Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Infected By Zlob.activex Object ....and Maybe More


  • Please log in to reply
15 replies to this topic

#1 Ndipso

Ndipso

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:08:16 PM

Posted 11 April 2008 - 07:00 PM

Hello,

First of all, I want to say how appreciative I am to have found this site!
I have this pesky fake security icon on my task bar, which if you click on it, takes you to a website called virusheat. When ever I open an IE window after that, it takes me to that page. I have tried to correct this issue...with my very limited knowledge. My spybot says I'm affected with this Zlob character. It tries to fix the problem (and actually says that it does), but it comes right back at the next spybot scan. I would highly appreciate any help I could get on this. I have posted my results below:




KASPERSKY ONLINE SCANNER REPORT
Friday, April 11, 2008 7:42:25 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 11/04/2008
Kaspersky Anti-Virus database records: 698498


Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true

Scan Target My Computer
C:\
D:\

Scan Statistics
Total number of scanned objects 108478
Number of viruses found 12
Number of infected objects 27
Number of suspicious objects 4
Duration of the scan process 02:02:37

Infected Object Name Virus Name Last Action
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\27d93284e02e2aad32d279e8089396c7_1dce0e75-1303-433a-bfc1-6b582bd25551 Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\3c11c0f6c513e8a6d63eebdf5b5710c2_1dce0e75-1303-433a-bfc1-6b582bd25551 Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\52ed115f9fe130a24f0d2e4b49d6685b_1dce0e75-1303-433a-bfc1-6b582bd25551 Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\58d6a05ec62d647f76e80bf8a9bb1135_1dce0e75-1303-433a-bfc1-6b582bd25551 Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\6a7ebcc40ff041471351c6b3d786dcd3_1dce0e75-1303-433a-bfc1-6b582bd25551 Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\6fdf136c82e70c89cb0426c07cc615b0_1dce0e75-1303-433a-bfc1-6b582bd25551 Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\8fab25b1af021bc9877daa57d59f72fa_1dce0e75-1303-433a-bfc1-6b582bd25551 Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\9b26a0fd498f161bdac6638ebd75e519_1dce0e75-1303-433a-bfc1-6b582bd25551 Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\febd63402ee797bce29bd67f9e6f9ebf_1dce0e75-1303-433a-bfc1-6b582bd25551 Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\VcodeceMedia4.zip/uninst.exe Suspicious: Password-protected-EXE skipped

C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\VcodeceMedia4.zip ZIP: suspicious - 1 skipped

C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\ZlobVideoActiveXObject5.zip/uninst.exe Suspicious: Password-protected-EXE skipped

C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\ZlobVideoActiveXObject5.zip ZIP: suspicious - 1 skipped

C:\Documents and Settings\DORA\Application Data\Gtek\GTUpdate\AUpdate\DellSupport\DSAgnt.log Object is locked skipped

C:\Documents and Settings\DORA\Application Data\Gtek\GTUpdate\AUpdate\DellSupport\DSAgnt_GTActions.log Object is locked skipped

C:\Documents and Settings\DORA\Application Data\Gtek\GTUpdate\AUpdate\DellSupport\gdql_d_DSAgnt.log Object is locked skipped

C:\Documents and Settings\DORA\Application Data\Gtek\GTUpdate\AUpdate\DellSupport\glog.log Object is locked skipped

C:\Documents and Settings\DORA\Cookies\INDEX.DAT Object is locked skipped

C:\Documents and Settings\DORA\Local Settings\Application Data\ApplicationHistory\TransferAgent.exe.91f03f4d.ini.inuse Object is locked skipped

C:\Documents and Settings\DORA\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\DORA\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\DORA\Local Settings\History\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\DORA\Local Settings\History\History.IE5\MSHist012008041120080412\index.dat Object is locked skipped

C:\Documents and Settings\DORA\Local Settings\Temp\~DF40AE.tmp Object is locked skipped

C:\Documents and Settings\DORA\Local Settings\Temporary Internet Files\Content.IE5\FXXUBJ3H\bind[1].htm Object is locked skipped

C:\Documents and Settings\DORA\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\DORA\ntuser.dat Object is locked skipped

C:\Documents and Settings\DORA\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\african front.pub Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\African Frontline.pub Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\Airticket letter.doc Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\C V.doc Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\Capital One Online Account Services Pay My Bill - Step 3 of 3.htm Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\Corel User Files\11\Projects.usr Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\Corel User Files\WT11US.HST Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\Corel User Files\WT11US.UWL Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\cv 2.doc Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\dentists.htm Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\DESKTOP.INI Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\Freelance 1.pub Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\fuel 101.doc Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\HIV cycle.gif Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\hiv_image.gif Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\katrina.doc Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\letterhead1.wpd Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\Mail-In Rebate Center.htm Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\Mail-In Rebate Center_files\common32.js Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\Mail-In Rebate Center_files\css.aspx Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\Mail-In Rebate Center_files\download.gif Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\Mail-In Rebate Center_files\hier.gif Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\Mail-In Rebate Center_files\img.gif Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\Mail-In Rebate Center_files\left.gif Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\Mail-In Rebate Center_files\light.gif Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\Mail-In Rebate Center_files\logo.gif Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\Mail-In Rebate Center_files\main.gif Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\Mail-In Rebate Center_files\menu.aspx Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\Mail-In Rebate Center_files\pdf.gif Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\Mail-In Rebate Center_files\primary.gif Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\Mail-In Rebate Center_files\secondary.gif Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\Mail-In Rebate Center_files\shad.gif Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\Mail-In Rebate Center_files\smextlink.gif Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\Mail-In Rebate Center_files\spacer.gif Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\Mail-In Rebate Center_files\viewlarger.gif Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\My Music\Desktop.ini Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\My Music\Sample Music.lnk Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\My Music\Unknown Artist\desktop.ini Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\My Pictures\applyForJob.htm Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\My Pictures\applyForJob_files\globalprocedures.js Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\My Pictures\Big City\City001.JPG Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\My Pictures\Big City\City002.jpg Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\My Pictures\Big City\City003.JPG Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\My Pictures\Big City\City004.jpg Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\My Pictures\Big City\City005.JPG Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\My Pictures\Big City\Thumbs.db Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\My Pictures\Desktop.ini Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\My Pictures\Flowers001.JPG Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\My Pictures\Flowers002.JPG Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\My Pictures\Flowers003.JPG Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\My Pictures\Flowers004.JPG Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\My Pictures\Flowers005.JPG Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\My Pictures\Flowers006.JPG Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\My Pictures\Jasc Paint Shop Photo Album Images\blue dress (2).jpg Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\My Pictures\Jasc Paint Shop Photo Album Images\Thumbs.db Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\My Pictures\Sample Pictures.lnk Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\My Pictures\Scenic\Scenic001.jpg Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\My Pictures\Scenic\Scenic002.jpg Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\My Pictures\Scenic\Scenic003.jpg Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\My Pictures\Scenic\Scenic004.JPG Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\My Pictures\Scenic\Scenic005.JPG Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\My Pictures\Scenic\Scenic006.JPG Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\My Pictures\Scenic\Scenic007.JPG Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\My Pictures\Scenic\Scenic008.JPG Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\My Pictures\Scenic\Scenic009.jpg Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\My Pictures\Scenic\Thumbs.db Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\My Pictures\Thumbs.db Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\My PSP8 Files\Scripts-Restricted\BoundScript1.PspScript Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\My PSP8 Files\Scripts-Restricted\BoundScript2.PspScript Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\My PSP8 Files\Scripts-Restricted\BoundScript3.PspScript Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\My PSP8 Files\Scripts-Restricted\BoundScript4.PspScript Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\My PSP8 Files\Scripts-Restricted\BoundScript5.PspScript Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\My PSP8 Files\Scripts-Restricted\BoundScript6.PspScript Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\My PSP8 Files\Scripts-Restricted\BoundScript7.PspScript Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\My PSP8 Files\Scripts-Restricted\BoundScript8.PspScript Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\My PSP8 Files\Scripts-Restricted\BoundScript9.PspScript Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\My PSP8 Files\Workspaces\Default.PSPWorkspace Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\My RoboForm Data\Default Profile\options.rfo Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\My RoboForm Data\Default Profile\RoboFormDataHere.txt Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\My Videos\Experience.mpg Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\My Videos\Thumbs.db Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\New Settings File.OPS Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\Outline.doc Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\Papa's CV.doc Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\papa's report.doc Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\phon payment.mht Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\resumes\Adele[1].doc Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\resumes\Martha I.wpd Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\resumes\Prince Donkor 2122 Hopkins Place Court Duluth.wpd Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\resumes\References.doc Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\resumes\~$ele Ako.doc Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\resumes\~WRL0001.tmp Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\spider.sav Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\WinXP\ltdfxp.cat Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\WinXP\ltdfxp.inf Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\WinXP\ltmdmxp.sys Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\WinXP\LtMoh.exe Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\WinXP\LTMOH.INI Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\WinXP\LTMSG.EXE Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\WinXP\ltremove.exe Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\WinXP\LTSETUP.INI Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\WinXP\ltsetup1.dll Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\WinXP\ltsetup2.dll Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\WinXP\mohapi.dll Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\WinXP\setup.exe Object is locked skipped

C:\Documents and Settings\ENOW\My Documents\~WRL3010.tmp Object is locked skipped

C:\Documents and Settings\LocalService\Cookies\INDEX.DAT Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\INDEX.DAT Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\INDEX.DAT Object is locked skipped

C:\Documents and Settings\LocalService\ntuser.dat Object is locked skipped

C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\MONICA\Favorites\locks\ 31 New .url Object is locked skipped

C:\Documents and Settings\MONICA\Favorites\locks\ FoZ.url Object is locked skipped

C:\Documents and Settings\MONICA\Favorites\locks\ guerilla sports .url Object is locked skipped

C:\Documents and Settings\MONICA\Favorites\locks\ invizibletouch.url Object is locked skipped

C:\Documents and Settings\MONICA\Favorites\locks\ Kong - Kong.url Object is locked skipped

C:\Documents and Settings\MONICA\Favorites\locks\ n Thigh.url Object is locked skipped

C:\Documents and Settings\MONICA\Favorites\locks\ Sir Rodney.url Object is locked skipped

C:\Documents and Settings\MONICA\Favorites\locks\ the net.url Object is locked skipped

C:\Documents and Settings\MONICA\Favorites\locks\100% FREE.url Object is locked skipped

C:\Documents and Settings\MONICA\Favorites\locks\18-19.url Object is locked skipped

C:\Documents and Settings\MONICA\Favorites\locks\Asia capoera.url Object is locked skipped

C:\Documents and Settings\MONICA\Favorites\locks\Audio Converter Home Page.url Object is locked skipped

C:\Documents and Settings\MONICA\Favorites\locks\bdex .url Object is locked skipped

C:\Documents and Settings\MONICA\Favorites\locks\Big-boys Picture Gallery XXI.url Object is locked skipped

C:\Documents and Settings\MONICA\Favorites\locks\Bon.url Object is locked skipped

C:\Documents and Settings\MONICA\Favorites\locks\Boobler.url Object is locked skipped

C:\Documents and Settings\MONICA\Favorites\locks\camer-hamburg Index.url Object is locked skipped

C:\Documents and Settings\MONICA\Favorites\locks\ChickLinks.url Object is locked skipped

C:\Documents and Settings\MONICA\Favorites\locks\Coyote.url Object is locked skipped

C:\Documents and Settings\MONICA\Favorites\locks\Customize Links.url Object is locked skipped

C:\Documents and Settings\MONICA\Favorites\locks\D12 World .url Object is locked skipped

C:\Documents and Settings\MONICA\Favorites\locks\Daily .url Object is locked skipped

C:\Documents and Settings\MONICA\Favorites\locks\Dailymotion - .url Object is locked skipped

C:\Documents and Settings\MONICA\Favorites\locks\DREAMS.url Object is locked skipped

C:\Documents and Settings\MONICA\Favorites\locks\enchthumb.url Object is locked skipped

C:\Documents and Settings\MONICA\Favorites\locks\Favorite Thumbs.url Object is locked skipped

C:\Documents and Settings\MONICA\Favorites\locks\Filipina .url Object is locked skipped

C:\Documents and Settings\MONICA\Favorites\locks\Flixarchive.org .url Object is locked skipped

C:\Documents and Settings\MONICA\Favorites\locks\GorillaMask.url Object is locked skipped

C:\Documents and Settings\MONICA\Favorites\locks\Guy.url Object is locked skipped

C:\Documents and Settings\MONICA\Favorites\locks\Hall Of Fame.url Object is locked skipped

C:\Documents and Settings\MONICA\Favorites\locks\hawtala!!!.url Object is locked skipped

C:\Documents and Settings\MONICA\Favorites\locks\icanVag.url Object is locked skipped

C:\Documents and Settings\MONICA\Favorites\locks\Japanese.url Object is locked skipped

C:\Documents and Settings\MONICA\Favorites\locks\maddux.url Object is locked skipped

C:\Documents and Settings\MONICA\Favorites\locks\Modelos Colombianas .url Object is locked skipped

C:\Documents and Settings\MONICA\Favorites\locks\Paradise.url Object is locked skipped

C:\Documents and Settings\MONICA\Favorites\locks\Photo Blog.url Object is locked skipped

C:\Documents and Settings\MONICA\Favorites\locks\Playground.url Object is locked skipped

C:\Documents and Settings\MONICA\Favorites\locks\Poisonous Plants and Animals.url Object is locked skipped

C:\Documents and Settings\MONICA\Favorites\locks\Real-.url Object is locked skipped

C:\Documents and Settings\MONICA\Favorites\locks\RealPlayer.url Object is locked skipped

C:\Documents and Settings\MONICA\Favorites\locks\Rotten Library.url Object is locked skipped

C:\Documents and Settings\MONICA\Favorites\locks\rotten.com .url Object is locked skipped

C:\Documents and Settings\MONICA\Favorites\locks\RUTHLESS REVIEWS .url Object is locked skipped

C:\Documents and Settings\MONICA\Favorites\locks\Scammer-Possibility Evaluation.url Object is locked skipped

C:\Documents and Settings\MONICA\Favorites\locks\Something Awful .url Object is locked skipped

C:\Documents and Settings\MONICA\Favorites\locks\Sports.url Object is locked skipped

C:\Documents and Settings\MONICA\Favorites\locks\SPUNK .url Object is locked skipped

C:\Documents and Settings\MONICA\Favorites\locks\The HoneyDripper.url Object is locked skipped

C:\Documents and Settings\MONICA\Favorites\locks\The Superficial - Because You're Ugly.url Object is locked skipped

C:\Documents and Settings\MONICA\Favorites\locks\The.Net ~ .url Object is locked skipped

C:\Documents and Settings\MONICA\Favorites\locks\Thumbs.db Object is locked skipped

C:\Documents and Settings\MONICA\Favorites\locks\Thumbz TGP .url Object is locked skipped

C:\Documents and Settings\MONICA\Favorites\locks\totally free .url Object is locked skipped

C:\Documents and Settings\MONICA\Favorites\locks\TYGOOD .url Object is locked skipped

C:\Documents and Settings\MONICA\Favorites\locks\Whale Tail .url Object is locked skipped

C:\Documents and Settings\MONICA\Favorites\locks\X-Blog.url Object is locked skipped

C:\Documents and Settings\MONICA\Favorites\locks\YUOKE Galleries ).url Object is locked skipped

C:\Documents and Settings\MONICA\My Documents\My Pictures\wandaz\personal1\mbokotam\10-08-06_1733.jpg Object is locked skipped

C:\Documents and Settings\MONICA\My Documents\My Pictures\wandaz\personal1\mbokotam\balckstrip.jpg Object is locked skipped

C:\Documents and Settings\MONICA\My Documents\My Pictures\wandaz\personal1\mbokotam\beribona.JPG Object is locked skipped

C:\Documents and Settings\MONICA\My Documents\My Pictures\wandaz\personal1\mbokotam\checkerd.jpg Object is locked skipped

C:\Documents and Settings\MONICA\My Documents\My Pictures\wandaz\personal1\mbokotam\davbday 001.jpg Object is locked skipped

C:\Documents and Settings\MONICA\My Documents\My Pictures\wandaz\personal1\mbokotam\davbday 002.jpg Object is locked skipped

C:\Documents and Settings\MONICA\My Documents\My Pictures\wandaz\personal1\mbokotam\davbday 003.jpg Object is locked skipped

C:\Documents and Settings\MONICA\My Documents\My Pictures\wandaz\personal1\mbokotam\davmicky.jpg Object is locked skipped

C:\Documents and Settings\MONICA\My Documents\My Pictures\wandaz\personal1\mbokotam\fif1.jpg Object is locked skipped

C:\Documents and Settings\MONICA\My Documents\My Pictures\wandaz\personal1\mbokotam\homealone 001.jpg Object is locked skipped

C:\Documents and Settings\MONICA\My Documents\My Pictures\wandaz\personal1\mbokotam\homealone 003.jpg Object is locked skipped

C:\Documents and Settings\MONICA\My Documents\My Pictures\wandaz\personal1\mbokotam\homealone 006.jpg Object is locked skipped

C:\Documents and Settings\MONICA\My Documents\My Pictures\wandaz\personal1\mbokotam\homealone 007.jpg Object is locked skipped

C:\Documents and Settings\MONICA\My Documents\My Pictures\wandaz\personal1\mbokotam\homealone.jpg Object is locked skipped

C:\Documents and Settings\MONICA\My Documents\My Pictures\wandaz\personal1\mbokotam\IM000620.JPG Object is locked skipped

C:\Documents and Settings\MONICA\My Documents\My Pictures\wandaz\personal1\mbokotam\IM000621.JPG Object is locked skipped

C:\Documents and Settings\MONICA\My Documents\My Pictures\wandaz\personal1\mbokotam\IM000622.JPG Object is locked skipped

C:\Documents and Settings\MONICA\My Documents\My Pictures\wandaz\personal1\mbokotam\jujuboy.JPG Object is locked skipped

C:\Documents and Settings\MONICA\My Documents\My Pictures\wandaz\personal1\mbokotam\mboko.JPG Object is locked skipped

C:\Documents and Settings\MONICA\My Documents\My Pictures\wandaz\personal1\mbokotam\musket.jpg Object is locked skipped

C:\Documents and Settings\MONICA\My Documents\My Pictures\wandaz\personal1\mbokotam\pacman2.jpg Object is locked skipped

C:\Documents and Settings\MONICA\My Documents\My Pictures\wandaz\personal1\mbokotam\posta.JPG Object is locked skipped

C:\Documents and Settings\MONICA\My Documents\My Pictures\wandaz\personal1\mbokotam\silowet.JPG Object is locked skipped

C:\Documents and Settings\MONICA\My Documents\My Pictures\wandaz\personal1\mbokotam\Thumbs.db Object is locked skipped

C:\Documents and Settings\MONICA\My Documents\My Pictures\wandaz\personal1\mbokotam\whitehat.jpg Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped

C:\Downloads\PrimeSuspectsGENSetup-dm[1].exe Infected: not-a-virus:AdWare.Win32.Trymedia.b skipped

C:\Program Files\HP\hpcoretech\hpcmerr.log Object is locked skipped

C:\RECYCLER\S-1-5-21-915312027-855725967-943491430-1007\Dc179.doc Object is locked skipped

C:\RECYCLER\S-1-5-21-915312027-855725967-943491430-1007\Dc180.pub Object is locked skipped

C:\RECYCLER\S-1-5-21-915312027-855725967-943491430-1007\Dc181.wpd Object is locked skipped

C:\RECYCLER\S-1-5-21-915312027-855725967-943491430-1007\Dc185.wma Object is locked skipped

C:\RECYCLER\S-1-5-21-915312027-855725967-943491430-1007\Dc186.wma Object is locked skipped

C:\RECYCLER\S-1-5-21-915312027-855725967-943491430-1007\Dc187.wma Object is locked skipped

C:\RECYCLER\S-1-5-21-915312027-855725967-943491430-1007\Dc188.wma Object is locked skipped

C:\RECYCLER\S-1-5-21-915312027-855725967-943491430-1007\Dc189.wma Object is locked skipped

C:\RECYCLER\S-1-5-21-915312027-855725967-943491430-1007\Dc190.wma Object is locked skipped

C:\RECYCLER\S-1-5-21-915312027-855725967-943491430-1007\Dc191.wma Object is locked skipped

C:\RECYCLER\S-1-5-21-915312027-855725967-943491430-1007\Dc192.wma Object is locked skipped

C:\RECYCLER\S-1-5-21-915312027-855725967-943491430-1007\Dc193.wma Object is locked skipped

C:\RECYCLER\S-1-5-21-915312027-855725967-943491430-1007\Dc194.wma Object is locked skipped

C:\RECYCLER\S-1-5-21-915312027-855725967-943491430-1007\Dc195.wma Object is locked skipped

C:\RECYCLER\S-1-5-21-915312027-855725967-943491430-1007\Dc196.wma Object is locked skipped

C:\RECYCLER\S-1-5-21-915312027-855725967-943491430-1007\Dc197.wma Object is locked skipped

C:\RECYCLER\S-1-5-21-915312027-855725967-943491430-1007\Dc198.wma Object is locked skipped

C:\RECYCLER\S-1-5-21-915312027-855725967-943491430-1007\Dc199.wma Object is locked skipped

C:\RECYCLER\S-1-5-21-915312027-855725967-943491430-1007\Dc200.wma Object is locked skipped

C:\RECYCLER\S-1-5-21-915312027-855725967-943491430-1007\Dc201.wma Object is locked skipped

C:\RECYCLER\S-1-5-21-915312027-855725967-943491430-1007\Dc202.wma Object is locked skipped

C:\RECYCLER\S-1-5-21-915312027-855725967-943491430-1007\Dc203.wma Object is locked skipped

C:\RECYCLER\S-1-5-21-915312027-855725967-943491430-1007\Dc204.wma Object is locked skipped

C:\RECYCLER\S-1-5-21-915312027-855725967-943491430-1007\Dc205.wma Object is locked skipped

C:\RECYCLER\S-1-5-21-915312027-855725967-943491430-1007\Dc206.wma Object is locked skipped

C:\RECYCLER\S-1-5-21-915312027-855725967-943491430-1007\Dc207.wma Object is locked skipped

C:\RECYCLER\S-1-5-21-915312027-855725967-943491430-1007\Dc208.wma Object is locked skipped

C:\RECYCLER\S-1-5-21-915312027-855725967-943491430-1007\Dc209.wma Object is locked skipped

C:\RECYCLER\S-1-5-21-915312027-855725967-943491430-1007\Dc210.wma Object is locked skipped

C:\RECYCLER\S-1-5-21-915312027-855725967-943491430-1007\Dc211.wma Object is locked skipped

C:\RECYCLER\S-1-5-21-915312027-855725967-943491430-1007\Dc212.wma Object is locked skipped

C:\RECYCLER\S-1-5-21-915312027-855725967-943491430-1007\Dc213.wma Object is locked skipped

C:\RECYCLER\S-1-5-21-915312027-855725967-943491430-1007\Dc214.wma Object is locked skipped

C:\RECYCLER\S-1-5-21-915312027-855725967-943491430-1007\Dc215.wma Object is locked skipped

C:\RECYCLER\S-1-5-21-915312027-855725967-943491430-1007\Dc216.wma Object is locked skipped

C:\RECYCLER\S-1-5-21-915312027-855725967-943491430-1007\Dc217.wma Object is locked skipped

C:\RECYCLER\S-1-5-21-915312027-855725967-943491430-1007\Dc218.wma Object is locked skipped

C:\RECYCLER\S-1-5-21-915312027-855725967-943491430-1007\Dc219.wma Object is locked skipped

C:\RECYCLER\S-1-5-21-915312027-855725967-943491430-1007\Dc220.wma Object is locked skipped

C:\RECYCLER\S-1-5-21-915312027-855725967-943491430-1007\Dc221.wma Object is locked skipped

C:\RECYCLER\S-1-5-21-915312027-855725967-943491430-1007\Dc222.wma Object is locked skipped

C:\RECYCLER\S-1-5-21-915312027-855725967-943491430-1007\Dc223.wma Object is locked skipped

C:\RECYCLER\S-1-5-21-915312027-855725967-943491430-1007\Dc224.wma Object is locked skipped

C:\RECYCLER\S-1-5-21-915312027-855725967-943491430-1007\Dc225.wma Object is locked skipped

C:\RECYCLER\S-1-5-21-915312027-855725967-943491430-1007\Dc226.wma Object is locked skipped

C:\RECYCLER\S-1-5-21-915312027-855725967-943491430-1007\Dc227.wma Object is locked skipped

C:\RECYCLER\S-1-5-21-915312027-855725967-943491430-1007\Dc228.wma Object is locked skipped

C:\RECYCLER\S-1-5-21-915312027-855725967-943491430-1007\Dc229.wma Object is locked skipped

C:\RECYCLER\S-1-5-21-915312027-855725967-943491430-1007\Dc230.wma Object is locked skipped

C:\RECYCLER\S-1-5-21-915312027-855725967-943491430-1007\Dc231.wma Object is locked skipped

C:\RECYCLER\S-1-5-21-915312027-855725967-943491430-1007\Dc232.wma Object is locked skipped

C:\RECYCLER\S-1-5-21-915312027-855725967-943491430-1007\Dc233.wma Object is locked skipped

C:\RECYCLER\S-1-5-21-915312027-855725967-943491430-1007\Dc234.mp3 Object is locked skipped

C:\RECYCLER\S-1-5-21-915312027-855725967-943491430-1007\Dc235.mp3 Object is locked skipped

C:\RECYCLER\S-1-5-21-915312027-855725967-943491430-1007\Dc238.mp3 Object is locked skipped

C:\RECYCLER\S-1-5-21-915312027-855725967-943491430-1007\Dc239.mp3 Object is locked skipped

C:\RECYCLER\S-1-5-21-915312027-855725967-943491430-1007\Dc240.mp3 Object is locked skipped

C:\RECYCLER\S-1-5-21-915312027-855725967-943491430-1007\Dc241.mp3 Object is locked skipped

C:\RECYCLER\S-1-5-21-915312027-855725967-943491430-1007\Dc242.mp3 Object is locked skipped

C:\RECYCLER\S-1-5-21-915312027-855725967-943491430-1007\Dc244.mp3 Object is locked skipped

C:\RECYCLER\S-1-5-21-915312027-855725967-943491430-1007\Dc245.mp3 Object is locked skipped

C:\RECYCLER\S-1-5-21-915312027-855725967-943491430-1007\Dc246.mp3 Object is locked skipped

C:\RECYCLER\S-1-5-21-915312027-855725967-943491430-1007\Dc247.mp3 Object is locked skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1419\A0120985.exe Infected: Trojan-Downloader.Win32.Zlob.kue skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1419\A0120997.dll Infected: Trojan-Downloader.Win32.Zlob.kyi skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1419\A0120998.exe Infected: Trojan-Downloader.Win32.Zlob.kux skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1419\A0121010.exe Infected: Trojan-Downloader.Win32.Zlob.kux skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1419\A0121011.dll Infected: Trojan-Downloader.Win32.Zlob.kyi skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1419\A0121012.exe Infected: Trojan-Downloader.Win32.Zlob.kue skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1419\A0121021.dll Infected: Trojan-Downloader.Win32.Zlob.kyi skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1419\A0121022.exe Infected: Trojan-Downloader.Win32.Zlob.kux skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1419\A0121025.exe Infected: Trojan-Downloader.Win32.Zlob.kue skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1419\A0121099.exe Infected: Trojan-Downloader.Win32.Zlob.kux skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1419\A0121100.dll Infected: Trojan-Downloader.Win32.Zlob.kyi skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1419\A0121101.exe Infected: Trojan-Downloader.Win32.Zlob.kue skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1419\A0121110.dll Infected: Trojan-Downloader.Win32.Zlob.kyi skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1419\A0121111.exe Infected: Trojan-Downloader.Win32.Zlob.kux skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1419\A0121112.exe Infected: Trojan-Downloader.Win32.Zlob.kue skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1421\A0122150.exe Infected: Trojan-Downloader.Win32.Zlob.kux skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1421\A0122151.dll Infected: Trojan-Downloader.Win32.Zlob.kyi skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1421\A0122152.exe Infected: Trojan-Downloader.Win32.Zlob.kue skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1421\A0122159.exe Infected: Trojan-Downloader.Win32.Zlob.kvd skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1421\A0122160.exe Infected: Trojan-Downloader.Win32.Zlob.kyy skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1421\A0122166.dll Infected: Trojan-Downloader.Win32.Zlob.kyi skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1421\A0123187.dll Infected: Trojan-Downloader.Win32.Zlob.kye skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1422\A0123421.dll Infected: not-a-virus:AdTool.Win32.MyWebSearch.i skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1422\A0123422.scr Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1428\change.log Object is locked skipped

C:\WINDOWS\$NtUninstallKB833407$\bssym7.ttf Object is locked skipped

C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

C:\WINDOWS\SchedLgU.Txt Object is locked skipped

C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped

C:\WINDOWS\Sti_Trace.log Object is locked skipped

C:\WINDOWS\SYSTEM32\209789\209789.dll Infected: not-a-virus:AdWare.Win32.E404.w skipped

C:\WINDOWS\SYSTEM32\CatRoot2\edb.log Object is locked skipped

C:\WINDOWS\SYSTEM32\CatRoot2\tmp.edb Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\AppEvent.Evt Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\Internet.evt Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\Paramete.evt Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\SAM Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\SecEvent.Evt Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\SECURITY Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\SysEvent.Evt Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG Object is locked skipped

C:\WINDOWS\SYSTEM32\dcggain.dll Infected: not-virus:Hoax.Win32.Agent.bv skipped

C:\WINDOWS\SYSTEM32\H323LOG.TXT Object is locked skipped

C:\WINDOWS\SYSTEM32\LogFiles\WUDF\WUDFTrace.etl Object is locked skipped

C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.BTR Object is locked skipped

C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.MAP Object is locked skipped

C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING.VER Object is locked skipped

C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING1.MAP Object is locked skipped

C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING2.MAP Object is locked skipped

C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.DATA Object is locked skipped

C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.MAP Object is locked skipped

C:\WINDOWS\WIADEBUG.LOG Object is locked skipped

C:\WINDOWS\WIASERVC.LOG Object is locked skipped

C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.



Deckard's System Scanner v20071014.68 (Main)
Run by DORA on 2008-04-11 17:03:43
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Successfully created a Deckard's System Scanner Restore Point.


-- Last 5 Restore Point(s) --
27: 2008-04-11 21:04:02 UTC - RP1428 - Deckard's System Scanner Restore Point
26: 2008-04-11 05:13:17 UTC - RP1427 - System Checkpoint
25: 2008-04-10 02:43:11 UTC - RP1426 - Software Distribution Service 3.0
24: 2008-04-09 03:56:58 UTC - RP1425 - System Checkpoint
23: 2008-04-07 22:40:09 UTC - RP1424 - System Checkpoint


-- First Restore Point --
1: 2008-03-19 22:23:24 UTC - RP1402 - Printer Driver Lexmark Print-2-Fax Printer Installed


Backed up registry hives.
Performed disk cleanup.

System Drive C: has 1.06 GiB (less than 15%) free.


-- HijackThis (run as DORA.exe) ------------------------------------------------

Unable to find log (file not found); running clone.
-- HijackThis Clone ------------------------------------------------------------


Emulating logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2008-04-11 17:09:19
Platform: Windows XP Service Pack 2 (5.01.2600)
MSIE: Internet Explorer (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\SYSTEM32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\SYSTEM32\services.exe
C:\WINDOWS\SYSTEM32\lsass.exe
C:\WINDOWS\SYSTEM32\svchost.exe
C:\WINDOWS\SYSTEM32\svchost.exe
C:\WINDOWS\SYSTEM32\svchost.exe
C:\ad adware\aawservice.exe
C:\WINDOWS\SYSTEM32\spoolsv.exe
C:\WINDOWS\SYSTEM32\svchost.exe
C:\WINDOWS\SYSTEM32\lxddcoms.exe
C:\WINDOWS\SYSTEM32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Lexmark 2500 Series\lxddmon.exe
C:\Program Files\Lexmark 2500 Series\lxddamon.exe
C:\Program Files\NovaStor\NovaBACKUP\NBKCTRL.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\SYSTEM32\hkcmd.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\SYSTEM32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\NovaStor\NovaBACKUP\NSENGINE.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\CASIO\Photo Loader\Plauto.exe
C:\Program Files\Yahoo!\Messenger\Ymsgr_tray.exe
C:\WINDOWS\SYSTEM32\wscntfy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Documents and Settings\DORA\Desktop\dss.exe
C:\Program Files\Trend Micro\HijackThis\DORA.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.com/search?q=%s
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,(Default) = http://www.google.com
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - __BHODemonDisabled (file missing)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - __BHODemonDisabled (file missing)
O2 - BHO: (no name) - {8CA5ED52-F3FB-4414-A105-2E3491156990} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\GoogleToolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\GoogleToolbar2.dll
O4 - HKLM\..\Run: [lxddmon.exe] "C:\Program Files\Lexmark 2500 Series\lxddmon.exe"
O4 - HKLM\..\Run: [lxddamon] "C:\Program Files\Lexmark 2500 Series\lxddamon.exe"
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\Support.com\BellSouth\hcenter.exe" /starthidden /tgcmdwrapper
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NovaBackup 7 Tray Control] "C:\Program Files\NovaStor\NovaBACKUP\NbkCtrl.exe"
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [FRISK FP-Scheduler] C:\Program Files\FSI\F-Prot\F-Sched.exe STARTUP
O4 - HKLM\..\Run: [F-StopW] C:\Program Files\FSI\F-Prot\F-StopW.EXE
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [DellTransferAgent] "C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Red Swoosh EDN Client] C:\Program Files\RSSoft\RSEDNClient.exe
O4 - HKCU\..\Run: [NetZero_uoltray] C:\Program Files\NetZero\exec.exe regrun
O4 - HKUS\S-1-5-18\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = ?
O4 - Global Startup: Photo Loader supervisory.lnk = C:\Program Files\CASIO\Photo Loader\Plauto.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/...arch.jhtml?p=ZS
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Display All Images with Full Quality - res://C:\Program Files\NetZero\qsacc\appres.dll/228
O8 - Extra context menu item: Display Image with Full Quality - res://C:\Program Files\NetZero\qsacc\appres.dll/227
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: (no name) - CmdMapping - (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O15 - Trusted IP Range: (HKLM)
O16 - DPF: {001EE746-A1F9-460E-80AD-269E088D6A01} (Infotl Control) - http://0-site.ebrary.com.olinkserver.frank...s/ebraryRdr.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://fpdownload.macromedia.com/get/shock...director/sw.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} () - http://download.mcafee.com/molbin/shared/m...01/mcinsctl.cab
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} () - http://fpdownload.macromedia.com/get/flash...t/ultrashim.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} () - http://download.mcafee.com/molbin/shared/m...,26/mcgdmgr.cab
O16 - DPF: {D6E7CFB5-C074-4D1C-B647-663D1A8D96BF} (Facebook Photo Uploader 4) - http://upload.facebook.com/controls/Facebo...Uploader4_5.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll
O18 - Protocol: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll
O18 - Protocol: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL
O18 - Protocol: mso-offdap11 - {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL
O18 - Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL
O20 - Winlogon Notify: SDNotify - C:\Program Files\SpywareDetector\SDNotify.dll (file missing)
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\system32\WRLogonNTF.dll (file missing)
O22 - SharedTaskScheduler: hirtellous - {fa19bd7e-50bc-4203-80ac-c4edc81ca9a3} - (no file)
O22 - SharedTaskScheduler: important - {9c87cb31-93d0-4f3e-a360-4a91ff77aeb7} - C:\WINDOWS\SYSTEM32\dcggain.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\ad adware\aawservice.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: lxddCATSCustConnectService - Lexmark International, Inc. - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxddserv.exe
O23 - Service: lxdd_device - Unknown owner - C:\WINDOWS\SYSTEM32\lxddcoms.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe


--
End of file - 11074 bytes

-- File Associations -----------------------------------------------------------

.bat - batfile - shell\edit\command - unable to read value
.cmd - cmdfile - shell\edit\command - unable to read value
.inf - inffile - DefaultIcon - unable to read value
.inf - inffile - shell\open\command - unable to read value
.ini - inifile - DefaultIcon - unable to read value
.ini - inifile - shell\open\command - notepad.exe %1
.reg - regfile - shell\edit\command - unable to read value
.txt - txtfile - DefaultIcon - unable to read value
.txt - txtfile - shell\open\command - notepad.exe %1
.vbs - VBSFile - shell\edit\command - unable to read value


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R1 FileDisk - c:\windows\system32\drivers\filedisk.sys <Not Verified; Bo Brantén; filedisk>
R1 omci (OMCI WDM Device Driver) - c:\windows\system32\drivers\omci.sys <Not Verified; Dell Computer Corporation; OMCI Driver>
R2 CdaD10BA - c:\windows\system32\drivers\cdad10ba.sys <Not Verified; Macrovision Europe Ltd; Security Windows NT>
R2 MCSTRM - c:\windows\system32\drivers\mcstrm.sys <Not Verified; RealNetworks, Inc.; RealNetworks Virtual Path Manager® (32-bit)>
R3 DSproct - c:\program files\dellsupport\gtaction\triggers\dsproct.sys <Not Verified; Gteko Ltd.; processt>
R3 Pcouffin (Low level access layer for CD devices) - c:\windows\system32\drivers\pcouffin.sys <Not Verified; VSO Software; Patin couffin engine>

S1 eeCtrl (Symantec Eraser Control driver) - c:\program files\common files\symantec shared\eengine\eectrl.sys (file missing)
S3 bvrp_pci - c:\windows\system32\drivers\bvrp_pci.sys
S3 iAimTV2 - c:\windows\system32\drivers\watv03nt.sys (file missing)
S3 usbsermpt (Motorola USB Modem Driver for MPT) - c:\windows\system32\drivers\usbsermpt.sys <Not Verified; Microsoft Corporation; Microsoft® Windows ® 2000 Operating System>


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 Viewpoint Manager Service - "c:\program files\viewpoint\common\viewpointservice.exe" <Not Verified; Viewpoint Corporation; Viewpoint Manager>


-- Device Manager: Disabled ----------------------------------------------------

Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: ZyXEL G-202 Wireless USB Adapter
Device ID: USB\VID_0586&PID_3410\5&18DE1848&0&1
Manufacturer: ZyXEL Communications Corp.
Name: ZyXEL G-202 Wireless USB Adapter #11
PNP Device ID: USB\VID_0586&PID_3410\5&18DE1848&0&1
Service: ZY202_XP

Class GUID: {4D36E96D-E325-11CE-BFC1-08002BE10318}
Description: Motorola USB Modem
Device ID: ROOT\MODEM\0001
Manufacturer: Motorola
Name: Motorola USB Modem #2
PNP Device ID: ROOT\MODEM\0001
Service: Modem


-- Scheduled Tasks -------------------------------------------------------------

2008-04-08 10:19:01 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job


-- Files created between 2008-03-11 and 2008-04-11 -----------------------------

2008-04-11 17:06:09 0 d-------- C:\Program Files\Trend Micro
2008-04-05 03:25:58 0 d-------- C:\Documents and Settings\DORA\Application Data\Grisoft
2008-04-05 03:24:38 0 d------c- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-04-05 01:46:35 0 d------c- C:\ad adware
2008-04-05 01:46:33 0 d------c- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-04-05 01:45:02 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-04-04 21:16:14 0 d-------- C:\Documents and Settings\Guest\Application Data\FaxCtr
2008-04-04 18:10:28 0 d-a----c- C:\Documents and Settings\All Users\Application Data\TEMP
2008-04-04 18:10:18 0 d-------- C:\WINDOWS\system32\209789
2008-04-03 15:35:37 0 d-------- C:\Program Files\Cloud10 MojoPac
2008-04-03 15:13:27 0 d-------- C:\Documents and Settings\ENOW\Application Data\FaxCtr
2008-04-03 15:09:49 0 d-------- C:\Documents and Settings\Offa\Application Data\FaxCtr
2008-04-03 14:55:23 0 d-------- C:\Documents and Settings\PRINCESS\Application Data\FaxCtr
2008-04-03 00:03:47 0 d-------- C:\Program Files\RingThree
2008-03-30 19:15:48 0 d-------- C:\Documents and Settings\MONICA\Application Data\MySpace
2008-03-30 00:34:59 0 d-------- C:\Documents and Settings\Owner\Application Data
2008-03-30 00:34:59 0 d-------- C:\Documents and Settings\Owner\Application Data\Microsoft
2008-03-30 00:34:57 0 d-------- C:\Documents and Settings\DORA\Application Data\MySpace
2008-03-19 18:25:02 0 d------c- C:\logs
2008-03-19 18:23:00 45056 --a------ C:\WINDOWS\system32\LXF3PMON.DLL
2008-03-19 18:23:00 32768 --a------ C:\WINDOWS\system32\LXF3FXPU.DLL
2008-03-19 18:22:40 12288 --a------ C:\WINDOWS\system32\LXF3PMRC.DLL
2008-03-19 18:22:40 36864 --a------ C:\WINDOWS\system32\lxf3oem.dll <Not Verified; ; Lexmark Fax Solutions Software>
2008-03-19 18:22:40 98345 --a------ C:\WINDOWS\system32\IMHOST32.DLL <Not Verified; Data Techniques, Inc.; ImageMan Image Processing Toolkit>
2008-03-19 18:22:40 339968 --a------ C:\WINDOWS\system32\IMGMAN32.DLL <Not Verified; Data Techniques, Inc.; ImageMan Image Processing Toolkit>
2008-03-19 18:13:37 286720 --a------ C:\WINDOWS\system32\LXDDinst.dll
2008-03-19 18:13:37 323584 --a------ C:\WINDOWS\system32\LXDDhcp.dll <Not Verified; ; Printer Communication System>


-- Find3M Report ---------------------------------------------------------------

2008-04-08 18:32:38 0 d-------- C:\Program Files\lx_cats
2008-04-06 07:00:10 0 d-------- C:\Program Files\Common Files
2008-04-04 21:50:10 0 d-------- C:\Program Files\PCPitstop
2008-04-04 21:03:28 0 d-------- C:\Program Files\DivX
2008-04-04 18:30:06 0 d-------- C:\Program Files\Yahoo!
2008-04-03 15:26:26 0 d-------- C:\Program Files\Siebel Option Pack 7.5.3.11
2008-04-03 15:21:06 0 d-------- C:\Program Files\MSN Games
2008-04-03 15:19:55 0 d-------- C:\Program Files\Kodak
2008-04-03 15:06:58 0 d-------- C:\Program Files\Windows Live Toolbar
2008-04-03 15:03:43 0 d-------- C:\Program Files\ResumeMaker
2008-04-03 15:01:10 0 d-------- C:\Program Files\Java
2008-04-03 15:00:52 13312 --a-s---- C:\WINDOWS\system32\dcggain.dll
2008-04-02 17:15:09 0 d-------- C:\Documents and Settings\DORA\Application Data\Yahoo!
2008-03-26 13:48:29 0 d-------- C:\Program Files\Abbyy FineReader 6.0 Sprint
2008-03-20 14:50:15 0 d-------- C:\Documents and Settings\DORA\Application Data\Lexmark Productivity Studio
2008-03-19 18:23:55 0 d-------- C:\Program Files\Lexmark 2500 Series
2008-03-19 18:22:32 0 d-------- C:\Program Files\Lexmark Fax Solutions
2008-03-02 15:56:09 0 d-------- C:\Documents and Settings\DORA\Application Data\FaxCtr
2008-02-23 20:43:41 0 d-------- C:\Documents and Settings\DORA\Application Data\Move Networks
2008-02-15 18:17:04 0 d--h----- C:\Program Files\InstallShield Installation Information


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8CA5ED52-F3FB-4414-A105-2E3491156990}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{DB9FBA9D-AB1B-4CC6-9745-F3B549D64E40}"= C:\Program Files\NetProject\wamdl.dll [ ]

[-HKEY_CLASSES_ROOT\CLSID\{DB9FBA9D-AB1B-4CC6-9745-F3B549D64E40}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"lxddmon.exe"="C:\Program Files\Lexmark 2500 Series\lxddmon.exe" [05/04/2007 02:38 AM]
"lxddamon"="C:\Program Files\Lexmark 2500 Series\lxddamon.exe" [03/05/2007 03:40 AM]
"FaxCenterServer"="C:\Program Files\Lexmark Fax Solutions\fm3032.exe" [05/04/2007 02:40 AM]
"VSOCheckTask"="c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" []
"VirusScan Online"="c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe" []
"UserFaultCheck"="C:\WINDOWS\system32\dumprep 0 -u" []
"tgcmd"="C:\Program Files\Support.com\BellSouth\hcenter.exe" []
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [06/29/2007 06:24 AM]
"NovaBackup 7 Tray Control"="C:\Program Files\NovaStor\NovaBACKUP\NbkCtrl.exe" [06/23/2005 09:03 AM]
"mmtask"="c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe" [10/06/2003 11:05 AM]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" []
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [06/22/2005 12:48 AM]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [02/12/2004 01:38 PM]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [05/12/2004 03:18 PM]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [06/22/2005 12:44 AM]
"FRISK FP-Scheduler"="C:\Program Files\FSI\F-Prot\F-Sched.exe" []
"F-StopW"="C:\Program Files\FSI\F-Prot\F-StopW.EXE" []

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [03/15/2007 11:09 AM]
"Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [08/30/2007 06:43 PM]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [01/19/2007 12:54 PM]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 03:56 AM]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [03/30/2006 05:45 PM]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [07/22/2007 12:41 PM]
"DellTransferAgent"="C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe" [11/13/2007 05:46 PM]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [05/12/2004 02:03 AM]
"Red Swoosh EDN Client"="C:\Program Files\RSSoft\RSEDNClient.exe" []
"NetZero_uoltray"="C:\Program Files\NetZero\exec.exe" []

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" /background

C:\Documents and Settings\DORA\Start Menu\Programs\Startup\
DESKTOP.INI [9/3/2002 10:00:00 AM]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [9/23/2005 11:05:26 PM]
DESKTOP.INI [9/3/2002 10:00:00 AM]
InterVideo WinCinema Manager.lnk - C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe [4/29/2006 11:22:00 PM]
Photo Loader supervisory.lnk - C:\Program Files\CASIO\Photo Loader\Plauto.exe [2/27/2007 6:52:15 PM]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{9c87cb31-93d0-4f3e-a360-4a91ff77aeb7}"= C:\WINDOWS\system32\dcggain.dll [04/03/2008 03:00 PM 13312]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\SDNotify]
C:\Program Files\SpywareDetector\SDNotify.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
@="Volume shadow copy"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^BugDoctor.lnk]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone Fast Start.lnk]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Error Nuker]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VIRIT LITE MONITOR]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\xp_system]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"SNDSrvc"=2 (0x2)
"UleadBurningHelper"=3 (0x3)
"mcupdmgr.exe"=3 (0x3)
"McTskshd.exe"=2 (0x2)
"McDetect.exe"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" -atboottime


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\M]
AutoRun\command- M:\.\Start.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\Z]
AutoRun\command- Z:\.\Start.exe




-- Hosts -----------------------------------------------------------------------

127.0.0.1 ads.x10.com
127.0.0.1 s1.bluestreak.com
127.0.0.1 abc.bnex.com
127.0.0.1 alpha.bnex.com
127.0.0.1 bnex.com
127.0.0.1 customer.bnex.com
127.0.0.1 db.bnex.com
127.0.0.1 dev.bnex.com
127.0.0.1 do.you.uh.yahoo.at.bnex.com
127.0.0.1 ghost.in.the.shell.at.bnex.com

74 more entries in hosts file.


-- End of Deckard's System Scanner: finished at 2008-04-11 17:10:42 ------------





Deckard's System Scanner v20071014.68
Extra logfile - please post this as an attachment with your post.
--------------------------------------------------------------------------------

-- System Information ----------------------------------------------------------

Microsoft Windows XP Home Edition (build 2600) SP 2.0
Architecture: X86; Language: English

CPU 0: Intel® Pentium® 4 CPU 2.66GHz
Percentage of Memory in Use: 43%
Physical Memory (total/avail): 766 MiB / 435.38 MiB
Pagefile Memory (total/avail): 1874.08 MiB / 1564.25 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1908.11 MiB

C: is Fixed (NTFS) - 37.23 GiB total, 1.06 GiB free.
D: is CDROM (No Media)

\\.\PHYSICALDRIVE0 - WDC WD400BB-75DEA0 - 37.27 GiB - 2 partitions
\PARTITION0 - Unknown - 39.19 MiB
\PARTITION1 (bootable) - Installable File System - 37.23 GiB - C:



-- Security Center -------------------------------------------------------------

AUOptions is scheduled to auto-install.
Windows Internal Firewall is enabled.


[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\\Program Files\\Lexmark 2500 Series\\app4r.exe"="C:\\Program Files\\Lexmark 2500 Series\\App4R.exe:*:Enabled:Lexmark Imaging Studio"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\WINDOWS\\SYSTEM32\\fxsclnt.exe"="C:\\WINDOWS\\SYSTEM32\\fxsclnt.exe:*:Enabled:Microsoft Fax Console"
"C:\\Program Files\\Yahoo!\\Messenger\\YPager.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YPager.exe:*:Enabled:Yahoo! Messenger"
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe:*:Enabled:YServer Module"
"C:\\Documents and Settings\\MONICA\\Local Settings\\Temp\\ImInstaller\\IncrediMail\\incredimail_install.exe"="C:\\Documents and Settings\\MONICA\\Local Settings\\Temp\\ImInstaller\\IncrediMail\\incredimail_install.exe:*:Enabled:IncrediMail Installer"
"C:\\Program Files\\Real\\RealPlayer\\realplay.exe"="C:\\Program Files\\Real\\RealPlayer\\realplay.exe:*:Enabled:RealOne Player"
"C:\\Documents and Settings\\ENOW\\Local Settings\\Temp\\ImInstaller\\IncrediMail\\incredimail_install.exe"="C:\\Documents and Settings\\ENOW\\Local Settings\\Temp\\ImInstaller\\IncrediMail\\incredimail_install.exe:*:Enabled:IncrediMail Installer"
"C:\\Program Files\\CallWave\\IAM.exe"="C:\\Program Files\\CallWave\\IAM.exe:*:Enabled:CallWave"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"="C:\\Program Files\\Mozilla Firefox\\firefox.exe:*:Enabled:Firefox"
"C:\\Program Files\\RSSoft\\RSEDNClient.exe"="C:\\Program Files\\RSSoft\\RSEDNClient.exe:*:Disabled:RSEDNClient"
"C:\\Program Files\\JEOPARDY!\\JEOPARDY!.exe"="C:\\Program Files\\JEOPARDY!\\JEOPARDY!.exe:*:Enabled:JEOPARDY!"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Internet Explorer\\iexplore.exe"="C:\\Program Files\\Internet Explorer\\iexplore.exe:*:Enabled:Internet Explorer"
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"C:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"="C:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe:*:Enabled:EasyShare"
"C:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\Kodak Software Updater.exe"="C:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\Kodak Software Updater.exe:*:Enabled:Kodak Software Updater"
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe:*:Enabled:AOL"
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe:*:Enabled:AOL"
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"="C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe:*:Enabled:AOL Application Loader"
"C:\\Program Files\\America Online 9.0\\waol.exe"="C:\\Program Files\\America Online 9.0\\waol.exe:*:Enabled:AOL"
"C:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltsmon.exe"="C:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltsmon.exe:*:Enabled:AOLTsMon"
"C:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltpspd.exe"="C:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltpspd.exe:*:Enabled:AOLTopSpeed"
"C:\\Program Files\\Common Files\\AOL\\1174411398\\EE\\AOLServiceHost.exe"="C:\\Program Files\\Common Files\\AOL\\1174411398\\EE\\AOLServiceHost.exe:*:Enabled:AOL"
"C:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe"="C:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe:*:Enabled:AOL"
"C:\\Program Files\\Common Files\\AOL\\AOL Spyware Protection\\AOLSP Scheduler.exe"="C:\\Program Files\\Common Files\\AOL\\AOL Spyware Protection\\AOLSP Scheduler.exe:*:Enabled:AOL"
"C:\\Program Files\\Common Files\\AOL\\AOL Spyware Protection\\asp.exe"="C:\\Program Files\\Common Files\\AOL\\AOL Spyware Protection\\asp.exe:*:Enabled:AOL"
"C:\\Program Files\\Common Files\\AolCoach\\en_en\\player\\AOLNySEV.exe"="C:\\Program Files\\Common Files\\AolCoach\\en_en\\player\\AOLNySEV.exe:*:Enabled:AOL"
"C:\\Documents and Settings\\DORA\\Local Settings\\Apps\\2.0\\VGZZPTNN.QZW\\7CK99KB0.X5B\\west..kage_28b3eab364833aef_0001.0001_ec31e0c58d5dbef4\\WelcomeHome.exe"="C:\\Documents and Settings\\DORA\\Local Settings\\Apps\\2.0\\VGZZPTNN.QZW\\7CK99KB0.X5B\\west..kage_28b3eab364833aef_0001.0001_ec31e0c58d5dbef4\\WelcomeHome.exe:*:Enabled:West At Home"
"C:\\Documents and Settings\\MONICA\\Local Settings\\Apps\\2.0\\5CME6A2H.G5W\\TRNPHDQG.02V\\west..kage_28b3eab364833aef_0001.0001_ec31e0c58d5dbef4\\WelcomeHome.exe"="C:\\Documents and Settings\\MONICA\\Local Settings\\Apps\\2.0\\5CME6A2H.G5W\\TRNPHDQG.02V\\west..kage_28b3eab364833aef_0001.0001_ec31e0c58d5dbef4\\WelcomeHome.exe:*:Enabled:West At Home"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\\Documents and Settings\\MONICA\\Local Settings\\Apps\\2.0\\5CME6A2H.G5W\\TRNPHDQG.02V\\west..kage_28b3eab364833aef_0001.0001_ec31e0c68ddcceb4\\WelcomeHome.exe"="C:\\Documents and Settings\\MONICA\\Local Settings\\Apps\\2.0\\5CME6A2H.G5W\\TRNPHDQG.02V\\west..kage_28b3eab364833aef_0001.0001_ec31e0c68ddcceb4\\WelcomeHome.exe:*:Enabled:West At Home"
"C:\\Program Files\\Joost\\xulrunner\\tvprunner.exe"="C:\\Program Files\\Joost\\xulrunner\\tvprunner.exe:*:Enabled:tvprunner"
"C:\\Documents and Settings\\MONICA\\Local Settings\\Apps\\2.0\\5CME6A2H.G5W\\TRNPHDQG.02V\\west..kage_28b3eab364833aef_0001.0002_490658ee75ccdff4\\WelcomeHome.exe"="C:\\Documents and Settings\\MONICA\\Local Settings\\Apps\\2.0\\5CME6A2H.G5W\\TRNPHDQG.02V\\west..kage_28b3eab364833aef_0001.0002_490658ee75ccdff4\\WelcomeHome.exe:*:Enabled:West At Home"
"C:\\Program Files\\AIM\\aim.exe"="C:\\Program Files\\AIM\\aim.exe:*:Enabled:AOL Instant Messenger"
"C:\\Documents and Settings\\MONICA\\Local Settings\\Apps\\2.0\\5CME6A2H.G5W\\TRNPHDQG.02V\\west..kage_28b3eab364833aef_0001.0002_4a04786571555234\\WelcomeHome.exe"="C:\\Documents and Settings\\MONICA\\Local Settings\\Apps\\2.0\\5CME6A2H.G5W\\TRNPHDQG.02V\\west..kage_28b3eab364833aef_0001.0002_4a04786571555234\\WelcomeHome.exe:*:Enabled:West At Home"
"C:\\Program Files\\UserTesting.com\\TestingRecorder\\TestingRecorder.exe"="C:\\Program Files\\UserTesting.com\\TestingRecorder\\TestingRecorder.exe:*:Enabled:Usability testing"
"C:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"="C:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe:*:Enabled:Veoh Client"
"C:\\Program Files\\Lexmark 2500 Series\\lxddamon.exe"="C:\\Program Files\\Lexmark 2500 Series\\lxddamon.exe:*:Enabled:Lexmark Device Monitor"
"C:\\Program Files\\Lexmark 2500 Series\\App4R.exe"="C:\\Program Files\\Lexmark 2500 Series\\App4R.exe:*:Enabled:Lexmark Imaging Studio"
"C:\\WINDOWS\\SYSTEM32\\lxddcoms.exe"="C:\\WINDOWS\\SYSTEM32\\lxddcoms.exe:*:Enabled:Lexmark Communications System"
"C:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"="C:\\Program Files\\MySpace\\IM\\MySpaceIM.exe:*:Enabled:MySpace Instant Messenger"
"C:\\Program Files\\Java\\jre1.5.0_11\\bin\\javaw.exe"="C:\\Program Files\\Java\\jre1.5.0_11\\bin\\javaw.exe:*:Enabled:Java™ 2 Platform Standard Edition binary"
"C:\\WINDOWS\\SYSTEM32\\SPOOL\\DRIVERS\\W32X86\\3\\lxddpswx.exe"="C:\\WINDOWS\\SYSTEM32\\SPOOL\\DRIVERS\\W32X86\\3\\lxddpswx.exe:*:Enabled: "
"C:\\WINDOWS\\SYSTEM32\\SPOOL\\DRIVERS\\W32X86\\3\\lxddjswx.exe"="C:\\WINDOWS\\SYSTEM32\\SPOOL\\DRIVERS\\W32X86\\3\\lxddjswx.exe:*:Enabled: "
"C:\\WINDOWS\\SYSTEM32\\SPOOL\\DRIVERS\\W32X86\\3\\lxddtime.exe"="C:\\WINDOWS\\SYSTEM32\\SPOOL\\DRIVERS\\W32X86\\3\\lxddtime.exe:*:Enabled: "
"C:\\Program Files\\Lexmark 2500 Series\\lxddmon.exe"="C:\\Program Files\\Lexmark 2500 Series\\lxddmon.exe:*:Enabled: "


-- Environment Variables -------------------------------------------------------

ALLUSERSPROFILE=C:\Documents and Settings\All Users
APPDATA=C:\Documents and Settings\DORA\Application Data
CLASSPATH=.;C:\Program Files\Java\jre1.6.0_02\lib\ext\QTJava.zip
CLIENTNAME=Console
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=MONICA
ComSpec=C:\WINDOWS\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Documents and Settings\DORA
LOGONSERVER=\\MONICA
NUMBER_OF_PROCESSORS=1
OS=Windows_NT
Path=C:\Program Files\Internet Explorer;;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Program Files\Common Files\Ulead Systems\MPEG;C:\Program Files\Common Files\Ulead Systems\DVD;C:\Program Files\QuickTime\QTSystem\
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 15 Model 2 Stepping 9, GenuineIntel
PROCESSOR_LEVEL=15
PROCESSOR_REVISION=0209
ProgramFiles=C:\Program Files
PROMPT=$P$G
QTJAVA=C:\Program Files\Java\jre1.6.0_02\lib\ext\QTJava.zip
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\WINDOWS
TEMP=C:\DOCUME~1\DORA\LOCALS~1\Temp
TMP=C:\DOCUME~1\DORA\LOCALS~1\Temp
USERDOMAIN=MONICA
USERNAME=DORA
USERPROFILE=C:\Documents and Settings\DORA
windir=C:\WINDOWS


-- User Profiles ---------------------------------------------------------------

ENOW (admin)
DORA (admin)
PRINCESS (admin)
MONICA (admin)
Offa (admin)
Administrator (admin)
Guest (guest)


-- Add/Remove Programs ---------------------------------------------------------

-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
--> C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
--> C:\WINDOWS\IsUninst.exe -fC:\WINDOWS\orun32.isu
--> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Acoustica Effects Pack --> C:\PROGRA~1\ACOUST~2\UNWISE.EXE C:\PROGRA~1\ACOUST~2\INSTALL.LOG
Acoustica Mixcraft --> C:\PROGRA~1\ACOUST~1\UNWISE.EXE C:\PROGRA~1\ACOUST~1\INSTALL.LOG
Ad-Aware 2007 --> MsiExec.exe /I{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}
Adobe Acrobat Connect Add-in --> C:\Documents and Settings\DORA\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\connectaddin6x5\connectaddin6x5.exe -uninstall
Adobe Flash Player ActiveX --> C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player Plugin --> C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 7.0.9 --> MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A70900000002}
AOL Instant Messenger --> C:\Program Files\AIM\uninstll.exe -LOG= C:\Program Files\AIM\install.log -OEM=
Apple Software Update --> MsiExec.exe /I{74EC78BC-B379-4E29-9006-8F161DCAABA6}
Banctec Service Agreement -->
Banctec Service Agreement -->
Broadcom Management Programs -->
Broadcom Management Programs --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{89EE857B-8970-4F9F-AB58-A1C873AC72B3} /l1033
Dell Digital Jukebox Driver --> C:\Program Files\Dell\Digital Jukebox Drivers\DrvUnins.exe /s
Dell Networking Guide -->
Dell Solution Center --> MsiExec.exe /X{11F1920A-56A2-4642-B6E0-3B31A12C9288}
DellSupport --> MsiExec.exe /X{7EFA5E6F-74F7-4AFB-8AEA-AA790BD3A76D}
DivX Content Uploader --> C:\Program Files\DivX\DivXContentUploaderUninstall.exe /CUPLOADER
DivX Web Player --> C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
DriverGuide Toolkit --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{71AA4525-52F2-4841-93B6-8DF58C0CC0DA}\setup.exe"
Google Toolbar for Internet Explorer --> MsiExec.exe /I{DBEA1034-5882-4A88-8033-81C4EF0CFA29}
Google Toolbar for Internet Explorer --> regsvr32 /u /s "c:\program files\google\googletoolbar2.dll"
Help and Support Customization -->
HijackThis 1.98.2 --> C:\Documents and Settings\MONICA\Desktop\hijackthis\HijackThis.exe /uninstall
Hotfix for Windows Media Format 11 SDK (KB929399) --> "C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
HP Diagnostic Assistant -->
HP Software Update --> MsiExec.exe /X{457791C5-D702-4143-A7B2-2744BE9573F2}
Intel® 537EP V9x DF PCI Modem --> rundll32 IntelCci.dll,iSMUninstallation "Intel® 537EP V9x DF PCI Modem"
Intel® Extreme Graphics Driver --> RUNDLL32.EXE C:\WINDOWS\system32\ialmrem.dll,UninstallW2KIGfx PCI\VEN_8086&DEV_2562
Internet Explorer Default Page --> MsiExec.exe /I{35BDEFF1-A610-4956-A00D-15453C116395}
InterVideo WinDVD --> "C:\Program Files\InstallShield Installation Information\{91810AFC-A4F8-4EBA-A5AA-B198BBC81144}\setup.exe" REMOVEALL
Jasc Paint Shop Photo Album --> MsiExec.exe /I{CC000127-5E5D-4A1C-90CB-EEAAAC1E3AC0}
Jasc Paint Shop Pro 8 Dell Edition --> MsiExec.exe /I{81A34902-9D0B-4920-A25C-4CDC5D14B328}
Lexmark 2500 Series --> C:\Program Files\Lexmark 2500 Series\Install\x86\Uninst.exe
Lexmark Fax Solutions --> C:\Program Files\Lexmark Fax Solutions\Install\x86\Uninst.exe /R:faxunst
Macromedia Extension Manager --> MsiExec.exe /I{5546CDB5-2CE2-498B-B059-5B3BF81FC41F}
Macromedia Flash 8 Video Encoder --> MsiExec.exe /X{8BF2C401-02CE-424D-BC26-6C4F9FB446B6}
Macromedia Flash Player 8 --> MsiExec.exe /X{885A63EA-382B-4DD4-A755-14809B8557D6}
Macromedia Shockwave Player --> C:\WINDOWS\SYSTEM32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\SYSTEM32\Macromed\SHOCKW~1\Install.log
Mavis Beacon Teaches Typing 9.0.0 --> C:\PROGRA~1\MINDSC~1\MAVISB~1\UNINST.EXE
MetaFrame Presentation Server Web Client for Win32 --> C:\WINDOWS\system32\ctxsetup.exe /uninst C:\PROGRA~1\Citrix\icaweb32\uninst.inf
Microsoft Compression Client Pack 1.0 for Windows XP --> "C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft Encarta Encyclopedia Standard 2004 --> MsiExec.exe /I{04410044-9149-45C6-A806-F2BF9CFCE762}
Microsoft Office Excel Viewer 2003 --> MsiExec.exe /I{90840409-6000-11D3-8CFE-0150048383C9}
Microsoft Office PowerPoint Viewer 2003 --> MsiExec.exe /X{90AF0409-6000-11D3-8CFE-0150048383C9}
Microsoft Office Professional Edition 2003 --> MsiExec.exe /I{91110409-6000-11D3-8CFE-0150048383C9}
Microsoft Office Visio Viewer 2007 --> MsiExec.exe /I{95120000-0052-0409-0000-0000000FF1CE}
Microsoft Office Word Viewer 2003 --> MsiExec.exe /I{90850409-6000-11D3-8CFE-0150048383C9}
Microsoft User-Mode Driver Framework Feature Pack 1.0 --> "C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Modem Event Monitor --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{7A0EFAFB-AC4B-4B88-8C6B-6731BE88DB68}\setup.exe" -l0x9
Modem Helper --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{7F142D56-3326-11D5-B229-002078017FBF}\setup.exe" -l0x9 ControlPanel
Modem On Hold --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{3F92ABBB-6BBF-11D5-B229-002078017FBF}\setup.exe" -l0x9 ControlPanelAnyText
Move Networks Media Player for Internet Explorer --> C:\Documents and Settings\DORA\Application Data\Move Networks\ie_bin\Uninst.exe
Mozilla Firefox (2.0.0.12) --> C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MUSICMATCH® Jukebox --> C:\PROGRA~1\MUSICM~1\MUSICM~2\unmatch.exe
NovaBACKUP --> MsiExec.exe /I{A14F19F4-2E19-4CA5-83AB-FC9EE3FEA1E0}
Overland -->
Palm Desktop --> MsiExec.exe /X{F1E906E7-1120-428D-A124-4938C306427E}
Photo Loader 3.0E --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{70B45586-B51E-4947-A258-A895596C5CED}\Setup.exe" -uninst
Photohands 1.0E --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll<UNINSTALL_CMD>
QuickTime --> MsiExec.exe /I{95A890AA-B3B1-44B6-9C18-A8F7AB3EE7FC}
RapidPlayer v4.0 ActiveX Control --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{31C2F32D-C5DD-4583-8181-B48591CA231C}\Setup.exe" -l0x9
RAR Password Cracker 4.12 --> C:\Program Files\RAR Password Cracker\uninstall.exe
RealPlayer --> C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
RTC Client API v1.2 Setup --> MsiExec.exe /I{9E5AE5C0-423C-4F4F-823B-57781C2B77F5}
Secure Game Player --> C:\Program Files\SkillJam Technologies\Secure Player\Uninstall.exe
Security Update for CAPICOM (KB931906) --> MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for CAPICOM (KB931906) --> MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for Step By Step Interactive Training (KB898458) --> "C:\WINDOWS\$NtUninstallKB898458$\spuninst\spuninst.exe"
Security Update for Step By Step Interactive Training (KB923723) --> "C:\WINDOWS\$NtUninstallKB923723$\spuninst\spuninst.exe"
Serif PhotoPlus 6.0 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{0609D0AF-1382-42BE-81DB-CF30F8B0F6E2}\Setup.exe" -l0x9
Siebel Option Pack 7.5.3.11 --> "C:\Program Files\Siebel Option Pack 7.5.3.11\UNINSTAL.EXE" "C:\Program Files\Siebel Option Pack 7.5.3.11\INSTALL.LOG" "Siebel Option Pack 7.5.3.11 Uninstall"
SmartSound Quicktracks Plugin -->
SmartSound Quicktracks Plugin --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\9\INTEL3~1\IDriver.exe /M{4A7FDA4D-F4D7-4A49-934A-066D59A43C7E}
Spybot - Search & Destroy 1.3 --> "C:\Program Files\Spybot - Search & Destroy\unins000.exe"
SpywareBlaster v3.5.1 --> "C:\Program Files\SpywareBlaster\unins000.exe"
Ulead DVD DiskRecorder 2.1.1 -->
Ulead Photo Explorer 8.5 SE --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{025C3792-E9C6-432A-92C1-661F99D021CA}\setup.exe" -l0x9
Viewpoint Media Player --> C:\Program Files\Viewpoint\Viewpoint Experience Technology\mtsAxInstaller.exe /u
WebEx --> C:\WINDOWS\DOWNLO~1\atcliun.exe
WebFldrs XP -->
West At Home (Production) --> rundll32.exe dfshim.dll,ShArpMaintain WestAtHomeProduction.Package, Culture=en-US, PublicKeyToken=28b3eab364833aef, processorArchitecture=msil
WinAce Archiver --> "C:\Program Files\WinAce\SXUNINST.EXE" "C:\Program Files\WinAce\SXUNINST.INI"
WinASO Registry Optimizer 2.0.5 --> "C:\Program Files\WinASO\Registry Optimizer 2.0\unins000.exe"
Windows Defender Signatures --> MsiExec.exe /I{A5CC2A09-E9D3-49EC-923D-03874BBD4C2C}
Windows Live Messenger --> MsiExec.exe /I{571700F0-DB9D-4B3A-B03D-35A14BB5939F}
Windows Live Safety scanner --> RunDll32.exe "C:\Program Files\Windows Live Safety Center\wlscCore.dll",?UninstallFunction@CwlscCore@@QAEXXZ
Windows Live Sign-in Assistant --> MsiExec.exe /I{49672EC2-171B-47B4-8CE7-50D7806360D7}
Windows Media Encoder 9 Series --> msiexec.exe /I {E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}
Windows Media Encoder 9 Series --> MsiExec.exe /I{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}
Windows Media Format 11 runtime --> "C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Vista Upgrade Advisor --> MsiExec.exe /I{B79FBFDD-8B0C-4B8E-B70E-499E39978281}
WinZip 11.1 --> MsiExec.exe /X{CD95F661-A5C4-44F5-A6AA-ECDD91C240B5}
WordPerfect Office 11 --> MsiExec.exe /I{54F90B55-BEB3-4F0D-8802-228822FA5921}
Yahoo! Messenger --> C:\PROGRA~1\Yahoo!\MESSEN~1\UNWISE.EXE /U C:\PROGRA~1\Yahoo!\MESSEN~1\INSTALL.LOG
Yahoo! Photos Easy Upload Tool 1v6 --> C:\WINDOWS\system32\regsvr32 /u /s "C:\WINDOWS\cache\YDropper.dll"
Zip Password Recovery --> C:\Program Files\Visual Zip Password Recovery\uninstall.exe


-- Application Event Log -------------------------------------------------------

Event Record #/Type7665 / Error
Event Submitted/Written: 04/11/2008 04:01:17 PM
Event ID/Source: 1002 / Application Hang
Event Description:
Hanging application IpAgent.exe, version 0.0.0.0, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Event Record #/Type7662 / Error
Event Submitted/Written: 04/11/2008 09:23:05 AM
Event ID/Source: 1002 / Application Hang
Event Description:
Hanging application IpAgent.exe, version 0.0.0.0, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Event Record #/Type7661 / Error
Event Submitted/Written: 04/11/2008 09:21:55 AM
Event ID/Source: 1002 / Application Hang
Event Description:
Hanging application IpAgent.exe, version 0.0.0.0, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Event Record #/Type7660 / Error
Event Submitted/Written: 04/11/2008 09:00:06 AM
Event ID/Source: 1002 / Application Hang
Event Description:
Hanging application IpAgent.exe, version 0.0.0.0, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Event Record #/Type7659 / Error
Event Submitted/Written: 04/11/2008 08:57:46 AM
Event ID/Source: 1002 / Application Hang
Event Description:
Hanging application IpAgent.exe, version 0.0.0.0, hang module hungapp, version 0.0.0.0, hang address 0x00000000.



-- Security Event Log ----------------------------------------------------------

No Errors/Warnings found.


-- System Event Log ------------------------------------------------------------

Event Record #/Type2120555 / Error
Event Submitted/Written: 04/11/2008 04:27:50 PM
Event ID/Source: 7024 / Service Control Manager
Event Description:
The Routing and Remote Access service terminated with service-specific error 340 (0x154).

Event Record #/Type2120539 / Error
Event Submitted/Written: 04/11/2008 04:27:42 PM
Event ID/Source: 7026 / Service Control Manager
Event Description:
The following boot-start or system-start driver(s) failed to load:
eeCtrl

Event Record #/Type2120538 / Error
Event Submitted/Written: 04/11/2008 04:27:42 PM
Event ID/Source: 7022 / Service Control Manager
Event Description:
The Windows Image Acquisition (WIA) service hung on starting.

Event Record #/Type2120536 / Error
Event Submitted/Written: 04/11/2008 04:26:07 PM
Event ID/Source: 7001 / Service Control Manager
Event Description:
The Windows Media Player Network Sharing Service service depends on the Universal Plug and Play Device Host service which failed to start because of the following error:
%%1058

Event Record #/Type2120535 / Error
Event Submitted/Written: 04/11/2008 04:26:07 PM
Event ID/Source: 7000 / Service Control Manager
Event Description:
The lxddCATSCustConnectService service failed to start due to the following error:
%%1053



-- End of Deckard's System Scanner: finished at 2008-04-11 17:10:42 ------------




Hope I did this right. If not, I apologise in advance. :thumbsup:

BC AdBot (Login to Remove)

 


#2 -David-

-David-

  • Members
  • 10,603 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London
  • Local time:01:16 AM

Posted 12 April 2008 - 05:26 AM

Hello there and welcome to Bleeping Computer's security forum.
My name is David, I will be helping you with your log today.

It is a good idea to print off these instructions. There is a possibility some of the instructions will need to be carried out where internet access is not available. It is important that you complete the instructions in the right order, and that you don't miss out any steps.

Please set your system to show all files.
Click Start, open My Computer, select the Tools menu and click Folder Options.
Select the View Tab. Under the Hidden files and folders heading, select Show hidden files and folders.
Uncheck: Hide file extensions for known file types
Uncheck the Hide protected operating system files (recommended) option.
Click Yes to confirm.

Start HijackThis, close all open windows leaving only HijackThis running. Place a check against each of the following if still present:

O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - __BHODemonDisabled (file missing)
O2 - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - __BHODemonDisabled (file missing)
O2 - BHO: (no name) - {8CA5ED52-F3FB-4414-A105-2E3491156990} - (no file)
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/...arch.jhtml?p=ZS
O9 - Extra button: (no name) - CmdMapping - (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing)
O22 - SharedTaskScheduler: hirtellous - {fa19bd7e-50bc-4203-80ac-c4edc81ca9a3} - (no file)
O22 - SharedTaskScheduler: important - {9c87cb31-93d0-4f3e-a360-4a91ff77aeb7} - C:\WINDOWS\SYSTEM32\dcggain.dll

Click on Fix Checked when finished and exit HijackThis.
Make sure your Internet Explorer is closed when you click Fix Checked!

Open hijackthis, click 'config' (bottom right) Choose the tab 'misc Tools' on top.
Choose 'delete a file on reboot'. In the field, copy and paste the filepath a few lines below.
Click open. Hijackthis will tell you that this file will be deleted on next reboot and if you want to reboot now.
When asked if you want to reboot now, say Yes:
C:\WINDOWS\SYSTEM32\dcggain.dll

Allow the PC to reboot, if it doesn't do it automatically, please reboot manually.

Now reboot into Safe Mode.
This can be done tapping the F8 key as soon as you start your computer
You will be brought to a menu where you can choose to boot into safe mode.
Make sure you choose the option without networking support.

Using Windows Explorer, please locate the following files/folders, and delete them if still present:

C:\WINDOWS\system32\209789 <--folder

I want you to clean your cache and cookies from your internet explorer.
There are a few infected files which need to be removed from your system.

° Close all instances of Internet Explorer .
° Go to your control panel and open "Internet Options".
° Click on the "General" tab.
° Click the "Delete Cookies" button, then the "Delete Files" button.
° If prompted, place a tick in the "Delete all offline content" box and click OK.

Also, please clean other Temporary files and Empty the Recycle Bin

° Go to start and click on the "run" button.
° Type the following in the box --> cleanmgr and click ok.
° Let it scan your system for files to remove.
° Make sure only Temporary Files, Temporary Internet Files, and Recycle Bin are checked.
° Press OK to remove them.

Reboot back into normal mode.

Please download Combofix to your desktop.
Doubleclick combofix.exe to launch the application.

Follow the prompts that will be displayed on the screen.
Don't click on the window while the fix is running, because that will cause your system to hang.
When finished, it should produce a log, combofix.txt.
Post this log in your next reply together with a new hijackthislog.

#3 Ndipso

Ndipso
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:08:16 PM

Posted 14 April 2008 - 04:08 PM

The fake icon is gone! You are Yoda! :thumbsup:

I did the next steps. Here are the results, David:

Combofix


ComboFix 08-04-13.3 - DORA 2008-04-14 16:39:30.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.411 [GMT -4:00]
Running from: C:\Documents and Settings\DORA\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\MONICA\Application Data\macromedia\Flash Player\#SharedObjects\7JBXWXPF\www.broadcaster.com
C:\Documents and Settings\MONICA\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com
C:\Documents and Settings\MONICA\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol
C:\Documents and Settings\MONICA\g2mdlhlpx.exe
C:\Documents and Settings\PRINCESS\Application Data\Hotbar
C:\Documents and Settings\PRINCESS\Application Data\Hotbar\reports.txt
C:\Program Files\internet explorer\msimg32.dll
C:\WINDOWS\system32\drivers\fad.sys

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_6TO4
-------\Service_6to4
-------\Service_PortProxy


((((((((((((((((((((((((( Files Created from 2008-03-14 to 2008-04-14 )))))))))))))))))))))))))))))))
.

2008-04-11 17:15 . 2008-04-11 17:15 <DIR> d-------- C:\WINDOWS\SYSTEM32\Kaspersky Lab
2008-04-11 17:15 . 2008-04-11 17:15 <DIR> d----c--- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-04-11 17:06 . 2008-04-11 17:06 <DIR> d-------- C:\Program Files\Trend Micro
2008-04-11 17:03 . 2008-04-11 17:03 <DIR> d----c--- C:\Deckard
2008-04-05 03:25 . 2008-04-05 03:25 <DIR> d-------- C:\Documents and Settings\DORA\Application Data\Grisoft
2008-04-05 03:24 . 2008-04-05 03:24 <DIR> d----c--- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-04-05 01:46 . 2008-04-05 01:47 <DIR> d----c--- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-04-05 01:45 . 2008-04-05 01:45 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-04-04 21:16 . 2008-04-04 21:16 <DIR> d-------- C:\Documents and Settings\Guest\Application Data\FaxCtr
2008-04-04 18:10 . 2008-04-14 16:21 <DIR> d-------- C:\WINDOWS\SYSTEM32\209789
2008-04-04 18:10 . 2008-04-04 18:16 <DIR> d-a--c--- C:\Documents and Settings\All Users\Application Data\TEMP
2008-04-03 15:35 . 2008-04-03 15:35 <DIR> d-------- C:\Program Files\Cloud10 MojoPac
2008-04-03 15:13 . 2008-04-03 15:13 <DIR> d-------- C:\Documents and Settings\ENOW\Application Data\FaxCtr
2008-04-03 15:09 . 2008-04-03 15:09 <DIR> d-------- C:\Documents and Settings\Offa\Application Data\FaxCtr
2008-04-03 14:55 . 2008-04-03 14:55 <DIR> d-------- C:\Documents and Settings\PRINCESS\Application Data\FaxCtr
2008-04-03 00:03 . 2008-04-03 00:03 <DIR> d-------- C:\Program Files\RingThree
2008-03-30 19:15 . 2008-03-30 19:15 <DIR> d-------- C:\Documents and Settings\MONICA\Application Data\MySpace
2008-03-30 00:34 . 2008-03-30 00:34 <DIR> d-------- C:\Documents and Settings\DORA\Application Data\MySpace
2008-03-28 16:38 . 2004-08-04 03:56 21,504 --a------ C:\WINDOWS\SYSTEM32\hidserv.dll
2008-03-28 16:38 . 2004-08-04 03:56 21,504 --a------ C:\WINDOWS\SYSTEM32\DLLCACHE\hidserv.dll
2008-03-28 16:37 . 2004-08-04 02:07 59,264 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\USBAUDIO.sys
2008-03-28 16:37 . 2004-08-04 02:07 59,264 --a------ C:\WINDOWS\SYSTEM32\DLLCACHE\usbaudio.sys
2008-03-19 18:25 . 2008-03-19 18:25 <DIR> d----c--- C:\logs
2008-03-19 18:24 . 2007-03-28 09:16 344,064 --a------ C:\WINDOWS\SYSTEM32\lxddcoin.dll
2008-03-19 18:24 . 2001-08-17 22:36 87,040 --a------ C:\WINDOWS\SYSTEM32\wiafbdrv.dll
2008-03-19 18:24 . 2001-08-17 22:36 87,040 --a------ C:\WINDOWS\SYSTEM32\DLLCACHE\wiafbdrv.dll
2008-03-19 18:24 . 2006-05-17 22:47 40,960 --a------ C:\WINDOWS\SYSTEM32\lxddvs.dll
2008-03-19 18:23 . 2007-01-09 12:13 692,224 --a------ C:\WINDOWS\SYSTEM32\lxdddrs.dll
2008-03-19 18:23 . 2006-10-06 13:08 69,632 --a------ C:\WINDOWS\SYSTEM32\lxddcnv4.dll
2008-03-19 18:23 . 2007-01-23 14:40 65,536 --a------ C:\WINDOWS\SYSTEM32\lxddcaps.dll
2008-03-19 18:23 . 2007-02-21 19:11 45,056 --a------ C:\WINDOWS\SYSTEM32\LXF3PMON.DLL
2008-03-19 18:23 . 2007-02-21 19:11 32,768 --a------ C:\WINDOWS\SYSTEM32\LXF3FXPU.DLL
2008-03-19 18:22 . 2006-05-31 11:51 339,968 --a------ C:\WINDOWS\SYSTEM32\IMGMAN32.DLL
2008-03-19 18:22 . 2006-05-31 11:51 98,345 --a------ C:\WINDOWS\SYSTEM32\IMHOST32.DLL
2008-03-19 18:22 . 2006-11-07 06:02 36,864 --a------ C:\WINDOWS\SYSTEM32\lxf3oem.dll
2008-03-19 18:22 . 2007-02-21 19:14 12,288 --a------ C:\WINDOWS\SYSTEM32\LXF3PMRC.DLL
2008-03-19 18:15 . 2006-12-06 00:19 44 --a------ C:\WINDOWS\SYSTEM32\lxddrwrd.ini
2008-03-17 00:50 . 2004-08-04 02:08 31,616 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\usbccgp.sys
2008-03-17 00:50 . 2004-08-04 02:08 31,616 --a------ C:\WINDOWS\SYSTEM32\DLLCACHE\usbccgp.sys
2008-03-17 00:50 . 2004-08-04 02:01 25,856 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\usbprint.sys
2008-03-17 00:50 . 2004-08-04 02:01 25,856 --a------ C:\WINDOWS\SYSTEM32\DLLCACHE\usbprint.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-14 20:02 --------- d-----w C:\Program Files\lx_cats
2008-04-06 11:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\McAfee
2008-04-05 01:50 --------- d-----w C:\Program Files\PCPitstop
2008-04-05 01:03 --------- d-----w C:\Program Files\DivX
2008-04-05 00:17 --------- d-----w C:\Documents and Settings\MONICA\Application Data\Lavasoft
2008-04-04 22:30 --------- d-----w C:\Program Files\Yahoo!
2008-04-03 19:26 --------- d-----w C:\Program Files\Siebel Option Pack 7.5.3.11
2008-04-03 19:21 --------- d-----w C:\Program Files\MSN Games
2008-04-03 19:19 --------- d-----w C:\Program Files\Kodak
2008-04-03 19:06 --------- d-----w C:\Program Files\Windows Live Toolbar
2008-04-03 19:03 --------- d-----w C:\Program Files\ResumeMaker
2008-04-03 19:01 --------- d-----w C:\Program Files\Java
2008-04-02 21:15 --------- d--h--r C:\Documents and Settings\All Users\Application Data\yahoo!
2008-04-02 21:15 --------- d-----w C:\Documents and Settings\DORA\Application Data\Yahoo!
2008-03-26 17:48 --------- d-----w C:\Program Files\Abbyy FineReader 6.0 Sprint
2008-03-22 01:06 --------- d-----w C:\Documents and Settings\MONICA\Application Data\Lexmark Productivity Studio
2008-03-20 18:50 --------- d-----w C:\Documents and Settings\DORA\Application Data\Lexmark Productivity Studio
2008-03-19 22:23 --------- d-----w C:\Program Files\Lexmark 2500 Series
2008-03-19 22:22 --------- d-----w C:\Program Files\Lexmark Fax Solutions
2008-03-02 19:56 --------- d-----w C:\Documents and Settings\DORA\Application Data\FaxCtr
2008-03-02 17:19 --------- d-----w C:\Documents and Settings\MONICA\Application Data\FaxCtr
2008-03-01 19:07 --------- dc----w C:\Documents and Settings\All Users\Application Data\FaxCtr
2008-02-24 00:43 --------- d-----w C:\Documents and Settings\DORA\Application Data\Move Networks
2008-02-15 22:17 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-05 19:14 6,710 ----a-w C:\Program Files\INSTALL.LOG
2007-02-28 03:38 24,192 ----a-w C:\Documents and Settings\MONICA\usbsermptxp.sys
2007-02-28 03:38 22,768 ----a-w C:\Documents and Settings\MONICA\usbsermpt.sys
2004-12-10 07:26 49 ----a-w C:\Documents and Settings\DORA\Application Data\tvmcwrd.dll
2004-12-02 02:34 48 ----a-w C:\Documents and Settings\ENOW\Application Data\tvmcwrd.dll
2004-11-13 04:10 230,237 ----a-w C:\Documents and Settings\ENOW\Application Data\tvmknwrd.dll
2004-11-12 01:47 42 ----a-w C:\Documents and Settings\PRINCESS\Application Data\tvmcwrd.dll
2004-11-12 01:06 230,237 ----a-w C:\Documents and Settings\PRINCESS\Application Data\tvmknwrd.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{67982BB7-0F95-44C5-92DC-E3AF3DC19D6D}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8CA5ED52-F3FB-4414-A105-2E3491156990}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [2007-03-15 11:09 460784]
"Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [2007-08-30 18:43 4670704]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 12:54 5674352]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:56 15360]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 17:45 313472]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-22 12:41 68856]
"DellTransferAgent"="C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe" [2007-11-13 17:46 135168]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2004-05-12 02:03 1038336]
"Red Swoosh EDN Client"="C:\Program Files\RSSoft\RSEDNClient.exe" [ ]
"NetZero_uoltray"="C:\Program Files\NetZero\exec.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"lxddmon.exe"="C:\Program Files\Lexmark 2500 Series\lxddmon.exe" [2007-05-04 02:38 291760]
"lxddamon"="C:\Program Files\Lexmark 2500 Series\lxddamon.exe" [2007-03-05 03:40 20480]
"FaxCenterServer"="C:\Program Files\Lexmark Fax Solutions\fm3032.exe" [2007-05-04 02:40 312240]
"VSOCheckTask"="c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" [ ]
"VirusScan Online"="c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe" [ ]
"UserFaultCheck"="C:\WINDOWS\system32\dumprep 0 -u" [ ]
"tgcmd"="C:\Program Files\Support.com\BellSouth\hcenter.exe" [ ]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24 286720]
"NovaBackup 7 Tray Control"="C:\Program Files\NovaStor\NovaBACKUP\NbkCtrl.exe" [2005-06-23 09:03 221184]
"mmtask"="c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe" [2003-10-06 11:05 53248]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [ ]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2005-06-22 00:48 155648]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2004-02-12 13:38 49152]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 15:18 241664]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-06-22 00:44 126976]
"FRISK FP-Scheduler"="C:\Program Files\FSI\F-Prot\F-Sched.exe" [ ]
"F-StopW"="C:\Program Files\FSI\F-Prot\F-StopW.EXE" [ ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 12:24 1694208]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 23:05:26 29696]
InterVideo WinCinema Manager.lnk - C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe [2006-04-29 23:22:00 114688]
Photo Loader supervisory.lnk - C:\Program Files\CASIO\Photo Loader\Plauto.exe [2007-02-27 18:52:15 229376]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\SDNotify]
C:\Program Files\SpywareDetector\SDNotify.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^BugDoctor.lnk]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone Fast Start.lnk]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Error Nuker]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VIRIT LITE MONITOR]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\xp_system]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"SNDSrvc"=2 (0x2)
"UleadBurningHelper"=3 (0x3)
"mcupdmgr.exe"=3 (0x3)
"McTskshd.exe"=2 (0x2)
"McDetect.exe"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\WINDOWS\\SYSTEM32\\fxsclnt.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Internet Explorer\\iexplore.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Documents and Settings\\DORA\\Local Settings\\Apps\\2.0\\VGZZPTNN.QZW\\7CK99KB0.X5B\\west..kage_28b3eab364833aef_0001.0001_ec31e0c58d5dbef4\\WelcomeHome.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Documents and Settings\\MONICA\\Local Settings\\Apps\\2.0\\5CME6A2H.G5W\\TRNPHDQG.02V\\west..kage_28b3eab364833aef_0001.0002_490658ee75ccdff4\\WelcomeHome.exe"=
"C:\\Program Files\\AIM\\aim.exe"=
"C:\\Documents and Settings\\MONICA\\Local Settings\\Apps\\2.0\\5CME6A2H.G5W\\TRNPHDQG.02V\\west..kage_28b3eab364833aef_0001.0002_4a04786571555234\\WelcomeHome.exe"=
"C:\\Program Files\\UserTesting.com\\TestingRecorder\\TestingRecorder.exe"=
"C:\\Program Files\\Lexmark 2500 Series\\lxddamon.exe"=
"C:\\Program Files\\Lexmark 2500 Series\\App4R.exe"=
"C:\\WINDOWS\\SYSTEM32\\lxddcoms.exe"=
"C:\\Program Files\\Lexmark 2500 Series\\lxddmon.exe"=
"C:\\WINDOWS\\SYSTEM32\\SPOOL\\DRIVERS\\W32X86\\3\\lxddpswx.exe"=
"C:\\WINDOWS\\SYSTEM32\\SPOOL\\DRIVERS\\W32X86\\3\\lxddjswx.exe"=
"C:\\WINDOWS\\SYSTEM32\\SPOOL\\DRIVERS\\W32X86\\3\\lxddtime.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"135:TCP"= 135:TCP:TCP Port 135
"5000:TCP"= 5000:TCP:TCP Port 5000
"5001:TCP"= 5001:TCP:TCP Port 5001
"5002:TCP"= 5002:TCP:TCP Port 5002
"5003:TCP"= 5003:TCP:TCP Port 5003
"5004:TCP"= 5004:TCP:TCP Port 5004
"5005:TCP"= 5005:TCP:TCP Port 5005
"5006:TCP"= 5006:TCP:TCP Port 5006
"5007:TCP"= 5007:TCP:TCP Port 5007
"5008:TCP"= 5008:TCP:TCP Port 5008
"5009:TCP"= 5009:TCP:TCP Port 5009
"5010:TCP"= 5010:TCP:TCP Port 5010
"5011:TCP"= 5011:TCP:TCP Port 5011
"5012:TCP"= 5012:TCP:TCP Port 5012
"5013:TCP"= 5013:TCP:TCP Port 5013
"5014:TCP"= 5014:TCP:TCP Port 5014
"5015:TCP"= 5015:TCP:TCP Port 5015
"5016:TCP"= 5016:TCP:TCP Port 5016
"5017:TCP"= 5017:TCP:TCP Port 5017
"5018:TCP"= 5018:TCP:TCP Port 5018
"5019:TCP"= 5019:TCP:TCP Port 5019
"5020:TCP"= 5020:TCP:TCP Port 5020

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R2 lxdd_device;lxdd_device;C:\WINDOWS\system32\lxddcoms.exe [2007-04-26 01:21]
R2 Viewpoint Manager Service;Viewpoint Manager Service;"C:\Program Files\Viewpoint\Common\ViewpointService.exe" [2007-01-04 17:38]
S2 lxddCATSCustConnectService;lxddCATSCustConnectService;C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxddserv.exe [2007-04-26 01:21]
S3 ZY202_XP;ZyXEL 802.11g XG202 1211 Driver;C:\WINDOWS\system32\DRIVERS\WlanUZXP.sys [2006-04-20 14:38]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\M]
\Shell\AutoRun\command - M:\.\Start.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\Z]
\Shell\AutoRun\command - Z:\.\Start.exe

.
Contents of the 'Scheduled Tasks' folder
"2008-04-08 14:19:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-14 16:48:32
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\ad adware\aawservice.exe
C:\Program Files\NovaStor\NovaBACKUP\NSENGINE.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\Ymsgr_tray.exe
C:\WINDOWS\SYSTEM32\wscntfy.exe
C:\WINDOWS\PSEXESVC.EXE
.
**************************************************************************
.
Completion time: 2008-04-14 16:56:50 - machine was rebooted
ComboFix-quarantined-files.txt 2008-04-14 20:56:45

Pre-Run: 910,331,904 bytes free
Post-Run: 811,810,816 bytes free
.
2008-04-12 07:09:57 --- E O F ---



Hijackthis


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:03:57 PM, on 4/14/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\ad adware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\lxddcoms.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Lexmark 2500 Series\lxddmon.exe
C:\Program Files\Lexmark 2500 Series\lxddamon.exe
C:\Program Files\NovaStor\NovaBACKUP\NbkCtrl.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\CASIO\Photo Loader\Plauto.exe
C:\PROGRA~1\NovaStor\NOVABA~1\NSENGINE.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [lxddmon.exe] "C:\Program Files\Lexmark 2500 Series\lxddmon.exe"
O4 - HKLM\..\Run: [lxddamon] "C:\Program Files\Lexmark 2500 Series\lxddamon.exe"
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\Support.com\BellSouth\hcenter.exe" /starthidden /tgcmdwrapper
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NovaBackup 7 Tray Control] "C:\Program Files\NovaStor\NovaBACKUP\NbkCtrl.exe"
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [FRISK FP-Scheduler] C:\Program Files\FSI\F-Prot\F-Sched.exe STARTUP
O4 - HKLM\..\Run: [F-StopW] C:\Program Files\FSI\F-Prot\F-StopW.EXE
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [DellTransferAgent] "C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Red Swoosh EDN Client] C:\Program Files\RSSoft\RSEDNClient.exe
O4 - HKCU\..\Run: [NetZero_uoltray] C:\Program Files\NetZero\exec.exe regrun
O4 - HKUS\S-1-5-18\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Photo Loader supervisory.lnk = C:\Program Files\CASIO\Photo Loader\Plauto.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Display All Images with Full Quality - res://C:\Program Files\NetZero\qsacc\appres.dll/228
O8 - Extra context menu item: Display Image with Full Quality - res://C:\Program Files\NetZero\qsacc\appres.dll/227
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O16 - DPF: {001EE746-A1F9-460E-80AD-269E088D6A01} (Infotl Control) - http://0-site.ebrary.com.olinkserver.frank...s/ebraryRdr.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/u...can_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {3EEFCD4B-E9FD-4601-BE5D-C5C1776E51D3} -
O16 - DPF: {4DCCD2FC-132F-45EC-BFDA-72235B85047C} -
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m...01/mcinsctl.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Plug-in 1.5.0_11) -
O16 - DPF: {909A35CA-61DC-4437-887E-30ED6D89F6C8} -
O16 - DPF: {AF2E62B6-F9E1-4D4F-A10A-9DC8E6DCBCC0} -
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/m...,26/mcgdmgr.cab
O16 - DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} (Java Plug-in 1.5.0_10) -
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} -
O16 - DPF: {D4C9E474-9A6C-4FBF-B13A-4BE2BDD34FD5} -
O16 - DPF: {D6E7CFB5-C074-4D1C-B647-663D1A8D96BF} (Facebook Photo Uploader 4) - http://upload.facebook.com/controls/Facebo...Uploader4_5.cab
O16 - DPF: {E70E3E64-2793-4AEF-8CC8-F1606BE563B0} -
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\ad adware\aawservice.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: lxddCATSCustConnectService - Lexmark International, Inc. - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxddserv.exe
O23 - Service: lxdd_device - - C:\WINDOWS\system32\lxddcoms.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

--
End of file - 8921 bytes


Thanks for your patience.

#4 -David-

-David-

  • Members
  • 10,603 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London
  • Local time:01:16 AM

Posted 15 April 2008 - 12:23 PM

Great to hear the icon is gone! We've still got some work to do though... :thumbsup:

First things first, we need to install the recovery console onto your system; it's an important security and safety feature which you really do need to have installed. You can install the recovery console regardless of whether or not you have the XP cd that came with the operating system - I recommend you download the recovery console installation file from the internet, it's only about 4mb in size, so it shouldn't take too long to download.

Go to Microsoft's website => http://support.microsoft.com/kb/310994
At that page, scroll down and click on the appropriate download for your version of Windows XP (Home or Professional) and the service pack level that you have installed. When you click on the link to download the file, make sure you save it directly to your desktop.

If you are unsure what version of Windows you have and what Service Pack is installed, you can follow these instructions to gain that information:

1) Click on the Start button.
2) Click on the Run menu option.
3) In the Open: field type the following: sysdm.cpl and then click on the OK button.
4) A screen will appear showing information about your installation.
Under the System: category you should see your Windows version and the installed Service Pack.

Once the Microsoft file has finished downloading, close all open windows and programs, then drag the setup package onto ComboFix.exe and drop it. This is shown in the following image:
Posted Image
Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Microsoft Recovery Console. When complete, a log named CF_RC.txt will open. Please post the contents of that log.

#5 Ndipso

Ndipso
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:08:16 PM

Posted 15 April 2008 - 05:45 PM

Did the next step...hopefully, I did it the right way.

This is the CF_RC.txt log:


WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons





The log is kinda short. I promise I didn't take any shortcuts! :blink:

Awaitting your next commands..... :thumbsup:

#6 -David-

-David-

  • Members
  • 10,603 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London
  • Local time:01:16 AM

Posted 16 April 2008 - 08:53 AM

Hehe, I know you didn't take any shortcuts.. :thumbsup:

Please find and delete the following folder and file:
C:\WINDOWS\SYSTEM32\209789
C:\WINDOWS\SYSTEM32\lxddrwrd.ini

Please open notepad and and copy and paste next bold in it:
(don't forget to copy and paste REGEDIT4)

REGEDIT4

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Error Nuker]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Run]

Save this as "fix.reg" Choose to save as *all files and place it on your desktop.
It should look like this: Posted Image
Doubleclick on it and when it asks you if you want to merge the contents to the registry, click yes/ok.

Please perform this online scan: Kaspersky Webscan
Note that this scanner will only work on Internet Explorer, so please use this browser for the scan.
Read the Requirements and Privacy statement, then select "Accept"
A dialogue box will appearing asking "Do you want to install this software?" Name: kavwebscan_unicode.cab
Select "Install" to download the ActiveX controls that allows ActiveScan to run.

When the download is complete it will say ready, click "Next"
Select a target to scan: Click on "My Computer"
When the scan is complete choose to save the results as "Save as Text"
Post the Kaspersky scan results in your next reply, along with a new Hijackthis log.

#7 Ndipso

Ndipso
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:08:16 PM

Posted 16 April 2008 - 08:27 PM

Hi David,

I am ashamed to say that I am only now figuring out that notepad means notepad, and not wordpad :thumbsup:
It took me a while to figure out why doubleclicking the cute blue icon wouldn't prompt that message to merge it to the registry.

Well, here are the scan results:


Kaspersky


-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Wednesday, April 16, 2008 9:16:50 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 16/04/2008
Kaspersky Anti-Virus database records: 711370
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\
M:\

Scan Statistics:
Total number of scanned objects: 92456
Number of viruses found: 15
Number of infected objects: 30
Number of suspicious objects: 4
Duration of the scan process: 01:57:24

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\27d93284e02e2aad32d279e8089396c7_1dce0e75-1303-433a-bfc1-6b582bd25551 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\3c11c0f6c513e8a6d63eebdf5b5710c2_1dce0e75-1303-433a-bfc1-6b582bd25551 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\52ed115f9fe130a24f0d2e4b49d6685b_1dce0e75-1303-433a-bfc1-6b582bd25551 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\58d6a05ec62d647f76e80bf8a9bb1135_1dce0e75-1303-433a-bfc1-6b582bd25551 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\6a7ebcc40ff041471351c6b3d786dcd3_1dce0e75-1303-433a-bfc1-6b582bd25551 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\6fdf136c82e70c89cb0426c07cc615b0_1dce0e75-1303-433a-bfc1-6b582bd25551 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\8fab25b1af021bc9877daa57d59f72fa_1dce0e75-1303-433a-bfc1-6b582bd25551 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\9b26a0fd498f161bdac6638ebd75e519_1dce0e75-1303-433a-bfc1-6b582bd25551 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\febd63402ee797bce29bd67f9e6f9ebf_1dce0e75-1303-433a-bfc1-6b582bd25551 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\VcodeceMedia4.zip/uninst.exe Suspicious: Password-protected-EXE skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\VcodeceMedia4.zip ZIP: suspicious - 1 skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\ZlobVideoActiveXObject5.zip/uninst.exe Suspicious: Password-protected-EXE skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\ZlobVideoActiveXObject5.zip ZIP: suspicious - 1 skipped
C:\Documents and Settings\DORA\Application Data\Gtek\GTUpdate\AUpdate\DellSupport\DSAgnt.log Object is locked skipped
C:\Documents and Settings\DORA\Application Data\Gtek\GTUpdate\AUpdate\DellSupport\DSAgnt_GTActions.log Object is locked skipped
C:\Documents and Settings\DORA\Application Data\Gtek\GTUpdate\AUpdate\DellSupport\gdql_d_DSAgnt.log Object is locked skipped
C:\Documents and Settings\DORA\Application Data\Gtek\GTUpdate\AUpdate\DellSupport\glog.log Object is locked skipped
C:\Documents and Settings\DORA\Cookies\INDEX.DAT Object is locked skipped
C:\Documents and Settings\DORA\Local Settings\Application Data\ApplicationHistory\TransferAgent.exe.91f03f4d.ini.inuse Object is locked skipped
C:\Documents and Settings\DORA\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\DORA\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\DORA\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\DORA\Local Settings\History\History.IE5\MSHist012008041620080417\index.dat Object is locked skipped
C:\Documents and Settings\DORA\Local Settings\Temp\~DF7FDF.tmp Object is locked skipped
C:\Documents and Settings\DORA\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\DORA\ntuser.dat Object is locked skipped
C:\Documents and Settings\DORA\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\african front.pub Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\African Frontline.pub Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\Airticket letter.doc Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\C V.doc Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\Capital One Online Account Services Pay My Bill - Step 3 of 3.htm Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\Corel User Files\11\Projects.usr Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\Corel User Files\WT11US.HST Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\Corel User Files\WT11US.UWL Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\cv 2.doc Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\dentists.htm Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\DESKTOP.INI Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\Freelance 1.pub Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\fuel 101.doc Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\HIV cycle.gif Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\hiv_image.gif Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\katrina.doc Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\letterhead1.wpd Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\Mail-In Rebate Center.htm Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\Mail-In Rebate Center_files\common32.js Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\Mail-In Rebate Center_files\css.aspx Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\Mail-In Rebate Center_files\download.gif Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\Mail-In Rebate Center_files\hier.gif Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\Mail-In Rebate Center_files\img.gif Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\Mail-In Rebate Center_files\left.gif Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\Mail-In Rebate Center_files\light.gif Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\Mail-In Rebate Center_files\logo.gif Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\Mail-In Rebate Center_files\main.gif Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\Mail-In Rebate Center_files\menu.aspx Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\Mail-In Rebate Center_files\pdf.gif Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\Mail-In Rebate Center_files\primary.gif Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\Mail-In Rebate Center_files\secondary.gif Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\Mail-In Rebate Center_files\shad.gif Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\Mail-In Rebate Center_files\smextlink.gif Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\Mail-In Rebate Center_files\spacer.gif Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\Mail-In Rebate Center_files\viewlarger.gif Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\My Music\Desktop.ini Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\My Music\Sample Music.lnk Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\My Music\Unknown Artist\desktop.ini Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\My Pictures\applyForJob.htm Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\My Pictures\applyForJob_files\globalprocedures.js Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\My Pictures\Big City\City001.JPG Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\My Pictures\Big City\City002.jpg Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\My Pictures\Big City\City003.JPG Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\My Pictures\Big City\City004.jpg Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\My Pictures\Big City\City005.JPG Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\My Pictures\Big City\Thumbs.db Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\My Pictures\Desktop.ini Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\My Pictures\Flowers001.JPG Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\My Pictures\Flowers002.JPG Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\My Pictures\Flowers003.JPG Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\My Pictures\Flowers004.JPG Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\My Pictures\Flowers005.JPG Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\My Pictures\Flowers006.JPG Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\My Pictures\Jasc Paint Shop Photo Album Images\blue dress (2).jpg Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\My Pictures\Jasc Paint Shop Photo Album Images\Thumbs.db Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\My Pictures\Sample Pictures.lnk Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\My Pictures\Scenic\Scenic001.jpg Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\My Pictures\Scenic\Scenic002.jpg Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\My Pictures\Scenic\Scenic003.jpg Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\My Pictures\Scenic\Scenic004.JPG Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\My Pictures\Scenic\Scenic005.JPG Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\My Pictures\Scenic\Scenic006.JPG Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\My Pictures\Scenic\Scenic007.JPG Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\My Pictures\Scenic\Scenic008.JPG Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\My Pictures\Scenic\Scenic009.jpg Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\My Pictures\Scenic\Thumbs.db Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\My Pictures\Thumbs.db Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\My PSP8 Files\Scripts-Restricted\BoundScript1.PspScript Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\My PSP8 Files\Scripts-Restricted\BoundScript2.PspScript Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\My PSP8 Files\Scripts-Restricted\BoundScript3.PspScript Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\My PSP8 Files\Scripts-Restricted\BoundScript4.PspScript Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\My PSP8 Files\Scripts-Restricted\BoundScript5.PspScript Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\My PSP8 Files\Scripts-Restricted\BoundScript6.PspScript Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\My PSP8 Files\Scripts-Restricted\BoundScript7.PspScript Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\My PSP8 Files\Scripts-Restricted\BoundScript8.PspScript Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\My PSP8 Files\Scripts-Restricted\BoundScript9.PspScript Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\My PSP8 Files\Workspaces\Default.PSPWorkspace Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\My RoboForm Data\Default Profile\options.rfo Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\My RoboForm Data\Default Profile\RoboFormDataHere.txt Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\My Videos\Experience.mpg Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\My Videos\Thumbs.db Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\New Settings File.OPS Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\Outline.doc Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\Papa's CV.doc Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\papa's report.doc Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\phon payment.mht Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\resumes\Adele[1].doc Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\resumes\Martha I.wpd Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\resumes\Prince Donkor 2122 Hopkins Place Court Duluth.wpd Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\resumes\References.doc Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\resumes\~$ele Ako.doc Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\resumes\~WRL0001.tmp Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\spider.sav Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\WinXP\ltdfxp.cat Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\WinXP\ltdfxp.inf Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\WinXP\ltmdmxp.sys Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\WinXP\LtMoh.exe Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\WinXP\LTMOH.INI Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\WinXP\LTMSG.EXE Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\WinXP\ltremove.exe Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\WinXP\LTSETUP.INI Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\WinXP\ltsetup1.dll Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\WinXP\ltsetup2.dll Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\WinXP\mohapi.dll Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\WinXP\setup.exe Object is locked skipped
C:\Documents and Settings\ENOW\My Documents\~WRL3010.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\INDEX.DAT Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\INDEX.DAT Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\INDEX.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\MONICA\Favorites\locks\ 31 New .url Object is locked skipped
C:\Documents and Settings\MONICA\Favorites\locks\ FoZ.url Object is locked skipped
C:\Documents and Settings\MONICA\Favorites\locks\ guerilla sports .url Object is locked skipped
C:\Documents and Settings\MONICA\Favorites\locks\ invizibletouch.url Object is locked skipped
C:\Documents and Settings\MONICA\Favorites\locks\ Kong - Kong.url Object is locked skipped
C:\Documents and Settings\MONICA\Favorites\locks\ n Thigh.url Object is locked skipped
C:\Documents and Settings\MONICA\Favorites\locks\ Sir Rodney.url Object is locked skipped
C:\Documents and Settings\MONICA\Favorites\locks\ the net.url Object is locked skipped
C:\Documents and Settings\MONICA\Favorites\locks\100% FREE.url Object is locked skipped
C:\Documents and Settings\MONICA\Favorites\locks\18-19.url Object is locked skipped
C:\Documents and Settings\MONICA\Favorites\locks\Asia capoera.url Object is locked skipped
C:\Documents and Settings\MONICA\Favorites\locks\Audio Converter Home Page.url Object is locked skipped
C:\Documents and Settings\MONICA\Favorites\locks\bdex   .url Object is locked skipped
C:\Documents and Settings\MONICA\Favorites\locks\Big-boys Picture Gallery XXI.url Object is locked skipped
C:\Documents and Settings\MONICA\Favorites\locks\Bon.url Object is locked skipped
C:\Documents and Settings\MONICA\Favorites\locks\Boobler.url Object is locked skipped
C:\Documents and Settings\MONICA\Favorites\locks\camer-hamburg Index.url Object is locked skipped
C:\Documents and Settings\MONICA\Favorites\locks\ChickLinks.url Object is locked skipped
C:\Documents and Settings\MONICA\Favorites\locks\Coyote.url Object is locked skipped
C:\Documents and Settings\MONICA\Favorites\locks\Customize Links.url Object is locked skipped
C:\Documents and Settings\MONICA\Favorites\locks\D12 World .url Object is locked skipped
C:\Documents and Settings\MONICA\Favorites\locks\Daily .url Object is locked skipped
C:\Documents and Settings\MONICA\Favorites\locks\Dailymotion - .url Object is locked skipped
C:\Documents and Settings\MONICA\Favorites\locks\DREAMS.url Object is locked skipped
C:\Documents and Settings\MONICA\Favorites\locks\enchthumb.url Object is locked skipped
C:\Documents and Settings\MONICA\Favorites\locks\Favorite Thumbs.url Object is locked skipped
C:\Documents and Settings\MONICA\Favorites\locks\Filipina .url Object is locked skipped
C:\Documents and Settings\MONICA\Favorites\locks\Flixarchive.org .url Object is locked skipped
C:\Documents and Settings\MONICA\Favorites\locks\GorillaMask.url Object is locked skipped
C:\Documents and Settings\MONICA\Favorites\locks\Guy.url Object is locked skipped
C:\Documents and Settings\MONICA\Favorites\locks\Hall Of Fame.url Object is locked skipped
C:\Documents and Settings\MONICA\Favorites\locks\hawtala!!!.url Object is locked skipped
C:\Documents and Settings\MONICA\Favorites\locks\icanVag.url Object is locked skipped
C:\Documents and Settings\MONICA\Favorites\locks\Japanese.url Object is locked skipped
C:\Documents and Settings\MONICA\Favorites\locks\maddux.url Object is locked skipped
C:\Documents and Settings\MONICA\Favorites\locks\Modelos Colombianas .url Object is locked skipped
C:\Documents and Settings\MONICA\Favorites\locks\Paradise.url Object is locked skipped
C:\Documents and Settings\MONICA\Favorites\locks\Photo Blog.url Object is locked skipped
C:\Documents and Settings\MONICA\Favorites\locks\Playground.url Object is locked skipped
C:\Documents and Settings\MONICA\Favorites\locks\Poisonous Plants and Animals.url Object is locked skipped
C:\Documents and Settings\MONICA\Favorites\locks\Real-.url Object is locked skipped
C:\Documents and Settings\MONICA\Favorites\locks\RealPlayer.url Object is locked skipped
C:\Documents and Settings\MONICA\Favorites\locks\Rotten Library.url Object is locked skipped
C:\Documents and Settings\MONICA\Favorites\locks\rotten.com .url Object is locked skipped
C:\Documents and Settings\MONICA\Favorites\locks\RUTHLESS REVIEWS .url Object is locked skipped
C:\Documents and Settings\MONICA\Favorites\locks\Scammer-Possibility Evaluation.url Object is locked skipped
C:\Documents and Settings\MONICA\Favorites\locks\Something Awful .url Object is locked skipped
C:\Documents and Settings\MONICA\Favorites\locks\Sports.url Object is locked skipped
C:\Documents and Settings\MONICA\Favorites\locks\SPUNK .url Object is locked skipped
C:\Documents and Settings\MONICA\Favorites\locks\The HoneyDripper.url Object is locked skipped
C:\Documents and Settings\MONICA\Favorites\locks\The Superficial - Because You're Ugly.url Object is locked skipped
C:\Documents and Settings\MONICA\Favorites\locks\The.Net ~ .url Object is locked skipped
C:\Documents and Settings\MONICA\Favorites\locks\Thumbs.db Object is locked skipped
C:\Documents and Settings\MONICA\Favorites\locks\Thumbz TGP .url Object is locked skipped
C:\Documents and Settings\MONICA\Favorites\locks\totally free .url Object is locked skipped
C:\Documents and Settings\MONICA\Favorites\locks\TYGOOD .url Object is locked skipped
C:\Documents and Settings\MONICA\Favorites\locks\Whale Tail .url Object is locked skipped
C:\Documents and Settings\MONICA\Favorites\locks\X-Blog.url Object is locked skipped
C:\Documents and Settings\MONICA\Favorites\locks\YUOKE Galleries ).url Object is locked skipped
C:\Documents and Settings\MONICA\My Documents\My Pictures\wandaz\personal1\mbokotam\10-08-06_1733.jpg Object is locked skipped
C:\Documents and Settings\MONICA\My Documents\My Pictures\wandaz\personal1\mbokotam\balckstrip.jpg Object is locked skipped
C:\Documents and Settings\MONICA\My Documents\My Pictures\wandaz\personal1\mbokotam\beribona.JPG Object is locked skipped
C:\Documents and Settings\MONICA\My Documents\My Pictures\wandaz\personal1\mbokotam\checkerd.jpg Object is locked skipped
C:\Documents and Settings\MONICA\My Documents\My Pictures\wandaz\personal1\mbokotam\davbday 001.jpg Object is locked skipped
C:\Documents and Settings\MONICA\My Documents\My Pictures\wandaz\personal1\mbokotam\davbday 002.jpg Object is locked skipped
C:\Documents and Settings\MONICA\My Documents\My Pictures\wandaz\personal1\mbokotam\davbday 003.jpg Object is locked skipped
C:\Documents and Settings\MONICA\My Documents\My Pictures\wandaz\personal1\mbokotam\davmicky.jpg Object is locked skipped
C:\Documents and Settings\MONICA\My Documents\My Pictures\wandaz\personal1\mbokotam\fif1.jpg Object is locked skipped
C:\Documents and Settings\MONICA\My Documents\My Pictures\wandaz\personal1\mbokotam\homealone 001.jpg Object is locked skipped
C:\Documents and Settings\MONICA\My Documents\My Pictures\wandaz\personal1\mbokotam\homealone 003.jpg Object is locked skipped
C:\Documents and Settings\MONICA\My Documents\My Pictures\wandaz\personal1\mbokotam\homealone 006.jpg Object is locked skipped
C:\Documents and Settings\MONICA\My Documents\My Pictures\wandaz\personal1\mbokotam\homealone 007.jpg Object is locked skipped
C:\Documents and Settings\MONICA\My Documents\My Pictures\wandaz\personal1\mbokotam\homealone.jpg Object is locked skipped
C:\Documents and Settings\MONICA\My Documents\My Pictures\wandaz\personal1\mbokotam\IM000620.JPG Object is locked skipped
C:\Documents and Settings\MONICA\My Documents\My Pictures\wandaz\personal1\mbokotam\IM000621.JPG Object is locked skipped
C:\Documents and Settings\MONICA\My Documents\My Pictures\wandaz\personal1\mbokotam\IM000622.JPG Object is locked skipped
C:\Documents and Settings\MONICA\My Documents\My Pictures\wandaz\personal1\mbokotam\jujuboy.JPG Object is locked skipped
C:\Documents and Settings\MONICA\My Documents\My Pictures\wandaz\personal1\mbokotam\mboko.JPG Object is locked skipped
C:\Documents and Settings\MONICA\My Documents\My Pictures\wandaz\personal1\mbokotam\musket.jpg Object is locked skipped
C:\Documents and Settings\MONICA\My Documents\My Pictures\wandaz\personal1\mbokotam\pacman2.jpg Object is locked skipped
C:\Documents and Settings\MONICA\My Documents\My Pictures\wandaz\personal1\mbokotam\posta.JPG Object is locked skipped
C:\Documents and Settings\MONICA\My Documents\My Pictures\wandaz\personal1\mbokotam\silowet.JPG Object is locked skipped
C:\Documents and Settings\MONICA\My Documents\My Pictures\wandaz\personal1\mbokotam\Thumbs.db Object is locked skipped
C:\Documents and Settings\MONICA\My Documents\My Pictures\wandaz\personal1\mbokotam\whitehat.jpg Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Downloads\PrimeSuspectsGENSetup-dm[1].exe Infected: not-a-virus:AdWare.Win32.Trymedia.b skipped
C:\Program Files\Cloud10 MojoPac\nucomm_v1.5 Object is locked skipped
C:\Program Files\HP\hpcoretech\hpcmerr.log Object is locked skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1419\A0120985.exe Infected: Trojan-Downloader.Win32.Zlob.kue skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1419\A0120997.dll Infected: Trojan-Downloader.Win32.Zlob.kyi skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1419\A0120998.exe Infected: Trojan-Downloader.Win32.Zlob.kux skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1419\A0121010.exe Infected: Trojan-Downloader.Win32.Zlob.kux skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1419\A0121011.dll Infected: Trojan-Downloader.Win32.Zlob.kyi skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1419\A0121012.exe Infected: Trojan-Downloader.Win32.Zlob.kue skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1419\A0121021.dll Infected: Trojan-Downloader.Win32.Zlob.kyi skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1419\A0121022.exe Infected: Trojan-Downloader.Win32.Zlob.kux skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1419\A0121025.exe Infected: Trojan-Downloader.Win32.Zlob.kue skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1419\A0121099.exe Infected: Trojan-Downloader.Win32.Zlob.kux skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1419\A0121100.dll Infected: Trojan-Downloader.Win32.Zlob.kyi skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1419\A0121101.exe Infected: Trojan-Downloader.Win32.Zlob.kue skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1419\A0121110.dll Infected: Trojan-Downloader.Win32.Zlob.kyi skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1419\A0121111.exe Infected: Trojan-Downloader.Win32.Zlob.kux skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1419\A0121112.exe Infected: Trojan-Downloader.Win32.Zlob.kue skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1421\A0122150.exe Infected: Trojan-Downloader.Win32.Zlob.kux skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1421\A0122151.dll Infected: Trojan-Downloader.Win32.Zlob.kyi skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1421\A0122152.exe Infected: Trojan-Downloader.Win32.Zlob.kue skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1421\A0122159.exe Infected: Trojan-Downloader.Win32.Zlob.kvd skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1421\A0122160.exe Infected: Trojan-Downloader.Win32.Zlob.kyy skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1421\A0122166.dll Infected: Trojan-Downloader.Win32.Zlob.kyi skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1421\A0123184.exe Infected: Trojan-Downloader.Win32.Zlob.kzq skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1421\A0123185.exe Infected: Trojan-Downloader.Win32.Zlob.lax skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1421\A0123186.exe Infected: Trojan-Downloader.Win32.Zlob.lad skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1421\A0123187.dll Infected: Trojan-Downloader.Win32.Zlob.kye skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1422\A0123421.dll Infected: not-a-virus:AdTool.Win32.MyWebSearch.i skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1422\A0123422.scr Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1429\A0124638.dll Infected: not-virus:Hoax.Win32.Agent.bv skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1429\A0124641.dll Infected: not-a-virus:AdWare.Win32.E404.w skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1431\change.log Object is locked skipped
C:\WINDOWS\$NtUninstallKB833407$\bssym7.ttf Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\DataStore\DataStore.edb Object is locked skipped
C:\WINDOWS\SoftwareDistribution\DataStore\Logs\edb.log Object is locked skipped
C:\WINDOWS\SoftwareDistribution\DataStore\Logs\tmp.edb Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\AppEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\Internet.evt Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\Paramete.evt Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SAM Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SecEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SECURITY Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SysEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\H323LOG.TXT Object is locked skipped
C:\WINDOWS\SYSTEM32\LogFiles\WUDF\WUDFTrace.etl Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\WIADEBUG.LOG Object is locked skipped
C:\WINDOWS\WIASERVC.LOG Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
M:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1431\change.log Object is locked skipped

Scan process completed.



Hijackthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:18:03 PM, on 4/16/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\ad adware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\lxddcoms.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Lexmark 2500 Series\lxddmon.exe
C:\Program Files\Lexmark 2500 Series\lxddamon.exe
C:\Program Files\NovaStor\NovaBACKUP\NbkCtrl.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\PROGRA~1\NovaStor\NOVABA~1\NSENGINE.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\CASIO\Photo Loader\Plauto.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {67982BB7-0F95-44C5-92DC-E3AF3DC19D6D} - (no file)
O2 - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {8CA5ED52-F3FB-4414-A105-2E3491156990} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [lxddmon.exe] "C:\Program Files\Lexmark 2500 Series\lxddmon.exe"
O4 - HKLM\..\Run: [lxddamon] "C:\Program Files\Lexmark 2500 Series\lxddamon.exe"
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\Support.com\BellSouth\hcenter.exe" /starthidden /tgcmdwrapper
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NovaBackup 7 Tray Control] "C:\Program Files\NovaStor\NovaBACKUP\NbkCtrl.exe"
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [FRISK FP-Scheduler] C:\Program Files\FSI\F-Prot\F-Sched.exe STARTUP
O4 - HKLM\..\Run: [F-StopW] C:\Program Files\FSI\F-Prot\F-StopW.EXE
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [DellTransferAgent] "C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Red Swoosh EDN Client] C:\Program Files\RSSoft\RSEDNClient.exe
O4 - HKCU\..\Run: [NetZero_uoltray] C:\Program Files\NetZero\exec.exe regrun
O4 - HKUS\S-1-5-18\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Photo Loader supervisory.lnk = C:\Program Files\CASIO\Photo Loader\Plauto.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Display All Images with Full Quality - res://C:\Program Files\NetZero\qsacc\appres.dll/228
O8 - Extra context menu item: Display Image with Full Quality - res://C:\Program Files\NetZero\qsacc\appres.dll/227
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O16 - DPF: {001EE746-A1F9-460E-80AD-269E088D6A01} (Infotl Control) - http://0-site.ebrary.com.olinkserver.frank...s/ebraryRdr.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/u...can_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {3EEFCD4B-E9FD-4601-BE5D-C5C1776E51D3} -
O16 - DPF: {4DCCD2FC-132F-45EC-BFDA-72235B85047C} -
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m...01/mcinsctl.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Plug-in 1.5.0_11) -
O16 - DPF: {909A35CA-61DC-4437-887E-30ED6D89F6C8} -
O16 - DPF: {AF2E62B6-F9E1-4D4F-A10A-9DC8E6DCBCC0} -
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/m...,26/mcgdmgr.cab
O16 - DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} (Java Plug-in 1.5.0_10) -
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} -
O16 - DPF: {D4C9E474-9A6C-4FBF-B13A-4BE2BDD34FD5} -
O16 - DPF: {D6E7CFB5-C074-4D1C-B647-663D1A8D96BF} (Facebook Photo Uploader 4) - http://upload.facebook.com/controls/Facebo...Uploader4_5.cab
O16 - DPF: {E70E3E64-2793-4AEF-8CC8-F1606BE563B0} -
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\ad adware\aawservice.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: lxddCATSCustConnectService - Lexmark International, Inc. - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxddserv.exe
O23 - Service: lxdd_device - - C:\WINDOWS\system32\lxddcoms.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

--
End of file - 9020 bytes


Dreading next orders...nah, just kidding!!

#8 -David-

-David-

  • Members
  • 10,603 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London
  • Local time:01:16 AM

Posted 17 April 2008 - 03:32 PM

Good stuff, just one more thing to do now... :thumbsup:

We need to purge your infected system restore points.
On the Desktop, right-click My Computer, then click Properties.
Click the System Restore tab near the top of the window.
Check Turn off System Restore, click Apply, and then click OK.
More information on how to disable your system restore can be found here.

We want to create a new, clean restore point. Please first reboot your computer.
On the Desktop, right-click My Computer, then click Properties.
Click the System Restore tab near the top of the window.
Uncheck "Turn off System Restore", click Apply, and then click OK.

Click Start > All Programs > Accessories > System Tools, and select System Restore.
In the System Restore wizard, select the box next the text labeled "Create a restore point" and click the Next button.
Type a description for your new restore point - Something like "After trojan/spyware cleanup".
Click Create, and after it has created the restore point, click "Close".
Further instructions on creating a restore point can be found here

Please reboot a final time and let me know how the PC is running.
I see a clean Hijackthis log now!

#9 Ndipso

Ndipso
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:08:16 PM

Posted 17 April 2008 - 04:24 PM

A quick question before I post the new hijackethis log. Are you related to Dumbledore in the Harry Potter movies? You are as wise as he is, and I believe you can perform magic!! :thumbsup:

Hijackthis:


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:15:31 PM, on 4/17/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\ad adware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\lxddcoms.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lexmark 2500 Series\lxddmon.exe
C:\Program Files\Lexmark 2500 Series\lxddamon.exe
C:\Program Files\NovaStor\NovaBACKUP\NbkCtrl.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\PROGRA~1\NovaStor\NOVABA~1\NSENGINE.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\CASIO\Photo Loader\Plauto.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {67982BB7-0F95-44C5-92DC-E3AF3DC19D6D} - (no file)
O2 - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {8CA5ED52-F3FB-4414-A105-2E3491156990} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [lxddmon.exe] "C:\Program Files\Lexmark 2500 Series\lxddmon.exe"
O4 - HKLM\..\Run: [lxddamon] "C:\Program Files\Lexmark 2500 Series\lxddamon.exe"
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\Support.com\BellSouth\hcenter.exe" /starthidden /tgcmdwrapper
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NovaBackup 7 Tray Control] "C:\Program Files\NovaStor\NovaBACKUP\NbkCtrl.exe"
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [FRISK FP-Scheduler] C:\Program Files\FSI\F-Prot\F-Sched.exe STARTUP
O4 - HKLM\..\Run: [F-StopW] C:\Program Files\FSI\F-Prot\F-StopW.EXE
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [DellTransferAgent] "C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Red Swoosh EDN Client] C:\Program Files\RSSoft\RSEDNClient.exe
O4 - HKCU\..\Run: [NetZero_uoltray] C:\Program Files\NetZero\exec.exe regrun
O4 - HKUS\S-1-5-18\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Photo Loader supervisory.lnk = C:\Program Files\CASIO\Photo Loader\Plauto.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Display All Images with Full Quality - res://C:\Program Files\NetZero\qsacc\appres.dll/228
O8 - Extra context menu item: Display Image with Full Quality - res://C:\Program Files\NetZero\qsacc\appres.dll/227
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {001EE746-A1F9-460E-80AD-269E088D6A01} (Infotl Control) - http://0-site.ebrary.com.olinkserver.frank...s/ebraryRdr.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/u...can_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {3EEFCD4B-E9FD-4601-BE5D-C5C1776E51D3} -
O16 - DPF: {4DCCD2FC-132F-45EC-BFDA-72235B85047C} -
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m...01/mcinsctl.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Plug-in 1.5.0_11) -
O16 - DPF: {909A35CA-61DC-4437-887E-30ED6D89F6C8} -
O16 - DPF: {AF2E62B6-F9E1-4D4F-A10A-9DC8E6DCBCC0} -
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/m...,26/mcgdmgr.cab
O16 - DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} (Java Plug-in 1.5.0_10) -
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} -
O16 - DPF: {D4C9E474-9A6C-4FBF-B13A-4BE2BDD34FD5} -
O16 - DPF: {D6E7CFB5-C074-4D1C-B647-663D1A8D96BF} (Facebook Photo Uploader 4) - http://upload.facebook.com/controls/Facebo...Uploader4_5.cab
O16 - DPF: {E70E3E64-2793-4AEF-8CC8-F1606BE563B0} -
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\ad adware\aawservice.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: lxddCATSCustConnectService - Lexmark International, Inc. - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxddserv.exe
O23 - Service: lxdd_device - - C:\WINDOWS\system32\lxddcoms.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

--
End of file - 9838 bytes


Pleeeeeaaaase let it be clean.

A message to all the virus, hijacker guys, adware, spyware... :blink:

Awaitting any more orders....

#10 -David-

-David-

  • Members
  • 10,603 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London
  • Local time:01:16 AM

Posted 17 April 2008 - 04:28 PM

1 last step to do, then we're allll done! :thumbsup:
And yes, of course I'm related to Dumbledore, I'm Harry Potter himself!

I see you are running Teatimer.
I suggest you to disable it because it can interfere with the changes you'll make on your system.
When everything is done and your log is clean again, you can enable it again.
If teatimer gives you a warning afterwards that some changes were made, allow this instead of blocking it.
How to disable TeaTimer during HijackThis Cleanup
Then, Download ResetTeaTimer.bat.
Double click ResetTeaTimer.bat to remove all entries set by TeaTimer.

Start HijackThis, close all open windows leaving only HijackThis running. Place a check against each of the following if still present:

O16 - DPF: {001EE746-A1F9-460E-80AD-269E088D6A01} (Infotl Control) - http://0-site.ebrary.com.olinkserver.frank...s/ebraryRdr.cab
O16 - DPF: {3EEFCD4B-E9FD-4601-BE5D-C5C1776E51D3} -
O16 - DPF: {4DCCD2FC-132F-45EC-BFDA-72235B85047C} -
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Plug-in 1.5.0_11) -
O16 - DPF: {909A35CA-61DC-4437-887E-30ED6D89F6C8} -
O16 - DPF: {AF2E62B6-F9E1-4D4F-A10A-9DC8E6DCBCC0} -
O16 - DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} (Java Plug-in 1.5.0_10) -
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} -
O16 - DPF: {D4C9E474-9A6C-4FF-B13A-4BE2BDD34FD5} -
O16 - DPF: {E70E3E64-2793-4AEF-8CC8-F1606BE563B0} -

Click on Fix Checked when finished and exit HijackThis.
Make sure your Internet Explorer is closed when you click Fix Checked!

Reboot once more and post the final HJT, I should then be able to give you the all clear!

#11 Ndipso

Ndipso
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:08:16 PM

Posted 17 April 2008 - 05:19 PM

Harry Potter!?! I knew it! Hewhomustnotbenamed was just trying to get your attention by infecting my pc with his Hocruxes!! I bet he's shaking in his boots now!! You are a master spell-caster!

Hijackthis:


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:07:18 PM, on 4/17/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\ad adware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lexmark 2500 Series\lxddmon.exe
C:\Program Files\Lexmark 2500 Series\lxddamon.exe
C:\Program Files\NovaStor\NovaBACKUP\NbkCtrl.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\system32\hkcmd.exe
C:\PROGRA~1\NovaStor\NOVABA~1\NSENGINE.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\CASIO\Photo Loader\Plauto.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\lxddcoms.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {67982BB7-0F95-44C5-92DC-E3AF3DC19D6D} - (no file)
O2 - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {8CA5ED52-F3FB-4414-A105-2E3491156990} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [lxddmon.exe] "C:\Program Files\Lexmark 2500 Series\lxddmon.exe"
O4 - HKLM\..\Run: [lxddamon] "C:\Program Files\Lexmark 2500 Series\lxddamon.exe"
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\Support.com\BellSouth\hcenter.exe" /starthidden /tgcmdwrapper
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NovaBackup 7 Tray Control] "C:\Program Files\NovaStor\NovaBACKUP\NbkCtrl.exe"
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [FRISK FP-Scheduler] C:\Program Files\FSI\F-Prot\F-Sched.exe STARTUP
O4 - HKLM\..\Run: [F-StopW] C:\Program Files\FSI\F-Prot\F-StopW.EXE
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [DellTransferAgent] "C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe"
O4 - HKCU\..\Run: [Red Swoosh EDN Client] C:\Program Files\RSSoft\RSEDNClient.exe
O4 - HKCU\..\Run: [NetZero_uoltray] C:\Program Files\NetZero\exec.exe regrun
O4 - HKUS\S-1-5-18\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Photo Loader supervisory.lnk = C:\Program Files\CASIO\Photo Loader\Plauto.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Display All Images with Full Quality - res://C:\Program Files\NetZero\qsacc\appres.dll/228
O8 - Extra context menu item: Display Image with Full Quality - res://C:\Program Files\NetZero\qsacc\appres.dll/227
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/u...can_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m...01/mcinsctl.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/m...,26/mcgdmgr.cab
O16 - DPF: {D6E7CFB5-C074-4D1C-B647-663D1A8D96BF} (Facebook Photo Uploader 4) - http://upload.facebook.com/controls/Facebo...Uploader4_5.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\ad adware\aawservice.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: lxddCATSCustConnectService - Lexmark International, Inc. - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxddserv.exe
O23 - Service: lxdd_device - - C:\WINDOWS\system32\lxddcoms.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

--
End of file - 8890 bytes


Looking forward to the virus-free Graduation! :thumbsup:

#12 -David-

-David-

  • Members
  • 10,603 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London
  • Local time:01:16 AM

Posted 17 April 2008 - 05:24 PM

Woop! The Hijackthis log is looking so clean, it's like someone's cast the Scourgify (Scouring Charm) on your PC!
I cannot actually believe I was that sad I searched on Wikipedia for a list of Harry Potter spells.. :thumbsup:
How is the computer running? I'm pleased to declare you have a clean bill of health!

#13 Ndipso

Ndipso
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:08:16 PM

Posted 17 April 2008 - 06:16 PM

'Scourgify'? LOL!!! (The funny thing is, I have a school group project due in a couple of weeks. We were given a list of movies to chose from. My team got Harry Potter! I kid you not!)

This pc is moving so fast and smooth, its scary!! I opened up IE,and it came up almost instantaneously! I was shocked!!!!! My eyes almost popped out of my head! :thumbsup:

You guys are amazing! Please don't blame me if I find it hard to leave and become a big time lurker on this forum!!
Thanks so much for all your help and patience.
Many thanks!!

#14 -David-

-David-

  • Members
  • 10,603 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London
  • Local time:01:16 AM

Posted 18 April 2008 - 04:24 PM

Glad I could help! :thumbsup:
The latest log is looking clean!
Follow this list and your potential for being infected again will be reduced dramatically.

Use an Anti Virus Software -
* It is very important that your computer has an anti-virus software running on your machine.
* This alone can save you a lot of trouble with malware in the future. This link has listings of stand-alone anti virus programs:
* Click here for more information on -> Computer Safety On line - Anti-Virus
* I would recommend Grisoft's AVG or AVAST.
* These are the more secure and better ones.

Update your Anti Virus Software - It is imperitive that you update your Anti virus software at least once a week (Even more if you wish). If you do not update your anti virus software then it will not be able to catch any of the new variants that may come out.

Use a Firewall -
* I can not stress how important it is that you use a Firewall on your computer.
* Without a firewall your computer is susceptible to being hacked and taken over.
* Simply using a Firewall in its default configuration can lower your risk greatly.
* For an article on Firewalls and a listing of some available ones see the link below:
* Click here for more information on -> Computer Safety On line - Software Firewalls
* I would recommend ZoneAlarm as a firewall as it's easy to use.

Visit Microsoft's Windows Update Site Frequently -
* It is important that you visit http://www.windowsupdate.com regularly.
* This will ensure your computer has always the latest security updates available installed on your computer.
* If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

Next, if they're not already present, I would recommend the download and installation of some or all of the following programs (all free), and the updating of them regularly

Install Spybot© - Search and Destroy- Install and download Spybot - Search and Destroy with its TeaTimer option.
* This will provide real-time spyware & hijacker protection on your computer alongside your virus protection.
* You should also scan your computer with program on a regular basis just as you would an anti virus software.
* A tutorial on installing & using this product can be found here:
* Click here for more info -->Instructions for - Spybot S & D and Ad-aware

Install Lavasofts© Ad-Aware - Install and download Ad-Aware.
* You should also scan your computer with the program on a regular basis just as you would an anti virus software in conjunction with Spybot.
* A tutorial on installing & using this product can be found here:
* Click here for more info -->Instructions for - Spybot S & D and Ad-aware

Install Javacools© SpywareBlaster -
* SpywareBlaster will added a large list of programs and sites into your Internet Explorer and Firefox settings and that will protect you from running and downloading known malicious programs.
* A article on anti-malware products with links for this program and others can be found here:
* Click here for more info -->Computer Safety on line - Anti-Malware

Update all these programs regularly - Make sure you update all the programs I have listed regularly.
Without regular updates you WILL NOT be protected when new malicious programs are released.

If you have any addition questions just ask...
David

#15 Ndipso

Ndipso
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:08:16 PM

Posted 19 April 2008 - 04:10 PM

Thanks for the advice!! Will esp need to update my antivurus software!

Thanks for everything once more! :thumbsup:




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users