Solved Random Files Keeps Making My Antivirus Pop Up

[Resolved]Random Files Keeps Making My Antivirus Pop Up

Hello!
So I'm just sitting at home playing on my xbox then I notice on my computer screen, my antivirus program, Nod32 pops up. It says some threat is detected.

File: c:\windows\system32\rqrolli.dll
Threat: Win32/Adware.Virumonde application
Comment: blah blah, can be deleted, back up data. Event occurred at an attempt to access the file by the application:\??\c:\windows\system32\winlogon.exe

I click delete but it keeps popping up, what gives?

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:37:47 PM, on 2/21/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe "
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe "
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe "
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe "
O4 - HKLM\..\Run: [009bf620] rundll32.exe "C:\WINDOWS\system32\pyhhhfbi.dll ",b
O4 - HKCU\..\Run: [RocketDock] "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe "
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe "
O4 - HKCU\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab
O23 - Service: Creative Service for CDROM Access - Unknown owner - C:\WINDOWS\system32\CTsvcCDA.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe

--
End of file - 5366 bytes

 

Hi Selphy
Welcome to Windowsbbs.
Yeah, looks like Vundo to me.

Lets start with this tool and see what happens.

Please download VundoFix.exe to your desktop

• Double-click VundoFix.exe to run it.
• Click the Scan for Vundo button.
• Once it's done scanning, click the Remove Vundo button.
• You will receive a prompt asking if you want to remove the files, click YES
• Once you click yes, your desktop will go blank as it starts removing Vundo.
• When completed, it will prompt that it will reboot your computer, click OK.
• Please post the contents of C:\vundofix.txt and a new HiJackThis log in a reply to this thread.

Note: It is possible that VundoFix encountered a file it could not remove. In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button" when VundoFix appears upon rebooting.

Then do this.

Please download Deckard's System Scanner (dss.exe) and save it to your Desktop.
Note: You must be logged onto an account with administrator privileges to complete the following.

• Close all other windows before proceeding.
• Double-click on dss.exe and follow the prompts.
• When it has finished, dss will open two Notepads main.txt and extra.txt -- please copy and then paste the contents of main.txt and extra.txt in your next reply.

Please post the "main.txt" log only for now.

Please post the Vundo log and the dss main txt log.

Thanks
Geri

 

Hello again!

Before I post my logs, there's something to say. When I tried to run Deckard's System Scanner, it almost finishes then some "error" occurs and Windows closes the program.

Also, after I ran VundoFix, when it restarted this message popped up.

RUNDLL
Error loading c:\windows\system32\pyhhfbi.dll
The specified module could not be found

Ok, after all this here are the logs you asked for and that I could get.

HJT
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:13:51 PM, on 2/21/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe "
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe "
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe "
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe "
O4 - HKLM\..\Run: [009bf620] rundll32.exe "C:\WINDOWS\system32\amkqwmxh.dll ",b
O4 - HKCU\..\Run: [RocketDock] "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe "
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe "
O4 - HKCU\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab
O23 - Service: Creative Service for CDROM Access - Unknown owner - C:\WINDOWS\system32\CTsvcCDA.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe

--
End of file - 5430 bytes

VundoFix

VundoFix V6.7.8

Checking Java version...

Scan started at 8:39:00 PM 2/21/2008

Listing files found while scanning....

C:\WINDOWS\system32\awtqn.dll
C:\WINDOWS\system32\dviboqeu.dll
C:\WINDOWS\system32\eurhcwox.dll
C:\WINDOWS\system32\inowqfnr.dll
C:\WINDOWS\system32\iysioyfo.dll
C:\WINDOWS\system32\koimamlm.dll
C:\WINDOWS\system32\mxxhselk.dll
C:\WINDOWS\system32\nqtwa.ini
C:\WINDOWS\system32\nqtwa.ini2
C:\WINDOWS\system32\pyhhhfbi.dll
C:\WINDOWS\system32\rnfqwoni.ini

Beginning removal...

Attempting to delete C:\WINDOWS\system32\awtqn.dll
C:\WINDOWS\system32\awtqn.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\dviboqeu.dll
C:\WINDOWS\system32\dviboqeu.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\eurhcwox.dll
C:\WINDOWS\system32\eurhcwox.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\inowqfnr.dll
C:\WINDOWS\system32\inowqfnr.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\iysioyfo.dll
C:\WINDOWS\system32\iysioyfo.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\koimamlm.dll
C:\WINDOWS\system32\koimamlm.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\mxxhselk.dll
C:\WINDOWS\system32\mxxhselk.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\nqtwa.ini
C:\WINDOWS\system32\nqtwa.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\nqtwa.ini2
C:\WINDOWS\system32\nqtwa.ini2 Has been deleted!

Attempting to delete C:\WINDOWS\system32\pyhhhfbi.dll
C:\WINDOWS\system32\pyhhhfbi.dll Could not be deleted.

Attempting to delete C:\WINDOWS\system32\rnfqwoni.ini
C:\WINDOWS\system32\rnfqwoni.ini Has been deleted!

Performing Repairs to the registry.
Done!

Beginning removal...

Attempting to delete C:\WINDOWS\system32\pyhhhfbi.dll
C:\WINDOWS\system32\pyhhhfbi.dll Has been deleted!

Performing Repairs to the registry.
Done!

 

Hi Selphy

Download and run this, then try Deckard's again.

Download ATF Cleaner by Atribune and save it to your Desktop.
This is a good tool to get rid of the temporary garbage you pick up while surfing the net.
Double click ATF-Cleaner.exe to run the program.
Check the boxes to the left of:

Windows Temp
Current User Temp
All Users Temp
Temporary Internet Files
Prefetch
Java Cache
Recycle bin

The rest are optional - if you want it to remove everything check "Select All ".
Finally, click Empty Selected. When you get the "Done Cleaning" message, click OK.

Thanks
Geri

 

Howdy

I used the ATF Cleaner, which seemed to work, then I tried Deckard's again, but it errors at the same spot and closes.

 

Hi Selphy

OK Lets try this one.

Download ComboFix from [color= "Red"]Here[/color] to your Desktop.
It's best to disable realtime protection applications as they sometimes interfere with the tool. Check this link for any applicable programs you may have.

• Close all open programs and windows
• Double click combofix.exe and follow the prompts.
• Vista users right click Combofix.exe and select Run As Administrator.
• When finished, it shall produce a log for you. Post that log and a HiJackthis log in your next reply

Note: Do not mouseclick combofix's window while its running. That may cause it to stall

Please post the Combofix log.

Also see if Deckards will run after this, if so post the main txt log.

Thanks
Geri

 

I think my computer just hates Deckard's, it still doesn't work. On a side note, my computer is running rather slow, slower than before, which ***** since I just reformatted and wasted one of my installs with XP.

HJT log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:14:57 PM, on 2/24/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {2E0050AC-E84C-4E55-8900-46440F698FB7} - C:\WINDOWS\system32\awtqn.dll (file missing)
O2 - BHO: (no name) - {446624E1-B767-4443-AA6E-0F355CAFD21B} - C:\WINDOWS\system32\rqrolli.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe "
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe "
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe "
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe "
O4 - HKCU\..\Run: [RocketDock] "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe "
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe "
O4 - HKCU\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab
O20 - Winlogon Notify: rqrolli - C:\WINDOWS\SYSTEM32\rqrolli.dll
O23 - Service: Creative Service for CDROM Access - Unknown owner - C:\WINDOWS\system32\CTsvcCDA.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe

--
End of file - 5866 bytes


ComboFix log:
ComboFix 08-02-24.2 - Cierno 2008-02-23 13:00:10.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.604 [GMT -8:00]
Running from: C:\Documents and Settings\Cierno\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\ddeeg.ini
C:\WINDOWS\system32\ddeeg.ini2
C:\WINDOWS\system32\geedd.dll
C:\WINDOWS\system32\hxmwqkma.ini
C:\WINDOWS\system32\ibfhhhyp.ini
C:\WINDOWS\system32\itjkmpxo.dll
C:\WINDOWS\system32\pjrmbhhg.dll
C:\WINDOWS\system32\ptwcsglv.dll
C:\WINDOWS\system32\qnglpfgf.ini
C:\WINDOWS\system32\rvcuhygr.ini
C:\WINDOWS\system32\txuvyaji.ini
C:\WINDOWS\system32\vlgscwtp.ini

.
((((((((((((((((((((((((( Files Created from 2008-01-24 to 2008-02-24 )))))))))))))))))))))))))))))))
.

2008-02-21 21:03 . 2008-02-21 21:03 <DIR> d-------- C:\Deckard
2008-02-21 20:39 . 2008-02-21 20:57 <DIR> d-------- C:\VundoFix Backups
2008-02-21 18:50 . 2008-02-21 18:50 38,400 --a------ C:\WINDOWS\system32\rqrolli.V10dll
2008-02-21 18:50 . 2008-02-21 18:50 38,400 --a------ C:\WINDOWS\system32\rqrolli.V09dll
2008-02-21 18:50 . 2008-02-21 18:50 38,400 --a------ C:\WINDOWS\system32\rqrolli.V08dll
2008-02-21 18:49 . 2008-02-21 18:49 38,400 --a------ C:\WINDOWS\system32\rqrolli.V07dll
2008-02-21 18:49 . 2008-02-21 18:49 38,400 --a------ C:\WINDOWS\system32\rqrolli.V06dll
2008-02-21 18:49 . 2008-02-21 18:49 38,400 --a------ C:\WINDOWS\system32\rqrolli.V05dll
2008-02-21 18:49 . 2008-02-21 18:49 38,400 --a------ C:\WINDOWS\system32\rqrolli.V04dll
2008-02-21 18:49 . 2008-02-21 18:49 38,400 --a------ C:\WINDOWS\system32\rqrolli.V02dll
2008-02-21 18:25 . 2008-02-21 18:25 38,400 --a------ C:\WINDOWS\system32\rqrolli.V01dll
2008-02-21 15:28 . 2008-02-21 15:28 <DIR> d-------- C:\Program Files\Trend Micro
2008-02-21 15:08 . 2008-02-21 15:08 38,400 --a------ C:\WINDOWS\system32\rqrolli.V03dll
2008-02-21 15:07 . 2008-02-21 15:07 38,400 --a------ C:\WINDOWS\system32\rqrolli.V00dll
2008-02-21 15:05 . 2008-02-21 15:05 38,400 --a------ C:\WINDOWS\system32\rqrolli.Vdll
2008-02-20 20:01 . 2008-02-20 20:01 <DIR> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-02-20 19:59 . 2008-02-20 19:59 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-02-18 22:04 . 2008-02-18 22:04 <DIR> d-------- C:\Program Files\Common Files\HP
2008-02-18 22:01 . 2008-02-18 22:01 <DIR> d-------- C:\Program Files\Hewlett-Packard
2008-02-18 22:01 . 2008-02-18 22:01 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Hewlett-Packard
2008-02-18 22:01 . 2004-05-11 10:53 626,960 -ra------ C:\WINDOWS\system32\hpvaut32.dll
2008-02-18 22:01 . 2004-05-11 10:53 487,424 -ra------ C:\WINDOWS\system32\hpvcp70.dll
2008-02-18 22:01 . 2004-05-11 10:53 344,064 -ra------ C:\WINDOWS\system32\hpvcr70.dll
2008-02-18 22:01 . 2004-05-11 10:53 82,432 -ra------ C:\WINDOWS\system32\MSXML4r.dll
2008-02-18 22:01 . 2004-05-11 10:53 44,544 -ra------ C:\WINDOWS\system32\MSXML4a.dll
2008-02-18 21:59 . 2008-02-18 21:59 <DIR> d-------- C:\Program Files\Common Files\Hewlett-Packard
2008-02-18 21:56 . 2004-06-21 09:40 51,088 -ra------ C:\WINDOWS\system32\drivers\hpzid412.sys
2008-02-18 21:56 . 2004-06-21 09:40 16,496 -ra------ C:\WINDOWS\system32\drivers\HPZipr12.sys
2008-02-18 21:55 . 2004-06-21 09:40 21,744 -ra------ C:\WINDOWS\system32\drivers\HPZius12.sys
2008-02-18 21:55 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2008-02-18 21:55 . 2004-08-03 22:58 15,104 --a--c--- C:\WINDOWS\system32\dllcache\usbscan.sys
2008-02-18 21:54 . 2004-03-18 16:53 278,584 --a------ C:\WINDOWS\system32\HPZidr12.dll
2008-02-18 21:54 . 2004-03-18 16:56 204,800 --a------ C:\WINDOWS\system32\HPZipr12.dll
2008-02-18 21:54 . 2004-03-18 16:39 94,208 --a------ C:\WINDOWS\system32\HPZipt12.dll
2008-02-18 21:54 . 2004-03-18 16:55 65,536 --a------ C:\WINDOWS\system32\HPZipm12.exe
2008-02-18 21:54 . 2004-03-18 16:38 61,440 --a------ C:\WINDOWS\system32\HPZinw12.exe
2008-02-18 21:54 . 2004-03-18 16:39 57,344 --a------ C:\WINDOWS\system32\HPZisn12.dll
2008-02-18 21:51 . 2008-02-18 22:07 <DIR> d-------- C:\Program Files\HP
2008-02-18 21:50 . 2008-02-18 22:08 104,253 --a------ C:\WINDOWS\hpoins04.dat
2008-02-18 21:50 . 2004-06-21 09:40 17,176 --------- C:\WINDOWS\hpomdl04.dat
2008-02-18 20:09 . 2008-02-18 20:09 <DIR> d-------- C:\Program Files\Common Files\Adobe
2008-02-17 13:06 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2008-02-17 13:06 . 2004-08-03 23:08 31,616 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys
2008-02-17 13:06 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2008-02-17 13:06 . 2004-08-03 23:01 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys
2008-02-15 22:20 . 2008-02-15 22:20 <DIR> d-------- C:\Program Files\Microsoft Works
2008-02-15 22:19 . 2008-02-15 22:19 <DIR> d-------- C:\Program Files\Microsoft.NET
2008-02-15 22:17 . 2008-02-15 22:18 <DIR> d-------- C:\WINDOWS\SHELLNEW
2008-02-15 22:16 . 2008-02-15 22:16 <DIR> dr-h----- C:\MSOCache
2008-02-15 22:16 . 2008-02-15 23:35 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-02-15 22:08 . 2008-02-15 22:08 32,764 --a------ C:\WINDOWS\17PHolmes1044.exe
2008-02-15 22:07 . 2008-02-15 22:07 38,400 --a------ C:\WINDOWS\system32\rqrolli.dll
2008-02-15 17:36 . 2008-02-15 17:36 <DIR> d-------- C:\Program Files\DAEMON Tools
2008-02-15 17:36 . 2008-02-15 17:36 223,128 --a------ C:\WINDOWS\system32\drivers\dtscsi.sys
2008-02-15 17:34 . 2008-02-15 17:34 643,072 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-02-15 17:34 . 2008-02-15 17:34 96,256 --a------ C:\WINDOWS\system32\drivers\sptd8157.sys
2008-02-15 12:07 . 2008-02-15 12:07 <DIR> d-------- C:\WINDOWS\Sun
2008-02-14 18:52 . 2008-02-14 18:52 <DIR> d-------- C:\Documents and Settings\All Users\SonicStage
2008-02-14 18:35 . 2008-02-14 18:35 <DIR> d-------- C:\WINDOWS\system32\Lang
2008-02-14 18:32 . 2008-02-14 18:39 <DIR> d-------- C:\Documents and Settings\Cierno\Application Data\Ahead
2008-02-14 18:31 . 2008-02-14 18:31 <DIR> d-------- C:\Program Files\Nero
2008-02-14 18:31 . 2008-02-14 18:32 <DIR> d-------- C:\Program Files\Common Files\Ahead
2008-02-14 18:31 . 2008-02-14 18:31 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Nero
2008-02-14 18:25 . 2008-02-14 18:25 <DIR> d-------- C:\WINDOWS\system32\XPSViewer
2008-02-14 18:25 . 2008-02-14 18:25 <DIR> d-------- C:\Program Files\Reference Assemblies
2008-02-14 18:25 . 2008-02-14 18:25 <DIR> d-------- C:\Program Files\MSBuild
2008-02-14 18:24 . 2006-06-29 13:07 14,048 --a------ C:\WINDOWS\system32\spmsg2.dll
2008-02-14 18:23 . 2008-02-14 18:23 <DIR> d-------- C:\Program Files\MSXML 6.0
2008-02-14 18:12 . 2008-02-18 21:58 <DIR> d-------- C:\WINDOWS\system32\URTTemp
2008-02-14 17:52 . 2008-02-14 17:52 <DIR> d-------- C:\Program Files\Realtek
2008-02-14 17:28 . 2008-02-14 17:28 <DIR> d-------- C:\Documents and Settings\Cierno\Application Data\Creative
2008-02-14 17:09 . 2008-02-14 17:09 588 --a------ C:\WINDOWS\system32\settingsbkup.sfm
2008-02-14 17:09 . 2008-02-14 17:09 588 --a------ C:\WINDOWS\system32\settings.sfm
2008-02-14 17:07 . 2006-02-28 04:00 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2008-02-13 23:22 . 2007-09-24 23:31 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-02-13 23:21 . 2008-02-13 23:22 <DIR> d-------- C:\Program Files\Java
2008-02-13 22:58 . 2008-02-13 22:58 <DIR> d-------- C:\Program Files\Common Files\Java
2008-02-13 20:23 . 2008-02-13 20:23 <DIR> d-------- C:\Program Files\Sony Corporation
2008-02-13 20:23 . 2001-09-13 02:15 90,112 --------- C:\WINDOWS\snymsico.dll
2008-02-13 20:23 . 2002-08-08 15:51 38,951 --------- C:\WINDOWS\system32\drivers\NETMDUSB.sys
2008-02-13 20:23 . 2005-10-31 10:46 36,679 --------- C:\WINDOWS\system32\drivers\NETMD052.sys
2008-02-13 20:23 . 2003-11-10 12:31 36,232 --------- C:\WINDOWS\system32\drivers\NETMD033.sys
2008-02-13 20:23 . 2003-04-01 18:55 35,319 --------- C:\WINDOWS\system32\drivers\NETMD031.sys
2008-02-13 20:23 . 2001-08-31 15:07 27,255 --------- C:\WINDOWS\system32\drivers\NWWMUSB.sys
2008-02-13 20:23 . 2002-09-11 10:20 11,510 --------- C:\WINDOWS\system32\drivers\VMCUSB.sys
2008-02-13 20:22 . 2008-02-13 20:22 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Sony Corporation
2008-02-13 20:22 . 2006-05-11 12:05 770,048 --a------ C:\WINDOWS\system32\CDDBUISony.dll
2008-02-13 20:22 . 2006-05-11 12:02 643,072 --a------ C:\WINDOWS\system32\CDDBControlSony.dll
2008-02-13 20:22 . 2006-05-11 12:03 585,728 --a------ C:\WINDOWS\system32\CddbMusicIDSony.dll
2008-02-13 20:22 . 2006-05-11 12:06 520,192 --a------ C:\WINDOWS\system32\CddbPlaylist2Sony.dll
2008-02-13 20:22 . 2006-05-11 12:05 73,728 --a------ C:\WINDOWS\system32\CddbLinkSony.dll
2008-02-13 20:21 . 2008-02-13 20:23 <DIR> d-------- C:\Program Files\Sony
2008-02-13 20:21 . 2008-02-13 20:23 <DIR> d-------- C:\Program Files\Common Files\Sony Shared
2008-02-13 20:21 . 2008-02-14 18:52 <DIR> d-------- C:\Documents and Settings\Cierno\Application Data\Sony Corporation
2008-02-13 16:23 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2008-02-13 16:23 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll
2008-02-13 16:23 . 2007-07-30 19:19 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2008-02-13 01:08 . 2008-02-13 01:08 <DIR> d-------- C:\Program Files\uTorrent
2008-02-13 01:08 . 2008-02-20 19:58 <DIR> d-------- C:\Documents and Settings\Cierno\Application Data\uTorrent
2008-02-13 00:55 . 2008-02-13 00:55 1,158 --a------ C:\WINDOWS\mozver.dat

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-15 01:52 315,392 ----a-w C:\WINDOWS\HideWin.exe
2008-02-13 08:24 218,624 ----a-w C:\WINDOWS\system32\uxtheme.dll
2008-02-13 04:56 --------- d-----w C:\Program Files\microsoft frontpage
2008-01-30 19:28 4,725,760 ----a-w C:\WINDOWS\system32\drivers\RtkHDAud.sys
2008-01-29 23:47 16,859,648 ----a-w C:\WINDOWS\RTHDCPL.exe
2007-12-07 01:07 659,456 ----a-w C:\WINDOWS\system32\wininet.dll
2007-12-04 18:38 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2E0050AC-E84C-4E55-8900-46440F698FB7}]
C:\WINDOWS\system32\awtqn.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{446624E1-B767-4443-AA6E-0F355CAFD21B}]
2008-02-15 22:07 38400 --a------ C:\WINDOWS\system32\rqrolli.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RocketDock "= "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe" [ ]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} "= "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-01-15 16:14 147456]
"SsAAD.exe "= "C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe" [2006-05-08 05:17 81920]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon "= "C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776]
"nwiz "= "nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter "= "C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920]
"nod32kui "= "C:\Program Files\Eset\nod32kui.exe" [2008-02-12 22:29 949376]
"IMJPMIG8.1 "= "C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2006-02-28 04:00 208952]
"MSPY2002 "= "C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2006-02-28 04:00 59392]
"PHIME2002ASync "= "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2006-02-28 04:00 455168]
"PHIME2002A "= "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2006-02-28 04:00 455168]
"WinampAgent "= "C:\Program Files\Winamp\winampa.exe" [2007-05-14 14:22 35328]
"SunJavaUpdateSched "= "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"RTHDCPL "= "RTHDCPL.EXE" [2008-01-29 15:47 16859648 C:\WINDOWS\RTHDCPL.exe]
"NeroFilterCheck "= "C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 15:40 155648]
"Adobe Reader Speed Launcher "= "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"HP Software Update "= "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2004-02-12 13:38 49152]
"HP Component Manager "= "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 15:18 241664]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-05-28 22:31:38 241664]
HP Image Zone Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2004-05-28 23:06:36 53248]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{446624E1-B767-4443-AA6E-0F355CAFD21B} "= C:\WINDOWS\system32\rqrolli.dll [2008-02-15 22:07 38400]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\rqrolli]
rqrolli.dll 2008-02-15 22:07 38400 C:\WINDOWS\system32\rqrolli.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe "=
"C:\\Program Files\\uTorrent\\uTorrent.exe "=


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bc1694ba-da6f-11dc-a38f-001731116063}]
\shell\sorthb\command - "C:\Program Files\PSP Brew\PSPbrew.exe" /sorthb

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-24 13:06:41
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\rqrolli.dll
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
.
**************************************************************************
.
Completion time: 2008-02-24 13:09:35 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-24 21:09:10
.
2008-02-22 05:47:47 --- E O F ---

 

Hi Selphy

Having any p2p file sharing apps such as Limewire, BitTorrent, uTorrent etc.. is almost like inviting malware into your computer. There is absolutely no way for you to know which of the hundreds of thousands of users you are sharing files with are infected or not.
I strongly recommend removing any P2P applications.


Do you use this?
PSP Brew


Highlight and copy the contents of the code box below and paste it into a blank notepad, then save it to your desktop as;

Filename: CFScript.txt
Save As Type: All Files (*.*)

Close all other windows and programs. Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button.
Click here to see how to use CFScript.txt
Combofix should run and may reboot the computer when it's done. A log will open when it's complete. Post the contents of that log and another fresh HijackThis log.

Please do not click on the ComboFix window while it is running a scan. This can cause it to stall.

Code:

File::
C:\WINDOWS\system32\rqrolli.V10dll
C:\WINDOWS\system32\rqrolli.V09dll
C:\WINDOWS\system32\rqrolli.V08dll
C:\WINDOWS\system32\rqrolli.V07dll
C:\WINDOWS\system32\rqrolli.V06dll
C:\WINDOWS\system32\rqrolli.V05dll
C:\WINDOWS\system32\rqrolli.V04dll
C:\WINDOWS\system32\rqrolli.V02dll
C:\WINDOWS\system32\rqrolli.V01dll
C:\WINDOWS\system32\rqrolli.V03dll
C:\WINDOWS\system32\rqrolli.V00dll
C:\WINDOWS\system32\rqrolli.Vdll
C:\WINDOWS\17PHolmes1044.exe
C:\WINDOWS\system32\rqrolli.dll

Folder::
C:\VundoFix Backups


Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2E0050AC-E84C-4E55-8900-46440F698FB7}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{446624E1-B767-4443-AA6E-0F355CAFD21B}]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shell executehooks]
 "{446624E1-B767-4443-AA6E-0F355CAFD21B} "= -
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\rqrolli] 

Please post the CFScript log.

Thanks
Geri

 

Yay, that rqroulli thing doesn't make my anti-virus pop up anymore! Still, doesn't seem to run as fast it used to.

Also, I was wondering, is there programs I can install to protect me from all sorts of viruses and stuff? I don't want to get rid of uTorrent really because it's where I get...pretty much everything I own.

On a side note, I tried using Deckard's again, and it worked! I'll include the main.txt it provided in a new post since this post is growing too huge.

HJT Log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:01:29 PM, on 2/24/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe "
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe "
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe "
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe "
O4 - HKCU\..\Run: [RocketDock] "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe "
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe "
O4 - HKCU\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab
O23 - Service: Creative Service for CDROM Access - Unknown owner - C:\WINDOWS\system32\CTsvcCDA.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe

--
End of file - 5767 bytes

ComboFix Log:
ComboFix 08-02-24.2 - Cierno 2008-02-24 22:52:37.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.586 [GMT -8:00]
Running from: C:\Documents and Settings\Cierno\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Cierno\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\WINDOWS\17PHolmes1044.exe
C:\WINDOWS\system32\rqrolli.dll
C:\WINDOWS\system32\rqrolli.V00dll
C:\WINDOWS\system32\rqrolli.V01dll
C:\WINDOWS\system32\rqrolli.V02dll
C:\WINDOWS\system32\rqrolli.V03dll
C:\WINDOWS\system32\rqrolli.V04dll
C:\WINDOWS\system32\rqrolli.V05dll
C:\WINDOWS\system32\rqrolli.V06dll
C:\WINDOWS\system32\rqrolli.V07dll
C:\WINDOWS\system32\rqrolli.V08dll
C:\WINDOWS\system32\rqrolli.V09dll
C:\WINDOWS\system32\rqrolli.V10dll
C:\WINDOWS\system32\rqrolli.Vdll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\VundoFix Backups
C:\VundoFix Backups\awtqn.dll.bad
C:\VundoFix Backups\dviboqeu.dll.bad
C:\VundoFix Backups\eurhcwox.dll.bad
C:\VundoFix Backups\inowqfnr.dll.bad
C:\VundoFix Backups\iysioyfo.dll.bad
C:\VundoFix Backups\koimamlm.dll.bad
C:\VundoFix Backups\mxxhselk.dll.bad
C:\VundoFix Backups\nqtwa.ini.bad
C:\VundoFix Backups\nqtwa.ini2.bad
C:\VundoFix Backups\pyhhhfbi.dll.bad
C:\VundoFix Backups\rnfqwoni.ini.bad
C:\WINDOWS\17PHolmes1044.exe
C:\WINDOWS\system32\klvlkgeg.dll
C:\WINDOWS\system32\pjakddiw.dll
C:\WINDOWS\system32\qrutv.ini
C:\WINDOWS\system32\qrutv.ini2
C:\WINDOWS\system32\rqrolli.dll
C:\WINDOWS\system32\rqrolli.V00dll
C:\WINDOWS\system32\rqrolli.V01dll
C:\WINDOWS\system32\rqrolli.V02dll
C:\WINDOWS\system32\rqrolli.V03dll
C:\WINDOWS\system32\rqrolli.V04dll
C:\WINDOWS\system32\rqrolli.V05dll
C:\WINDOWS\system32\rqrolli.V06dll
C:\WINDOWS\system32\rqrolli.V07dll
C:\WINDOWS\system32\rqrolli.V08dll
C:\WINDOWS\system32\rqrolli.V09dll
C:\WINDOWS\system32\rqrolli.V10dll
C:\WINDOWS\system32\rqrolli.Vdll
C:\WINDOWS\system32\vturq.dll
C:\WINDOWS\system32\widdkajp.ini

.
((((((((((((((((((((((((( Files Created from 2008-01-25 to 2008-02-25 )))))))))))))))))))))))))))))))
.

2008-02-21 21:03 . 2008-02-21 21:03 <DIR> d-------- C:\Deckard
2008-02-21 15:28 . 2008-02-21 15:28 <DIR> d-------- C:\Program Files\Trend Micro
2008-02-20 20:01 . 2008-02-20 20:01 <DIR> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-02-20 19:59 . 2008-02-20 19:59 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-02-18 22:04 . 2008-02-18 22:04 <DIR> d-------- C:\Program Files\Common Files\HP
2008-02-18 22:01 . 2008-02-18 22:01 <DIR> d-------- C:\Program Files\Hewlett-Packard
2008-02-18 22:01 . 2008-02-18 22:01 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Hewlett-Packard
2008-02-18 22:01 . 2004-05-11 10:53 626,960 -ra------ C:\WINDOWS\system32\hpvaut32.dll
2008-02-18 22:01 . 2004-05-11 10:53 487,424 -ra------ C:\WINDOWS\system32\hpvcp70.dll
2008-02-18 22:01 . 2004-05-11 10:53 344,064 -ra------ C:\WINDOWS\system32\hpvcr70.dll
2008-02-18 22:01 . 2004-05-11 10:53 82,432 -ra------ C:\WINDOWS\system32\MSXML4r.dll
2008-02-18 22:01 . 2004-05-11 10:53 44,544 -ra------ C:\WINDOWS\system32\MSXML4a.dll
2008-02-18 21:59 . 2008-02-18 21:59 <DIR> d-------- C:\Program Files\Common Files\Hewlett-Packard
2008-02-18 21:56 . 2004-06-21 09:40 51,088 -ra------ C:\WINDOWS\system32\drivers\hpzid412.sys
2008-02-18 21:56 . 2004-06-21 09:40 16,496 -ra------ C:\WINDOWS\system32\drivers\HPZipr12.sys
2008-02-18 21:55 . 2004-06-21 09:40 21,744 -ra------ C:\WINDOWS\system32\drivers\HPZius12.sys
2008-02-18 21:55 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2008-02-18 21:55 . 2004-08-03 22:58 15,104 --a--c--- C:\WINDOWS\system32\dllcache\usbscan.sys
2008-02-18 21:54 . 2004-03-18 16:53 278,584 --a------ C:\WINDOWS\system32\HPZidr12.dll
2008-02-18 21:54 . 2004-03-18 16:56 204,800 --a------ C:\WINDOWS\system32\HPZipr12.dll
2008-02-18 21:54 . 2004-03-18 16:39 94,208 --a------ C:\WINDOWS\system32\HPZipt12.dll
2008-02-18 21:54 . 2004-03-18 16:55 65,536 --a------ C:\WINDOWS\system32\HPZipm12.exe
2008-02-18 21:54 . 2004-03-18 16:38 61,440 --a------ C:\WINDOWS\system32\HPZinw12.exe
2008-02-18 21:54 . 2004-03-18 16:39 57,344 --a------ C:\WINDOWS\system32\HPZisn12.dll
2008-02-18 21:51 . 2008-02-18 22:07 <DIR> d-------- C:\Program Files\HP
2008-02-18 21:50 . 2008-02-18 22:08 104,253 --a------ C:\WINDOWS\hpoins04.dat
2008-02-18 21:50 . 2004-06-21 09:40 17,176 --------- C:\WINDOWS\hpomdl04.dat
2008-02-18 20:09 . 2008-02-18 20:09 <DIR> d-------- C:\Program Files\Common Files\Adobe
2008-02-17 13:06 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2008-02-17 13:06 . 2004-08-03 23:08 31,616 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys
2008-02-17 13:06 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2008-02-17 13:06 . 2004-08-03 23:01 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys
2008-02-15 22:20 . 2008-02-15 22:20 <DIR> d-------- C:\Program Files\Microsoft Works
2008-02-15 22:19 . 2008-02-15 22:19 <DIR> d-------- C:\Program Files\Microsoft.NET
2008-02-15 22:17 . 2008-02-15 22:18 <DIR> d-------- C:\WINDOWS\SHELLNEW
2008-02-15 22:16 . 2008-02-15 22:16 <DIR> dr-h----- C:\MSOCache
2008-02-15 22:16 . 2008-02-15 23:35 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-02-15 17:36 . 2008-02-15 17:36 <DIR> d-------- C:\Program Files\DAEMON Tools
2008-02-15 17:36 . 2008-02-15 17:36 223,128 --a------ C:\WINDOWS\system32\drivers\dtscsi.sys
2008-02-15 17:34 . 2008-02-15 17:34 643,072 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-02-15 17:34 . 2008-02-15 17:34 96,256 --a------ C:\WINDOWS\system32\drivers\sptd8157.sys
2008-02-15 12:07 . 2008-02-15 12:07 <DIR> d-------- C:\WINDOWS\Sun
2008-02-14 18:52 . 2008-02-14 18:52 <DIR> d-------- C:\Documents and Settings\All Users\SonicStage
2008-02-14 18:35 . 2008-02-14 18:35 <DIR> d-------- C:\WINDOWS\system32\Lang
2008-02-14 18:32 . 2008-02-14 18:39 <DIR> d-------- C:\Documents and Settings\Cierno\Application Data\Ahead
2008-02-14 18:31 . 2008-02-14 18:31 <DIR> d-------- C:\Program Files\Nero
2008-02-14 18:31 . 2008-02-14 18:32 <DIR> d-------- C:\Program Files\Common Files\Ahead
2008-02-14 18:31 . 2008-02-14 18:31 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Nero
2008-02-14 18:25 . 2008-02-14 18:25 <DIR> d-------- C:\WINDOWS\system32\XPSViewer
2008-02-14 18:25 . 2008-02-14 18:25 <DIR> d-------- C:\Program Files\Reference Assemblies
2008-02-14 18:25 . 2008-02-14 18:25 <DIR> d-------- C:\Program Files\MSBuild
2008-02-14 18:24 . 2006-06-29 13:07 14,048 --a------ C:\WINDOWS\system32\spmsg2.dll
2008-02-14 18:23 . 2008-02-14 18:23 <DIR> d-------- C:\Program Files\MSXML 6.0
2008-02-14 18:12 . 2008-02-18 21:58 <DIR> d-------- C:\WINDOWS\system32\URTTemp
2008-02-14 17:52 . 2008-02-14 17:52 <DIR> d-------- C:\Program Files\Realtek
2008-02-14 17:28 . 2008-02-14 17:28 <DIR> d-------- C:\Documents and Settings\Cierno\Application Data\Creative
2008-02-14 17:09 . 2008-02-14 17:09 588 --a------ C:\WINDOWS\system32\settingsbkup.sfm
2008-02-14 17:09 . 2008-02-14 17:09 588 --a------ C:\WINDOWS\system32\settings.sfm
2008-02-14 17:07 . 2006-02-28 04:00 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2008-02-13 23:22 . 2007-09-24 23:31 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-02-13 23:21 . 2008-02-13 23:22 <DIR> d-------- C:\Program Files\Java
2008-02-13 22:58 . 2008-02-13 22:58 <DIR> d-------- C:\Program Files\Common Files\Java
2008-02-13 20:23 . 2008-02-13 20:23 <DIR> d-------- C:\Program Files\Sony Corporation
2008-02-13 20:23 . 2001-09-13 02:15 90,112 --------- C:\WINDOWS\snymsico.dll
2008-02-13 20:23 . 2002-08-08 15:51 38,951 --------- C:\WINDOWS\system32\drivers\NETMDUSB.sys
2008-02-13 20:23 . 2005-10-31 10:46 36,679 --------- C:\WINDOWS\system32\drivers\NETMD052.sys
2008-02-13 20:23 . 2003-11-10 12:31 36,232 --------- C:\WINDOWS\system32\drivers\NETMD033.sys
2008-02-13 20:23 . 2003-04-01 18:55 35,319 --------- C:\WINDOWS\system32\drivers\NETMD031.sys
2008-02-13 20:23 . 2001-08-31 15:07 27,255 --------- C:\WINDOWS\system32\drivers\NWWMUSB.sys
2008-02-13 20:23 . 2002-09-11 10:20 11,510 --------- C:\WINDOWS\system32\drivers\VMCUSB.sys
2008-02-13 20:22 . 2008-02-13 20:22 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Sony Corporation
2008-02-13 20:22 . 2006-05-11 12:05 770,048 --a------ C:\WINDOWS\system32\CDDBUISony.dll
2008-02-13 20:22 . 2006-05-11 12:02 643,072 --a------ C:\WINDOWS\system32\CDDBControlSony.dll
2008-02-13 20:22 . 2006-05-11 12:03 585,728 --a------ C:\WINDOWS\system32\CddbMusicIDSony.dll
2008-02-13 20:22 . 2006-05-11 12:06 520,192 --a------ C:\WINDOWS\system32\CddbPlaylist2Sony.dll
2008-02-13 20:22 . 2006-05-11 12:05 73,728 --a------ C:\WINDOWS\system32\CddbLinkSony.dll
2008-02-13 20:21 . 2008-02-13 20:23 <DIR> d-------- C:\Program Files\Sony
2008-02-13 20:21 . 2008-02-13 20:23 <DIR> d-------- C:\Program Files\Common Files\Sony Shared
2008-02-13 20:21 . 2008-02-14 18:52 <DIR> d-------- C:\Documents and Settings\Cierno\Application Data\Sony Corporation
2008-02-13 16:23 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2008-02-13 16:23 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll
2008-02-13 16:23 . 2007-07-30 19:19 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2008-02-13 01:08 . 2008-02-13 01:08 <DIR> d-------- C:\Program Files\uTorrent
2008-02-13 01:08 . 2008-02-20 19:58 <DIR> d-------- C:\Documents and Settings\Cierno\Application Data\uTorrent
2008-02-13 00:55 . 2008-02-13 00:55 1,158 --a------ C:\WINDOWS\mozver.dat
2008-02-13 00:51 . 2008-02-13 00:51 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
2008-02-13 00:51 . 2008-02-13 12:09 <DIR> d-------- C:\Documents and Settings\Cierno\Contacts
2008-02-13 00:42 . 2008-02-13 00:50 <DIR> d-------- C:\Program Files\Windows Live
2008-02-13 00:42 . 2008-02-13 00:50 <DIR> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller
2008-02-13 00:41 . 2008-02-13 00:41 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-02-13 00:28 . 2008-02-13 00:28 <DIR> d-------- C:\Program Files\Winamp
2008-02-13 00:24 . 2008-02-13 00:24 2,359,350 --a------ C:\WINDOWS\BricoPack Wallpaper.bmp
2008-02-13 00:24 . 2008-02-13 00:24 64,567 --a------ C:\WINDOWS\BricoPackUninst.cmd
2008-02-13 00:23 . 2008-02-13 00:23 <DIR> d-------- C:\WINDOWS\BricoPacks
2008-02-13 00:23 . 2008-02-13 00:24 6,116 --a------ C:\WINDOWS\BricoPackFoldersDelete.cmd
2008-02-13 00:14 . 2008-02-13 00:14 0 --a------ C:\WINDOWS\nsreg.dat
2008-02-13 00:08 . 2000-05-22 00:58 647,872 --a------ C:\WINDOWS\system32\Mscomct2.ocx
2008-02-13 00:08 . 1998-10-29 16:45 306,688 --a------ C:\WINDOWS\IsUninst.exe
2008-02-13 00:08 . 1999-10-10 17:00 41,984 --------- C:\WINDOWS\Ctregrun.exe
2008-02-13 00:08 . 2008-02-14 17:31 11 --a------ C:\WINDOWS\SBWIN.INI

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-15 01:52 315,392 ----a-w C:\WINDOWS\HideWin.exe
2008-02-13 04:56 --------- d-----w C:\Program Files\microsoft frontpage
2008-01-30 19:28 4,725,760 ----a-w C:\WINDOWS\system32\drivers\RtkHDAud.sys
2008-01-29 23:47 16,859,648 ----a-w C:\WINDOWS\RTHDCPL.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RocketDock "= "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe" [ ]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} "= "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-01-15 16:14 147456]
"SsAAD.exe "= "C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe" [2006-05-08 05:17 81920]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon "= "C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776]
"nwiz "= "nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter "= "C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920]
"nod32kui "= "C:\Program Files\Eset\nod32kui.exe" [2008-02-12 22:29 949376]
"IMJPMIG8.1 "= "C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2006-02-28 04:00 208952]
"MSPY2002 "= "C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2006-02-28 04:00 59392]
"PHIME2002ASync "= "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2006-02-28 04:00 455168]
"PHIME2002A "= "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2006-02-28 04:00 455168]
"WinampAgent "= "C:\Program Files\Winamp\winampa.exe" [2007-05-14 14:22 35328]
"SunJavaUpdateSched "= "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"RTHDCPL "= "RTHDCPL.EXE" [2008-01-29 15:47 16859648 C:\WINDOWS\RTHDCPL.exe]
"NeroFilterCheck "= "C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 15:40 155648]
"Adobe Reader Speed Launcher "= "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"HP Software Update "= "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2004-02-12 13:38 49152]
"HP Component Manager "= "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 15:18 241664]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-05-28 22:31:38 241664]
HP Image Zone Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2004-05-28 23:06:36 53248]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe "=
"C:\\Program Files\\uTorrent\\uTorrent.exe "=


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bc1694ba-da6f-11dc-a38f-001731116063}]
\shell\sorthb\command - "C:\Program Files\PSP Brew\PSPbrew.exe" /sorthb

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-24 22:57:19
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
.
**************************************************************************
.
Completion time: 2008-02-24 22:58:36 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-25 06:58:27
ComboFix2.txt 2008-02-24 21:09:36
.
2008-02-22 05:47:47 --- E O F ---

 

Deckard's Log:
Deckard's System Scanner v20071014.68
Run by Cierno on 2008-02-24 23:05:34
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Successfully created a Deckard's System Scanner Restore Point.


-- Last 5 Restore Point(s) --
77: 2008-02-25 07:05:37 UTC - RP77 - Deckard's System Scanner Restore Point
76: 2008-02-25 06:51:44 UTC - RP76 - ComboFix created restore point
75: 2008-02-25 06:46:06 UTC - RP75 - Last known good configuration
74: 2008-02-25 06:45:56 UTC - RP74 - Deckard's System Scanner Restore Point
73: 2008-02-25 06:45:56 UTC - RP73 - ComboFix created restore point


-- First Restore Point --
1: 2008-02-25 06:45:55 UTC - RP1 - System Checkpoint


Backed up registry hives.
Performed disk cleanup.



-- HijackThis (run as Cierno.exe) ----------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:06:10 PM, on 2/24/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Cierno\Desktop\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Cierno.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe "
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe "
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe "
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe "
O4 - HKCU\..\Run: [RocketDock] "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe "
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe "
O4 - HKCU\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab
O23 - Service: Creative Service for CDROM Access - Unknown owner - C:\WINDOWS\system32\CTsvcCDA.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe

--
End of file - 5645 bytes

-- File Associations -----------------------------------------------------------

All associations okay.


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

S3 BCM42RLY - c:\windows\system32\bcm42rly.sys (file missing)
S3 ctsfm2k (Creative SoundFont Management Device Driver) - c:\windows\system32\drivers\ctsfm2k.sys (file missing)
S3 GTNDIS5 (GTNDIS5 NDIS Protocol Driver) - c:\windows\system32\gtndis5.sys (file missing)
S3 ossrv (Creative OS Services Driver) - c:\windows\system32\drivers\ctoss2k.sys (file missing)
S3 P17 (Sound Blaster Live! 24-bit) - c:\windows\system32\drivers\p17.sys (file missing)


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R3 NMIndexingService - "c:\program files\common files\ahead\lib\nmindexingservice.exe" <Not Verified; Nero AG; Nero Home>

S2 Creative Service for CDROM Access - c:\windows\system32\ctsvccda.exe (file missing)
S3 NBService - c:\program files\nero\nero 7\nero backitup\nbservice.exe


-- Device Manager: Disabled ----------------------------------------------------

Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description:
Device ID: ACPI\AWY0001\2&DABA3FF&0
Manufacturer:
Name:
PNP Device ID: ACPI\AWY0001\2&DABA3FF&0
Service:

Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description: SM Bus Controller
Device ID: PCI\VEN_10DE&DEV_0264&SUBSYS_2A3A103C&REV_A2\3&2411E6FE&0&51
Manufacturer:
Name: SM Bus Controller
PNP Device ID: PCI\VEN_10DE&DEV_0264&SUBSYS_2A3A103C&REV_A2\3&2411E6FE&0&51
Service:

Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description: PCI Simple Communications Controller
Device ID: PCI\VEN_11C1&DEV_0620&SUBSYS_062011C1&REV_00\4&DC268A3&0&5080
Manufacturer:
Name: PCI Simple Communications Controller
PNP Device ID: PCI\VEN_11C1&DEV_0620&SUBSYS_062011C1&REV_00\4&DC268A3&0&5080
Service:


-- Files created between 2008-01-24 and 2008-02-24 -----------------------------

2008-02-23 12:58:43 68096 --a------ C:\WINDOWS\system32\zip.exe
2008-02-23 12:58:43 98816 --a------ C:\WINDOWS\system32\sed.exe
2008-02-23 12:58:43 80412 --a------ C:\WINDOWS\system32\grep.exe
2008-02-23 12:58:43 73728 --a------ C:\WINDOWS\system32\fdsv.exe <Not Verified; Smallfrogs Studio; >
2008-02-21 15:28:36 0 d-------- C:\Program Files\Trend Micro
2008-02-20 20:01:08 0 d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-02-20 19:59:33 0 d-------- C:\Program Files\MSXML 4.0
2008-02-18 22:04:06 0 d-------- C:\Program Files\Common Files\HP
2008-02-18 22:01:40 0 d-------- C:\Program Files\Hewlett-Packard
2008-02-18 22:01:39 0 d-------- C:\Documents and Settings\All Users\Application Data\Hewlett-Packard
2008-02-18 22:01:22 82432 -ra------ C:\WINDOWS\system32\MSXML4r.dll <Not Verified; Microsoft Corporation; Microsoft(R) MSXML 4.0 SP1>
2008-02-18 22:01:22 44544 -ra------ C:\WINDOWS\system32\MSXML4a.dll <Not Verified; Microsoft Corporation; Microsoft(R) MSXML 4.0 SP1>
2008-02-18 22:01:22 626960 -ra------ C:\WINDOWS\system32\hpvaut32.dll <Not Verified; Microsoft Corporation; >
2008-02-18 21:59:27 0 d-------- C:\Program Files\Common Files\Hewlett-Packard
2008-02-18 21:54:17 57344 --a------ C:\WINDOWS\system32\HPZisn12.dll <Not Verified; HP; HP SNMP Windows>
2008-02-18 21:54:17 65536 --a------ C:\WINDOWS\system32\HPZipm12.exe <Not Verified; HP; HP PML>
2008-02-18 21:54:17 61440 --a------ C:\WINDOWS\system32\HPZinw12.exe <Not Verified; HP; HP Dot4Net Windows>
2008-02-18 21:54:16 94208 --a------ C:\WINDOWS\system32\HPZipt12.dll <Not Verified; HP; HP SNMP Windows>
2008-02-18 21:54:16 204800 --a------ C:\WINDOWS\system32\HPZipr12.dll <Not Verified; HP; HP PmlRtl>
2008-02-18 21:54:16 278584 --a------ C:\WINDOWS\system32\HPZidr12.dll <Not Verified; HP; HP Dot4Rtl>
2008-02-18 21:51:38 0 d-------- C:\Program Files\HP
2008-02-18 21:50:33 17176 -----n--- C:\WINDOWS\hpomdl04.dat
2008-02-18 21:50:33 104253 --a------ C:\WINDOWS\hpoins04.dat
2008-02-18 20:09:44 0 d-------- C:\Documents and Settings\All Users\Application Data\Adobe
2008-02-18 20:09:31 0 d-------- C:\Program Files\Common Files\Adobe
2008-02-17 16:16:02 0 d--hs---- C:\Documents and Settings\Cierno\Recent
2008-02-15 22:20:37 0 d-------- C:\Program Files\Microsoft Works
2008-02-15 22:19:51 0 d-------- C:\Program Files\Microsoft.NET
2008-02-15 22:17:38 0 d-------- C:\WINDOWS\SHELLNEW
2008-02-15 22:16:51 0 d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-02-15 22:16:21 0 dr-h----- C:\MSOCache
2008-02-15 17:36:47 223128 --a------ C:\WINDOWS\system32\drivers\dtscsi.sys
2008-02-15 17:36:45 0 d-------- C:\Program Files\DAEMON Tools
2008-02-15 17:34:52 96256 --a------ C:\WINDOWS\system32\drivers\sptd8157.sys
2008-02-15 17:34:52 643072 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-02-15 12:07:58 0 d-------- C:\WINDOWS\Sun
2008-02-15 12:07:58 0 d-------- C:\Documents and Settings\Cierno\Application Data\Sun
2008-02-14 18:52:46 0 d-------- C:\Documents and Settings\All Users\SonicStage
2008-02-14 18:35:41 0 d-------- C:\WINDOWS\system32\Lang
2008-02-14 18:32:48 0 d-------- C:\Documents and Settings\Cierno\Application Data\Ahead
2008-02-14 18:31:15 0 d-------- C:\Program Files\Nero
2008-02-14 18:31:15 0 d-------- C:\Program Files\Common Files\Ahead
2008-02-14 18:31:15 0 d-------- C:\Documents and Settings\All Users\Application Data\Nero
2008-02-14 18:25:12 0 d-------- C:\Program Files\MSBuild
2008-02-14 18:25:09 0 d-------- C:\WINDOWS\system32\XPSViewer
2008-02-14 18:25:05 0 d-------- C:\Program Files\Reference Assemblies
2008-02-14 18:23:10 0 d-------- C:\Program Files\MSXML 6.0
2008-02-14 18:12:48 0 d-------- C:\WINDOWS\system32\URTTemp
2008-02-14 17:52:39 0 d-------- C:\WINDOWS\system32\RTCOM
2008-02-14 17:52:39 49152 --a------ C:\WINDOWS\system32\ChCfg.exe
2008-02-14 17:52:04 0 d-------- C:\Program Files\Realtek
2008-02-14 17:52:01 520192 --a------ C:\WINDOWS\RtlExUpd.dll <Not Verified; Realtek Semiconductor Corp.; RtlExUpd Dynamic Link Library>
2008-02-14 17:52:01 315392 --a------ C:\WINDOWS\HideWin.exe <Not Verified; Realtek Semiconductor Corp.; HD Audio Hide windows program>
2008-02-14 17:28:55 0 d-------- C:\Documents and Settings\Cierno\Application Data\Creative
2008-02-13 23:21:59 0 d-------- C:\Program Files\Java
2008-02-13 22:58:11 0 d-------- C:\Program Files\Common Files\Java
2008-02-13 20:23:20 0 d-------- C:\Program Files\Sony Corporation
2008-02-13 20:22:52 770048 --a------ C:\WINDOWS\system32\CDDBUISony.dll <Not Verified; Gracenote; CDDBUIControl Module>
2008-02-13 20:22:52 520192 --a------ C:\WINDOWS\system32\CddbPlaylist2Sony.dll <Not Verified; ; CddbPlaylist2 Module>
2008-02-13 20:22:52 585728 --a------ C:\WINDOWS\system32\CddbMusicIDSony.dll <Not Verified; Gracenote; CddbMusicID Module>
2008-02-13 20:22:52 73728 --a------ C:\WINDOWS\system32\CddbLinkSony.dll <Not Verified; Gracenote; CddbLink Module>
2008-02-13 20:22:52 643072 --a------ C:\WINDOWS\system32\CDDBControlSony.dll <Not Verified; Gracenote, Inc.; CDDBControl Core Module>
2008-02-13 20:22:33 0 d-------- C:\Documents and Settings\All Users\Application Data\Sony Corporation
2008-02-13 20:21:59 0 d-------- C:\Program Files\Sony
2008-02-13 20:21:41 0 d-------- C:\Documents and Settings\Cierno\Application Data\Sony Corporation
2008-02-13 20:21:40 0 d-------- C:\Program Files\Common Files\Sony Shared
2008-02-13 20:20:55 0 d-------- C:\WINDOWS\RegisteredPackages
2008-02-13 01:08:34 0 d-------- C:\Program Files\uTorrent
2008-02-13 01:08:26 0 d-------- C:\Documents and Settings\Cierno\Application Data\uTorrent
2008-02-13 00:55:20 0 d-------- C:\Documents and Settings\Cierno\Application Data\Macromedia
2008-02-13 00:55:20 0 d-------- C:\Documents and Settings\Cierno\Application Data\Adobe
2008-02-13 00:55:17 1158 --a------ C:\WINDOWS\mozver.dat
2008-02-13 00:51:47 0 d-------- C:\Documents and Settings\Cierno\Contacts
2008-02-13 00:51:02 0 d------c- C:\WINDOWS\system32\DRVSTORE
2008-02-13 00:42:32 0 d--hs--c- C:\Program Files\Common Files\WindowsLiveInstaller
2008-02-13 00:42:03 0 d-------- C:\Program Files\Windows Live
2008-02-13 00:41:56 0 d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-02-13 00:28:55 0 d-------- C:\Documents and Settings\Cierno\Application Data\WinRAR
2008-02-13 00:28:12 0 d-------- C:\Program Files\Winamp
2008-02-13 00:24:35 64567 --a------ C:\WINDOWS\BricoPackUninst.cmd
2008-02-13 00:23:40 6116 --a------ C:\WINDOWS\BricoPackFoldersDelete.cmd
2008-02-13 00:23:24 0 d-------- C:\WINDOWS\BricoPacks
2008-02-13 00:14:19 0 --a------ C:\WINDOWS\nsreg.dat
2008-02-13 00:14:18 0 d-------- C:\Documents and Settings\Cierno\Application Data\Mozilla
2008-02-13 00:08:31 41984 -----n--- C:\WINDOWS\Ctregrun.exe <Not Verified; Creative Technology Ltd; Creative On-line Registration System>
2008-02-13 00:08:12 306688 --a------ C:\WINDOWS\IsUninst.exe <Not Verified; InstallShield Software Corporation; InstallShield® unInstaller>
2008-02-13 00:06:03 0 d-------- C:\Program Files\Creative
2008-02-13 00:05:27 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-02-12 22:30:27 298104 --a------ C:\WINDOWS\system32\imon.dll <Not Verified; Eset; NOD32 Antivirus System>
2008-02-12 22:09:38 0 d-------- C:\WINDOWS\system32\PreInstall
2008-02-12 22:05:59 0 d-------- C:\WINDOWS\system32\appmgmt
2008-02-12 21:56:28 0 d-------- C:\WINDOWS\Downloaded Installations
2008-02-12 21:51:28 0 d-------- C:\WINDOWS\system32\LogFiles
2008-02-12 21:45:20 0 d-------- C:\Program Files\VIALAN
2008-02-12 21:27:43 0 d-------- C:\WINDOWS\system32\SoftwareDistribution
2008-02-12 21:24:49 0 d-------- C:\WINDOWS\nview
2008-02-12 21:24:31 0 d-------- C:\NVIDIA
2008-02-12 21:24:01 0 d-------- C:\WINDOWS\system32\NtmsData
2008-02-12 21:07:24 0 d-------- C:\Program Files\Common Files\InstallShield
2008-02-12 21:00:43 0 d-------- C:\Documents and Settings\Cierno\Application Data\Identities
2008-02-12 21:00:37 0 dr------- C:\Documents and Settings\Cierno\Favorites
2008-02-12 21:00:37 0 d-------- C:\Documents and Settings\Cierno\Desktop
2008-02-12 21:00:37 0 d---s---- C:\Documents and Settings\Cierno\Cookies
2008-02-12 21:00:37 0 dr-h----- C:\Documents and Settings\Cierno\Application Data
2008-02-12 21:00:36 0 d--h----- C:\Documents and Settings\Cierno\Templates
2008-02-12 21:00:36 0 dr------- C:\Documents and Settings\Cierno\Start Menu
2008-02-12 21:00:36 0 dr-h----- C:\Documents and Settings\Cierno\SendTo
2008-02-12 21:00:36 0 d--h----- C:\Documents and Settings\Cierno\PrintHood
2008-02-12 21:00:36 1572864 --ah----- C:\Documents and Settings\Cierno\NTUSER.DAT
2008-02-12 21:00:36 0 d--h----- C:\Documents and Settings\Cierno\NetHood
2008-02-12 21:00:36 0 dr------- C:\Documents and Settings\Cierno\My Documents
2008-02-12 21:00:36 0 d--h----- C:\Documents and Settings\Cierno\Local Settings
2008-02-12 20:59:47 0 d-------- C:\WINDOWS\SoftwareDistribution
2008-02-12 20:59:46 0 d---s---- C:\WINDOWS\system32\Microsoft
2008-02-12 20:59:46 0 d-------- C:\WINDOWS\Prefetch
2008-02-12 20:59:45 262144 --ah----- C:\Documents and Settings\LocalService\NTUSER.DAT
2008-02-12 20:59:45 0 d--h----- C:\Documents and Settings\LocalService\Local Settings
2008-02-12 20:59:45 0 d---s---- C:\Documents and Settings\LocalService\Cookies
2008-02-12 20:59:45 0 d-------- C:\Documents and Settings\LocalService\Application Data
2008-02-12 20:59:45 0 d---s---- C:\Documents and Settings\LocalService\Application Data\Microsoft
2008-02-12 20:59:23 0 d--h----- C:\Documents and Settings\NetworkService\Local Settings
2008-02-12 20:59:23 0 d---s---- C:\Documents and Settings\NetworkService\Cookies
2008-02-12 20:59:23 0 d-------- C:\Documents and Settings\NetworkService\Application Data
2008-02-12 20:59:23 0 d---s---- C:\Documents and Settings\NetworkService\Application Data\Microsoft
2008-02-12 20:59:22 262144 --ah----- C:\Documents and Settings\NetworkService\NTUSER.DAT
2008-02-12 20:56:52 0 d-------- C:\WINDOWS\system32\xircom
2008-02-12 20:56:52 0 d-------- C:\Program Files\microsoft frontpage
2008-02-12 20:56:43 262144 --ah----- C:\Documents and Settings\Default User\NTUSER.DAT
2008-02-12 20:56:41 0 d--h----- C:\WINDOWS\$hf_mig$
2008-02-12 20:56:30 0 -rahs---- C:\MSDOS.SYS
2008-02-12 20:56:30 0 -rahs---- C:\IO.SYS
2008-02-12 20:56:30 0 --a------ C:\CONFIG.SYS
2008-02-12 20:56:30 0 --a------ C:\AUTOEXEC.BAT
2008-02-12 20:55:45 0 d--hs---- C:\Documents and Settings\All Users\DRM
2008-02-12 20:55:39 0 dr------- C:\WINDOWS\Offline Web Pages
2008-02-12 20:55:39 0 d---s---- C:\WINDOWS\Downloaded Program Files
2008-02-12 20:55:31 0 d--h----- C:\Program Files\WindowsUpdate
2008-02-12 20:55:18 0 d-------- C:\WINDOWS\system32\DirectX
2008-02-12 20:54:54 0 d---s---- C:\WINDOWS\Tasks
2008-02-12 20:54:53 0 d-------- C:\Program Files\Common Files\MSSoap
2008-02-12 20:54:50 0 d-------- C:\WINDOWS\srchasst
2008-02-12 20:54:49 0 d-------- C:\WINDOWS\system32\Macromed
2008-02-12 20:54:43 0 d-------- C:\Program Files\Movie Maker
2008-02-12 20:54:37 0 d-------- C:\WINDOWS\system32\Restore
2008-02-12 20:54:10 21640 --a------ C:\WINDOWS\system32\emptyregdb.dat
2008-02-12 20:53:57 0 d-------- C:\WINDOWS\Registration
2008-02-12 20:53:51 0 d-------- C:\Program Files\Online Services
2008-02-12 20:53:47 0 d-------- C:\Program Files\Messenger
2008-02-12 20:53:44 0 d-------- C:\Program Files\MSN Gaming Zone
2008-02-12 20:53:17 0 d-------- C:\Program Files\Windows NT
2008-02-12 20:53:14 0 d-------- C:\WINDOWS\system32\MsDtc
2008-02-12 20:53:13 0 d-------- C:\WINDOWS\system32\Com
2008-02-12 12:48:05 0 d--hs---- C:\WINDOWS\Installer
2008-02-12 12:48:04 0 d-------- C:\Program Files\Common Files\ODBC
2008-02-12 12:48:02 0 d-------- C:\Program Files\Common Files\SpeechEngines
2008-02-12 12:48:01 0 dr------- C:\Program Files
2008-02-12 12:48:01 0 d-------- C:\Program Files\Common Files
2008-02-12 12:47:43 0 d--h----- C:\Documents and Settings\Default User\Templates
2008-02-12 12:47:43 0 dr------- C:\Documents and Settings\Default User\Start Menu
2008-02-12 12:47:43 0 dr-h----- C:\Documents and Settings\Default User\SendTo
2008-02-12 12:47:43 0 d--h----- C:\Documents and Settings\Default User\Recent
2008-02-12 12:47:43 0 d--h----- C:\Documents and Settings\Default User\PrintHood
2008-02-12 12:47:43 0 d--h----- C:\Documents and Settings\Default User\NetHood
2008-02-12 12:47:43 0 d-------- C:\Documents and Settings\Default User\My Documents
2008-02-12 12:47:43 0 dr-h----- C:\Documents and Settings\Default User\Local Settings
2008-02-12 12:47:43 0 d-------- C:\Documents and Settings\Default User\Favorites
2008-02-12 12:47:43 0 d-------- C:\Documents and Settings\Default User\Desktop
2008-02-12 12:47:43 0 d---s---- C:\Documents and Settings\Default User\Cookies
2008-02-12 12:47:43 0 d--h----- C:\Documents and Settings\All Users\Templates
2008-02-12 12:47:43 0 dr------- C:\Documents and Settings\All Users\Start Menu
2008-02-12 12:47:43 0 d-------- C:\Documents and Settings\All Users\Favorites
2008-02-12 12:47:43 0 dr------- C:\Documents and Settings\All Users\Documents
2008-02-12 12:47:43 0 d-------- C:\Documents and Settings\All Users\Desktop
2008-02-12 12:47:32 0 d-------- C:\WINDOWS\system32\CatRoot2
2008-02-12 12:47:32 0 d-------- C:\WINDOWS\system32\CatRoot
2008-02-12 12:47:26 0 dr-h----- C:\Documents and Settings\Default User\Application Data
2008-02-12 12:47:26 0 d---s---- C:\Documents and Settings\Default User\Application Data\Microsoft
2008-02-12 12:47:26 0 dr-h----- C:\Documents and Settings\All Users\Application Data
2008-02-12 12:47:26 0 d---s---- C:\Documents and Settings\All Users\Application Data\Microsoft
2008-02-12 12:47:07 0 d-------- C:\Documents and Settings
2008-02-12 12:47:06 0 d--hs---- C:\System Volume Information
2008-02-12 12:41:19 0 d-------- C:\WINDOWS
2008-02-12 12:41:19 0 d-------- C:\WINDOWS\WinSxS
2008-02-12 12:41:19 0 dr------- C:\WINDOWS\Web
2008-02-12 12:41:19 0 d-------- C:\WINDOWS\twain_32
2008-02-12 12:41:19 0 d-------- C:\WINDOWS\system32
2008-02-12 12:41:19 0 d-------- C:\WINDOWS\system32\wins
2008-02-12 12:41:19 0 d-------- C:\WINDOWS\system32\wbem
2008-02-12 12:41:19 0 d-------- C:\WINDOWS\system32\usmt
2008-02-12 12:41:19 0 d-------- C:\WINDOWS\system32\spool
2008-02-12 12:41:19 0 d-------- C:\WINDOWS\system32\ShellExt
2008-02-12 12:41:19 0 d-------- C:\WINDOWS\system32\Setup
2008-02-12 12:41:19 0 d-------- C:\WINDOWS\system32\ras
2008-02-12 12:41:19 0 d-------- C:\WINDOWS\system32\oobe
2008-02-12 12:41:19 0 d-------- C:\WINDOWS\system32\npp
2008-02-12 12:41:19 0 d-------- C:\WINDOWS\system32\mui
2008-02-12 12:41:19 0 d-------- C:\WINDOWS\system32\inetsrv
2008-02-12 12:41:19 0 d-------- C:\WINDOWS\system32\IME
2008-02-12 12:41:19 0 d-------- C:\WINDOWS\system32\icsxml
2008-02-12 12:41:19 0 d-------- C:\WINDOWS\system32\ias
2008-02-12 12:41:19 0 d-------- C:\WINDOWS\system32\export
2008-02-12 12:41:19 0 d-------- C:\WINDOWS\system32\drivers
2008-02-12 12:41:19 0 d-------- C:\WINDOWS\system32\drivers\etc
2008-02-12 12:41:19 0 d-------- C:\WINDOWS\system32\drivers\disdn
2008-02-12 12:41:19 0 dr-hs--c- C:\WINDOWS\system32\dllcache
2008-02-12 12:41:19 0 d-------- C:\WINDOWS\system32\dhcp
2008-02-12 12:41:19 0 d-------- C:\WINDOWS\system32\config
2008-02-12 12:41:19 0 d-------- C:\WINDOWS\system32\3com_dmi
2008-02-12 12:41:19 0 d-------- C:\WINDOWS\system32\3076
2008-02-12 12:41:19 0 d-------- C:\WINDOWS\system32\2052
2008-02-12 12:41:19 0 d-------- C:\WINDOWS\system32\1054
2008-02-12 12:41:19 0 d-------- C:\WINDOWS\system32\1042
2008-02-12 12:41:19 0 d-------- C:\WINDOWS\system32\1041
2008-02-12 12:41:19 0 d-------- C:\WINDOWS\system32\1037
2008-02-12 12:41:19 0 d-------- C:\WINDOWS\system32\1033
2008-02-12 12:41:19 0 d-------- C:\WINDOWS\system32\1031
2008-02-12 12:41:19 0 d-------- C:\WINDOWS\system32\1028
2008-02-12 12:41:19 0 d-------- C:\WINDOWS\system32\1025
2008-02-12 12:41:19 0 d-------- C:\WINDOWS\system
2008-02-12 12:41:19 0 d-------- C:\WINDOWS\security
2008-02-12 12:41:19 0 d-------- C:\WINDOWS\Resources
2008-02-12 12:41:19 0 d-------- C:\WINDOWS\repair
2008-02-12 12:41:19 0 d-------- C:\WINDOWS\Provisioning
2008-02-12 12:41:19 0 d-------- C:\WINDOWS\PeerNet
2008-02-12 12:41:19 0 d-------- C:\WINDOWS\pchealth
2008-02-12 12:41:19 0 d-------- C:\WINDOWS\mui
2008-02-12 12:41:19 0 d-------- C:\WINDOWS\msapps
2008-02-12 12:41:19 0 d-------- C:\WINDOWS\msagent
2008-02-12 12:41:19 0 d-------- C:\WINDOWS\Media
2008-02-12 12:41:19 0 d-------- C:\WINDOWS\java
2008-02-12 12:41:19 0 d--h----- C:\WINDOWS\inf
2008-02-12 12:41:19 0 d-------- C:\WINDOWS\ime
2008-02-12 12:41:19 0 d-------- C:\WINDOWS\Help
2008-02-12 12:41:19 0 dr--s---- C:\WINDOWS\Fonts
2008-02-12 12:41:19 0 d-------- C:\WINDOWS\ehome
2008-02-12 12:41:19 0 d-------- C:\WINDOWS\Driver Cache
2008-02-12 12:41:19 0 d-------- C:\WINDOWS\Debug
2008-02-12 12:41:19 0 d-------- C:\WINDOWS\Cursors
2008-02-12 12:41:19 0 d-------- C:\WINDOWS\Connection Wizard
2008-02-12 12:41:19 0 d-------- C:\WINDOWS\Config
2008-02-12 12:41:19 0 d-------- C:\WINDOWS\AppPatch
2008-02-12 12:41:19 0 d-------- C:\WINDOWS\addins


-- Find3M Report ---------------------------------------------------------------

2008-02-13 00:24:34 218624 --a------ C:\WINDOWS\system32\uxtheme.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-02-12 12:47:43 62 --ahs---- C:\Documents and Settings\Cierno\Application Data\desktop.ini
2007-12-05 01:41:00 1626112 --a------ C:\WINDOWS\system32\nwiz.exe
2007-12-05 01:41:00 1019904 --a------ C:\WINDOWS\system32\nvwimg.dll
2007-12-05 01:41:00 1703936 --a------ C:\WINDOWS\system32\nvwdmcpl.dll
2007-12-05 01:41:00 466944 --a------ C:\WINDOWS\system32\nvshell.dll
2007-12-05 01:41:00 286720 --a------ C:\WINDOWS\system32\nvnt4cpl.dll
2007-12-05 01:41:00 1474560 --a------ C:\WINDOWS\system32\nview.dll
2007-12-05 01:41:00 1339392 --a------ C:\WINDOWS\system32\nvdspsch.exe
2007-12-05 01:41:00 442368 --a------ C:\WINDOWS\system32\nvappbar.exe
2007-12-05 01:41:00 425984 --a------ C:\WINDOWS\system32\keystone.exe


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon "= "C:\WINDOWS\system32\NvCpl.dll" [12/05/2007 01:41 AM]
"nwiz "= "nwiz.exe" [12/05/2007 01:41 AM C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter "= "C:\WINDOWS\system32\NvMcTray.dll" [12/05/2007 01:41 AM]
"nod32kui "= "C:\Program Files\Eset\nod32kui.exe" [02/12/2008 10:29 PM]
"IMJPMIG8.1 "= "C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [02/28/2006 04:00 AM]
"MSPY2002 "= "C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [02/28/2006 04:00 AM]
"PHIME2002ASync "= "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [02/28/2006 04:00 AM]
"PHIME2002A "= "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [02/28/2006 04:00 AM]
"WinampAgent "= "C:\Program Files\Winamp\winampa.exe" [05/14/2007 02:22 PM]
"SunJavaUpdateSched "= "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [09/25/2007 01:11 AM]
"RTHDCPL "= "RTHDCPL.EXE" [01/29/2008 03:47 PM C:\WINDOWS\RTHDCPL.exe]
"NeroFilterCheck "= "C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [01/12/2006 03:40 PM]
"Adobe Reader Speed Launcher "= "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [01/11/2008 10:16 PM]
"HP Software Update "= "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [02/12/2004 01:38 PM]
"HP Component Manager "= "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [05/12/2004 03:18 PM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RocketDock "= "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe" []
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} "= "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [01/15/2007 04:14 PM]
"SsAAD.exe "= "C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe" [05/08/2006 05:17 AM]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [5/28/2004 10:31:38 PM]
HP Image Zone Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [5/28/2004 11:06:36 PM]


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bc1694ba-da6f-11dc-a38f-001731116063}]
sorthb\command- "C:\Program Files\PSP Brew\PSPbrew.exe" /sorthb




-- End of Deckard's System Scanner: finished at 2008-02-24 23:06:56 ------------

 

Hi

Including all the infections on your computer.

You can have programs to "help" keep you clean, But it is mostly up to you, bad computer use makes for bad things getting on your system.

What will you do when you get a infection that turns it into a paper weight?
I've seen it happen.

That being said, it is your computer and your risk.

I will give you some recommendations when we're done here.

OK, Lets get a on-line scan.

Please run ATF Cleaner.

Then do an online scan with Kaspersky WebScanner

Click on "Accept" If your pop "“up blocker blocks the ActiveX download, allow it, click on "Accept" again

You will be promted to install an ActiveX component from Kaspersky, Click Yes or Install.

• The program will launch and then begin downloading the latest definition files:
• Once the files have been downloaded click on NEXT
  
• Now click on Scan Settings
• In the scan settings make that the following are selected:
  • Scan using the following Anti-Virus database:
  • Extended (if available otherwise Standard)
  • Scan Options:
  • Scan Archives
    Scan Mail Bases
• Click OK
• Now under select a target to scan:
  • Select My Computer
• This will start the program and scan your system.
• The scan will take a while so be patient and let it run.
• Once the scan is complete it will display if your system has been infected.
  • Now click on the Save as Text button:
• Save the file to your desktop.
• Copy and paste that information in your next post.

Please post the Kaspersky log.

Thanks
Geri

 

Howdy!

Here's the Kaspersky Scan Log:
-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Sunday, February 24, 2008 11:47:43 AM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 24/02/2008
Kaspersky Anti-Virus database records: 578530
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\
E:\
F:\
G:\
H:\
I:\
J:\
K:\
L:\

Scan Statistics:
Total number of scanned objects: 39897
Number of viruses found: 7
Number of infected objects: 43
Number of suspicious objects: 0
Duration of the scan process: 00:58:28

Infected Object Name / Virus Name / Last Action
C:\Deckard\System Scanner\20080221210653\backup\DOCUME~1\Cierno\LOCALS~1\Temp\NeroDemo12065\Toolbar.exe Infected: not-a-virus:AdTool.Win32.MyWebSearch.bm skipped
C:\Deckard\System Scanner\20080221210653\backup\DOCUME~1\Cierno\LOCALS~1\Temp\UYF4E7\qpfu.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\Cierno\Application Data\Mozilla\Firefox\Profiles\vyijljmu.default\cert8.db Object is locked skipped
C:\Documents and Settings\Cierno\Application Data\Mozilla\Firefox\Profiles\vyijljmu.default\history.dat Object is locked skipped
C:\Documents and Settings\Cierno\Application Data\Mozilla\Firefox\Profiles\vyijljmu.default\key3.db Object is locked skipped
C:\Documents and Settings\Cierno\Application Data\Mozilla\Firefox\Profiles\vyijljmu.default\parent.lock Object is locked skipped
C:\Documents and Settings\Cierno\Application Data\Mozilla\Firefox\Profiles\vyijljmu.default\search.sqlite Object is locked skipped
C:\Documents and Settings\Cierno\Application Data\Mozilla\Firefox\Profiles\vyijljmu.default\urlclassifier2.sqlite Object is locked skipped
C:\Documents and Settings\Cierno\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\Ahead\Nero Home\bl.db Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\Ahead\Nero Home\is2.db Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\ApplicationHistory\hpqgalry.exe.cf8dd223.ini.inuse Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\HP\Digital Imaging\db\administrativeInfo.dbf Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\HP\Digital Imaging\db\albumImagesTable.cdx Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\HP\Digital Imaging\db\albumImagesTable.dbf Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\HP\Digital Imaging\db\albumTable.cdx Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\HP\Digital Imaging\db\albumTable.dbf Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\HP\Digital Imaging\db\CB_Server_Errors.txt Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\HP\Digital Imaging\db\EXIFTable.cdx Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\HP\Digital Imaging\db\EXIFTable.dbf Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\HP\Digital Imaging\db\imageTable.cdx Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\HP\Digital Imaging\db\imageTable.dbf Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\HP\Digital Imaging\db\imageTable.fpt Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\HP\Digital Imaging\db\keywordImagesTable.cdx Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\HP\Digital Imaging\db\keywordImagesTable.dbf Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\HP\Digital Imaging\db\keywordTable.cdx Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\HP\Digital Imaging\db\keywordTable.dbf Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\HP\Digital Imaging\db\managedFolderTable.dbf Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\HP\Digital Imaging\db\pathnameTable.cdx Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\HP\Digital Imaging\db\pathnameTable.dbf Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\HP\Digital Imaging\db\ROFImagesTable.cdx Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\HP\Digital Imaging\db\ROFImagesTable.dbf Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\HP\Digital Imaging\db\ROFTable.cdx Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\HP\Digital Imaging\db\ROFTable.dbf Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\Identities\{52A7385A-2885-4365-80B6-19ED05440A75}\Microsoft\Outlook Express\Folders.dbx Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\Identities\{52A7385A-2885-4365-80B6-19ED05440A75}\Microsoft\Outlook Express\Offline.dbx Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\Microsoft\Messenger\aoki_tenma@hotmail.com\SharingMetadata\Logs\Dfsr00005.log Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\Microsoft\Messenger\aoki_tenma@hotmail.com\SharingMetadata\pending.dat Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\Microsoft\Messenger\aoki_tenma@hotmail.com\SharingMetadata\Working\database_A200_9C1D_9B_F68F\dfsr.db Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\Microsoft\Messenger\aoki_tenma@hotmail.com\SharingMetadata\Working\database_A200_9C1D_9B_F68F\fsr.log Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\Microsoft\Messenger\aoki_tenma@hotmail.com\SharingMetadata\Working\database_A200_9C1D_9B_F68F\fsrtmp.log Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\Microsoft\Messenger\aoki_tenma@hotmail.com\SharingMetadata\Working\database_A200_9C1D_9B_F68F\tmp.edb Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\Microsoft\Windows Live Contacts\aoki_tenma@hotmail.com\real\members.stg Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\Microsoft\Windows Live Contacts\aoki_tenma@hotmail.com\shadow\members.stg Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\Mozilla\Firefox\Profiles\vyijljmu.default\Cache\_CACHE_001_ Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\Mozilla\Firefox\Profiles\vyijljmu.default\Cache\_CACHE_002_ Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\Mozilla\Firefox\Profiles\vyijljmu.default\Cache\_CACHE_003_ Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\Mozilla\Firefox\Profiles\vyijljmu.default\Cache\_CACHE_MAP_ Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Temp\hpodvd09.log Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Temp\~DF872D.tmp Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Temp\~DF8738.tmp Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Temp\~DF8F2A.tmp Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Temp\~DF8F35.tmp Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Temp\~DFD221.tmp Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Cierno\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Cierno\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Program Files\Eset\cache\CACHE.NDB Object is locked skipped
C:\Program Files\Eset\infected\GIGW3ZDA.NQF Infected: Trojan-Downloader.Win32.Agent.jal skipped
C:\Program Files\Eset\infected\GW3NQLAA.NQF/data0000.cab/boehse.exe Infected: Backdoor.Win32.Rbot.hfs skipped
C:\Program Files\Eset\infected\GW3NQLAA.NQF/data0000.cab Infected: Backdoor.Win32.Rbot.hfs skipped
C:\Program Files\Eset\infected\GW3NQLAA.NQF Rsrc-Package: infected - 2 skipped
C:\Program Files\Eset\infected\GW3NQLAA.NQF PE-Crypt.XorPE: infected - 2 skipped
C:\Program Files\Eset\infected\IYLYTBDA.NQF/data0000.cab/boehse.exe Infected: Backdoor.Win32.Rbot.hfs skipped
C:\Program Files\Eset\infected\IYLYTBDA.NQF/data0000.cab Infected: Backdoor.Win32.Rbot.hfs skipped
C:\Program Files\Eset\infected\IYLYTBDA.NQF Rsrc-Package: infected - 2 skipped
C:\Program Files\Eset\infected\IYLYTBDA.NQF PE-Crypt.XorPE: infected - 2 skipped
C:\Program Files\Eset\infected\RKPKZHAA.NQF Infected: Trojan-Downloader.Win32.Small.hsl skipped
C:\Program Files\Eset\logs\virlog.dat Object is locked skipped
C:\Program Files\Eset\logs\warnlog.dat Object is locked skipped
C:\Program Files\HP\hpcoretech\hpcmerr.log Object is locked skipped
C:\QooBox\Quarantine\C\VundoFix Backups\awtqn.dll.bad.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\VundoFix Backups\dviboqeu.dll.bad.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\VundoFix Backups\eurhcwox.dll.bad.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\VundoFix Backups\inowqfnr.dll.bad.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\VundoFix Backups\iysioyfo.dll.bad.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\VundoFix Backups\koimamlm.dll.bad.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\VundoFix Backups\mxxhselk.dll.bad.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\VundoFix Backups\pyhhhfbi.dll.bad.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\itjkmpxo.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\pjrmbhhg.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.ixf skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\ptwcsglv.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.ixe skipped
C:\QooBox\Quarantine\catchme2008-02-24_130545.20.zip/geedd.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\catchme2008-02-24_130545.20.zip ZIP: infected - 1 skipped
C:\QooBox\Quarantine\catchme2008-02-24_225700.67.zip/rqrolli.dll Infected: Trojan-Downloader.Win32.Small.hsl skipped
C:\QooBox\Quarantine\catchme2008-02-24_225700.67.zip ZIP: infected - 1 skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{3492880D-B413-4081-A66F-8D6F50FD8D18}\RP65\A0005718.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{3492880D-B413-4081-A66F-8D6F50FD8D18}\RP67\A0006170.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{3492880D-B413-4081-A66F-8D6F50FD8D18}\RP68\A0006207.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{3492880D-B413-4081-A66F-8D6F50FD8D18}\RP69\A0006387.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{3492880D-B413-4081-A66F-8D6F50FD8D18}\RP69\A0006388.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{3492880D-B413-4081-A66F-8D6F50FD8D18}\RP69\A0006389.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{3492880D-B413-4081-A66F-8D6F50FD8D18}\RP69\A0006390.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{3492880D-B413-4081-A66F-8D6F50FD8D18}\RP69\A0006391.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{3492880D-B413-4081-A66F-8D6F50FD8D18}\RP69\A0006392.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{3492880D-B413-4081-A66F-8D6F50FD8D18}\RP69\A0006393.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{3492880D-B413-4081-A66F-8D6F50FD8D18}\RP69\A0006398.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{3492880D-B413-4081-A66F-8D6F50FD8D18}\RP72\A0006514.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{3492880D-B413-4081-A66F-8D6F50FD8D18}\RP73\A0006539.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{3492880D-B413-4081-A66F-8D6F50FD8D18}\RP73\A0006540.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ixf skipped
C:\System Volume Information\_restore{3492880D-B413-4081-A66F-8D6F50FD8D18}\RP73\A0006541.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ixe skipped
C:\System Volume Information\_restore{3492880D-B413-4081-A66F-8D6F50FD8D18}\RP73\A0006550.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{3492880D-B413-4081-A66F-8D6F50FD8D18}\RP77\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\ODiag.evt Object is locked skipped
C:\WINDOWS\system32\config\OSession.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\drivers\dtscsi.sys Object is locked skipped
C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped
C:\WINDOWS\system32\drivers\sptd8157.sys Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\LogFiles\HTTPERR\httperr1.log Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
D:\System Volume Information\_restore{3492880D-B413-4081-A66F-8D6F50FD8D18}\RP77\change.log Object is locked skipped
J:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
J:\System Volume Information\_restore{3492880D-B413-4081-A66F-8D6F50FD8D18}\RP77\change.log Object is locked skipped

Scan process completed.

 

Hi Selphy

Ok Please do the following.

Click Start>Run in the run box copy and paste or type ComboFix /u then hit Enter to uninstall ComboFix and remove the files/folders it created.


Please clean out your FireFox cashe, here is how.
Open FireFox
Click on Tools
Click on Options
Click on the NetWork tab
In the Cashe, Click Clear Now.
Close the Options window.


You need to clean out the quarantine folder of ESet. (NQF)
I don't have the program, so not sure of the instructions on how to do this. and their web site doesn't say.


We need to turn off and on system restore. There are infections in it and by using system restore you would reinfect yourself.

To turn off Windows XP System Restore:
NOTE: These instructions assume that you are using the default Windows XP Start Menu and have not changed to the Classic Start menu. To re-enable the default menu, right-click Start, click Properties, click Start menu (not Classic) and then click OK.
1. Click Start.
2. Right-click the My Computer icon, and then click Properties.
3. Click the System Restore tab.
4. Check "Turn off System Restore" or "Turn off System Restore on all drives"
5. Click Apply.
6. When turning off System Restore, the existing restore points will be deleted. Click Yes to do this.
7. Click OK.
8. Restart the computer and follow the instructions in the next section to turn on System Restore.

To turn on Windows XP System Restore:
1. Click Start.
2. Right-click My Computer, and then click Properties.
3. Click the System Restore tab.
4. Uncheck "Turn off System Restore" or "Turn off System Restore on all drives. "
5. Click Apply, and then click OK
6. Make a new restore point.
7. Click Start, All Programs, Accessories, System Tools, System Restore.
Chose Create a restore point and clicked Next, Under "Type a description for your restore point…â€put a name in the box,. Click Create. In the next window click Close.

After doing all of the above please do another scan with Kaspersky and post the results.

Thanks
Geri

 

Hello!

I think I cleaned out the quarantine folder of Eset, I dunno though. I opened the program, when to the quarantine section, and just right-click/deleted all the files there.

Kaspersky Log V.2:
-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Sunday, February 24, 2008 2:26:19 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 24/02/2008
Kaspersky Anti-Virus database records: 578541
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\
E:\
F:\
G:\
H:\
I:\
J:\
K:\
L:\

Scan Statistics:
Total number of scanned objects: 31537
Number of viruses found: 0
Number of infected objects: 0
Number of suspicious objects: 0
Duration of the scan process: 01:02:40

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\Cierno\Application Data\Mozilla\Firefox\Profiles\vyijljmu.default\cert8.db Object is locked skipped
C:\Documents and Settings\Cierno\Application Data\Mozilla\Firefox\Profiles\vyijljmu.default\formhistory.dat Object is locked skipped
C:\Documents and Settings\Cierno\Application Data\Mozilla\Firefox\Profiles\vyijljmu.default\history.dat Object is locked skipped
C:\Documents and Settings\Cierno\Application Data\Mozilla\Firefox\Profiles\vyijljmu.default\key3.db Object is locked skipped
C:\Documents and Settings\Cierno\Application Data\Mozilla\Firefox\Profiles\vyijljmu.default\parent.lock Object is locked skipped
C:\Documents and Settings\Cierno\Application Data\Mozilla\Firefox\Profiles\vyijljmu.default\search.sqlite Object is locked skipped
C:\Documents and Settings\Cierno\Application Data\Mozilla\Firefox\Profiles\vyijljmu.default\urlclassifier2.sqlite Object is locked skipped
C:\Documents and Settings\Cierno\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\Ahead\Nero Home\bl.db Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\Ahead\Nero Home\is2.db Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\ApplicationHistory\hpqgalry.exe.cf8dd223.ini.inuse Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\HP\Digital Imaging\db\administrativeInfo.dbf Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\HP\Digital Imaging\db\albumImagesTable.cdx Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\HP\Digital Imaging\db\albumImagesTable.dbf Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\HP\Digital Imaging\db\albumTable.cdx Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\HP\Digital Imaging\db\albumTable.dbf Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\HP\Digital Imaging\db\CB_Server_Errors.txt Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\HP\Digital Imaging\db\EXIFTable.cdx Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\HP\Digital Imaging\db\EXIFTable.dbf Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\HP\Digital Imaging\db\imageTable.cdx Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\HP\Digital Imaging\db\imageTable.dbf Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\HP\Digital Imaging\db\imageTable.fpt Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\HP\Digital Imaging\db\keywordImagesTable.cdx Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\HP\Digital Imaging\db\keywordImagesTable.dbf Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\HP\Digital Imaging\db\keywordTable.cdx Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\HP\Digital Imaging\db\keywordTable.dbf Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\HP\Digital Imaging\db\managedFolderTable.dbf Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\HP\Digital Imaging\db\pathnameTable.cdx Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\HP\Digital Imaging\db\pathnameTable.dbf Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\HP\Digital Imaging\db\ROFImagesTable.cdx Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\HP\Digital Imaging\db\ROFImagesTable.dbf Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\HP\Digital Imaging\db\ROFTable.cdx Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\HP\Digital Imaging\db\ROFTable.dbf Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\Identities\{52A7385A-2885-4365-80B6-19ED05440A75}\Microsoft\Outlook Express\Folders.dbx Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\Identities\{52A7385A-2885-4365-80B6-19ED05440A75}\Microsoft\Outlook Express\Offline.dbx Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\Mozilla\Firefox\Profiles\vyijljmu.default\Cache\_CACHE_001_ Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\Mozilla\Firefox\Profiles\vyijljmu.default\Cache\_CACHE_002_ Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\Mozilla\Firefox\Profiles\vyijljmu.default\Cache\_CACHE_003_ Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Application Data\Mozilla\Firefox\Profiles\vyijljmu.default\Cache\_CACHE_MAP_ Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\History\History.IE5\MSHist012008022420080225\index.dat Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Temp\hpodvd09.log Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Temp\~DFBB48.tmp Object is locked skipped
C:\Documents and Settings\Cierno\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Cierno\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Cierno\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Program Files\Eset\cache\CACHE.NDB Object is locked skipped
C:\Program Files\Eset\logs\virlog.dat Object is locked skipped
C:\Program Files\Eset\logs\warnlog.dat Object is locked skipped
C:\Program Files\HP\hpcoretech\hpcmerr.log Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{3492880D-B413-4081-A66F-8D6F50FD8D18}\RP2\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{8ED99F98-E0B2-42CF-AAE6-6779B9A9CAF7}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\ODiag.evt Object is locked skipped
C:\WINDOWS\system32\config\OSession.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\drivers\dtscsi.sys Object is locked skipped
C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped
C:\WINDOWS\system32\drivers\sptd8157.sys Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
D:\System Volume Information\_restore{3492880D-B413-4081-A66F-8D6F50FD8D18}\RP2\change.log Object is locked skipped
J:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

Scan process completed.

 

Hi Selphy

OK Good that scan came back clean.

You are free from malware...for now.

Please look at this link for some preventive recommendations, It could keep you from ending up back here to the Spyware and Virus Removal Forms.
http://www.windowsbbs.com/showthread.php?t=67958

Here is a web page that may help speed up your computer by miekiemoes.She has some very good suggestions.
http://users.telenet.be/bluepatchy/miekiemoes/slowcomputer.html


I'll mark this one resolved.

Surf Safely
Geri