Explorer crashes and restarts over and over again.

Hello, I'm new here. I just have a question. My explore.exe keeps on having an error message and shuts down my explore.exe file, pop ups do show up but they get blocked before hand. None of my virus and spyware programs come up with anything. Internet explorer does come up in the processes and so does rundll32.exe. Here's my hijack this log file.

Logfile of HijackThis v1.99.1
Scan saved at 11:49:49 PM, on 8/27/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Common Files\AOL\1154048045\ee\AOLSoftware.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\iTunes\iTunes.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
c:\program files\common files\aol\1154048045\ee\aim6.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Owner\Desktop\HijackThis.exe

R3 - Default URLSearchHook is missing
O3 - Toolbar: (no name) - {052b12f7-86fa-4921-8482-26c42316b522} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe "
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe "
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1154048045\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\Common Files\AOL\Launch\AOLLaunch.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Valve\Steam\Steam.exe" -silent
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: http://locator.cdn.imageservr.com
O15 - Trusted Zone: http://click.getmirar.com (HKLM)
O15 - Trusted Zone: http://click.mirarsearch.com (HKLM)
O15 - Trusted Zone: http://redirect.mirarsearch.com (HKLM)
O15 - Trusted Zone: http://awbeta.net-nucleus.com (HKLM)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1154048707687
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Trend Micro ActiveX Scan Agent 6.5) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

 

Hi, Tron. Welcome to Windows BBS!

To my untrained eye, it looks to me like you may be a victim of some adware/malware. I think we should take care of that before investigating other possible causes of your crashes. Cleaning your system of adware/malware might be all that is necessary to get your machine running properly.

• Please move your hijackthis.exe program from your Desktop to a new permanent folder on your hard drive (such as C:\HJT).
• Please follow ALL the instructions in this link so you can get some preliminary work out of the way.

Some (all?) of those sites are associated with adware/malware. The HKLM seems to indicate they are registry keys (which I think is not normal).

Here's what SiteAdvisor says about getmirar.com (and mirarsearch.com and net-nucleus.com):

Also, your HJT log includes this CLSID: {052b12f7-86fa-4921-8482-26c42316b522} which has dubious associations. Here's what CastleCops says about that CLSID:

I expect this thread will be moved to our Removing Spyware & Viruses forum where you will receive assistance from experts. Please be patient. They are very busy with many people just like you.


You should post any follow-up information in this thread (not a new thread), including a new HijackThis log after you you have performed the steps in the instructions I linked.

After you post a new HJT log, follow the experts' instructions EXACTLY. Often certain steps must be carefully followed in a certain order.

 

Mailman is correct, that BHO CLSID does point to those applications.

This looks to be one of the SmithFraud\Zlob infections, or remnants of one, lets run a special tool to double check.

Please download SmitfraudFix (by S!Ri)
Extract the content (a folder named SmitfraudFix) to your Desktop.

Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #1 - Search by typing 1 and press "Enter "; a text file will appear, which lists infected files (if present).
Please copy/paste the content of that report into your next reply.

Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool "; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore you may get an alert.

 

Here's my smitfraud report. Thank you guys for helping me out, not too sure if its gone just yet. Its shady, because it will stop here and there for an hour or so. Oh yeah sorry for posting this in the wrong thread, it was my misjudgement, i didn't think it was really spyware, but something more virus oriented.

SmitFraudFix v2.81

Scan done at 17:31:16.63, Mon 08/28/2006
Run from C:\Documents and Settings\Owner\My Documents\Unzipped\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
Fix ran in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» C:\

Here's my new hijack this profile

Logfile of HijackThis v1.99.1
Scan saved at 5:34:01 PM, on 8/28/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Common Files\AOL\1154048045\ee\AOLSoftware.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\iTunes\iTunes.exe
c:\program files\common files\aol\1154048045\ee\aim6.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Documents and Settings\Owner\Desktop\HijackThis.exe

R3 - Default URLSearchHook is missing
O3 - Toolbar: (no name) - {052b12f7-86fa-4921-8482-26c42316b522} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe "
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe "
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1154048045\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\Common Files\AOL\Launch\AOLLaunch.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Valve\Steam\Steam.exe" -silent
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1154048707687
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Trend Micro ActiveX Scan Agent 6.5) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe



»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

C:\WINDOWS\system32\issearch.exe FOUND !
C:\WINDOWS\system32\ot.ico FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Owner\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Start Menu

C:\DOCUME~1\ALLUSE~1\STARTM~1\Online Security Guide.url FOUND !
C:\DOCUME~1\ALLUSE~1\STARTM~1\Security Troubleshooting.url FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Owner\FAVORI~1

C:\DOCUME~1\Owner\FAVORI~1\Antivirus Test Online.url FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» Desktop


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source "= "About:Home "
"SubscribedURL "= "About:Home "
"FriendlyName "= "My Current Home Page "


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"incestuously "= "{03413bf7-e34c-445b-bfc0-a2b127255871} "


»»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection


»»»»»»»»»»»»»»»»»»»»»»»» End

 

The tool looks to have worked, how are things running now? We just have some minor clean up to perform at this point.

Below you will find my results and recommendations. Please read ALL instructions carefully BEFORE proceeding.

Please follow these instructions, exactly, for proper HJT installation. Please place HJT into ITS OWN PERMANANT FOLDER. It also needs to be removed from the desktop.
You can do this by going to My Computer (Windows key+e) then double click on C: then right click and select New then Folder and name it HJT. (C:\HJT\HijackThis.exe)Move HijackThis.exe into this folder. When you run HijackThis.exe from C:\HJT folder and have it "Fixed checked" it will create a backup file of modifications to use if restore is necessary which is easily accessible.

Run Hijackthis and look over the following entries I have listed, check the boxes next to them and press the "Fix Checked" button with HijackThis. When you are doing this, make sure you have No IE windows, or other browsers open, including this one. Reboot if I have specified below, and post a fresh HijackThis log.

R3 - Default URLSearchHook is missing


O3 - Toolbar: (no name) - {052b12f7-86fa-4921-8482-26c42316b522} - (no file)

Reboot, run HJT, if the above are gone, no need to repost with new log.

 

Its still not working, it seems to be worse now. Here's my log.

Logfile of HijackThis v1.99.1
Scan saved at 12:23:57 AM, on 8/29/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Common Files\AOL\1154048045\ee\AOLSoftware.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\iTunes\iTunes.exe
c:\program files\common files\aol\1154048045\ee\aim6.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\System32\imapi.exe
C:\Documents and Settings\Owner\Desktop\HijackThis.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe "
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe "
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1154048045\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\Common Files\AOL\Launch\AOLLaunch.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Valve\Steam\Steam.exe" -silent
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1154048707687
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Trend Micro ActiveX Scan Agent 6.5) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

 

Your log file shows no indication of infection, exactly what is happening at this point?

 

Hi, TeMerc. Thanks!


Tron, please attend to TeMerc's question before proceeding with my suggestion in this message. I want to avoid any confusion that might arise due to trying to solve a problem from two angles at once.

After TeMerc has exhausted all his possible ideas, I suggest investigating the cause of your program crashes by following the directions in this link.


Assuming your "Explorer" program is still crashing and restarting the same way as you described in your first post, you should post your DebugWiz-generated USER.DMP information here (after TeMerc has exhausted all his possible ideas).


BTW, we don't currently seem to have crash dump experts around here but we might be able to nail down your crash problem anyway. There are several people around here that are very familiar with computers and hunting down information in general. At the very least, your DebugWiz-generated information should be very helpful to technical support personnel if we cannot fully resolve your crash problem.

 

it keeps on restarting now, no sign of Internet Explorer. No warning or error msgs, it just spontaneously dies out and restarts. I have no idea whats going on. If you have any ideas, Temerc(Sorry for mispelling it or getting it all wrong, its not infront of me) let me know. Thanks.

NVM Iexplorer.exe is still popping up here and there.

 

Hi, Tron.

Are you CERTAIN you typed that filename "[FONT= "Courier New"][SIZE= "4"]Iexplorer.exe[/SIZE][/FONT]" correctly? That particular filename is associated with malware.

Please double-check next time you see it and let us know exactly how the filename is spelled.

EDIT: If you get any additional error information, please provide us with the complete EXACT error message for EVERY error message you get.

 

its spelt Iexplore.exe

 

Thanks, Tron.

Turns out [FONT= "Courier New"][SIZE= "3"]Iexplore.exe[/SIZE][/FONT] is also associated with malware.

Sophos Information: W32/Lovgate-X (worm)

We'd better wait for advice from TeMerc.

EDIT: Please continue to copy down exact error messages and exact filenames whenever they appear.

 

When you say "it ", what exactly is "it "?

Does your computer keep on restarting or is "it" a particular program that keeps restarting?

EDIT: How often does "it" restart? Do you notice any patterns regarding what you may be doing that may trigger the restarts?

 

OK, lets try ComboFix and an online scan. See what they find.


Download combofix.exe

• Double click combofix.exe & follow the prompts.
• When finished, it shall produce a log for you. Post that log in your next reply

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Then go to this page, Panda ActiveScan

• Click the 'Scan your PC' button. ( You may have to disable any pop up blockers)
• Then press the green 'Check Now' button.
• Enter your country and state along with a valid email address.
• Allow the ActiveX install, it may be a few minutes for all components. (For XP SP 2 watch for the yellow bar at the top of IE)
• Once installation is complete you will need to select a device to scan. Please select 'My Computer' and the scan will begin.
• Once the scan is done, click the 'See report' button, then the 'save report' button. Be sure to save the log file created in a place easy for you to find.

Post both the Combofix log and the log from the Panda scan please back into this thread.

 

Owner - 06-08-31 0:53:40.57
ComboFix 06.08.30BT - Running from: D:\

(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\system32\issearch.exe
C:\WINDOWS\system32\WinNB58.dll
C:\WINDOWS\system32\components
C:\Program Files\Common Files\{780C2092-095F-1033-0206-061116050001}

~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

Folders Quarantined:

C:\QooBox\Purity\Documents and Settings\Owner\My Documents\TSKS~1
C:\QooBox\Purity\WINDOWS\YMBOLS~1
C:\QooBox\Purity\WINDOWS\YMBOLS~1\YMBOLS~1


((((((((((((((((((((((((((((((( Files Created from 2006-07-31 to 2006-08-31 ))))))))))))))))))))))))))))))))))


2006-08-30 01:39 13,844 --a------ C:\WINDOWS\system32\fvthfgyw.exe
2006-08-30 01:36 13,844 --a------ C:\WINDOWS\system32\dldanvjd.exe
2006-08-30 01:33 13,844 --a------ C:\WINDOWS\system32\jsnapsti.exe
2006-08-30 00:20 13,844 --a------ C:\WINDOWS\system32\blijsdtq.exe
2006-08-30 00:15 13,844 --a------ C:\WINDOWS\system32\kjuululj.exe
2006-08-30 00:12 13,844 --a------ C:\WINDOWS\system32\xmbohopq.exe
2006-08-30 00:09 13,844 --a------ C:\WINDOWS\system32\vtkojeav.exe
2006-08-30 00:05 13,844 --a------ C:\WINDOWS\system32\mrgsrvqx.exe
2006-08-29 11:58 13,844 --a------ C:\WINDOWS\system32\lnvycogs.exe
2006-08-29 11:42 13,844 --a------ C:\WINDOWS\system32\yynrnutw.exe
2006-08-29 10:37 13,844 --a------ C:\WINDOWS\system32\jcxighru.exe
2006-08-29 05:27 13,844 --a------ C:\WINDOWS\system32\mwxmakre.exe
2006-08-29 05:23 13,844 --a------ C:\WINDOWS\system32\jankhpqd.exe
2006-08-29 05:20 13,844 --a------ C:\WINDOWS\system32\sqiophhm.exe
2006-08-29 05:17 13,844 --a------ C:\WINDOWS\system32\bpwkrrwo.exe
2006-08-29 05:14 13,844 --a------ C:\WINDOWS\system32\vrdmnmbv.exe
2006-08-29 00:25 13,844 --a------ C:\WINDOWS\system32\sxcpkgfv.exe
2006-08-28 23:59 13,844 --a------ C:\WINDOWS\system32\tdnxyhci.exe
2006-08-28 23:55 13,844 --a------ C:\WINDOWS\system32\degytjiq.exe
2006-08-28 17:31 53,248 --a------ C:\WINDOWS\system32\Process.exe
2006-08-28 17:31 42,496 --a------ C:\WINDOWS\system32\swreg.exe
2006-08-28 17:31 40,960 --a------ C:\WINDOWS\system32\swsc.exe
2006-08-28 17:31 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2006-08-27 23:33 13,844 --a------ C:\WINDOWS\system32\weevsotx.exe
2006-08-27 23:29 13,844 --a------ C:\WINDOWS\system32\ulnuueee.exe
2006-08-27 23:25 13,844 --a------ C:\WINDOWS\system32\notbigod.exe
2006-08-27 23:22 13,844 --a------ C:\WINDOWS\system32\hrauetsk.exe
2006-08-27 23:17 13,844 --a------ C:\WINDOWS\system32\mbwrqhqw.exe
2006-08-27 23:14 13,844 --a------ C:\WINDOWS\system32\hedtftue.exe
2006-08-27 21:51 13,844 --a------ C:\WINDOWS\system32\hgsgutii.exe
2006-08-27 11:24 13,844 --a------ C:\WINDOWS\system32\fihbnnlk.exe
2006-08-26 11:24 13,844 --a------ C:\WINDOWS\system32\dgrqswjn.exe
2006-08-26 02:16 13,844 --a------ C:\WINDOWS\system32\esatoycr.exe
2006-08-25 17:32 13,844 --a------ C:\WINDOWS\system32\xstefykh.exe
2006-08-25 17:10 13,844 --a------ C:\WINDOWS\system32\giajgbdv.exe
2006-08-24 17:30 13,844 --a------ C:\WINDOWS\system32\xcdvufpk.exe
2006-08-23 17:30 13,844 --a------ C:\WINDOWS\system32\pdfyvhtu.exe
2006-08-23 09:35 13,844 --a------ C:\WINDOWS\system32\onkjbtwr.exe
2006-08-23 01:30 13,844 --a------ C:\WINDOWS\system32\rqkklqdg.exe
2006-08-23 01:11 13,844 --a------ C:\WINDOWS\system32\eywnipkk.exe
2006-08-22 19:54 13,844 --a------ C:\WINDOWS\system32\ddargtaw.exe
2006-08-22 19:51 13,844 --a------ C:\WINDOWS\system32\xgmngkmg.exe
2006-08-22 19:00 13,844 --a------ C:\WINDOWS\system32\cpkrcoru.exe
2006-08-22 18:57 13,844 --a------ C:\WINDOWS\system32\bggwwkqn.exe
2006-08-22 18:50 13,844 --a------ C:\WINDOWS\system32\ayxjbfvx.exe
2006-08-22 18:47 13,844 --a------ C:\WINDOWS\system32\ygijdund.exe
2006-08-22 18:44 13,844 --a------ C:\WINDOWS\system32\oedglnem.exe
2006-08-22 18:41 13,844 --a------ C:\WINDOWS\system32\chchaahn.exe
2006-08-22 18:37 13,844 --a------ C:\WINDOWS\system32\ltwyvyyq.exe
2006-08-22 18:06 13,844 --a------ C:\WINDOWS\system32\ljltpdyk.exe
2006-08-22 17:59 13,844 --a------ C:\WINDOWS\system32\byoniqon.exe
2006-08-22 17:55 13,844 --a------ C:\WINDOWS\system32\alpsoysi.exe
2006-08-22 15:25 13,844 --a------ C:\WINDOWS\system32\qvuuoato.exe
2006-08-21 15:24 13,844 --a------ C:\WINDOWS\system32\lvtyrgur.exe
2006-08-20 23:12 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2006-08-18 00:32 13,844 --a------ C:\WINDOWS\system32\akanwsqd.exe
2006-08-17 19:23 1,079,637 ---hs---- C:\WINDOWS\system32\hjkmp.ini2
2006-08-17 00:32 12,308 --a------ C:\WINDOWS\system32\caloxgop.exe
2006-08-17 00:31 12,820 --a------ C:\WINDOWS\system32\qdgfajfm.exe
2006-08-15 00:31 1,079,688 ---hs---- C:\WINDOWS\system32\hjkmp.bak2
2006-08-14 21:26 90,112 --a------ C:\WINDOWS\system32\AVASTSS.scr
2006-08-14 21:26 635,520 --a------ C:\WINDOWS\system32\aswBoot.exe
2006-08-14 20:54 131,072 --a------ C:\WINDOWS\system32\datestamp.dll
2006-08-14 12:29 960,977 ---hs---- C:\WINDOWS\system32\hjkmp.bak1
2006-08-14 12:28 573,492 ---hs---- C:\WINDOWS\system32\pmkjh.dll
2006-08-14 12:10 553,101 --a------ C:\WINDOWS\system32\vturs.dll
2006-08-14 12:03 2 --a------ C:\WINDOWS\system32\wnstssv.exe
2006-08-14 12:02 40,973 ---hs---- C:\WINDOWS\system32\fccyxxw.dll
2006-08-09 11:57 90,112 --------- C:\WINDOWS\Updreg.EXE
2006-08-09 11:56 84,992 --------- C:\WINDOWS\system32\SFCVRT32.DLL
2006-08-09 11:56 82,432 --------- C:\WINDOWS\system32\CTWFLT32.DLL
2006-08-09 11:56 54,784 --------- C:\WINDOWS\system32\INETWH32.DLL
2006-08-09 11:56 53,552 --------- C:\WINDOWS\CTCCW.DLL
2006-08-09 11:56 26,768 --------- C:\WINDOWS\system32\CTL3D.DLL
2006-08-09 11:56 24,976 --------- C:\WINDOWS\CTRES.DLL
2006-08-09 11:56 20,480 --a------ C:\WINDOWS\INRES.DLL
2006-08-09 11:55 94,208 --a------ C:\WINDOWS\DEVREG.DLL
2006-08-09 11:55 77,824 --a------ C:\WINDOWS\system32\EAXAC3.DLL
2006-08-09 11:55 655,360 --a------ C:\WINDOWS\system32\CTSBLFX.DLL
2006-08-09 11:55 65,536 --a------ C:\WINDOWS\system32\a3d.dll
2006-08-09 11:55 57,344 --a------ C:\WINDOWS\system32\CTAGENT.DLL
2006-08-09 11:55 53,248 --a------ C:\WINDOWS\system32\AC3API.DLL
2006-08-09 11:55 495,616 --a------ C:\WINDOWS\system32\CTAUDFX.DLL
2006-08-09 11:55 49,152 --a------ C:\WINDOWS\system32\KILLAPPS.EXE
2006-08-09 11:55 49,152 --a------ C:\WINDOWS\MIDIDEF.EXE
2006-08-09 11:55 49,152 --a------ C:\WINDOWS\CTDCRES.DLL
2006-08-09 11:55 45,056 --a------ C:\WINDOWS\system32\CTSPKHLP.DLL
2006-08-09 11:55 372,736 --a------ C:\WINDOWS\system32\CTDC0001.DLL
2006-08-09 11:55 36,864 --a------ C:\WINDOWS\system32\sfman32.dll
2006-08-09 11:55 36,864 --a------ C:\WINDOWS\system32\REGPLIB.EXE
2006-08-09 11:55 36,864 --a------ C:\WINDOWS\system32\CTEMUPIA.DLL
2006-08-09 11:55 356,445 --a------ C:\WINDOWS\system32\CTDC0000.DLL
2006-08-09 11:55 28,672 --a------ C:\WINDOWS\system32\CTMMEP.DLL
2006-08-09 11:55 270,336 --a------ C:\WINDOWS\system32\SFMS32.DLL
2006-08-09 11:55 24,576 --a------ C:\WINDOWS\system32\CTHELPER.EXE
2006-08-09 11:55 20,480 --a------ C:\WINDOWS\system32\ENSDEF.EXE
2006-08-09 11:55 184,320 --a------ C:\WINDOWS\PSCONV.EXE
2006-08-09 11:55 180,224 --a------ C:\WINDOWS\READREG.EXE
2006-08-09 11:55 155,648 --a------ C:\WINDOWS\system32\CTOSUSER.DLL
2006-08-09 11:55 139,353 --a------ C:\WINDOWS\system32\CTDCIFCE.DLL
2006-08-09 11:55 131,072 --a------ C:\WINDOWS\system32\OPENAL32.DLL
2006-08-09 11:55 126,976 --a------ C:\WINDOWS\system32\COMMONFX.DLL
2006-08-09 11:55 12,288 --a------ C:\WINDOWS\system32\AHQCpURes.dll
2006-08-09 11:55 110,592 --a------ C:\WINDOWS\system32\PIAPROXY.DLL
2006-08-09 11:55 110,592 --a------ C:\WINDOWS\system32\CTSCAL.DLL
2006-08-09 11:55 110,592 --a------ C:\WINDOWS\system32\CTDPROXY.DLL
2006-08-09 11:55 106,496 --a------ C:\WINDOWS\system32\CTASIO.DLL
2006-08-05 21:15 94,208 --a------ C:\WINDOWS\system32\HPZipt12.dll
2006-08-05 21:15 69,632 --a------ C:\WINDOWS\system32\HPZipm12.exe
2006-08-05 21:15 61,440 --a------ C:\WINDOWS\system32\HPZinw12.exe
2006-08-05 21:15 57,344 --a------ C:\WINDOWS\system32\HPZisn12.dll
2006-08-05 21:15 278,584 --a------ C:\WINDOWS\system32\HPZidr12.dll
2006-08-05 21:15 204,800 --a------ C:\WINDOWS\system32\HPZipr12.dll


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2006-08-31 00:54 -------- d-------- C:\Program Files\Common Files
2006-08-31 00:42 -------- d-------- C:\Program Files\Mozilla Firefox
2006-08-31 00:38 -------- d-------- C:\Program Files\Mozilla Thunderbird
2006-08-23 17:44 -------- d-------- C:\Program Files\thriXXX
2006-08-21 20:47 -------- d--h----- C:\Program Files\InstallShield Installation Information
2006-08-21 20:00 -------- d-------- C:\Program Files\XviD
2006-08-21 19:57 -------- d-------- C:\Program Files\Aspyr
2006-08-21 16:11 -------- d-------- C:\Program Files\FBM Software
2006-08-21 11:27 -------- d-------- C:\Program Files\WinZip
2006-08-21 00:09 -------- d-------- C:\Program Files\Soulseek
2006-08-16 22:48 -------- d-------- C:\Documents and Settings\Owner\Application Data\dvdcss
2006-08-15 23:01 -------- d-------- C:\Program Files\HP
2006-08-15 21:17 -------- d-------- C:\Program Files\Common Files\HP
2006-08-15 21:02 -------- d-------- C:\Program Files\Microsoft IntelliType Pro
2006-08-15 20:59 5582 --a------ C:\Documents and Settings\Owner\Application Data\GdiplusUpgrade_MSIApproach_Wrapper.log
2006-08-15 20:50 3024 --a------ C:\Documents and Settings\Owner\Application Data\BestModePatch_RubenMain.log
2006-08-15 20:49 -------- d-------- C:\Program Files\Hewlett-Packard
2006-08-15 20:46 -------- d---s---- C:\Documents and Settings\Owner\Application Data\Microsoft
2006-08-15 18:41 -------- d-------- C:\Documents and Settings\Owner\Application Data\Image Zone Express
2006-08-14 21:26 -------- d-------- C:\Program Files\Alwil Software
2006-08-14 20:39 -------- d-------- C:\Program Files\AxBx
2006-08-14 17:30 -------- d-------- C:\Program Files\Yahoo!
2006-08-14 17:08 -------- d-------- C:\Program Files\CCleaner
2006-08-14 12:51 -------- d-------- C:\Documents and Settings\Owner\Application Data\Sun
2006-08-14 12:49 -------- d-------- C:\Program Files\Java
2006-08-14 12:47 -------- d-------- C:\Program Files\Common Files\Java
2006-08-14 00:10 -------- d-------- C:\Documents and Settings\Owner\Application Data\Help
2006-08-13 23:18 11376 --a------ C:\WINDOWS\system32\drivers\secdrv.sys
2006-08-13 23:15 223128 --a------ C:\WINDOWS\system32\drivers\dtscsi.sys
2006-08-13 23:15 -------- d-------- C:\Program Files\DAEMON Tools
2006-08-13 23:12 96256 --a------ C:\WINDOWS\system32\drivers\sptd8477.sys
2006-08-13 23:12 642560 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2006-08-13 03:01 -------- d-------- C:\Program Files\Internet Explorer
2006-08-11 20:13 -------- d-------- C:\Program Files\Windows Defender
2006-08-11 20:13 -------- d-------- C:\Program Files\Common Files\Microsoft Shared
2006-08-09 11:57 -------- d-------- C:\Program Files\Creative
2006-08-05 21:21 -------- d-------- C:\Program Files\Common Files\Hewlett-Packard
2006-08-05 12:47 -------- d-------- C:\Program Files\Dobermann
2006-08-05 11:25 85952 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2006-08-05 11:24 16352 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2006-08-05 11:22 36176 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2006-08-05 11:20 24304 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2006-08-04 17:29 -------- d-------- C:\Documents and Settings\Owner\Application Data\Macromedia
2006-08-03 23:02 -------- d-------- C:\Program Files\LochJournal
2006-08-03 18:02 -------- d-------- C:\Documents and Settings\Owner\Application Data\VersionTracker Pro
2006-08-02 11:32 -------- d-------- C:\Documents and Settings\Owner\Application Data\vlc
2006-08-02 11:27 -------- d-------- C:\Program Files\VideoLAN
2006-08-02 02:06 -------- d-------- C:\Documents and Settings\Owner\Application Data\Apple Computer
2006-07-30 22:48 178 --a------ C:\Documents and Settings\Owner\Application Data\iPod Access v2 Prefs
2006-07-30 22:21 44 --ah----- C:\Documents and Settings\Owner\Application Data\iPodAccess_OwnerName
2006-07-30 22:18 11 --ah----- C:\Documents and Settings\Owner\Application Data\iPodAccess_Time
2006-07-30 21:08 -------- d-------- C:\Program Files\iPod Access for Windows
2006-07-30 20:37 98304 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2006-07-30 20:24 -------- d-------- C:\Program Files\THQ
2006-07-29 19:23 -------- d-------- C:\Documents and Settings\Owner\Application Data\Adobe
2006-07-29 19:21 -------- d-------- C:\Program Files\Common Files\Adobe
2006-07-29 19:21 -------- d-------- C:\Program Files\Adobe
2006-07-29 17:49 -------- d-------- C:\Program Files\Valve
2006-07-29 01:04 -------- d-------- C:\Program Files\DivX
2006-07-28 16:11 -------- d-------- C:\Program Files\WinRAR
2006-07-28 12:24 -------- d-------- C:\Program Files\BitLord
2006-07-28 12:20 -------- d-------- C:\Program Files\Windows Media Player
2006-07-28 03:04 -------- d-------- C:\Documents and Settings\Owner\Application Data\Thunderbird
2006-07-28 01:44 -------- d-------- C:\Program Files\Messenger
2006-07-28 01:42 -------- d-------- C:\Program Files\Outlook Express

 

2006-07-28 01:42 -------- d-------- C:\Program Files\Common Files\System
2006-07-28 01:28 -------- d-------- C:\Program Files\Bethesda Softworks
2006-07-28 00:10 -------- d-------- C:\Documents and Settings\Owner\Application Data\Talkback
2006-07-27 22:09 -------- d-------- C:\Program Files\Movie Maker
2006-07-27 22:07 -------- d-------- C:\Program Files\Windows NT
2006-07-27 22:07 -------- d-------- C:\Program Files\NetMeeting
2006-07-27 21:36 -------- d-------- C:\Program Files\QuickTime
2006-07-27 21:34 -------- d-------- C:\Program Files\iTunes
2006-07-27 21:34 -------- d-------- C:\Program Files\iPod
2006-07-27 21:34 -------- d-------- C:\Program Files\Common Files\InstallShield
2006-07-27 20:56 -------- d-------- C:\Documents and Settings\Owner\Application Data\acccore
2006-07-27 20:54 -------- d-------- C:\Program Files\Common Files\Nullsoft
2006-07-27 20:54 -------- d-------- C:\Program Files\Common Files\aolshare
2006-07-27 20:54 -------- d-------- C:\Program Files\Common Files\AOL
2006-07-27 20:54 -------- d-------- C:\Program Files\AOL
2006-07-27 20:54 -------- d-------- C:\Program Files\AOD
2006-07-27 20:53 -------- d-------- C:\Documents and Settings\Owner\Application Data\Mozilla
2006-07-27 20:49 -------- d--h----- C:\Program Files\WindowsUpdate
2006-07-27 20:48 -------- d-------- C:\Documents and Settings\Owner\Application Data\InterTrust
2006-07-27 20:42 -------- d-------- C:\Program Files\Microsoft IntelliPoint
2006-07-27 20:17 -------- d-------- C:\Documents and Settings\Owner\Application Data\Identities
2006-07-27 20:16 -------- d--h----- C:\Program Files\Uninstall Information
2006-07-27 20:12 -------- d-------- C:\Program Files\xerox
2006-07-27 20:12 -------- d-------- C:\Program Files\microsoft frontpage
2006-07-27 20:11 0 -rahs---- C:\MSDOS.SYS
2006-07-27 20:11 0 -rahs---- C:\IO.SYS
2006-07-27 20:11 0 --a------ C:\CONFIG.SYS
2006-07-27 20:11 0 --a------ C:\AUTOEXEC.BAT
2006-07-27 20:09 -------- d-------- C:\Program Files\ComPlus Applications
2006-07-27 20:09 -------- d-------- C:\Program Files\Common Files\Services
2006-07-27 20:09 -------- d-------- C:\Program Files\Common Files\MSSoap
2006-07-27 20:08 -------- d-------- C:\Program Files\Online Services
2006-07-27 20:08 -------- d-------- C:\Program Files\MSN Gaming Zone
2006-07-27 20:08 -------- d-------- C:\Program Files\MSN
2006-07-27 15:37 -------- d-------- C:\Program Files\Common Files\SpeechEngines
2006-07-27 15:37 -------- d-------- C:\Program Files\Common Files\ODBC
2006-07-27 15:36 62 --ahs---- C:\Documents and Settings\Owner\Application Data\desktop.ini
2006-07-27 09:24 679424 --a------ C:\WINDOWS\system32\inetcomm.dll
2006-07-21 04:24 72704 --a------ C:\WINDOWS\system32\hlink.dll
2006-07-03 17:40 778240 --a------ C:\WINDOWS\system32\divx_xx0c.dll
2006-07-03 17:40 778240 --a------ C:\WINDOWS\system32\divx_xx07.dll
2006-07-03 17:40 761856 --a------ C:\WINDOWS\system32\divx_xx11.dll
2006-07-03 17:40 620180 --a------ C:\WINDOWS\system32\DivX.dll
2006-06-21 06:49 53248 --a------ C:\WINDOWS\system32\dpuGUI10.dll
2006-06-21 06:43 520192 --a------ C:\WINDOWS\system32\DivXsm.exe
2006-06-21 06:43 3596288 --a------ C:\WINDOWS\system32\qt-dx331.dll
2006-06-21 06:42 200704 --a------ C:\WINDOWS\system32\ssldivx.dll
2006-06-21 06:42 1044480 --a------ C:\WINDOWS\system32\libdivx.dll
2006-06-21 06:34 90112 --a------ C:\WINDOWS\system32\dpl100.dll
2006-06-21 06:34 593920 --a------ C:\WINDOWS\system32\dpuGUI11.dll
2006-06-21 06:34 57344 --a------ C:\WINDOWS\system32\dpv11.dll
2006-06-21 06:34 344064 --a------ C:\WINDOWS\system32\dpus11.dll
2006-06-21 06:34 294912 --a------ C:\WINDOWS\system32\dpu11.dll
2006-06-21 06:34 294912 --a------ C:\WINDOWS\system32\dpu10.dll
2006-06-21 06:34 200704 --a------ C:\WINDOWS\system32\dtu100.dll
2006-06-21 06:33 12288 --a------ C:\WINDOWS\system32\DivXWMPExtType.dll
2006-06-21 06:33 118784 --a------ C:\WINDOWS\system32\DivXCodecUpdateChecker.exe
2006-06-01 19:09 208896 --a------ C:\WINDOWS\system32\NVUNINST.EXE
2006-06-01 19:09 208896 --a------ C:\WINDOWS\system32\nvudisp.exe
2006-06-01 17:22 888832 --a------ C:\WINDOWS\system32\nvmobls.dll
2006-06-01 17:22 86016 --a------ C:\WINDOWS\system32\nvmctray.dll
2006-06-01 17:22 81920 --a------ C:\WINDOWS\system32\nvwddi.dll
2006-06-01 17:22 794624 --a------ C:\WINDOWS\system32\nvcplui.exe
2006-06-01 17:22 7618560 --a------ C:\WINDOWS\system32\nvcpl.dll
2006-06-01 17:22 581632 --a------ C:\WINDOWS\system32\nvhwvid.dll
2006-06-01 17:22 5652480 --a------ C:\WINDOWS\system32\nvdisps.dll
2006-06-01 17:22 5632000 --a------ C:\WINDOWS\system32\nvoglnt.dll
2006-06-01 17:22 5246976 --a------ C:\WINDOWS\system32\nvdispsr.dll
2006-06-01 17:22 466944 --a------ C:\WINDOWS\system32\nvshell.dll
2006-06-01 17:22 462848 --a------ C:\WINDOWS\system32\nvmccssr.dll
2006-06-01 17:22 4529408 --a------ C:\WINDOWS\system32\nv4_disp.dll
2006-06-01 17:22 45056 --a------ C:\WINDOWS\system32\nvmccsrs.dll
2006-06-01 17:22 442368 --a------ C:\WINDOWS\system32\nvappbar.exe
2006-06-01 17:22 425984 --a------ C:\WINDOWS\system32\keystone.exe
2006-06-01 17:22 35840 --a------ C:\WINDOWS\system32\nvcodins.dll
2006-06-01 17:22 35840 --a------ C:\WINDOWS\system32\nvcod.dll
2006-06-01 17:22 311296 --a------ C:\WINDOWS\system32\nvexpbar.dll
2006-06-01 17:22 3100672 --a------ C:\WINDOWS\system32\nvgames.dll
2006-06-01 17:22 2977792 --a------ C:\WINDOWS\system32\nvvitvsr.dll
2006-06-01 17:22 2924544 --a------ C:\WINDOWS\system32\nvvitvs.dll
2006-06-01 17:22 2916352 --a------ C:\WINDOWS\system32\nvgamesr.dll
2006-06-01 17:22 286720 --a------ C:\WINDOWS\system32\nvnt4cpl.dll
2006-06-01 17:22 2859008 --a------ C:\WINDOWS\system32\nvmoblsr.dll
2006-06-01 17:22 229376 --a------ C:\WINDOWS\system32\nvmccs.dll
2006-06-01 17:22 196608 --a------ C:\WINDOWS\system32\nvapi.dll
2006-06-01 17:22 188416 --a------ C:\WINDOWS\system32\nvmccss.dll
2006-06-01 17:22 1740800 --a------ C:\WINDOWS\system32\nvwssr.dll
2006-06-01 17:22 1662976 --a------ C:\WINDOWS\system32\nvwdmcpl.dll
2006-06-01 17:22 155715 --a------ C:\WINDOWS\system32\nvsvc32.exe
2006-06-01 17:22 1519616 --a------ C:\WINDOWS\system32\nwiz.exe
2006-06-01 17:22 147456 --a------ C:\WINDOWS\system32\nvcolor.exe
2006-06-01 17:22 1466368 --a------ C:\WINDOWS\system32\nview.dll
2006-06-01 17:22 1339392 --a------ C:\WINDOWS\system32\nvdspsch.exe
2006-06-01 17:22 1257472 --a------ C:\WINDOWS\system32\nvwss.dll
2006-06-01 17:22 1019904 --a------ C:\WINDOWS\system32\nvwimg.dll
2006-06-01 17:22 1011712 --a------ C:\WINDOWS\system32\nvcpluir.dll


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon "= "RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup "
"type32 "= "\ "C:\\Program Files\\Microsoft IntelliType Pro\\type32.exe\" "
"IntelliPoint "= "\ "C:\\Program Files\\Microsoft IntelliPoint\\point32.exe\" "
"HostManager "= "C:\\Program Files\\Common Files\\AOL\\1154048045\\ee\\AOLSoftware.exe "
"IPHSend "= "C:\\Program Files\\Common Files\\AOL\\IPHSend\\IPHSend.exe "
"iTunesHelper "= "\ "C:\\Program Files\\iTunes\\iTunesHelper.exe\" "
"QuickTime Task "= "\ "C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime "
"NvMediaCenter "= "RunDLL32.exe NvMCTray.dll,NvTaskbarInit "
"CTHelper "= "CTHELPER.EXE "
"Windows Defender "= "\ "C:\\Program Files\\Windows Defender\\MSASCui.exe\" -hide "
"DAEMON Tools "= "\ "C:\\Program Files\\DAEMON Tools\\daemon.exe\" -lang 1033 "
"SunJavaUpdateSched "= "C:\\Program Files\\Java\\jre1.5.0_06\\bin\\jusched.exe "
"avast! "= "C:\\PROGRA~1\\ALWILS~1\\Avast4\\ashDisp.exe "
"HP Software Update "= "C:\\Program Files\\HP\\HP Software Update\\HPWuSchd2.exe "


[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Aim6 "= "\ "C:\\Program Files\\Common Files\\AOL\\Launch\\AOLLaunch.exe\" /d locale=en-US ee://aol/imApp "
"Steam "= "\ "C:\\Program Files\\Valve\\Steam\\Steam.exe\" -silent "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"dontdisplaylastusername "=dword:00000000
"legalnoticecaption "=" "
"legalnoticetext "=" "
"shutdownwithoutlogon "=dword:00000001
"undockwithoutlogon "=dword:00000001

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun "=dword:00000091

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components]
"DeskHtmlVersion "=dword:00000110
"DeskHtmlMinorVersion "=dword:00000005
"Settings "=dword:00000001
"GeneralFlags "=dword:00000001

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\0]
"Source "= "About:Home "
"SubscribedURL "= "About:Home "
"FriendlyName "= "My Current Home Page "
"Flags "=dword:00000002
"Position "=hex:2c,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e4,02,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState "=hex:04,00,00,40
"OriginalStateInfo "=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo "=hex:18,00,00,00,f2,01,00,00,23,00,00,00,7c,00,00,00,72,00,\
00,00,01,00,00,00

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun "=dword:00000091

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun "=dword:00000091

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972} "=" "
"{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} "= "Microsoft AntiMalware ShellExecuteHook "

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\pmkjh
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winjvd32

Sorry for the double post, it said it was too long. I couldn't get Panda Scan to work, a pop up for Win Anti Virus Pro came up, i know thats spyware. When I say it keeps rebooting i mean Explorer.exe, I can't get to my folders or anything without it rebooting.

 

GRrrrr.................

I cannot beleive I did this. but it appears I neglected to have you run the second part of the SmithFraud Fix!! My apologies for that.

Lets run that, along with Vundo Fix.

You should print out these instructions, or copy them to a Notepad file for reading while in Safe Mode, because you will not be able to connect to the Internet to read from this site. Please follow the instructions exactly in the order listed; this is very important!

Please download, install, and update the free version of Ewido Anti-Malware:

1. When installing, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu ".
2. When you run Ewido for the first time, you will get a warning "Database could not be found! ". Click OK. We will fix this in a moment.
3. From the main Ewido screen, click on update in the left menu, then click the Start update button.
4. After the update finishes, the status bar at the bottom will display "Update successful "
5. Exit Ewido. DO NOT run a scan yet.

Reboot, into safe mode, this way:
Turn on the computer
Immediately begin tapping the F8 key.
Use the arrow keys to highlight Safe Mode and press the Enter key.

Once in Safe Mode, open the SmitfraudFix folder again and double-click smitfraudfix.cmd
Select option #2 - Clean by typing 2 and press "Enter" to delete infected files.

You will be prompted : "Registry cleaning - Do you want to clean the registry ? "; answer "Yes" by typing Y and press "Enter" in order to remove the Desktop background and clean registry keys associated with the infection.

The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found); answer "Yes" by typing Y and press "Enter ".

The tool may need to restart your computer to finish the cleaning process. A text file will appear onscreen, with results from the cleaning process; please copy/paste the content of that report into your next reply.

AFTER SmitfraudFix finishes (and after a reboot if required), please open Ewido. (If a reboot is required, please boot BACK into Safe Mode.)

• Click on Scanner
• Click on Complete System Scan and the scan will begin.
• If ewido finds anything, it will pop up a notification. You can select "Remove" and check the boxes "Perform action with all infections" and "Create encrypted backup" before clicking on OK.
• When the scan is finished, click the Save report button at the bottom of the screen.
• Save the report to your desktop
• Close Ewido

Then please restart it into Normal Windows. Please post the contents of the SmitfraudFix log located at C:\rapport.txt into this thread.

Once the machine is back into normal mode run the Vundo Fix.

Please download VundoFix.exe to your desktop.

• Double-click *VundoFix.exe* to run it.
• Click the *Scan for Vundo* button.
• Once it's done scanning, click the *Remove Vundo* button.
• You will receive a prompt asking if you want to remove the files, click *YES*
• Once you click yes, your desktop will go blank as it starts removing Vundo.
• When completed, it will prompt that it will reboot your computer, click *OK*.
• Please post the contents of C:\*vundofix.txt* and a new HiJackThis log.

Note: It is possible that VundoFix encountered a file it could not remove.
In this case, VundoFix will run on reboot, simply follow the above
instructions starting from "Click the *Scan for Vundo* button." when
VundoFix appears at reboot

Once that has run, please run ComboFix again and then HJT and post the following logs

• Ewido
• SmithFRaud
• Vundo
• ComboFix
• HJT

 

Here's my new scan logs, Vundo fix never gave me a report.

Here's Hijack this

Logfile of HijackThis v1.99.1
Scan saved at 9:26:41 PM, on 9/1/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Common Files\AOL\1154048045\ee\AOLSoftware.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\Program Files\Valve\Steam\Steam.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
c:\program files\common files\aol\1154048045\ee\aim6.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Owner\Desktop\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {3773E00C-3AA3-4A16-80C6-0F851E8F32F8} - C:\WINDOWS\system32\pmkjh.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe "
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe "
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1154048045\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\Common Files\AOL\Launch\AOLLaunch.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Valve\Steam\Steam.exe" -silent
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1154048707687
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Trend Micro ActiveX Scan Agent 6.5) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: winjvd32 - winjvd32.dll (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

 

Logfile of HijackThis v1.99.1
Scan saved at 9:26:41 PM, on 9/1/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Common Files\AOL\1154048045\ee\AOLSoftware.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\Program Files\Valve\Steam\Steam.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
c:\program files\common files\aol\1154048045\ee\aim6.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Owner\Desktop\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {3773E00C-3AA3-4A16-80C6-0F851E8F32F8} - C:\WINDOWS\system32\pmkjh.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe "
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe "
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1154048045\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\Common Files\AOL\Launch\AOLLaunch.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Valve\Steam\Steam.exe" -silent
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1154048707687
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Trend Micro ActiveX Scan Agent 6.5) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: winjvd32 - winjvd32.dll (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

SmitFraudFix v2.81

Scan done at 16:35:08.75, Fri 09/01/2006
Run from C:\Documents and Settings\Owner\My Documents\Unzipped\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
Fix ran in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

C:\WINDOWS\system32\ot.ico Deleted
C:\DOCUME~1\Owner\FAVORI~1\Antivirus Test Online.url Deleted
C:\DOCUME~1\ALLUSE~1\STARTM~1\Online Security Guide.url Deleted
C:\DOCUME~1\ALLUSE~1\STARTM~1\Security Troubleshooting.url Deleted

»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» End

 

wOwner - 06-09-01 21:24:15.25
ComboFix 06.08.30BT - Running from: C:\Documents and Settings\Owner\Desktop

(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))



~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

Folders Quarantined:

C:\QooBox\Purity\Documents and Settings\Owner\My Documents\TSKS~1
C:\QooBox\Purity\WINDOWS\YMBOLS~1
C:\QooBox\Purity\WINDOWS\YMBOLS~1\YMBOLS~1


((((((((((((((((((((((((((((((( Files Created from 2006-08-01 to 2006-09-01 ))))))))))))))))))))))))))))))))))


2006-08-30 01:39 13,844 --a------ C:\WINDOWS\system32\fvthfgyw.exe
2006-08-30 01:36 13,844 --a------ C:\WINDOWS\system32\dldanvjd.exe
2006-08-30 01:33 13,844 --a------ C:\WINDOWS\system32\jsnapsti.exe
2006-08-30 00:20 13,844 --a------ C:\WINDOWS\system32\blijsdtq.exe
2006-08-30 00:15 13,844 --a------ C:\WINDOWS\system32\kjuululj.exe
2006-08-30 00:12 13,844 --a------ C:\WINDOWS\system32\xmbohopq.exe
2006-08-30 00:09 13,844 --a------ C:\WINDOWS\system32\vtkojeav.exe
2006-08-30 00:05 13,844 --a------ C:\WINDOWS\system32\mrgsrvqx.exe
2006-08-29 11:58 13,844 --a------ C:\WINDOWS\system32\lnvycogs.exe
2006-08-29 11:42 13,844 --a------ C:\WINDOWS\system32\yynrnutw.exe
2006-08-29 10:37 13,844 --a------ C:\WINDOWS\system32\jcxighru.exe
2006-08-29 05:27 13,844 --a------ C:\WINDOWS\system32\mwxmakre.exe
2006-08-29 05:23 13,844 --a------ C:\WINDOWS\system32\jankhpqd.exe
2006-08-29 05:20 13,844 --a------ C:\WINDOWS\system32\sqiophhm.exe
2006-08-29 05:17 13,844 --a------ C:\WINDOWS\system32\bpwkrrwo.exe
2006-08-29 05:14 13,844 --a------ C:\WINDOWS\system32\vrdmnmbv.exe
2006-08-29 00:25 13,844 --a------ C:\WINDOWS\system32\sxcpkgfv.exe
2006-08-28 23:59 13,844 --a------ C:\WINDOWS\system32\tdnxyhci.exe
2006-08-28 23:55 13,844 --a------ C:\WINDOWS\system32\degytjiq.exe
2006-08-28 17:31 53,248 --a------ C:\WINDOWS\system32\Process.exe
2006-08-28 17:31 42,496 --a------ C:\WINDOWS\system32\swreg.exe
2006-08-28 17:31 40,960 --a------ C:\WINDOWS\system32\swsc.exe
2006-08-28 17:31 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2006-08-27 23:33 13,844 --a------ C:\WINDOWS\system32\weevsotx.exe
2006-08-27 23:29 13,844 --a------ C:\WINDOWS\system32\ulnuueee.exe
2006-08-27 23:25 13,844 --a------ C:\WINDOWS\system32\notbigod.exe
2006-08-27 23:22 13,844 --a------ C:\WINDOWS\system32\hrauetsk.exe
2006-08-27 23:17 13,844 --a------ C:\WINDOWS\system32\mbwrqhqw.exe
2006-08-27 23:14 13,844 --a------ C:\WINDOWS\system32\hedtftue.exe
2006-08-27 21:51 13,844 --a------ C:\WINDOWS\system32\hgsgutii.exe
2006-08-27 11:24 13,844 --a------ C:\WINDOWS\system32\fihbnnlk.exe
2006-08-26 11:24 13,844 --a------ C:\WINDOWS\system32\dgrqswjn.exe
2006-08-26 02:16 13,844 --a------ C:\WINDOWS\system32\esatoycr.exe
2006-08-25 17:32 13,844 --a------ C:\WINDOWS\system32\xstefykh.exe
2006-08-25 17:10 13,844 --a------ C:\WINDOWS\system32\giajgbdv.exe
2006-08-24 17:30 13,844 --a------ C:\WINDOWS\system32\xcdvufpk.exe
2006-08-23 17:30 13,844 --a------ C:\WINDOWS\system32\pdfyvhtu.exe
2006-08-23 09:35 13,844 --a------ C:\WINDOWS\system32\onkjbtwr.exe
2006-08-23 01:30 13,844 --a------ C:\WINDOWS\system32\rqkklqdg.exe
2006-08-23 01:11 13,844 --a------ C:\WINDOWS\system32\eywnipkk.exe
2006-08-22 19:54 13,844 --a------ C:\WINDOWS\system32\ddargtaw.exe
2006-08-22 19:51 13,844 --a------ C:\WINDOWS\system32\xgmngkmg.exe
2006-08-22 19:00 13,844 --a------ C:\WINDOWS\system32\cpkrcoru.exe
2006-08-22 18:57 13,844 --a------ C:\WINDOWS\system32\bggwwkqn.exe
2006-08-22 18:50 13,844 --a------ C:\WINDOWS\system32\ayxjbfvx.exe
2006-08-22 18:47 13,844 --a------ C:\WINDOWS\system32\ygijdund.exe
2006-08-22 18:44 13,844 --a------ C:\WINDOWS\system32\oedglnem.exe
2006-08-22 18:41 13,844 --a------ C:\WINDOWS\system32\chchaahn.exe
2006-08-22 18:37 13,844 --a------ C:\WINDOWS\system32\ltwyvyyq.exe
2006-08-22 18:06 13,844 --a------ C:\WINDOWS\system32\ljltpdyk.exe
2006-08-22 17:59 13,844 --a------ C:\WINDOWS\system32\byoniqon.exe
2006-08-22 17:55 13,844 --a------ C:\WINDOWS\system32\alpsoysi.exe
2006-08-22 15:25 13,844 --a------ C:\WINDOWS\system32\qvuuoato.exe
2006-08-21 15:24 13,844 --a------ C:\WINDOWS\system32\lvtyrgur.exe
2006-08-20 23:12 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2006-08-14 20:54 131,072 --a------ C:\WINDOWS\system32\datestamp.dll
2006-08-14 12:03 2 --a------ C:\WINDOWS\system32\wnstssv.exe
2006-08-09 11:57 90,112 --------- C:\WINDOWS\Updreg.EXE
2006-08-09 11:56 84,992 --------- C:\WINDOWS\system32\SFCVRT32.DLL
2006-08-09 11:56 82,432 --------- C:\WINDOWS\system32\CTWFLT32.DLL
2006-08-09 11:56 54,784 --------- C:\WINDOWS\system32\INETWH32.DLL
2006-08-09 11:56 53,552 --------- C:\WINDOWS\CTCCW.DLL
2006-08-09 11:56 26,768 --------- C:\WINDOWS\system32\CTL3D.DLL
2006-08-09 11:56 24,976 --------- C:\WINDOWS\CTRES.DLL
2006-08-09 11:56 20,480 --a------ C:\WINDOWS\INRES.DLL
2006-08-09 11:55 94,208 --a------ C:\WINDOWS\DEVREG.DLL
2006-08-09 11:55 77,824 --a------ C:\WINDOWS\system32\EAXAC3.DLL
2006-08-09 11:55 655,360 --a------ C:\WINDOWS\system32\CTSBLFX.DLL
2006-08-09 11:55 65,536 --a------ C:\WINDOWS\system32\a3d.dll
2006-08-09 11:55 57,344 --a------ C:\WINDOWS\system32\CTAGENT.DLL
2006-08-09 11:55 53,248 --a------ C:\WINDOWS\system32\AC3API.DLL
2006-08-09 11:55 495,616 --a------ C:\WINDOWS\system32\CTAUDFX.DLL
2006-08-09 11:55 49,152 --a------ C:\WINDOWS\system32\KILLAPPS.EXE
2006-08-09 11:55 49,152 --a------ C:\WINDOWS\MIDIDEF.EXE
2006-08-09 11:55 49,152 --a------ C:\WINDOWS\CTDCRES.DLL
2006-08-09 11:55 45,056 --a------ C:\WINDOWS\system32\CTSPKHLP.DLL
2006-08-09 11:55 372,736 --a------ C:\WINDOWS\system32\CTDC0001.DLL
2006-08-09 11:55 36,864 --a------ C:\WINDOWS\system32\sfman32.dll
2006-08-09 11:55 36,864 --a------ C:\WINDOWS\system32\REGPLIB.EXE
2006-08-09 11:55 36,864 --a------ C:\WINDOWS\system32\CTEMUPIA.DLL
2006-08-09 11:55 356,445 --a------ C:\WINDOWS\system32\CTDC0000.DLL
2006-08-09 11:55 28,672 --a------ C:\WINDOWS\system32\CTMMEP.DLL
2006-08-09 11:55 270,336 --a------ C:\WINDOWS\system32\SFMS32.DLL
2006-08-09 11:55 24,576 --a------ C:\WINDOWS\system32\CTHELPER.EXE
2006-08-09 11:55 20,480 --a------ C:\WINDOWS\system32\ENSDEF.EXE
2006-08-09 11:55 184,320 --a------ C:\WINDOWS\PSCONV.EXE
2006-08-09 11:55 180,224 --a------ C:\WINDOWS\READREG.EXE
2006-08-09 11:55 155,648 --a------ C:\WINDOWS\system32\CTOSUSER.DLL
2006-08-09 11:55 139,353 --a------ C:\WINDOWS\system32\CTDCIFCE.DLL
2006-08-09 11:55 131,072 --a------ C:\WINDOWS\system32\OPENAL32.DLL
2006-08-09 11:55 126,976 --a------ C:\WINDOWS\system32\COMMONFX.DLL
2006-08-09 11:55 12,288 --a------ C:\WINDOWS\system32\AHQCpURes.dll
2006-08-09 11:55 110,592 --a------ C:\WINDOWS\system32\PIAPROXY.DLL
2006-08-09 11:55 110,592 --a------ C:\WINDOWS\system32\CTSCAL.DLL
2006-08-09 11:55 110,592 --a------ C:\WINDOWS\system32\CTDPROXY.DLL
2006-08-09 11:55 106,496 --a------ C:\WINDOWS\system32\CTASIO.DLL
2006-08-05 21:15 94,208 --a------ C:\WINDOWS\system32\HPZipt12.dll
2006-08-05 21:15 69,632 --a------ C:\WINDOWS\system32\HPZipm12.exe
2006-08-05 21:15 61,440 --a------ C:\WINDOWS\system32\HPZinw12.exe
2006-08-05 21:15 57,344 --a------ C:\WINDOWS\system32\HPZisn12.dll
2006-08-05 21:15 278,584 --a------ C:\WINDOWS\system32\HPZidr12.dll
2006-08-05 21:15 204,800 --a------ C:\WINDOWS\system32\HPZipr12.dll


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2006-09-01 21:15 -------- d-------- C:\Program Files\Mozilla Firefox
2006-09-01 21:13 -------- d-------- C:\Program Files\Mozilla Thunderbird
2006-09-01 16:26 -------- d-------- C:\Program Files\ewido anti-spyware 4.0
2006-08-31 00:54 -------- d-------- C:\Program Files\Common Files
2006-08-23 17:44 -------- d-------- C:\Program Files\thriXXX
2006-08-21 20:47 -------- d--h----- C:\Program Files\InstallShield Installation Information
2006-08-21 20:00 -------- d-------- C:\Program Files\XviD
2006-08-21 19:57 -------- d-------- C:\Program Files\Aspyr
2006-08-21 16:11 -------- d-------- C:\Program Files\FBM Software
2006-08-21 11:27 -------- d-------- C:\Program Files\WinZip
2006-08-21 00:09 -------- d-------- C:\Program Files\Soulseek
2006-08-16 22:48 -------- d-------- C:\Documents and Settings\Owner\Application Data\dvdcss
2006-08-15 23:01 -------- d-------- C:\Program Files\HP
2006-08-15 21:17 -------- d-------- C:\Program Files\Common Files\HP
2006-08-15 21:02 -------- d-------- C:\Program Files\Microsoft IntelliType Pro
2006-08-15 20:59 5582 --a------ C:\Documents and Settings\Owner\Application Data\GdiplusUpgrade_MSIApproach_Wrapper.log
2006-08-15 20:50 3024 --a------ C:\Documents and Settings\Owner\Application Data\BestModePatch_RubenMain.log
2006-08-15 20:49 -------- d-------- C:\Program Files\Hewlett-Packard
2006-08-15 20:46 -------- d---s---- C:\Documents and Settings\Owner\Application Data\Microsoft
2006-08-15 18:41 -------- d-------- C:\Documents and Settings\Owner\Application Data\Image Zone Express
2006-08-14 21:26 -------- d-------- C:\Program Files\Alwil Software
2006-08-14 20:39 -------- d-------- C:\Program Files\AxBx
2006-08-14 17:30 -------- d-------- C:\Program Files\Yahoo!
2006-08-14 17:08 -------- d-------- C:\Program Files\CCleaner
2006-08-14 12:51 -------- d-------- C:\Documents and Settings\Owner\Application Data\Sun
2006-08-14 12:49 -------- d-------- C:\Program Files\Java
2006-08-14 12:47 -------- d-------- C:\Program Files\Common Files\Java
2006-08-14 00:10 -------- d-------- C:\Documents and Settings\Owner\Application Data\Help
2006-08-13 23:18 11376 --a------ C:\WINDOWS\system32\drivers\secdrv.sys
2006-08-13 23:15 223128 --a------ C:\WINDOWS\system32\drivers\dtscsi.sys
2006-08-13 23:15 -------- d-------- C:\Program Files\DAEMON Tools
2006-08-13 23:12 96256 --a------ C:\WINDOWS\system32\drivers\sptd8477.sys
2006-08-13 23:12 642560 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2006-08-13 03:01 -------- d-------- C:\Program Files\Internet Explorer
2006-08-11 20:13 -------- d-------- C:\Program Files\Windows Defender
2006-08-11 20:13 -------- d-------- C:\Program Files\Common Files\Microsoft Shared
2006-08-09 11:57 -------- d-------- C:\Program Files\Creative
2006-08-05 21:21 -------- d-------- C:\Program Files\Common Files\Hewlett-Packard
2006-08-05 12:47 -------- d-------- C:\Program Files\Dobermann
2006-08-04 17:29 -------- d-------- C:\Documents and Settings\Owner\Application Data\Macromedia
2006-08-03 23:02 -------- d-------- C:\Program Files\LochJournal
2006-08-03 18:02 -------- d-------- C:\Documents and Settings\Owner\Application Data\VersionTracker Pro
2006-08-02 11:32 -------- d-------- C:\Documents and Settings\Owner\Application Data\vlc
2006-08-02 11:27 -------- d-------- C:\Program Files\VideoLAN
2006-08-02 02:06 -------- d-------- C:\Documents and Settings\Owner\Application Data\Apple Computer
2006-07-30 22:48 178 --a------ C:\Documents and Settings\Owner\Application Data\iPod Access v2 Prefs
2006-07-30 22:21 44 --ah----- C:\Documents and Settings\Owner\Application Data\iPodAccess_OwnerName
2006-07-30 22:18 11 --ah----- C:\Documents and Settings\Owner\Application Data\iPodAccess_Time
2006-07-30 21:08 -------- d-------- C:\Program Files\iPod Access for Windows
2006-07-30 20:37 98304 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2006-07-30 20:24 -------- d-------- C:\Program Files\THQ
2006-07-29 19:23 -------- d-------- C:\Documents and Settings\Owner\Application Data\Adobe
2006-07-29 19:21 -------- d-------- C:\Program Files\Common Files\Adobe
2006-07-29 19:21 -------- d-------- C:\Program Files\Adobe
2006-07-29 17:49 -------- d-------- C:\Program Files\Valve
2006-07-29 01:04 -------- d-------- C:\Program Files\DivX
2006-07-28 16:11 -------- d-------- C:\Program Files\WinRAR
2006-07-28 12:24 -------- d-------- C:\Program Files\BitLord
2006-07-28 12:20 -------- d-------- C:\Program Files\Windows Media Player
2006-07-28 03:04 -------- d-------- C:\Documents and Settings\Owner\Application Data\Thunderbird
2006-07-28 01:44 -------- d-------- C:\Program Files\Messenger
2006-07-28 01:42 -------- d-------- C:\Program Files\Outlook Express
2006-07-28 01:42 -------- d-------- C:\Program Files\Common Files\System
2006-07-28 01:28 -------- d-------- C:\Program Files\Bethesda Softworks
2006-07-28 00:10 -------- d-------- C:\Documents and Settings\Owner\Application Data\Talkback
2006-07-27 22:09 -------- d-------- C:\Program Files\Movie Maker
2006-07-27 22:07 -------- d-------- C:\Program Files\Windows NT
2006-07-27 22:07 -------- d-------- C:\Program Files\NetMeeting
2006-07-27 21:36 -------- d-------- C:\Program Files\QuickTime
2006-07-27 21:34 -------- d-------- C:\Program Files\iTunes
2006-07-27 21:34 -------- d-------- C:\Program Files\iPod
2006-07-27 21:34 -------- d-------- C:\Program Files\Common Files\InstallShield
2006-07-27 20:56 -------- d-------- C:\Documents and Settings\Owner\Application Data\acccore
2006-07-27 20:54 -------- d-------- C:\Program Files\Common Files\Nullsoft
2006-07-27 20:54 -------- d-------- C:\Program Files\Common Files\aolshare
2006-07-27 20:54 -------- d-------- C:\Program Files\Common Files\AOL
2006-07-27 20:54 -------- d-------- C:\Program Files\AOL
2006-07-27 20:54 -------- d-------- C:\Program Files\AOD
2006-07-27 20:53 -------- d-------- C:\Documents and Settings\Owner\Application Data\Mozilla
2006-07-27 20:49 -------- d--h----- C:\Program Files\WindowsUpdate
2006-07-27 20:48 -------- d-------- C:\Documents and Settings\Owner\Application Data\InterTrust
2006-07-27 20:42 -------- d-------- C:\Program Files\Microsoft IntelliPoint
2006-07-27 20:17 -------- d-------- C:\Documents and Settings\Owner\Application Data\Identities
2006-07-27 20:16 -------- d--h----- C:\Program