1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Solved Cere's Captivity I can't get rid of

Discussion in 'Malware and Virus Removal Archive' started by KarenAZ, 2008/09/14.

Page 1 of 2
  1. 2008/09/14
    KarenAZ

    KarenAZ Inactive Thread Starter

    Joined:
    2008/09/14
    Messages:
    24
    Likes Received:
    0
    [Resolved] Cere's Captivity I can't get rid of

    hello - I am new and at my wit's end. While I am not computer stupid, I need simple instructions and I'm fine following. It seems I picked up a trojan even though I have a virus protector and I can't get rid of it. AVG says I have:
    3 in my restore file
    c:\\windows\cere's captivity.exe
    c:\\windows\cere's captivity.exe\cere's captivity.scr
    c:\\windows\sftMeane72.exe

    AVG says it is moved to the virus vault but it is not - if I click on the remove all unhealed infections then i can't do anything but boot up.

    I ran hijack this as suggested and this is the log file:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 9:01:53 a.m., on 9/14/2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16705)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
    C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
    C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe
    C:\WINDOWS\system32\Rundll32.exe
    C:\Program Files\Dell\Media Experience\PCMService.exe
    C:\WINDOWS\system32\dla\tfswctrl.exe
    C:\Program Files\Common Files\Dell\EUSW\Support.exe
    C:\Program Files\Microsoft IntelliPoint\ipoint.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    C:\PROGRA~1\AVG\AVG8\avgtray.exe
    C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Pure Networks\Network Magic\nmapp.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\System32\CTsvcCDA.EXE
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
    C:\Program Files\GetModule\GetModule23.exe
    C:\WINDOWS\system32\PSIService.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
    C:\WINDOWS\System32\MsPMSPSv.exe
    C:\Program Files\Digital Line Detect\DLG.exe
    C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
    C:\Program Files\Canon\CAL\CALMAIN.exe
    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
    C:\PROGRA~1\AVG\AVG8\avgemc.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\WISPTIS.EXE
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://cm.my.yahoo.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
    O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe "
    O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
    O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe "
    O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe /r
    O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
    O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
    O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe "
    O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
    O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
    O4 - HKLM\..\Run: [DwlClient] c:\Program Files\Common Files\Dell\EUSW\Support.exe
    O4 - HKLM\..\Run: [webscan] "C:\Program Files\Acceleration Software\Anti-Virus\stopsignav.exe" -k
    O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe "
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
    O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe "
    O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
    O4 - HKLM\..\Run: [nmctxth] "C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe "
    O4 - HKLM\..\Run: [nmapp] "C:\Program Files\Pure Networks\Network Magic\nmapp.exe" -autorun -nosplash
    O4 - HKLM\..\Run: [602fec7f] rundll32.exe "C:\WINDOWS\system32\tgshxfyk.dll ",b
    O4 - HKLM\..\Run: [BM631cdfe3] Rundll32.exe "C:\WINDOWS\system32\wnvflsmh.dll ",s
    O4 - HKCU\..\Run: [Magentic] C:\PROGRA~1\Magentic\bin\Magentic.exe /c
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [mSpotAlltelRemix] "C:\Program Files\Alltel Jump Music\Remix\msptcmd.exe" /runcheck
    O4 - HKCU\..\Run: [GetModule23] "C:\Program Files\GetModule\GetModule23.exe "
    O4 - HKUS\S-1-5-18\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'Default user')
    O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Startup: Rainlendar.lnk = C:\Program Files\Rainlendar\Rainlendar.exe
    O4 - Startup: Snsicon.lnk = C:\SLIDESHW\Snsicon.exe
    O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
    O4 - Global Startup: Digital Line Detect.lnk = ?
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office12\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\Office12\REFIEBAR.DLL
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: Photobucket Publisher - http://pic.photobucket.com/plugins/csve/photobucket_publisher.CAB
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {1A1F56AA-3401-46F9-B277-D57F3421F821} (FunGamesLoader Object) - http://www.worldwinner.com/games/v47/shared/FunGamesLoader.cab
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
    O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photo.walgreens.com/WalgreensActivia.cab
    O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://groups.msn.com/controls/PhotoUC/MsnPUpld.cab
    O16 - DPF: {5D9E4B6D-CD17-4D85-99D4-6A52B394EC3B} (WSDownloader Control) - http://www.webshots.com/samplers/WSDownloader.ocx
    O16 - DPF: {615F158E-D5CA-422F-A8E7-F6A5EED7063B} (Bejeweled Control) - http://www.worldwinner.com/games/v46/bejeweled/bejeweled.cab
    O16 - DPF: {7CCAD6DD-DD0B-440B-91FF-7670F5AADC21} (SpinTop Games Launcher) - http://clubgames.pogo.com/online2/pogop/mahjong_escape_ancient_japan/SpinTopGamesLauncher.cab
    O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - http://download.zonelabs.com/bin/promotions/spywaredetector/ICSScanner37380.cab
    O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab
    O16 - DPF: {99B6E512-3893-4155-9964-8EB8E06099CB} (WebSpyWareKiller Class) - http://download.zonelabs.com/bin/promotions/spywaredetector/WebSWK.cab
    O16 - DPF: {9A54032D-31F7-400D-B184-83B33BDE65FA} (MSN File Upload Control) - http://sc.groups.msn.com/controls/FileUC/MsnUpld.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
    O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) - http://sc.groups.msn.com/controls/PhotoUC/MsnPUpld.cab
    O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/games/web_games/popcap/chuzzle/popcaploader_v6.cab
    O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
    O20 - AppInit_DLLs: avgrsstx.dll xxstjm.dll
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe
    O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
    O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Pure Networks Net2Go Service (nmraapache) - Pure Networks, Inc. - C:\Program Files\Pure Networks\Network Magic\WebServer\bin\nmraapache.exe
    O23 - Service: Pure Networks Platform Service (nmservice) - Pure Networks, Inc. - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
    O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe

    --
    End of file - 11897 bytes

    Any help would sure be appreciated - I am not doing mail or anything on this computer - I moved to my lap top but I have to get this cleaned up to finish my on line college course :(

    Thank you in advance
    Karen
     
    KarenAZ,
    #1
  2. 2008/09/14
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi Karen
    Welcome to Windowsbbs

    Is that the system restore where it is seeing it?

    • Download RSIT by random/random and save it to your desktop.
    • Double click RSIT.exe to start the tool and click Continue at the disclaimer.
    • When the scan completes it will open a log named log.txt maximized, and a log named info.txt minimized.
    • Please post the contents of the log.txt here in your next reply.

    Thanks
    Geri
     
    Geri,
    #2


  3. to hide this advert.

  4. 2008/09/14
    KarenAZ

    KarenAZ Inactive Thread Starter

    Joined:
    2008/09/14
    Messages:
    24
    Likes Received:
    0
    Hello - and thank you much for your help! Yes the first 3 AVG seem to be restore files. If I can get this posted (LOL) here is the log in 2 posts (it's too long for one)

    Logfile of random's system information tool 1.01 (written by random/random)
    Run by Karen at 2008-09-14 09:33:07
    Microsoft Windows XP Home Edition Service Pack 3
    System drive C: has 93 GB (62%) free of 149 GB
    Total RAM: 1534 MB (57% free)

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 9:33:15 a.m., on 9/14/2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16705)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
    C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
    C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe
    C:\WINDOWS\system32\Rundll32.exe
    C:\Program Files\Dell\Media Experience\PCMService.exe
    C:\WINDOWS\system32\dla\tfswctrl.exe
    C:\Program Files\Common Files\Dell\EUSW\Support.exe
    C:\Program Files\Microsoft IntelliPoint\ipoint.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    C:\PROGRA~1\AVG\AVG8\avgtray.exe
    C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Pure Networks\Network Magic\nmapp.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\System32\CTsvcCDA.EXE
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
    C:\Program Files\GetModule\GetModule23.exe
    C:\WINDOWS\system32\PSIService.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
    C:\WINDOWS\System32\MsPMSPSv.exe
    C:\Program Files\Digital Line Detect\DLG.exe
    C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
    C:\Program Files\Canon\CAL\CALMAIN.exe
    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
    C:\PROGRA~1\AVG\AVG8\avgemc.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\WISPTIS.EXE
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\WINDOWS\explorer.exe
    C:\Documents and Settings\Karen\Desktop\RSIT.exe
    C:\Program Files\Trend Micro\HijackThis\Karen.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://cm.my.yahoo.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: {80cb9ec6-a147-4c48-54b4-7264229739e1} - {1e937922-4627-4b45-84c4-741a6ce9bc08} - C:\WINDOWS\system32\xxstjm.dll
    O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
    O2 - BHO: (no name) - {638F95F8-A833-431A-97EC-DA6C03CA3CAF} - C:\WINDOWS\system32\xxyaxVnl.dll
    O2 - BHO: OIN Analytics - {6B221E01-F517-4959-8C41-81948E7F2F17} - C:\Program Files\OINAnalytics\OINAnalytics.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
    O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.509.5470\swg.dll
    O2 - BHO: (no name) - {D7336D32-62F7-43B5-8B8C-3963C72CA498} - C:\WINDOWS\system32\ddcATlJB.dll
    O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
    O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe "
    O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
    O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe "
    O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe /r
    O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
    O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
    O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe "
    O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
    O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
    O4 - HKLM\..\Run: [DwlClient] c:\Program Files\Common Files\Dell\EUSW\Support.exe
    O4 - HKLM\..\Run: [webscan] "C:\Program Files\Acceleration Software\Anti-Virus\stopsignav.exe" -k
    O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe "
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
    O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe "
    O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
    O4 - HKLM\..\Run: [nmctxth] "C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe "
    O4 - HKLM\..\Run: [nmapp] "C:\Program Files\Pure Networks\Network Magic\nmapp.exe" -autorun -nosplash
    O4 - HKLM\..\Run: [602fec7f] rundll32.exe "C:\WINDOWS\system32\tgshxfyk.dll ",b
    O4 - HKLM\..\Run: [BM631cdfe3] Rundll32.exe "C:\WINDOWS\system32\wnvflsmh.dll ",s
    O4 - HKCU\..\Run: [Magentic] C:\PROGRA~1\Magentic\bin\Magentic.exe /c
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [mSpotAlltelRemix] "C:\Program Files\Alltel Jump Music\Remix\msptcmd.exe" /runcheck
    O4 - HKCU\..\Run: [GetModule23] "C:\Program Files\GetModule\GetModule23.exe "
    O4 - HKUS\S-1-5-18\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'Default user')
    O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Startup: Rainlendar.lnk = C:\Program Files\Rainlendar\Rainlendar.exe
    O4 - Startup: Snsicon.lnk = C:\SLIDESHW\Snsicon.exe
    O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
    O4 - Global Startup: Digital Line Detect.lnk = ?
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office12\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\Office12\REFIEBAR.DLL
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: Photobucket Publisher - http://pic.photobucket.com/plugins/csve/photobucket_publisher.CAB
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {1A1F56AA-3401-46F9-B277-D57F3421F821} (FunGamesLoader Object) - http://www.worldwinner.com/games/v47/shared/FunGamesLoader.cab
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
    O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photo.walgreens.com/WalgreensActivia.cab
    O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://groups.msn.com/controls/PhotoUC/MsnPUpld.cab
    O16 - DPF: {5D9E4B6D-CD17-4D85-99D4-6A52B394EC3B} (WSDownloader Control) - http://www.webshots.com/samplers/WSDownloader.ocx
    O16 - DPF: {615F158E-D5CA-422F-A8E7-F6A5EED7063B} (Bejeweled Control) - http://www.worldwinner.com/games/v46/bejeweled/bejeweled.cab
    O16 - DPF: {7CCAD6DD-DD0B-440B-91FF-7670F5AADC21} (SpinTop Games Launcher) - http://clubgames.pogo.com/online2/pogop/mahjong_escape_ancient_japan/SpinTopGamesLauncher.cab
    O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - http://download.zonelabs.com/bin/promotions/spywaredetector/ICSScanner37380.cab
    O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab
    O16 - DPF: {99B6E512-3893-4155-9964-8EB8E06099CB} (WebSpyWareKiller Class) - http://download.zonelabs.com/bin/promotions/spywaredetector/WebSWK.cab
    O16 - DPF: {9A54032D-31F7-400D-B184-83B33BDE65FA} (MSN File Upload Control) - http://sc.groups.msn.com/controls/FileUC/MsnUpld.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
    O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) - http://sc.groups.msn.com/controls/PhotoUC/MsnPUpld.cab
    O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/games/web_games/popcap/chuzzle/popcaploader_v6.cab
    O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
    O20 - AppInit_DLLs: avgrsstx.dll xxstjm.dll
    O20 - Winlogon Notify: ddcATlJB - C:\WINDOWS\SYSTEM32\ddcATlJB.dll
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe
    O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
    O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Pure Networks Net2Go Service (nmraapache) - Pure Networks, Inc. - C:\Program Files\Pure Networks\Network Magic\WebServer\bin\nmraapache.exe
    O23 - Service: Pure Networks Platform Service (nmservice) - Pure Networks, Inc. - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
    O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe

    --
    End of file - 13653 bytes

    Scheduled tasks folder

    C:\WINDOWS\tasks\AppleSoftwareUpdate.job
    C:\WINDOWS\tasks\XoftSpy.job

    Registry dump

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
    AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll [2003-11-03 54248]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1e937922-4627-4b45-84c4-741a6ce9bc08}]
    C:\WINDOWS\system32\xxstjm.dll [2008-09-14 111616]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]
    RealPlayer Download and Record Plugin for Internet Explorer - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll [2008-08-20 308856]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
    C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2004-05-12 744960]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5CA3D70E-1895-11CF-8E15-001234567890}]
    DriveLetterAccess - C:\WINDOWS\system32\dla\tfswshx.dll [2004-03-14 118836]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{638F95F8-A833-431A-97EC-DA6C03CA3CAF}]
    C:\WINDOWS\system32\xxyaxVnl.dll [2008-09-13 253440]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6B221E01-F517-4959-8C41-81948E7F2F17}]
    OIN Analytics - C:\Program Files\OINAnalytics\OINAnalytics.dll [2008-09-11 229376]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
    SSVHelper Class - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll [2008-06-10 509328]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
    Google Toolbar Helper - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll [2008-08-14 193136]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}]
    AcroIEToolbarHelper Class - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll [2003-05-15 147456]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
    Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\4.1.509.5470\swg.dll [2008-07-18 651760]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D7336D32-62F7-43B5-8B8C-3963C72CA498}]
    C:\WINDOWS\system32\ddcATlJB.dll [2008-09-13 45568]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FDD3B846-8D59-4ffb-8758-209B6AD74ACC}]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    {47833539-D0C5-4125-9FA8-0819E2EAAC93} - Adobe PDF - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll [2003-05-15 147456]
    {2318C2B1-4965-11d4-9B18-009027A5CD4F} - &Google Toolbar - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll [2008-08-14 193136]

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    "SunJavaUpdateSched "=C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe [2008-06-10 144784]
    "IAAnotif "=C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe [2004-03-23 135168]
    "DVDLauncher "=C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe [2004-04-11 53248]
    "CTSysVol "=C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe [2003-09-17 57344]
    "P17Helper "=Rundll32 P17.dll []
    "UpdReg "=C:\WINDOWS\UpdReg.EXE [2000-05-10 90112]
    "PCMService "=C:\Program Files\Dell\Media Experience\PCMService.exe [2004-04-11 290816]
    "dla "=C:\WINDOWS\system32\dla\tfswctrl.exe [2004-03-14 122933]
    "UpdateManager "=C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe [2003-08-18 110592]
    "DwlClient "=c:\Program Files\Common Files\Dell\EUSW\Support.exe [2004-05-27 323584]
    "webscan "=C:\Program Files\Acceleration Software\Anti-Virus\stopsignav.exe -k []
    "IntelliPoint "=C:\Program Files\Microsoft IntelliPoint\ipoint.exe [2007-02-05 849280]
    "QuickTime Task "=C:\Program Files\QuickTime\qttask.exe [2008-03-28 413696]
    "iTunesHelper "=C:\Program Files\iTunes\iTunesHelper.exe [2008-03-30 267048]
    "StartCCC "=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2008-01-21 61440]
    "AVG8_TRAY "=C:\PROGRA~1\AVG\AVG8\avgtray.exe [2008-08-29 1235736]
    "nmctxth "=C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe [2008-05-16 648504]
    "nmapp "=C:\Program Files\Pure Networks\Network Magic\nmapp.exe [2008-05-21 451896]
    "602fec7f "=C:\WINDOWS\system32\tgshxfyk.dll [2008-09-14 88576]
    "BM631cdfe3 "=C:\WINDOWS\system32\wnvflsmh.dll [2008-09-14 99328]

    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    "Magentic "=C:\PROGRA~1\Magentic\bin\Magentic.exe /c []
    "ctfmon.exe "=C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360]
    "swg "=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2007-06-26 68856]
    "mSpotAlltelRemix "=C:\Program Files\Alltel Jump Music\Remix\msptcmd.exe [2008-02-07 1507328]
    "GetModule23 "=C:\Program Files\GetModule\GetModule23.exe [2008-09-09 364032]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MimBoot]
    C:\PROGRA~1\MUSICM~1\MUSICM~2\mimboot.exe []

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup
    Acrobat Assistant.lnk - C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
    Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe

    C:\Documents and Settings\Karen\Start Menu\Programs\Startup
    Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    Rainlendar.lnk - C:\Program Files\Rainlendar\Rainlendar.exe
    Snsicon.lnk - C:\SLIDESHW\Snsicon.exe

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
    "AppInit_DLLS "= "avgrsstx.dll xxstjm.dll "

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
    C:\WINDOWS\system32\Ati2evxx.dll [2008-03-28 126976]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ddcATlJB]
    C:\WINDOWS\system32\ddcATlJB.dll [2008-09-13 45568]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
    WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    "{D7336D32-62F7-43B5-8B8C-3963C72CA498} "=C:\WINDOWS\system32\ddcATlJB.dll [2008-09-13 45568]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
    "authentication packages "=msv1_0
    C:\WINDOWS\system32\xxyaxVnl

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\aawservice]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr]
     
    KarenAZ,
    #3
  5. 2008/09/14
    KarenAZ

    KarenAZ Inactive Thread Starter

    Joined:
    2008/09/14
    Messages:
    24
    Likes Received:
    0
    and the rest of it:

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
    "dontdisplaylastusername "=0
    "legalnoticecaption "=
    "legalnoticetext "=
    "shutdownwithoutlogon "=1
    "undockwithoutlogon "=1

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
    "%windir%\system32\sessmgr.exe "= "%windir%\system32\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019 "
    "C:\Documents and Settings\Karen\Local Settings\Temporary Internet Files\Content.IE5\95FQWZQF\incredimail_install[1].exe "= "C:\Documents and Settings\Karen\Local Settings\Temporary Internet Files\Content.IE5\95FQWZQF\incredimail_install[1].exe:*:Enabled:IncrediMail Installer "
    "C:\Program Files\IncrediMail\bin\IMApp.exe "= "C:\Program Files\IncrediMail\bin\IMApp.exe:*:Enabled:IncrediMail "
    "C:\Program Files\IncrediMail\bin\IncMail.exe "= "C:\Program Files\IncrediMail\bin\IncMail.exe:*:Enabled:IncrediMail "
    "C:\Program Files\IncrediMail\bin\ImpCnt.exe "= "C:\Program Files\IncrediMail\bin\ImpCnt.exe:*:Enabled:IncrediMail "
    "C:\Program Files\IncrediMail\bin\ImLc.exe "= "C:\Program Files\IncrediMail\bin\ImLc.exe:*:Enabled:IncrediMail "
    "C:\Program Files\Magentic\bin\MgImp.exe "= "C:\Program Files\Magentic\bin\MgImp.exe:*:Enabled:Magentic "
    "C:\Program Files\Magentic\bin\Magentic.exe "= "C:\Program Files\Magentic\bin\Magentic.exe:*:Enabled:Magentic "
    "C:\Program Files\Magentic\bin\MgApp.exe "= "C:\Program Files\Magentic\bin\MgApp.exe:*:Enabled:Magentic "
    "%windir%\Network Diagnostic\xpnetdiag.exe "= "%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000 "
    "C:\Program Files\Grisoft\AVG7\avginet.exe "= "C:\Program Files\Grisoft\AVG7\avginet.exe:*:Enabled:avginet.exe "
    "C:\Program Files\Grisoft\AVG7\avgamsvr.exe "= "C:\Program Files\Grisoft\AVG7\avgamsvr.exe:*:Enabled:avgamsvr.exe "
    "C:\Program Files\Grisoft\AVG7\avgcc.exe "= "C:\Program Files\Grisoft\AVG7\avgcc.exe:*:Enabled:avgcc.exe "
    "C:\Program Files\Real\RealPlayer\realplay.exe "= "C:\Program Files\Real\RealPlayer\realplay.exe:*:Enabled:RealPlayer "
    "C:\Program Files\MSN Messenger\msnmsgr.exe "= "C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1 "
    "C:\Program Files\MSN Messenger\livecall.exe "= "C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone) "
    "C:\Program Files\IncrediMail\bin\ImPackr.exe "= "C:\Program Files\IncrediMail\bin\ImPackr.exe:*:Enabled:IncrediMail "
    "C:\Documents and Settings\Karen\Local Settings\Temporary Internet Files\Content.IE5\UDSH5VWM\incredimail_install[1].exe "= "C:\Documents and Settings\Karen\Local Settings\Temporary Internet Files\Content.IE5\UDSH5VWM\incredimail_install[1].exe:*:Enabled:IncrediMail Installer "
    "C:\Program Files\Pando Networks\Pando\pando.exe "= "C:\Program Files\Pando Networks\Pando\pando.exe:*:Enabled:pando Application "
    "C:\Program Files\Bonjour\mDNSResponder.exe "= "C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour "
    "C:\Program Files\iTunes\iTunes.exe "= "C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes "
    "C:\Program Files\IncrediMail\bin\ImSc.exe "= "C:\Program Files\IncrediMail\bin\ImSc.exe:*:Enabled:IncrediMail "
    "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe "= "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger "
    "C:\Program Files\Yahoo!\Messenger\YServer.exe "= "C:\Program Files\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server "
    "C:\Program Files\AVG\AVG8\avgemc.exe "= "C:\Program Files\AVG\AVG8\avgemc.exe:*:Enabled:avgemc.exe "
    "C:\Program Files\AVG\AVG8\avgupd.exe "= "C:\Program Files\AVG\AVG8\avgupd.exe:*:Enabled:avgupd.exe "
    "C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE "= "C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook "
    "C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe "= "C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe:LocalSubNet:Enabled:pure Networks Platform Service "

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
    "%windir%\system32\sessmgr.exe "= "%windir%\system32\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019 "
    "%windir%\Network Diagnostic\xpnetdiag.exe "= "%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000 "
    "C:\Program Files\MSN Messenger\msnmsgr.exe "= "C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1 "
    "C:\Program Files\MSN Messenger\livecall.exe "= "C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone) "

    List of files/folders created in the last three months

    2008-09-14 09:33:07 ----D---- C:\rsit
    2008-09-14 08:59:27 ----D---- C:\Program Files\Trend Micro
    2008-09-14 03:13:25 ----SH---- C:\WINDOWS\system32\kyfxhsgt.ini
    2008-09-14 03:13:13 ----A---- C:\WINDOWS\system32\tgshxfyk.dll
    2008-09-14 03:10:15 ----A---- C:\WINDOWS\system32\xxstjm.dll
    2008-09-14 03:10:14 ----A---- C:\WINDOWS\system32\gjwtaget.dll
    2008-09-14 03:07:14 ----A---- C:\WINDOWS\system32\wnvflsmh.dll
    2008-09-14 03:05:41 ----A---- C:\WINDOWS\pskt.ini
    2008-09-14 03:05:37 ----A---- C:\WINDOWS\system32\dltoxxvd.dll
    2008-09-13 16:04:08 ----D---- C:\Program Files\Spyware Doctor
    2008-09-13 13:31:32 ----A---- C:\WINDOWS\BM631cdfe3.txt
    2008-09-13 13:31:04 ----A---- C:\WINDOWS\system32\6b0c2801-.txt
    2008-09-13 13:30:00 ----ASH---- C:\WINDOWS\system32\lnVxayxx.ini2
    2008-09-13 13:30:00 ----ASH---- C:\WINDOWS\system32\lnVxayxx.ini
    2008-09-13 13:29:47 ----A---- C:\WINDOWS\system32\xxyaxVnl.dll
    2008-09-13 13:24:48 ----SH---- C:\Program Files\Common Files\Yazzle1554OinUninstaller.exe
    2008-09-13 13:24:44 ----A---- C:\WINDOWS\system32\efcBurRH.dll
    2008-09-13 13:24:43 ----D---- C:\Program Files\iCheck
    2008-09-13 13:24:43 ----D---- C:\Program Files\GetModule
    2008-09-13 13:24:42 ----D---- C:\Program Files\OINAnalytics
    2008-09-13 13:24:42 ----A---- C:\WINDOWS\system32\ddcATlJB.dll
    2008-09-11 18:20:48 ----D---- C:\9-11
    2008-09-11 14:48:02 ----SH---- C:\Program Files\Common Files\Yazzle1554OinAdmin.exe
    2008-09-10 22:55:39 ----HD---- C:\WINDOWS\PIF
    2008-09-10 22:55:22 ----D---- C:\Credit Report - experian.com
    2008-09-10 06:08:03 ----HDC---- C:\WINDOWS\$NtUninstallKB938464$
    2008-09-10 06:07:39 ----HDC---- C:\WINDOWS\$NtUninstallKB954154_WM11$
    2008-09-07 01:26:16 ----A---- C:\WINDOWS\unvise32.exe
    2008-09-06 20:13:15 ----D---- C:\Program Files\TeaTimer (Spybot - Search & Destroy)
    2008-09-05 15:00:17 ----D---- C:\Program Files\Wondershare
    2008-09-03 18:43:43 ----D---- C:\Program Files\Microsoft Visual Studio
    2008-09-03 18:39:42 ----D---- C:\Documents and Settings\All Users\Application Data\Microsoft Help
    2008-09-03 18:31:23 ----D---- C:\Course Technology
    2008-08-30 13:58:38 ----D---- C:\Program Files\Pure Networks
    2008-08-30 13:57:51 ----D---- C:\Program Files\Common Files\Pure Networks Shared
    2008-08-30 12:29:53 ----D---- C:\Program Files\DIFX
    2008-08-30 12:29:12 ----D---- C:\Documents and Settings\All Users\Application Data\Pure Networks
    2008-08-30 11:31:02 ----HD---- C:\$AVG8.VAULT$
    2008-08-27 21:15:21 ----N---- C:\WINDOWS\WB.ini
    2008-08-27 21:10:25 ----N---- C:\WINDOWS\system32\wbsys.dll
    2008-08-27 21:10:24 ----D---- C:\Program Files\Stardock
    2008-08-25 17:24:14 ----D---- C:\x-smilies
    2008-08-24 01:33:57 ----D---- C:\Documents and Settings\Karen\Application Data\Mythic Adventure
    2008-08-22 06:37:52 ----D---- C:\Program Files\BetterJPEG 2
    2008-08-22 06:36:08 ----D---- C:\Program Files\Better JPEG
    2008-08-20 20:01:07 ----D---- C:\Program Files\Common Files\xing shared
    2008-08-19 17:38:31 ----HDC---- C:\WINDOWS\$NtUninstallKB951978$
    2008-08-19 00:05:04 ----A---- C:\WINDOWS\OEWABLog.txt
    2008-08-19 00:04:07 ----D---- C:\WINDOWS\Prefetch
    2008-08-18 21:42:20 ----HDC---- C:\WINDOWS\$NtUninstallKB952954$
    2008-08-18 21:42:12 ----HDC---- C:\WINDOWS\$NtUninstallKB952287$
    2008-08-18 21:42:03 ----HDC---- C:\WINDOWS\$NtUninstallKB951748$
    2008-08-18 21:41:53 ----HDC---- C:\WINDOWS\$NtUninstallKB951698$
    2008-08-18 21:41:47 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2$
    2008-08-18 21:41:39 ----HDC---- C:\WINDOWS\$NtUninstallKB951376$
    2008-08-18 21:41:30 ----HDC---- C:\WINDOWS\$NtUninstallKB951066$
    2008-08-18 21:41:22 ----HDC---- C:\WINDOWS\$NtUninstallKB950974$
    2008-08-18 21:41:16 ----HDC---- C:\WINDOWS\$NtUninstallKB950762$
    2008-08-18 21:41:06 ----HDC---- C:\WINDOWS\$NtUninstallKB946648$
    2008-08-18 21:37:57 ----A---- C:\WINDOWS\setuplog.txt
    2008-08-18 21:36:41 ----D---- C:\WINDOWS\system32\scripting
    2008-08-18 21:36:40 ----D---- C:\WINDOWS\system32\en
    2008-08-18 21:36:40 ----D---- C:\WINDOWS\l2schemas
    2008-08-18 17:23:35 ----N---- C:\WINDOWS\system32\wmphoto.dll
    2008-08-18 17:23:34 ----N---- C:\WINDOWS\system32\wlanapi.dll
    2008-08-18 17:23:33 ----N---- C:\WINDOWS\system32\windowscodecsext.dll
    2008-08-18 17:23:33 ----N---- C:\WINDOWS\system32\windowscodecs.dll
    2008-08-18 17:23:30 ----N---- C:\WINDOWS\system32\tspkg.dll
    2008-08-18 17:23:30 ----N---- C:\WINDOWS\system32\tsgqec.dll
    2008-08-18 17:23:24 ----N---- C:\WINDOWS\system32\setupn.exe
    2008-08-18 17:23:23 ----N---- C:\WINDOWS\system32\rhttpaa.dll
    2008-08-18 17:23:22 ----N---- C:\WINDOWS\system32\rasqec.dll
    2008-08-18 17:23:22 ----N---- C:\WINDOWS\system32\qutil.dll
    2008-08-18 17:23:22 ----N---- C:\WINDOWS\system32\qcliprov.dll
    2008-08-18 17:23:21 ----N---- C:\WINDOWS\system32\qagentrt.dll
    2008-08-18 17:23:21 ----N---- C:\WINDOWS\system32\qagent.dll
    2008-08-18 17:23:21 ----N---- C:\WINDOWS\system32\photometadatahandler.dll
    2008-08-18 17:23:20 ----N---- C:\WINDOWS\system32\onex.dll
    2008-08-18 17:23:15 ----N---- C:\WINDOWS\system32\napstat.exe
    2008-08-18 17:23:15 ----N---- C:\WINDOWS\system32\napmontr.dll
    2008-08-18 17:23:15 ----N---- C:\WINDOWS\system32\napipsec.dll
    2008-08-18 17:23:15 ----N---- C:\WINDOWS\system32\msxml6r.dll
    2008-08-18 17:23:15 ----N---- C:\WINDOWS\system32\msxml6.dll
    2008-08-18 17:23:14 ----N---- C:\WINDOWS\system32\msshavmsg.dll
    2008-08-18 17:23:14 ----N---- C:\WINDOWS\system32\mssha.dll
    2008-08-18 17:23:08 ----N---- C:\WINDOWS\system32\mmcperf.exe
    2008-08-18 17:23:08 ----N---- C:\WINDOWS\system32\mmcfxcommon.dll
    2008-08-18 17:23:08 ----N---- C:\WINDOWS\system32\mmcex.dll
    2008-08-18 17:23:07 ----N---- C:\WINDOWS\system32\microsoft.managementconsole.dll
    2008-08-18 17:23:04 ----N---- C:\WINDOWS\system32\l2gpstore.dll
    2008-08-18 17:22:55 ----N---- C:\WINDOWS\system32\kmsvc.dll
    2008-08-18 17:22:55 ----N---- C:\WINDOWS\system32\kbdpash.dll
    2008-08-18 17:22:55 ----N---- C:\WINDOWS\system32\kbdnepr.dll
    2008-08-18 17:22:55 ----N---- C:\WINDOWS\system32\kbdiultn.dll
    2008-08-18 17:22:55 ----N---- C:\WINDOWS\system32\kbdbhc.dll
    2008-08-18 17:22:39 ----A---- C:\WINDOWS\005414_.tmp
    2008-08-18 17:22:38 ----N---- C:\WINDOWS\system32\eapsvc.dll
    2008-08-18 17:22:38 ----N---- C:\WINDOWS\system32\eapqec.dll
    2008-08-18 17:22:38 ----N---- C:\WINDOWS\system32\eappprxy.dll
    2008-08-18 17:22:38 ----N---- C:\WINDOWS\system32\eapphost.dll
    2008-08-18 17:22:38 ----N---- C:\WINDOWS\system32\eappgnui.dll
    2008-08-18 17:22:38 ----N---- C:\WINDOWS\system32\eappcfg.dll
    2008-08-18 17:22:38 ----N---- C:\WINDOWS\system32\eapp3hst.dll
    2008-08-18 17:22:38 ----N---- C:\WINDOWS\system32\eapolqec.dll
    2008-08-18 17:22:36 ----N---- C:\WINDOWS\system32\dot3ui.dll
    2008-08-18 17:22:36 ----N---- C:\WINDOWS\system32\dot3svc.dll
    2008-08-18 17:22:36 ----N---- C:\WINDOWS\system32\dot3msm.dll
    2008-08-18 17:22:36 ----N---- C:\WINDOWS\system32\dot3gpclnt.dll
    2008-08-18 17:22:36 ----N---- C:\WINDOWS\system32\dot3dlg.dll
    2008-08-18 17:22:36 ----N---- C:\WINDOWS\system32\dot3cfg.dll
    2008-08-18 17:22:36 ----N---- C:\WINDOWS\system32\dot3api.dll
    2008-08-18 17:22:35 ----N---- C:\WINDOWS\system32\dimsroam.dll
    2008-08-18 17:22:35 ----N---- C:\WINDOWS\system32\dimsntfy.dll
    2008-08-18 17:22:35 ----N---- C:\WINDOWS\system32\dhcpqec.dll
    2008-08-18 17:22:33 ----N---- C:\WINDOWS\system32\credssp.dll
    2008-08-18 17:22:31 ----N---- C:\WINDOWS\system32\bitsprx4.dll
    2008-08-18 17:22:31 ----N---- C:\WINDOWS\system32\azroles.dll
    2008-08-18 17:22:26 ----N---- C:\WINDOWS\system32\aaclient.dll
    2008-08-16 14:53:13 ----A---- C:\WINDOWS\system32\avgrsstx.dll
    2008-08-16 14:52:54 ----D---- C:\Program Files\AVG
    2008-08-16 14:48:48 ----D---- C:\Documents and Settings\All Users\Application Data\Avg8
    2008-08-14 15:05:48 ----D---- C:\Documents and Settings\Karen\Application Data\Filter Forge
    2008-08-14 14:58:25 ----A---- C:\WINDOWS\system32\dbghelp-xfw.dll
    2008-08-14 03:04:08 ----HDC---- C:\WINDOWS\$NtUninstallKB952954_0$
    2008-08-14 03:04:01 ----HDC---- C:\WINDOWS\$NtUninstallKB946648_0$
    2008-08-14 03:03:56 ----HDC---- C:\WINDOWS\$NtUninstallKB953839$
    2008-08-14 03:03:49 ----HDC---- C:\WINDOWS\$NtUninstallKB950974_0$
    2008-08-14 03:01:16 ----HDC---- C:\WINDOWS\$NtUninstallKB951072-v2$
    2008-08-14 03:01:10 ----HDC---- C:\WINDOWS\$NtUninstallKB952287_0$
    2008-08-14 03:00:31 ----HDC---- C:\WINDOWS\$NtUninstallKB951066_0$
    2008-08-03 02:16:51 ----D---- C:\Program Files\Gambana
    2008-07-26 18:43:18 ----D---- C:\Program Files\Common Files\Roxio Shared
    2008-07-26 18:43:17 ----D---- C:\Program Files\Common Files\Napster Shared
    2008-07-26 18:41:41 ----D---- C:\Documents and Settings\Karen\Application Data\InstallShield
    2008-07-20 01:48:47 ----A---- C:\WINDOWS\system32\javaws.exe
    2008-07-20 01:48:47 ----A---- C:\WINDOWS\system32\javaw.exe
    2008-07-20 01:48:47 ----A---- C:\WINDOWS\system32\java.exe
    2008-07-19 01:46:28 ----D---- C:\Program Files\Common Files\Corel
    2008-07-19 01:44:47 ----D---- C:\Program Files\Corel
    2008-07-19 00:45:23 ----D---- C:\Documents and Settings\All Users\Application Data\Yahoo!
    2008-07-19 00:44:59 ----A---- C:\YServer.txt
    2008-07-14 18:42:51 ----D---- C:\tools
    2008-07-09 03:00:51 ----HDC---- C:\WINDOWS\$NtUninstallKB951748_0$
    2008-06-25 22:57:48 ----D---- C:\Rosey Posey Web Set
    2008-06-21 12:21:24 ----D---- C:\Documents and Settings\All Users\Application Data\WholeSecurity
    2008-06-19 21:35:07 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2_0$
    2008-06-18 22:49:47 ----D---- C:\Program Files\Broderbund
    2008-06-15 21:50:44 ----D---- C:\Program Files\Lavasoft
    2008-06-15 21:50:04 ----D---- C:\Program Files\Common Files\Wise Installation Wizard

    List of drivers

    R1 AvgLdx86;AVG Free AVI Loader Driver x86; C:\WINDOWS\System32\Drivers\avgldx86.sys [2008-08-29 97928]
    R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86; C:\WINDOWS\System32\Drivers\avgmfx86.sys [2008-08-16 26824]
    R1 Cdr4_xp;Cdr4_xp; C:\WINDOWS\system32\drivers\Cdr4_xp.sys [2007-06-20 9072]
    R1 Cdralw2k;Cdralw2k; C:\WINDOWS\system32\drivers\Cdralw2k.sys [2007-06-20 9200]
    R1 intelppm;Intel Processor Driver; C:\WINDOWS\System32\DRIVERS\intelppm.sys [2008-04-13 36352]
    R1 omci;OMCI WDM Device Driver; C:\WINDOWS\System32\DRIVERS\omci.sys [2002-11-08 17217]
    R1 sscdbhk5;sscdbhk5; C:\WINDOWS\system32\drivers\sscdbhk5.sys [2004-01-14 5621]
    R1 ssrtln;ssrtln; C:\WINDOWS\system32\drivers\ssrtln.sys [2004-01-14 23219]
    R2 AvgTdiX;AVG Free8 Network Redirector; C:\WINDOWS\System32\Drivers\avgtdix.sys [2008-08-16 76040]
    R2 drvnddm;drvnddm; C:\WINDOWS\system32\drivers\drvnddm.sys [2004-02-27 40480]
    R2 mdmxsdk;mdmxsdk; C:\WINDOWS\System32\DRIVERS\mdmxsdk.sys [2003-04-09 11043]
    R2 PfModNT;PfModNT; \??\C:\WINDOWS\system32\drivers\PfModNT.sys []
    R2 pnarp;Pure Networks Device Discovery Driver; C:\WINDOWS\system32\DRIVERS\pnarp.sys [2008-05-16 23992]
    R2 purendis;Pure Networks Wireless Driver; C:\WINDOWS\system32\DRIVERS\purendis.sys [2008-05-16 25272]
    R2 tfsnboio;tfsnboio; C:\WINDOWS\system32\dla\tfsnboio.sys [2004-03-14 25685]
    R2 tfsncofs;tfsncofs; C:\WINDOWS\system32\dla\tfsncofs.sys [2004-03-14 34837]
    R2 tfsndrct;tfsndrct; C:\WINDOWS\system32\dla\tfsndrct.sys [2004-03-14 4117]
    R2 tfsndres;tfsndres; C:\WINDOWS\system32\dla\tfsndres.sys [2004-03-14 2233]
    R2 tfsnifs;tfsnifs; C:\WINDOWS\system32\dla\tfsnifs.sys [2004-03-14 85972]
    R2 tfsnopio;tfsnopio; C:\WINDOWS\system32\dla\tfsnopio.sys [2004-03-14 14229]
    R2 tfsnpool;tfsnpool; C:\WINDOWS\system32\dla\tfsnpool.sys [2004-03-14 6357]
    R2 tfsnudf;tfsnudf; C:\WINDOWS\system32\dla\tfsnudf.sys [2004-03-14 98580]
    R2 tfsnudfa;tfsnudfa; C:\WINDOWS\system32\dla\tfsnudfa.sys [2004-03-14 100597]
    R3 ati2mtag;ati2mtag; C:\WINDOWS\System32\DRIVERS\ati2mtag.sys [2008-03-28 2873856]
    R3 b57w2k;Broadcom NetXtreme 57xx Gigabit Controller; C:\WINDOWS\System32\DRIVERS\b57xp32.sys [2004-05-29 186112]
    R3 ctsfm2k;Creative SoundFont Management Device Driver; C:\WINDOWS\System32\DRIVERS\ctsfm2k.sys [2003-09-22 130192]
    R3 GEARAspiWDM;GEARAspiWDM; C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys [2008-01-29 16168]
    R3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\System32\DRIVERS\hidusb.sys [2008-04-13 10368]
    R3 HSF_DP;HSF_DP; C:\WINDOWS\System32\DRIVERS\HSF_DP.sys [2003-11-17 1042432]
    R3 HSFHWBS2;HSFHWBS2; C:\WINDOWS\System32\DRIVERS\HSFHWBS2.sys [2003-11-17 212224]
    R3 MODEMCSA;Unimodem Streaming Filter Device; C:\WINDOWS\system32\drivers\MODEMCSA.sys [2001-08-17 16128]
    R3 mouhid;Mouse HID Driver; C:\WINDOWS\System32\DRIVERS\mouhid.sys [2001-08-17 12160]
    R3 ossrv;Creative OS Services Driver; C:\WINDOWS\System32\DRIVERS\ctoss2k.sys [2003-09-22 178672]
    R3 P17;Sound Blaster Live! 24-bit; C:\WINDOWS\system32\drivers\P17.sys [2004-06-09 840960]
    R3 Point32;Microsoft IntelliPoint Filter Driver; C:\WINDOWS\system32\DRIVERS\point32.sys [2006-11-08 21760]
    R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\System32\DRIVERS\usbehci.sys [2008-04-13 30208]
    R3 usbhub;Microsoft USB Standard Hub Driver; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2008-04-13 59520]
    R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\System32\DRIVERS\usbuhci.sys [2008-04-13 20608]
    R3 winachsf;winachsf; C:\WINDOWS\System32\DRIVERS\HSF_CNXT.sys [2003-11-17 680704]
    S1 P3;Intel PentiumIII Processor Driver; C:\WINDOWS\System32\DRIVERS\p3.sys [2008-04-13 42752]
    S3 bvrp_pci;bvrp_pci; C:\WINDOWS\system32\drivers\bvrp_pci.sys []
    S3 EL90XBC;3Com EtherLink XL 90XB/C Adapter Driver; C:\WINDOWS\System32\DRIVERS\el90xbc5.sys [2001-08-17 66591]
    S3 i81x;i81x; C:\WINDOWS\System32\DRIVERS\i81xnt5.sys [2004-08-03 161020]
    S3 iAimFP0;iAimFP0; C:\WINDOWS\System32\DRIVERS\wADV01nt.sys [2004-08-03 12415]
    S3 iAimFP1;iAimFP1; C:\WINDOWS\System32\DRIVERS\wADV02NT.sys [2004-08-03 12127]
    S3 iAimFP2;iAimFP2; C:\WINDOWS\System32\DRIVERS\wADV05NT.sys [2004-08-03 11775]
    S3 iAimFP3;iAimFP3; C:\WINDOWS\System32\DRIVERS\wSiINTxx.sys [2004-08-03 12063]
    S3 iAimFP4;iAimFP4; C:\WINDOWS\System32\DRIVERS\wVchNTxx.sys [2004-08-03 19455]
    S3 iAimTV0;iAimTV0; C:\WINDOWS\System32\DRIVERS\wATV01nt.sys [2004-08-03 29311]
    S3 iAimTV1;iAimTV1; C:\WINDOWS\System32\DRIVERS\wATV02NT.sys [2004-08-03 19551]
    S3 iAimTV2;iAimTV2; C:\WINDOWS\System32\DRIVERS\wATV03nt.sys []
    S3 iAimTV3;iAimTV3; C:\WINDOWS\System32\DRIVERS\wATV04nt.sys [2004-08-03 33599]
    S3 iAimTV4;iAimTV4; C:\WINDOWS\System32\DRIVERS\wCh7xxNT.sys [2004-08-03 23615]
    S3 IPFilter;Microsoft IntelliPoint Features driver; C:\WINDOWS\System32\DRIVERS\IPFilter.sys [2001-05-09 10352]
    S3 nv;nv; C:\WINDOWS\System32\DRIVERS\nv4_mini.sys [2004-08-03 1897408]
    S3 usb_rndisx;USB RNDIS Adapter; C:\WINDOWS\system32\DRIVERS\usb8023x.sys [2008-04-13 12800]
    S3 usbscan;USB Scanner Driver; C:\WINDOWS\System32\DRIVERS\usbscan.sys [2008-04-13 15104]
    S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
    S3 wanatw;WAN Miniport (ATW); C:\WINDOWS\System32\DRIVERS\wanatw4.sys []
    S3 wceusbsh;Windows CE USB Serial Host Driver; C:\WINDOWS\System32\DRIVERS\wceusbsh.sys [2004-12-30 104576]
    S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
    S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
    S4 agp440;Intel AGP Bus Filter; C:\WINDOWS\System32\DRIVERS\agp440.sys [2008-04-13 42368]
    S4 agpCPQ;Compaq AGP Bus Filter; C:\WINDOWS\System32\DRIVERS\agpCPQ.sys [2008-04-13 44928]
    S4 alim1541;ALI AGP Bus Filter; C:\WINDOWS\System32\DRIVERS\alim1541.sys [2008-04-13 42752]
    S4 amdagp;AMD AGP Bus Filter Driver; C:\WINDOWS\System32\DRIVERS\amdagp.sys [2008-04-13 43008]
    S4 cbidf;cbidf; C:\WINDOWS\System32\DRIVERS\cbidf2k.sys [2001-08-17 13952]
    S4 IntelIde;IntelIde; C:\WINDOWS\System32\DRIVERS\intelide.sys [2008-04-13 5504]
    S4 sisagp;SIS AGP Bus Filter; C:\WINDOWS\System32\DRIVERS\sisagp.sys [2008-04-13 40960]
    S4 viaagp;VIA AGP Bus Filter; C:\WINDOWS\System32\DRIVERS\viaagp.sys [2008-04-13 42240]

    List of services

    R2 aawservice;Lavasoft Ad-Aware Service; C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe [2008-06-15 611664]
    R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-02-18 110592]
    R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2008-03-28 536576]
    R2 avg8emc;AVG Free8 E-mail Scanner; C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-08-29 875288]
    R2 avg8wd;AVG Free8 WatchDog; C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-08-29 231704]
    R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2007-07-24 229376]
    R2 CCALib8;Canon Camera Access Library 8; C:\Program Files\Canon\CAL\CALMAIN.exe [2006-03-30 96341]
    R2 Creative Service for CDROM Access;Creative Service for CDROM Access; C:\WINDOWS\System32\CTsvcCDA.EXE [1999-12-13 44032]
    R2 IAANTMon;IAA Event Monitor; C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe [2004-03-23 73852]
    R2 nmservice;Pure Networks Platform Service; C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe [2008-05-16 648504]
    R2 ProtexisLicensing;ProtexisLicensing; C:\WINDOWS\system32\PSIService.exe [2007-06-05 177704]
    R2 WMDM PMSP Service;WMDM PMSP Service; C:\WINDOWS\System32\MsPMSPSv.exe [2000-06-26 53520]
    R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-13 14336]
    R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2008-03-30 504104]
    S2 ATI Smart;ATI Smart; C:\WINDOWS\SYSTEM32\ati2sgag.exe [2008-03-28 593920]
    S3 Adobe LM Service;Adobe LM Service; C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [2007-03-17 72704]
    S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800]
    S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
    S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-07-18 156656]
    S3 nmraapache;Pure Networks Net2Go Service; C:\Program Files\Pure Networks\Network Magic\WebServer\bin\nmraapache.exe [2008-05-21 12800]
    S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
    S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
    S3 usnjsvc;Messenger Sharing Folders USN Journal Reader service; C:\Program Files\MSN Messenger\usnsvc.exe [2007-01-19 97136]
    S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-18 913408]

    -----------------EOF-----------------
     
    KarenAZ,
    #4
  6. 2008/09/14
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi
    OK please do this in the order given.

    Download Malwarebytes' Anti-Malware (MBAM) from here or here and save the file to your desktop.

    Double click mbam-setup.exe to install the application.
    • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
    • If an update is found, it will download and install the latest version.
    • Once the program has loaded, select 'Perform Quick Scan', then click Scan.
    • The scan may take some time to finish,so please be patient.
    • When the scan is complete, click OK, then Show Results to view the results.
    • Make sure that everything is checked, and click Remove Selected.
    • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note below)
    • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
    • Post the entire report in your next reply along with a fresh HijackThis log.

    Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.


    Download ComboFix from Here to your Desktop.

    It's best to disable realtime protection applications as they sometimes interfere with the tool.
    Check this link for any applicable programs you may have.
    • Close all open programs and windows
    • Double click combofix.exe and follow the prompts.
    • Vista users right click Combofix.exe and select Run As Administrator.
    • When finished, it shall produce a log for you. Post the Combofix log
    Note: Do not mouseclick combofix's window while its running. That may cause it to stall

    Note - ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.

    Note - Combofix makes some changes when run to prevent autorun/autoplay of ALL CDs, floppies and USB devices, to assist with malware removal & increase security. If this is an issue or makes it difficult for you to use those devices, please ask how to reset it.

    Please post the MBAM log and the combofix log.

    Thanks
    Geri
     
    Geri,
    #5
  7. 2008/09/14
    KarenAZ

    KarenAZ Inactive Thread Starter

    Joined:
    2008/09/14
    Messages:
    24
    Likes Received:
    0
    okay - off I go!!! Be back soon I hope ;)
     
    KarenAZ,
    #6
  8. 2008/09/14
    KarenAZ

    KarenAZ Inactive Thread Starter

    Joined:
    2008/09/14
    Messages:
    24
    Likes Received:
    0
    Here is the malware log:

    Malwarebytes' Anti-Malware 1.28
    Database version: 1151
    Windows 5.1.2600 Service Pack 3

    9/14/2008 10:14:50 a.m.
    mbam-log-2008-09-14 (10-14-50).txt

    Scan type: Quick Scan
    Objects scanned: 54569
    Time elapsed: 6 minute(s), 12 second(s)

    Memory Processes Infected: 1
    Memory Modules Infected: 4
    Registry Keys Infected: 32
    Registry Values Infected: 5
    Registry Data Items Infected: 2
    Folders Infected: 2
    Files Infected: 24

    Memory Processes Infected:
    C:\Program Files\GetModule\GetModule23.exe (Trojan.Agent) -> Unloaded process successfully.

    Memory Modules Infected:
    C:\WINDOWS\SYSTEM32\tgshxfyk.dll (Trojan.Vundo.H) -> Delete on reboot.
    C:\WINDOWS\SYSTEM32\xxyaxVnl.dll (Trojan.Vundo.H) -> Delete on reboot.
    C:\WINDOWS\SYSTEM32\xxstjm.dll (Trojan.Vundo) -> Delete on reboot.
    C:\WINDOWS\SYSTEM32\ddcATlJB.dll (Trojan.Vundo.H) -> Delete on reboot.

    Registry Keys Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1e937922-4627-4b45-84c4-741a6ce9bc08} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{1e937922-4627-4b45-84c4-741a6ce9bc08} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{638f95f8-a833-431a-97ec-da6c03ca3caf} (Trojan.Vundo.H) -> Delete on reboot.
    HKEY_CLASSES_ROOT\CLSID\{638f95f8-a833-431a-97ec-da6c03ca3caf} (Trojan.Vundo.H) -> Delete on reboot.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d7336d32-62f7-43b5-8b8c-3963c72ca498} (Trojan.Vundo.H) -> Delete on reboot.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ddcatljb (Trojan.Vundo.H) -> Delete on reboot.
    HKEY_CLASSES_ROOT\CLSID\{d7336d32-62f7-43b5-8b8c-3963c72ca498} (Trojan.Vundo.H) -> Delete on reboot.
    HKEY_CLASSES_ROOT\minibugtransporter.minibugtransporterx (Adware.Minibug) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\minibugtransporter.minibugtransporterx.1 (Adware.Minibug) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\popcaploader.popcaploaderctrl2 (Adware.PopCap) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\popcaploader.popcaploaderctrl2.1 (Adware.PopCap) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{04a38f6b-006f-4247-ba4c-02a139d5531c} (Adware.Minibug) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{e4e3e0f8-cd30-4380-8ce9-b96904bdefca} (Adware.PopCap) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{fe8a736f-4124-4d9c-b4b1-3b12381efabe} (Adware.PopCap) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{df780f87-ff2b-4df8-92d0-73db16a1543a} (Adware.PopCap) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{2b96d5cc-c5b5-49a5-a69d-cc0a30f9028c} (Adware.Minibug) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Typelib\{c9c5deaf-0a1f-4660-8279-9edfad6fefe1} (Adware.PopCap) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Typelib\{3c2d2a1e-031f-4397-9614-87c932a848e0} (Adware.Minibug) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{df780f87-ff2b-4df8-92d0-73db16a1543a} (Adware.PopCap) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\icheck (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\GetModule (Adware.Agent) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Trymedia Systems (Adware.Trymedia) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\dslcnnct (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IProxyProvider (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Outerinfo (Adware.PurityScan) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Trojan.Vundo) -> Quarantined and deleted successfully.

    Registry Values Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\602fec7f (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{d7336d32-62f7-43b5-8b8c-3963c72ca498} (Trojan.Vundo.H) -> Delete on reboot.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bm631cdfe3 (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\getmodule23 (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\c:\program files\adwarealert\filterdrv\ (Rogue.AdwareAlert) -> Quarantined and deleted successfully.

    Registry Data Items Infected:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\xxyaxvnl -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\xxyaxvnl -> Delete on reboot.

    Folders Infected:
    C:\Program Files\iCheck (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\GetModule (Trojan.Agent) -> Quarantined and deleted successfully.

    Files Infected:
    C:\WINDOWS\SYSTEM32\xxstjm.dll (Trojan.Vundo.H) -> Delete on reboot.
    C:\WINDOWS\SYSTEM32\xxyaxVnl.dll (Trojan.Vundo.H) -> Delete on reboot.
    C:\WINDOWS\SYSTEM32\lnVxayxx.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINDOWS\SYSTEM32\lnVxayxx.ini2 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINDOWS\SYSTEM32\ddcATlJB.dll (Trojan.Vundo.H) -> Delete on reboot.
    C:\WINDOWS\SYSTEM32\tgshxfyk.dll (Trojan.Vundo.H) -> Delete on reboot.
    C:\WINDOWS\SYSTEM32\kyfxhsgt.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINDOWS\SYSTEM32\wnvflsmh.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\WINDOWS\Installer\{CEA5713B-7C19-48DA-AF9A-19AEC593F8E4}\Icon.exe (Rogue.AdwareAlert) -> Quarantined and deleted successfully.
    C:\WINDOWS\SYSTEM32\gjwtaget.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\WINDOWS\SYSTEM32\dltoxxvd.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\WINDOWS\SYSTEM32\efcBurRH.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\Program Files\iCheck\iCheck.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\iCheck\Uninstall.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\GetModule\dicik.gz (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\GetModule\GetModule23.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\GetModule\kwdik.gz (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\GetModule\ozadik.gz (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\WINDOWS\SYSTEM32\mcrh.tmp (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\pskt.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\WINDOWS\BM631cdfe3.xml (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\WINDOWS\BM631cdfe3.txt (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Program Files\Common Files\Yazzle1554OinAdmin.exe (Adware.PurityScan) -> Quarantined and deleted successfully.
    C:\Program Files\Common Files\Yazzle1554OinUninstaller.exe (Adware.PurityScan) -> Quarantined and deleted successfully.


    Here is the Combo log:

    ComboFix 08-09-13.05 - Karen 2008-09-14 10:20:00.1 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.943 [GMT -7:00]
    Running from: C:\Documents and Settings\Karen\Desktop\ComboFix.exe
    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\Documents and Settings\Karen\Cookies\karen@ad.yieldmanager[2].txt
    C:\Documents and Settings\Karen\Local Settings\Temporary Internet Files\favicon.ico
    C:\WINDOWS\system32\actskn43.ocx
    C:\WINDOWS\SYSTEM32\cfhkj.bak1
    C:\WINDOWS\SYSTEM32\cfhkj.bak2
    C:\WINDOWS\SYSTEM32\cfhkj.ini
    C:\WINDOWS\SYSTEM32\cfhkj.ini2
    C:\WINDOWS\SYSTEM32\cfhkj.tmp
    C:\WINDOWS\system32\dao350.dll
    C:\WINDOWS\system32\Memman.vxd
    C:\WINDOWS\system32\skinboxer43.dll

    .
    ((((((((((((((((((((((((( Files Created from 2008-08-14 to 2008-09-14 )))))))))))))))))))))))))))))))
    .

    2008-09-14 10:04 . 2008-09-14 10:07 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-09-14 10:04 . 2008-09-14 10:04 <DIR> d-------- C:\Documents and Settings\Karen\Application Data\Malwarebytes
    2008-09-14 10:04 . 2008-09-14 10:04 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-09-14 10:04 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\mbamswissarmy.sys
    2008-09-14 10:04 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\mbam.sys
    2008-09-14 09:33 . 2008-09-14 09:33 <DIR> d-------- C:\rsit
    2008-09-14 08:59 . 2008-09-14 08:59 <DIR> d-------- C:\Program Files\Trend Micro
    2008-09-13 16:04 . 2008-09-14 03:02 <DIR> d-------- C:\Program Files\Spyware Doctor
    2008-09-13 13:24 . 2008-09-13 13:24 <DIR> d-------- C:\Program Files\OINAnalytics
    2008-09-11 18:20 . 2008-09-11 20:05 <DIR> d-------- C:\9-11
    2008-09-10 22:55 . 2008-09-10 22:55 <DIR> d--h----- C:\WINDOWS\PIF
    2008-09-10 22:55 . 2008-09-10 22:57 <DIR> d-------- C:\Credit Report - experian.com
    2008-09-07 01:26 . 2003-03-16 00:15 90,112 --a------ C:\WINDOWS\unvise32.exe
    2008-09-06 20:13 . 2008-09-06 20:13 <DIR> d-------- C:\Program Files\TeaTimer (Spybot - Search & Destroy)
    2008-09-05 15:00 . 2008-09-05 15:00 <DIR> d-------- C:\Program Files\Wondershare
    2008-09-05 15:00 . 2008-09-01 16:00 1,435,272 --a------ C:\WINDOWS\SYSTEM32\Flash8.ocx
    2008-09-03 18:39 . 2008-09-03 18:47 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help
    2008-09-03 18:31 . 2008-09-03 18:31 <DIR> d-------- C:\Course Technology
    2008-08-30 13:58 . 2008-08-30 13:58 <DIR> d-------- C:\Program Files\Pure Networks
    2008-08-30 13:57 . 2008-08-30 13:57 <DIR> d-------- C:\Program Files\Common Files\Pure Networks Shared
    2008-08-30 13:57 . 2008-05-16 06:10 25,272 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\purendis.sys
    2008-08-30 13:57 . 2008-05-16 06:10 23,992 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\pnarp.sys
    2008-08-30 12:29 . 2008-08-30 12:29 <DIR> d-------- C:\Program Files\DIFX
    2008-08-30 12:29 . 2008-08-30 13:57 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Pure Networks
    2008-08-30 11:31 . 2008-09-14 08:24 <DIR> d--h----- C:\$AVG8.VAULT$
    2008-08-27 21:15 . 2008-08-27 21:15 0 --------- C:\WINDOWS\WB.ini
    2008-08-27 21:10 . 2008-08-27 21:10 <DIR> d-------- C:\Program Files\Stardock
    2008-08-27 21:10 . 2008-04-26 16:14 42,672 --------- C:\WINDOWS\SYSTEM32\wbsys.dll
    2008-08-25 17:24 . 2008-08-25 17:35 <DIR> d-------- C:\x-smilies
    2008-08-24 01:33 . 2008-08-24 01:33 <DIR> d-------- C:\Documents and Settings\Karen\Application Data\Mythic Adventure
    2008-08-24 01:25 . 2008-08-24 01:25 <DIR> d-------- C:\Temp\MythicAdventure
    2008-08-24 01:23 . 2008-08-24 01:23 10,432,231 --a------ C:\Temp\MythicAdventure.zip
    2008-08-22 06:37 . 2008-08-22 06:37 <DIR> d-------- C:\Program Files\BetterJPEG 2
    2008-08-22 06:36 . 2008-08-22 06:36 <DIR> d-------- C:\Program Files\Better JPEG
    2008-08-20 20:01 . 2008-08-20 20:01 <DIR> d-------- C:\Program Files\Common Files\xing shared
    2008-08-18 21:36 . 2008-08-18 21:36 <DIR> d-------- C:\WINDOWS\SYSTEM32\scripting
    2008-08-18 21:36 . 2008-08-18 21:36 <DIR> d-------- C:\WINDOWS\SYSTEM32\en
    2008-08-18 21:36 . 2008-08-18 21:36 <DIR> d-------- C:\WINDOWS\l2schemas
    2008-08-18 17:22 . 2008-04-13 17:11 650,752 --------- C:\WINDOWS\SYSTEM32\dot3ui.dll
    2008-08-16 14:53 . 2008-09-14 03:06 <DIR> d-------- C:\WINDOWS\SYSTEM32\DRIVERS\Avg
    2008-08-16 14:53 . 2008-08-29 16:11 97,928 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\avgldx86.sys
    2008-08-16 14:53 . 2008-08-16 14:53 76,040 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\avgtdix.sys
    2008-08-16 14:53 . 2008-08-16 14:53 10,520 --a------ C:\WINDOWS\SYSTEM32\avgrsstx.dll
    2008-08-16 14:52 . 2008-08-16 14:52 <DIR> d-------- C:\Program Files\AVG
    2008-08-16 14:48 . 2008-08-16 14:52 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avg8
    2008-08-14 15:05 . 2008-08-14 15:07 <DIR> d-------- C:\Documents and Settings\Karen\Application Data\Filter Forge
    2008-08-14 14:58 . 2006-11-10 18:41 1,030,144 --a------ C:\WINDOWS\SYSTEM32\dbghelp-xfw.dll
    2008-08-14 02:06 . 2008-04-11 12:04 691,712 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\inetcomm.dll
    2008-08-14 02:06 . 2008-05-01 07:33 331,776 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\msadce.dll

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-09-07 04:26 --------- d-----w C:\Program Files\Prolific Publishing, Inc
    2008-09-07 04:26 --------- d-----w C:\Program Files\Microsoft ActiveSync
    2008-09-07 04:23 --------- d-----w C:\Documents and Settings\Karen\Application Data\Aim
    2008-09-07 03:13 --------- d-----w C:\Program Files\Spybot - Search & Destroy
    2008-09-06 07:39 --------- d-----w C:\Program Files\Yahoo!
    2008-09-06 07:34 2,560 ----a-w C:\WINDOWS\_MSRSTRT.EXE
    2008-09-06 00:45 --------- d-----w C:\Documents and Settings\Karen\Application Data\ZoomBrowser EX
    2008-09-06 00:44 --------- d-----w C:\Documents and Settings\All Users\Application Data\ZoomBrowser
    2008-09-05 00:21 --------- d-----w C:\Program Files\Weather Pulse
    2008-09-04 01:44 --------- d-----w C:\Program Files\Microsoft Works
    2008-08-21 03:01 --------- d-----w C:\Program Files\Common Files\Real
    2008-08-21 03:00 348,160 ----a-w C:\WINDOWS\SYSTEM32\msvcr71.dll
    2008-08-15 23:06 --------- d-----w C:\Program Files\Gambana
    2008-08-15 23:06 --------- d-----w C:\Documents and Settings\Karen\Application Data\Musicmatch
    2008-08-15 23:05 --------- d-----w C:\Program Files\MUSICMATCH
    2008-08-15 23:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\YAHOO
    2008-08-14 14:37 5,852 --sha-w C:\WINDOWS\SYSTEM32\KGyGaAvL.sys
    2008-08-05 02:03 --------- d-----w C:\Program Files\IncrediMail
    2008-07-27 01:49 --------- d-----w C:\Program Files\Napster
    2008-07-27 01:43 --------- d-----w C:\Program Files\Common Files\Roxio Shared
    2008-07-27 01:43 --------- d-----w C:\Program Files\Common Files\Napster Shared
    2008-07-27 01:41 --------- d-----w C:\Documents and Settings\Karen\Application Data\InstallShield
    2008-07-20 08:48 --------- d-----w C:\Program Files\Java
    2008-07-19 08:46 --------- d-----w C:\Program Files\Corel
    2008-07-19 08:46 --------- d-----w C:\Program Files\Common Files\Corel
    2008-07-19 07:45 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo!
    2008-07-19 05:10 94,920 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\cdm.dll
    2008-07-19 05:10 94,920 ----a-w C:\WINDOWS\SYSTEM32\cdm.dll
    2008-07-19 05:10 53,448 ----a-w C:\WINDOWS\SYSTEM32\wuauclt.exe
    2008-07-19 05:10 53,448 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wuauclt.exe
    2008-07-19 05:10 45,768 ----a-w C:\WINDOWS\SYSTEM32\wups2.dll
    2008-07-19 05:10 36,552 ----a-w C:\WINDOWS\SYSTEM32\wups.dll
    2008-07-19 05:10 36,552 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wups.dll
    2008-07-19 05:09 563,912 ----a-w C:\WINDOWS\SYSTEM32\wuapi.dll
    2008-07-19 05:09 563,912 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wuapi.dll
    2008-07-19 05:09 325,832 ----a-w C:\WINDOWS\SYSTEM32\wucltui.dll
    2008-07-19 05:09 325,832 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wucltui.dll
    2008-07-19 05:09 205,000 ----a-w C:\WINDOWS\SYSTEM32\wuweb.dll
    2008-07-19 05:09 205,000 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wuweb.dll
    2008-07-19 05:09 1,811,656 ----a-w C:\WINDOWS\SYSTEM32\wuaueng.dll
    2008-07-19 05:09 1,811,656 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wuaueng.dll
    2008-07-19 01:00 --------- d-----w C:\Program Files\Google
    2008-07-15 14:36 --------- d-----w C:\Documents and Settings\Karen\Application Data\Corel
    2008-07-07 20:26 253,952 ----a-w C:\WINDOWS\SYSTEM32\es.dll
    2008-07-07 20:26 253,952 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\es.dll
    2008-06-25 01:12 295,936 ------w C:\WINDOWS\SYSTEM32\wmpeffects.dll
    2008-06-24 17:57 3,592,192 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\mshtml.dll
    2008-06-24 16:43 74,240 ----a-w C:\WINDOWS\SYSTEM32\mscms.dll
    2008-06-24 16:43 74,240 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\mscms.dll
    2008-06-24 00:10 443,288 ----a-w C:\!rppspringblossomwebset.zip
    2008-06-23 09:20 70,656 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\ie4uinit.exe
    2008-06-23 09:20 625,664 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\iexplore.exe
    2008-06-23 09:20 13,824 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\ieudinit.exe
    2008-06-21 05:23 161,792 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\ieakui.dll
    2008-06-20 17:46 245,248 ----a-w C:\WINDOWS\SYSTEM32\mswsock.dll
    2008-06-20 17:46 245,248 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\mswsock.dll
    2008-06-20 17:46 147,968 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\dnsapi.dll
    2008-06-20 11:51 361,600 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\tcpip.sys
    2008-06-20 11:40 138,496 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\afd.sys
    2008-06-20 11:08 225,856 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\tcpip6.sys
    2004-11-30 12:37 0 ----a-w C:\Documents and Settings\Karen\emlthumb.reg
    2004-10-01 01:29 40,960 ----a-w C:\Program Files\colorspy.exe
    2004-08-28 00:04 40,295 ----a-w C:\Program Files\uninstal.log
    2008-03-09 02:57 88 --sh--r C:\WINDOWS\SYSTEM32\0A974F2BD6.sys
    .
    Code:
    <pre>
----a-r            18,139 2003-07-27 04:02:14  C:\Documents and Settings\Karen\My Documents\My Received Files\Alien Skin Xenofex 2 Demo crack\LS_Alien_Skin_Xenofex_v2.0.0_Demo .exe
</pre>

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6B221E01-F517-4959-8C41-81948E7F2F17}]
    2008-09-11 12:48 229376 --a------ C:\Program Files\OINAnalytics\OINAnalytics.dll

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Magentic "= "C:\PROGRA~1\Magentic\bin\Magentic.exe" [N/A]
    "ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 15360]
    "swg "= "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-26 68856]
    "mSpotAlltelRemix "= "C:\Program Files\Alltel Jump Music\Remix\msptcmd.exe" [2008-02-07 1507328]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SunJavaUpdateSched "= "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
    "IAAnotif "= "C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe" [2004-03-23 135168]
    "DVDLauncher "= "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-04-11 53248]
    "CTSysVol "= "C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe" [2003-09-17 57344]
    "UpdReg "= "C:\WINDOWS\UpdReg.EXE" [2000-05-10 90112]
    "PCMService "= "C:\Program Files\Dell\Media Experience\PCMService.exe" [2004-04-11 290816]
    "dla "= "C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-03-14 122933]
    "UpdateManager "= "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-18 110592]
    "DwlClient "= "c:\Program Files\Common Files\Dell\EUSW\Support.exe" [2004-05-27 323584]
    "webscan "= "C:\Program Files\Acceleration Software\Anti-Virus\stopsignav.exe" [N/A]
    "IntelliPoint "= "C:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2007-02-05 849280]
    "QuickTime Task "= "C:\Program Files\QuickTime\qttask.exe" [2008-03-28 413696]
    "iTunesHelper "= "C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 267048]
    "StartCCC "= "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
    "AVG8_TRAY "= "C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-08-29 1235736]
    "nmctxth "= "C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe" [2008-05-16 648504]
    "nmapp "= "C:\Program Files\Pure Networks\Network Magic\nmapp.exe" [2008-05-21 451896]
    "P17Helper "= "P17.dll" [2004-06-10 C:\WINDOWS\SYSTEM32\P17.dll]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "swg "= "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-26 68856]

    C:\Documents and Settings\Karen\Start Menu\Programs\Startup\
    Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 113664]
    Rainlendar.lnk - C:\Program Files\Rainlendar\Rainlendar.exe [2006-01-21 118784]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    Acrobat Assistant.lnk - C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [2003-10-23 217194]
    Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2004-08-24 24576]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs "=avgrsstx.dll xxstjm.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "MSACM.CEGSM "= mobilev.acm

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MimBoot]
    C:\PROGRA~1\MUSICM~1\MUSICM~2\mimboot.exe [N/A]

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe "=
    "C:\\Program Files\\IncrediMail\\bin\\IMApp.exe "=
    "C:\\Program Files\\IncrediMail\\bin\\IncMail.exe "=
    "C:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe "=
    "C:\\Program Files\\IncrediMail\\bin\\ImLc.exe "=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe "=
    "C:\\Program Files\\Real\\RealPlayer\\realplay.exe "=
    "C:\\Program Files\\MSN Messenger\\msnmsgr.exe "=
    "C:\\Program Files\\MSN Messenger\\livecall.exe "=
    "C:\\Program Files\\IncrediMail\\bin\\ImPackr.exe "=
    "C:\\Program Files\\Bonjour\\mDNSResponder.exe "=
    "C:\\Program Files\\iTunes\\iTunes.exe "=
    "C:\\Program Files\\IncrediMail\\bin\\ImSc.exe "=
    "C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe "=
    "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe "=
    "C:\\Program Files\\AVG\\AVG8\\avgemc.exe "=
    "C:\\Program Files\\AVG\\AVG8\\avgupd.exe "=
    "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE "=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "56106:TCP "= 56106:TCP:pando P2P TCP Listening Port
    "56106:UDP "= 56106:UDP:pando P2P UDP Listening Port
    "67:UDP "= 67:UDP:DHCP Discovery Service

    R1 AvgLdx86;AVG Free AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-08-29 97928]
    R2 avg8emc;AVG Free8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-08-29 875288]
    R2 avg8wd;AVG Free8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-08-29 231704]
    R2 AvgTdiX;AVG Free8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-08-16 76040]

    *Newly Created Service* - CATCHME
    *Newly Created Service* - PROCEXP90
    .
    Contents of the 'Scheduled Tasks' folder
    .
    .
    ------- Supplementary Scan -------
    .
    FireFox -: Profile - C:\Documents and Settings\Karen\Application Data\Mozilla\Firefox\Profiles\gfqnf6lt.default\
    FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
    FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://cm.my.yahoo.com/
    .

    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-09-14 10:24:37
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    HKLM\Software\Microsoft\Windows\CurrentVersion\Run
    DwlClient = c:\Program Files\Common Files\Dell\EUSW\Support.exe?l?e?s?\?D?e?l?l?\?E?U?S?W?\?S?u?p?p?o?r?t?.?e?x?e???x???x???????????????????x???h???????x???x???????????x???H???????x???x???????????????????????@????????????????D?w????????????7??w????x???x??????????????

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2008-09-14 10:30:52
    ComboFix-quarantined-files.txt 2008-09-14 17:30:00

    Pre-Run: 97,495,830,528 bytes free
    Post-Run: 97,901,903,872 bytes free

    243 --- E O F --- 2008-09-10 13:09:50


    Next post is the hijack this log
     
    KarenAZ,
    #7
  9. 2008/09/14
    KarenAZ

    KarenAZ Inactive Thread Starter

    Joined:
    2008/09/14
    Messages:
    24
    Likes Received:
    0
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 10:31:34 a.m., on 9/14/2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16705)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
    C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
    C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe
    C:\Program Files\Dell\Media Experience\PCMService.exe
    C:\WINDOWS\system32\dla\tfswctrl.exe
    C:\Program Files\Common Files\Dell\EUSW\Support.exe
    C:\Program Files\Microsoft IntelliPoint\ipoint.exe
    c:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe
    C:\Program Files\Pure Networks\Network Magic\nmapp.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\WINDOWS\System32\CTsvcCDA.EXE
    C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
    C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
    C:\WINDOWS\system32\PSIService.exe
    C:\Program Files\Digital Line Detect\DLG.exe
    C:\WINDOWS\System32\svchost.exe
    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
    C:\WINDOWS\System32\MsPMSPSv.exe
    C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
    C:\Program Files\Canon\CAL\CALMAIN.exe
    C:\PROGRA~1\AVG\AVG8\avgemc.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\notepad.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://cm.my.yahoo.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
    O2 - BHO: OIN Analytics - {6B221E01-F517-4959-8C41-81948E7F2F17} - C:\Program Files\OINAnalytics\OINAnalytics.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
    O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.509.5470\swg.dll
    O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
    O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe "
    O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
    O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe "
    O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe /r
    O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
    O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
    O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe "
    O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
    O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
    O4 - HKLM\..\Run: [DwlClient] c:\Program Files\Common Files\Dell\EUSW\Support.exe
    O4 - HKLM\..\Run: [webscan] "C:\Program Files\Acceleration Software\Anti-Virus\stopsignav.exe" -k
    O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe "
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
    O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe "
    O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
    O4 - HKLM\..\Run: [nmctxth] "C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe "
    O4 - HKLM\..\Run: [nmapp] "C:\Program Files\Pure Networks\Network Magic\nmapp.exe" -autorun -nosplash
    O4 - HKCU\..\Run: [Magentic] C:\PROGRA~1\Magentic\bin\Magentic.exe /c
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [mSpotAlltelRemix] "C:\Program Files\Alltel Jump Music\Remix\msptcmd.exe" /runcheck
    O4 - HKUS\S-1-5-18\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'Default user')
    O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Startup: Rainlendar.lnk = C:\Program Files\Rainlendar\Rainlendar.exe
    O4 - Startup: Snsicon.lnk = C:\SLIDESHW\Snsicon.exe
    O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
    O4 - Global Startup: Digital Line Detect.lnk = ?
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office12\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\Office12\REFIEBAR.DLL
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: Photobucket Publisher - http://pic.photobucket.com/plugins/csve/photobucket_publisher.CAB
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {1A1F56AA-3401-46F9-B277-D57F3421F821} (FunGamesLoader Object) - http://www.worldwinner.com/games/v47/shared/FunGamesLoader.cab
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
    O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photo.walgreens.com/WalgreensActivia.cab
    O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://groups.msn.com/controls/PhotoUC/MsnPUpld.cab
    O16 - DPF: {5D9E4B6D-CD17-4D85-99D4-6A52B394EC3B} (WSDownloader Control) - http://www.webshots.com/samplers/WSDownloader.ocx
    O16 - DPF: {615F158E-D5CA-422F-A8E7-F6A5EED7063B} (Bejeweled Control) - http://www.worldwinner.com/games/v46/bejeweled/bejeweled.cab
    O16 - DPF: {7CCAD6DD-DD0B-440B-91FF-7670F5AADC21} (SpinTop Games Launcher) - http://clubgames.pogo.com/online2/pogop/mahjong_escape_ancient_japan/SpinTopGamesLauncher.cab
    O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - http://download.zonelabs.com/bin/promotions/spywaredetector/ICSScanner37380.cab
    O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab
    O16 - DPF: {99B6E512-3893-4155-9964-8EB8E06099CB} (WebSpyWareKiller Class) - http://download.zonelabs.com/bin/promotions/spywaredetector/WebSWK.cab
    O16 - DPF: {9A54032D-31F7-400D-B184-83B33BDE65FA} (MSN File Upload Control) - http://sc.groups.msn.com/controls/FileUC/MsnUpld.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
    O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) - http://sc.groups.msn.com/controls/PhotoUC/MsnPUpld.cab
    O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
    O20 - AppInit_DLLs: avgrsstx.dll xxstjm.dll
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe
    O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
    O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Pure Networks Net2Go Service (nmraapache) - Pure Networks, Inc. - C:\Program Files\Pure Networks\Network Magic\WebServer\bin\nmraapache.exe
    O23 - Service: Pure Networks Platform Service (nmservice) - Pure Networks, Inc. - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
    O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe

    --
    End of file - 12369 bytes
     
    KarenAZ,
    #8
  10. 2008/09/14
    KarenAZ

    KarenAZ Inactive Thread Starter

    Joined:
    2008/09/14
    Messages:
    24
    Likes Received:
    0
    Does this mean it's gone now?
     
    KarenAZ,
    #9
  11. 2008/09/14
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi

    Do you know what this is?
    C:\9-11


    Please go to Start > Control Panel > Add/Remove Programs (Windows Vista it’s Programs and Features) and remove the following (if present):


    OINAnalytics <<Anything that has to do with OIN or Yazzle
    Yazzle

    Highlight and copy the contents of the code box below and paste it into a blank Notepad, then save it to your desktop as;

    Filename: CFScript.txt
    Save As Type: All Files (*.*)

    Close all other windows and programs. Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button.
    Click here to see how to use CFScript.txt
    Combofix should run and may reboot the computer when it's done. A log will open when it's complete. Post the contents of that log and another fresh HijackThis log.

    Please do not click on the ComboFix window while it is running a scan. This can cause it to stall.

    Code:
    RenV::
C:\Documents and Settings\Karen\My Documents\My Received Files\Alien Skin Xenofex 2 Demo crack\LS_Alien_Skin_Xenofex_v2.0.0_Demo .exe

Folder::
C:\Program Files\OINAnalytics

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6B221E01-F517-4959-8C41-81948E7F2F17}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
 "xxstjm.dll "=-
    Please post the combofix log and a new RSIT log.txt

    Let me know if you know what C:\9-11 is.

    Also. You are going to have nothing but problems if you keep dealing with P2P or cracks.
    Windowsbbs or staff do not approve nor will we provide support in the future for problems resulting from the use of them.

    Geri
     
    Geri,
    #10
  12. 2008/09/14
    KarenAZ

    KarenAZ Inactive Thread Starter

    Joined:
    2008/09/14
    Messages:
    24
    Likes Received:
    0
    yes - it's a folder that just contains things about 9/11 -
     
    KarenAZ,
    #11
  13. 2008/09/14
    KarenAZ

    KarenAZ Inactive Thread Starter

    Joined:
    2008/09/14
    Messages:
    24
    Likes Received:
    0
    What is P2P?
     
    KarenAZ,
    #12
  14. 2008/09/14
    KarenAZ

    KarenAZ Inactive Thread Starter

    Joined:
    2008/09/14
    Messages:
    24
    Likes Received:
    0
    Here is the combo fix log (I dragged that text to the icon but I'm not sure it worked?)
    ComboFix 08-09-14.01 - Karen 2008-09-14 12:01:16.2 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.858 [GMT -7:00]
    Running from: C:\Documents and Settings\Karen\Desktop\ComboFix.exe
    Command switches used :: C:\Documents and Settings\Karen\Desktop\CFScript.txt
    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    ((((((((((((((((((((((((( Files Created from 2008-08-14 to 2008-09-14 )))))))))))))))))))))))))))))))
    .

    2008-09-14 10:04 . 2008-09-14 10:07 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-09-14 10:04 . 2008-09-14 10:04 <DIR> d-------- C:\Documents and Settings\Karen\Application Data\Malwarebytes
    2008-09-14 10:04 . 2008-09-14 10:04 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-09-14 10:04 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\mbamswissarmy.sys
    2008-09-14 10:04 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\mbam.sys
    2008-09-14 09:33 . 2008-09-14 09:33 <DIR> d-------- C:\rsit
    2008-09-14 08:59 . 2008-09-14 08:59 <DIR> d-------- C:\Program Files\Trend Micro
    2008-09-13 16:04 . 2008-09-14 03:02 <DIR> d-------- C:\Program Files\Spyware Doctor
    2008-09-11 18:20 . 2008-09-11 20:05 <DIR> d-------- C:\9-11
    2008-09-10 22:55 . 2008-09-10 22:55 <DIR> d--h----- C:\WINDOWS\PIF
    2008-09-10 22:55 . 2008-09-10 22:57 <DIR> d-------- C:\Credit Report - experian.com
    2008-09-07 01:26 . 2003-03-16 00:15 90,112 --a------ C:\WINDOWS\unvise32.exe
    2008-09-06 20:13 . 2008-09-06 20:13 <DIR> d-------- C:\Program Files\TeaTimer (Spybot - Search & Destroy)
    2008-09-05 15:00 . 2008-09-05 15:00 <DIR> d-------- C:\Program Files\Wondershare
    2008-09-05 15:00 . 2008-09-01 16:00 1,435,272 --a------ C:\WINDOWS\SYSTEM32\Flash8.ocx
    2008-09-03 18:39 . 2008-09-03 18:47 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help
    2008-09-03 18:31 . 2008-09-03 18:31 <DIR> d-------- C:\Course Technology
    2008-08-30 13:58 . 2008-08-30 13:58 <DIR> d-------- C:\Program Files\Pure Networks
    2008-08-30 13:57 . 2008-08-30 13:57 <DIR> d-------- C:\Program Files\Common Files\Pure Networks Shared
    2008-08-30 13:57 . 2008-05-16 06:10 25,272 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\purendis.sys
    2008-08-30 13:57 . 2008-05-16 06:10 23,992 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\pnarp.sys
    2008-08-30 12:29 . 2008-08-30 12:29 <DIR> d-------- C:\Program Files\DIFX
    2008-08-30 12:29 . 2008-08-30 13:57 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Pure Networks
    2008-08-30 11:31 . 2008-09-14 08:24 <DIR> d--h----- C:\$AVG8.VAULT$
    2008-08-27 21:15 . 2008-08-27 21:15 0 --------- C:\WINDOWS\WB.ini
    2008-08-27 21:10 . 2008-08-27 21:10 <DIR> d-------- C:\Program Files\Stardock
    2008-08-27 21:10 . 2008-04-26 16:14 42,672 --------- C:\WINDOWS\SYSTEM32\wbsys.dll
    2008-08-25 17:24 . 2008-08-25 17:35 <DIR> d-------- C:\x-smilies
    2008-08-24 01:33 . 2008-08-24 01:33 <DIR> d-------- C:\Documents and Settings\Karen\Application Data\Mythic Adventure
    2008-08-24 01:25 . 2008-08-24 01:25 <DIR> d-------- C:\Temp\MythicAdventure
    2008-08-24 01:23 . 2008-08-24 01:23 10,432,231 --a------ C:\Temp\MythicAdventure.zip
    2008-08-22 06:37 . 2008-08-22 06:37 <DIR> d-------- C:\Program Files\BetterJPEG 2
    2008-08-22 06:36 . 2008-08-22 06:36 <DIR> d-------- C:\Program Files\Better JPEG
    2008-08-20 20:01 . 2008-08-20 20:01 <DIR> d-------- C:\Program Files\Common Files\xing shared
    2008-08-18 21:36 . 2008-08-18 21:36 <DIR> d-------- C:\WINDOWS\SYSTEM32\scripting
    2008-08-18 21:36 . 2008-08-18 21:36 <DIR> d-------- C:\WINDOWS\SYSTEM32\en
    2008-08-18 21:36 . 2008-08-18 21:36 <DIR> d-------- C:\WINDOWS\l2schemas
    2008-08-18 17:22 . 2008-04-13 17:11 650,752 --------- C:\WINDOWS\SYSTEM32\dot3ui.dll
    2008-08-16 14:53 . 2008-09-14 03:06 <DIR> d-------- C:\WINDOWS\SYSTEM32\DRIVERS\Avg
    2008-08-16 14:53 . 2008-08-29 16:11 97,928 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\avgldx86.sys
    2008-08-16 14:53 . 2008-08-16 14:53 76,040 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\avgtdix.sys
    2008-08-16 14:53 . 2008-08-16 14:53 10,520 --a------ C:\WINDOWS\SYSTEM32\avgrsstx.dll
    2008-08-16 14:52 . 2008-08-16 14:52 <DIR> d-------- C:\Program Files\AVG
    2008-08-16 14:48 . 2008-08-16 14:52 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avg8
    2008-08-14 15:05 . 2008-08-14 15:07 <DIR> d-------- C:\Documents and Settings\Karen\Application Data\Filter Forge
    2008-08-14 14:58 . 2006-11-10 18:41 1,030,144 --a------ C:\WINDOWS\SYSTEM32\dbghelp-xfw.dll
    2008-08-14 02:06 . 2008-04-11 12:04 691,712 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\inetcomm.dll
    2008-08-14 02:06 . 2008-05-01 07:33 331,776 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\msadce.dll

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-09-07 04:26 --------- d-----w C:\Program Files\Prolific Publishing, Inc
    2008-09-07 04:26 --------- d-----w C:\Program Files\Microsoft ActiveSync
    2008-09-07 04:23 --------- d-----w C:\Documents and Settings\Karen\Application Data\Aim
    2008-09-07 03:13 --------- d-----w C:\Program Files\Spybot - Search & Destroy
    2008-09-06 07:39 --------- d-----w C:\Program Files\Yahoo!
    2008-09-06 07:34 2,560 ----a-w C:\WINDOWS\_MSRSTRT.EXE
    2008-09-06 00:45 --------- d-----w C:\Documents and Settings\Karen\Application Data\ZoomBrowser EX
    2008-09-06 00:44 --------- d-----w C:\Documents and Settings\All Users\Application Data\ZoomBrowser
    2008-09-05 00:21 --------- d-----w C:\Program Files\Weather Pulse
    2008-09-04 01:44 --------- d-----w C:\Program Files\Microsoft Works
    2008-08-21 03:01 --------- d-----w C:\Program Files\Common Files\Real
    2008-08-21 03:00 348,160 ----a-w C:\WINDOWS\SYSTEM32\msvcr71.dll
    2008-08-15 23:06 --------- d-----w C:\Program Files\Gambana
    2008-08-15 23:06 --------- d-----w C:\Documents and Settings\Karen\Application Data\Musicmatch
    2008-08-15 23:05 --------- d-----w C:\Program Files\MUSICMATCH
    2008-08-15 23:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\YAHOO
    2008-08-14 14:37 5,852 --sha-w C:\WINDOWS\SYSTEM32\KGyGaAvL.sys
    2008-08-05 02:03 --------- d-----w C:\Program Files\IncrediMail
    2008-07-27 01:49 --------- d-----w C:\Program Files\Napster
    2008-07-27 01:43 --------- d-----w C:\Program Files\Common Files\Roxio Shared
    2008-07-27 01:43 --------- d-----w C:\Program Files\Common Files\Napster Shared
    2008-07-27 01:41 --------- d-----w C:\Documents and Settings\Karen\Application Data\InstallShield
    2008-07-20 08:48 --------- d-----w C:\Program Files\Java
    2008-07-19 08:46 --------- d-----w C:\Program Files\Corel
    2008-07-19 08:46 --------- d-----w C:\Program Files\Common Files\Corel
    2008-07-19 07:45 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo!
    2008-07-19 05:10 94,920 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\cdm.dll
    2008-07-19 05:10 94,920 ----a-w C:\WINDOWS\SYSTEM32\cdm.dll
    2008-07-19 05:10 53,448 ----a-w C:\WINDOWS\SYSTEM32\wuauclt.exe
    2008-07-19 05:10 53,448 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wuauclt.exe
    2008-07-19 05:10 45,768 ----a-w C:\WINDOWS\SYSTEM32\wups2.dll
    2008-07-19 05:10 36,552 ----a-w C:\WINDOWS\SYSTEM32\wups.dll
    2008-07-19 05:10 36,552 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wups.dll
    2008-07-19 05:09 563,912 ----a-w C:\WINDOWS\SYSTEM32\wuapi.dll
    2008-07-19 05:09 563,912 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wuapi.dll
    2008-07-19 05:09 325,832 ----a-w C:\WINDOWS\SYSTEM32\wucltui.dll
    2008-07-19 05:09 325,832 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wucltui.dll
    2008-07-19 05:09 205,000 ----a-w C:\WINDOWS\SYSTEM32\wuweb.dll
    2008-07-19 05:09 205,000 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wuweb.dll
    2008-07-19 05:09 1,811,656 ----a-w C:\WINDOWS\SYSTEM32\wuaueng.dll
    2008-07-19 05:09 1,811,656 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wuaueng.dll
    2008-07-19 01:00 --------- d-----w C:\Program Files\Google
    2008-07-15 14:36 --------- d-----w C:\Documents and Settings\Karen\Application Data\Corel
    2008-07-07 20:26 253,952 ----a-w C:\WINDOWS\SYSTEM32\es.dll
    2008-07-07 20:26 253,952 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\es.dll
    2008-06-25 01:12 295,936 ------w C:\WINDOWS\SYSTEM32\wmpeffects.dll
    2008-06-24 17:57 3,592,192 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\mshtml.dll
    2008-06-24 16:43 74,240 ----a-w C:\WINDOWS\SYSTEM32\mscms.dll
    2008-06-24 16:43 74,240 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\mscms.dll
    2008-06-24 00:10 443,288 ----a-w C:\!rppspringblossomwebset.zip
    2008-06-23 09:20 70,656 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\ie4uinit.exe
    2008-06-23 09:20 625,664 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\iexplore.exe
    2008-06-23 09:20 13,824 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\ieudinit.exe
    2008-06-21 05:23 161,792 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\ieakui.dll
    2008-06-20 17:46 245,248 ----a-w C:\WINDOWS\SYSTEM32\mswsock.dll
    2008-06-20 17:46 245,248 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\mswsock.dll
    2008-06-20 17:46 147,968 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\dnsapi.dll
    2008-06-20 11:51 361,600 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\tcpip.sys
    2008-06-20 11:40 138,496 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\afd.sys
    2008-06-20 11:08 225,856 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\tcpip6.sys
    2004-11-30 12:37 0 ----a-w C:\Documents and Settings\Karen\emlthumb.reg
    2004-10-01 01:29 40,960 ----a-w C:\Program Files\colorspy.exe
    2004-08-28 00:04 40,295 ----a-w C:\Program Files\uninstal.log
    2008-03-09 02:57 88 --sh--r C:\WINDOWS\SYSTEM32\0A974F2BD6.sys
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 15360]
    "swg "= "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-26 68856]
    "mSpotAlltelRemix "= "C:\Program Files\Alltel Jump Music\Remix\msptcmd.exe" [2008-02-07 1507328]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SunJavaUpdateSched "= "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
    "IAAnotif "= "C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe" [2004-03-23 135168]
    "DVDLauncher "= "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-04-11 53248]
    "CTSysVol "= "C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe" [2003-09-17 57344]
    "UpdReg "= "C:\WINDOWS\UpdReg.EXE" [2000-05-10 90112]
    "PCMService "= "C:\Program Files\Dell\Media Experience\PCMService.exe" [2004-04-11 290816]
    "dla "= "C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-03-14 122933]
    "UpdateManager "= "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-18 110592]
    "DwlClient "= "c:\Program Files\Common Files\Dell\EUSW\Support.exe" [2004-05-27 323584]
    "IntelliPoint "= "C:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2007-02-05 849280]
    "QuickTime Task "= "C:\Program Files\QuickTime\qttask.exe" [2008-03-28 413696]
    "iTunesHelper "= "C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 267048]
    "StartCCC "= "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
    "AVG8_TRAY "= "C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-08-29 1235736]
    "nmctxth "= "C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe" [2008-05-16 648504]
    "nmapp "= "C:\Program Files\Pure Networks\Network Magic\nmapp.exe" [2008-05-21 451896]
    "P17Helper "= "P17.dll" [2004-06-10 C:\WINDOWS\SYSTEM32\P17.dll]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "swg "= "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-26 68856]

    C:\Documents and Settings\Karen\Start Menu\Programs\Startup\
    Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 113664]
    Rainlendar.lnk - C:\Program Files\Rainlendar\Rainlendar.exe [2006-01-21 118784]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    Acrobat Assistant.lnk - C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [2003-10-23 217194]
    Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2004-08-24 24576]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs "=avgrsstx.dll xxstjm.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "MSACM.CEGSM "= mobilev.acm

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe "=
    "C:\\Program Files\\IncrediMail\\bin\\IMApp.exe "=
    "C:\\Program Files\\IncrediMail\\bin\\IncMail.exe "=
    "C:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe "=
    "C:\\Program Files\\IncrediMail\\bin\\ImLc.exe "=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe "=
    "C:\\Program Files\\Real\\RealPlayer\\realplay.exe "=
    "C:\\Program Files\\MSN Messenger\\msnmsgr.exe "=
    "C:\\Program Files\\MSN Messenger\\livecall.exe "=
    "C:\\Program Files\\IncrediMail\\bin\\ImPackr.exe "=
    "C:\\Program Files\\Bonjour\\mDNSResponder.exe "=
    "C:\\Program Files\\iTunes\\iTunes.exe "=
    "C:\\Program Files\\IncrediMail\\bin\\ImSc.exe "=
    "C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe "=
    "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe "=
    "C:\\Program Files\\AVG\\AVG8\\avgemc.exe "=
    "C:\\Program Files\\AVG\\AVG8\\avgupd.exe "=
    "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE "=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "56106:TCP "= 56106:TCP:pando P2P TCP Listening Port
    "56106:UDP "= 56106:UDP:pando P2P UDP Listening Port
    "67:UDP "= 67:UDP:DHCP Discovery Service

    R1 AvgLdx86;AVG Free AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-08-29 97928]
    R2 avg8emc;AVG Free8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-08-29 875288]
    R2 avg8wd;AVG Free8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-08-29 231704]
    R2 AvgTdiX;AVG Free8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-08-16 76040]

    *Newly Created Service* - CATCHME
    *Newly Created Service* - PROCEXP90
    .
    Contents of the 'Scheduled Tasks' folder
    .
    - - - - ORPHANS REMOVED - - - -

    HKCU-Run-Magentic - C:\PROGRA~1\Magentic\bin\Magentic.exe
    HKLM-Run-webscan - C:\Program Files\Acceleration Software\Anti-Virus\stopsignav.exe
    MSConfigStartUp-MimBoot - C:\PROGRA~1\MUSICM~1\MUSICM~2\mimboot.exe



    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-09-14 12:02:34
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    HKLM\Software\Microsoft\Windows\CurrentVersion\Run
    DwlClient = c:\Program Files\Common Files\Dell\EUSW\Support.exe?l?e?s?\?D?e?l?l?\?E?U?S?W?\?S?u?p?p?o?r?t?.?e?x?e???x???x???????????????????x???h???????x???x???????????x???H???????x???x???????????????????????@????????????????D?w????????????7??w????x???x??????????????

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2008-09-14 12:04:46
    ComboFix-quarantined-files.txt 2008-09-14 19:03:57
    ComboFix2.txt 2008-09-14 17:30:54

    Pre-Run: 98,330,275,840 bytes free
    Post-Run: 98,312,105,984 bytes free

    218 --- E O F --- 2008-09-10 13:09:50


    RSIT in next post
     
    KarenAZ,
    #13
  15. 2008/09/14
    KarenAZ

    KarenAZ Inactive Thread Starter

    Joined:
    2008/09/14
    Messages:
    24
    Likes Received:
    0
    RSIT Log
    Logfile of random's system information tool 1.01 (written by random/random)
    Run by Karen at 2008-09-14 12:07:09
    Microsoft Windows XP Home Edition Service Pack 3
    System drive C: has 94 GB (63%) free of 149 GB
    Total RAM: 1534 MB (50% free)

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 12:07:16 p.m., on 9/14/2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16705)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
    C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
    C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe
    C:\Program Files\Dell\Media Experience\PCMService.exe
    C:\WINDOWS\system32\dla\tfswctrl.exe
    C:\Program Files\Common Files\Dell\EUSW\Support.exe
    C:\Program Files\Microsoft IntelliPoint\ipoint.exe
    c:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe
    C:\Program Files\Pure Networks\Network Magic\nmapp.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\WINDOWS\System32\CTsvcCDA.EXE
    C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
    C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
    C:\WINDOWS\system32\PSIService.exe
    C:\Program Files\Digital Line Detect\DLG.exe
    C:\WINDOWS\System32\svchost.exe
    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
    C:\WINDOWS\System32\MsPMSPSv.exe
    C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
    C:\Program Files\Canon\CAL\CALMAIN.exe
    C:\PROGRA~1\AVG\AVG8\avgemc.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\explorer.exe
    C:\WINDOWS\system32\notepad.exe
    C:\Program Files\internet explorer\iexplore.exe
    C:\Documents and Settings\Karen\Desktop\RSIT.exe
    C:\Program Files\Trend Micro\HijackThis\Karen.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://cm.my.yahoo.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
    O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.509.5470\swg.dll
    O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
    O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe "
    O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
    O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe "
    O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe /r
    O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
    O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
    O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe "
    O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
    O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
    O4 - HKLM\..\Run: [DwlClient] c:\Program Files\Common Files\Dell\EUSW\Support.exe
    O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe "
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
    O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe "
    O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
    O4 - HKLM\..\Run: [nmctxth] "C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe "
    O4 - HKLM\..\Run: [nmapp] "C:\Program Files\Pure Networks\Network Magic\nmapp.exe" -autorun -nosplash
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [mSpotAlltelRemix] "C:\Program Files\Alltel Jump Music\Remix\msptcmd.exe" /runcheck
    O4 - HKUS\S-1-5-18\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'Default user')
    O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Startup: Rainlendar.lnk = C:\Program Files\Rainlendar\Rainlendar.exe
    O4 - Startup: Snsicon.lnk = C:\SLIDESHW\Snsicon.exe
    O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
    O4 - Global Startup: Digital Line Detect.lnk = ?
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office12\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\Office12\REFIEBAR.DLL
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: Photobucket Publisher - http://pic.photobucket.com/plugins/csve/photobucket_publisher.CAB
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {1A1F56AA-3401-46F9-B277-D57F3421F821} (FunGamesLoader Object) - http://www.worldwinner.com/games/v47/shared/FunGamesLoader.cab
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
    O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photo.walgreens.com/WalgreensActivia.cab
    O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://groups.msn.com/controls/PhotoUC/MsnPUpld.cab
    O16 - DPF: {5D9E4B6D-CD17-4D85-99D4-6A52B394EC3B} (WSDownloader Control) - http://www.webshots.com/samplers/WSDownloader.ocx
    O16 - DPF: {615F158E-D5CA-422F-A8E7-F6A5EED7063B} (Bejeweled Control) - http://www.worldwinner.com/games/v46/bejeweled/bejeweled.cab
    O16 - DPF: {7CCAD6DD-DD0B-440B-91FF-7670F5AADC21} (SpinTop Games Launcher) - http://clubgames.pogo.com/online2/pogop/mahjong_escape_ancient_japan/SpinTopGamesLauncher.cab
    O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - http://download.zonelabs.com/bin/promotions/spywaredetector/ICSScanner37380.cab
    O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab
    O16 - DPF: {99B6E512-3893-4155-9964-8EB8E06099CB} (WebSpyWareKiller Class) - http://download.zonelabs.com/bin/promotions/spywaredetector/WebSWK.cab
    O16 - DPF: {9A54032D-31F7-400D-B184-83B33BDE65FA} (MSN File Upload Control) - http://sc.groups.msn.com/controls/FileUC/MsnUpld.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
    O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) - http://sc.groups.msn.com/controls/PhotoUC/MsnPUpld.cab
    O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
    O20 - AppInit_DLLs: avgrsstx.dll xxstjm.dll
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe
    O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
    O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Pure Networks Net2Go Service (nmraapache) - Pure Networks, Inc. - C:\Program Files\Pure Networks\Network Magic\WebServer\bin\nmraapache.exe
    O23 - Service: Pure Networks Platform Service (nmservice) - Pure Networks, Inc. - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
    O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe

    --
    End of file - 12145 bytes

    Scheduled tasks folder

    C:\WINDOWS\tasks\AppleSoftwareUpdate.job
    C:\WINDOWS\tasks\XoftSpy.job

    Registry dump

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
    AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll [2003-11-03 54248]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]
    RealPlayer Download and Record Plugin for Internet Explorer - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll [2008-08-20 308856]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
    C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2004-05-12 744960]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5CA3D70E-1895-11CF-8E15-001234567890}]
    DriveLetterAccess - C:\WINDOWS\system32\dla\tfswshx.dll [2004-03-14 118836]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
    SSVHelper Class - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll [2008-06-10 509328]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
    Google Toolbar Helper - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll [2008-08-14 193136]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}]
    AcroIEToolbarHelper Class - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll [2003-05-15 147456]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
    Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\4.1.509.5470\swg.dll [2008-07-18 651760]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FDD3B846-8D59-4ffb-8758-209B6AD74ACC}]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    {47833539-D0C5-4125-9FA8-0819E2EAAC93} - Adobe PDF - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll [2003-05-15 147456]
    {2318C2B1-4965-11d4-9B18-009027A5CD4F} - &Google Toolbar - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll [2008-08-14 193136]

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    "SunJavaUpdateSched "=C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe [2008-06-10 144784]
    "IAAnotif "=C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe [2004-03-23 135168]
    "DVDLauncher "=C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe [2004-04-11 53248]
    "CTSysVol "=C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe [2003-09-17 57344]
    "P17Helper "=Rundll32 P17.dll []
    "UpdReg "=C:\WINDOWS\UpdReg.EXE [2000-05-10 90112]
    "PCMService "=C:\Program Files\Dell\Media Experience\PCMService.exe [2004-04-11 290816]
    "dla "=C:\WINDOWS\system32\dla\tfswctrl.exe [2004-03-14 122933]
    "UpdateManager "=C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe [2003-08-18 110592]
    "DwlClient "=c:\Program Files\Common Files\Dell\EUSW\Support.exe [2004-05-27 323584]
    "IntelliPoint "=C:\Program Files\Microsoft IntelliPoint\ipoint.exe [2007-02-05 849280]
    "QuickTime Task "=C:\Program Files\QuickTime\qttask.exe [2008-03-28 413696]
    "iTunesHelper "=C:\Program Files\iTunes\iTunesHelper.exe [2008-03-30 267048]
    "StartCCC "=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2008-01-21 61440]
    "AVG8_TRAY "=C:\PROGRA~1\AVG\AVG8\avgtray.exe [2008-08-29 1235736]
    "nmctxth "=C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe [2008-05-16 648504]
    "nmapp "=C:\Program Files\Pure Networks\Network Magic\nmapp.exe [2008-05-21 451896]

    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe "=C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360]
    "swg "=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2007-06-26 68856]
    "mSpotAlltelRemix "=C:\Program Files\Alltel Jump Music\Remix\msptcmd.exe [2008-02-07 1507328]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup
    Acrobat Assistant.lnk - C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
    Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe

    C:\Documents and Settings\Karen\Start Menu\Programs\Startup
    Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    Rainlendar.lnk - C:\Program Files\Rainlendar\Rainlendar.exe
    Snsicon.lnk - C:\SLIDESHW\Snsicon.exe

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
    "AppInit_DLLS "= "avgrsstx.dll xxstjm.dll "

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
    C:\WINDOWS\system32\Ati2evxx.dll [2008-03-28 126976]


    more in next post....
     
    KarenAZ,
    #14
  16. 2008/09/14
    KarenAZ

    KarenAZ Inactive Thread Starter

    Joined:
    2008/09/14
    Messages:
    24
    Likes Received:
    0
    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
    "dontdisplaylastusername "=0
    "legalnoticecaption "=
    "legalnoticetext "=
    "shutdownwithoutlogon "=1
    "undockwithoutlogon "=1

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
    "%windir%\system32\sessmgr.exe "= "%windir%\system32\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019 "
    "C:\Program Files\IncrediMail\bin\IMApp.exe "= "C:\Program Files\IncrediMail\bin\IMApp.exe:*:Enabled:IncrediMail "
    "C:\Program Files\IncrediMail\bin\IncMail.exe "= "C:\Program Files\IncrediMail\bin\IncMail.exe:*:Enabled:IncrediMail "
    "C:\Program Files\IncrediMail\bin\ImpCnt.exe "= "C:\Program Files\IncrediMail\bin\ImpCnt.exe:*:Enabled:IncrediMail "
    "C:\Program Files\IncrediMail\bin\ImLc.exe "= "C:\Program Files\IncrediMail\bin\ImLc.exe:*:Enabled:IncrediMail "
    "%windir%\Network Diagnostic\xpnetdiag.exe "= "%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000 "
    "C:\Program Files\Real\RealPlayer\realplay.exe "= "C:\Program Files\Real\RealPlayer\realplay.exe:*:Enabled:RealPlayer "
    "C:\Program Files\MSN Messenger\msnmsgr.exe "= "C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1 "
    "C:\Program Files\MSN Messenger\livecall.exe "= "C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone) "
    "C:\Program Files\IncrediMail\bin\ImPackr.exe "= "C:\Program Files\IncrediMail\bin\ImPackr.exe:*:Enabled:IncrediMail "
    "C:\Program Files\Bonjour\mDNSResponder.exe "= "C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour "
    "C:\Program Files\iTunes\iTunes.exe "= "C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes "
    "C:\Program Files\IncrediMail\bin\ImSc.exe "= "C:\Program Files\IncrediMail\bin\ImSc.exe:*:Enabled:IncrediMail "
    "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe "= "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger "
    "C:\Program Files\Yahoo!\Messenger\YServer.exe "= "C:\Program Files\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server "
    "C:\Program Files\AVG\AVG8\avgemc.exe "= "C:\Program Files\AVG\AVG8\avgemc.exe:*:Enabled:avgemc.exe "
    "C:\Program Files\AVG\AVG8\avgupd.exe "= "C:\Program Files\AVG\AVG8\avgupd.exe:*:Enabled:avgupd.exe "
    "C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE "= "C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook "
    "C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe "= "C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe:LocalSubNet:Enabled:pure Networks Platform Service "

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
    "%windir%\system32\sessmgr.exe "= "%windir%\system32\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019 "
    "%windir%\Network Diagnostic\xpnetdiag.exe "= "%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000 "
    "C:\Program Files\MSN Messenger\msnmsgr.exe "= "C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1 "
    "C:\Program Files\MSN Messenger\livecall.exe "= "C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone) "

    List of files/folders created in the last three months

    2008-09-14 12:04:49 ----D---- C:\WINDOWS\temp
    2008-09-14 12:04:48 ----A---- C:\ComboFix.txt
    2008-09-14 10:19:32 ----D---- C:\WINDOWS\erdnt
    2008-09-14 10:19:10 ----D---- C:\QooBox
    2008-09-14 10:19:07 ----A---- C:\WINDOWS\zip.exe
    2008-09-14 10:19:07 ----A---- C:\WINDOWS\VFind.exe
    2008-09-14 10:19:07 ----A---- C:\WINDOWS\swxcacls.exe
    2008-09-14 10:19:07 ----A---- C:\WINDOWS\swsc.exe
    2008-09-14 10:19:07 ----A---- C:\WINDOWS\swreg.exe
    2008-09-14 10:19:07 ----A---- C:\WINDOWS\sed.exe
    2008-09-14 10:19:07 ----A---- C:\WINDOWS\Nircmd.exe
    2008-09-14 10:19:07 ----A---- C:\WINDOWS\grep.exe
    2008-09-14 10:19:07 ----A---- C:\WINDOWS\fdsv.exe
    2008-09-14 10:04:50 ----D---- C:\Documents and Settings\Karen\Application Data\Malwarebytes
    2008-09-14 10:04:45 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
    2008-09-14 10:04:45 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-09-14 09:33:07 ----D---- C:\rsit
    2008-09-14 08:59:27 ----D---- C:\Program Files\Trend Micro
    2008-09-13 16:04:08 ----D---- C:\Program Files\Spyware Doctor
    2008-09-13 13:31:04 ----A---- C:\WINDOWS\system32\6b0c2801-.txt
    2008-09-11 18:20:48 ----D---- C:\9-11
    2008-09-10 22:55:39 ----HD---- C:\WINDOWS\PIF
    2008-09-10 22:55:22 ----D---- C:\Credit Report - experian.com
    2008-09-10 06:08:03 ----HDC---- C:\WINDOWS\$NtUninstallKB938464$
    2008-09-10 06:07:39 ----HDC---- C:\WINDOWS\$NtUninstallKB954154_WM11$
    2008-09-07 01:26:16 ----A---- C:\WINDOWS\unvise32.exe
    2008-09-06 20:13:15 ----D---- C:\Program Files\TeaTimer (Spybot - Search & Destroy)
    2008-09-05 15:00:17 ----D---- C:\Program Files\Wondershare
    2008-09-03 18:43:43 ----D---- C:\Program Files\Microsoft Visual Studio
    2008-09-03 18:39:42 ----D---- C:\Documents and Settings\All Users\Application Data\Microsoft Help
    2008-09-03 18:31:23 ----D---- C:\Course Technology
    2008-08-30 13:58:38 ----D---- C:\Program Files\Pure Networks
    2008-08-30 13:57:51 ----D---- C:\Program Files\Common Files\Pure Networks Shared
    2008-08-30 12:29:53 ----D---- C:\Program Files\DIFX
    2008-08-30 12:29:12 ----D---- C:\Documents and Settings\All Users\Application Data\Pure Networks
    2008-08-30 11:31:02 ----HD---- C:\$AVG8.VAULT$
    2008-08-27 21:15:21 ----N---- C:\WINDOWS\WB.ini
    2008-08-27 21:10:25 ----N---- C:\WINDOWS\system32\wbsys.dll
    2008-08-27 21:10:24 ----D---- C:\Program Files\Stardock
    2008-08-25 17:24:14 ----D---- C:\x-smilies
    2008-08-24 01:33:57 ----D---- C:\Documents and Settings\Karen\Application Data\Mythic Adventure
    2008-08-22 06:37:52 ----D---- C:\Program Files\BetterJPEG 2
    2008-08-22 06:36:08 ----D---- C:\Program Files\Better JPEG
    2008-08-20 20:01:07 ----D---- C:\Program Files\Common Files\xing shared
    2008-08-19 17:38:31 ----HDC---- C:\WINDOWS\$NtUninstallKB951978$
    2008-08-19 00:05:04 ----A---- C:\WINDOWS\OEWABLog.txt
    2008-08-19 00:04:07 ----D---- C:\WINDOWS\Prefetch
    2008-08-18 21:42:20 ----HDC---- C:\WINDOWS\$NtUninstallKB952954$
    2008-08-18 21:42:12 ----HDC---- C:\WINDOWS\$NtUninstallKB952287$
    2008-08-18 21:42:03 ----HDC---- C:\WINDOWS\$NtUninstallKB951748$
    2008-08-18 21:41:53 ----HDC---- C:\WINDOWS\$NtUninstallKB951698$
    2008-08-18 21:41:47 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2$
    2008-08-18 21:41:39 ----HDC---- C:\WINDOWS\$NtUninstallKB951376$
    2008-08-18 21:41:30 ----HDC---- C:\WINDOWS\$NtUninstallKB951066$
    2008-08-18 21:41:22 ----HDC---- C:\WINDOWS\$NtUninstallKB950974$
    2008-08-18 21:41:16 ----HDC---- C:\WINDOWS\$NtUninstallKB950762$
    2008-08-18 21:41:06 ----HDC---- C:\WINDOWS\$NtUninstallKB946648$
    2008-08-18 21:37:57 ----A---- C:\WINDOWS\setuplog.txt
    2008-08-18 21:36:41 ----D---- C:\WINDOWS\system32\scripting
    2008-08-18 21:36:40 ----D---- C:\WINDOWS\system32\en
    2008-08-18 21:36:40 ----D---- C:\WINDOWS\l2schemas
    2008-08-18 17:23:35 ----N---- C:\WINDOWS\system32\wmphoto.dll
    2008-08-18 17:23:34 ----N---- C:\WINDOWS\system32\wlanapi.dll
    2008-08-18 17:23:33 ----N---- C:\WINDOWS\system32\windowscodecsext.dll
    2008-08-18 17:23:33 ----N---- C:\WINDOWS\system32\windowscodecs.dll
    2008-08-18 17:23:30 ----N---- C:\WINDOWS\system32\tspkg.dll
    2008-08-18 17:23:30 ----N---- C:\WINDOWS\system32\tsgqec.dll
    2008-08-18 17:23:24 ----N---- C:\WINDOWS\system32\setupn.exe
    2008-08-18 17:23:23 ----N---- C:\WINDOWS\system32\rhttpaa.dll
    2008-08-18 17:23:22 ----N---- C:\WINDOWS\system32\rasqec.dll
    2008-08-18 17:23:22 ----N---- C:\WINDOWS\system32\qutil.dll
    2008-08-18 17:23:22 ----N---- C:\WINDOWS\system32\qcliprov.dll
    2008-08-18 17:23:21 ----N---- C:\WINDOWS\system32\qagentrt.dll
    2008-08-18 17:23:21 ----N---- C:\WINDOWS\system32\qagent.dll
    2008-08-18 17:23:21 ----N---- C:\WINDOWS\system32\photometadatahandler.dll
    2008-08-18 17:23:20 ----N---- C:\WINDOWS\system32\onex.dll
    2008-08-18 17:23:15 ----N---- C:\WINDOWS\system32\napstat.exe
    2008-08-18 17:23:15 ----N---- C:\WINDOWS\system32\napmontr.dll
    2008-08-18 17:23:15 ----N---- C:\WINDOWS\system32\napipsec.dll
    2008-08-18 17:23:15 ----N---- C:\WINDOWS\system32\msxml6r.dll
    2008-08-18 17:23:15 ----N---- C:\WINDOWS\system32\msxml6.dll
    2008-08-18 17:23:14 ----N---- C:\WINDOWS\system32\msshavmsg.dll
    2008-08-18 17:23:14 ----N---- C:\WINDOWS\system32\mssha.dll
    2008-08-18 17:23:08 ----N---- C:\WINDOWS\system32\mmcperf.exe
    2008-08-18 17:23:08 ----N---- C:\WINDOWS\system32\mmcfxcommon.dll
    2008-08-18 17:23:08 ----N---- C:\WINDOWS\system32\mmcex.dll
    2008-08-18 17:23:07 ----N---- C:\WINDOWS\system32\microsoft.managementconsole.dll
    2008-08-18 17:23:04 ----N---- C:\WINDOWS\system32\l2gpstore.dll
    2008-08-18 17:22:55 ----N---- C:\WINDOWS\system32\kmsvc.dll
    2008-08-18 17:22:55 ----N---- C:\WINDOWS\system32\kbdpash.dll
    2008-08-18 17:22:55 ----N---- C:\WINDOWS\system32\kbdnepr.dll
    2008-08-18 17:22:55 ----N---- C:\WINDOWS\system32\kbdiultn.dll
    2008-08-18 17:22:55 ----N---- C:\WINDOWS\system32\kbdbhc.dll
    2008-08-18 17:22:39 ----A---- C:\WINDOWS\005414_.tmp
    2008-08-18 17:22:38 ----N---- C:\WINDOWS\system32\eapsvc.dll
    2008-08-18 17:22:38 ----N---- C:\WINDOWS\system32\eapqec.dll
    2008-08-18 17:22:38 ----N---- C:\WINDOWS\system32\eappprxy.dll
    2008-08-18 17:22:38 ----N---- C:\WINDOWS\system32\eapphost.dll
    2008-08-18 17:22:38 ----N---- C:\WINDOWS\system32\eappgnui.dll
    2008-08-18 17:22:38 ----N---- C:\WINDOWS\system32\eappcfg.dll
    2008-08-18 17:22:38 ----N---- C:\WINDOWS\system32\eapp3hst.dll
    2008-08-18 17:22:38 ----N---- C:\WINDOWS\system32\eapolqec.dll
    2008-08-18 17:22:36 ----N---- C:\WINDOWS\system32\dot3ui.dll
    2008-08-18 17:22:36 ----N---- C:\WINDOWS\system32\dot3svc.dll
    2008-08-18 17:22:36 ----N---- C:\WINDOWS\system32\dot3msm.dll
    2008-08-18 17:22:36 ----N---- C:\WINDOWS\system32\dot3gpclnt.dll
    2008-08-18 17:22:36 ----N---- C:\WINDOWS\system32\dot3dlg.dll
    2008-08-18 17:22:36 ----N---- C:\WINDOWS\system32\dot3cfg.dll
    2008-08-18 17:22:36 ----N---- C:\WINDOWS\system32\dot3api.dll
    2008-08-18 17:22:35 ----N---- C:\WINDOWS\system32\dimsroam.dll
    2008-08-18 17:22:35 ----N---- C:\WINDOWS\system32\dimsntfy.dll
    2008-08-18 17:22:35 ----N---- C:\WINDOWS\system32\dhcpqec.dll
    2008-08-18 17:22:33 ----N---- C:\WINDOWS\system32\credssp.dll
    2008-08-18 17:22:31 ----N---- C:\WINDOWS\system32\bitsprx4.dll
    2008-08-18 17:22:31 ----N---- C:\WINDOWS\system32\azroles.dll
    2008-08-18 17:22:26 ----N---- C:\WINDOWS\system32\aaclient.dll
    2008-08-16 14:53:13 ----A---- C:\WINDOWS\system32\avgrsstx.dll
    2008-08-16 14:52:54 ----D---- C:\Program Files\AVG
    2008-08-16 14:48:48 ----D---- C:\Documents and Settings\All Users\Application Data\Avg8
    2008-08-14 15:05:48 ----D---- C:\Documents and Settings\Karen\Application Data\Filter Forge
    2008-08-14 14:58:25 ----A---- C:\WINDOWS\system32\dbghelp-xfw.dll
    2008-08-14 03:04:08 ----HDC---- C:\WINDOWS\$NtUninstallKB952954_0$
    2008-08-14 03:04:01 ----HDC---- C:\WINDOWS\$NtUninstallKB946648_0$
    2008-08-14 03:03:56 ----HDC---- C:\WINDOWS\$NtUninstallKB953839$
    2008-08-14 03:03:49 ----HDC---- C:\WINDOWS\$NtUninstallKB950974_0$
    2008-08-14 03:01:16 ----HDC---- C:\WINDOWS\$NtUninstallKB951072-v2$
    2008-08-14 03:01:10 ----HDC---- C:\WINDOWS\$NtUninstallKB952287_0$
    2008-08-14 03:00:31 ----HDC---- C:\WINDOWS\$NtUninstallKB951066_0$
    2008-08-03 02:16:51 ----D---- C:\Program Files\Gambana
    2008-07-26 18:43:18 ----D---- C:\Program Files\Common Files\Roxio Shared
    2008-07-26 18:43:17 ----D---- C:\Program Files\Common Files\Napster Shared
    2008-07-26 18:41:41 ----D---- C:\Documents and Settings\Karen\Application Data\InstallShield
    2008-07-20 01:48:47 ----A---- C:\WINDOWS\system32\javaws.exe
    2008-07-20 01:48:47 ----A---- C:\WINDOWS\system32\javaw.exe
    2008-07-20 01:48:47 ----A---- C:\WINDOWS\system32\java.exe
    2008-07-19 01:46:28 ----D---- C:\Program Files\Common Files\Corel
    2008-07-19 01:44:47 ----D---- C:\Program Files\Corel
    2008-07-19 00:45:23 ----D---- C:\Documents and Settings\All Users\Application Data\Yahoo!
    2008-07-19 00:44:59 ----A---- C:\YServer.txt
    2008-07-14 18:42:51 ----D---- C:\tools
    2008-07-09 03:00:51 ----HDC---- C:\WINDOWS\$NtUninstallKB951748_0$
    2008-06-25 22:57:48 ----D---- C:\Rosey Posey Web Set
    2008-06-21 12:21:24 ----D---- C:\Documents and Settings\All Users\Application Data\WholeSecurity
    2008-06-19 21:35:07 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2_0$
    2008-06-18 22:49:47 ----D---- C:\Program Files\Broderbund
    2008-06-15 21:50:44 ----D---- C:\Program Files\Lavasoft
    2008-06-15 21:50:04 ----D---- C:\Program Files\Common Files\Wise Installation Wizard

    List of drivers

    R1 AvgLdx86;AVG Free AVI Loader Driver x86; C:\WINDOWS\System32\Drivers\avgldx86.sys [2008-08-29 97928]
    R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86; C:\WINDOWS\System32\Drivers\avgmfx86.sys [2008-08-16 26824]
    R1 Cdr4_xp;Cdr4_xp; C:\WINDOWS\system32\drivers\Cdr4_xp.sys [2007-06-20 9072]
    R1 Cdralw2k;Cdralw2k; C:\WINDOWS\system32\drivers\Cdralw2k.sys [2007-06-20 9200]
    R1 intelppm;Intel Processor Driver; C:\WINDOWS\System32\DRIVERS\intelppm.sys [2008-04-13 36352]
    R1 omci;OMCI WDM Device Driver; C:\WINDOWS\System32\DRIVERS\omci.sys [2002-11-08 17217]
    R1 sscdbhk5;sscdbhk5; C:\WINDOWS\system32\drivers\sscdbhk5.sys [2004-01-14 5621]
    R1 ssrtln;ssrtln; C:\WINDOWS\system32\drivers\ssrtln.sys [2004-01-14 23219]
    R2 AvgTdiX;AVG Free8 Network Redirector; C:\WINDOWS\System32\Drivers\avgtdix.sys [2008-08-16 76040]
    R2 drvnddm;drvnddm; C:\WINDOWS\system32\drivers\drvnddm.sys [2004-02-27 40480]
    R2 mdmxsdk;mdmxsdk; C:\WINDOWS\System32\DRIVERS\mdmxsdk.sys [2003-04-09 11043]
    R2 PfModNT;PfModNT; \??\C:\WINDOWS\system32\drivers\PfModNT.sys []
    R2 pnarp;Pure Networks Device Discovery Driver; C:\WINDOWS\system32\DRIVERS\pnarp.sys [2008-05-16 23992]
    R2 purendis;Pure Networks Wireless Driver; C:\WINDOWS\system32\DRIVERS\purendis.sys [2008-05-16 25272]
    R2 tfsnboio;tfsnboio; C:\WINDOWS\system32\dla\tfsnboio.sys [2004-03-14 25685]
    R2 tfsncofs;tfsncofs; C:\WINDOWS\system32\dla\tfsncofs.sys [2004-03-14 34837]
    R2 tfsndrct;tfsndrct; C:\WINDOWS\system32\dla\tfsndrct.sys [2004-03-14 4117]
    R2 tfsndres;tfsndres; C:\WINDOWS\system32\dla\tfsndres.sys [2004-03-14 2233]
    R2 tfsnifs;tfsnifs; C:\WINDOWS\system32\dla\tfsnifs.sys [2004-03-14 85972]
    R2 tfsnopio;tfsnopio; C:\WINDOWS\system32\dla\tfsnopio.sys [2004-03-14 14229]
    R2 tfsnpool;tfsnpool; C:\WINDOWS\system32\dla\tfsnpool.sys [2004-03-14 6357]
    R2 tfsnudf;tfsnudf; C:\WINDOWS\system32\dla\tfsnudf.sys [2004-03-14 98580]
    R2 tfsnudfa;tfsnudfa; C:\WINDOWS\system32\dla\tfsnudfa.sys [2004-03-14 100597]
    R3 ati2mtag;ati2mtag; C:\WINDOWS\System32\DRIVERS\ati2mtag.sys [2008-03-28 2873856]
    R3 b57w2k;Broadcom NetXtreme 57xx Gigabit Controller; C:\WINDOWS\System32\DRIVERS\b57xp32.sys [2004-05-29 186112]
    R3 ctsfm2k;Creative SoundFont Management Device Driver; C:\WINDOWS\System32\DRIVERS\ctsfm2k.sys [2003-09-22 130192]
    R3 GEARAspiWDM;GEARAspiWDM; C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys [2008-01-29 16168]
    R3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\System32\DRIVERS\hidusb.sys [2008-04-13 10368]
    R3 HSF_DP;HSF_DP; C:\WINDOWS\System32\DRIVERS\HSF_DP.sys [2003-11-17 1042432]
    R3 HSFHWBS2;HSFHWBS2; C:\WINDOWS\System32\DRIVERS\HSFHWBS2.sys [2003-11-17 212224]
    R3 MODEMCSA;Unimodem Streaming Filter Device; C:\WINDOWS\system32\drivers\MODEMCSA.sys [2001-08-17 16128]
    R3 mouhid;Mouse HID Driver; C:\WINDOWS\System32\DRIVERS\mouhid.sys [2001-08-17 12160]
    R3 ossrv;Creative OS Services Driver; C:\WINDOWS\System32\DRIVERS\ctoss2k.sys [2003-09-22 178672]
    R3 P17;Sound Blaster Live! 24-bit; C:\WINDOWS\system32\drivers\P17.sys [2004-06-09 840960]
    R3 Point32;Microsoft IntelliPoint Filter Driver; C:\WINDOWS\system32\DRIVERS\point32.sys [2006-11-08 21760]
    R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\System32\DRIVERS\usbehci.sys [2008-04-13 30208]
    R3 usbhub;Microsoft USB Standard Hub Driver; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2008-04-13 59520]
    R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\System32\DRIVERS\usbuhci.sys [2008-04-13 20608]
    R3 winachsf;winachsf; C:\WINDOWS\System32\DRIVERS\HSF_CNXT.sys [2003-11-17 680704]
    S1 P3;Intel PentiumIII Processor Driver; C:\WINDOWS\System32\DRIVERS\p3.sys [2008-04-13 42752]
    S3 bvrp_pci;bvrp_pci; C:\WINDOWS\system32\drivers\bvrp_pci.sys []
    S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
    S3 EL90XBC;3Com EtherLink XL 90XB/C Adapter Driver; C:\WINDOWS\System32\DRIVERS\el90xbc5.sys [2001-08-17 66591]
    S3 i81x;i81x; C:\WINDOWS\System32\DRIVERS\i81xnt5.sys [2004-08-03 161020]
    S3 iAimFP0;iAimFP0; C:\WINDOWS\System32\DRIVERS\wADV01nt.sys [2004-08-03 12415]
    S3 iAimFP1;iAimFP1; C:\WINDOWS\System32\DRIVERS\wADV02NT.sys [2004-08-03 12127]
    S3 iAimFP2;iAimFP2; C:\WINDOWS\System32\DRIVERS\wADV05NT.sys [2004-08-03 11775]
    S3 iAimFP3;iAimFP3; C:\WINDOWS\System32\DRIVERS\wSiINTxx.sys [2004-08-03 12063]
    S3 iAimFP4;iAimFP4; C:\WINDOWS\System32\DRIVERS\wVchNTxx.sys [2004-08-03 19455]
    S3 iAimTV0;iAimTV0; C:\WINDOWS\System32\DRIVERS\wATV01nt.sys [2004-08-03 29311]
    S3 iAimTV1;iAimTV1; C:\WINDOWS\System32\DRIVERS\wATV02NT.sys [2004-08-03 19551]
    S3 iAimTV2;iAimTV2; C:\WINDOWS\System32\DRIVERS\wATV03nt.sys []
    S3 iAimTV3;iAimTV3; C:\WINDOWS\System32\DRIVERS\wATV04nt.sys [2004-08-03 33599]
    S3 iAimTV4;iAimTV4; C:\WINDOWS\System32\DRIVERS\wCh7xxNT.sys [2004-08-03 23615]
    S3 IPFilter;Microsoft IntelliPoint Features driver; C:\WINDOWS\System32\DRIVERS\IPFilter.sys [2001-05-09 10352]
    S3 nv;nv; C:\WINDOWS\System32\DRIVERS\nv4_mini.sys [2004-08-03 1897408]
    S3 usb_rndisx;USB RNDIS Adapter; C:\WINDOWS\system32\DRIVERS\usb8023x.sys [2008-04-13 12800]
    S3 usbscan;USB Scanner Driver; C:\WINDOWS\System32\DRIVERS\usbscan.sys [2008-04-13 15104]
    S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
    S3 wanatw;WAN Miniport (ATW); C:\WINDOWS\System32\DRIVERS\wanatw4.sys []
    S3 wceusbsh;Windows CE USB Serial Host Driver; C:\WINDOWS\System32\DRIVERS\wceusbsh.sys [2004-12-30 104576]
    S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
    S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
    S4 agp440;Intel AGP Bus Filter; C:\WINDOWS\System32\DRIVERS\agp440.sys [2008-04-13 42368]
    S4 agpCPQ;Compaq AGP Bus Filter; C:\WINDOWS\System32\DRIVERS\agpCPQ.sys [2008-04-13 44928]
    S4 alim1541;ALI AGP Bus Filter; C:\WINDOWS\System32\DRIVERS\alim1541.sys [2008-04-13 42752]
    S4 amdagp;AMD AGP Bus Filter Driver; C:\WINDOWS\System32\DRIVERS\amdagp.sys [2008-04-13 43008]
    S4 cbidf;cbidf; C:\WINDOWS\System32\DRIVERS\cbidf2k.sys [2001-08-17 13952]
    S4 IntelIde;IntelIde; C:\WINDOWS\System32\DRIVERS\intelide.sys [2008-04-13 5504]
    S4 sisagp;SIS AGP Bus Filter; C:\WINDOWS\System32\DRIVERS\sisagp.sys [2008-04-13 40960]
    S4 viaagp;VIA AGP Bus Filter; C:\WINDOWS\System32\DRIVERS\viaagp.sys [2008-04-13 42240]

    List of services

    R2 aawservice;Lavasoft Ad-Aware Service; C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe [2008-06-15 611664]
    R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-02-18 110592]
    R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2008-03-28 536576]
    R2 avg8emc;AVG Free8 E-mail Scanner; C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-08-29 875288]
    R2 avg8wd;AVG Free8 WatchDog; C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-08-29 231704]
    R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2007-07-24 229376]
    R2 CCALib8;Canon Camera Access Library 8; C:\Program Files\Canon\CAL\CALMAIN.exe [2006-03-30 96341]
    R2 Creative Service for CDROM Access;Creative Service for CDROM Access; C:\WINDOWS\System32\CTsvcCDA.EXE [1999-12-13 44032]
    R2 IAANTMon;IAA Event Monitor; C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe [2004-03-23 73852]
    R2 nmservice;Pure Networks Platform Service; C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe [2008-05-16 648504]
    R2 ProtexisLicensing;ProtexisLicensing; C:\WINDOWS\system32\PSIService.exe [2007-06-05 177704]
    R2 WMDM PMSP Service;WMDM PMSP Service; C:\WINDOWS\System32\MsPMSPSv.exe [2000-06-26 53520]
    R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-13 14336]
    R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2008-03-30 504104]
    S2 ATI Smart;ATI Smart; C:\WINDOWS\SYSTEM32\ati2sgag.exe [2008-03-28 593920]
    S3 Adobe LM Service;Adobe LM Service; C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [2007-03-17 72704]
    S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800]
    S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
    S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-07-18 156656]
    S3 nmraapache;Pure Networks Net2Go Service; C:\Program Files\Pure Networks\Network Magic\WebServer\bin\nmraapache.exe [2008-05-21 12800]
    S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
    S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
    S3 usnjsvc;Messenger Sharing Folders USN Journal Reader service; C:\Program Files\MSN Messenger\usnsvc.exe [2007-01-19 97136]
    S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-18 913408]

    -----------------EOF-----------------
     
    KarenAZ,
    #15
  17. 2008/09/14
    KarenAZ

    KarenAZ Inactive Thread Starter

    Joined:
    2008/09/14
    Messages:
    24
    Likes Received:
    0
    thank you for your help - I really appreciate it and understand about the cracks. I got this virus downloading a scrapbook set from a blog.

    I don't understand how if you are "protected" as AVG tells me (I always run AVG on anything I download) how you can get this stuff anyway.
     
    KarenAZ,
    #16
  18. 2008/09/14
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi
    You still have one file to remove, I will be back to you soon.
    Thanks
     
    Geri,
    #17
  19. 2008/09/14
    KarenAZ

    KarenAZ Inactive Thread Starter

    Joined:
    2008/09/14
    Messages:
    24
    Likes Received:
    0
    okay - thank you so much
     
    KarenAZ,
    #18
  20. 2008/09/14
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi
    P2P is file sharing, or getting programs from another source other then from the company that makes them.

    Please do this.

    Open "Notepad†Copy the contents of the code box below to the blank Notepad.
    Click "File" > "Save as "
    In the "Save In" box at the top click the down arrow and select DeskTop

    In the "File name" type in: fix.reg
    In the "Save As Type" select: All Files
    Once saved, Go to your desktop double click "fix.reg file" and let it merge with the registry.


    Code:
    REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
 "AppInit_DLLS "= "avgrsstx.dll "
    Please post a new HJT log.


    Then lets get a on line scan.

    Download ATF Cleaner by Atribune and save it to your Desktop.
    This is a good tool to get rid of the temporary garbage you pick up while surfing the net.
    Double click ATF-Cleaner.exe to run the program.
    Check the boxes to the left of:

    Windows Temp
    Current User Temp
    All Users Temp
    Cookies
    Temporary Internet Files
    Prefetch
    Java Cache
    Recycle bin

    The rest are optional - if you want it to remove everything check "Select All ".
    Finally, click Empty Selected. When you get the "Done Cleaning" message, click OK.


    Please do an online scan with Kaspersky WebScanner

    Click on "Accept" If your pop "“up blocker blocks any windows from opening.

    Click Run on the window that opens.
    Windows Vista users you must open the web browser using the Run as Administrator command.
    • The program will launch and then begin downloading the latest definition files:
    • Under Scan on the left side.Click on My Computer
    • This will start the program and scan your system.
    • Click the "Scan Report" On the left side.
    • The scan will take a while so be patient and let it run.
    • Once the scan is complete it will display if your system has been infected.
      • Click the Save Report As button, and in the Browse dialog box, type a name for the scan report file that you want to create and select its type Text file. Click OK to save the file.:
    • Save the text file to your desktop.
    • Copy and paste that information in your next post.

    Please post the Kaspersky results.
     
    Geri,
    #19
  21. 2008/09/14
    KarenAZ

    KarenAZ Inactive Thread Starter

    Joined:
    2008/09/14
    Messages:
    24
    Likes Received:
    0
    here is the hjt log after the registry - on my way to scan the next step
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 1:50:26 p.m., on 9/14/2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16705)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
    C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
    C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe
    C:\Program Files\Dell\Media Experience\PCMService.exe
    C:\WINDOWS\system32\dla\tfswctrl.exe
    C:\Program Files\Common Files\Dell\EUSW\Support.exe
    C:\Program Files\Microsoft IntelliPoint\ipoint.exe
    c:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe
    C:\Program Files\Pure Networks\Network Magic\nmapp.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\WINDOWS\System32\CTsvcCDA.EXE
    C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
    C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
    C:\WINDOWS\system32\PSIService.exe
    C:\Program Files\Digital Line Detect\DLG.exe
    C:\WINDOWS\System32\svchost.exe
    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
    C:\WINDOWS\System32\MsPMSPSv.exe
    C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
    C:\Program Files\Canon\CAL\CALMAIN.exe
    C:\PROGRA~1\AVG\AVG8\avgemc.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\internet explorer\iexplore.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://cm.my.yahoo.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
    O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.509.5470\swg.dll
    O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
    O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe "
    O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
    O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe "
    O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe /r
    O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
    O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
    O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe "
    O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
    O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
    O4 - HKLM\..\Run: [DwlClient] c:\Program Files\Common Files\Dell\EUSW\Support.exe
    O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe "
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
    O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe "
    O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
    O4 - HKLM\..\Run: [nmctxth] "C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe "
    O4 - HKLM\..\Run: [nmapp] "C:\Program Files\Pure Networks\Network Magic\nmapp.exe" -autorun -nosplash
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [mSpotAlltelRemix] "C:\Program Files\Alltel Jump Music\Remix\msptcmd.exe" /runcheck
    O4 - HKUS\S-1-5-18\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'Default user')
    O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Startup: Rainlendar.lnk = C:\Program Files\Rainlendar\Rainlendar.exe
    O4 - Startup: Snsicon.lnk = C:\SLIDESHW\Snsicon.exe
    O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
    O4 - Global Startup: Digital Line Detect.lnk = ?
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office12\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\Office12\REFIEBAR.DLL
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: Photobucket Publisher - http://pic.photobucket.com/plugins/csve/photobucket_publisher.CAB
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {1A1F56AA-3401-46F9-B277-D57F3421F821} (FunGamesLoader Object) - http://www.worldwinner.com/games/v47/shared/FunGamesLoader.cab
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
    O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photo.walgreens.com/WalgreensActivia.cab
    O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://groups.msn.com/controls/PhotoUC/MsnPUpld.cab
    O16 - DPF: {5D9E4B6D-CD17-4D85-99D4-6A52B394EC3B} (WSDownloader Control) - http://www.webshots.com/samplers/WSDownloader.ocx
    O16 - DPF: {615F158E-D5CA-422F-A8E7-F6A5EED7063B} (Bejeweled Control) - http://www.worldwinner.com/games/v46/bejeweled/bejeweled.cab
    O16 - DPF: {7CCAD6DD-DD0B-440B-91FF-7670F5AADC21} (SpinTop Games Launcher) - http://clubgames.pogo.com/online2/pogop/mahjong_escape_ancient_japan/SpinTopGamesLauncher.cab
    O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - http://download.zonelabs.com/bin/promotions/spywaredetector/ICSScanner37380.cab
    O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab
    O16 - DPF: {99B6E512-3893-4155-9964-8EB8E06099CB} (WebSpyWareKiller Class) - http://download.zonelabs.com/bin/promotions/spywaredetector/WebSWK.cab
    O16 - DPF: {9A54032D-31F7-400D-B184-83B33BDE65FA} (MSN File Upload Control) - http://sc.groups.msn.com/controls/FileUC/MsnUpld.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
    O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) - http://sc.groups.msn.com/controls/PhotoUC/MsnPUpld.cab
    O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
    O20 - AppInit_DLLs: avgrsstx.dll
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe
    O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
    O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Pure Networks Net2Go Service (nmraapache) - Pure Networks, Inc. - C:\Program Files\Pure Networks\Network Magic\WebServer\bin\nmraapache.exe
    O23 - Service: Pure Networks Platform Service (nmservice) - Pure Networks, Inc. - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
    O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe

    --
    End of file - 12055 bytes
     
    KarenAZ,
    #20
Page 1 of 2

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...