 12:00:00 181,760 -c----w C:\WINDOWS\$NtServicePackUninstall$\activeds.dll
    + 2002-08-29 12:00:00 4,096 -c----w C:\WINDOWS\$NtServicePackUninstall$\actmovie.exe
    + 2002-08-29 12:00:00 98,304 -c----w C:\WINDOWS\$NtServicePackUninstall$\actxprxy.dll
    + 2002-08-29 12:00:00 255,488 -c----w C:\WINDOWS\$NtServicePackUninstall$\acverfyr.dll
    + 2002-08-29 12:00:00 107,520 -c----w C:\WINDOWS\$NtServicePackUninstall$\acxtrnal.dll
    + 2002-05-15 02:08:54 20,540 -c----w C:\WINDOWS\$NtServicePackUninstall$\admin.dll
    + 2002-05-15 02:08:54 16,439 -c----w C:\WINDOWS\$NtServicePackUninstall$\admin.exe
    + 2002-08-29 12:00:00 57,344 -c----w C:\WINDOWS\$NtServicePackUninstall$\admparse.dll
    + 2002-08-29 12:00:00 162,816 -c----w C:\WINDOWS\$NtServicePackUninstall$\adsldp.dll
    + 2002-08-29 12:00:00 139,776 -c----w C:\WINDOWS\$NtServicePackUninstall$\adsldpc.dll
    + 2002-08-29 12:00:00 62,464 -c----w C:\WINDOWS\$NtServicePackUninstall$\adsmsext.dll
    + 2002-08-29 12:00:00 239,616 -c----w C:\WINDOWS\$NtServicePackUninstall$\adsnt.dll
    + 2002-08-29 12:00:00 558,080 -c----w C:\WINDOWS\$NtServicePackUninstall$\advapi32.dll
    + 2002-08-29 12:00:00 91,136 -c----w C:\WINDOWS\$NtServicePackUninstall$\advpack.dll
    + 2002-08-29 07:16:38 142,208 -c----w C:\WINDOWS\$NtServicePackUninstall$\aec.sys
    + 2002-08-29 12:00:00 131,968 -c----w C:\WINDOWS\$NtServicePackUninstall$\afd.sys
    + 2002-08-29 12:00:00 22,016 -c----w C:\WINDOWS\$NtServicePackUninstall$\agentanm.dll
    + 2002-08-29 12:00:00 204,288 -c----w C:\WINDOWS\$NtServicePackUninstall$\agentctl.dll
    + 2002-08-29 12:00:00 35,840 -c----w C:\WINDOWS\$NtServicePackUninstall$\agentdp2.dll
    + 2002-08-29 12:00:00 44,032 -c----w C:\WINDOWS\$NtServicePackUninstall$\agentmpx.dll
    + 2002-08-29 12:00:00 21,504 -c----w C:\WINDOWS\$NtServicePackUninstall$\agentpsh.dll
    + 2002-08-29 12:00:00 39,936 -c----w C:\WINDOWS\$NtServicePackUninstall$\agentsr.dll
    + 2002-08-29 12:00:00 235,008 -c----w C:\WINDOWS\$NtServicePackUninstall$\agentsvr.exe
    + 2001-08-18 03:58:00 25,472 -c----w C:\WINDOWS\$NtServicePackUninstall$\agp440.sys
    + 2002-08-29 12:00:00 21,504 -c----w C:\WINDOWS\$NtServicePackUninstall$\agtintl.dll
    + 2002-08-29 12:00:00 91,648 -c----w C:\WINDOWS\$NtServicePackUninstall$\ahui.exe
    + 2002-08-29 12:00:00 41,984 -c----w C:\WINDOWS\$NtServicePackUninstall$\alg.exe
    + 2002-08-29 12:00:00 15,872 -c----w C:\WINDOWS\$NtServicePackUninstall$\alrsvc.dll
    + 2002-08-29 19:00:00 32,000 -c----w C:\WINDOWS\$NtServicePackUninstall$\amdk6.sys
    + 2002-08-29 19:00:00 32,512 -c----w C:\WINDOWS\$NtServicePackUninstall$\amdk7.sys
    + 2002-12-12 14:14:32 64,512 -c----w C:\WINDOWS\$NtServicePackUninstall$\amstream.dll
    + 2002-08-29 12:00:00 115,712 -c----w C:\WINDOWS\$NtServicePackUninstall$\apphelp.dll
    + 2002-08-29 19:00:00 57,344 -c----w C:\WINDOWS\$NtServicePackUninstall$\arp1394.sys
    + 2002-08-29 12:00:00 14,366 -c----w C:\WINDOWS\$NtServicePackUninstall$\asfsipc.dll
    + 2002-08-29 12:00:00 77,824 -c----w C:\WINDOWS\$NtServicePackUninstall$\asycfilt.dll
    + 2002-08-29 12:00:00 13,568 -c----w C:\WINDOWS\$NtServicePackUninstall$\asyncmac.sys
    + 2002-08-29 12:00:00 22,528 -c----w C:\WINDOWS\$NtServicePackUninstall$\at.exe
    + 2002-10-24 20:59:48 87,040 -c----w C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
    + 2002-08-29 12:00:00 74,810 -c----w C:\WINDOWS\$NtServicePackUninstall$\atl.dll
    + 2002-08-29 12:00:00 10,240 -c----w C:\WINDOWS\$NtServicePackUninstall$\atmadm.exe
    + 2002-08-29 12:00:00 57,216 -c----w C:\WINDOWS\$NtServicePackUninstall$\atmarpc.sys
    + 2002-08-29 12:00:00 272,768 -c----w C:\WINDOWS\$NtServicePackUninstall$\atmfd.dll
    + 2002-08-29 12:00:00 53,888 -c----w C:\WINDOWS\$NtServicePackUninstall$\atmlane.sys
    + 2002-08-29 12:00:00 27,136 -c----w C:\WINDOWS\$NtServicePackUninstall$\atmlib.dll
    + 2002-08-29 12:00:00 38,912 -c----w C:\WINDOWS\$NtServicePackUninstall$\audiosrv.dll
    + 2002-05-15 02:08:54 20,540 -c----w C:\WINDOWS\$NtServicePackUninstall$\author.dll
    + 2002-05-15 02:08:54 16,439 -c----w C:\WINDOWS\$NtServicePackUninstall$\author.exe
    + 2005-03-02 18:20:03 53,760 -c----w C:\WINDOWS\$NtServicePackUninstall$\authz.dll
    + 2002-08-29 19:00:00 565,760 -c----w C:\WINDOWS\$NtServicePackUninstall$\autochk.exe
    + 2002-08-29 12:00:00 578,560 -c----w C:\WINDOWS\$NtServicePackUninstall$\autoconv.exe
    + 2002-08-29 19:00:00 558,592 -c----w C:\WINDOWS\$NtServicePackUninstall$\autofmt.exe
    + 2002-08-29 12:00:00 8,192 -c----w C:\WINDOWS\$NtServicePackUninstall$\autolfn.exe
    + 2002-08-29 12:00:00 76,288 -c----w C:\WINDOWS\$NtServicePackUninstall$\avifil32.dll
    + 2002-08-29 12:00:00 44,032 -c----w C:\WINDOWS\$NtServicePackUninstall$\basesrv.dll
    + 2002-08-29 12:00:00 27,136 -c----w C:\WINDOWS\$NtServicePackUninstall$\batmeter.dll
    + 2002-08-29 12:00:00 6,656 -c----w C:\WINDOWS\$NtServicePackUninstall$\batt.dll
    + 2004-07-09 08:26:38 11,392 -c----w C:\WINDOWS\$NtServicePackUninstall$\bdasup.sys
    + 2002-08-29 12:00:00 14,848 -c----w C:\WINDOWS\$NtServicePackUninstall$\bidispl.dll
    + 2004-07-01 22:08:18 7,680 -c----w C:\WINDOWS\$NtServicePackUninstall$\bitsprx2.dll
    + 2004-07-01 22:08:18 7,168 -c----w C:\WINDOWS\$NtServicePackUninstall$\bitsprx3.dll
    + 2002-08-29 12:00:00 68,864 -c----w C:\WINDOWS\$NtServicePackUninstall$\bridge.sys
    + 2002-08-29 12:00:00 62,976 -c----w C:\WINDOWS\$NtServicePackUninstall$\browselc.dll
    + 2002-08-29 12:00:00 49,152 -c----w C:\WINDOWS\$NtServicePackUninstall$\browser.dll
    + 2006-09-04 06:23:53 1,027,072 -c----w C:\WINDOWS\$NtServicePackUninstall$\browseui.dll
    + 2002-08-29 12:00:00 71,680 -c----w C:\WINDOWS\$NtServicePackUninstall$\browsewm.dll
    + 2002-08-29 19:00:00 59,904 -c----w C:\WINDOWS\$NtServicePackUninstall$\cabinet.dll
    + 2002-08-29 12:00:00 80,384 -c----w C:\WINDOWS\$NtServicePackUninstall$\cabview.dll
    + 2004-03-30 01:48:36 364,544 -c----w C:\WINDOWS\$NtServicePackUninstall$\callcont.dll
    + 2002-08-29 12:00:00 45,056 -c----w C:\WINDOWS\$NtServicePackUninstall$\camocx.dll
    + 2005-07-26 04:30:34 220,672 -c----w C:\WINDOWS\$NtServicePackUninstall$\catsrv.dll
    + 2002-08-29 12:00:00 85,504 -c----w C:\WINDOWS\$NtServicePackUninstall$\catsrvps.dll
    + 2005-07-26 04:30:38 581,632 -c----w C:\WINDOWS\$NtServicePackUninstall$\catsrvut.dll
    + 2004-07-09 08:26:38 16,384 -c----w C:\WINDOWS\$NtServicePackUninstall$\ccdecode.sys
    + 2002-08-29 12:00:00 59,648 -c----w C:\WINDOWS\$NtServicePackUninstall$\cdfs.sys
    + 2004-12-07 22:43:02 143,360 -c----w C:\WINDOWS\$NtServicePackUninstall$\cdfview.dll
    + 2005-09-10 02:04:32 2,025,984 -c----w C:\WINDOWS\$NtServicePackUninstall$\cdosys.dll
    + 2002-08-29 12:00:00 47,488 -c----w C:\WINDOWS\$NtServicePackUninstall$\cdrom.sys
    + 2002-08-29 12:00:00 186,880 -c----w C:\WINDOWS\$NtServicePackUninstall$\certcli.dll
    + 2002-08-29 12:00:00 436,736 -c----w C:\WINDOWS\$NtServicePackUninstall$\certmgr.dll
    + 2002-08-29 12:00:00 32,768 -c----w C:\WINDOWS\$NtServicePackUninstall$\cfgbkend.dll
    + 2002-08-29 12:00:00 16,896 -c----w C:\WINDOWS\$NtServicePackUninstall$\cfgmgr32.dll
    + 2002-05-15 02:08:54 188,480 -c----w C:\WINDOWS\$NtServicePackUninstall$\cfgwiz.exe
    + 2002-08-29 12:00:00 1,267,712 -c----w C:\WINDOWS\$NtServicePackUninstall$\cimwin32.dll
    + 2006-06-22 05:19:48 64,512 -c----w C:\WINDOWS\$NtServicePackUninstall$\ciodm.dll
    + 2002-08-29 12:00:00 5,120 -c----w C:\WINDOWS\$NtServicePackUninstall$\cisvc.exe
    + 2002-08-29 12:00:00 46,336 -c----w C:\WINDOWS\$NtServicePackUninstall$\classpnp.sys
    + 2005-07-26 04:30:38 110,080 -c----w C:\WINDOWS\$NtServicePackUninstall$\clbcatex.dll
    + 2005-07-26 04:30:41 497,152 -c----w C:\WINDOWS\$NtServicePackUninstall$\clbcatq.dll
    + 2002-08-29 12:00:00 61,440 -c----w C:\WINDOWS\$NtServicePackUninstall$\cleanmgr.exe
    + 2003-02-20 20:28:04 73,728 -c----w C:\WINDOWS\$NtServicePackUninstall$\cliconfg.dll
    + 2003-02-20 20:28:06 20,480 -c----w C:\WINDOWS\$NtServicePackUninstall$\cliconfg.exe
    + 2002-08-29 12:00:00 98,816 -c----w C:\WINDOWS\$NtServicePackUninstall$\clipbrd.exe
    + 2002-08-29 12:00:00 30,720 -c----w C:\WINDOWS\$NtServicePackUninstall$\clipsrv.exe
    + 2002-08-29 12:00:00 54,272 -c----w C:\WINDOWS\$NtServicePackUninstall$\clusapi.dll
    + 2002-08-29 12:00:00 12,288 -c----w C:\WINDOWS\$NtServicePackUninstall$\cmcfg32.dll
    + 2002-08-29 12:00:00 375,808 -c----w C:\WINDOWS\$NtServicePackUninstall$\cmd.exe
    + 2002-08-29 12:00:00 324,608 -c----w C:\WINDOWS\$NtServicePackUninstall$\cmdial32.dll
    + 2002-08-29 12:00:00 41,472 -c----w C:\WINDOWS\$NtServicePackUninstall$\cmdl32.exe
    + 2002-08-29 12:00:00 35,840 -c----w C:\WINDOWS\$NtServicePackUninstall$\cmmon32.exe
    + 2002-08-29 12:00:00 174,592 -c----w C:\WINDOWS\$NtServicePackUninstall$\cmprops.dll
    + 2002-08-29 12:00:00 54,784 -c----w C:\WINDOWS\$NtServicePackUninstall$\cmstp.exe
    + 2002-08-29 12:00:00 36,352 -c----w C:\WINDOWS\$NtServicePackUninstall$\cmutil.dll
    + 2002-08-29 19:00:00 45,568 -c----w C:\WINDOWS\$NtServicePackUninstall$\cnbjmon.dll
    + 2005-07-26 04:30:41 62,464 -c----w C:\WINDOWS\$NtServicePackUninstall$\colbact.dll
    + 2005-07-26 04:30:42 187,392 -c----w C:\WINDOWS\$NtServicePackUninstall$\comadmin.dll
    + 2006-08-25 15:53:55 561,664 -c----w C:\WINDOWS\$NtServicePackUninstall$\comctl32.dll
    + 2002-08-29 12:00:00 258,048 -c----w C:\WINDOWS\$NtServicePackUninstall$\comdlg32.dll
    + 2002-08-29 12:00:00 238,592 -c----w C:\WINDOWS\$NtServicePackUninstall$\compatui.dll
    + 2002-08-29 12:00:00 222,208 -c----w C:\WINDOWS\$NtServicePackUninstall$\compstui.dll
    + 2002-08-29 12:00:00 8,192 -c----w C:\WINDOWS\$NtServicePackUninstall$\comrepl.exe
    + 2002-08-29 12:00:00 792,064 -c----w C:\WINDOWS\$NtServicePackUninstall$\comres.dll
    + 2005-07-26 04:30:49 1,179,136 -c----w C:\WINDOWS\$NtServicePackUninstall$\comsvcs.dll
    + 2005-07-26 04:31:11 499,200 -c----w C:\WINDOWS\$NtServicePackUninstall$\comuid.dll
    + 2002-08-29 12:00:00 995,328 -c----w C:\WINDOWS\$NtServicePackUninstall$\conf.exe
    + 2002-08-29 12:00:00 45,056 -c----w C:\WINDOWS\$NtServicePackUninstall$\confmrsl.dll
    + 2002-08-29 12:00:00 24,576 -c----w C:\WINDOWS\$NtServicePackUninstall$\conime.exe
    + 2002-08-29 12:00:00 14,877 -c----w C:\WINDOWS\$NtServicePackUninstall$\corpol.dll
    + 2002-08-29 12:00:00 57,400 -c----w C:\WINDOWS\$NtServicePackUninstall$\cplexe.exe
    + 2002-08-29 12:00:00 158,720 -c----w C:\WINDOWS\$NtServicePackUninstall$\credui.dll
    + 2002-08-29 19:00:00 31,488 -c----w C:\WINDOWS\$NtServicePackUninstall$\crusoe.sys
    + 2002-08-29 12:00:00 557,568 -c----w C:\WINDOWS\$NtServicePackUninstall$\crypt32.dll
    + 2002-08-29 12:00:00 70,144 -c----w C:\WINDOWS\$NtServicePackUninstall$\cryptdlg.dll
    + 2002-08-29 12:00:00 29,184 -c----w C:\WINDOWS\$NtServicePackUninstall$\cryptdll.dll
    + 2002-08-29 12:00:00 48,640 -c----w C:\WINDOWS\$NtServicePackUninstall$\cryptext.dll
    + 2002-08-29 12:00:00 53,248 -c----w C:\WINDOWS\$NtServicePackUninstall$\cryptnet.dll
    + 2002-08-29 12:00:00 53,248 -c----w C:\WINDOWS\$NtServicePackUninstall$\cryptsvc.dll
    + 2002-08-29 12:00:00 471,040 -c----w C:\WINDOWS\$NtServicePackUninstall$\cryptui.dll
    + 2004-10-28 01:29:54 92,160 -c----w C:\WINDOWS\$NtServicePackUninstall$\cscdll.dll
    + 2002-08-29 12:00:00 102,450 -c----w C:\WINDOWS\$NtServicePackUninstall$\cscript.exe
    + 2002-08-29 12:00:00 307,712 -c----w C:\WINDOWS\$NtServicePackUninstall$\cscui.dll
    + 2002-08-29 12:00:00 29,184 -c----w C:\WINDOWS\$NtServicePackUninstall$\csrsrv.dll
    + 2002-08-29 12:00:00 4,096 -c----w C:\WINDOWS\$NtServicePackUninstall$\csrss.exe
    + 2002-08-29 12:00:00 13,312 -c----w C:\WINDOWS\$NtServicePackUninstall$\ctfmon.exe
    + 2005-01-28 17:44:28 28,672 -c----w C:\WINDOWS\$NtServicePackUninstall$\custsat.dll
    + 2004-07-09 08:27:28 1,179,648 -c----w C:\WINDOWS\$NtServicePackUninstall$\d3d8.dll
    + 2002-12-12 14:14:32 8,192 -c----w C:\WINDOWS\$NtServicePackUninstall$\d3d8thk.dll
    + 2004-07-09 08:27:28 1,689,600 -c----w C:\WINDOWS\$NtServicePackUninstall$\d3d9.dll
    + 2003-05-30 13:00:02 797,184 -c----w C:\WINDOWS\$NtServicePackUninstall$\d3dim700.dll
    + 2002-08-29 12:00:00 557,128 -c----w C:\WINDOWS\$NtServicePackUninstall$\dao360.dll
    + 2002-08-29 12:00:00 51,712 -c----w C:\WINDOWS\$NtServicePackUninstall$\dataclen.dll
    + 2002-08-29 12:00:00 22,016 -c----w C:\WINDOWS\$NtServicePackUninstall$\davclnt.dll
    + 2002-08-29 19:00:00 489,984 -c----w C:\WINDOWS\$NtServicePackUninstall$\dbghelp.dll
    + 2003-02-20 21:39:40 24,576 -c----w C:\WINDOWS\$NtServicePackUninstall$\dbmsrpcn.dll
    + 2006-03-07 17:27:18 73,728 -c----w C:\WINDOWS\$NtServicePackUninstall$\dbnetlib.dll
    + 2006-03-07 17:27:18 28,672 -c----w C:\WINDOWS\$NtServicePackUninstall$\dbnmpntw.dll
    + 2007-12-19 23:09:16 2,678 -c----w C:\WINDOWS\$NtServicePackUninstall$\dbzb5zl7.dat
    + 2002-08-29 12:00:00 40,960 -c----w C:\WINDOWS\$NtServicePackUninstall$\dcap32.dll
    + 2002-08-29 12:00:00 7,680 -c----w C:\WINDOWS\$NtServicePackUninstall$\dciman32.dll
    + 2002-08-29 12:00:00 27,136 -c----w C:\WINDOWS\$NtServicePackUninstall$\ddeshare.exe
    + 2004-07-09 08:27:28 265,728 -c----w C:\WINDOWS\$NtServicePackUninstall$\ddraw.dll
    + 2002-12-12 14:14:32 24,064 -c----w C:\WINDOWS\$NtServicePackUninstall$\ddrawex.dll
    + 2002-08-29 12:00:00 70,656 -c----w C:\WINDOWS\$NtServicePackUninstall$\defrag.exe
    + 2003-05-30 13:00:02 53,248 -c----w C:\WINDOWS\$NtServicePackUninstall$\devenum.dll
    + 2002-08-29 12:00:00 263,168 -c----w C:\WINDOWS\$NtServicePackUninstall$\devmgr.dll
    + 2002-08-29 12:00:00 76,288 -c----w C:\WINDOWS\$NtServicePackUninstall$\dfrgfat.exe
    + 2002-08-29 12:00:00 99,328 -c----w C:\WINDOWS\$NtServicePackUninstall$\dfrgntfs.exe
    + 2002-08-29 12:00:00 35,328 -c----w C:\WINDOWS\$NtServicePackUninstall$\dfrgsnap.dll
    + 2002-08-29 12:00:00 113,152 -c----w C:\WINDOWS\$NtServicePackUninstall$\dfrgui.dll
    + 2002-08-29 12:00:00 25,600 -c----w C:\WINDOWS\$NtServicePackUninstall$\dfsshlex.dll
    + 2002-08-29 12:00:00 103,424 -c----w C:\WINDOWS\$NtServicePackUninstall$\dgnet.dll
    + 2006-05-19 12:15:32 103,936 -c----w C:\WINDOWS\$NtServicePackUninstall$\dhcpcsvc.dll
    + 2002-08-29 12:00:00 522,240 -c----w C:\WINDOWS\$NtServicePackUninstall$\dialer.exe
    + 2002-08-29 12:00:00 79,360 -c----w C:\WINDOWS\$NtServicePackUninstall$\diantz.exe
    + 2002-08-29 12:00:00 55,296 -c----w C:\WINDOWS\$NtServicePackUninstall$\digest.dll
    + 2002-08-29 12:00:00 151,552 -c----w C:\WINDOWS\$NtServicePackUninstall$\dinput.dll
    + 2002-08-29 12:00:00 168,960 -c----w C:\WINDOWS\$NtServicePackUninstall$\dinput8.dll
    + 2006-02-27 17:31:38 75,776 -c----w C:\WINDOWS\$NtServicePackUninstall$\directdb.dll
    + 2002-08-29 12:00:00 33,792 -c----w C:\WINDOWS\$NtServicePackUninstall$\disk.sys
    + 2002-08-29 12:00:00 13,184 -c----w C:\WINDOWS\$NtServicePackUninstall$\diskdump.sys
    + 2002-08-29 12:00:00 145,920 -c----w C:\WINDOWS\$NtServicePackUninstall$\diskpart.exe
    + 2002-08-29 12:00:00 294,912 -c----w C:\WINDOWS\$NtServicePackUninstall$\dlimport.exe
    + 2002-08-29 12:00:00 4,608 -c----w C:\WINDOWS\$NtServicePackUninstall$\dllhost.exe
    + 2002-08-29 12:00:00 204,800 -c----w C:\WINDOWS\$NtServicePackUninstall$\dmadmin.exe
    + 2002-12-12 14:14:32 27,136 -c----w C:\WINDOWS\$NtServicePackUninstall$\dmband.dll
    + 2002-08-29 12:00:00 780,928 -c----w C:\WINDOWS\$NtServicePackUninstall$\dmboot.sys
    + 2002-12-12 14:14:32 58,368 -c----w C:\WINDOWS\$NtServicePackUninstall$\dmcompos.dll
    + 2002-08-29 12:00:00 184,320 -c----w C:\WINDOWS\$NtServicePackUninstall$\dmdskmgr.dll
    + 2004-07-09 08:27:28 181,248 -c----w C:\WINDOWS\$NtServicePackUninstall$\dmime.dll
    + 2002-08-29 12:00:00 146,304 -c----w C:\WINDOWS\$NtServicePackUninstall$\dmio.sys
    + 2002-12-12 14:14:32 33,280 -c----w C:\WINDOWS\$NtServicePackUninstall$\dmloader.dll
    + 2002-08-29 12:00:00 14,336 -c----w C:\WINDOWS\$NtServicePackUninstall$\dmremote.exe
    + 2002-12-12 14:14:32 76,800 -c----w C:\WINDOWS\$NtServicePackUninstall$\dmscript.dll
    + 2002-08-29 12:00:00 21,504 -c----w C:\WINDOWS\$NtServicePackUninstall$\dmserver.dll
    + 2002-12-12 14:14:32 98,816 -c----w C:\WINDOWS\$NtServicePackUninstall$\dmstyle.dll
    + 2002-12-12 14:14:32 100,864 -c----w C:\WINDOWS\$NtServicePackUninstall$\dmsynth.dll
    + 2004-07-09 08:27:28 104,448 -c----w C:\WINDOWS\$NtServicePackUninstall$\dmusic.dll
    + 2001-08-17 21:59:58 50,048 -c----w C:\WINDOWS\$NtServicePackUninstall$\dmusic.sys
    + 2002-08-29 19:00:00 50,688 -c----w C:\WINDOWS\$NtServicePackUninstall$\dmutil.dll
    + 2006-06-26 17:47:50 140,288 -c----w C:\WINDOWS\$NtServicePackUninstall$\dnsapi.dll
    + 2002-08-29 12:00:00 44,032 -c----w C:\WINDOWS\$NtServicePackUninstall$\dnsrslvr.dll
    + 2002-08-29 12:00:00 45,568 -c----w C:\WINDOWS\$NtServicePackUninstall$\docprop2.dll
    + 2002-08-29 12:00:00 53,840 -c----w C:\WINDOWS\$NtServicePackUninstall$\dosx.exe
    + 2001-08-17 21:47:46 205,056 -c----w C:\WINDOWS\$NtServicePackUninstall$\dot4.sys
    + 2002-08-29 12:00:00 115,200 -c----w C:\WINDOWS\$NtServicePackUninstall$\dpcdll.dll
    + 2002-12-12 14:14:32 28,160 -c----w C:\WINDOWS\$NtServicePackUninstall$\dplaysvr.exe
    + 2004-07-09 08:27:28 230,400 -c----w C:\WINDOWS\$NtServicePackUninstall$\dplayx.dll
    + 2002-12-12 14:14:32 77,824 -c----w C:\WINDOWS\$NtServicePackUninstall$\dpmodemx.dll
    + 2002-12-12 14:14:32 3,072 -c----w C:\WINDOWS\$NtServicePackUninstall$\dpnaddr.dll
    + 2002-12-12 14:14:32 723,968 -c----w C:\WINDOWS\$NtServicePackUninstall$\dpnet.dll
    + 2003-03-24 13:00:02 32,768 -c----w C:\WINDOWS\$NtServicePackUninstall$\dpnhpast.dll
    + 2002-12-12 14:14:32 68,096 -c----w C:\WINDOWS\$NtServicePackUninstall$\dpnhupnp.dll
    + 2002-12-12 14:14:32 3,072 -c----w C:\WINDOWS\$NtServicePackUninstall$\dpnlobby.dll
    + 2002-12-12 14:14:32 16,896 -c----w C:\WINDOWS\$NtServicePackUninstall$\dpnsvr.exe
    + 2002-12-12 14:14:32 19,968 -c----w C:\WINDOWS\$NtServicePackUninstall$\dpvacm.dll
    + 2002-12-12 14:14:32 381,952 -c----w C:\WINDOWS\$NtServicePackUninstall$\dpvoice.dll
    + 2002-12-12 14:14:32 80,896 -c----w C:\WINDOWS\$NtServicePackUninstall$\dpvsetup.exe
    + 2002-12-12 14:14:32 112,128 -c----w C:\WINDOWS\$NtServicePackUninstall$\dpvvox.dll
    + 2004-07-09 08:27:28 57,856 -c----w C:\WINDOWS\$NtServicePackUninstall$\dpwsockx.dll
    + 2002-08-29 05:32:34 57,856 -c----w C:\WINDOWS\$NtServicePackUninstall$\drmk.sys
    + 2002-08-29 09:32:34 2,816 -c----w C:\WINDOWS\$NtServicePackUninstall$\drmkaud.sys
    + 2002-12-12 08:09:22 678,912 -c----w C:\WINDOWS\$NtServicePackUninstall$\drmv2clt.dll
    + 2002-08-29 12:00:00 11,776 -c----w C:\WINDOWS\$NtServicePackUninstall$\drprov.dll
    + 2003-02-20 21:39:06 16,384 -c----w C:\WINDOWS\$NtServicePackUninstall$\ds32gt.dll
    + 2002-12-12 14:14:32 186,880 -c----w C:\WINDOWS\$NtServicePackUninstall$\dsdmo.dll
    + 2002-12-12 14:14:32 491,520 -c----w C:\WINDOWS\$NtServicePackUninstall$\dsdmoprp.dll
    + 2002-08-29 12:00:00 84,992 -c----w C:\WINDOWS\$NtServicePackUninstall$\dskquota.dll
    + 2004-07-09 08:27:28 363,520 -c----w C:\WINDOWS\$NtServicePackUninstall$\dsound.dll
    + 2002-12-12 14:14:32 1,294,336 -c----w C:\WINDOWS\$NtServicePackUninstall$\dsound3d.dll
    + 2002-08-29 12:00:00 135,680 -c----w C:\WINDOWS\$NtServicePackUninstall$\dsprop.dll
    + 2002-08-29 12:00:00 3,584 -c----w C:\WINDOWS\$NtServicePackUninstall$\dsprpres.dll
    + 2002-08-29 12:00:00 227,840 -c----w C:\WINDOWS\$NtServicePackUninstall$\dsquery.dll
    + 2002-08-29 12:00:00 47,104 -c----w C:\WINDOWS\$NtServicePackUninstall$\dssec.dll
    + 2002-08-29 12:00:00 124,928 -c----w C:\WINDOWS\$NtServicePackUninstall$\dssenh.dll
     
    covian,
    #19
  21. 2008/04/24
    covian

    covian Inactive Thread Starter

    Joined:
    2008/03/30
    Messages:
    22
    Likes Received:
    0
    Is there any way i can email u this log it is to big
     
    covian,
    #20
Page 1 of 2

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...