Help Removing Antispyware Soft + Others

I think I have multiple infections on this machine including Antispyware Soft.

Started with redirection of search results in IE. Now I have all of the Antispyware Soft problems in addition.

I followed the Antispyware Soft removal tutorial, but I was not able to download and run the programs required including Malwarebytes. Most programs can be installed, but they won't run. It appears that they are being blocked.

Here are my logs which I had to run in Safe Mode. Not sure if this will work.


DDS (Ver_10-03-17.01) - NTFSx86 MINIMAL
Run by Owner at 17:28:41.89 on Fri 05/07/2010
Internet Explorer: 8.0.6001.18372
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.1982.1552 [GMT -7:00]

SP: Spybot - Search and Destroy *disabled* (Outdated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\Explorer.EXE
C:\Windows\system32\wbem\unsecapp.exe
C:\Users\Owner\Desktop\dds.scr
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://espn.com/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=73&bd=Pavilion&pf=laptop
mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=73&bd=Pavilion&pf=laptop
uInternet Settings,ProxyOverride = <local>
uInternet Settings,ProxyServer = http=127.0.0.1:5555
uURLSearchHooks: H - No File
uURLSearchHooks: H - No File
uURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg8\toolbar\IEToolbar.dll
BHO: Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg8\toolbar\IEToolbar.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.4.4525.1752\swg.dll
BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_A8904FB862BD9564.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll
TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg8\toolbar\IEToolbar.dll
uRun: [LightScribe Control Panel] c:\program files\common files\lightscribe\LightScribeControlPanel.exe -hidden
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRun: [Universal Installer] "c:\program files\comcastui\universal installer\uinstaller.exe" /fromrun /starthidden
uRun: [Desktop Software] "c:\program files\comcastui\universal installer\uinstaller.exe" /ini "uinstaller.ini" /fromrun /starthidden
uRun: [ColdWare] c:\windows\temp\28568135.tmp.exe
uRun: [WiniFighter] c:\program files\winifighter software\winifighter\WiniFighter.exe -min
uRun: [msttvkdw] c:\users\owner\appdata\local\wydtisykr\rlydvcxtssd.exe
uRun: [pnbjptlx] c:\users\owner\appdata\local\lmetidmui\rcrukrktssd.exe
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [QPService] "c:\program files\hp\quickplay\QPService.exe"
mRun: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
mRun: [HP Health Check Scheduler] c:\program files\hewlett-packard\hp health check\HPHC_Scheduler.exe
mRun: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
mRun: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [SynTPStart] c:\program files\synaptics\syntp\SynTPStart.exe
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\AppleSyncNotifier.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office\OSA9.EXE
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\vongot~1.lnk - c:\windows\installer\{8c3ae2d1-854d-4650-a73d-c7cc7ee36b80}\NewShortcut2_DB7E00C96DEF489A8112D8F81614F45A.exe
uPolicies-explorer: NoDesktopCleanupWizard = 1 (0x1)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
DPF: Microsoft XML Parser for Java - file:///C:/Windows/Java/classes/xmldso.cab
DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} - hxxps://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} - hxxp://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection2.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {BCBC9371-9827-11DA-A72B-0800200C9A66} - hxxp://merillat.view22.com/release_3_9_177/View22RTEv4.cab
DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: NameServer = 85.255.112.184,85.255.112.75
TCP: {3C4C231C-BD71-4AC7-A165-5023550969D3} = 85.255.112.184,85.255.112.75
TCP: {8081FFA4-8702-4231-AD95-CF59EDC4FCA8} = 85.255.112.184,85.255.112.75
Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\google\google toolbar\component\fastsearch_A8904FB862BD9564.dll
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} -
SEH: Eudora's Shell Extension: {edb0e980-90bd-11d4-8599-0008c7d3b6f8} - c:\windows\themes\magic\EuShlExt.dll
mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "c:\program files\common files\lightscribe\LSRunOnce.exe"

================= FIREFOX ===================

FF - ProfilePath - c:\users\owner\appdata\roaming\mozilla\firefox\profiles\8a3dq32g.default\

---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============


=============== Created Last 30 ================

2010-05-08 00:24:24 0 ----a-w- c:\users\owner\defogger_reenable
2010-05-07 09:39:30 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-05-07 09:39:26 0 d-----w- c:\programdata\Malwarebytes
2010-05-07 09:39:25 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-05-05 21:56:08 823808 ----a-w- c:\windows\system32\drivers\kuaiykhu.sys
2010-04-28 02:07:26 0 d-----w- c:\program files\iPod
2010-04-28 02:07:24 0 d-----w- c:\program files\iTunes
2010-04-28 02:04:48 0 d-----w- c:\program files\Bonjour
2010-04-08 20:20:02 91424 ----a-w- c:\windows\system32\dnssd.dll
2010-04-08 20:20:02 107808 ----a-w- c:\windows\system32\dns-sd.exe

==================== Find3M ====================

2010-05-06 00:09:44 27839 ----a-w- c:\programdata\nvModes.dat
2010-04-28 02:05:17 51200 ----a-w- c:\windows\inf\infpub.dat
2010-04-28 02:05:17 143360 ----a-w- c:\windows\inf\infstrng.dat
2010-03-31 02:40:56 86016 ----a-w- c:\windows\inf\infstor.dat
2010-03-09 11:28:20 411368 ----a-w- c:\windows\system32\deploytk.dll
2008-09-22 18:44:29 174 --sha-w- c:\program files\desktop.ini
2008-09-22 18:33:19 665600 ----a-w- c:\windows\inf\drvindex.dat
2006-11-02 12:42:02 30674 ----a-w- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 12:42:02 30674 ----a-w- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 12:42:02 287440 ----a-w- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 12:42:02 287440 ----a-w- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 09:20:21 287440 ----a-w- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 09:20:21 287440 ----a-w- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 09:20:19 30674 ----a-w- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 09:20:19 30674 ----a-w- c:\windows\inf\perflib\0000\perfc.dat
2010-01-24 22:48:56 16384 --sha-w- c:\windows\serviceprofiles\localservice\appdata\local\microsoft\windows\history\history.ie5\index.dat
2010-01-24 22:48:56 32768 --sha-w- c:\windows\serviceprofiles\localservice\appdata\local\microsoft\windows\temporary internet files\content.ie5\index.dat
2010-01-24 22:48:56 16384 --sha-w- c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\windows\cookies\index.dat
2007-12-21 08:36:57 22 --sha-w- c:\windows\sminst\HPCD.sys
2009-07-01 00:31:16 952 --sha-w- c:\windows\system32\KGyGaAvL.sys
2009-07-07 03:56:05 32768 --sha-w- c:\windows\system32\config\systemprofile\appdata\local\microsoft\windows\history\history.ie5\mshist012009070620090707\index.dat
2009-04-03 04:18:09 32768 --sha-w- c:\windows\system32\config\systemprofile\appdata\roaming\microsoft\windows\ietldcache\index.dat

============= FINISH: 17:28:56.91 ===============

Hello looky_lou Welcome to the BC HijackThis Log and Analysis forum. I will be assisting you in cleaning up your system.


I ask that you refrain from running tools other than those we suggest while we are cleaning up your computer. The reason for this is so we know what is going on with the machine at any time. Some programs can interfere with others and hamper the recovery process.



In the upper right hand corner of the topic you will see a button called Options. If you click on this in the drop-down menu you can choose Track this topic. By doing this and then choosing Immediate E-Mail notification and then clicking on Proceed you will be advised when we respond the your topic and facilitate the cleaning of your machine.


Please keep in mind that we have a large backlog of users just like yourself waiting to be helped so try to be as timely as possible in your replies. Since we do this on a part-time voluntary basis we are limited on how many logs we can respond to and keep open due to time restraints. If you have to be away or can't answer for some other reason just let me know. Thank you for your understanding.



After 5 days if a topic is not replied to we assume it has been abandoned and it is closed.



I would like for you to download and run ComboFix. The instructions are below but when you download it rename it to something you can remember. Right before you try to run ComboFix(CF) run RKill. So you will want to go ahead and download both programs but run RKill just prior to attempting to run CF. If something is not clear don't hesitate to ask.



RKill by Grinler

Link #1
Link #2
Link #3
Link #4

• Download Link #1.
• Save it to your Desktop.
• Double click the RKill desktop icon.
  If you are using Vista please right click and run as Admin!
• A black screen will briefly flash indicating a successful run.
• If this does not occur please delete that application and download Link #2.
• Continue process until the tool runs.
• If the tool does not run from any of the links tell me about it.

Please download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Instruction can be found HERE
  
• Double click on ComboFix.exe & follow the prompts.

When finished, it will produce a log for you. Please include the C:\ComboFix.txt in your next reply.







Note: Please post the log in the reply window and do not make it an attachment. Do this with all subsequent replies unless I ask otherwise. I will not need the log RKill generates.







Thanks,



thewall

ComboFix 10-05-10.02 - Owner 05/10/2010 13:52:33.1.2 - x86
Running from: c:\users\Owner\Desktop\cf01.exe
SP: Spybot - Search and Destroy *disabled* (Outdated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Autorun.inf
c:\program files\DigitalLabs
c:\users\Owner\AppData\Local\lmetidmui
c:\users\Owner\AppData\Local\lmetidmui\rcrukrktssd.exe
c:\users\Owner\AppData\Local\wydtisykr
c:\users\Owner\AppData\Local\wydtisykr\rlydvcxtssd.exe
c:\users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DigitalLabs
c:\users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DigitalLabs\Uninstall.lnk
c:\windows\10989za5kto9l285.cpl
c:\windows\109fszyware254.exe
c:\windows\1125zn5t-a-virus698.exe
c:\windows\11385pz391.exe
c:\windows\11791w5zm5a9.bin
c:\windows\11973z5rm33c.exe
c:\windows\126ezddw5re1194.cpl
c:\windows\12902hacktool7z25.dll
c:\windows\1290threat1z9835.bin
c:\windows\12926trojze5.bin
c:\windows\12936z95mbot550.ocx
c:\windows\12962vz5us37d9.cpl
c:\windows\13157vir597z.cpl
c:\windows\13239zorm5b2.dll
c:\windows\13623v9rzs495.cpl
c:\windows\13686viruz75e9.cpl
c:\windows\14057wo952z6.dll
c:\windows\14347hazk5ool39b.cpl
c:\windows\1453659cktool5z1.dll
c:\windows\1456thiefz989.dll
c:\windows\1485vir9s3ze5.bin
c:\windows\1539tzreat10821.cpl
c:\windows\153asteaz2975.dll
c:\windows\15582wo9z619.dll
c:\windows\15599troj5fz.bin
c:\windows\15693s5y58z.cpl
c:\windows\15732tro55z79.bin
c:\windows\1616zack5ool219.dll
c:\windows\16185s9z56d.cpl
c:\windows\16559tzoj5e2.bin
c:\windows\1669ztroj15.exe
c:\windows\1695hac9tooz533.dll
c:\windows\16e8v5931z3.bin
c:\windows\172279aczt5ol59f.exe
c:\windows\174ztro5394.cpl
c:\windows\17557nzt9a-5irusb0.bin
c:\windows\179z6tro53b9.ocx
c:\windows\18155s5ambot39z.dll
c:\windows\18286w5rz5629.dll
c:\windows\18409spz385.exe
c:\windows\185069rojz8c.exe
c:\windows\18590wo5m1b5z.bin
c:\windows\186z7virus695.ocx
c:\windows\18z75worm599.exe
c:\windows\192ztroj6a95.cpl
c:\windows\19460szambo97a5.ocx
c:\windows\19592spazbot945.dll
c:\windows\19594worm7z3.ocx
c:\windows\19640zpambo975e.cpl
c:\windows\198529roj7bz5.dll
c:\windows\198889rojz5.bin
c:\windows\1997spy5d1z.cpl
c:\windows\199aspy5zre1292.dll
c:\windows\1c2cztea528079.cpl
c:\windows\1c52zack9oor2576.cpl
c:\windows\1da7th9ez715.cpl
c:\windows\1ef8thiez6795.exe
c:\windows\1f18back5oorz696.dll
c:\windows\1f3etzief26659.dll
c:\windows\1fe5tzrea59394.dll
c:\windows\1z3fspars927455.dll
c:\windows\1zf2addwa9e5535.dll
c:\windows\20019spamzot5ee.dll
c:\windows\2021zspy98a5.cpl
c:\windows\202625orz4e9.dll
c:\windows\204bspzware39395.exe
c:\windows\207379zambo53f1.dll
c:\windows\20z29v5ru99c.dll
c:\windows\20zca9dware15105.exe
c:\windows\20zdbackdoor23599.cpl
c:\windows\21060not-a-viruz9b65.cpl
c:\windows\2138695oj3zd.ocx
c:\windows\2183095rm39z.cpl
c:\windows\21z89virus1e55.dll
c:\windows\22439hiez1557.ocx
c:\windows\224955zy7f5.exe
c:\windows\22575spy1cz9.exe
c:\windows\226289acktool452z.cpl
c:\windows\229z9spy7e5.exe
c:\windows\2435w9rm43ez.exe
c:\windows\24395hreat92z9.cpl
c:\windows\24557noz-a-v9rus62d.dll
c:\windows\24719s5y1zd.exe
c:\windows\2474659oj7f1z.ocx
c:\windows\2475z5ot-a-9irus716.dll
c:\windows\24959spazbot4a4.cpl
c:\windows\249z1ha9kt5ol4bc.dll
c:\windows\25057t9z5795.cpl
c:\windows\251z69p514c.cpl
c:\windows\25215ha9kzool7b.ocx
c:\windows\252675ot-z-vir9s65a.dll
c:\windows\25453wo9m7ze.dll
c:\windows\254z8troj3ae9.ocx
c:\windows\2551sparse954z.exe
c:\windows\2554zsp925e.bin
c:\windows\2557steal1z96.exe
c:\windows\25654spa9bot7z1.dll
c:\windows\25790hacktool586z.cpl
c:\windows\2579zpy677.bin
c:\windows\25859parse1849z.cpl
c:\windows\25952not-a-virus22z.ocx
c:\windows\2595downloader1z13.cpl
c:\windows\25976tr5j67z.cpl
c:\windows\25995wozm359.exe
c:\windows\2599zw5rm91.dll
c:\windows\25b39hzef785.dll
c:\windows\25f3ad9warez3175.dll
c:\windows\260z9pyware2525.exe
c:\windows\2641ha5k9ool6a0z.ocx
c:\windows\265z39acktool636.bin
c:\windows\2675roj5z49.exe
c:\windows\27039not5a-vz9us7b1.dll
c:\windows\27632s5a9zot156.exe
c:\windows\27769vzru5723.exe
c:\windows\27896n5t-a-virus3bez.dll
c:\windows\27991spam5ot750z.dll
c:\windows\27z759yware23.exe
c:\windows\28483wo5z2879.exe
c:\windows\28839w5rm29z.ocx
c:\windows\28b4sparse289z5.dll
c:\windows\28z55worm974.cpl
c:\windows\28z58sp945e5.bin
c:\windows\29017v95us7z4.exe
c:\windows\29067spz695.bin
c:\windows\29253zackto5l299.bin
c:\windows\29436virus115z.cpl
c:\windows\29502wor52dez.dll
c:\windows\29591viruz79b.dll
c:\windows\2985th5e9192z.dll
c:\windows\29895virus5zb.exe
c:\windows\298z9wormc5.dll
c:\windows\29z35vi5us19e.cpl
c:\windows\29z5sparse1194.exe
c:\windows\2ad9addware588z.cpl
c:\windows\2c3zs9yware615.bin
c:\windows\2e51s9yzare951.ocx
c:\windows\2e5as9a5sz804.exe
c:\windows\2z746spa5bo9783.ocx
c:\windows\2z759tro5329.ocx
c:\windows\2z93ste5943.bin
c:\windows\30903w5rm345z.dll
c:\windows\30z05spy399.dll
c:\windows\30z68t5ojb69.dll
c:\windows\31026wz5m479.bin
c:\windows\3158s9ezl1611.bin
c:\windows\3199v5r108z.exe
c:\windows\31dza95ware1245.bin
c:\windows\3269zac5door3984.cpl
c:\windows\329fdownlo5dez7679.exe
c:\windows\33dfspyz5re965.exe
c:\windows\3428thi5z16969.cpl
c:\windows\3463thzef2915.ocx
c:\windows\34za9ir2522.exe
c:\windows\34zfsparse195.exe
c:\windows\3563s9ywa5z3088.bin
c:\windows\3693szea5924.exe
c:\windows\3859spywar9211z.bin
c:\windows\3901tzo564f.dll
c:\windows\393zvir5s248.cpl
c:\windows\396addwarz2159.bin
c:\windows\39f5tzief28905.cpl
c:\windows\3b9559reat6z1.cpl
c:\windows\3d0dstz9l1523.dll
c:\windows\3dz59teal16015.dll
c:\windows\3e07zte5l3900.ocx
c:\windows\3e38addw5r9z168.ocx
c:\windows\3f92vir25z2.cpl
c:\windows\3z2905pambot1b1.bin
c:\windows\3z575iru96e7.dll
c:\windows\41359azkdoor1595.cpl
c:\windows\41czvir2935.bin
c:\windows\4255ste9z2671.cpl
c:\windows\43cfzt5al21219.cpl
c:\windows\45279or528z.ocx
c:\windows\454noz-a-viru5359.ocx
c:\windows\46e1spywa9z885.cpl
c:\windows\47d5downloa59r263z.ocx
c:\windows\4835tro9zdb.bin
c:\windows\4a9zspars9625.ocx
c:\windows\4b9dtzie5944.bin
c:\windows\4c59addza9e1145.cpl
c:\windows\4cb5t59ef70z.dll
c:\windows\4cded5wzl9ader1445.ocx
c:\windows\4dd9t5re9t3z40.dll
c:\windows\4dezthi5f8419.cpl
c:\windows\4df3dow5loazer22009.bin
c:\windows\4e5zvir2975.dll
c:\windows\4z2bspyw5re16859.dll
c:\windows\4z4fth59f1712.cpl
c:\windows\4ze99tea5261.ocx
c:\windows\50aback9zor950.ocx
c:\windows\50b7t9ief3z85.dll
c:\windows\51177worz499.dll
c:\windows\51416no9za-virus279.bin
c:\windows\5156spzrse2958.cpl
c:\windows\51dbsparse1049z.cpl
c:\windows\524s9ywa5z1337.cpl
c:\windows\52902spyz15.ocx
c:\windows\52d5stea9z3.bin
c:\windows\5345s9azbot405.dll
c:\windows\5382s9yware4z4.cpl
c:\windows\53ddbackdo9z2586.dll
c:\windows\53z37spambot49d.ocx
c:\windows\53z4spar5e31369.dll
c:\windows\53z7threat211659.cpl
c:\windows\5459zor56f2.dll
c:\windows\54abbz9kd5or395.cpl
c:\windows\5512zspambo9774.cpl
c:\windows\5515zir15179.bin
c:\windows\5534bazkdoor439.cpl
c:\windows\5535t9oj1ze.bin
c:\windows\5559worm78z5.cpl
c:\windows\559bsparse9z99.ocx
c:\windows\55a5a9dwarz2598.ocx
c:\windows\55fviz289.bin
c:\windows\56007wo9m4z4.exe
c:\windows\5693adzware1950.dll
c:\windows\5735addwa9e4z4.ocx
c:\windows\57490troj9z5.cpl
c:\windows\576cspars9293z.ocx
c:\windows\57730viru935z.bin
c:\windows\57769troz16f.bin
c:\windows\580bsp9w5re268z.cpl
c:\windows\58135oznlo9der897.bin
c:\windows\58189spyz49.dll
c:\windows\5822not-z-vi5us19b.dll
c:\windows\58798hackt9ol7z0.dll
c:\windows\58858zot-a-v9rus1f1.cpl
c:\windows\58b25hief9882z.exe
c:\windows\58z66virus509.exe
c:\windows\58z8sp5ware695.exe
c:\windows\58zavir12895.dll
c:\windows\5906v9rus4za5.ocx
c:\windows\590zspywa9e858.dll
c:\windows\5925thr5at31z49.dll
c:\windows\593zth5ef239.bin
c:\windows\59876sp92cz.exe
c:\windows\59czb9ckd5or820.dll
c:\windows\5c3ctz95f968.ocx
c:\windows\5c595teal19z5.ocx
c:\windows\5cdbthre9t20115z.dll
c:\windows\5e1d5parze9997.dll
c:\windows\5z1evi95557.bin
c:\windows\5za9vir5205.cpl
c:\windows\60fb5hrea9z7055.dll
c:\windows\610threaz192705.exe
c:\windows\61129pars51z33.bin
c:\windows\61dbbackdooz10995.bin
c:\windows\630f5own9oaderz39.bin
c:\windows\639fzack5oor1408.bin
c:\windows\640a9py5are307z.bin
c:\windows\6431ha95tzol4ba.dll
c:\windows\64a2thre5t15z749.cpl
c:\windows\6582backd5zr28549.ocx
c:\windows\659zdownlo5der410.exe
c:\windows\65b2downloaze5293.cpl
c:\windows\65d6addw5re9z3.cpl
c:\windows\65z0virus299.ocx
c:\windows\66a95hrzat3979.dll
c:\windows\67a4zp5ware509.bin
c:\windows\68z9ha9k5ool20a.cpl
c:\windows\6960zot-a-5irus97.dll
c:\windows\69ecspzwar52365.exe
c:\windows\6a86ste9lz325.cpl
c:\windows\6d395ir25z2.bin
c:\windows\70769zambo5267.ocx
c:\windows\709hacktz9l7e5.bin
c:\windows\7144sparsz90735.exe
c:\windows\7155dzwnloa9er2162.dll
c:\windows\7183sza9bot6015.ocx
c:\windows\74z5s9y5are347.bin
c:\windows\7544spzmbot9cc.ocx
c:\windows\75adad9ware9z5.dll
c:\windows\7617addwar9225z.dll
c:\windows\7651s5ar9e666z.bin
c:\windows\765bspyware17z9.dll
c:\windows\767zw9r52ec.exe
c:\windows\77105iruz329.ocx
c:\windows\7909hack5ozl131.exe
c:\windows\7928thizf151.dll
c:\windows\79bzbackdoor659.cpl
c:\windows\79d5doznloader5685.bin
c:\windows\7c885ddwarz2912.ocx
c:\windows\7e61ste5l208z9.bin
c:\windows\7e9zbackd5or2710.ocx
c:\windows\7eas9eal2z435.bin
c:\windows\7z82threat60995.exe
c:\windows\7z95hacktool20.cpl
c:\windows\80999ac5tool7zc.bin
c:\windows\8196hackzool3535.bin
c:\windows\8303s5yz3d9.dll
c:\windows\84d5ir987z.exe
c:\windows\90055ormz65.cpl
c:\windows\90258zpy695.exe
c:\windows\9029not-a-v5rus299z.dll
c:\windows\90433worm2z5.exe
c:\windows\909wo5m56z.ocx
c:\windows\90z5threat263515.dll
c:\windows\90zasteal454.dll
c:\windows\912zsparse2885.exe
c:\windows\92z83worm7575.ocx
c:\windows\93aspyware202z5.exe
c:\windows\9452ba5kzoor930.exe
c:\windows\94803spam5ot33z.ocx
c:\windows\953z5acktool905.dll
c:\windows\95571spy324z.cpl
c:\windows\95640troj5z15.exe
c:\windows\95675irz506.exe
c:\windows\95z4threat24095.ocx
c:\windows\96295spambot24z.bin
c:\windows\97047no5-a-vizus3c0.bin
c:\windows\9756vir9s55z.exe
c:\windows\975zack9oor715.dll
c:\windows\9775bazkdoor468.bin
c:\windows\9825tr5z6e5.exe
c:\windows\993thrzat53206.cpl
c:\windows\9979zroj5ac.exe
c:\windows\9996spambot3e5z.bin
c:\windows\99zst5al164.ocx
c:\windows\9afdthie511z1.ocx
c:\windows\9azd5hief416.ocx
c:\windows\9e51zpy5are955.dll
c:\windows\9e5hief10z9.ocx
c:\windows\9e6dz59loader405.ocx
c:\windows\9ez2addwar565.ocx
c:\windows\9f3athzef255.ocx
c:\windows\9z054spy545.cpl
c:\windows\9z139virus185.dll
c:\windows\a95stealz94.dll
c:\windows\afdd5wnload9r275z.exe
c:\windows\b64v9r3055z.cpl
c:\windows\b92backd5or9z46.dll
c:\windows\bea5hreat1z930.dll
c:\windows\d55thr9at1315z.dll
c:\windows\d9edownlo9d5z601.bin
c:\windows\dz5downloader3945.ocx
c:\windows\e40adzwa59857.cpl
c:\windows\system32\10915woz945f.ocx
c:\windows\system32\10959zot-a-vi5us792.bin
c:\windows\system32\10983viru9z58.bin
c:\windows\system32\109ezackdoo525939.dll
c:\windows\system32\11692s9z4285.dll
c:\windows\system32\11779pywarz159.cpl
c:\windows\system32\11793n9tza-v5rus444.dll
c:\windows\system32\11easpyw9z5552.dll
c:\windows\system32\120z6n9t5a-virus52d.bin
c:\windows\system32\12612vz5us68d9.dll
c:\windows\system32\12667noz-a-5irus195.bin
c:\windows\system32\12760no5-a-vir9sz0d.exe
c:\windows\system32\12z53not-a-v9ru5290.cpl
c:\windows\system32\13164v9r5z4b2.exe
c:\windows\system32\1319zt9o55d3.cpl
c:\windows\system32\13395roz559.cpl
c:\windows\system32\13605s9a5bot13z.exe
c:\windows\system32\14259virzs57a.cpl
c:\windows\system32\14744v9rus65fz.cpl
c:\windows\system32\147z1hackto5l3d09.exe
c:\windows\system32\14z32hackto59621.exe
c:\windows\system32\14z5troj59d.exe
c:\windows\system32\15000sp91zf.bin
c:\windows\system32\1507895ckzool25e.ocx
c:\windows\system32\1510195oj4a0z.exe
c:\windows\system32\1510thief29z95.cpl
c:\windows\system32\15381spyz93.dll
c:\windows\system32\15769not-a-virus7z95.exe
c:\windows\system32\15858not9z5virus2a3.exe
c:\windows\system32\15daspzwa9e747.cpl
c:\windows\system32\15e0azdwar954.dll
c:\windows\system32\15ezspywar928485.cpl
c:\windows\system32\15fdad9ware29z4.dll
c:\windows\system32\1635v9rz015.dll
c:\windows\system32\16381vir5s7e9z.cpl
c:\windows\system32\16z2vir96855.bin
c:\windows\system32\17054v9ru553z.bin
c:\windows\system32\17195zpambot3cd.ocx
c:\windows\system32\17727sz93ee5.exe
c:\windows\system32\1791spyz75.ocx
c:\windows\system32\181z9tro5924.exe
c:\windows\system32\18826ha9kt5ol4ez.ocx
c:\windows\system32\18917zpam5ot9c6.dll
c:\windows\system32\19056sp9mbot75z.exe
c:\windows\system32\19093spz5c1.cpl
c:\windows\system32\19125vzr9s4e5.exe
c:\windows\system32\19227noz-a-virus3a5.dll
c:\windows\system32\1926w5rm9z.dll
c:\windows\system32\19450noz-a-virus4f0.exe
c:\windows\system32\19561hacktooz628.cpl
c:\windows\system32\1957z5ya3.cpl
c:\windows\system32\1958zir2714.dll
c:\windows\system32\19655vzrus643.exe
c:\windows\system32\19709szy1f75.bin
c:\windows\system32\19748spamb5t9z6.bin
c:\windows\system32\19765hackt5zl570.bin
c:\windows\system32\198309acztool57d.exe
c:\windows\system32\1995iruz66.ocx
c:\windows\system32\1995zworm670.cpl
c:\windows\system32\19z97wo5m589.cpl
c:\windows\system32\1a99ba59dozr2498.dll
c:\windows\system32\1c21t9r5atz8802.cpl
c:\windows\system32\1ca0thze51896.dll
c:\windows\system32\1cd39zars5785.dll
c:\windows\system32\1fd59pyware2z01.bin
c:\windows\system32\1z09s5yware449.cpl
c:\windows\system32\1z259not-a-v5rus4129.dll
c:\windows\system32\1z355spy659.bin
c:\windows\system32\1z519not-a-virus691.bin
c:\windows\system32\1z918spy55f.exe
c:\windows\system32\20597s5amz9t73d.exe
c:\windows\system32\209805ack9ool3cez.ocx
c:\windows\system32\20z25hack9ool4ad.exe
c:\windows\system32\20z39ack5oor3130.bin
c:\windows\system32\21185spzmbot590.bin
c:\windows\system32\21z1359rm4f4.ocx
c:\windows\system32\22391hzcktool259.bin
c:\windows\system32\22418zorm4559.bin
c:\windows\system32\2259z9orm419.dll
c:\windows\system32\225zhac9tool5d2.bin
c:\windows\system32\2275z9pambot3ce5.dll
c:\windows\system32\22835iz9s2f9.ocx
c:\windows\system32\22895s5y10z.cpl
c:\windows\system32\22z93hack5ool62f9.dll
c:\windows\system32\2309not-z-95rus4de.dll
c:\windows\system32\23157zo9m5b7.dll
c:\windows\system32\23338n9t-a-virus3z95.cpl
c:\windows\system32\2342z5ck9oor1555.exe
c:\windows\system32\234z0s95mbot64.dll
c:\windows\system32\23891n5tza-virus558.exe
c:\windows\system32\23915ha9ktoolz23.cpl
c:\windows\system32\23955wzrm2859.dll
c:\windows\system32\24083sz9555.dll
c:\windows\system32\244329i5uz475.bin
c:\windows\system32\24642hacktozl79b5.ocx
c:\windows\system32\24659ddwzre1109.exe
c:\windows\system32\24726spaz5ot1d9.cpl
c:\windows\system32\24779haz5tool456.dll
c:\windows\system32\2494t5iez2200.bin
c:\windows\system32\249z4sp54da.exe
c:\windows\system32\24dtzrea571019.cpl
c:\windows\system32\25076zpamb9t795.exe
c:\windows\system32\25080v5zusc19.ocx
c:\windows\system32\25198spy2bz.ocx
c:\windows\system32\2527zv95us2ef.cpl
c:\windows\system32\25355trojze99.ocx
c:\windows\system32\2546sz9rs5502.exe
c:\windows\system32\2550backd9or1z.dll
c:\windows\system32\25645spz5f79.ocx
c:\windows\system32\2595szeal1675.bin
c:\windows\system32\2595vi59z532.ocx
c:\windows\system32\26388spambz9356.exe
c:\windows\system32\26ct5reatz941.ocx
c:\windows\system32\26z93s5y5c3.bin
c:\windows\system32\27529sz913a.dll
c:\windows\system32\2795hackzool7ad5.dll
c:\windows\system32\27z4s9ambot155.ocx
c:\windows\system32\27z90not-a5vir9s388.dll
c:\windows\system32\28184worz25c9.exe
c:\windows\system32\2838zhacktoo96f5.dll
c:\windows\system32\28419vi5us6zb.exe
c:\windows\system32\28791za5ktool79e9.cpl
c:\windows\system32\28962zro5331.bin
c:\windows\system32\28979ha5ktozl732.cpl
c:\windows\system32\28994vzru9a85.cpl
c:\windows\system32\28c3th9ef24z5.cpl
c:\windows\system32\29058hacktoo576z.exe
c:\windows\system32\29529not-a-virzs569.cpl
c:\windows\system32\29583tzo93ce.dll
c:\windows\system32\296685pamboz5cd.bin
c:\windows\system32\297195irusza1.dll
c:\windows\system32\299bzt9al1533.ocx
c:\windows\system32\29zsteal12759.ocx
c:\windows\system32\2b44addw9re15z5.dll
c:\windows\system32\2b849hi5f149z.cpl
c:\windows\system32\2c07stza95113.exe
c:\windows\system32\2dd8thiz51999.ocx
c:\windows\system32\2ddedow59oazer507.dll
c:\windows\system32\2e67addz9re1595.exe
c:\windows\system32\2f83backdo5r1z89.cpl
c:\windows\system32\2z150v9rus545.ocx
c:\windows\system32\2z25spywar95109.dll
c:\windows\system32\2z36a9d5are1891.dll
c:\windows\system32\30129szy951.bin
c:\windows\system32\305569ot-a-viruz1a9.bin
c:\windows\system32\31536hack5zol69b.ocx
c:\windows\system32\31586viru53bz9.cpl
c:\windows\system32\31704zot-95virus130.ocx
c:\windows\system32\319545pambzt654.ocx
c:\windows\system32\32397spam5o94z.dll
c:\windows\system32\329z5troj2d0.cpl
c:\windows\system32\3355zhre9t28135.cpl
c:\windows\system32\3369haczt9ol457.exe
c:\windows\system32\34785izu94a5.cpl
c:\windows\system32\34z3threa59927.exe
c:\windows\system32\3557zac9tool56d.bin
c:\windows\system32\3649sp5wa9e14z6.cpl
c:\windows\system32\36635te9l2z97.dll
c:\windows\system32\369ddow5lo9zer2197.bin
c:\windows\system32\39249pazbot295.cpl
c:\windows\system32\3946troj54z9.cpl
c:\windows\system32\39686trzjf25.ocx
c:\windows\system32\3991thiez1854.ocx
c:\windows\system32\39bbspzwa5e481.bin
c:\windows\system32\39c5thie9z416.dll
c:\windows\system32\39e5downloader9z3.exe
c:\windows\system32\39f2dow9loa5er148z.dll
c:\windows\system32\39f5t9ief35z4.bin
c:\windows\system32\3aa1ba5k9oorz12.ocx
c:\windows\system32\3c16spywa5ez9399.exe
c:\windows\system32\3cazst5al9003.bin
c:\windows\system32\3de5threat97z00.bin
c:\windows\system32\3fab5a9kdoor6z8.ocx
c:\windows\system32\3z445virus4059.bin
c:\windows\system32\3z54t5re9t7255.ocx
c:\windows\system32\40199acktz5l95.cpl
c:\windows\system32\40895zwnloa9er2740.bin
c:\windows\system32\40cc5parse1z689.ocx
c:\windows\system32\41a9thiefz547.bin
c:\windows\system32\44275ozm17a9.bin
c:\windows\system32\44be9oznloa5er939.ocx
c:\windows\system32\45479tza52195.ocx
c:\windows\system32\4585wormzd69.bin
c:\windows\system32\45f5threat94z49.bin
c:\windows\system32\469bback5oor129z.cpl
c:\windows\system32\46aadd95re2684z.ocx
c:\windows\system32\47515parse154z9.ocx
c:\windows\system32\4956virzs7d7.bin
c:\windows\system32\4985spars510z9.ocx
c:\windows\system32\49d3zpywa5e2185.ocx
c:\windows\system32\4a9zspyware2355.dll
c:\windows\system32\4b1z9hi5f1574.dll
c:\windows\system32\4c895iz1299.cpl
c:\windows\system32\4e09thrzat79375.dll
c:\windows\system32\4ef0d5wnlza9er1857.exe
c:\windows\system32\4f03azdwa5e2938.dll
c:\windows\system32\4z019tea52842.cpl
c:\windows\system32\4z50not-a-vir5s793.ocx
c:\windows\system32\4zbthreat179375.cpl
c:\windows\system32\50191spy6z2.bin
c:\windows\system32\50750hacktzol69b.dll
c:\windows\system32\5078h5ck9ool563z.dll
c:\windows\system32\5094spzrse1335.exe
c:\windows\system32\50ca95wzre3198.cpl
c:\windows\system32\51165izu962a.exe
c:\windows\system32\51659pazse903.cpl
c:\windows\system32\52048haz9tool22c.exe
c:\windows\system32\520bzh9eat58001.bin
c:\windows\system32\5241backdoor2955z.cpl
c:\windows\system32\5309thief2596z.dll
c:\windows\system32\53847wo9m5a3z.exe
c:\windows\system32\53ea9zr1174.exe
c:\windows\system32\5428viru95b3z.cpl
c:\windows\system32\54519orm54z.cpl
c:\windows\system32\546zspyware28965.ocx
c:\windows\system32\54761za9ktool4f5.bin
c:\windows\system32\5486t9reat2z549.exe
c:\windows\system32\5499thie9162z.cpl
c:\windows\system32\54e5zir9955.ocx
c:\windows\system32\551e9ir2z35.ocx
c:\windows\system32\5569vir9z630.dll
c:\windows\system32\56e95ownloader123z.ocx
c:\windows\system32\5704sparse9717z.dll
c:\windows\system32\573bz9kdoor2359.dll
c:\windows\system32\5799hazktool46f.dll
c:\windows\system32\5819virus73z.cpl
c:\windows\system32\5830spambo958z.cpl
c:\windows\system32\587bsp5waze2599.ocx
c:\windows\system32\588dvi93z28.cpl
c:\windows\system32\58f9z9arse3250.exe
c:\windows\system32\59170zpy11e.cpl
c:\windows\system32\5926vir8z2.exe
c:\windows\system32\593bviz15049.exe
c:\windows\system32\5959thizf371.dll
c:\windows\system32\596e9teaz565.dll
c:\windows\system32\599bdownloa5e9282z.exe
c:\windows\system32\59b2vir169z9.exe
c:\windows\system32\59e9spyzare1628.exe
c:\windows\system32\59ezsparse7275.bin
c:\windows\system32\5a68ad9ware18z4.ocx
c:\windows\system32\5a989ackdoor32z2.bin
c:\windows\system32\5azcv5r9393.exe
c:\windows\system32\5b55thie9119z.bin
c:\windows\system32\5b6dow9loadzr510.cpl
c:\windows\system32\5bz2thi5f5539.dll
c:\windows\system32\5c3ad5wzre20089.bin
c:\windows\system32\5d98spywa5e296z.cpl
c:\windows\system32\5dz1ba5kdoor591.cpl
c:\windows\system32\5dz5vir1539.exe
c:\windows\system32\5e0a9parse20z5.cpl
c:\windows\system32\5e3addware324z9.bin
c:\windows\system32\5e3fdowzloader25989.ocx
c:\windows\system32\5e509pyware2z54.bin
c:\windows\system32\5eaa9azkdo5r1504.cpl
c:\windows\system32\5efspaz9e895.ocx
c:\windows\system32\5f59sparse9621z.bin
c:\windows\system32\5z4769irus363.cpl
c:\windows\system32\5z59s5eal1071.dll
c:\windows\system32\5z9dthief3215.ocx
c:\windows\system32\5zcaddwa9e616.ocx
c:\windows\system32\5zcd59ckdoor865.cpl
c:\windows\system32\613cspazse5293.exe
c:\windows\system32\6143wzrm5a19.exe
c:\windows\system32\62f8v9r5z5.ocx
c:\windows\system32\6377b9zkdoo5566.cpl
c:\windows\system32\6503thrzat1479.bin
c:\windows\system32\6541spzw9re159.dll
c:\windows\system32\6552tro93z6.dll
c:\windows\system32\65ba9ddware1549z.cpl
c:\windows\system32\65d8threaz5549.bin
c:\windows\system32\65ezback9oor10695.cpl
c:\windows\system32\6676zackd9or1540.bin
c:\windows\system32\66f5zp9rse2355.ocx
c:\windows\system32\6909hzckto5l275.ocx
c:\windows\system32\6915ba9kz5or998.dll
c:\windows\system32\6959wzrm504.exe
c:\windows\system32\6975threatz2555.bin
c:\windows\system32\69e159iefz07.ocx
c:\windows\system32\6c7fv9r3577z.ocx
c:\windows\system32\6e21ad5ware2492z.dll
c:\windows\system32\6e6czownlo5de9111.exe
c:\windows\system32\6f255zdware1589.ocx
c:\windows\system32\6z82thief35689.cpl
c:\windows\system32\701ct9iez555.cpl
c:\windows\system32\7093thiez155.cpl
c:\windows\system32\73c5threaz9579.exe
c:\windows\system32\7439h9cktzol525.ocx
c:\windows\system32\7475spywaze2929.bin
c:\windows\system32\7577szea92592.bin
c:\windows\system32\7690sp569z.cpl
c:\windows\system32\76979otza-virus7865.ocx
c:\windows\system32\7725not-9-vzrus7e3.cpl
c:\windows\system32\77eeszyw5re649.ocx
c:\windows\system32\78fedoznloa5e91941.exe
c:\windows\system32\7907thzea524579.exe
c:\windows\system32\793z5rm9a.bin
c:\windows\system32\7962spzr5e1346.cpl
c:\windows\system32\7964s5eal125z.exe
c:\windows\system32\7a56sp5rs9223z.dll
c:\windows\system32\7acaaddwarez1095.ocx
c:\windows\system32\7b7a5pywa9ez795.ocx
c:\windows\system32\7d1ftzre5t23919.dll
c:\windows\system32\7dz5vir901.bin
c:\windows\system32\7e28v9rz975.dll
c:\windows\system32\7ee3downzoader39175.exe
c:\windows\system32\7zc69hreat55512.bin
c:\windows\system32\8348spam5oz7a9.cpl
c:\windows\system32\8449vir5sz8.ocx
c:\windows\system32\8z02virus5759.ocx
c:\windows\system32\8z5ba9k5oor1819.dll
c:\windows\system32\9000tzoj5f9.bin
c:\windows\system32\9058troz21b.exe
c:\windows\system32\90858s5yzca.dll
c:\windows\system32\90et5iefz177.cpl
c:\windows\system32\91155wzrm3c5.dll
c:\windows\system32\91c5steal7z5.cpl
c:\windows\system32\91zspar9e915.cpl
c:\windows\system32\92135zeal1199.ocx
c:\windows\system32\92343haczto5l90.ocx
c:\windows\system32\92549worm7z75.ocx
c:\windows\system32\9321zi5us280.dll
c:\windows\system32\93374trz52dd.cpl
c:\windows\system32\93543zr5j6a0.exe
c:\windows\system32\9451sp97z5.ocx
c:\windows\system32\94d5steal245z.dll
c:\windows\system32\95163spzmbot4ab.cpl
c:\windows\system32\95421virus7a6z.dll
c:\windows\system32\9577h5cktozl6f9.exe
c:\windows\system32\9587zhief2144.cpl
c:\windows\system32\95z3w5rm692.ocx
c:\windows\system32\9716hacktozl45a.ocx
c:\windows\system32\972s9e5l2z2.bin
c:\windows\system32\981bacz95or797.cpl
c:\windows\system32\985z5roj7be.ocx
c:\windows\system32\98d7zackdoo52284.bin
c:\windows\system32\9957wzrm5b9.ocx
c:\windows\system32\9af9steaz5505.bin
c:\windows\system32\9b5avir27z9.dll
c:\windows\system32\9b5zdownloader5124.exe
c:\windows\system32\9d67steal1255z.exe
c:\windows\system32\9ez8sp5rse767.bin
c:\windows\system32\9z07hackto9l258.bin
c:\windows\system32\9z60virus589.bin
c:\windows\system32\AbaleZip.dll
c:\windows\system32\az9sparse21845.exe
c:\windows\system32\b055pywa9ez144.dll
c:\windows\system32\caavz59991.cpl
c:\windows\system32\d55backdoorz99.dll
c:\windows\system32\dc5spywzr92514.cpl
c:\windows\system32\drivers\gxvxcfyinbqejwgsxwfvplrmqpdtamiurxyqs.sys
c:\windows\system32\e9zthreat30151.bin
c:\windows\system32\ezbste5l393.exe
c:\windows\system32\f24z5dware2109.ocx
c:\windows\System32\gxvxcbvyfbvrdxunrpxbcbgjduqocemhqnbio.dll
c:\windows\system32\gxvxccount
c:\windows\System32\gxvxchkuekwgoficctxoxhmdbiidrcxuiiwnc.dll
c:\windows\system32\z0053tr9j4d9.dll
c:\windows\system32\z029159y4e.cpl
c:\windows\system32\z1353virus7fb9.ocx
c:\windows\system32\z1355tro5e9.exe
c:\windows\system32\z1877vi5us1219.dll
c:\windows\system32\z2558not-a-virus9c5.bin
c:\windows\system32\z2959h9ckt5ol735.bin
c:\windows\system32\z3855troj2f9.ocx
c:\windows\system32\z45threat8295.cpl
c:\windows\system32\z5209spambot5a4.ocx
c:\windows\system32\z597steal2572.cpl
c:\windows\system32\z5d6b9ckdoo5591.bin
c:\windows\system32\z6372wo9m365.ocx
c:\windows\system32\z715spa5b9t79f.bin
c:\windows\system32\z8228w9rm365.cpl
c:\windows\system32\z8525spy1e9.cpl
c:\windows\system32\z95th9ef1535.bin
c:\windows\system32\z96steal465.exe
c:\windows\system32\z9715ir846.bin
c:\windows\system32\z984ad5ware180.dll
c:\windows\system32\z99cs5arse405.exe
c:\windows\system32\zc87backdoor6599.cpl
c:\windows\system32\zc9eback9oor2589.bin
c:\windows\system32\zd6f5parse979.exe
c:\windows\system32\zff8thie95276.cpl
c:\windows\Tasks\{5B57CF47-0BFA-43c6-ACF9-3B3653DCADBA}.job
c:\windows\z2587wo9m1aa.cpl
c:\windows\z2602hacktool5a9.dll
c:\windows\z2936spy555.cpl
c:\windows\z2965parse2276.cpl
c:\windows\z3599troj4595.exe
c:\windows\z391dow5loader1924.dll
c:\windows\z4eat9reat172165.bin
c:\windows\z529not5a-virus62d.dll
c:\windows\z541steal1694.cpl
c:\windows\z5c9s9arse569.bin
c:\windows\z6491wo95121.exe
c:\windows\z69thief2735.ocx
c:\windows\z6e9back9oo52057.cpl
c:\windows\z73565ro9276.exe
c:\windows\z8033worm594.cpl
c:\windows\z8445p933b.ocx
c:\windows\z8acthi9f955.bin
c:\windows\z94ethreat20587.dll
c:\windows\z9514spamb5t77b.dll
c:\windows\z965virus711.exe
c:\windows\z97195oj7e3.exe
c:\windows\z98635py3a.cpl
c:\windows\z9896spamb5t5aa.ocx
c:\windows\z99bst9al35.bin
c:\windows\z9b5teal1970.exe
c:\windows\za0espar951015.exe
c:\windows\za9dst9al155.cpl
c:\windows\zaf7downl5ader1309.ocx
c:\windows\zb33spy5ar93274.bin
c:\windows\zb529hreat16817.cpl
c:\windows\zb9fspar5e29829.dll
c:\windows\zc7ba9d5are2629.dll
c:\windows\zca0vir9534.dll
D:\Autorun.inf
c:\windows\system32\drivers\kuaiykhu.sys . . . . failed to delete

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_gxvxcserv.sys
-------\Legacy_gxvxcserv.sys
-------\Legacy_kuaiykhu
-------\Service_kuaiykhu


((((((((((((((((((((((((( Files Created from 2010-04-10 to 2010-05-10 )))))))))))))))))))))))))))))))
.

2010-05-10 21:07 . 2010-05-10 21:13 -------- d-----w- c:\users\Owner\AppData\Local\temp
2010-05-10 21:07 . 2010-05-10 21:07 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-05-10 20:31 . 2010-05-10 20:31 -------- d-----w- C:\found.001
2010-05-08 05:23 . 2010-05-08 05:23 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-05-07 09:39 . 2010-04-29 22:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-05-07 09:39 . 2010-05-07 09:39 -------- d-----w- c:\programdata\Malwarebytes
2010-05-07 09:39 . 2010-04-29 22:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-05-05 21:56 . 2010-05-10 21:12 823808 ----a-w- c:\windows\system32\drivers\kuaiykhu.sys
2010-04-28 02:07 . 2010-04-28 02:07 -------- d-----w- c:\program files\iPod
2010-04-28 02:07 . 2010-04-28 02:08 -------- d-----w- c:\program files\iTunes
2010-04-28 02:04 . 2010-04-28 02:04 -------- d-----w- c:\program files\Bonjour

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-07 08:46 . 2010-04-06 07:21 -------- d-----w- c:\programdata\Lavasoft
2010-05-07 07:54 . 2008-01-07 01:28 7620 ----a-w- c:\users\Owner\AppData\Local\d3d9caps.dat
2010-05-06 00:09 . 2009-02-15 18:35 27839 ----a-w- c:\programdata\nvModes.dat
2010-05-02 18:51 . 2007-08-04 10:40 -------- d-----w- c:\programdata\CyberLink
2010-04-28 02:07 . 2008-02-20 02:28 -------- d-----w- c:\program files\Common Files\Apple
2010-04-28 01:57 . 2010-04-28 01:57 73000 ----a-w- c:\programdata\Apple Computer\Installer Cache\iTunes 9.1.1.11\SetupAdmin.exe
2010-04-08 20:20 . 2010-04-08 20:20 91424 ----a-w- c:\windows\system32\dnssd.dll
2010-04-08 20:20 . 2010-04-08 20:20 107808 ----a-w- c:\windows\system32\dns-sd.exe
2010-04-06 11:51 . 2007-12-21 05:56 -------- d-----w- c:\program files\AskPBar
2010-04-06 09:10 . 2007-08-04 11:36 -------- d-----w- c:\program files\Common Files\Java
2010-04-06 09:10 . 2007-08-04 11:36 -------- d-----w- c:\program files\Java
2010-03-31 02:46 . 2010-03-31 02:46 -------- d-----w- c:\programdata\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-03-31 02:43 . 2010-03-31 02:43 -------- d-----w- c:\program files\QuickTime
2010-03-31 02:33 . 2008-07-14 05:02 -------- d-----w- c:\program files\Safari
2010-03-31 02:30 . 2010-03-31 02:30 79144 ----a-w- c:\programdata\Apple Computer\Installer Cache\Safari 5.31.22.7\SetupAdmin.exe
2010-03-15 03:46 . 2009-05-25 12:25 -------- d-----w- c:\users\Owner\AppData\Roaming\ZoomBrowser EX
2010-03-09 11:28 . 2009-05-04 05:35 411368 ----a-w- c:\windows\system32\deploytk.dll
2007-12-21 08:36 . 2007-12-21 08:36 22 --sha-w- c:\windows\SMINST\HPCD.sys
2009-07-01 00:31 . 2007-12-22 09:56 952 --sha-w- c:\windows\System32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-06-14 1004800]

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2009-06-14 23:07 1004800 ----a-w- c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-06-14 1004800]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-06-14 1004800]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-04-19 484904]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-02-16 39408]
"Universal Installer"="c:\program files\ComcastUI\Universal Installer\uinstaller.exe" [2008-03-18 984616]
"Desktop Software"="c:\program files\ComcastUI\Universal Installer\uinstaller.exe" [2008-03-18 984616]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-09-15 1021224]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2007-04-24 176128]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-02-13 159744]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-06-16 75008]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-03-01 472776]
"WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-10 317128]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"SynTPStart"="c:\program files\Synaptics\SynTP\SynTPStart.exe" [2007-09-15 102400]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-12-04 13556256]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-12-04 92704]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-03-17 47392]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-18 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-04-25 142120]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="c:\windows\SMINST\launcher.exe" [2006-11-08 44128]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [2000-1-21 65588]
Vongo Tray.lnk - c:\windows\Installer\{8C3AE2D1-854D-4650-A73D-C7CC7EE36B80}\NewShortcut2_DB7E00C96DEF489A8112D8F81614F45A.exe [2007-8-4 53248]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2007-04-19 20:23 452136 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://espn.com/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=73&bd=Pavilion&pf=laptop
uInternet Settings,ProxyOverride = <local>
uInternet Settings,ProxyServer = http=127.0.0.1:5555
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
DPF: Microsoft XML Parser for Java - file:///C:/Windows/Java/classes/xmldso.cab
DPF: {BCBC9371-9827-11DA-A72B-0800200C9A66} - hxxp://merillat.view22.com/release_3_9_177/View22RTEv4.cab
FF - ProfilePath - c:\users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\8a3dq32g.default\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
.
- - - - ORPHANS REMOVED - - - -

URLSearchHooks-0A94B116-4504-4e26-AB05-E61E474AA38B} - (no file)
URLSearchHooks-CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
HKCU-Run-msttvkdw - c:\users\Owner\AppData\Local\wydtisykr\rlydvcxtssd.exe
HKCU-Run-pnbjptlx - c:\users\Owner\AppData\Local\lmetidmui\rcrukrktssd.exe
ShellExecuteHooks-{EDB0E980-90BD-11D4-8599-0008C7D3B6F8} - c:\windows\Themes\Magic\EuShlExt.dll



**************************************************************************
scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files:

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\WLANExt.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Vongo\VongoService.exe
c:\windows\system32\DRIVERS\xaudio.exe
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
c:\program files\HP\QuickPlay\Kernel\TV\CLSched.exe
c:\program files\Windows Media Player\wmpnscfg.exe
c:\windows\System32\rundll32.exe
c:\windows\system32\wbem\unsecapp.exe
c:\program files\Vongo\Tray.exe
c:\program files\Hewlett-Packard\Shared\HpqToaster.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2010-05-10 14:22:19 - machine was rebooted
ComboFix-quarantined-files.txt 2010-05-10 21:22

Pre-Run: 90,881,105,920 bytes free
Post-Run: 90,462,715,904 bytes free

- - End Of File - - BC39E6E6AC529F13251AACFF25232FDB

Well that was quite a list of things ComboFix found.

Rerun GMER now just like you did the first time and post the log it produces along with running Kaspersky below.





It's important to run this online scan to search for any remnants. It can take some time, so please be patient and allow it to run it's full course:



Please perform a scan with Kaspersky Online Virus Scanner.
-- Requires free Java Runtime Environment (JRE) to be installed before scanning for malware as ActiveX is no longer being used.
-- This scan will not remove any detected file threats but it will show where they are located so they can be cleaned with other tools.

• Vista users need to right-click the IE or FF Start Menu or Quick Launch Bar icons and Run As Administrator from the context menu.
• Read the "Advantages - Requirements and Limitations" then press the ... button.
• You will be prompted to install an application from Kaspersky. Click the Run button. It will start downloading and installing the scanner and virus definitions.
• When the downloads have finished, you should see 'Database is updated. Ready to scan'. Click on the ... button.
• Make sure these boxes are checked. By default, they should be. If not, please check them and click on the ... button afterwards:
  • Detect malicious programs of the following categories:
    Viruses, Worms, Trojan Horses, Rootkits
    Spyware, Adware, Dialers and other potentially dangerous programs
  • Scan compound files (doesn't apply to the File scan area):
    Archives
    Mail databases
• Click on My Computer under the Scan section. OK any warnings from your protection programs.
• The scan will take a while so be patient and do NOT use the computer while the scan is running. Keep all other programs and windows closed.
• Once the scan is complete (the 'status' will show complete), click on View Scan Report and any infected objects will be shown.
• Click on Save Report As... and change the Files of type to Text file (.txt)
• Name the file KAVScan_ddmmyy (day, month, year) before clicking on the Save button and save it to your Desktop.
• Copy and paste (Ctrl+C) the saved scan results from that file in your next reply.

-- Note: Some online scanners will detect existing anti-virus software and refuse to cooperate. You may have to disable the real-time protection components of your existing anti-virus and try running the scan again. If you do this, remember to turn them back on after you are finished.

Are you still with me?

Due to the lack of feedback This Topic is closed.

Should you need it reopened, please contact my by PM. Include the address of this thread in your request.

If you have a new issue, please start a New Topic.

This applies only to the original poster. Everyone else please begin a New Topic.